Profile Portability: implement accepted backup, restore and transfer UX #882

Goal

Implement the Human-accepted Profile Backup / Restore / Transfer UX from #76 / PR #881 under ADR-0041–0044. Milestone v1.1; feature Project V1 · Memory, matching #76. This hub coordinates implementation and does not itself claim runtime capability.

Delivery order

First close canonical-owner gaps through runnable existing-UI slices, then deliver complete-core Export Profile → one .botharness-backup → staged restore-as-new → explicit fresh Bot activation. Do not export a raw live database, a model-only package or a partial core.

1. Reusable Model Presets: existing Profile/model UI → owning SQLite module → restart with stable templates/revisions and unchanged applied Bot snapshots.
2. PersonaBot Registry: existing creation/Profile/plan UI → owning SQLite module → restart with the same identity, permissions and independent applied plans.
3. Roster arrangement: existing section/pin/hide/reorder UI → owning SQLite module → restart and new Client with the same arrangement.
4. Complete-core export / restore-as-new: real Bot mode Settings → verified file → stopped-target staging → cold history/readiness → explicit activation and real reply.
5. Verify Tracer: Preserve model plans in Profile Backup only #505's template and independent Model Plan preservation through that complete-core path.

All children use native sub-issues and blocking edges. Optional Session history, whole-profile replacement, additional repair paths and two-Host transfer are subsequent slices; publish concrete tickets after runtime evidence and Human feedback, not speculative horizontal layers.

Acceptance boundaries

• Runtime children provide actual DSH evidence and wait for Human QA or an explicitly scoped Human merge decision; record visual gaps without claiming genuine visual verification.
• Snapshot/restore authority stays in the owning modules; credentials, executable Plugins and Workspace contents remain excluded.
• Data commit, readiness, authorization and execution remain distinct; restored Bots are cold until explicit Human activation.
• Tracer: Preserve model plans in Profile Backup only #505 remains the model-preservation child of this hub. Its former SoulSnapshot/Export criterion moved to Tracer: publish a Memory Git repo and import through a Bot link #17 per ADR-0131.

Current implementation status — 2026-10-08

• Tracer: persist reusable Model Presets in the Profile database #883 — closed; reusable Model Presets in SQLite merged via Persist reusable Model Presets in the Profile database #888. The Human approved a screenshot exception limited to that ticket.
• Tracer: persist PersonaBot registry and applied model plans in SQLite #884 — closed; Registry and independent applied plans in SQLite merged via Persist PersonaBot Registry and independent model plans in SQLite #891. Human merge approval followed disclosure of missing screenshots; genuine visual verification was not claimed.
• Tracer: migrate roster arrangement to its SQLite owner #885 — closed; roster arrangement merged via Persist Channel roster arrangement in the Profile database #892 after exact-head CI and Human approval with the visual gap disclosed. Production API/SSE and cold restart were verified; actual UI interaction, a second browser Client and screenshots remained unverified.
• 设计：PersonaBot / Channel 破坏性删除与 Purge 依赖契约 #138 / Tracer: delete a PersonaBot with explicit optional Memory erasure #896 / Tracer: purge Channel content with a durable restore-safe ledger #897 — closed; accepted deletion/Purge contract, retained/deleted Memory locators and the production monotonic ledger/checkpoint/union are implemented. Tracer: purge Channel content with a durable restore-safe ledger #897 merged via Complete Channel Content Purge and recovery (#897) #1190; Tracer: export a complete Profile and restore as new with explicit activation #886 uses its real checkpoint and applies it before Messaging.
• Tracer: export a complete Profile and restore as new with explicit activation #886 — closed; complete-core backup, new stopped-target restore and explicit activation merged via #1195 at a7b9773e. Exact-head Linux verification/package preparation passed. Real Generation 72 source reply, backup, shipped CLI restore, target authorization/activation, same-identity reply and cold-restart reply passed. Human explicitly authorized merge after disclosure of the final Settings/localized readiness screenshot and manual-interaction gaps; those gaps remain documented in the PR. This approval is limited to feat(portability): back up full Profiles and restore cold identities #1195, and no release was performed.
• Tracer: Preserve model plans in Profile Backup only #505 — closed; PR #1198 merged as be804da7 after Human authorization. Complete-core regression verifies templates, independent snapshots, Assignment defaults/allowlists/reasoning choices, revisions, credential exclusion and unavailable-route refusal without fallback. Nine local backup tests and exact-head Linux verification passed (3333 tests passed, nine skipped). Actual restored Host model endpoints matched the stopped source; feat(portability): back up full Profiles and restore cold identities #1195 supplies real DSH reply/cold-restart evidence. Remaining Settings visual QA is still documented under Tracer: export a complete Profile and restore as new with explicit activation #886/feat(portability): back up full Profiles and restore cold identities #1195. No release was performed.

Design and verification sources

• Accepted design: Design: Profile Backup / Restore / Transfer UX #76 / PR #881.
• Complete-core verification and disclosed limits: #886 report.
• Merge/task outcome: #886 completion.