arcane-os 0.59.0 → 0.60.0

package/docs/reference/inventory/package-api.json

@@ -3898,7 +3898,7 @@
       "summary": "Projects a Core client into the established application-facing Arcane namespace.",
       "availability": "Browser and native WebView JavaScript hosts with a Core client",
       "protocol": "arcane/1 compatibility facade",
-      "normalization": "Routes existing namespace methods through client.invoke while retaining operation-specific parameters, correlation, streaming callbacks, timeouts and cancellation"
+      "normalization": "Routes namespace methods through client.invoke while retaining operation-specific parameters, correlation, streaming callbacks, timeouts and cancellation; window.setTheme(presentation,{signal}?) forwards the complete per-window backgroundColor/textColor record, with omitted fields unchanged and null reset, and returns the host's actual applied/unsupported result without changing system appearance"
     },
     {
       "id": "core-client:installCoreClient",
@@ -4052,7 +4052,7 @@
       "summary": "Assembles selected application services and browser content with the SDK-owned Windows x64 WebView2 and SEA host.",
       "availability": "Node for assembly; Windows x64 with WebView2 Runtime for execution",
       "protocol": "arcane-native-builder/1 windows-x64 provider",
-      "normalization": "Uses a selected hostDirectory or the exact installed SDK version's numeric release asset; preserves complete payloads; run cancellation closes stdin and waits for host-owned graceful shutdown"
+      "normalization": "Uses a selected hostDirectory or the exact installed SDK version's numeric release asset; preserves complete payloads; native.icon PNG/ICO derives the copied executable and host.icon without an app compiler, while other formats retain assembly with native.icon.unsupported and executableIcon:false; the matching host loads the selected window/taskbar icon and handles window.setTheme with per-field applied/unsupported results; run cancellation closes stdin and waits for host-owned graceful shutdown"
     },
     {
       "id": "native-windows-provider:arcaneNativeBuilderProvider",

