arcane-os 0.2.2 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.2.3
+
+- Made shared voice transcription consume authoritative sticky STT state,
+  expose explicit selected-unloaded activation, and keep recording disabled
+  until the selected route is genuinely ready and non-busy.
+- Added owned cancellation and current-operation guards across microphone
+  permission, recording, transcription, save, completion, transcript
+  replacement, synchronous public events, teardown, and stale settlement.
+- Centralized the shared STT activation control in
+  `createSTTActivationController()` without automatic downloads, hidden
+  provider selection, or application policy.
+
 ## 0.2.2
 
 - Corrected latest-request-wins ownership so each newly admitted AI request

package/README.md

@@ -19,7 +19,7 @@ version-locked SDK runtime, while an integrated Arcane checkout uses its live
 `arcane/` runtime. Both profiles preserve the same app URLs, theme, packaging,
 event, cancellation, and browser run contracts.
 
-This checkout defines the `0.2.2` SDK contract. Applications pin one exact npm
+This checkout defines the `0.2.3` SDK contract. Applications pin one exact npm
 version and lockfile; registry state is deliberately not baked into immutable
 application artifacts.
 
@@ -132,7 +132,7 @@ uses the same controller for automatic memory extraction.
 Create a new repository-shaped Arcane application with the exact stable SDK:
 
 ```bash
-npx arcane-os@0.2.2 new my-app --path ./my-app --target portable --git
+npx arcane-os@0.2.3 new my-app --path ./my-app --target portable --git
 cd my-app
 npm install
 npm run check
@@ -143,7 +143,7 @@ To enroll an existing repository, install the exact SDK and initialize only
 missing Arcane files:
 
 ```bash
-npm install --save-dev --save-exact arcane-os@0.2.2
+npm install --save-dev --save-exact arcane-os@0.2.3
 npm exec -- arcane init my-app --target portable
 ```
 
@@ -159,7 +159,7 @@ npm exec -- arcane-os targets
 No global SDK install or standalone Arcane CLI is required. The application
 repository's exact npm dependency and lockfile own the CLI and toolchain version.
 
-Use `npx arcane-os@0.2.2` for the initial bootstrap because it names this npm
+Use `npx arcane-os@0.2.3` for the initial bootstrap because it names this npm
 package explicitly; bare `npx arcane` outside an installed project could resolve
 a different package. Both installed commands invoke the same headless toolchain.
 Project-local npm scripts use the SDK pinned by that app's `package-lock.json`,
@@ -180,7 +180,7 @@ node ./bin/arcane.mjs new local-app --path ../local-app --target portable --git
 
 # From the generated app repository
 cd ../local-app
-npm install --save-dev --save-exact ../arcane-os-sdk/arcane-os-0.2.2.tgz
+npm install --save-dev --save-exact ../arcane-os-sdk/arcane-os-0.2.3.tgz
 npm run check
 npm ci
 ```
@@ -191,7 +191,7 @@ still verifies the installed package name and exact version, the locked runtime
 identity, and the runtime bytes. Local directory `file:` dependencies are not
 accepted because npm may install them as links; use a packed `.tgz`. A GitHub
 runner also needs that tarball at the locked path. After publication, replace
-the local declaration with the exact `arcane-os@0.2.2` registry package and
+the local declaration with the exact `arcane-os@0.2.3` registry package and
 commit the regenerated lock.
 
 Generated repositories use `npm ci --ignore-scripts` in CI. Run dependency
@@ -304,7 +304,7 @@ recorded length through a final identity check; an appended byte, concurrent
 growth, path replacement, or hard link fails closed. NFC paths use defined
 UTF-8 byte ordering, covered by one pinned golden bundle digest on every
 supported Node/runner combination. This SDK accepts only the explicitly listed
-`0.2.2` bundle generation; structural validity does not imply cross-SDK
+`0.2.3` bundle generation; structural validity does not imply cross-SDK
 compatibility, and a release with zero payload bytes cannot be created. Portable
 path validation rejects file/directory prefix conflicts, case-colliding prefix
 spellings, and Windows device aliases including superscript COM/LPT digits.
@@ -350,7 +350,7 @@ package installation, or assertions.
 
 ## Current target support
 
-Version `0.2.2` exposes one browser target and five explicitly paired
+Version `0.2.3` exposes one browser target and five explicitly paired
 native development targets: a verified non-runnable portable directory, a
 Windows x64 unsigned-local-test EXE bundle, Linux x64 and Linux ARM64
 unsigned-local-test DEBs, and an Android development-signed APK. The

package/browser-runtime/ARCANE_SDK_BROWSER_RELEASE.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
   "builder": "arcane-sdk-browser-runtime-v1",
-  "sdkVersion": "0.2.2",
+  "sdkVersion": "0.2.3",
   "source": {
     "authority": "arcane-os-sdk",
     "repository": "https://github.com/TheWizardNexus/arcane-os-sdk.git",

package/docs/architecture.md

@@ -200,7 +200,7 @@ length with an EOF growth probe, and rechecked by handle and pathname identity.
 Every cumulative path prefix has one case-folded spelling and one file/directory
 kind; prefix topology conflicts and the complete portable Windows device-name
 set fail before creation or admission.
-The current SDK admits only the explicitly compatible `0.2.2` bundle
+The current SDK admits only the explicitly compatible `0.2.3` bundle
 generation and rejects zero-byte payload releases.
 
