pfSense CARP config sync overwrites direct edits on secondary node

A pfSense CARP cluster with configuration synchronization enabled treats the primary node's config.xml as authoritative. The goal is to determine whether configuration changes made directly on a secondary or backup node survive the next XML-RPC sync cycle, or whether they are silently discarded.

Behavior may differ between pfSense CE and pfSense Plus and across major versions. A failed or silent sync can leave the secondary running a divergent configuration without an obvious default dashboard alert. CARP interface tracking and demotion settings control failover but do not prevent configuration overwrite during sync.

Does a direct edit on a secondary node persist after synchronization completes? What conditions cause the primary to overwrite secondary-specific settings? Is there a supported way to preserve secondary-only configuration while keeping sync enabled?