package/docs/reference/inventory/runtime-modules.json

@@ -30,7 +30,7 @@
       "availability": "Browser + native bridge + TWiN Cloud",
       "protocol": "arcane-ai-browser-speech-configuration/1, AIProviderRuntime arcane-ai-provider/2 routes, globalThis.arcaneEvents, TWiN Cloud HTTPS, Arcane.ollama, Arcane.speech, Android WebView bridge",
       "normalization": "Complete mutable caller-owned browser speech authority, SDK-owned provider registration/replacement/disposal, explicit STT/TTS activation, normalized Whisper STT and Kokoro TTS execution with default capacities 1 and 4 respectively, explicit provider-neutral execution snapshots through status(role,{execution:true}), sticky readiness, canonical window.user readiness without compatibility-event object-identity admission or polling, exact ordered structural calls with required arguments.message, atomic nonblank all-ID tool-result sequencing, complete all-choice streaming/data validation, native Ollama structural adaptation, complete-response then all validated tool callbacks then completion ordering, observed async callbacks, Blob/File transcription, automatic repeated-formatting-mark removal from cloned outbound TTS input while caller and visible content stays exact, immediate exact-segment synthesis, per-call voice/speed capture, optional final-segment pause on the existing audio clock, optional per-call terminal playback completion, detached preparation with complete semantic DBOPFS audio reuse and same-owner pending request sharing, independent prepared playback without a model load for cached audio, ordered audio-clock scheduling, playable audio, active-generation TTS operation-failure routing, mute, and cancellation are normalized; provider/model/runtime/voice policy remains caller-owned. Both speech roles default execution.device to auto: webnn-npu when navigator.ml.createContext is exposed, then webgpu when navigator.gpu is exposed, then wasm for CPU execution. Failed backend loads clean up the pool before trying fresh Workers with the same prepared model and dtype; explicit devices never fall back. STT capacity only accepts 1; TTS accepts 1 through 4. Execution snapshots expose requestedDevice, selectedDevice, maxConcurrentRequests, and activeRequestCount for both roles; selectedDevice is null while unloaded and names the successful upstream session backend request when loaded. It does not prove every operation used the physical NPU: WebNN unsupported operations may use WASM, and compatibility depends on the browser, driver, hardware, and graph.",
-      "surface": "prepareTTSPlayback(payload,signal) silently returns a real Blob or native-speech descriptor; native controls expose finished/released/state/error/pause/resume/stop, and actual release owns the playback lane. fetchTTS and durable prepareTTS report ARCANE_AI_TTS_AUDIO_EXPORT_UNAVAILABLE for native voices. Request-local model overrides remain exact and never mutate the configured model. Browser-speech protocol/event/error/reason constants; default `AI`; read-only `providerRuntime`, `browserSpeechConfiguration`, and `browserSpeechDescriptor`; explicit `providerRuntime.status(role,{execution:true})` snapshots; `streamTTS(text,end,options={})` with optional voice, speed, pauseAfterMs, and waitForPlayback; automatic speech-input cleanup with SDK-internal preparation metadata; `prepareTTS({parts,storage,identity,signal,onState})` returning ordered segments, state, ready, getAudio(index), and cancel(); `playPreparedTTS(prepared,{signal,onState})` returning state, error, finished, pause(), resume(), and stop() with one playback lane per AI and observational state/error callbacks; configure/dispose speech, route lifecycle, declaration-validated chat/stream requests with exact ordered calls; optional streamRequest toolText:{name,field} and onToolText(text,call,displayId) for decoded selected argument text with actual call identity, distinct from ordinary prose and terminal tool execution; synthesis/transcription and playback controls; initializes from current canonical user readiness, installs `window.ai`, and projects `ai-ready` plus active-generation `ai-tts-failure`."
