arcane-os 0.55.0 → 0.57.0

package/CHANGELOG.md

@@ -1,5 +1,56 @@
 # Changelog
 
+## 0.57.0
+
+- Add local model chat through explicit llama.cpp/Ollama runtime requirements,
+  reusable installation and bundling, a retained Core local-AI service, and an
+  optional browser-to-Core provider. Preserve complete requests and streamed
+  responses, model readiness, cancellation and owned process shutdown. Apps own
+  model selection and defaults; preparation does not block ordinary page startup.
+- Add authored Core service selection and launch context. Factories receive
+  authored options and the separate app-root/runtime context; explicit launch
+  context overrides remain supported. Portable packages can bundle explicitly
+  selected local-AI runtimes without changing browser-only output.
+- Add Windows x64 executable packaging through the public Windows native
+  provider and the matching release's retained WebView2/Node SEA host asset.
+  Client injection precedes app scripts, service requests retain complete JSON,
+  and accepted service work drains before the owned Core process exits.
+- Add `runProcess` cancellation mode `close-input` for owned graceful shutdown;
+  the existing `terminate-tree` default remains unchanged. Includes separately
+  delivered macOS process source, without claiming a complete macOS host.
+- Correct the documented Node document-library subpath and lexical-search
+  example. No preferences service, Nemotron diarization, native ONNX, native
+  Kokoro or local image generation is introduced in this release.
+
+## 0.56.0
+
+- Add explicit `package.nativeResources` selection for native-only application
+  files and directories. Browser selection remains unchanged; non-browser
+  packaging keeps additional resources outside browser transformations and
+  stages them in a separate target output. Applications select their complete
+  required source closure, and target adapters receive the effective target
+  and browser-PWA selection.
+- Add `getInstalledCoreClient()` to read the exact live SDK-installed client
+  without connecting or changing globals. Terminal `failTransport(error)` and
+  the owned native failure callback preserve complete errors, settle pending
+  requests, and release the failed installation's callbacks and subscriptions.
+- Add opt-in `replayRuntimeState` for Core clients and classic injection. The
+  runtime replays its actual readiness and current service state for newly
+  connected documents without restarting services or delaying page startup.
+
+- Preserve complete UTF-8 process output when a character spans stdout or stderr
+  chunks. Independent readable-stream decoders feed the same text to captured
+  results and existing event delivery; ordering, backpressure, cancellation,
+  graceful drain, nonzero error details and line-event behavior remain unchanged.
+- Include committed Windows and Linux Core process-transport source and the
+  generic Windows SEA launcher source as native-host groundwork. These sources
+  do not activate a platform host or deliver a public native executable; app
+  host composition and the remaining native integration stay independently owned.
+- Clarify development `latest` tracking, production-designated pins, matching
+  requester notices, and required documentation/site release follow-through.
+- No new dependency, application service, automatic runtime installation,
+  application default change or saved-data migration is introduced.
+
 ## 0.55.0
 
 - Add public Core client, protocol contracts and classic-script source generation

package/README.md

@@ -20,9 +20,11 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.55.0` SDK contract. Applications pin one exact npm
-version and lockfile; registry state is deliberately not baked into application
-artifacts.
+This checkout defines the `0.57.0` SDK contract. Development applications declare
+`arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
+designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
+to refresh and compare the installed SDK and lockfile with the published channel;
+registry state is deliberately not baked into application artifacts.
 
 Standalone browser apps use their repository root and installed npm package directly, without a
 generated workspace `arcane/` directory or `arcane.lock.json`. Select the

