arcane-os 0.3.0 → 0.3.1

package/docs/reference/ai/browser-speech.md

@@ -242,11 +242,14 @@ ignores it and uses module-captured native Blob URL creation, revocation, and
 fetch so a caller cannot substitute the executable materialization boundary.
 
 For a graph, `prepare(graph,{signal,onProgress,offline=false,security})` follows
-the shared model-security flag and requires explicit `secure:true`. The graph is
-the opt-in strict path: it enables byte-length, SHA-256, and undeclared-
-capability enforcement. Ordinary warn-first operation uses the direct
-`model`/`runtime` authority described below and does not construct or admit an
-artifact graph.
+the shared model-security flag. Its default `secure:false` path retains the
+selected graph, scans and rewrites its declared module edges, and reports
+unchecked or partially checked admission without enabling optional strict
+capability isolation. Explicit `secure:true` defaults byte-length and SHA-256
+checks on and adds strict Worker isolation. Either mode rejects malformed graph
+records, unreadable Fetch responses, media-type mismatches, structurally
+unmaterializable runtime modules, failed object-URL readback, and every enabled
+byte-length or SHA-256 mismatch.
 
 ### Cold admission
 
@@ -261,24 +264,27 @@ artifact graph.
    HTTPS URL without credentials or a fragment and require its canonical origin
    to occur in that file's declared final-origin inventory.
 5. Require the response Content-Type to equal `sourceMediaType` (which defaults
-   to `mediaType`), then stream exact byte-length and SHA-256 verification into
-   DBOPFS.
-6. Reopen and rehash every persisted file.
+   to `mediaType`), then stream into DBOPFS while applying each enabled
+   byte-length or SHA-256 check. `secure:true` enables both checks by default;
+   `secure:false` leaves both disabled unless the caller selects them.
+6. Reopen every persisted file and repeat only the enabled byte-length or
+   SHA-256 checks.
 7. Decode and scan every runtime JavaScript file and prove exact edge/transform
    closure.
 8. Persist `arcane.ai.browser-speech.authenticated-artifact-graph.v1` only
    after every file and the complete runtime graph pass.
 
-The returned admission is
-`artifact-graph-network-dbopfs-verified`. A failure before manifest completion
-removes the graph's incomplete records.
+The returned admission is `artifact-graph-network-dbopfs-verified`,
+`artifact-graph-network-dbopfs-partially-checked`, or
+`artifact-graph-network-dbopfs-unchecked` according to the effective checks. A
+failure before manifest completion removes the graph's incomplete records.
 
 `redirectFinalOrigins` admits only a final origin, not a final path, query, or
 signed/expiring URL. The browser may follow such an implementation-specific
 final URL, but that URL is neither persisted nor accepted as source, revision,
-signature, graph identity, or future download authority. Trust remains bound to
-the immutable starting `sourceUrl` and the exact authenticated length and
-SHA-256 of the received bytes.
+signature, graph identity, or future download authority. The graph remains
+bound to its immutable starting `sourceUrl`; selected length and SHA-256 checks
+apply only when enabled and are reported honestly by the admission status.
 
 Browser Fetch exposes the final CORS response, not an inspectable list of every
 intermediate redirect hop. The SDK therefore cannot authenticate intermediate
@@ -291,13 +297,17 @@ than this redirect opt-in.
 ### Warm and offline admission
 
 A warm prepare requires the exact manifest authority and file count, reopens
-every DBOPFS record, checks the manifest's observed bytes and declared SHA-256,
-rehashes every file, and rescans the runtime graph before returning
-`artifact-graph-dbopfs-cache-verified`.
+every DBOPFS record, checks the manifest's observed byte count and declared
+descriptor identity, repeats the enabled byte-length or SHA-256 checks, and
+rescans the runtime graph. It returns the corresponding
+`artifact-graph-dbopfs-cache-verified`,
+`artifact-graph-dbopfs-cache-partially-checked`, or
+`artifact-graph-dbopfs-cache-unchecked` status.
 
 `offline:true` runs the same cache verification and never calls the source
 fetch function. It returns
-`artifact-graph-offline-dbopfs-cache-verified`, or rejects with code
+`artifact-graph-offline-dbopfs-cache-{verified|partially-checked|unchecked}`,
+or rejects with code
 `ARCANE_AI_ARTIFACT_GRAPH_OFFLINE_CACHE_MISS` and reason
 `artifact-graph-offline-cache-miss`. There is no network repair, runtime CDN,
 private Cache Storage fallback, or partial-cache admission.
@@ -305,7 +315,8 @@ private Cache Storage fallback, or partial-cache admission.
 The manifest authority binds each file's `sourceMediaType` and
 `redirectFinalOrigins` through the graph identity. A valid warm or offline
 admission does not resolve the starting URL again, follow a redirect, or reuse a
-prior final URL; it authenticates only the complete cached bytes and graph.
+prior final URL; it admits only the complete cached records and graph under the
+selected checks.
 
