Tier 2: Version-history + rollback revision model (separate from apply-time snapshots)

[NickCrew]

Summary

Build a navigable revision stack + rollback per AI-generated artifact — the
safety axis in the AI-action-verbs design. Tier 2 work from
docs/development/design/ai-action-verbs-and-sharpen-mechanic.md
(Status: Proposed, 2026-06-21).

Why

The design's unlocking decision: quality and safety are orthogonal. The quality
axis is which generation mode runs (Sharpen / Refresh / Start over). The safety
axis is version history + rollback, always on. Once rollback exists:

• The data-safety reason for the conservative "Refresh" mode evaporates.
• Sharpen becomes safe to run confidently — nothing is irreversibly lost.
• The user's control becomes post-hoc time-travel ("I liked v2, restore it"),
  not a verb toggle before the fact — which sidesteps the false-choice trap where
  users reach for the verb that feels safe and silently forfeit quality.

This issue is therefore a prerequisite for flipping Sharpen on as the default.

Do not overload apply-time snapshots

resumeStore.snapshots / coverLetterStore.snapshots exist today, but per
ADR-0005 they are apply-time immutability records — one permanent, frozen
"what I submitted" record created when a pipeline entry transitions to applied.
That is a different lifecycle:

• Apply-time snapshots — permanent, legal-ish "what I sent" records. Never pruned.
• Revisions — an ephemeral, prunable undo stack snapshotted before each
  Sharpen / Start over / Refresh.

Different retention rules → do not share the *Snapshot types. Lean toward a
separate revision model. No retention/prune logic exists anywhere today; this is
net-new and touches storage growth (persistence-tier work).

Scope

• A per-artifact revision model (separate from *Snapshot), snapshotted before
  each destructive AI generation.
• User-browsable revision list with restore.
• A retention/prune policy (the design leaves N-revisions vs time-window vs both as
  an open question — decide here).

Open questions to resolve here

1. Scope — which artifacts get a revision stack? (cover letters + prep decks
   for sure; theses, resumes, identity sections TBD.)
2. Retention — N revisions, a time window, or both?

Acceptance criteria

• A revision model distinct from apply-time *Snapshot exists, with its own
  retention rules.
• A revision is captured before each Sharpen/Start over/Refresh on covered
  artifacts.
• The user can browse revisions and restore a prior one.
• A retention/prune policy is implemented and documented.
• Persistence migration/normalization coverage for the new model.

Design: docs/development/design/ai-action-verbs-and-sharpen-mechanic.md
Related: #31 (Tier 1 standardization), Sharpen generator path (#92, blocked on this for default-on)