package/browser-runtime/ai/core-local.mjs

@@ -0,0 +1,306 @@
+import Is from '../dependencies/strong-type/index.js';
+import {getInstalledCoreClient} from '../core/client.mjs';
+
+const is = new Is(false);
+const PROVIDER_PROTOCOL = 'arcane-ai-provider/2';
+const AUTHORITY_PROTOCOL = 'arcane-ai-model-authority/1';
+
+function localAIError(code, message, cause) {
+    const error = cause === undefined ? new Error(message) : new Error(message, {cause});
+    error.code = code;
+    return error;
+}
+
+function cancelled(reason) {
+    const error = localAIError('ARCANE_AI_REQUEST_ABORTED', 'The local AI request was cancelled.', reason);
+    error.name = 'AbortError';
+    return error;
+}
+
+/**
+ * Browser-safe llama.cpp access through an existing Core connection. The app
+ * selects its model; Core owns the running engine and its loaded sessions.
+ * Creating this provider neither connects a transport nor installs a runtime.
+ */
+export function createCoreLocalAIProvider({client = getInstalledCoreClient(), id = 'llama.cpp'} = {}) {
+    if (!is.string(id) || !id.trim()) throw new TypeError('The Core AI provider id must be a nonempty string.');
+    if (client !== null && (!is.function(client?.invoke) || !is.function(client?.events?.on))) {
+        throw new TypeError('The Core AI client must expose invoke and events.on.');
+    }
+
+    let runtime = null;
+    let models = [];
+    let selection = null;
+    let disposed = false;
+    let loading = false;
+    let sequence = 0;
+    let lifecycleRevision = 0;
+    const requests = new Set();
+
+    function requireClient() {
+        if (disposed) throw localAIError('ARCANE_AI_PROVIDER_DISPOSED', 'The Core AI provider is disposed.');
+        if (!client) throw localAIError('ARCANE_AI_CORE_UNAVAILABLE', 'Local llama.cpp requires an available Core connection.');
+        return client;
+    }
+
+    function requireSelection(value) {
+        if (value?.providerId !== id || !is.string(value?.modelId) || !value.modelId
+            || value.localOnly !== true) {
+            throw localAIError('ARCANE_AI_MODEL_AUTHORITY_REQUIRED', 'The local provider requires an explicit matching provider and model.');
+        }
+        return value;
+    }
+
+    function loadedModel() {
+        return selection && models.find(function selectedModel(model) {
+            return model.id === selection.modelId && model.loaded === true;
+        });
+    }
+
+    function modelReady() {
+        return runtime?.available === true && runtime.state === 'ready' && Boolean(loadedModel());
+    }
+
+    function status() {
+        const loaded = !disposed && modelReady();
+        return {
+            state: disposed ? 'disposed' : loading ? 'loading' : loaded ? 'ready'
+                : runtime?.error ? 'error' : runtime?.available === true ? 'unloaded' : 'unavailable',
+            loaded,
+            busy: loading || requests.size > 0,
+            modelId: selection?.modelId ?? null,
+            available: !disposed && runtime?.available === true,
+            installed: runtime?.installed === true,
+            error: runtime?.error ?? null
+        };
+    }
+
+    function acceptRuntime(value) {
+        runtime = value ?? null;
+        models = is.array(runtime?.models) ? runtime.models : [];
+        for (const request of requests) {
+            const model = models.find(function requestModel(record) { return record.id === request.modelId; });
+            if (model?.loaded === true) request.loaded = true;
+            if (runtime?.available !== true || (request.loaded && (runtime.state !== 'ready' || model?.loaded !== true))) {
+                request.controller.abort(localAIError('ARCANE_AI_MODEL_NOT_READY', 'The requested local model is no longer ready.', runtime?.error));
+            }
+        }
+        return status();
+    }
+
+    const unsubscribe = client?.events.on('localai.state', function localRuntimeChanged(snapshot) {
+        if (disposed || !is.array(snapshot?.runtimes)) return;
+        lifecycleRevision += 1;
+        acceptRuntime(snapshot.runtimes.find(function llamaRuntime(value) {
+            return value.id === 'llama.cpp';
+        }));
+    }) ?? function noCoreSubscription() {};
+
+    function authority(value) {
+        return {protocol: AUTHORITY_PROTOCOL, providerId: id, modelId: value.modelId};
+    }
+
+    async function inspect(value, {signal} = {}) {
+        requireSelection(value);
+        if (signal?.aborted) throw cancelled(signal.reason);
+        try {
+            const core = requireClient();
+            const statusRevision = lifecycleRevision;
