Revisions, manifests, and rollback

Reproducible history for every write and every publish. Restore a CDN tag without rewriting the editor.

LexiSync treats every meaningful write and every publish as reproducible history — not a silent overwrite. That lets you inspect origin, diff releases, and restore a CDN tag without rewriting the editor.

What happens on write

Dashboard cell save, CLI sync, and AI translate all go through one write path.
Each change appends a TranslationRevision (value, origin, actor). Origins: human, ai, sync, import, restore, system.
When the source / reference language changes, a SourceRevision is created and other languages for that key are marked stale (plus a quality issue stale_target).

What happens on publish

Build a PublicationManifest with one entry per key × language: revision IDs + a frozen value snapshot.
Enqueue an OutboxEvent publish.artifacts in the same DB transaction.
Process the outbox: upload Blob slices and upsert PublishedCatalog. Retries are idempotent (content-hash objects; same outbox key).

Idempotency

Pass optional idempotencyKey on POST /api/publish so a retried client request does not create a duplicate successful publish. Failed materialize can be retried with { "action": "retry_outbox" }.

Two kinds of “restore”

Action	Touches working copy?	Touches CDN?	Where
Restore to CDN	No	Yes — rewrites the version tag from a prior manifest	Project → Releases & history
Restore revision	Yes — new revision with origin=restore	No (until you publish again)	Key history drawer

Restore to CDN is the safe production rollback: apps pinned to production serve the frozen snapshot again. Your in-progress editor strings stay as they are.

Dashboard: Releases & history

List every publication manifest (status, source, actor, entry count).
Restore to CDN on a published manifest (confirm dialog).
Diff A vs B — added / removed / changed entries between two freezes.
Per-cell history — revision list with inline diff vs previous + restore into the working copy.