+      "surface": "Native fetchTTS(payload,signal) and fetchSTT(audio,signal) forward caller cancellation separately from their complete Core speech payloads, normalize aborts to AbortError and suppress late results; actual engine interruption remains service-owned. prepareTTSPlayback(payload,signal) silently returns a real Blob or native-speech descriptor; native controls expose finished/released/state/error/pause/resume/stop, and actual release owns the playback lane. fetchTTS and durable prepareTTS report ARCANE_AI_TTS_AUDIO_EXPORT_UNAVAILABLE for native voices. Request-local model overrides remain exact and never mutate the configured model. Browser-speech protocol/event/error/reason constants; default `AI`; read-only `providerRuntime`, `browserSpeechConfiguration`, and `browserSpeechDescriptor`; explicit `providerRuntime.status(role,{execution:true})` snapshots; `streamTTS(text,end,options={})` with optional voice, speed, pauseAfterMs, and waitForPlayback; automatic speech-input cleanup with SDK-internal preparation metadata; `prepareTTS({parts,storage,identity,signal,onState})` returning ordered segments, state, ready, getAudio(index), and cancel(); `playPreparedTTS(prepared,{signal,onState})` returning state, error, finished, pause(), resume(), and stop() with one playback lane per AI and observational state/error callbacks; configure/dispose speech, route lifecycle, declaration-validated chat/stream requests with exact ordered calls; optional streamRequest toolText:{name,field} and onToolText(text,call,displayId) for decoded selected argument text with actual call identity, distinct from ordinary prose and terminal tool execution; synthesis/transcription and playback controls; initializes from current canonical user readiness, installs `window.ai`, and projects `ai-ready` plus active-generation `ai-tts-failure`."
     },
     {
       "file": "runtime/arcane/modules/AIModelSelectionController.js",
@@ -1364,7 +1364,7 @@
       "availability": "Browser/native hybrid",
       "protocol": "ThemeManager + host Arcane.events projected once through the per-realm globalThis.arcaneEvents authority",
       "normalization": "Theme state normalized; storage/native errors mixed.",
-      "surface": "`bootstrapArcaneTheme()`, `disposeArcaneThemeBootstrap()`, `arcaneThemeReady`, and default ready promise. Shared bootstrap replays an already-ready User and disposes both appearance and user-ready subscriptions; presentation cache is nonauthoritative. Its module graph does not guarantee restoration before first paint; use the classic ThemePresentation entry after app-id and before CSS."
+      "surface": "`bootstrapArcaneTheme()`, `disposeArcaneThemeBootstrap()`, `arcaneThemeReady`, and default ready promise. Shared bootstrap replays an already-ready User. In native hosts it independently forwards computed --background/--text-color through Arcane.window.setTheme, observing shared theme events, root/body presentation attributes, stylesheets, device scheme and page restoration; browser CSS resolution retains alpha and converts modern colors to sRGB. Disposal releases appearance/user/theme subscriptions, native sampling observers and listeners, and pending window requests. Ordinary browsers remain silent. Presentation cache is nonauthoritative; use classic ThemePresentation after app-id and before CSS for early restoration."
     },
     {
       "file": "runtime/arcane/modules/ThemeManager.js",

