arcane-os 0.33.5 → 0.34.0

package/docs/reference/ai/twin-cloud.md

@@ -81,8 +81,11 @@ two failure types share that three-retry budget. HTTP `429` with a message
 containing `overload` (case-insensitive) retains its unlimited three-second
 retry behavior and does not consume that budget. Each attempt reuses the exact
 destination, Fetch options, serialized request, and signal. Other HTTP errors,
-response decoding failures, and application callback failures do not retry.
-The last complete failure is thrown unchanged when recovery is exhausted.
+successful-response decoding failures, and application callback failures do not
+retry. A known HTTP `529` also retries when reading or parsing its diagnostic
+body fails; `onRetry.error` retains that exact failure, which is thrown unchanged
+if recovery is exhausted. Diagnostic-body failures for other HTTP statuses do
+not retry. The last complete failure is thrown unchanged when recovery is exhausted.
 Pass a fresh
 `AbortController`'s `signal` and call `abort()` to cancel. Cancellation during
 the request, response-body read, retry wait, or callback settlement prevents

package/docs/reference/core/arcane-entities.md

@@ -41,7 +41,7 @@ authoritative in the linked contract document.
 | `arcane/entities/Theme.js#themeTokens` | constant | `themeTokens` | Frozen ordered definitions that map public theme-token keys to CSS custom properties, labels, and defaults. |
 | `arcane/entities/Theme.js#themeColorToHex` | function | `themeColorToHex` | Validates an RGB, RGBA, or six-digit hexadecimal color and returns its RGB channels as a normalized six-digit hexadecimal color. |
 | `arcane/entities/Theme.js#default` | class | `Theme` | Validates and freezes a named light or dark token set and can serialize, restore, apply, or clear that theme on a document root. |
-| `arcane/entities/User.js#default` | class | `UserEntity` | Owns the browser user's validated settings and profile record, including DBOPFS load, refresh, serialized updates, and optional persistence. |
+| `arcane/entities/User.js#default` | class | `UserEntity` | Owns the browser user's settings and profile record, including DBOPFS load, refresh, serialized partial or fresh-baseline callback updates, and optional persistence. Callback null skips saving; timestamp setters merge only their fields through the same write owner. |
 | `arcane/entities/Weather.js#WeatherLocation` | class | `WeatherLocation` | Validates and freezes geographic identity, coordinates, and timezone metadata for a weather location. |
 | `arcane/entities/Weather.js#WeatherObservation` | class | `WeatherObservation` | Validates and freezes one timestamped current-weather observation and its units. |
 | `arcane/entities/Weather.js#WeatherDay` | class | `WeatherDay` | Validates and freezes one daily forecast with temperature, precipitation, and optional sunrise and sunset times. |

package/docs/reference/inventory/package-api.json

@@ -6,7 +6,7 @@
     "minimumVersion": "22.23.2 for Node entrypoints",
     "moduleSystem": "ESM"
   },
-  "memberCount": 217,
+  "memberCount": 218,
   "runtimeSubpathPatterns": {
     "arcane-os/modules/*": "./runtime/arcane/modules/*",
     "arcane-os/entities/*": "./runtime/arcane/entities/*"
@@ -3106,6 +3106,20 @@
       "protocol": "arcane-ai-browser-speech-artifacts/1 over arcane-ai-provider/2",
       "normalization": "Exact protocol string; it grants no model authority and names no model download"
     },
+    {
+      "id": "browser-speech:createDigitalOceanFalTTSProvider",
+      "name": "createDigitalOceanFalTTSProvider",
+      "displayName": "createDigitalOceanFalTTSProvider()",
+      "kind": "function",
+      "signature": "createDigitalOceanFalTTSProvider({id,model,getApiKey,maxConcurrentRequests=4,fetch=globalThis.fetch}={})",
+      "entrypoints": ["arcane-os/ai/browser-speech"],
+      "primaryImport": "arcane-os/ai/browser-speech",
+      "group": "Browser speech providers",
+      "summary": "Creates an explicitly selected DigitalOcean FAL remote TTS provider using standard Fetch and completed audio jobs.",
+      "availability": "Browser or Node with Fetch, Blob, AbortController, and an application-owned DigitalOcean inference key",
+      "protocol": "arcane-ai-provider/2 tts/synthesize",
+      "normalization": "Construction and activation make no adapter network requests. Activation awaits the application-owned string or promise key reader. localOnly false, concurrent requests, complete audio Blob results, and local cancellation without claiming remote-job cancellation. Applications own model, voice, credentials, and activation."
+    },
     {
       "id": "browser-speech:createBrowserKokoroProvider",
       "name": "createBrowserKokoroProvider",