 After every cold, warm, or offline admission, the store materializes a fresh
 set of unique native `blob:` URLs. Each URL is fetched back with omitted
@@ -324,9 +335,10 @@ Successful graph preparation returns:
   cache,                    // the exact graph admission value
   artifactGraphId,
   artifactGraphAdmission,
+  warnings,                 // frozen runtime-inspection warnings
   runtime: {
     ...normalizedRuntime,
-    files, edges, transforms,
+    files, edges, transforms, warnings,
     guardCapability,
     artifactGraphId,
     artifactGraphAdmission
@@ -340,31 +352,40 @@ Successful graph preparation returns:
 does not delete the caller-owned DBOPFS cache. `remove(graph)` is the explicit
 cache-deletion operation.
 
-## Authenticated Worker host
+## Graph Worker host
 
-Graph loading creates one dedicated Worker for the selected role. Its first
-load envelope transfers a new private `MessagePort`; all graph responses,
-progress, cancellation settlement, and later operations stay on that port.
-Graph loading rejects if `MessageChannel`/`MessagePort` is unavailable, if a
-legacy global transport was already selected, or if the Worker receives a graph
-load without the private port. The published single-module compatibility path
-continues to use the original Worker-global message transport.
+Graph loading creates one dedicated Worker for the selected role. With explicit
+`secure:true`, its first load envelope transfers a new private `MessagePort`;
+all graph responses, progress, cancellation settlement, and later operations
+stay on that port. Strict loading rejects if `MessageChannel`/`MessagePort` is
+unavailable, if a Worker-global transport was already selected, or if the
+Worker receives a strict graph load without the private port. Default
+`secure:false` graph loading uses the ordinary Worker-global message transport,
+as does the published single-module compatibility path.
 
-Before importing the entrypoint, the graph Worker installs these fail-closed
-boundaries:
+Before importing the entrypoint in either mode, the graph Worker installs the
+functional graph boundary:
 
 - exact graph routes map declared source URLs, runtime aliases, and materialized
-  URLs to already authenticated object URLs;
+  URLs to the selected materialized object URLs;
 - the ephemeral guard capability must match at every rewritten call;
-- global `fetch` rejects unless the scanned source was rewritten to one
-  declared fetch edge;
-- global Cache Storage `open` and `match` reject unless the scanned
-  `caches.open(...)` was rewritten to one exact declared cache-open edge; its
-  returned read-only cache serves only `targetPaths`, while `put`, `add`, and
-  `addAll` reject, so DBOPFS remains the sole durable store;
+- each rewritten fetch, cache-open, import, and child-Worker edge resolves
+  through its declared graph route and local materialized bytes;
+- the returned graph cache facade serves only declared `targetPaths`, while
+  `put`, `add`, and `addAll` reject, so DBOPFS remains the graph's sole durable
+  store;
 - a `typed-array-constructor` rewrite returns only the intrinsic constructor of
-  a verified typed-array receiver; an own or non-intrinsic `constructor`
+  a typed-array receiver; an own or non-intrinsic `constructor`
   rejects;
+- an admitted child module Worker is created through the SDK's role Worker,
+  receives the graph configuration, installs the same guard, and imports only
+  its declared materialized target.
+
+Explicit `secure:true` additionally installs these strict isolation controls:
+
+- raw global `fetch` rejects unless scanned source was rewritten to one
+  declared fetch edge, and raw Cache Storage access is replaced by the graph
+  facade;
 - the `Function`, `AsyncFunction`, `GeneratorFunction`, and
   `AsyncGeneratorFunction` prototype constructor escape is replaced before
   import, and string callbacks to `setTimeout` or `setInterval` reject;
@@ -372,15 +393,13 @@ boundaries:
 - raw `BroadcastChannel`, `EventSource`, `Function`, `RTCPeerConnection`,
   `ShadowRealm`, `SharedWorker`, `WebSocket`, `WebSocketStream`, `WebTransport`,
   `Worker`, `XMLHttpRequest`, `eval`, and `importScripts` capabilities are
-  denied; and
-- an admitted child module Worker is created through the SDK's role Worker,
-  receives the authenticated graph configuration, installs the same guard, and
-  imports only its declared materialized target.
+  denied.
 