package/docs/reference/local-image-editing.md

@@ -0,0 +1,79 @@
+# Local image edit inputs
+
+The SDK input decoder prepares a PNG raster for the shared native image
+runtime. Decoding does not load a model or perform inference. The runtime owns
+model selection, supported editing operations, native calls and their complete
+results. Applications retain the original image and decide whether to save a
+newly generated result.
+
+## Decoder contract
+
+`src/local-ai/image-editing.mjs` exports the internal worker function
+`decodeImage({data, mediaType, signal})`.
+
+| Field | Contract |
+| --- | --- |
+| `data` | Complete encoded PNG in a `Uint8Array`; a Node `Buffer` is also accepted. Only the supplied view is read. |
+| `mediaType` | `image/png`, an empty string, or omitted. The PNG signature is read from the actual input. Other declared formats report unsupported input. |
+| `signal` | Optional `AbortSignal` belonging to the image request. |
+
+The promise returns `{width, height, channel, data}`. Dimensions come from the
+source raster; `channel` is `3` for RGB or `4` for RGBA. Returned `data` is a
+separate contiguous `Uint8Array` containing interleaved samples, with pixels
+ordered left to right and rows ordered top to bottom. The native request owner
+retains this allocation until the native operation actually completes,
+including after a cancellation request.
+
+Input decoding accepts static, non-interlaced, 8-bit RGB and RGBA PNGs, all
+five PNG row filters, and image data spread across multiple `IDAT` chunks.
+RGB transparent-color information is represented as RGBA. An optional suggested
+palette on an RGB or RGBA image does not change its color type.
+
+Indexed-color, grayscale, 16-bit, interlaced and animated PNGs currently report
+unsupported input. JPEG and WebP are also unsupported by this decoder. The
+decoder does not silently convert those formats or select one animation frame.
+
+The original encoded image is copied for the operation and never modified or
+detached. Decoding preserves stored color samples and straight alpha, including
+RGB values underneath transparent pixels. It does not composite onto a chosen
+background, rotate pixels from metadata, apply a color-profile conversion,
+resize, crop or create a file. Metadata remains in the original image; the
+native raster record contains pixels and dimensions only.
+
+## Execution and cancellation
+
+Invoke the decoder inside the shared image runtime's existing worker.
+Inflation uses asynchronous Node zlib. Row reconstruction yields between
+scanlines so the worker can receive cancellation. An abort during inflation is
+observed after that native operation settles; it does not claim instant
+interruption. A cancelled decode returns no raster for inference.
+
+`ARCANE_IMAGE_INPUT_UNSUPPORTED` describes an unavailable input format or
+encoding. `ARCANE_IMAGE_DECODE_FAILED` describes unreadable PNG structure or
+scanlines. Node zlib failures retain their complete original errors, and
+cancellation retains the owning signal's reason or Node `AbortError`. A decode
+failure never returns partial imagery or substitutes a different image.
+
+## Editing semantics at the native owner
+
+Whole-image img2img uses an initial image, prompt and strength. Masked editing
+adds a separate mask; instruction/reference editing uses a model that supports
+reference conditioning. These are distinct operations and must be advertised
+only when the selected model and native path implement them. Ordinary img2img
+does not require LoRA training. The candidate engine documents this directly
+with its base SD1.4 model in the
+[tagged img2img example](https://github.com/leejet/stable-diffusion.cpp/blob/master-929-3f8527a/docs/sd.md#img2img-example).
+
+Source dimensions are decoder output, not an implicit request to change the
+generation dimensions. The model owner documents its actual canvas adaptation
+and reports actual output dimensions. In the candidate engine, temporary
+initial images use model preprocessing while caller images remain unchanged;
+even `mode=none` does not suppress all later model adaptation. See the
+[native preprocessing contract](https://github.com/leejet/stable-diffusion.cpp/blob/master-929-3f8527a/docs/image_preprocessing.md).
+
+An RGB-only model such as the selected SD1.4 candidate consumes the stored RGB
+and does not preserve alpha. The SDK must not silently choose a compositing
+background or claim that passing RGBA preserves its displayed appearance.
+Strength zero is also not an exact-copy operation: native img2img still uses
+the model's encode, sampling and decode path. These model behaviors are
+separate from the decoder preserving the original input.

