Implement command transactions, undo/redo, and minimal atomic saves

[zoeyrose]

Outcome

Make every edit a preconditioned semantic command with reversible history and crash-safe minimal source changes.

Scope and invariants

• Define command IDs, document/project revision preconditions, affected spans/files, semantic before/after, validation, inverse/redo, grouping, and user-facing description.
• Use toolkit lossless transactions so unknown fields, comments, order, formatting outside touched spans, and exact bytes outside the change survive.
• Support multi-file atomic plans, preview semantic/text diffs, dry run, confirmation policy, temporary files, fsync/rename, rollback, and failure reports.
• Handle history invalidation/rebase when files change externally; never replay against unverified revisions.
• Implement bounded undo memory/history, autosave/recovery checkpoints, and sensitive-path redaction.

Acceptance criteria

• Fault injection at every write/rename/fsync step leaves source wholly old or wholly new, never a mixed transaction.
• Property tests verify command inverse/redo where defined and preserve untouched bytes.
• GUI, CLI, and automation use the same transaction engine and diagnostics.
• Undo/redo across document switches and grouped map operations is deterministic.
• Save refuses symlink/path escape, generated paths, stale preconditions, or validation errors without partial write.

Dependencies and parallelization

Depends on toolkit transaction APIs and editor #2/#3. Individual tools/panels can implement commands independently.

Licensing

Editor code/tests are MIT. Verified original past work by an approved MIT provenance grantor may be copied, migrated, or translated under the audited file/component grant; other legacy implementation remains behavior/specification input only. Authored content/assets retain exact licenses.