Warn and reset instead of exiting when a kit manifest is missing

A kit with no manifest under the Sedona home folder called sys.exit(1),
tearing down the whole app over one unopenable file.

schema now raises MissingManifestError instead, collecting every
unresolved kit first so one dialog names them all rather than the user
fixing them one reopen at a time. describe_missing_manifests builds the
body, pointing at the configured Sedona home and at Preferences.

open_file catches it, reports it, and calls the new
reset_to_startup_state to return to the just-launched state: no file,
empty tree, empty sheet, cleared registries and undo stack. The generic
except now resets too, since a half-parsed file previously left
current_file_path and a stale root behind.

Placing a palette component hits the same loader, where a full reset
would be too destructive: it rolls back the <kit> entry it just added,
rebuilds the previous registry, and abandons only that placement.

schema no longer imports sys or tkinter, so it reports nothing itself
and stays testable without a display. base_window_title moves to
app_state so the reset can restore the title without duplicating it.

README: document the new behaviour, drop the fixed gap, and correct the
stale "no undo, no keyboard shortcuts for save" claim.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -47,6 +47,7 @@ not inside the window. Tk always hands it to the system menu bar.
 | `app_state.py` | Preferences, runtime state, widget handles, `mark_dirty`/`mark_clean` | no |
 | `sax_dom.py` | `meta` bit-packing codec, component path resolution | no |
 | `schema.py` | Kit manifest loading, slot inheritance, slot visibility rules | no |
+| `undo.py` | Undo/redo stack of reversible DOM commands | no |
 | `wiresheet.py` | Grid, component boxes, link routing and painting | yes |
 | `sax_file.py` | Open/save, navigation tree, cascading delete | yes |
 | `main.py` | Widgets, menus, event handlers, dialogs, main loop | yes |
@@ -63,10 +64,32 @@ Modules reach shared state as **`app_state.<name>`**, always qualified. A bare
 invisible to every other module. Every mutation of "the document changed" goes through
 `app_state.mark_dirty()`, which also applies the unsaved-state pink canvas tint.
 
+### Undo and keyboard shortcuts
+
+`undo.py` holds a stack of commands that own their DOM mutation in both directions:
+`MetaMoveCommand` (a box drag, or a whole Tidy Layout as one step), `AddComponentCommand`
+(which also removes the `<kit>` entry placing it may have added) and
+`DeleteComponentCommand` (which restores the removed `<link>` entries at their original
+indices, reinserting in ascending order so the indices stay valid). Nothing in
+`undo.py` touches Tk; `main` registers a refresh callback at startup, which is what keeps
+`sax_file` and `wiresheet` free to push commands without an import cycle.
+
+Undoing back to the depth of the last save clears the dirty tint rather than leaving it lit.
+
+| Shortcut | Action |
+|---|---|
+| `Ctrl`/`Cmd` + `S` | Save (direct overwrite) |
+| `Ctrl`/`Cmd` + `Z` | Undo |
+| `Ctrl`/`Cmd` + `Y` or `Ctrl`/`Cmd` + `Shift` + `Z` | Redo |
+| `Del` / `Backspace` | Delete selected component |
+
+Both `Command-` and `Control-` are bound for each, so the same build works on macOS and
+Windows; menu accelerators render as `Cmd` or `Ctrl` per platform.
+
 ### Testing without a window
 
-`app_state`, `sax_dom`, `schema` and `wiresheet` import with no display, so the rules
-can be exercised directly:
+`app_state`, `sax_dom`, `schema`, `undo` and `wiresheet` import with no display, so the
+rules can be exercised directly:
 
 ```python
 import xml.etree.ElementTree as ET
@@ -90,8 +113,14 @@ Each `<kit name="..."/>` in the file's `<schema>` block is resolved to
 highest-sorting file in that directory when the checksum is absent. Slots are
 flattened along the `base` chain, so inherited slots keep their declaration order.
 
-A kit with no manifest directory is currently **fatal** — the app reports it and calls
-`sys.exit(1)`. See [Known gaps](#known-gaps).
+A kit with no manifest aborts **that load only**. `schema.load_schema_kits_and_manifests()`
+raises `schema.MissingManifestError` naming every unresolved kit at once, the caller shows a
+dialog asking the user to check the Sedona home folder, and `sax_file.reset_to_startup_state()`
+returns the app to its just-launched state — no file, empty tree, empty sheet. The app stays
+open, so the folder can be corrected in Preferences and the file opened again.
+
+The same error raised while placing a palette component only abandons that placement: the
+`<kit>` entry just added to `<schema>` is removed and the previous registry is rebuilt.
 
 ### Slot visibility
 
@@ -163,11 +192,10 @@ step, since they are not part of the dragged canvas group.
 
 ## Known gaps
 
-- A kit missing from `<sedona home>/manifests/` exits the whole app rather than warning
-  and declining to open that file.
 - The yellow square in each box header is drawn but wired to nothing; it is the natural
   place for a per-box collapse/expand toggle.
-- No undo, and no keyboard shortcuts for save.
+- Undo covers box moves, adds and deletes. Nothing else pushes a command, so a change made
+  outside those three is not reversible.
 - `on_canvas_release` snaps using the rounded-rectangle polygon's first coordinate,
   which is `x1 + radius` rather than `x1`, so snapping is offset by the corner radius.
 - Slot values are display-only; there is no editing of a slot from the wiresheet.