feat(oauth): support recoverable profile rename

README.md

@@ -528,9 +528,11 @@ Rename a profile without hand-editing every configuration reference:
 miftah profile rename --config ~/.config/miftah/gsc.json --profile google-personal --new-profile google-studio
 ```
 
-The selected profile must already exist and the new name must be distinct and safe. Miftah atomically renames the profile and every configuration-owned reference to it: the durable default, routing rules, routing-plugin bindings, and a configured profile lock. It validates the complete candidate, keeps a recovery backup, and finalizes the configured fail-closed audit lifecycle.
+The selected profile must already exist and the new name must be distinct and safe. Miftah atomically renames the profile and every configuration-owned reference to it: the durable default, routing rules, routing-plugin bindings, configured profile lock, and any native OAuth connection binding. It validates the complete candidate, keeps a recovery backup, and finalizes the configured fail-closed audit lifecycle.
 
-It does not read, move, copy, or delete credentials, provider token caches, profile state, identity records, or OS-vault data, and it does not change an active MCP client session. Miftah refuses to rename a profile with a native OAuth binding because moving its OS-vault credential requires one future atomic lifecycle rather than a configuration-only rename.
+For a native OAuth connection, Miftah moves the credential only between its two exact OS-vault keys and migrates its non-secret connection metadata in the same recoverable local transaction. It never exposes the credential or copies it to configuration, logs, provider caches, profile state, or identity records. Existing MCP clients keep their current session; restart the client to use the new profile name.
+
+If a local interruption leaves that native OAuth rename unfinished, retry the same rename from the CLI or Console surface that started it. Miftah completes the recovery journal only after its required audit finalization succeeds, then asks you to reload the configuration. Do not edit the configuration, vault, metadata, or provider cache to recover it.
 
 In the browser, run `miftah dashboard --config ~/.config/miftah/gsc.json` and choose **Rename an account profile**. In catalog mode, select the configuration again after the write before making another Console change.
 

docs/cli.md

@@ -30,7 +30,7 @@ Documented command names, options, JSON success forms, and exit categories are c
 | `miftah profile list --config <file>` | `--config` | `--config <file>` | Lists the durable default and fixed non-secret metadata for every configured account: name, optional description/tags/policy, and profile-level upstream override names. It only loads and validates configuration; it never resolves secret references, reads credentials, headers, OAuth vault entries, or provider token caches, starts an upstream, or changes configuration. |
 | `miftah profile set-default --config <file> --profile <name>` | `--config`, `--profile` | `--config <file>`, `--profile <name>` | Makes one existing profile the durable default for future Miftah sessions. It performs a guarded replacement with a recovery backup and finalizes a configured fail-closed audit record. Its result omits configuration bytes, profile data, provider paths, and secret references; it never starts an upstream, opens OAuth, or changes profile data, provider caches, or an active client session. |
 | `miftah profile set-description --config <file> --profile <name>` | `--config`, `--profile`, exactly one of `--description` or `--clear-description` | `--config <file>`, `--profile <name>`, `--description <text>`, `--clear-description` | Sets or explicitly clears one existing profile's non-secret description. It validates the candidate and performs a guarded replacement with a recovery backup and configured fail-closed audit record. The public result omits configuration bytes and the submitted description. It never starts an upstream, opens OAuth, resolves credentials, changes routing/default selection, or changes provider caches or an active client session. |
-| `miftah profile rename --config <file> --profile <name> --new-profile <name>` | `--config`, `--profile`, `--new-profile` | `--config <file>`, `--profile <name>`, `--new-profile <name>` | Renames one existing profile and every configuration-owned durable reference: the default profile, routing rules, routing-plugin bindings, and configured profile lock. It validates the candidate and performs a guarded replacement with recovery backup and configured fail-closed audit. It never starts an upstream, resolves, moves, copies, or deletes credentials, provider caches, profile state, identity records, or an active client session. A configured native OAuth binding causes `PROFILE_RENAME_OAUTH_CONNECTION`: Miftah refuses to split configuration rename from OS-vault credential migration. |
+| `miftah profile rename --config <file> --profile <name> --new-profile <name>` | `--config`, `--profile`, `--new-profile` | `--config <file>`, `--profile <name>`, `--new-profile <name>` | Renames one existing profile and every configuration-owned durable reference: the default profile, routing rules, routing-plugin bindings, configured profile lock, and native OAuth connection bindings. It validates the candidate and performs a guarded replacement with recovery backup and configured fail-closed audit. For native OAuth, it moves the credential only between exact OS-vault keys and migrates non-secret metadata through one recoverable local transaction; it never exposes a credential or copies it to config, logs, provider caches, profile state, identity records, or active client sessions. If a local interruption leaves the transaction unfinished, retry the same rename from the CLI; Miftah completes recovery only after required audit finalization, otherwise returns `OAUTH_PROFILE_RENAME_RECOVERY_REQUIRED` (exit 1). Do not hand-edit the configuration, vault, metadata, or provider cache. |
 | `miftah profile remove --config <file> --profile <name>` | `--config`, `--profile`; `--replacement-profile` when the profile has durable references | `--config <file>`, `--profile <name>`, `--replacement-profile <name>` | Removes one configured profile only when another remains. It requires an explicit different existing replacement before it changes a durable default, routing rule, routing-plugin binding, or configured profile lock; it performs one guarded replacement with recovery backup and fail-closed audit. It never resolves or deletes an underlying secret, provider cache, token cache, or active client session. A configured native OAuth binding causes `PROFILE_REMOVAL_OAUTH_CONNECTION`: configuration and OS-vault cleanup are not split by this generic command. |
 | `miftah profile test --config <file> --profile <name>` | `--config`, `--profile` | `--config <file>`, `--profile <name>`, `--upstream <name>` | Runs only the selected provider adapter's declared read-only readiness check and writes its redacted report. It never accepts an arbitrary tool name, exposes provider output, changes configuration, reads provider token caches, or opens a browser. `--upstream` is required only when the configuration has multiple upstreams. It exits `0` only for `ready`; other bounded readiness results exit `1`. |
 | `miftah connection add --config <file>` | `--config`, `--profile`, `--issuer`, `--client-registration` | `--connection <ref>`, `--upstream <name>`, repeated `--scope <scope>`, `--write` | Plans a v3 OAuth binding by default. `--write` applies the reviewed candidate with a unique recovery backup and configured audit event. It never resolves credentials or starts an upstream. |