Browser: preserve private profile state through reopen, transfer and deletion #292

Runtime keeps each principal's Browser profile private and durable. A committed profile reopens after Close, crash or supported update; explicitly authorized transfer and deletion retain the same ownership and protection rules.

Goal: private durable profiles. Lane: Contract and source. Own B12.A1–A4, profile-specific B15.A2 and remote/local integration proof. #131 owns the immediate first-use transaction and native disk lease repair; #87 consumes local persistence, while this task owns the full profile contract.

Scope and milestones

Keep immutable Engine capsules separate from mutable rooted principal state and writer leases. Start local durability/isolation tests from existing profile descriptors. Consume #131's accepted transactional first-use/settlement output, the delivery generation output for upgrades, and the first remote service result for granted transfer. Full parent closure is unnecessary for compatible milestone integration.

#217 compares a signed validated empty ext4 template against guest initialization of an unpublished sibling. It selects the smaller complete crash-safe path with filesystem/size/features/sparse-copy/capacity proof. This task accepts the producer decision rather than imposing a new generic profile manager or ambient host formatter. Existing verified four-member images and unknown retained profiles keep explicit compatibility/recovery treatment.

Use the existing protected object/key/rights mechanisms for authenticated encrypted transfer and protected storage. Remote state placement follows an explicit grant. #209's broader protection from a hosted operator remains its own scheduled gate; a VM disk or opaque UI frame does not prove encryption or hosted confidentiality.

Done means

• Cookies, advertised history/settings, localStorage and IndexedDB persist through normal reopen, abrupt crash/restart and each supported update/migration.
• Cross-principal inspect/modify/substitute attempts fail. Concurrent writers acquire exact principal/profile leases; uncertain cleanup preserves the conflicting lease.
• Interrupted creation/migration preserves the last committed profile and actionable recovery. A working profile is published only after verified durable preparation.
• Advertised export/import/checkpoint transfer is authenticated, encrypted, grant-bound and bound to profile/package compatibility; both ends verify before activation. Refused, interrupted and revoked cases preserve committed state.
• Ephemeral close, explicit deletion, retention and replication cleanup satisfy the original B12.A4 semantics; verification covers every advertised retained copy and key policy.
• The actual supported Linux/Jetson path has Runtime persistent-profile binding where advertised. Mac evidence is separate; protection claims match tested key/storage boundaries.

Next experiment: fail profile preparation before and after each publish/flush boundary under the existing exclusive rooted lease; prove that reopen sees either the last committed state or typed recovery, then test two principals/writers.

Ownership and acceptance

Product owner: Anders (@andersalm). Part of Browser mission #283, acceptance revision Browser-2026-10-07-R1. The complete original criterion text and numerical budgets in #283 remain authoritative. This task supplies the stated contribution; shared-producer and full-mission acceptance remain open.

Record one execution owner, lane, approved task base/PR target, file scope, exact candidate and resource lease before implementation. Planning uses fetched develop 1828919980b1af1d60895c6cee178f769daed74c; existing branches retain their approved bases/history. Keep at most one active task per Browser lane. New tasks start in Backlog; #131 remains the installed-product task.

Runtime owns admission, principal/grants, placement, routing, resource limits, lifecycle and audit. Engine executes and renders websites and owns website TLS; the selected Exit performs authorized DNS and destination streams. Carrier carries off-box traffic below the same contract. Immutable signed capsule/dependency identity and separately rooted mutable profiles retain their distinct owners.

Verification and closeout

Use the smallest behavior tests that exercise the changed boundary. Freeze the affected input closure, then batch one needed build under the shared Mac lease. Reuse the verified image/helpers when inputs match. Source presence and prepared fixtures provide bounded evidence; installed acceptance binds source commit/tree, built/installed/served hashes, package/image/helper manifests, device/client/adapter versions, selected Engine/Exit, placement/network, commands, failures, cleanup and matching media/manual evidence.

Use one isolated Mac test owner and the authorized Mac/Jetson targets; existing Namespace is an optional x86 fallback. Other physical role/network rows remain unverified until their evidence exists. OMP and existing Homes keep their owners. Disposable fixture signing uses separate trust; production signing, existing-Home changes, release and deployment retain their approval gates.

Before reporting, update this issue with passed, failed, pending, exact candidate and next experiment; use 30-minute checkpoints during sustained execution. Full closure requires accepted behavior, resolved findings, required independent review, applicable irzhywau/security/signing review and human UX/media review, and a merged implementing PR. Applicable #173 changes retain its approval and different-model-family adversarial review gate. All #283 hardware/media/soak/second-maintainer gates remain intact.

Related Browser outputs: #131 first-use/reopen output; #288 compatible delivery; #291 ordinary remote service; #293 protection/deletion qualification.