Add persistency.

This saves Petri Net state, and recovers it later.  Synchronisation may be costly, can we keep it simple?

Complication: Timeout processing needs to be noted, but luckily it can be simply retried immediately after recovery.  Limiting it to at most one timer seems fine.  Since timeouts are also supported for the synchronous event message, this is a true concern.