 Promotion retains any prior output as an identity-bound backup until the new
@@ -320,7 +320,7 @@ through SDK-bound verified readers rather than accepting a mutable source path
 as authority. Build completion requires provider verification, and later
 verify/run calls receive the exact artifact receipt.
 
-The SDK `0.2.2` runtime requires Arcane `0.8.12` or newer. Compatibility
+The SDK `0.2.3` runtime requires Arcane `0.8.12` or newer. Compatibility
 is contractual rather than exact-version pinning: the prepared Core must meet
 the highest minimum declared by the runtime, selected app, and bundled app
 dependencies; keep each app's Arcane protocol generation; and provide every

package/docs/reference/README.md

@@ -39,9 +39,9 @@ This repository contains explicitly versioned surfaces with different owners:
 
 | Surface | Source identity | Meaning |
 | --- | --- | --- |
-| SDK and CLI | `arcane-os` `0.2.1` | The Node.js toolchain plus the browser-only `arcane-os/ai/browser-wasm` and `arcane-os/ai/browser-speech` entrypoints in this checkout. |
-| Browser runtime | SDK source commit `36fbe1418af3d5c343d105ee7c9456360c57785d`, SDK `0.2.1`, protocol `arcane/1` | The SDK-canonical exact 160-file runtime shipped under `runtime/`; Arcane OS commit `c540014afe69f14cf5ae60493b7295f36dbcec64` is legacy projection provenance, not a second source authority. |
-| Browser SDK runtime | SDK source commit `36fbe1418af3d5c343d105ee7c9456360c57785d`, SDK `0.2.1` | The exact 25-file authenticated browser closure: EventManager/DOM instrumentation and pinned event dependencies, Wllama runtime assets, and SDK browser speech provider/store/Worker mechanisms. It contains no model weights or speech adapter/model bytes. |
+| SDK and CLI | `arcane-os` `0.2.3` | The Node.js toolchain plus the browser-only `arcane-os/ai/browser-wasm` and `arcane-os/ai/browser-speech` entrypoints in this checkout. |
+| Browser runtime | SDK source commit `f97ac4f2e7cc92a00a3a466c38a67446dd112acf`, SDK `0.2.3`, protocol `arcane/1` | The SDK-canonical exact 160-file runtime shipped under `runtime/`; Arcane OS commit `c540014afe69f14cf5ae60493b7295f36dbcec64` is legacy projection provenance, not a second source authority. |
+| Browser SDK runtime | SDK source commit `f97ac4f2e7cc92a00a3a466c38a67446dd112acf`, SDK `0.2.3` | The exact 25-file authenticated browser closure: EventManager/DOM instrumentation and pinned event dependencies, Wllama runtime assets, and SDK browser speech provider/store/Worker mechanisms. It contains no model weights or speech adapter/model bytes. |
 | Core reference snapshot | Arcane OS commit `567ad110bf57a1c2d4a3daa22ae93716cc5f4d7e`, protocol `arcane/1` | The application-facing Core contract derived into `docs/reference/core/`. Canonical inventory and focused-member content was verified unchanged at Arcane OS `main` commit `13f3ce0ae34f77a3495331c8b4c30b1bb105f8ed`; SDK-local provenance, link, and package-boundary annotations are added explicitly. |
 
 The SDK runtime receipt and Core reference are distinct evidence and have
@@ -58,26 +58,25 @@ See [Core reference provenance](core/README.md) for the imported inventory and
 the exact distinction between a documentation snapshot and shipped runtime
 bytes.
 
-## Published 0.2.1
+## Published 0.2.2
 
-The published package is exactly `arcane-os@0.2.1` from source commit
-`36fbe1418af3d5c343d105ee7c9456360c57785d`. The npm `latest` dist-tag resolves
-to `0.2.1`; the separate `dev` dist-tag remains `0.1.0-dev.5`.
+The published package is exactly `arcane-os@0.2.2` from source commit
+`d5326d206bf0bec6ad82d53605e666841aa79899`. The npm `latest` dist-tag resolves
+to `0.2.2`; the separate `dev` dist-tag remains `0.1.0-dev.5`.
 