-An immutable `sourceUrl` may be an explicitly caller-selected HTTPS origin,
-but runtime execution cannot escalate to that or another network origin. Its
-declared request is answered from authenticated local object bytes, and any
-other request or import edge rejects.
+An immutable `sourceUrl` may be an explicitly caller-selected HTTPS origin.
+Every rewritten declared request is answered from local object bytes and an
+undeclared transformed edge rejects. Explicit `secure:true` additionally
+prevents raw runtime access from escalating to that or another network origin;
+default warn-first mode does not make that isolation claim.
 
 ### ONNX Runtime Web configuration
 
@@ -393,15 +412,17 @@ The Worker accepts only the two mechanically verified namespace shapes:
   `kokoro-env-wasm-paths-assignment-rejected`.
 - Transformers: `namespace.env.backends.onnx.wasm.wasmPaths = {mjs,wasm}`.
   The Worker also requires the verified outer `env` fields, sets
-  `allowLocalModels:false`, `allowRemoteModels:true`, `useBrowserCache:false`,
-  and `useFSCache:false`. With no admitted `cacheOpens` edge named exactly
-  `transformers-cache`, it assigns `useCustomCache:false` and `customCache:null`.
-  With exactly one such edge it assigns `useCustomCache:true` and the
-  target-limited read-only graph facade; more than one rejects as ambiguous.
-  Only a caller-declared STT `numThreads` is assigned. The
+  `allowLocalModels:false` and `allowRemoteModels:true`. In explicit
+  `secure:true`, it additionally sets `useBrowserCache:false` and
+  `useFSCache:false`; with no admitted `cacheOpens` edge named exactly
+  `transformers-cache`, it assigns `useCustomCache:false` and `customCache:null`,
+  while exactly one such edge selects the target-limited read-only graph
+  facade. Default `secure:false` leaves those optional upstream cache settings
+  unchanged. More than one declared Transformers cache edge rejects as
+  ambiguous in either mode. Only a caller-declared STT `numThreads` is assigned. The
   `allowRemoteModels` value permits the audited library code path to issue its
-  declared request; the graph guard still prevents network access and serves
-  only exact local graph routes.
+  declared request; the rewritten graph edge still serves its selected local
+  route. Strict mode separately prevents unrewritten network access.
 
 For Transformers, the exact missing-field reasons are
 `transformers-env-backends-onnx-wasm-unavailable`,
@@ -472,10 +493,10 @@ createBrowserKokoroProvider({
 } = {})
 ```
 
-`graph` is mutually exclusive with the legacy `model`/`runtime` options and may
-load only when effective security explicitly selects `secure:true`. Both
-constructors require an SDK-created DBOPFS speech store and return one frozen
-`arcane-ai-provider/2` object:
+`graph` is mutually exclusive with the legacy `model`/`runtime` options. It may
+load under default `secure:false` warn-first operation or explicit
+`secure:true` strict operation. Both constructors require an SDK-created
+DBOPFS speech store and return one frozen `arcane-ai-provider/2` object:
 