package/docs/reference/model-assets.md

@@ -0,0 +1,144 @@
+# Native working files from stored model assets
+
+The selected `0.60.0` package contains the model-assets helpers as internal
+preparation. The public imports and Core registration shown below belong to
+the pending local-image integration and are unavailable through `0.60.0`.
+These examples document that integration's intended public contract.
+
+`prepareCoreModelAssets()` streams complete browser `File` or `Blob` members
+through the existing Core connection into native working files. DBOPFS keeps
+the authoritative originals. The helper performs no model download and changes
+neither stored content nor the model format.
+
+Use complete members returned by `createDbopfsModelStore().ensure()` or files
+read from the application's existing DBOPFS owner. The browser model store
+already assembles persisted Range parts into one logical Blob per upstream
+member. Preserve that member order and the original relative filenames,
+including companion files required by a model.
+
+## Browser preparation
+
+```javascript
+import {prepareCoreModelAssets} from 'arcane-os/ai/core-model-assets';
+import {createCoreImageRuntime} from 'arcane-os/ai/core-image';
+
+const stored = await modelStore.ensure(selectedSource, {signal});
+const projection = await prepareCoreModelAssets({
+    client,
+    workingDirectory: selectedWorkingDirectory,
+    members: [{path: 'sd-v1-4.ckpt', file: stored.files[0]}],
+    signal,
+    onProgress: renderPreparationProgress
+});
+const image = createCoreImageRuntime({client});
+try {
+    await image.load({
+        model: 'sd14',
+        assetProjectionId: projection.id,
+        resourcePaths: {model: 'sd-v1-4.ckpt'},
+        signal
+    });
+} finally {
+    // Native loading takes its own retain handle before using these files.
+    await projection.release();
+}
+const result = await image.generate({
+    model: 'sd14',
+    prompt: 'A dignified raccoon who has been put in charge of the moon.',
+    signal
+});
+// Display or save the complete returned image through the application owner.
+await image.unload();
+```
+
+This example assumes that the application selected the `sd14` model and its
+complete checkpoint source. Model choice, download approval, prompts, output
+storage and the selected working directory remain application-owned.
+
+`prepareCoreModelAssets({client,workingDirectory,members,signal,onProgress})`
+requires an available Core connection exposing the model-assets service.
+`client` defaults to the installed Core client. Every member is
+`{path,file}`, where `path` is its relative filename or companion-file path and
+`file` is the complete stored Blob or File. Relative working-directory paths
+resolve from the native service's `appRoot`; an application may explicitly
+select an absolute working directory.
+
+The result contains `id`, `directory`, ordered
+`members: [{path,nativePath}]`, and an idempotent asynchronous `release()`.
+The operation creates a unique child directory under the selected working
+directory. Member paths identify files inside that child directory. Original
+DBOPFS files remain untouched.
+
+Each incoming Blob stream chunk is encoded only for the existing JSON Core
+transport. The helper waits for the corresponding native write before reading
+the next chunk of that member. Independent members transfer concurrently;
+the complete member set is returned only after every write and file close
+finishes. There is no complete-model transport buffer or application content
+limit. Progress reports actual preparation phases and member paths.
+
+Cancellation stops active readers and requests. Failure joins the participating
+transfers and requests native cleanup; that cleanup joins actual file writes
+before removing the projection. Cleanup uses its own uncancelled operation so
+an already-aborted preparation signal cannot skip it. Original failures and
+cleanup failures remain observable.
+
+## Native ownership
+
+```javascript
+import {createModelAssetService} from 'arcane-os/core/model-assets';
+
+const modelAssets = createModelAssetService({appRoot});
+// Register this same service with Core and pass it to the native engine owner.
+const use = modelAssets.retain(projectionId);
+try {
+    // Load and use the complete files from use.members.
+    await ownNativeModelLifetime(use.members);
+} finally {
+    // ownNativeModelLifetime must join actual model release before returning.
+    await use.release();
+}
+```
+
+`createModelAssetService({appRoot})` returns a Core service with `current()`,
+`retain(id)` and `dispose()`. `retain()` accepts only a completed projection
+and returns `{id,directory,members,release}`. A native engine takes this handle
+before loading and releases it after actual unload, failed-load cleanup or
+worker exit. A rejected inference/load promise alone does not establish native
+release. Multiple contexts can retain one prepared set, and repeated inference
+on a retained context reuses its files.
+
+The browser's `projection.release()` relinquishes preparation ownership. It
+does not delete files retained by a native engine. Deletion follows the final
+native release and removes only that operation's working directory. Core closes
+independent services concurrently, so the model-assets service waits for all
+native retain handles during disposal instead of assuming service order.
+Owners must release their handles after joining their actual engine lifetime.
+
+Closing a browser accessor does not by itself establish native unload.
+Explicitly release unused prepared projections. Core disposal also releases
+preparation ownership and cleans up after retained engine uses end.
+
+`current()` returns `{closing,projections}`. Each projection reports its `id`,
+`directory`, `state`, ordered `members`, `preparationOwned`, number of native
+`uses`, and `error`. Core emits `modelAssets.state` for lifecycle changes.
+
+## Core transport operations
+
+| Method | Parameters | Result |
+| --- | --- | --- |
+| `modelAssets.open` | `{id,workingDirectory,members:[{path}]}` | Preparing projection and native member paths |
+| `modelAssets.write` | `{id,memberIndex,contentBase64}` | `{id,memberIndex,written:true}` after the native write |
+| `modelAssets.complete` | `{id}` | Ready projection after all files close |
+| `modelAssets.release` | `{id}` | Released preparation ownership; native uses may retain the files |
+| `modelAssets.status` | `{}` | Current projection lifecycle records |
+
+The browser helper owns this transport sequence. Correlation IDs identify
+operations; they are unrelated to content identity. Original model files remain
+separate and complete. A retry creates a new working projection from the stored
+assets; it does not redownload them or replace the authoritative DBOPFS record.
+
+The implementation uses browser streams, the existing portable Core JSON
+transport and Node filesystem operations. Native paths and cleanup follow the
+host's Windows, Linux or macOS filesystem behavior. Android requires its host's
+Core/filesystem adaptation. These are source-level platform contracts, not a
+claim of execution on every target.