-The provider supersession, legacy speech readiness, fail-closed compatibility,
-explicit STT activation/cancellation, TTS lifecycle, and route-owned voice
-corrections documented below are newer canonical source. They are not package
-authority in `0.2.1`; consumers require a fresh numeric publication before
-relying on them.
+The admission-aware `voice-transcription.html` lifecycle and shared
+`createSTTActivationController()` contract documented below are newer canonical
+source. They are not package authority in `0.2.2`; consumers require a fresh
+numeric publication before relying on them.
 
 | Evidence | Exact value |
 | --- | --- |
-| npm integrity | `sha512-FJ7zCFvQVZEMLQ8kn9IqddnFkfw397S87tENfLULwt0bN5hYn22wmN2zU50BqYC4zDKI/fdf4Rcl5G6A6KwlCg==` |
-| npm shasum | `9b21aea206582e367b8220ad45475ce69af5365a` |
-| Immutable release tarball | `arcane-os-0.2.1.manifest.json`; artifact `9623565709`; 6,951,752 bytes; SHA-256 `c9ebe6d5c0f8f808707a00ca055ef1fe142a3a51715df43f7da427be31c95808` |
-| GitHub release | [`0.2.1`](https://github.com/TheWizardNexus/arcane-os-sdk/releases/tag/0.2.1) (tag and title are both exactly `0.2.1`) |
-| Hosted source/artifact gate | [Check run 33013624030](https://github.com/TheWizardNexus/arcane-os-sdk/actions/runs/33013624030) |
-| Trusted publication | [Run 33013804158](https://github.com/TheWizardNexus/arcane-os-sdk/actions/runs/33013804158) |
+| npm integrity | `sha512-JnLzZ4+FqX9tMgRv8HMcaCPSFx3xNNRf8BF8T03fD2ymg2g8cIGZRdD/3Tbd9PLtpx1PIKCpxz6nCP6ztnu1Nw==` |
+| npm shasum | `0b0d314acce48dcb5518470cd45a54221589d4d4` |
+| Immutable release tarball | `arcane-os-0.2.2.manifest.json`; artifact `9631659213`; 6,993,999 bytes; SHA-256 `e0fe1a556b603f67f5e3c142be7154b433312d3c0f3b58632df2e7fc43cc0ca7` |
+| GitHub release | [`0.2.2`](https://github.com/TheWizardNexus/arcane-os-sdk/releases/tag/0.2.2) (tag and title are both exactly `0.2.2`) |
+| Hosted source/artifact gate | [Check run 33034955277](https://github.com/TheWizardNexus/arcane-os-sdk/actions/runs/33034955277) |
+| Trusted publication | [Run 33035086265](https://github.com/TheWizardNexus/arcane-os-sdk/actions/runs/33035086265) |
 
 The npm SLSA provenance binds the published package to that exact source commit
 and `.github/workflows/publish-dev.yml`. Hashes prove byte identity or
@@ -139,7 +138,7 @@ Ollama, Wllama, Whisper, Kokoro, native, or cloud transport:
 | --- | --- | --- |
 | Select, load, unload, inspect, cancel, and use LLM/STT/TTS independently | [`AIProviderRuntime.js`](runtime-modules.md#aiproviderruntimejs) | Cross-host controller; each registered provider declares its own host requirements. |
 | Observe sticky role state and startup settlement | [`AIRuntimeState.js`](runtime-modules.md#airuntimestatejs) | Cross-host EventTarget state; observation grants no authority. |
-| Offer explicit selected-model start/cancel UI | [`chat.html`](runtime-components.md#chathtml) and [`speech.html`](runtime-components.md#speechhtml) | Browser/native WebView components; user activation emits a cancelable request before any LLM or STT load intent. |
+| Offer explicit selected-model start/cancel UI | [`chat.html`](runtime-components.md#chathtml), [`speech.html`](runtime-components.md#speechhtml), and [`voice-transcription.html`](runtime-components.md#voice-transcriptionhtml) | Browser/native WebView components; user activation emits a cancelable request before any LLM or STT load intent, and recording stays disabled without sticky ready STT. |
 | Use Core-normalized chat | [`globalThis.Arcane.ai`](core/arcane-ai-contracts.md) | Native/Core only when separately admitted. |
 | Run a caller-selected GGUF LLM locally | [`arcane-os/ai/browser-wasm`](ai/browser-wasm.md) | Browser secure context with WebGPU/full-offload evidence, WebAssembly, and OPFS/DBOPFS. |
 | Run caller-selected Whisper/Kokoro locally | [`arcane-os/ai/browser-speech`](ai/browser-speech.md) | Browser with DBOPFS, Web Locks, Workers, and caller-supplied immutable runtime/model bytes. |
@@ -153,11 +152,12 @@ profiles, tools, business policy, and private data remain app-owned.
 
