Backup restore can silently skip exported user preferences

[pzauner]

The ZIP exporter and restore parser currently define their accepted preferences separately. When those schemas drift, a preference can be written into a valid backup but silently ignored on a fresh restore. That is especially risky for the Pastiera → Plektra transfer because a completed restore can appear successful while part of the user's state is missing.

Expected behavior:

• one central, typed source of truth defines exportable user preferences and their value types;
• dynamic user-owned prefixes are classified explicitly;
• internal UI markers and cache/performance preferences are explicitly excluded rather than incidentally omitted;
• a contract test exports a rich source state and restores it into a fresh target;
• every exported user preference is recognized, and semantic state such as dictionaries, replacements, layouts, input styles, themes and ordinary settings is effective after restore without an unnecessary restart.

Local unmerged work in 996d2be8 and 323d8ab2 implements the contract and immediate restored-input-style registration. A fresh-data T2 ZIP roundtrip completed with zero unknown/skipped user preference keys and runtime verification of the restored dictionary, replacement, Cyrillic layout/input style and theme library. The issue should remain open until those changes are reviewed, merged and released.

Agent disclosure: This investigation, implementation, on-device verification, and issue creation were performed by an AI coding agent under explicit maintainer direction.

[pzauner]

The complete local backup-contract fix and review-hardening series is now implemented and verified:

• 996d2be8 defines the central typed exportable-preference contract and explicit dynamic/excluded classifications.
• 323d8ab2 immediately refreshes restored user dictionaries and registers restored custom input styles.
• 9fb46fce prevents existing target preferences from expanding the accepted restore schema.
• 9341a82c classifies all SettingsManager.KEY_* values and transfers a validated custom typing-sound pack as an exact rollback-capable unit.
• 0133ea73 enforces component-aware canonical ZIP extraction containment and rejects absolute entries.
• 4335fea8 bounds actual extracted entry count, per-entry bytes, and total uncompressed bytes.

The final integrated T2 regression used Nightly 0.86-nightly.20260830.161026 (versionCode 1788106226). A rich archive containing dictionary/replacement state, three safe-ID layouts, three saved themes, and a real five-file Vorbis custom sound pack was restored into freshly cleared Nightly data through the ordinary UI. Restore logging contained zero unknown or skipped user-preference keys. Restored custom subtypes were registered immediately; Cyrillic input, the unique text replacement, the dictionary suggestion, and Theme-library selection were effective without an app or device restart. Sound mode/output/display metadata and exactly the five archive samples were restored; reloading the IME created five Vorbis decoders and reached input EOS for all five, with real normal, space, delete, enter, and modifier key events and no SoundPool, load, or sample-decode failure. The complete testStableDebugUnitTest suite passes.

These commits are local and unmerged; this issue remains open until review, merge, and release.

Agent disclosure: This implementation, verification, and issue update were performed by an AI coding agent under explicit maintainer direction.