Add persistent history stacks

docs/project-history-and-external-model-architecture.md

@@ -160,16 +160,24 @@ Completed foundation:
 - integration tests apply the generated inverse as a new `undo` revision and
   verify rollback for stale revisions and late history failures on both update
   command types
+- project-scoped relational undo/redo stacks persist eligible original change
+  sets independently from immutable audit revisions
+- stack transitions enforce LIFO order, keep undo/redo revisions out of the
+  eligibility stacks and clear the redo branch on a new user command
+- domain writes, audit revisions and stack transitions share one transaction;
+  a forced stack failure rolls all of them back
+- `GET /api/projects/:projectId/history` exposes current revision, stack depths
+  and top change-set ids without enabling mutation endpoints
 
-Remaining constraints before implementing history:
+Remaining constraints before completing persistent history:
 
 - extend the concrete project-scoped command union and executors beyond the
   internal Circuit and CircuitDeviceRow update slices; the generic versioned
   command envelope is complete
-- route domain writes and revision recording through one shared project
-  transaction boundary; the current revision repository only commits history
-  records and the counter together
-- expose revision state and history eligibility through the application API
+- route the remaining structural, synchronization and destructive domain
+  writes through the shared command, revision and stack transaction boundary
+- add public command execution plus undo/redo endpoints; read-only revision and
+  stack eligibility state is already exposed
 - replace the session-local frontend command stack only after server-side
   command execution and inverse application are complete
 - do not model IFCGUID as an overloaded circuit equipment identifier