 An explicitly selected but unloaded model is not “ready.” `chat.html` keeps
 Send disabled and exposes a visible keyboard-operable LLM Start/Try again or
-Cancel loading control. `speech.html` keeps Hold to talk unavailable and offers
-the equivalent Start transcription/Try again/Cancel loading control for STT.
-Applications can override `requestAIActivation(intent)` or
-`requestSTTActivation(intent)`, or cancel the corresponding activation-request
-event. Imports and state observation emit no lifecycle intent, and default
+Cancel loading control. `speech.html` and `voice-transcription.html` keep their
+recording operations unavailable and share the equivalent Start
+transcription/Try again/Cancel loading control for STT. Applications can
+override `requestAIActivation(intent)` or `requestSTTActivation(intent)`, or
+cancel the corresponding activation-request event. Imports and state
+observation emit no lifecycle intent, and default
 `startTranscription=false` does not request an STT startup load or begin an
 automatic model download. It does not unload a role started independently.
 Compatibility availability never creates ready STT/TTS state without an

package/docs/reference/ai/browser-speech.md

@@ -17,7 +17,7 @@ with the [normalized AI guide](../README.md#normalized-ai) and
 | --- | --- | --- |
 | Browser | Shipped | Requires DBOPFS/OPFS, Web Locks, Workers, Fetch or an injected fetch function, Blob/File, and object URLs. |
 | Native WebView | Conditional | Works only when the WebView exposes the same browser APIs and the application admits every artifact. This does not invoke Core speech. |
-| Node | Importable, execution unavailable | The ESM subpath is exported, but `0.2.1` publishes no Node speech storage, Worker, audio-decoder, or execution adapter. |
+| Node | Importable, execution unavailable | The ESM subpath is exported, but `0.2.2` publishes no Node speech storage, Worker, audio-decoder, or execution adapter. |
 | Cloud | Not provided | A cloud speech provider can implement `arcane-ai-provider/2`, but this package never selects one. |
 
 Browser speech is independent from `arcane-os/ai/browser-wasm`: the Wllama

package/docs/reference/ai/browser-wasm.md

@@ -9,7 +9,7 @@ page is the focused local-browser path beneath the normalized AI decision
 guide.
 
 The wiring example assumes a scaffolded or materialized Arcane application
-with SDK `0.2.1`'s authenticated runtime tree and generated browser import map.
+with SDK `0.2.2`'s authenticated runtime tree and generated browser import map.
 `arcane/DBOPFS` is a managed browser-map specifier, not an npm package export.
 See [browser runtime delivery](../protocols.md#browser-runtime-delivery) before
 using the example in a custom host or bundler.

package/docs/reference/availability-and-normalization.md

@@ -91,7 +91,7 @@ surface does not require an Arcane Core method grant because it does not call a
 Core host. Browser Fetch, CORS, storage policy, secure-context behavior, and
 resource limits still apply.
 
-The shipped `0.2.1` runtime requires WebGPU and has no CPU fallback. A successful
+The shipped `0.2.2` runtime requires WebGPU and has no CPU fallback. A successful
 load requests full GPU offload (`gpuLayers: 99999`) and admits actual adapter,
 full-offload, buffer, queue, and settled-fence evidence. `navigator.gpu`
 presence by itself is not readiness. The provider emits the instrumented
@@ -128,8 +128,11 @@ through an SDK-created authority and DBOPFS artifact store.
 
 The projected [`AIProviderRuntime`](runtime-modules.md#aiproviderruntimejs)
 normalizes those browser providers and can admit an externally supplied native
-or cloud provider/2 adapter. SDK `0.2.1` does not publish a native, Core, or
-cloud provider/2 adapter. The sticky
+or cloud provider/2 adapter. `AI.js` also supplies compatibility adapters for
+an already-selected legacy OpenAI route, Ollama route, or admitted Core speech
+route. SDK `0.2.2` publishes no privileged Core implementation, credential,
+model, or speech-runtime authority, and those adapters never probe, select,
+download, or fall back. The sticky
 [`AIRuntimeState`](runtime-modules.md#airuntimestatejs) surface keeps
 application UI independent of transport. A selected route remains explicit:
 browser failure is not permission to invoke Core or cloud.