 ```text
 {
@@ -485,7 +506,8 @@ constructors require an SDK-created DBOPFS speech store and return one frozen
 ```
 
 `localOnly` must remain `true`. `offline:true` makes every later explicit load
-use strict offline graph/cache admission; it does not trigger a load itself.
+use the selected offline graph/cache admission policy; it does not trigger a
+load itself.
 
 `catalog()` exposes only the caller's selected model/runtime/files. A graph
 catalog also reports `artifactGraphId`, caller dtype, exact sample rate, and the
@@ -574,6 +596,9 @@ Provider `status()` returns:
   generation,
   errorCode,
   cache,
+  security,
+  integrity,
+  warnings,
   artifactGraphId,
   artifactGraphAdmission
 }
@@ -595,6 +620,20 @@ The provider states are exactly `unloaded`, `loading`, `ready`, `unloading`,
 synthesis request; load, unload, and dispose remain visible through `state` and
 `activeOperation`. `cache` is `null`, a graph admission value, or the legacy
 `installed`/`cached` value. Graph identity and admission are otherwise `null`.
+`security` reports the effective `secure`, `byteLength`, and `sha256` choices.
+`integrity.state` is `unchecked` when no integrity check is enabled, `pending`
+while enabled checks have not completed, `verified` only after every enabled
+check passes, and `failed` when an enabled verification attempt rejects. This
+verification outcome is independent of later Worker initialization and remains
+visible after a failed or unloaded provider. Default `secure:false` status
+includes the frozen warning code
+`browser-speech-warn-first-secure-mode-disabled` without blocking upstream
+package, provider, model, voice, fetch, cache, or Worker behavior. Graph runtime
+inspection warnings are deduplicated into the same frozen status array. The
+high-level AI runtime owns the single configuration warning event; providers
+and Workers do not create a competing event source. Strict byte admission,
+private transport, and capability isolation remain exclusive to explicit
+`secure:true`.
 
 Provider-owned lifecycle reasons are:
 
@@ -1217,19 +1256,23 @@ advanced strict-control option; it is not required for normal speech use.
 - The SDK redistributes no speech runtime, model, voice, third-party license,
   or corresponding-source payload. Explicit `load()` resolves them from the
   caller-selected npm/package/provider authorities.
-- Default direct-authority operation is warn-first and preserves ordinary
-  upstream fetch/cache behavior. An artifact graph is admitted only when
-  `secure:true` explicitly opts into strict graph/file verification and
-  capability isolation.
-- Every graph byte is caller-selected, immutable, exact-length, SHA-256 bound,
-  revision bound, media-type bound, license-declaration bound, and reachable
-  through one closed graph identity.
+- Default direct-authority and graph operation is warn-first and preserves
+  ordinary upstream Worker capabilities. `secure:true` explicitly opts into
+  strict graph/file verification, private transport, and capability isolation.
+- Every graph descriptor is caller-selected and binds immutable source,
+  declared length, SHA-256, revision, media type, license declaration, and
+  closed graph identity. Runtime status calls the bytes `verified` only when
+  both byte checks actually complete; warn-first can honestly report
+  `partially-checked` or `unchecked`.
 - Redirects are rejected by default. An undeclared redirect, an undeclared or
   non-HTTPS final origin, a mutable starting source authority, an ambiguous
-  path/route, an undeclared code/data edge, a raw network transport, a cache
-  write, or an incomplete offline closure fails closed.
-- DBOPFS is the sole durable artifact store; the Worker sees only authenticated
-  local object bytes and an exact read-only cache facade.
+  path/route, an undeclared transformed code/data edge, a graph-cache write, or
+  an incomplete offline closure fails closed. Explicit `secure:true` also
+  rejects raw network and other undeclared Worker capabilities.
+- DBOPFS is the graph's sole SDK-owned durable artifact store. Declared graph
+  routes resolve to local object bytes and an exact read-only cache facade;
+  default warn-first mode does not claim to deny every ordinary upstream
+  browser capability.
 - Runtime/model/sample-rate/default-voice/voice inventory and optional
   Transformers thread count remain caller authority. No hardware heuristic,
   hidden fallback, startup download, native/Core call, or cloud retry is added.

package/docs/reference/ai/browser-wasm.md

@@ -9,7 +9,7 @@ page is the focused local-browser path beneath the normalized AI decision
 guide.
 
 The wiring example assumes a scaffolded or materialized Arcane application
-with SDK `0.3.0`'s runtime tree and generated browser import map.
+with SDK `0.3.1`'s runtime tree and generated browser import map.
 `arcane/DBOPFS` is a managed browser-map specifier, not an npm package export.
 See [browser runtime delivery](../protocols.md#browser-runtime-delivery) before
 using the example in a custom host or bundler.

package/docs/reference/availability-and-normalization.md

@@ -91,7 +91,7 @@ surface does not require an Arcane Core method grant because it does not call a
 Core host. Browser Fetch, CORS, storage policy, secure-context behavior, and
 resource limits still apply.
 
-The shipped `0.3.0` runtime requires WebGPU and has no CPU fallback. A successful
+The shipped `0.3.1` runtime requires WebGPU and has no CPU fallback. A successful
 load requests full GPU offload (`gpuLayers: 99999`) and admits actual adapter,
 full-offload, buffer, queue, and settled-fence evidence. `navigator.gpu`
 presence by itself is not readiness. The provider emits the instrumented
@@ -130,7 +130,7 @@ The projected [`AIProviderRuntime`](runtime-modules.md#aiproviderruntimejs)
 normalizes those browser providers and can admit an externally supplied native
 or cloud provider/2 adapter. `AI.js` also supplies compatibility adapters for
 an already-selected legacy OpenAI route, Ollama route, or admitted Core speech
-route. SDK `0.3.0` publishes no privileged Core implementation, credential,
+route. SDK `0.3.1` publishes no privileged Core implementation, credential,
 model, or speech-runtime authority, and those adapters never probe, select,
 download, or fall back. The sticky
 [`AIRuntimeState`](runtime-modules.md#airuntimestatejs) surface keeps

package/docs/reference/cli.md

@@ -197,7 +197,7 @@ identical executable alias.
 The generated artifact is
 `apps/<id>/modules/arcane.importmap.json`. Its exact JSON is also installed in
 the app entry as `<script type="importmap" data-arcane-import-map>` before
-module loading. In SDK `0.3.0`, the complete physical-v1 runtime derives its
+module loading. In SDK `0.3.1`, the complete physical-v1 runtime derives its
 entries from the installed runtime and browser-runtime inventories and
 intentionally has no package-root mapping. The command receipt remains
 authoritative for the exact map written to the selected application; no fixed

package/docs/reference/core/arcane-ai-contracts.md

@@ -9,7 +9,7 @@ They are not TypeScript declarations.
 
 ## Portable SDK AI and Core AI
 
-The SDK `0.3.0` has two related but separate normalized boundaries:
+The SDK `0.3.1` has two related but separate normalized boundaries:
 
 | Boundary | Use | Host |
 |---|---|---|

package/docs/reference/inventory/package-api.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.3.0",
+  "sdkVersion": "0.3.1",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",

package/docs/reference/inventory/runtime-components.json

@@ -5,7 +5,7 @@
     "repository": "https://github.com/TheWizardNexus/arcane-os-sdk.git",
     "commit": "75b01e7ddcd751f7970d8c1aaf18bfff05b706b7",
     "path": "runtime/arcane/components",
-    "sdkVersion": "0.3.0",
+    "sdkVersion": "0.3.1",
     "legacyProjection": {
       "repository": "https://github.com/TheWizardNexus/ARCANE-OS.git",
       "commit": "c540014afe69f14cf5ae60493b7295f36dbcec64",

package/docs/reference/inventory/runtime-modules.json

@@ -5,7 +5,7 @@
     "repository": "https://github.com/TheWizardNexus/arcane-os-sdk.git",
     "commit": "9c4ec2213af98cbc53fca073a799435a89c6650f",
     "path": "runtime/arcane",
-    "sdkVersion": "0.3.0",
+    "sdkVersion": "0.3.1",
     "legacyProjection": {
       "repository": "https://github.com/TheWizardNexus/ARCANE-OS.git",
       "commit": "c540014afe69f14cf5ae60493b7295f36dbcec64",

package/docs/reference/mail.md

@@ -22,7 +22,7 @@ plaintext fallback.
 
 ## Public npm import
 
-The 0.3.0 portable programmatic contract is one subpath:
+The 0.3.1 portable programmatic contract is one subpath:
 