package/docs/reference/runtime-modules.md

@@ -387,8 +387,12 @@ existing `audioFormat` when the catalog does not declare response formats. When
 the selected model declares `speech.responseFormats`, that setting is used only when supported; if
 the setting is the instance's `opus` default and the model rejects it, the catalog's
 `speech.defaultResponseFormat` is used, while any other unsupported setting is
-rejected. It propagates the caller-owned signal and returns a playable `Blob`;
-it does not independently choose a provider, cloud fallback, model, runtime, or
+rejected. It propagates the caller-owned signal and returns a playable `Blob`.
+The native `LOCAL_SPEACH` route forwards that signal separately from its
+synthesis payload to `Arcane.speech.synthesize(request, {signal})`; Core aborts
+are normalized to `AbortError` with `ARCANE_AI_REQUEST_ABORTED`. Actual engine
+interruption belongs to the registered service. It does not independently
+choose a provider, cloud fallback, model, runtime, or
 voice policy for the application. Every call removes repeated same formatting
 marks from a cloned outbound input before delegation; the caller's payload stays
 unchanged. The third `preparation` argument is reserved for SDK-internal
@@ -529,8 +533,11 @@ operation boundary, generation, and stable reason. Muting, explicit
 cancellation, permission waiting, and superseded generations do not emit a
 failure. The operation event does not rewrite provider readiness; the consuming
 Chat/Speech surface owns its visible mute and recovery state.
-`fetchSTT(audioFile,signal)` propagates the caller-owned signal;
-provider routes accept a `Blob` or `File` directly and leave media decoding,
+`fetchSTT(audioFile,signal)` propagates the caller-owned signal, including the
+native `Arcane.speech.transcribe(request, {signal})` route. The native signal
+remains separate from the complete audio request; Core aborts are normalized
+to `AbortError` with `ARCANE_AI_REQUEST_ABORTED`.
+Provider routes accept a `Blob` or `File` directly and leave media decoding,
 PCM normalization, and WAV construction to the selected shared provider;
 delivery suppression is guaranteed after abort, while underlying provider-stop
 claims remain limited to that provider's cancellation contract.
@@ -4168,7 +4175,9 @@ creating a profile or migrating saved data.
 Exact exports: `arcaneThemeReady`, `bootstrapArcaneTheme`, `default`, and
 `disposeArcaneThemeBootstrap`.
 
-`disposeArcaneThemeBootstrap()` removes both bootstrap-owned subscriptions.
+`disposeArcaneThemeBootstrap()` removes bootstrap-owned subscriptions,
+native-window theme observers and listeners, and cancels its pending window
+request.
 The cache is a presentation hint, not the authority for preferences or user
 data. Preference loading and User readiness independently reconcile it; cache
 failures are logged without blocking the page.
@@ -4178,6 +4187,29 @@ does not establish restoration before the first paint. Use the classic
 [ThemePresentation head entry](#themepresentationjs) before CSS for that early
 restoration. Neither entry imports User or starts its storage lifecycle.
 
+When a native host exposes `Arcane.window.setTheme`, the shared bootstrap
+samples the app body's inherited `--background` and `--text-color`. It resolves
+CSS variables, named colors, HSL and other browser-supported color forms through
+computed style. Modern color spaces use the browser's sRGB canvas conversion;
+the resolved alpha is retained separately, including translucency close to one.
+Authored styles remain unchanged. Missing semantic properties are omitted.
+
+One listener on the shared `arcane-theme-change` owner, root/body presentation
+attribute observers, stylesheet-load events and device-color-scheme changes
+schedule samples. Identical channel values do not issue another request.
+Initial sampling and preference/profile reconciliation run independently of
+rendering and native completion. Page hide cancels the pending renderer wait;
+page restoration samples again. Print presentation is excluded. The host keeps
+its last accepted colors across navigation until the next document changes
+them. No additional theme bus, polling, storage or system-appearance mutation is
+introduced by this forwarding path.
+
+Ordinary browsers and facades without the window method install no native
+sampler. An older host's unavailable-method response is recorded once in
+developer diagnostics and stops that sampler; genuine bridge failures retain
+their complete diagnostics. See the [current-window contract](core-client.md#current-window-theme)
+for per-field results, cancellation and actual adapter availability.
+
 ### Availability and normalization
 
 **Browser/native hybrid.** Theme state normalized; storage/native errors mixed. Transport: ThemeManager + Arcane.events. [Deep protocol details](protocols.md).