package/docs/reference/behavioral-testing.md

@@ -37,7 +37,7 @@ release acceptance.
 | EventManager and event stacks | Live pub/sub ordering and payload identity, nested causation, immutable/redacted snapshots, strict import, bounded overflow, seek, all playback modes/lifecycle outcomes, cancellation, and DOM start/stop/privacy behavior. | Real user journeys and browser layout belong in a browser harness; event-stack review never proves that external side effects can be replayed. |
 | CLI | Commands parse, acknowledge, select one scope, produce normalized human/JSON/NDJSON output, propagate cancellation/failure, and reject invalid cardinality. | Native build/run requires the selected real provider and host. |
 | Browser runtime modules | Every shipped ESM module parses and its export inventory matches the catalog; pure helpers run focused success/error cases. | DOM, OPFS, media, and Web Component journeys use a browser harness. |
-| Provider-neutral AI runtime and chat/speech activation | Provider/2 registration, closed three-role configuration, opt-in STT startup, legacy Cloud/Core speech readiness, independent LLM/STT/TTS load/unload/status, latest-request-wins settlement, owned STT signals, TTS mute lifecycle, route-owned voice defaults, sticky-state-only speech readiness, selected-unloaded activation request/cancellation/error events, stale-callback suppression, and absence of silent provider fallback are exercised against bounded providers and host callbacks. | Real model/runtime admission remains the selected provider's evidence boundary; provider-promise settlement, state, an abort signal, or an activation event does not by itself prove underlying provider work stopped or native, cloud, or browser-model availability. |
+| Provider-neutral AI runtime and chat/speech activation | Provider/2 registration, closed three-role configuration, opt-in STT startup, legacy Cloud/Core speech readiness, independent LLM/STT/TTS load/unload/status, latest-request-wins settlement, owned STT signals, TTS mute lifecycle, route-owned voice defaults, sticky-state-only readiness for both speech components, shared selected-unloaded activation request/cancellation/error behavior, fail-closed programmatic voice recording, public transcript-replacement supersession of late transcribe/save/complete settlement, `AI.fetchSTT` callback-position compatibility, stale-callback suppression, and absence of silent provider fallback are exercised against bounded providers and host callbacks. | Real model/runtime admission remains the selected provider's evidence boundary; provider-promise settlement, state, an abort signal, or an activation event does not by itself prove underlying provider work stopped or native, cloud, or browser-model availability. |
 | Browser-WASM local AI | The exact exported namespace, canonical ordered `{id, files:[{name?,url,bytes?,sha256?},...]}` descriptor plus its one-file compatibility input, fieldwise app/provider/load security precedence, default-unchecked and secure-check paths, observed-byte persistence, honest capability/status reasons, provider/facade lifecycle, lazy/manual policy, successful Wllama-load requirement, abort normalization, and structural-only tool behavior run with bounded deterministic providers. | The publication gate installs the packed SDK into a real Chrome app, loads the authenticated Wllama 3.6.0 JS/WASM assets, configures `secure:true`, performs a cold exact-length/SHA-256 model install, real inference, in-flight cancellation, unload, and a verified offline reload with zero model requests. It is an explicit heavyweight capability gate, not an implicit model download in every local `npm run check`. |
 | Browser speech | Caller-owned Whisper/Kokoro authority, closed runtime graph, app/provider/load security precedence, manifest-last DBOPFS cache, strict offline admission, independent Worker lifecycle, pre-Worker versus in-Worker cancellation, Blob/File STT conversion, WAV TTS conversion, and no cloud fallback are exercised with bounded synthetic artifacts and adapters. | A real runtime/model/voice download and actual transcription or synthesis require the application's admitted immutable artifacts, licenses, browser media support, and explicit user action. |
 | Persistent chat and document context | Atomic in-memory/history commit, explicit per-turn persistence, single structural tool-call sequencing, bounded bootstrap/search/context, caller-source `evaluate()` budgets, cancellation, and reject versus `preserve-readable` partial coverage are exercised with app-scoped adapters. | Live Core/provider inference and durable browser storage remain separate authorities; tests never treat a fake chat function or in-memory adapter as host/storage proof. |