+            const current = await core.invoke('llama.status', {}, {signal});
+            if (lifecycleRevision === statusRevision) acceptRuntime(current);
+            if (runtime?.available !== true) {
+                return {
+                    available: false,
+                    code: 'ARCANE_AI_PROVIDER_UNAVAILABLE',
+                    message: 'The local llama.cpp runtime is unavailable.',
+                    error: runtime?.error ?? null
+                };
+            }
+            if (!models.some(function matchesModel(model) { return model.id === value.modelId; })) {
+                return {
+                    available: false,
+                    code: 'ARCANE_AI_MODEL_UNAVAILABLE',
+                    message: 'The selected model is unavailable in the local llama.cpp runtime.'
+                };
+            }
+            return {available: true, authority: authority(value)};
+        } catch (error) {
+            if (signal?.aborted || error?.name === 'AbortError') throw error;
+            acceptRuntime({...runtime, available: false, state: 'error', error});
+            return {available: false, code: error.code ?? 'ARCANE_AI_CORE_UNAVAILABLE', message: error.message, error};
+        }
+    }
+
+    async function load({selection: value, signal, progress} = {}) {
+        const core = requireClient();
+        requireSelection(value);
+        if (signal?.aborted) throw cancelled(signal.reason);
+        selection = value;
+        loading = true;
+        try {
+            progress?.({phase: 'loading', modelId: value.modelId});
+            const revision = lifecycleRevision;
+            const current = await core.invoke('llama.load', {model: value.modelId}, {signal});
+            if (lifecycleRevision === revision) acceptRuntime(current);
+            if (!modelReady()) throw localAIError('ARCANE_AI_MODEL_NOT_READY', 'Core did not report the selected model loaded and ready.', current?.error);
+            progress?.({phase: 'ready', modelId: value.modelId});
+            return {authority: authority(value), status: {...status(), state: 'ready', busy: false}};
+        } finally {
+            loading = false;
+        }
+    }
+
+    function ownRequest(signal, modelId) {
+        const controller = new AbortController();
+        function forwardAbort() { controller.abort(signal.reason); }
+        signal?.addEventListener('abort', forwardAbort, {once: true});
+        if (signal?.aborted) forwardAbort();
+        const request = {controller, result: null, modelId, loaded: models.some(function loadedTarget(model) {
+            return model.id === modelId && model.loaded === true;
+        })};
+        requests.add(request);
+        request.release = function releaseRequest() {
+            signal?.removeEventListener('abort', forwardAbort);
+            requests.delete(request);
+        };
+        return request;
+    }
+
+    function streamRequest(core, parameters, signal) {
+        const request = ownRequest(signal, parameters.model);
+        const chunks = [];
+        const readers = [];
+        let complete = false;
+        let failure = null;
+        sequence += 1;
+        const streamId = is.function(core.uuid) ? core.uuid()
+            : globalThis.crypto?.randomUUID?.() ?? `${id}:${Date.now()}:${sequence}:${Math.random()}`;
+
+        function flush() {
+            while (readers.length && chunks.length && !request.controller.signal.aborted) {
+                readers.shift().resolve({value: chunks.shift(), done: false});
+            }
+            if (!complete || (chunks.length && !request.controller.signal.aborted)) return;
+            while (readers.length) {
+                const reader = readers.shift();
+                if (failure) reader.reject(failure);
+                else reader.resolve({value: undefined, done: true});
+            }
+        }
+
+        const stopChunks = core.events.on('llama.chunk', function receiveChunk(event) {
+            if (event?.streamId !== streamId || complete || request.controller.signal.aborted) return;
+            chunks.push(event.chunk);
+            flush();
+        });
+
+        request.result = Promise.resolve().then(function invokeStream() {
+            return core.invoke('llama.chat', {...parameters, stream: true, streamId}, {signal: request.controller.signal});
+        }).then(function streamCompleted(result) {
+            if (request.controller.signal.aborted) throw cancelled(request.controller.signal.reason);
+            return result;
+        }).catch(function streamFailed(error) {
+            failure = error;
+            throw error;
+        }).finally(function releaseStream() {