package/docs/reference/inventory/runtime-entities.json

@@ -19,7 +19,7 @@
     {"file":"runtime/arcane/entities/Preference.js","exports":["default","preferenceSchema"],"availability":"cross-host","normalization":"normalized"},
     {"file":"runtime/arcane/entities/TerminalSession.js","exports":["default","terminalShells"],"availability":"cross-host","normalization":"normalized"},
     {"file":"runtime/arcane/entities/Theme.js","exports":["arcaneDarkThemeTokens","arcaneLightThemeTokens","default","themeColorToHex","themeTokens"],"availability":"cross-host/dom-when-applied","normalization":"normalized/mixed"},
-    {"file":"runtime/arcane/entities/User.js","exports":["default","profileUpdateFromSearchParams"],"availability":"browser/native-webview","normalization":"Existing User lifecycle is unchanged; profileUpdateFromSearchParams purely maps nonempty supplied URLSearchParams values without further decoding, trimming, or persistence."},
+    {"file":"runtime/arcane/entities/User.js","exports":["default","profileUpdateFromSearchParams"],"availability":"browser/native-webview","normalization":"updateExplicit accepts existing partial/JSON updates or an awaited fresh-profile callback under the existing serialized write owner; callback null skips saving and returns the fresh profile, while failed writes restore the fresh baseline. Timestamp setters persist partial fields through that owner. profileUpdateFromSearchParams purely maps nonempty supplied URLSearchParams values without further decoding, trimming, or persistence."},
     {"file":"runtime/arcane/entities/Weather.js","exports":["WeatherDay","WeatherLocation","WeatherObservation","WeatherSnapshot"],"availability":"cross-host","normalization":"normalized"}
   ]
 }

package/docs/reference/runtime-components.md

@@ -342,7 +342,9 @@ transcript is a masked vertical scroll viewport; status and composer remain
 outside it. Initial restoration follows the true bottom. User, assistant, tool,
 streaming, progress, and failure updates continue following it, including later
 message-card, status, composer, or viewport resizing, until the reader scrolls
-toward earlier content. Scrolling down to the bottom resumes following. Layout
+toward earlier content. Scrolling down to the bottom or submitting an accepted
+non-synthetic user message resumes following. Canceled or rejected submissions
+and synthetic requests preserve the reader's position. Layout
 clamping, hidden views, and BFCache restoration preserve that choice;
 destruction releases scroll observation. Each
 restored or new message uses a separate semantic `<time>` element at the card's

package/docs/reference/runtime-entities.md

@@ -274,6 +274,46 @@ Owns persisted user preference/profile fields, explicit-preference updates,
 fresh reads, saves, and JSON projection. It installs `window.user` after its
 DBLS/DBOPFS lifecycle and emits `user-entity-loaded`.
 
+### updateExplicit(update)
+
+Accepts an ordinary partial profile object, a JSON string, or a function
+`current => partialOrNull`. It returns `Promise<UserEntityData>` with the
+resulting explicit profile, retaining the existing field setters and their
+validation behavior.
+
+The function is called once after the latest durable profile has been read,
+inside the existing serialized update and Web Lock. It may return a promise.
+Return only the fields to change, or return `null` to skip the durable write
+and receive the fresh profile unchanged. This no-write meaning applies only
+to the callback result; ordinary object/string inputs and direct `null` retain
+their existing behavior. With `persist=false`, the callback uses current
+memory and performs no durable read or write.
+
+```javascript
+const displayedName = user.username;
+const profile = await user.updateExplicit(function renameTheCaptain(current) {
+    if (current.username !== displayedName) return null;
+    return {username: 'Captain Moonboots'};
+});
+```
+
+Callbacks compute a patch without mutating `current`. Do not call or await
+`updateExplicit()`, `withFreshExplicit()`, or `refresh()` on the same instance
+inside the callback: those operations depend on the current queue entry
+finishing. Fetch outside the callback; compare against `current` at the write
+boundary. Rendering and unrelated background work need not await this update.
+
+A thrown or rejected callback causes no save and rejects with the original
+error. A failed save restores the fresh baseline in memory and rejects with
+the save error. The persistence setting is restored and later queued updates
+remain usable. The existing `current_time` and `last_successful_time` setters
+keep their immediate in-memory assignment, then save only their timestamp
+field through this same fresh partial-update owner. This preserves newer
+durable profile fields when TimeGuard records a check. Automatic timestamp
+save failures are reported through Arcane logging; callers requiring durable
+completion use and await `updateExplicit({current_time: value})` or the
+corresponding `last_successful_time` partial update.
+
 ### profileUpdateFromSearchParams(searchParams)
 
