Expand description
Undo/redo engine (step 6): the user-facing payoff of everything upstream.
Model: each protected action carries PRE manifests (state before the command — undo restores these) and POST manifests (state after — redo restores these, and they answer “is the world still as the action left it?” for conflict detection). The journal’s bounded chain semantics do the bookkeeping: undo is itself a journaled action; redo = undo of the undo; undoing a redo is refused with a pointer to the original.
Safety posture:
- conflict-checked by default: if the touched paths changed since the action (user edits, later agent actions) — or if the action failed and left no post-state to verify against — refuse unless –force;
- all-or-nothing and restore-BEFORE-record: a partial failure rolls the restored paths back and returns an error WITHOUT recording, so the target stays retryable and the journal never claims an undo that only half happened;
- dry-run plans without writing anything, journal included.