+            complete = true;
+            stopChunks();
+            request.release();
+            flush();
+        });
+        request.result.catch(function observeRetainedStreamFailure() {});
+
+        function cancel(reason) {
+            if (!complete) request.controller.abort(reason);
+            return request.result.then(function cancelledAfterSuccess() {}, function cancelledAfterFailure() {});
+        }
+
+        return {
+            result: request.result,
+            cancel,
+            [Symbol.asyncIterator]() {
+                return {
+                    next() {
+                        if (request.controller.signal.aborted) return Promise.reject(failure ?? cancelled(request.controller.signal.reason));
+                        if (chunks.length) return Promise.resolve({value: chunks.shift(), done: false});
+                        if (complete) return failure ? Promise.reject(failure) : Promise.resolve({value: undefined, done: true});
+                        return new Promise(function awaitChunk(resolve, reject) { readers.push({resolve, reject}); });
+                    },
+                    async return() {
+                        await cancel();
+                        return {value: undefined, done: true};
+                    }
+                };
+            }
+        };
+    }
+
+    async function request({selection: value, operation, payload, signal} = {}) {
+        const core = requireClient();
+        requireSelection(value);
+        if (signal?.aborted) throw cancelled(signal.reason);
+        if (loading || selection?.modelId !== value.modelId) {
+            throw localAIError('ARCANE_AI_MODEL_NOT_READY', 'Load the selected local model before requesting inference.');
+        }
+        const model = payload?.model ?? value.modelId;
+        if (!models.some(function knownModel(record) { return record.id === model; })) {
+            const revision = lifecycleRevision;
+            const current = await core.invoke('llama.status', {}, {signal});
+            if (lifecycleRevision === revision) acceptRuntime(current);
+        }
+        if (!models.some(function knownModel(record) { return record.id === model; })) {
+            throw localAIError('ARCANE_AI_MODEL_UNAVAILABLE', 'The requested model is unavailable in the local llama.cpp runtime.');
+        }
+        if (runtime?.available !== true || runtime.state !== 'ready'
+            || (model === value.modelId && !modelReady())) {
+            throw localAIError('ARCANE_AI_MODEL_NOT_READY', 'The requested local runtime or selected model is not ready.');
+        }
+        const parameters = {model, payload};
+        if (operation === 'stream') return streamRequest(core, parameters, signal);
+        if (operation !== 'chat') throw localAIError('ARCANE_AI_PROVIDER_OPERATION_UNAVAILABLE', 'The local llama.cpp provider supports chat and stream.');
+        const pending = ownRequest(signal, model);
+        pending.result = Promise.resolve().then(function invokeChat() {
+            return core.invoke('llama.chat', {...parameters, stream: false}, {signal: pending.controller.signal});
+        }).then(function chatCompleted(result) {
+            if (pending.controller.signal.aborted) throw cancelled(pending.controller.signal.reason);
+            return result;
+        }).finally(pending.release);
+        return pending.result;
+    }
+
+    async function unload({selection: value = selection, signal} = {}) {
+        const core = requireClient();
+        if (signal?.aborted) throw cancelled(signal.reason);
+        for (const request of requests) request.controller.abort();
+        await Promise.allSettled([...requests].map(function activeResult(request) { return request.result; }));
+        if (!value) return status();
+        requireSelection(value);
+        const revision = lifecycleRevision;
+        const current = await core.invoke('llama.unload', {model: value.modelId}, {signal});
+        if (lifecycleRevision === revision) acceptRuntime(current);
+        selection = null;
+        return status();
+    }
+
+    async function dispose(options = {}) {
+        if (disposed) return status();
+        if (selection || requests.size) await unload(options);
+        disposed = true;
+        unsubscribe();
+        return status();
+    }
+
+    return {
+        protocol: PROVIDER_PROTOCOL,
+        role: 'llm',
+        id,
+        localOnly: true,
+        catalog: function catalog() { return [...models]; },
+        status,
+        inspect,
+        load,
+        request,
+        unload,
+        dispose
+    };
+}