 ```javascript
 import Mail,{

package/docs/reference/protocols.md

@@ -55,6 +55,48 @@ same app-scoped operation, not three import-map formats. There is no exported
 `importMapApplication()` function, `generateImportMap()` function, or
 `arcane-os/import-map` package subpath.
 
+## Installed SDK runtime materialization
+
+`materializeInstalledSdkRuntime()` is the Node entrypoint for refreshing one
+external workspace's checked-in `arcane/` projection from its one exact
+installed SDK declaration. Import the function through the dependency key that
+the workspace actually declares: `arcane-os` for the canonical package name or,
+for example, `arcane-sdk` for the exact `npm:arcane-os@<version>` alias. No
+application- or Arcane OS-local copier owns this operation.
+
+The operation resolves that declaration again while holding the shared
+workspace-operation lock, authenticates the physical package plus its runtime
+and browser-runtime receipts, derives the destination inventory dynamically,
+and returns one of three statuses:
+
+- `created` when no prior `arcane/` projection or persistent receipt existed;
+- `reused` only after the current process reauthenticates the recorded physical
+  package, both source receipts, and every destination byte;
+- `refreshed` when a safe legacy projection or an authenticated older generation
+  is replaced.
+
+Each committed generation writes the canonical workspace-local receipt
+`.arcane/installed-sdk-runtime.json`. Its
+`arcane-installed-sdk-runtime-projection` schema binds a UUID generation, the
+workspace location identity, declared dependency name/group/specifier and
+package source, physical package location/name/version/identity, both source
+receipt identities and content hashes, and the exact projected path/byte/hash
+inventory. The file is durable evidence, not standalone authority: a later
+process must authenticate it against the current physical package, freshly
+issued source receipts, and the complete destination tree before reporting
+`reused`.
+
+Creation and refresh write and authenticate a complete staging tree and staged
+receipt before the commit boundary. Refresh moves the prior tree and receipt to
+owned backups, installs the new pair without invoking callbacks or observing
+cancellation inside that bounded commit, and restores the prior pair if commit
+or post-commit verification fails. Cancellation remains effective through the
+last pre-commit check; after commit begins the operation finishes verification
+or rollback. Successful whole-tree replacement removes bytes absent from the
+new dynamic inventory. Symbolic links, non-files, malformed receipts, receipt
+tampering, unsafe paths, and corrupt selected source bytes remain errors rather
+than refresh inputs.
+
 ## Central events and time-travel data
 
