[Draft] Concept upload history + rollback (P2-1)

[mvkonchits-db]

DRAFT — not for review yet. Stacked on the diff engine (#705, which is itself on the versioning engine #703). Merge order: #703 → #705 → this. Held from review-ready until the full stack passes E2E together.

What this is (P2-1)

Records every file re-upload as an auditable event, and lets a steward roll one back. Backend only. Composes the diff engine's machinery — one new table (upload_event), one migration (m5), single alembic head.

Rollback is FORWARD, never a delete

The store is snapshot-per-version and append-only, so "roll back upload #N" does not delete anything — it re-applies each concept's pre-upload state as a NEW bulk versioning event. The rollback is itself recorded (auditable, and itself roll-back-able).

• upload_event: {id, context_name, created_at, created_by, summary(JSON diff counts), concept_prev_state(JSON: per-concept {iri, prev_version|null, prev_status|null, bucket})}.
• Record hook: apply_upload_as_versioning_event captures prev-state before mutation and writes the event inside the same atomic closure — so an upload that rolls back writes no event.
• Inverse mapping: modified (had prev_version V) → publish_concept_version re-publishing V's frozen triples; new (was absent) → deprecate_concept (tombstone, never hard-delete); removed (was deprecated) → restore prior status.
• Atomicity reuse (not duplicated): the diff engine's commit→flush / one-real-commit / rollback-and-rebuild-on-exception block was refactored into a shared _run_atomic_bulk_event(context, work_fn); both re-upload and rollback call it. commit is restored on both the except and finally paths.

Endpoints (above the /concepts/{iri:path} catch-all)

• GET /semantic-models/uploads?context=<ctx> (READ_ONLY) → newest-first [{id, created_at, created_by, summary}].
• POST /semantic-models/uploads/{event_id}/rollback (READ_WRITE + editable gate) → {event_id, rolled_back, summary}.

Tests — test_upload_rollback.py, 6 passed; diff-engine regression 6 passed (wrapper refactor safe)

event recorded with correct prev-state · rollback of a modified upload restores the prior definition + mints a new version · rollback of an add deprecates (tombstone, resolvable) · rollback of a remove restores active · rollback recorded as a new event · mid-rollback failure leaves the store unchanged.

Not included

• No REST-route upload E2E (orchestrator driven directly in tests); full deployed-app E2E happens with the stack.
• No UI (an "Upload history / Roll back" surface is a separate follow-up).

This pull request and its description were written by Isaac.

[mvkonchits-db]

Superseded by the concepts-v2 redesign (#734): the upload_event/rollback approach here was replaced by the upload_preview mechanism on feat/concepts-v2 (p1_upload_preview migration, upload_preview model/repository, orphan-version self-heal). Closing as obsolete. Note: #704 (reference-reconciliation split/merge) stays open — its worklist logic is not yet in #734.