 Named export from `arcane-os/entities/User.js`. Pass an existing

package/docs/reference/runtime-modules.md

@@ -144,10 +144,11 @@ playback.
 
 ### Public surface
 
-default `AI`; read-only `providerRuntime`, `browserSpeechConfiguration`, and
+default `AI`; read-only `providerRuntime`, `speechActivationPending`, `browserSpeechConfiguration`, and
 `browserSpeechDescriptor`; `configureBrowserSpeech(configuration,{signal})`,
 `disposeBrowserSpeech({signal})`, `setAI()`, `configureProviders()`,
-`configureSpeechProviders()`, `transitionAI()`, `transitionProviders()`,
+`configureSpeechProviders()`, `configureSpeechProvider(role,provider,options)`,
+`transitionAI()`, `transitionProviders()`,
 `transitionSpeechProviders()`, `startProviders()`, `setSpeechMuted()`,
 `streamRequest()`, `streamMessage()`, `fetchRequest()`, `fetch()`,
 read-only `ttsSegmentation`, `configureTTSSegmentation()`,
@@ -217,16 +218,17 @@ returns aggregate runtime status; `transitionProviders()` returns the configured
 three-role route configuration. Selected TWiN Cloud `TWIN` LLM, `OLLAMA` LLM,
 and Core `LOCAL_SPEACH` STT/TTS built-in routes expose truthful capability-only
 readiness through internal provider/2 adapters without probing, downloading, or
-hiding a load. Configured `OPENAI` speech preferences migrate to on-device
-`LOCAL_SPEACH`, with Whisper for STT and Kokoro for TTS. TWiN Cloud availability
+hiding a load. Explicit speech preference slots remain unchanged, including a
+selected external provider that the application registers after AI startup.
+TWiN Cloud availability
 requires the selected LLM route, its model, a credential, and `fetch`; Core speech
 availability requires the exact selected `Arcane.speech.transcribe` or
 `synthesize` method. `fetchRequest()`
 keeps the selected provider's public response shape. Browser speech routes
 translate the existing AI.js STT `{audio:Blob|File,mimeType,model}` and TTS
 `{model,input,responseFormat,voice?,speed?}` requests at the provider boundary;
-only WAV is accepted for the shared TTS result. TTS voice selection comes from
-the exact selected local provider/model catalog `defaultVoice`; a saved
+the selected provider declares its supported audio format. TTS voice selection comes from
+the exact selected provider/model catalog `defaultVoice`; a saved
 OpenAI-route voice is never forwarded to another provider route.
 
 The TWiN Cloud built-in provider and default-model preference sentinel are
@@ -252,14 +254,34 @@ tool declarations, emitted tool calls, or callback ordering.
 
 `configureSpeechProviders({stt,tts})` commits only the two speech routes and
 leaves the current LLM route and sticky lifecycle record unchanged. Both speech
-roles must be unloaded, use local-only selections, and own no request, load,
-unload, or dispose operation. Non-local STT and TTS selections reject with
-`AI_STT_DEVICE_ONLY` and `AI_TTS_DEVICE_ONLY`, respectively.
+roles must be unloaded and own no request, load, unload, or dispose operation.
+STT remains local-only (`AI_STT_DEVICE_ONLY` for a remote selection); an
+explicit TTS provider may declare `localOnly:false`.
 `transitionSpeechProviders({stt,tts})` stops queued audio, explicitly unloads
 only STT and TTS, then commits that same closed speech route record. Neither
 method loads a model, selects a fallback, or changes caller-owned model or voice
 policy.
 