 `arcane-os/event-manager` is host-neutral JavaScript. Its live event path is
@@ -104,12 +146,12 @@ import ollama from 'arcane/Ollama';
 ```
 
 The authenticated physical-v1 tree lives entirely beneath `arcane/`. SDK
-`0.3.0` projects it from two canonical release receipts:
+`0.3.1` projects it from two canonical release receipts:
 
 | Canonical receipt | Source authority and protocol | Receipt inventory |
 | --- | --- | --- |
-| `runtime/ARCANE_RUNTIME_RELEASE.json` | `sdk-canonical`; `arcane/1`; builder `arcane-sdk-runtime-v1` | 161 files; 4,159,000 bytes; content SHA-256 `5dab0c9cadd9e5ca97f90ab63ce755940318198d5b1efc0b7b666de4075302e9` |
-| `browser-runtime/ARCANE_SDK_BROWSER_RELEASE.json` | `arcane-os-sdk`; `arcane-sdk-browser-runtime/1`; builder `arcane-sdk-browser-runtime-v1` | 26 files; 9,548,478 bytes; content SHA-256 `0d41531e9a2d6ce97a357eeeebde5fbac8af59639a52f4f682717097b13dc6dc` |
+| `runtime/ARCANE_RUNTIME_RELEASE.json` | `sdk-canonical`; `arcane/1`; builder `arcane-sdk-runtime-v1` | 161 files; 4,161,715 bytes; content SHA-256 `9ed39694d9f286e0994404a82fb6002c3ba48be0d085a6b68d51c7facc17c56f` |
+| `browser-runtime/ARCANE_SDK_BROWSER_RELEASE.json` | `arcane-os-sdk`; `arcane-sdk-browser-runtime/1`; builder `arcane-sdk-browser-runtime-v1` | 26 files; 9,554,968 bytes; content SHA-256 `1493497265c330507abed847e52e65dc2ce22c15efaf5646ed7ae544b107ad6f` |
 
 The runtime receipt is the current byte authority. Its Arcane OS
 `c540014afe69f14cf5ae60493b7295f36dbcec64` / bundle `0.8.12` record is
@@ -123,7 +165,7 @@ versions from aliasing one another.
 
 Those two receipt inventories contain 187 entries in total. That sum is a
 release-inventory fact, not an import-map entry count and not an assertion about
-one maintained example. The `0.3.0` map deterministically roots every admitted
+one maintained example. The `0.3.1` map deterministically roots every admitted
 top-level runtime ESM plus the authenticated SDK browser roots, then follows
 those roots for runtime entities and dependency compatibility. Application
 source imports do not select a fixed entry count. Its public operation receipt is the
@@ -188,8 +230,8 @@ authority with exactly `dependencyName`, `packageSource`,
 `canonicalPackageRoot`, `packageName`, `packageVersion`, `runtimeRoot`,
 `browserRuntimeRoot`, `runtimeManifest`, and `browserRuntimeManifest`. A
 workspace may use the canonical dependency name or one exact npm alias such as
-`npm:arcane-os@0.3.0`; the physical package manifest must still identify
-exactly as `arcane-os@0.3.0`. Canonical-plus-alias duplicates, multiple aliases,
+`npm:arcane-os@0.3.1`; the physical package manifest must still identify
+exactly as `arcane-os@0.3.1`. Canonical-plus-alias duplicates, multiple aliases,
 links/junctions, indirect package roots, or version drift fail closed.
 
 The imported module can be pure browser logic, standard-Web-API logic, or a
@@ -225,19 +267,19 @@ heartbeat is event telemetry only and never regenerates browser state.
 </details>
 
 <details>
-<summary>SDK 0.3.0 browser-runtime admission and exact receipt fields</summary>
+<summary>SDK 0.3.1 browser-runtime admission and exact receipt fields</summary>
 
 `arcane.lock.json.sdkBrowserRuntime` persists the trusted manifest path,
 `manifestSha256`, `contentSha256`, `builder`, `sdkVersion`, and `source` record.
-For SDK `0.3.0`, the manifest itself records:
+For SDK `0.3.1`, the manifest itself records:
 