package/docs/reference/sdk-api.md

@@ -4563,6 +4563,12 @@ The object includes `importMap(options)`, which merges defaults with explicit
 call options and refreshes every directly navigable descriptor-selected browser
 document for one selected app. The equivalent generic route is
 `execute('import-map', options)`.
+For a standalone root app with `pwa.enabled:false`, ordinary refresh removes
+marked SDK-generated PWA references from selected documents. An explicit
+`importMap({retireGeneratedPwa:true})` also retires the four standard root PWA
+outputs and matching older manifest references after the application owner
+confirms they are generated. See [disabled-PWA retirement](pwa.md#disable-source-pwa-generation-and-retire-generated-output)
+for the required source-selection adjustment and preserved content.
 It also includes `upgrade(options)`, which performs the explicit installed-SDK
 consumer upgrade described by `upgradeApplication()`, and
 `updateCheck(options)`, which invokes `checkSdkUpdate()` once. Constructing the
@@ -4685,6 +4691,25 @@ documents through sequential writes and has no supported dry-run or
 all-file transaction. An error or cancellation can leave completed writes in
 place; rerun the operation after resolving the cause.
 
+For a standalone `appsRoot:'.'` app with `pwa.enabled:false`, ordinary refresh
+removes active generated registration scripts and matching manifest relationships
+marked `data-arcane-manifest`. Unmarked references and existing PWA files remain.
+Set `retireGeneratedPwa:true` only after confirming generated ownership of the
+matching root manifest references and all four standard outputs:
+`arcane.webmanifest`, `arcane-offline.json`, `arcane-sw.js` and `arcane-pwa.mjs`.
+Remove those generated outputs from required `package.include` entries first,
+and confirm that unselected documents no longer need them. The operation writes
+selected reference changes before deleting these files; its
+`import-map.root-files.completed` event reports actual removed paths in
+`retiredPwa`. Repeated retirement accepts already-absent output.
+
+An omitted PWA record selects no retirement; an enabled record keeps normal
+generation. The option belongs only to this explicit import-map API route.
+Ordinary development refresh does not forward file-retirement authority, and
+there is no new CLI flag. Other files, unselected/inactive HTML, authored content
+and browser registrations, caches and saved data keep their existing ownership.
+See the complete [source PWA contract](pwa.md#disable-source-pwa-generation-and-retire-generated-output).
+
 The exact command `'upgrade'` dispatches `upgradeApplication(options)`. It is
 external-workspace-only and runs that application's ordinary `npm upgrade`
 command. It does not independently reconcile the installed SDK projection,
@@ -6899,6 +6924,18 @@ Import it from `arcane-os/core/client`. The result includes `runtime`, `events`,
 `Error` and the existing `ai`, `environment`, `mail`, `speech`, `localAI`,
 `ollama`, application, platform, storage and other host namespaces.
 
+`facade.speech.synthesize(request, {signal})` and
+`facade.speech.transcribe(request, {signal})` accept an optional `AbortSignal`
+through the same correlated request lifetime. Each complete request and existing
+180,000 ms timeout remain unchanged. A pre-aborted signal sends no speech
+request; an in-flight abort emits that request's `request.cancel`, rejects with
+`ARCANE_REQUEST_ABORTED` and leaves unrelated requests active. Late responses
+cannot settle the cancelled request. Actual native synthesis or transcription
+interruption belongs to the registered service and engine; this facade supplies
+no engine. The native routes of `AI.fetchTTS(payload, signal)` and
+`AI.fetchSTT(audio, signal)` forward their signals through these calls and
+normalize cancellation to `AbortError` with `ARCANE_AI_REQUEST_ABORTED`.
+
 ### Availability and normalization
 
 **Browser and native WebView JavaScript hosts with a Core client.** Creating the
@@ -7560,8 +7597,9 @@ import createDiarizationService from 'arcane-os/core/diarization';
 
 ### Overview
 
-Reads only the complete JSON object explicitly selected by
-`--arcane-launch-config <path>`; it does not search for application configuration.
+Reads the complete JSON object explicitly selected by
+`--arcane-launch-config <path>`, with an optional separately supplied native host
+state-directory default. It does not search for application configuration.
 