+`configureSpeechProvider(role,provider,{modelId,signal,expectedProvider})`
+asynchronously registers and selects one provider/2 speech role, unloading and
+disposing only its previous SDK-owned provider. `modelId` defaults to the first
+catalog entry. It returns the selected `{providerId,modelId,localOnly}` record;
+passing `null` removes that role and returns `null`. An optional
+`expectedProvider` is compared inside the configuration lane; if another
+provider has taken ownership, removal resolves `false` without changing it.
+An unaccepted candidate is disposed on failure; a failure after replacement
+has `committed:true`, and runtime ownership identifies the installed provider.
+
+This method composes with an STT-only or TTS-only `configureBrowserSpeech()`
+in either order. The other speech role and LLM keep their routes, readiness,
+requests, and storage. Use sequential disposal when combining this method
+with `disposeBrowserSpeech()`. Configuration does not activate the new provider
+or make a network request. `setSpeechMuted(false)` waits for an in-progress
+configuration before activating the committed TTS selection; a later mute
+cancels that pending unmute. The application keeps model, voice, and credential
+selection. See [DigitalOcean FAL speech](ai/browser-speech.md#digitalocean-fal-text-to-speech)
+for the public remote adapter and completed-job audio transport.
+
 `startProviders({startLanguageModel=true,startMuted=true,startTranscription=false,signal=null}={})`
 starts provider-owned text chat without requesting an STT load by default.
 Callers selecting a browser-WASM LLM pass `startLanguageModel:false` so it
@@ -273,6 +295,14 @@ user activation intent exposed by the shared speech component.
 `setSpeechMuted(false)` records the public unmuted state only after the selected
 TTS route reaches ready; a failed load leaves the public state muted. In contrast,
 `setSpeechMuted(true)` cancels active TTS work and unloads that role.
+An explicit unmute may wait for its selected external provider to register.
+`speechActivationPending` distinguishes that intent from an ordinary muted
+state. Streamed text and its final remainder may enter the existing speech
+queue during that wait; synthesis waits for the same activation promise.
+Text never activates a provider itself. Stop cancels queued preparation even
+while registration is pending; mute, disposal, a new startup operation, or an
+actual route replacement also revoke the pending activation. Initial
+registration of the already-selected provider/model preserves queued speech.
 The optional browser-speech `stt.execution` and `tts.execution` records select
 `device:'auto'|'webnn-npu'|'webgpu'|'wasm'` and `maxConcurrentRequests`.
 Omission uses NPU, GPU, then CPU automatic selection with one Whisper slot and

package/docs/reference/sdk-api.md

@@ -67,7 +67,7 @@ runtime layouts.
 | `arcane-os/ai/browser-wasm` | Caller-selected browser-local Wllama inference, complete DBOPFS model storage, streaming, cancellation, and structural tool-call results. |
 | `arcane-os/ai/tool-text-stream` | Shared selected tool-argument text observer for provider integration. |
 | `arcane-os/ai/twin-cloud` | Complete TWiN Cloud requests from Node or a browser with an explicit key/model and shared retry/cancellation behavior. |
-| `arcane-os/ai/browser-speech` | Caller-selected browser-local Whisper STT and Kokoro TTS provider mechanisms, ordinary upstream assets, materialized/native routing, Workers, and cancellation. |
+| `arcane-os/ai/browser-speech` | Caller-selected browser-local Whisper STT and Kokoro TTS, explicit DigitalOcean FAL remote TTS, ordinary upstream assets, role lifecycle, and cancellation. |
 | `arcane-os/mail` | Portable Mail runtime, durable outbox, complete transport responses, and provider-neutral acceptance contracts. |
 
 These lowercase runtime-module entrypoints expose their existing exports; they
@@ -178,6 +178,7 @@ browser map are cataloged separately in [Runtime modules](runtime-modules.md).
 | `getPwaInstall()` | function | `arcane-os/pwa` | Progressive web applications | Browser native installation events; waiting state while no prompt is available |
 | `mountPwaInstallPrompt()` | function | `arcane-os/pwa` | Progressive web applications | Browser document and managed HTML import; resolves to null without a document |
 | `createDbopfsSpeechArtifactStore()` | function | `arcane-os/ai/browser-speech` | Browser speech providers | Browser with ready DBOPFS, Web Locks, Fetch, File/Blob, and object URLs |
+| `createDigitalOceanFalTTSProvider()` | function | `arcane-os/ai/browser-speech` | Browser speech providers | Browser or Node with Fetch, Blob, and an application-supplied DigitalOcean inference key |
 | `removeBrowserSpeechModelCache()` | function | `arcane-os/ai/browser-speech` | Browser speech providers | Browser CacheStorage; explicit removal of one selected upstream model |
 | `createNativeBuildPlan()` | function | `arcane-os` | Targets, native plans, and providers | Node; selected browser/native target or provider as documented |
 | `createNativeTargetAdapter()` | function | `arcane-os` | Targets, native plans, and providers | Node; selected browser/native target or provider as documented |
@@ -6763,7 +6764,7 @@ releaseProvider();
 