package/docs/reference/cli.md

@@ -185,7 +185,7 @@ identical executable alias.
 The generated artifact is
 `apps/<id>/modules/arcane.importmap.json`. Its exact JSON is also installed in
 the app entry as `<script type="importmap" data-arcane-import-map>` before
-module loading. In SDK `0.2.1`, the complete authenticated physical-v1 runtime
+module loading. In SDK `0.2.2`, the complete authenticated physical-v1 runtime
 produces 91 entries and intentionally has no package-root mapping. That count
 describes the shipped SDK closure; the command receipt remains authoritative
 for the exact map written to the selected application.
@@ -573,8 +573,8 @@ Success returns:
 ```javascript
 {
     packageName:'arcane-os',
-    currentVersion:'0.2.0',
-    registryVersion:'0.2.1',
+    currentVersion:'0.2.1',
+    registryVersion:'0.2.2',
     tag:'latest',
     status:'update-available', // or 'current' or 'ahead'
     updateAvailable:true,

package/docs/reference/core/arcane-ai-contracts.md

@@ -9,7 +9,7 @@ They are not TypeScript declarations.
 
 ## Portable SDK AI and Core AI
 
-The SDK `0.2.1` has two related but separate normalized boundaries:
+The SDK `0.2.2` has two related but separate normalized boundaries:
 
 | Boundary | Use | Host |
 |---|---|---|

package/docs/reference/inventory/package-api.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.2.1",
+  "sdkVersion": "0.2.3",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",

package/docs/reference/inventory/runtime-components.json

@@ -3,9 +3,9 @@
   "source": {
     "authority": "sdk-canonical",
     "repository": "https://github.com/TheWizardNexus/arcane-os-sdk.git",
-    "commit": "36fbe1418af3d5c343d105ee7c9456360c57785d",
+    "commit": "f97ac4f2e7cc92a00a3a466c38a67446dd112acf",
     "path": "runtime/arcane/components",
-    "sdkVersion": "0.2.1",
+    "sdkVersion": "0.2.3",
     "legacyProjection": {
       "repository": "https://github.com/TheWizardNexus/ARCANE-OS.git",
       "commit": "c540014afe69f14cf5ae60493b7295f36dbcec64",
@@ -689,28 +689,38 @@
     {
       "file": "runtime/arcane/components/speech.html",
       "name": "speech.html",
-      "purpose": "Coordinates speech controls, transcription completion, mute state, and microphone availability.",
+      "purpose": "Coordinates explicit speech-to-text activation, request cancellation, speech controls, transcription completion, mute state, and microphone availability.",
       "methods": [
         "configure()",
         "setAvailability()",
-        "setMuted(); availability",
+        "setMuted()",
+        "requestSTTActivation()",
+        "destroy()",
+        "availability",
         "muted",
         "initialMuted",
-        "componentReady properties"
+        "componentReady"
       ],
       "events": [
         "speech-ready",
         "speech-transcription-complete",
-        "speech-microphone-unavailable"
+        "speech-transcription-error",
+        "speech-transcription-cancelled",
+        "speech-microphone-unavailable",
+        "speech-stt-activation-request",
+        "speech-stt-activation-error",
+        "speech-tts-lifecycle-error"
       ],
       "slots": [],
       "dependencies": [
         "AI.js",
+        "AIRuntimeState.js",
+        "ComponentContracts.js",
         "DBLS.js"
       ],
       "availability": "Browser and supported native WebViews",
       "transport": "HTMLImport + DOM; injected Arcane/provider modules where listed",
-      "normalization": "UI state normalized; AI/media behavior mixed"
+      "normalization": "UI/runtime state, explicit STT activation intent, and request-owned cancellation are normalized; positive compatibility booleans cannot manufacture provider readiness; provider/model authority and media behavior remain external"
     },
     {
       "file": "runtime/arcane/components/summary-strip.html",
@@ -875,9 +885,10 @@
     {
       "file": "runtime/arcane/components/voice-transcription.html",
       "name": "voice-transcription.html",
-      "purpose": "Records segmented microphone audio, transcribes, persists, and completes a combined transcript.",
+      "purpose": "Records segmented microphone audio only after authoritative STT admission, exposes explicit selected-STT activation, transcribes with cancellation, persists, and completes a combined transcript.",
       "methods": [
         "configure()",
+        "requestSTTActivation()",
         "startRecording()",
         "stopRecording()",
         "save()",
@@ -892,17 +903,21 @@
         "voice-transcription-segment",
         "voice-transcription-change",
         "voice-transcription-complete",
-        "speech-transcription-complete"
+        "speech-transcription-complete",
+        "speech-transcription-cancelled",
+        "speech-stt-activation-request",
+        "speech-stt-activation-error"
       ],
       "slots": [],
       "dependencies": [
         "MD.js",
         "ComponentContracts.js",
+        "AIRuntimeState.js",
         "AI.js"
       ],
       "availability": "Browser and supported native WebViews",
       "transport": "HTMLImport + DOM; injected Arcane/provider modules where listed",
-      "normalization": "State/text normalized; media/provider behavior mixed"
+      "normalization": "Sticky runtime STT readiness, explicit activation, request cancellation, and state/text are normalized; media/provider behavior remains external"
     },
     {
       "file": "runtime/arcane/components/weather-widget.html",

package/docs/reference/inventory/runtime-modules.json

@@ -3,9 +3,9 @@
   "source": {
     "authority": "sdk-canonical",
     "repository": "https://github.com/TheWizardNexus/arcane-os-sdk.git",
-    "commit": "36fbe1418af3d5c343d105ee7c9456360c57785d",
+    "commit": "f97ac4f2e7cc92a00a3a466c38a67446dd112acf",
     "path": "runtime/arcane",
-    "sdkVersion": "0.2.1",
+    "sdkVersion": "0.2.3",
     "legacyProjection": {
       "repository": "https://github.com/TheWizardNexus/ARCANE-OS.git",
       "commit": "c540014afe69f14cf5ae60493b7295f36dbcec64",
@@ -15,7 +15,7 @@
   },
   "artifactCount": 85,
   "javascriptArtifactCount": 83,
-  "esmExportCount": 318,
+  "esmExportCount": 319,
   "artifacts": [
     {
       "file": "runtime/arcane/modules/AI.js",
@@ -407,6 +407,7 @@
         "VOICE_MESSAGES",
         "appendTranscription",
         "applyMarkdownFormat",
+        "createSTTActivationController",
         "effectiveDashboardVisibility",
         "normalizeChartOptions",
         "normalizeChartRows",
@@ -417,11 +418,11 @@
         "normalizeMarkdownOptions",
         "normalizeVoiceOptions"
       ],
-      "summary": "Owns normalized configuration/value contracts shared by chart, dashboard, Markdown, and voice components.",
-      "availability": "Cross-host",
+      "summary": "Owns normalized configuration/value contracts and shared explicit STT activation behavior for chart, dashboard, Markdown, and voice components.",
+      "availability": "Cross-host with an injected event constructor outside DOM hosts",
       "protocol": "In-process only",
-      "normalization": "Fully normalized labels, rows, definitions, visibility, formats, editor and voice options.",
-      "surface": "Six constant sets and twelve normalization/formatting helpers."
+      "normalization": "Fully normalized labels, rows, definitions, visibility, formats, editor and voice options, plus capability-neutral STT activation intent and presentation state.",
+      "surface": "Constant sets plus normalization, formatting, and explicit STT activation helpers."
     },
     {
       "file": "runtime/arcane/modules/ConfiguredAIChatSession.js",

package/docs/reference/protocols.md

@@ -104,12 +104,12 @@ import ollama from 'arcane/Ollama';
 ```
 
