Memory-safe Rust code with clear error handling.
Recent revisions are kept. Restoring one creates a new revision.