package/browser-runtime/core/client.mjs

@@ -2,6 +2,7 @@ import {arcaneEvents} from '../event-manager.mjs';
 import {CORE_PROTOCOL,CORE_READY_EVENTS,CoreError,serializeCoreError} from './contracts.mjs';
 
 const CORE_CLIENT_KEY=Symbol.for('arcane-os.core.client');
+const CORE_CLIENT_INSTALLATION=Symbol.for('arcane-os.core.client.installation');
 const CORE_EVENT='core.rpc.event';
 const LONG_OPERATION_TIMEOUT=50*60*1000;
 
@@ -12,6 +13,7 @@ export function createCoreClient({
     eventOwner=arcaneEvents,
     eventOwnerReady,
     autoConnect=true,
+    replayRuntimeState=false,
     onError=error=>global.console?.error('Arcane Core client failed.',error)
 }={}){
     const pending=new Map();
@@ -25,8 +27,14 @@ export function createCoreClient({
     let transport=null;
     let closed=false;
     let eventOwnerFailure=null;
+    let transportFailure=null;
+    let transportFailureReported=false;
 
     function report(error){
+        if(error===transportFailure){
+            if(transportFailureReported)return;
+            transportFailureReported=true;
+        }
         try{onError(error instanceof CoreError?error:new CoreError(error));}
         catch(reportError){global.console?.error('Arcane Core error listener failed.',reportError,error);}
     }
@@ -260,7 +268,7 @@ export function createCoreClient({
         throw new CoreError({code:'ARCANE_TRANSPORT_UNAVAILABLE',message:'This interface is not connected to an Arcane native host.'});
     }
     function connect(){
-        if(closed)throw new CoreError({code:'ARCANE_CLIENT_CLOSED',message:'The Core client is closed.'});
+        if(closed)throw transportFailure??new CoreError({code:'ARCANE_CLIENT_CLOSED',message:'The Core client is closed.'});
         if(transport)return transport;
         const cleanupStart=cleanups.length;
         try{
@@ -271,7 +279,11 @@ export function createCoreClient({
             transport=selected;
             if(typeof transport.subscribe==='function'){
                 const unsubscribe=transport.subscribe(receive);
-                if(typeof unsubscribe==='function')cleanups.push(unsubscribe);
+                if(typeof unsubscribe==='function'){
+                    if(closed){
+                        try{unsubscribe();}catch(error){report(error);}
+                    }else cleanups.push(unsubscribe);
+                }
             }
         }catch(error){
             transport=null;
@@ -280,7 +292,11 @@ export function createCoreClient({
             }
             throw error;
         }
+        if(closed)throw transportFailure??new CoreError({code:'ARCANE_CLIENT_CLOSED',message:'The Core client is closed.'});
         complete('transport.ready',{protocol:CORE_PROTOCOL,transport:transport.name});
+        if(replayRuntimeState&&!closed)sendControl({protocol:CORE_PROTOCOL,type:'control',control:'runtime.replay'});
+        // A native callback may close the client synchronously during replay.
+        if(closed)throw transportFailure??new CoreError({code:'ARCANE_CLIENT_CLOSED',message:'The Core client is closed.'});
         return transport;
     }
     function runtimeSnapshot(){
@@ -312,6 +328,7 @@ export function createCoreClient({
         return true;
     }
     function invoke(method,parameters={},options={}){
+        if(transportFailure)return Promise.reject(transportFailure);
         if(eventOwnerFailure)return Promise.reject(eventOwnerFailure);
         let selected;
         try{selected=connect();}catch(error){return Promise.reject(error);}
@@ -343,23 +360,37 @@ export function createCoreClient({
         }catch(error){sendFailed(error);}
         return promise;
     }
-    function close(){
-        if(closed)return false;
-        closed=true;
-        cancelAll();
+    function disposeTransport(error){
         for(const record of acknowledgements.values()){
             clearTimeout(record.timer);
-            record.reject(new CoreError({code:'ARCANE_CLIENT_CLOSED',message:'The Core client is closed.'}));
+            record.reject(error);
         }
         acknowledgements.clear();
         for(const cleanup of cleanups.splice(0)){
             try{cleanup();}catch(error){report(error);}
         }
-        source?.dispose();
+        try{source?.dispose();}catch(disposeError){report(disposeError);}
+        source=null;
+        transport=null;
         // Registration closures and already-delivered payloads belong to this
         // client lifetime and are released when the owner explicitly closes it.
         eventActions.length=0;
         completedEvents.clear();
+    }
+    function failTransport(error){
+        if(closed)return false;
+        transportFailure=error instanceof CoreError?error:new CoreError(error);
+        closed=true;
+        for(const id of pending.keys())settle(id,transportFailure);
+        disposeTransport(transportFailure);
+        report(transportFailure);
+        return true;
+    }
+    function close(){
+        if(closed)return false;
+        closed=true;
+        cancelAll();
+        disposeTransport(new CoreError({code:'ARCANE_CLIENT_CLOSED',message:'The Core client is closed.'}));
         return true;
     }
     if(typeof global.addEventListener==='function'){
@@ -369,7 +400,7 @@ export function createCoreClient({
     if(autoConnect){
         try{connect();}catch(error){if(error.code!=='ARCANE_TRANSPORT_UNAVAILABLE')report(error);}
     }
-    return {protocol:CORE_PROTOCOL,Error:CoreError,invoke,receive,connect,close,cancelAll,events,eventsReady,runtime:{current:runtimeSnapshot},uuid};
+    return {protocol:CORE_PROTOCOL,Error:CoreError,invoke,receive,connect,close,failTransport,cancelAll,events,eventsReady,runtime:{current:runtimeSnapshot},uuid};
 }
 