 ```text
 manifest: node_modules/arcane-os/browser-runtime/ARCANE_SDK_BROWSER_RELEASE.json
 fileCount: 26
-totalBytes: 9548478
-contentSha256: 0d41531e9a2d6ce97a357eeeebde5fbac8af59639a52f4f682717097b13dc6dc
+totalBytes: 9554968
+contentSha256: 1493497265c330507abed847e52e65dc2ce22c15efaf5646ed7ae544b107ad6f
 builder: arcane-sdk-browser-runtime-v1
-sdkVersion: 0.3.0
+sdkVersion: 0.3.1
 source.protocol: arcane-sdk-browser-runtime/1
 source.browserEntry: arcane-os/event-manager
 ```
@@ -263,7 +305,7 @@ Application code should select a normalized role, not an internal protocol.
 The exported
 [`getAIProviderRuntime()` singleton](runtime-modules.md#aiproviderruntimejs)
 comes from authenticated runtime bytes and owns independent `llm`, `stt`, and
-`tts` selections. SDK `0.3.0` ships browser-WASM LLM and browser
+`tts` selections. SDK `0.3.1` ships browser-WASM LLM and browser
 speech provider/2 adapters and also adapts selected legacy OpenAI LLM/STT/TTS,
 Core-backed Ollama LLM, and admitted Core speech STT/TTS routes into provider/2;
 other native, Core, or cloud routes require an externally supplied compatible
@@ -300,7 +342,7 @@ compatible completed cache, otherwise it rejects with
 `ARCANE_AI_MODEL_OFFLINE_MISS`. Unload releases the active Wllama session but
 does not silently delete the app-owned cache.
 
-SDK `0.3.0` requires WebGPU. Load requests full offload with exactly 99,999 GPU
+SDK `0.3.1` requires WebGPU. Load requests full offload with exactly 99,999 GPU
 layers and admits the model only after observing an adapter, full layer offload,
 buffer and queue work, and a settled fence. `navigator.gpu` presence alone is
 not readiness. There is no CPU fallback, partial-offload success mode, or

package/docs/reference/runtime-modules.md

@@ -495,6 +495,11 @@ removes that role and requires its exact non-null expected provider. The method
 provider registration, routes, selection, readiness, generation, sticky state,
 owned lifecycle work, and TTS mute state. `replaceSpeechProviders(value)` keeps
 the existing atomic two-role boundary for a coordinated STT/TTS replacement.
+Either replacement may hydrate an exact selected-but-unregistered speech route
+whose saved locality is still `null`, but only when provider id, model id, and
+every pending route agree with the replacement. Registration and route
+publication remain one commit; a mismatched, already registered, local-only,
+busy, or partially divergent selection rejects without changing either role.
 
 `start(options)` waits for prior speech-state and role unload work, applies the
 requested initial mute state, and returns the `startAIRuntime()` control handle
@@ -1424,7 +1429,7 @@ source body as implicit authority, and never persists a caller-owned body.
 **Browser or compatible host with an injected DBOPFS adapter.** The adapter
 keeps the existing `get`, `set`, `getAllKeys`, and `delete` method names; Node
 can use the same class only through an explicitly imported runtime module and a
-compatible storage adapter; SDK `0.3.0` publishes no Node package subpath or
+compatible storage adapter; SDK `0.3.1` publishes no Node package subpath or
 Node storage implementation for it. Bootstrap uses a bounded concurrent
 generation, commits its manifest last, cleans partial data on failure, and
 rejects case-colliding IDs. Search

package/docs/reference/sdk-api.md

@@ -17,7 +17,7 @@ This table is the Node `package.json#exports` map: it defines package
 entrypoints for SDK/tooling code. It is distinct from the generated browser
 import map that resolves application-facing `arcane/*` modules and the focused
 EventManager entry. See [browser runtime delivery](protocols.md#browser-runtime-delivery)
-for the installed-inventory-derived physical-runtime contract in SDK `0.3.0`.
+for the installed-inventory-derived physical-runtime contract in SDK `0.3.1`.
 
 | Specifier | Purpose |
 | --- | --- |
@@ -849,7 +849,7 @@ same deterministic map. The package root also contains the public
 {
   schemaVersion: 1,
   kind: 'arcane-app-runtime-projection',
-  sdkVersion: '0.3.0',
+  sdkVersion: '0.3.1',
   pathPrefix: 'arcane/',
   fileCount,
   totalBytes,
@@ -1404,24 +1404,28 @@ async function useloadRuntimeRelease(...arguments_) {
 
 ### Overview
 
-Verifies the workspace's exact installed SDK runtime and browser runtime, then materializes their dynamic inventories.
+Verifies the workspace's exact installed SDK runtime and browser runtime, then creates, reuses, or transactionally refreshes their dynamic projection.
 
 ### Signature and result
 