 # Browser speech providers
 
-`arcane-os/ai/browser-speech` exports exactly the seven package members below.
+`arcane-os/ai/browser-speech` exports the package members below.
 It ships provider, authority, artifact-store, and Worker mechanisms but no
 Whisper/Kokoro model weights, adapter runtime artifacts, voices, download URLs,
 default catalog, CDN loader, native bridge, or cloud fallback. The providers
@@ -7121,6 +7122,69 @@ async function transcribeAfterUserChoice(audioBlob) {
 }
 ```
 
+## createDigitalOceanFalTTSProvider()
+
+### Overview
+
+Creates a `localOnly:false` provider/2 TTS adapter for the caller-selected
+DigitalOcean FAL model. It submits independent synthesis jobs, polls their
+completion, and returns each complete downloaded audio `Blob`. The shared AI
+queue owns punctuation segmentation, bounded concurrent requests, and playback
+in input order; this is not provider-native live audio streaming.
+
+### Signature and parameters
+
+```text
+createDigitalOceanFalTTSProvider({id,model,getApiKey,maxConcurrentRequests=4,fetch=globalThis.fetch}={})
+```
+
+`id` is the application-owned provider identifier. `model` contains the selected
+`id` and `defaultVoice`; the supported multilingual-v2 selection is
+`fal-ai/elevenlabs/tts/multilingual-v2`. `getApiKey()` returns the
+application's current DigitalOcean inference key or a promise for it. The credential is never
+included in catalog or status. `maxConcurrentRequests` is a positive integer;
+the runtime owns admission and its FIFO queue. Optional `fetch` supplies the
+standard Fetch interface.
+
+### Availability and normalization
+
+The adapter needs Fetch, Blob, and AbortController; it needs no Worker or
+DBOPFS. Browser access depends on endpoint CORS support. Construction makes
+no network request. Inspection and activation await the application's key
+reader without making an SDK network request. Activation checks
+local credential presence, not remote validity. Status reports remote
+execution and current activity. Requests preserve complete text, selected
+voice, and speed; multilingual-v2 speed outside `0.7` through `1.2` rejects
+instead of clamping. Returned media is fetched without the inference key.
+Cancelling a credential wait leaves the application's shared refresh alone
+and prevents a late result from starting this cancelled operation.
+
+Each provider/2 `tts/synthesize` request returns one complete audio Blob.
+Request cancellation, unload, and disposal stop local polling/downloads and
+discard late results; they cannot promise cancellation of an already submitted
+remote job. HTTP, provider, and media failures remain observable. The adapter
+does not select a fallback or silently resubmit a paid synthesis POST.
+
+### Example
+
+```javascript
+import {createDigitalOceanFalTTSProvider} from 'arcane-os/ai/browser-speech';
+
+async function configureCloudVoice(ai, getApiKey) {
+  const provider = createDigitalOceanFalTTSProvider({
+    id: 'selected-cloud-voice',
+    model: {id: 'fal-ai/elevenlabs/tts/multilingual-v2', defaultVoice: 'Rachel'},
+    getApiKey
+  });
+  await ai.configureSpeechProvider('tts', provider);
+  return provider;
+}
+```
+
+Call activation and synthesis from the application's explicit speech action.
+For streaming text, cancellation, and independent STT configuration, see
+[DigitalOcean FAL speech](ai/browser-speech.md#digitalocean-fal-text-to-speech).
+
 ## createBrowserKokoroProvider()
 
 ### Overview

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.33.5",
+  "version": "0.34.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -86,7 +86,7 @@
     "test": "npm run test:unit && npm run test:functional && npm run test:integration && npm run test:regression",
     "test:release": "node ./bin/arcane-test.mjs test/npm-release.test.mjs",
     "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
-    "test:functional": "node ./bin/arcane-test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/cli.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/modal.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/twin-cloud.test.mjs test/update-check.test.mjs",
+    "test:functional": "node ./bin/arcane-test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/cli.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/modal.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/twin-cloud.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
