Restore named project snapshots

docs/project-history-and-external-model-architecture.md

@@ -88,6 +88,15 @@ Implemented named-snapshot foundation:
 - snapshot creation/listing does not create a project revision or affect
   undo/redo eligibility
 - public Create/List endpoints expose metadata but not the logical payload
+- restore verifies the stored checksum and a hash of the complete current
+  state before replacing supported project data in one transaction
+- restore records a new `restore` revision containing both the selected target
+  state and the complete pre-restore inverse; undo/redo therefore remains
+  available after application restarts
+- compatible upgrade-only Consumer links, mappings and reports are preserved
+  separately and are never imported into the logical snapshot payload
+- arbitrary restore payloads are rejected by the generic user-command
+  endpoint; only server-stored snapshots can initiate a forward restore
 
 ## Revit / CSV / IFCGUID Round-Trip Direction
 
@@ -243,7 +252,7 @@ Completed foundation:
 
 Remaining constraints before completing project version history:
 
-- add a browsable timeline/snapshot UI, periodic snapshot policy and restore
+- add a browsable timeline/snapshot UI and periodic snapshot policy
 - extend project-scoped commands only when further project mutations are
   deliberately added to history; the generic versioned envelope is complete
 - do not model IFCGUID as an overloaded circuit equipment identifier