 /** Existing namespace call shapes; method implementations remain host-owned. */
@@ -461,28 +492,58 @@ export function createCoreFacade(client){
     };
 }
 
+/** Reads an installed SDK client without creating a transport or changing globals. */
+export function getInstalledCoreClient(global=globalThis){
+    const client=global?.[CORE_CLIENT_KEY];
+    const installation=client?.[CORE_CLIENT_INSTALLATION];
+    return installation?.global===global&&installation.active?client:null;
+}
+
 /** Installs the same synchronous facade used by classic native-host scripts. */
 export function installCoreClient(global=globalThis,options={}){
     if(global[CORE_CLIENT_KEY])return global[CORE_CLIENT_KEY];
     const client=createCoreClient({...options,global,autoConnect:false});
     const facade=createCoreFacade(client);
+    const installation={global,active:true};
+    client[CORE_CLIENT_INSTALLATION]=installation;
+    const previousFacade=global.Arcane;
     global.Arcane=facade;
     global[CORE_CLIENT_KEY]=client;
     const previous=global.__arcaneReceive;
     global.__arcaneReceive=client.receive;
+    const previousFailure=global.__arcaneTransportFailed;
+    function nativeTransportFailed(error){return client.failTransport(error);}
+    global.__arcaneTransportFailed=nativeTransportFailed;
     const close=client.close;
-    client.close=function closeInstalledClient(){
-        const changed=close();
+    const failTransport=client.failTransport;
+    let installedTransportFailure=null;
+    function releaseInstalledClient(){
+        installation.active=false;
         if(global[CORE_CLIENT_KEY]===client)delete global[CORE_CLIENT_KEY];
-        if(global.Arcane===facade)delete global.Arcane;
+        if(global.Arcane===facade){
+            if(previousFacade===undefined)delete global.Arcane;
+            else global.Arcane=previousFacade;
+        }
         if(global.__arcaneReceive===client.receive){
             if(previous===undefined)delete global.__arcaneReceive;
             else global.__arcaneReceive=previous;
         }
-        return changed;
+        if(global.__arcaneTransportFailed===nativeTransportFailed){
+            if(previousFailure===undefined)delete global.__arcaneTransportFailed;
+            else global.__arcaneTransportFailed=previousFailure;
+        }
+    }
+    client.close=function closeInstalledClient(){
+        installation.active=false;
+        try{return close();}finally{releaseInstalledClient();}
+    };
+    client.failTransport=function failInstalledTransport(error){
+        if(installation.active)installedTransportFailure=error instanceof CoreError?error:new CoreError(error);
+        releaseInstalledClient();
+        return failTransport(installedTransportFailure??error);
     };
     try{client.connect();}catch(error){
-        if(error.code!=='ARCANE_TRANSPORT_UNAVAILABLE'){
+        if(error!==installedTransportFailure&&error.code!=='ARCANE_TRANSPORT_UNAVAILABLE'){
             if(options.onError)options.onError(error);
             else global.console?.error('Arcane Core transport initialization failed.',error);
         }

package/browser-runtime/core/contracts.mjs

@@ -7,7 +7,8 @@ export const CORE_FRAME_CONTRACTS={
     response:{type:'response',fields:['protocol','type','id','ok'],success:['result'],failure:['error'],optional:['time']},
     event:{type:'event',fields:['protocol','type','event','data'],optional:['time']},
     cancel:{type:'control',control:'request.cancel',fields:['protocol','type','control','requestId']},
-    cancelAll:{type:'control',control:'requests.cancelAll',fields:['protocol','type','control']}
+    cancelAll:{type:'control',control:'requests.cancelAll',fields:['protocol','type','control']},
+    replay:{type:'control',control:'runtime.replay',fields:['protocol','type','control']}
 };
 