     "test:integration": "node ./bin/arcane-test.mjs test/installed-package-runtime.test.mjs test/root-app-layout.test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/mail-browser.test.mjs test/native-plan.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/release-capability-smoke.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs test/browser-wasm-cpu.test.mjs test/wllama-webgpu-runtime.test.mjs",
     "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",
     "check": "node tools/check-source.mjs && npm test",

package/runtime/arcane/components/chat.html

@@ -1161,9 +1161,13 @@
         scrollTranscriptToBottom();
     }
 
-    function scrollTranscriptToBottom() {
+    function scrollTranscriptToBottom(resumeFollowing = false) {
         // Read movement before writing: a reader's scroll event may still be queued.
-        if(!trackTranscriptScrollPosition() || !transcriptFollowing) return false;
+        const visible = trackTranscriptScrollPosition();
+        if(resumeFollowing === true && !destroyed) {
+            transcriptFollowing = true;
+        }
+        if(!visible || !transcriptFollowing) return false;
         chatOutput.scrollTop = chatOutput.scrollHeight;
         transcriptScrollTop = chatOutput.scrollTop;
         return true;
@@ -2961,13 +2965,13 @@
         const clearThinking=thinkingHTML;
         
         //console.table(arguments);
+        const aiRuntime=boundChatAI??globalThis.ai;
         if(
             !isThinking
             &&text
-            &&host.aiAvailability.tts
-            &&speech.muted===false
+            &&((host.aiAvailability.tts&&speech.muted===false)
+                ||aiRuntime?.speechActivationPending===true)
         ){
-            const aiRuntime=boundChatAI??globalThis.ai;
             if(is.function(aiRuntime?.streamTTS)){
                 void Promise.resolve(aiRuntime.streamTTS(text)).catch(
                     reportTTSError
@@ -3831,12 +3835,14 @@
                 const visibleMessage=appendTranscriptMessage('user',text,host.name);
                 visibleMessage.dataset.operationId=operationId;
             }
-            scrollTranscriptToBottom();
+            scrollTranscriptToBottom(!eventContext.synthetic);
 
-            if(host.aiAvailability.tts&&speech.muted===false){
-                const aiRuntime=boundChatAI??globalThis.ai;
+            const aiRuntime=boundChatAI??globalThis.ai;
+            if((host.aiAvailability.tts&&speech.muted===false)
+                ||aiRuntime?.speechActivationPending===true){
                 aiRuntime?.stopAudio?.();
-                if(is.function(aiRuntime?.resumeAudio)){
+                if(host.aiAvailability.tts&&speech.muted===false
+                    &&is.function(aiRuntime?.resumeAudio)){
                     void Promise.resolve(aiRuntime.resumeAudio()).catch(
                         function reportPlaybackResumeFailure(error){
                             reportTTSError(error,'playback-resume');

package/runtime/arcane/components/speech.html

@@ -392,6 +392,7 @@
     recordButton.addEventListener('blur', handleRecordBlur, lifecycleListenerOptions);
     stopButton.addEventListener('click', stop, lifecycleListenerOptions);
     muteButton.addEventListener('click', muteToggle, lifecycleListenerOptions);
+    window.addEventListener('ai-ready', synchronizeAIReadiness, lifecycleListenerOptions);
     window.addEventListener(
         'pagehide',
         handlePageHide,
@@ -417,11 +418,7 @@
     renderStatus();
     void observeMicrophonePermission();
     void aiModuleImport.then(
-        function synchronizeMutedStateAfterAIImport() {
-            if (!destroyed) {
-                synchronizeAIMutedState();
-            }
-        },
+        synchronizeAIReadiness,
         function reportAIModuleImportFailure(error) {
             if (destroyed) {
                 return;
@@ -546,6 +543,17 @@
         applyRoleTransitions(previousSTTRole, previousTTSRole);
     }
 
+    function synchronizeAIReadiness() {
+        if (destroyed) {
+            return;
+        }
+        settleSuccessfulUnmute();
+        continuePendingUnmute();
+        synchronizeAIMutedState();
+        renderControls();
+        renderStatus();
+    }
+
     function applyRoleTransitions(previousSTTRole, previousTTSRole) {
         sttActivationController?.synchronize(sttRole);
         const sttBecameUnready = previousSTTRole.state === 'ready'
@@ -996,6 +1004,13 @@
         ) {
             return false;
         }
+        if (!is.function(globalThis.ai?.setSpeechMuted)) {
+            pendingUnmute = true;
+            host.muted = true;
+            renderControls();
+            renderStatus();
+            return false;
