Phase 2 sub-commit 3: full Update Semantics + ReactiveListModel + AppShell

BackendConnection's ConnectionState enum is now Connecting / Online /
Reconnecting / Offline (PLAN.md §5). The probe loop tracks the first
failure since the last Online and transitions to Reconnecting on any
failed probe, then to Offline once the configurable threshold (30 s
default) is exceeded. The Error state is gone; Reconnecting + the
exposed `error` string subsume its UI role.

ReactiveListModel is the headline QML type:

- QAbstractListModel that GETs `baseUrl + source` for an initial JSON
  array and then keeps in sync via an internal MercureClient subscribed
  to `topic`.
- Role names are derived dynamically from the first row's keys plus an
  internal `pending` boolean role used by optimistic mutations.
- Diff application: upsert (insert-or-update), delete, replace; gap
  detection via the envelope `version` field with auto re-fetch.
- `invoke(method, path, body, optimistic)` is the optimistic command
  primitive. Generates an Idempotency-Key, applies the local diff,
  POST/PATCH/DELETEs with that key, and resolves on the matching
  Mercure echo (correlation-key matched in ModelPublisher's envelope).
  Rolls back and emits commandFailed on 4xx/5xx, commandTimedOut after
  10 s without an echo. Phase 4 packaging will surface configuration
  for the timeout.

AppShell.qml is the optional convenience root:

- Reads BackendConnection.connectionState.
- Reconnecting → top banner.
- Offline → modal overlay with the error string and a Retry button
  (calls BackendConnection.restart()).
- Wraps user content via `default property alias content`.

Apps that want full chrome control can skip AppShell entirely; the
skeleton's Main.qml keeps its own status display for demonstration
and is unaffected.

ReactiveObject (single-entity twin of ReactiveListModel) is intentionally
deferred — same envelope handling, smaller surface; will land in Phase 2
follow-up or Phase 3 alongside the todo example. Cursor pagination is
similarly deferred (the Phase 2 done criterion uses small lists).

Smoke tested: /healthz + /api/ping round-trip cleanly, zero Mercure 401s,
clean shutdown. composer quality stays green (16 tests, 45 assertions).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

framework/qml/src/BackendConnection.h

@@ -1,5 +1,6 @@
 #pragma once
 
+#include <QElapsedTimer>
 #include <QObject>
 #include <QString>
 #include <QtQmlIntegration>
@@ -37,13 +38,16 @@ public:
     };
     Q_ENUM(Mode)
 
-    /// Phase 1 surfaces only Connecting / Online / Error. The full enum
-    /// (Reconnecting, Offline) lands with the Update Semantics layer in
-    /// Phase 2 (PLAN.md §5).
+    /// Full Update Semantics enum (PLAN.md §5).
+    ///   - Connecting   : initial state until first probe response
+    ///   - Online       : last probe succeeded
+    ///   - Reconnecting : ≥1 probe failed since last success; backing off
+    ///   - Offline      : reconnect failures exceeded the threshold (default 30 s)
     enum class ConnectionState {
         Connecting,
         Online,
-        Error,
+        Reconnecting,
+        Offline,
     };
     Q_ENUM(ConnectionState)
 
@@ -86,6 +90,8 @@ private:
     QNetworkAccessManager* m_nam = nullptr;
     QNetworkReply* m_pendingReply = nullptr;
     QTimer* m_retryTimer = nullptr;
+    QElapsedTimer m_firstFailureSinceOnline;  // not started while Online
+    int m_offlineThresholdMs = 30000;
 };
 
 } // namespace PhpQml::Bridge