 /** These names describe existing methods; installed services determine availability. */

package/docs/consumer-updates.md

@@ -0,0 +1,82 @@
+# Consumer updates
+
+Development applications track the published npm `latest` channel. Declare
+`"arcane-os": "latest"` in the application's existing dependency section.
+Preserve an existing package alias where the application needs it; Arcane OS,
+for example, uses `"arcane-sdk": "npm:arcane-os@latest"` to avoid a name collision.
+Pin an application's SDK version only when Roshi explicitly designates it as a
+production build. An exact version recorded in `package-lock.json` records what
+was installed; it does not turn a development application into a production pin.
+
+## Development refresh
+
+Each application's existing owner performs its refresh through the public npm
+package workflow in its canonical `main` checkout. Coordinate the dependency
+and Git mutation window before cleanup, preserve active processes and other
+owners' work, and establish applicable dependency permissions before removing
+the installed tree. Respect explicit project stops, including Lifeline.
+
+1. Keep the SDK declaration at `latest` and preserve `package-lock.json`.
+2. Resolve the exact application path and remove only that application's
+   disposable `node_modules`, before pulling. Do not sweep sibling projects or
+   shared caches.
+3. Run `git pull` and observe the result. Preserve existing changes and stop the
+   affected operation if the pull fails or leaves conflicts.
+4. Run `npm i` through the application's supported install workflow, retaining
+   its applicable lifecycle-script options.
+5. Explicitly run `npm update arcane-os` to refresh only the SDK. For an existing
+   alias, target its dependency key, such as `npm update arcane-sdk`.
+6. Before materializing managed files or building, obtain npm's published
+   `latest` version with a fresh registry lookup, such as
+   `npm view arcane-os@latest version --prefer-online`. Read the actual installed
+   package version and the lockfile's resolved SDK version. Both must match that
+   published version. If the tag advances during the operation, refresh the SDK
+   again and report the actual selected version.
+7. Update managed SDK projections only through the application's supported
+   public package workflow. Commit the intended declaration, retained updated
+   lockfile, managed files, and relevant instructions through its normal owner.
+
+A `latest` declaration and `npm i` alone are insufficient: an existing lockfile
+can preserve an older resolution. Keep and update the lockfile instead of
+deleting it and re-resolving unrelated dependencies. Surface installation and
+compatibility failures; do not claim current adoption from a manifest label.
+
+This dependency-result comparison is part of the requested refresh. It does
+not authorize application tests, unrelated checks or dependency updates,
+recurring polling, broad cleanup, or production administration. A later release
+can advance `latest`; record the exact version selected by each refresh.
+
+## Production builds
+
+On Roshi's explicit production designation, record the selected exact SDK
+version consistently in the dependency declaration, lockfile, managed
+projections, and application instructions. Use the supported locked install
+workflow, normally `npm ci`, to reproduce that selection. A production pin
+records reproducibility, not a permanent ceiling on otherwise authorized
+needed updates. Preserve an explicit update deferral or actual compatibility
+constraint.
+
+## Feature requests and release notices
+
+Inspect the published SDK's public API and documentation before implementing a
+request. If it already supports the requested behavior, tell the requesting
+application owner which API and usage provide it and link directly to the
+relevant documentation. Do not present unpublished source as available support.
+
+After a release's npm version and channel are confirmed, notify only existing
+application owners whose requests it addresses. Notify every requester covered
+by matching, similar, or bundled requests when one shared feature serves them.
+Do not send routine release broadcasts to unrelated consumers.
+
+Each notice includes the exact published version and channel, requested
+functionality delivered, its relevance, release notes or a changelog link,
+direct API and usage documentation references, and required compatibility or
+adoption steps. Keep publication evidence distinct from application behavior.
+Deduplicate by version and recipient and retain send outcomes in the release
+handoff. Report unreachable owners and resume missing deliveries.
+
+After every release and applicable requester notices, update the documentation
+and existing SDK website for all affected public contracts, including releases
+with no requesters. Record those delivery outcomes separately. The SDK owner
+retains this follow-through; application upgrades and tests remain with their
+owners and never gate SDK publication. See [npm publication](publishing.md).