+        }
         const providerSelected = is.string(ttsRole.providerId)
             && ttsRole.providerId.length > 0
             && is.string(ttsRole.modelId)
@@ -1016,8 +1031,12 @@
         }
 
         pendingUnmute = true;
+        const generation = ttsIntentGeneration + 1;
         const requested = await requestTTSIntent('load', 'user');
-        if (!requested || destroyed) {
+        if (destroyed || generation !== ttsIntentGeneration) {
+            return false;
+        }
+        if (!requested) {
             pendingUnmute = false;
             host.muted = true;
             stopTTSPlayback();
@@ -1774,7 +1793,12 @@
             return;
         }
 
+        const cancelPendingUnmute = activeTTSIntent?.action === 'load';
         destroyed = true;
+        ttsIntentGeneration += 1;
+        pendingUnmute = false;
+        pendingTTSIntent = null;
+        activeTTSIntent = null;
         runtimeStateAbortController.abort();
         sttActivationController?.destroy();
         window.removeEventListener('pagehide', handlePageHide);
@@ -1785,6 +1809,16 @@
         );
         cancelSTTOperation('component-destroyed');
         stopTTSPlayback();
+        const aiRuntime = globalThis.ai;
+        if (cancelPendingUnmute
+            && aiRuntime?.speechActivationPending === true
+            && is.function(aiRuntime.setSpeechMuted)) {
+            void Promise.resolve(aiRuntime.setSpeechMuted(true)).catch(
+                function reportSpeechTeardownFailure(error) {
+                    arcaneLogging.error('Speech activation could not be cancelled during component teardown.', error);
+                }
+            );
+        }
         events.dispose();
         host.componentReady = false;
         renderControls();

package/runtime/arcane/entities/User.js

@@ -370,7 +370,7 @@ class UserEntity {
 
         this.#current_time = v;
 
-        this.#persist();
+        this.#persist({current_time:v});
     }
 
     /** @returns {number} */
@@ -386,7 +386,7 @@ class UserEntity {
 
         this.#last_successful_time = v;
 
-        this.#persist();
+        this.#persist({last_successful_time:v});
     }
 
      /** @returns {string} */
@@ -822,7 +822,7 @@ class UserEntity {
             src=this.explicit;
         }
 
-        if(!is.union(src,'object','string')){
+        if(!is.union(src,'object|string')){
             throw new Error('UserEntity.explicit setter expects object or JSON string');
         }
 
@@ -857,9 +857,11 @@ class UserEntity {
 
     /**
      * Applies and durably saves an explicit profile update as one serialized
-     * operation. A failed write restores the prior in-memory values.
+     * operation. A callback computes a partial update from the fresh profile;
+     * its null result skips the write. It must not await another queued User
+     * operation on this instance. A failed write restores the fresh baseline.
      *
-     * @param {UserEntityData|string|Object} src
+     * @param {UserEntityData|string|Object|function(UserEntityData): (Object|null|Promise<Object|null>)} src
      * @returns {Promise<UserEntityData>}
      */
     updateExplicit(src){
@@ -883,7 +885,19 @@ class UserEntity {
                 this.persist=false;
                 try{
                     this.explicit=baseline;
-                    this.explicit=src;
+                }finally{
+                    this.persist=persist;
+                }
+
+                const conditional=is.function(src);
+                const update=conditional?await src(this.explicit):src;
+                if(conditional&&update===null){
+                    return this.explicit;
+                }
+
+                this.persist=false;
+                try{
+                    this.explicit=update;
                 }finally{
                     this.persist=persist;
                 }
@@ -1107,8 +1121,17 @@ class UserEntity {
     /**
      * Internal persistence trigger
      */
-    #persist(){
+    #persist(update){
         if(this.persist){
+            // TimeGuard's ordinary timestamp setters must merge only their
+            // fields into the fresh profile, never overwrite another tab's edits.
+            if(!is.undefined(update)){
+                const operation=this.updateExplicit(update);
+                void operation.catch(function reportTimestampSaveFailure(error){
+                    arcaneLogging.error('The user timestamp could not be saved.',error);
+                });
+                return operation;
+            }
             return this.save();
         }