 ```text
-async materializeInstalledSdkRuntime({workspaceRoot,sdkPackageSource,signal,onEvent}={})
+async materializeInstalledSdkRuntime({workspaceRoot,sdkPackageSource,workspaceOperationLease,signal,onEvent}={})
 ```
 
-Import it from `arcane-os`. It resolves the workspace's exact installed SDK declaration, verifies both physical runtime receipts, materializes the authenticated runtime projection, and returns a frozen result containing the installation and all three receipts. Cancellation and progress remain caller-owned through `signal` and `onEvent`.
+Import it through the exact dependency key declared by the workspace: normally `arcane-os`, or the alias name such as `arcane-sdk` when the declaration is `npm:arcane-os@<version>`. It resolves that declaration under the shared workspace-operation lock, verifies both physical runtime receipts, and creates or refreshes the complete projection by staged whole-tree replacement. The frozen result includes `status` (`created`, `reused`, or `refreshed`), `generation`, `receiptPath`, `persistentReceipt`, `cleanupWarnings`, the installed-package authority, and all three process-local verification receipts.
+
+The canonical `.arcane/installed-sdk-runtime.json` receipt binds the physical package and exact destination inventory. A later process reauthenticates that receipt against the current installed package, freshly issued source receipts, and all destination bytes before returning `reused`; the JSON file alone grants no authority. Refresh prunes bytes absent from the new inventory and restores the prior tree and receipt on commit or post-commit verification failure. `signal` and `onEvent` remain caller-owned before commit. Once the bounded commit starts, it completes verification or rollback without observing cancellation or invoking callbacks.
 
 ### Availability and normalization
 
-**Node.** Canonical workspace and installed-package identity, verified runtime receipts, and a frozen materialization result. Deep protocol: [Installed SDK runtime materialization](protocols.md).
+**Node.** Canonical workspace and installed-package identity, verified runtime receipts, a persistent reauthenticatable generation receipt, and a frozen materialization result. Deep protocol: [Installed SDK runtime materialization](protocols.md#installed-sdk-runtime-materialization).
 
 ### Example
 
 ```javascript
 import {materializeInstalledSdkRuntime} from 'arcane-os';
+// If package.json declares the SDK under the arcane-sdk alias, import from
+// 'arcane-sdk' instead.
 
 const result=await materializeInstalledSdkRuntime({workspaceRoot});
 ```
@@ -2759,7 +2763,7 @@ The import-map operation also reports the stable operation-specific strings
 `ARCANE_IMPORT_MAP_COLLISION`; package assembly can additionally report
 `ARCANE_IMPORT_MAP_CLEANUP_FAILED`. They are normalized `ArcaneError.code`
 values, but are not properties added to this frozen general registry in SDK
-`0.3.0`.
+`0.3.1`.
 
 ### Value and import
 
@@ -3425,7 +3429,7 @@ workspace it additionally returns the exact installed package authority:
     packageSource,
     canonicalPackageRoot,
     packageName: 'arcane-os',
-    packageVersion: '0.3.0',
+    packageVersion: '0.3.1',
     runtimeRoot,
     browserRuntimeRoot,
     runtimeManifest,
@@ -3435,9 +3439,9 @@ workspace it additionally returns the exact installed package authority:
 ```
 
 The dependency can be named `arcane-os` or be one exact npm alias for
-`npm:arcane-os@0.3.0`. The selected installation must still be one direct,
+`npm:arcane-os@0.3.1`. The selected installation must still be one direct,
 physical, non-link package directory whose manifest identifies exactly as
-`arcane-os@0.3.0`; duplicate canonical/alias declarations fail closed.
+`arcane-os@0.3.1`; duplicate canonical/alias declarations fail closed.
 `allowMissingManagedImportMap` is an internal packaging/development seam. An
 ordinary caller should leave it `false`.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",