 The authenticated physical-v1 tree lives entirely beneath `arcane/`. SDK
-`0.2.1` projects it from two canonical release receipts:
+`0.2.3` projects it from two canonical release receipts:
 
 | Canonical receipt | Source authority and protocol | Receipt inventory |
 | --- | --- | --- |
-| `runtime/ARCANE_RUNTIME_RELEASE.json` | `sdk-canonical`; `arcane/1`; builder `arcane-sdk-runtime-v1` | 160 files; 3,605,154 bytes; content SHA-256 `5b921d50b6a0cf36a13f7a7dedf96cd3a68104a322e5139136fd4197aa1ca7cb` |
-| `browser-runtime/ARCANE_SDK_BROWSER_RELEASE.json` | `arcane-os-sdk`; `arcane-sdk-browser-runtime/1`; builder `arcane-sdk-browser-runtime-v1` | 25 files; 9,279,974 bytes; content SHA-256 `a9715c4b3aef70ec4042e4738089568d6588877b29582e0f758ed83897b6814f` |
+| `runtime/ARCANE_RUNTIME_RELEASE.json` | `sdk-canonical`; `arcane/1`; builder `arcane-sdk-runtime-v1` | 160 files; 3,655,536 bytes; content SHA-256 `f96a27bd79a809201708f73ca729bc60ab02696daf619365f77267a28b47b4b3` |
+| `browser-runtime/ARCANE_SDK_BROWSER_RELEASE.json` | `arcane-os-sdk`; `arcane-sdk-browser-runtime/1`; builder `arcane-sdk-browser-runtime-v1` | 25 files; 9,280,047 bytes; content SHA-256 `3c82ed11b24c7b7b91b62f6dc52e0b1dcd444112a29cd48413eedc008380eb61` |
 
 The runtime receipt is the current byte authority. Its Arcane OS
 `c540014afe69f14cf5ae60493b7295f36dbcec64` / bundle `0.8.12` record is
@@ -123,7 +123,7 @@ versions from aliasing one another.
 
 Those two receipt inventories contain 185 entries in total. That sum is a
 release-inventory fact, not an import-map entry count and not an assertion about
-one maintained example. The `0.2.1` map deterministically roots every admitted
+one maintained example. The `0.2.3` map deterministically roots every admitted
 top-level runtime ESM plus the authenticated SDK browser roots, then follows
 those roots for runtime entities and dependency compatibility. Application
 source imports do not select the 91 entries. Its public operation receipt is the
@@ -188,8 +188,8 @@ authority with exactly `dependencyName`, `packageSource`,
 `canonicalPackageRoot`, `packageName`, `packageVersion`, `runtimeRoot`,
 `browserRuntimeRoot`, `runtimeManifest`, and `browserRuntimeManifest`. A
 workspace may use the canonical dependency name or one exact npm alias such as
-`npm:arcane-os@0.2.1`; the physical package manifest must still identify
-exactly as `arcane-os@0.2.1`. Canonical-plus-alias duplicates, multiple aliases,
+`npm:arcane-os@0.2.3`; the physical package manifest must still identify
+exactly as `arcane-os@0.2.3`. Canonical-plus-alias duplicates, multiple aliases,
 links/junctions, indirect package roots, or version drift fail closed.
 
 The imported module can be pure browser logic, standard-Web-API logic, or a
@@ -225,19 +225,19 @@ heartbeat is event telemetry only and never regenerates browser state.
 </details>
 
 <details>
-<summary>SDK 0.2.1 browser-runtime admission and exact receipt fields</summary>
+<summary>SDK 0.2.3 browser-runtime admission and exact receipt fields</summary>
 
 `arcane.lock.json.sdkBrowserRuntime` persists the trusted manifest path,
 `manifestSha256`, `contentSha256`, `builder`, `sdkVersion`, and `source` record.
-For SDK `0.2.1`, the manifest itself records:
+For SDK `0.2.3`, the manifest itself records:
 
 ```text
 manifest: node_modules/arcane-os/browser-runtime/ARCANE_SDK_BROWSER_RELEASE.json
 fileCount: 25
-totalBytes: 9279974
-contentSha256: a9715c4b3aef70ec4042e4738089568d6588877b29582e0f758ed83897b6814f
+totalBytes: 9280047
+contentSha256: 3c82ed11b24c7b7b91b62f6dc52e0b1dcd444112a29cd48413eedc008380eb61
 builder: arcane-sdk-browser-runtime-v1
-sdkVersion: 0.2.1
+sdkVersion: 0.2.3
 source.protocol: arcane-sdk-browser-runtime/1
 source.browserEntry: arcane-os/event-manager
 ```
@@ -263,9 +263,8 @@ Application code should select a normalized role, not an internal protocol.
 The exported
 [`getAIProviderRuntime()` singleton](runtime-modules.md#aiproviderruntimejs)
 comes from authenticated runtime bytes and owns independent `llm`, `stt`, and
-`tts` selections. Published SDK `0.2.1` ships browser-WASM LLM and browser
-speech provider/2 adapters but predates the legacy speech correction described
-below. Current source also adapts selected legacy OpenAI LLM/STT/TTS,
+`tts` selections. SDK `0.2.3` ships browser-WASM LLM and browser
+speech provider/2 adapters and also adapts selected legacy OpenAI LLM/STT/TTS,
 Core-backed Ollama LLM, and admitted Core speech STT/TTS routes into provider/2;
 other native, Core, or cloud routes require an externally supplied compatible
 adapter. The singleton itself is not an authentication or capability token. It
@@ -301,7 +300,7 @@ compatible completed cache, otherwise it rejects with
 `ARCANE_AI_MODEL_OFFLINE_MISS`. Unload releases the active Wllama session but
 does not silently delete the app-owned cache.
 
-SDK `0.2.1` requires WebGPU. Load requests full offload with exactly 99,999 GPU
+SDK `0.2.3` requires WebGPU. Load requests full offload with exactly 99,999 GPU
 layers and admits the model only after observing an adapter, full layer offload,
 buffer and queue work, and a settled fence. `navigator.gpu` presence alone is
 not readiness. There is no CPU fallback, partial-offload success mode, or
@@ -378,14 +377,19 @@ STT. It declines to request a startup STT load; it does not unload a role alread
 started through another explicit lifecycle action. A selected unloaded
 transcription provider remains selected and unloaded until a user lifecycle
 intent or explicit `startTranscription:true` opt-in asks the provider owner to
-load it. Neither state observation nor the shared speech component imports a
-model or selects a fallback.
-
-The shared speech component owns an `AbortController` for each STT request and
-passes its signal through `AI.fetchSTT()`. Cancel, superseding capture, and
-component teardown abort that signal and suppress late delivery. Whether the
-provider's underlying computation stops remains governed by its own
-cancellation contract. User TTS unmute calls `AI.setSpeechMuted(false)` before
+load it. Neither state observation nor either shared speech component imports a
+model or selects a fallback. `speech.html` and `voice-transcription.html` consume
+one shared `createSTTActivationController()` contract for selected, unloaded,
+loading, unloading, error, and ready presentation plus cancelable user intent.
+Both keep capture fail-closed until sticky STT state is exactly ready.
+
+Each shared speech component owns an `AbortController` for its STT request and
+passes its signal through `AI.fetchSTT()`. `voice-transcription.html` also adds
+that signal to the existing injected `transcribe(file,context)` callback
+context. Cancel, readiness loss, superseding capture, and component teardown
+abort the owned signal and suppress late delivery. Whether the provider's
+underlying computation stops remains governed by its own cancellation contract.
+User TTS unmute calls `AI.setSpeechMuted(false)` before
 or with its load intent so the runtime records the unmuted lifecycle preference;
 mute calls `AI.setSpeechMuted(true)`, cancels active synthesis, and unloads TTS.
 The selected TTS model catalog owns `defaultVoice`. AI.js uses a saved OpenAI