 ### Signature and result
 
@@ -7569,11 +7607,15 @@ Reads only the complete JSON object explicitly selected by
 async readCoreLaunchContext({argv=process.argv.slice(2)}={})
 ```
 
-Import it from `arcane-os/core/host`. The promise resolves to `{}` when the flag
-is absent, or the complete parsed object when present. A missing flag value,
-unreadable file, malformed JSON or non-object value rejects. Relative paths use
-the process working directory. The reader does not rewrite content or mutate
-the environment.
+Import it from `arcane-os/core/host`. `--arcane-host-state-root <directory>`
+supplies a `stateRoot` default; every field from the explicit launch JSON object
+then takes precedence unchanged, including a relative, null or other explicitly
+present `stateRoot`. With neither argument, the promise resolves to `{}`.
+A missing argument value, unreadable launch file, malformed JSON or non-object
+value rejects. Relative launch-file paths use the process working directory.
+The reader does not choose, resolve or validate the state directory, rewrite
+content, discover or migrate stored data, or mutate the environment. An
+application-selected `preferencesFile` remains a separate unchanged field.
 
 ```javascript
 import {readCoreLaunchContext} from 'arcane-os/core/host';
@@ -7584,7 +7626,10 @@ const launchContext = await readCoreLaunchContext();
 The generated entry supplies artifact-derived `appRoot`, then applies the whole
 explicit context and passes the same object as every service factory's second
 argument. Authored service options remain the first argument. Workspace/state
-locations and additional fields belong to the launcher/application. See
+locations and additional fields belong to the launcher/application. Windows and
+Mac launchers forward their actual host-selected state directory through the
+separate argument; other composing hosts may use the same seam. This JavaScript
+contract does not establish a compiled host or matching release archive. See
 [launch-time locations](core-native-packaging.md#launch-time-locations).
 
 ## createCoreLocalAIProvider()

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.59.0",
+  "version": "0.60.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -107,8 +107,8 @@
   "scripts": {
     "test": "npm run test:unit && npm run test:functional && npm run test:integration && npm run test:regression",
     "test:release": "node ./bin/arcane-test.mjs test/npm-release.test.mjs",
-    "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/conversation-closing-report.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
-    "test:functional": "node ./bin/arcane-test.mjs test/ai-request-model.test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-decisions.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-input.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/chat-transient-retention.test.mjs test/cli.test.mjs test/continuous-voice-capture.test.mjs test/core-classic-source.test.mjs test/core-client.test.mjs test/core-host.test.mjs test/core-packaged-web.test.mjs test/core-runtime.test.mjs test/core-stdio.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs-png.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/file-preview.test.mjs test/import-map.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/markdown-editor.test.mjs test/markdown-media.test.mjs test/markdown-source-map.test.mjs test/modal.test.mjs test/native-module-packaging.test.mjs test/native-module-resource-references.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/rendered-print.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/theme-manager.test.mjs test/twin-cloud-images.test.mjs test/twin-cloud.test.mjs test/websocket-client-import-map.test.mjs test/websocket.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
+    "test:unit": "node ./bin/arcane-test.mjs test/app-descriptor.test.mjs test/app-schema.test.mjs test/app-selection.test.mjs test/contracts.test.mjs test/conversation-closing-report.test.mjs test/doctor.test.mjs test/mail-credentials.test.mjs test/mail-outbox.test.mjs test/mail-public-api.test.mjs test/mail-send.test.mjs test/mail-transport.test.mjs test/native-windows-icon.test.mjs test/targets.test.mjs test/workspace-operation-lock.test.mjs",
+    "test:functional": "node ./bin/arcane-test.mjs test/ai-request-model.test.mjs test/ai-request-retry.test.mjs test/ai-stream-cancellation.test.mjs test/browser-decisions.test.mjs test/browser-speech-providers.test.mjs test/browser-wasm-gpu-notice.test.mjs test/browser-wasm-download-resume.test.mjs test/chat-input.test.mjs test/chat-stream-speech.test.mjs test/chat-transcript-scroll.test.mjs test/chat-transient-retention.test.mjs test/cli.test.mjs test/continuous-voice-capture.test.mjs test/core-classic-source.test.mjs test/core-client.test.mjs test/core-host.test.mjs test/core-packaged-web.test.mjs test/core-runtime.test.mjs test/core-stdio.test.mjs test/dbopfs-document-library.test.mjs test/dbopfs-png.test.mjs test/dbopfs.test.mjs test/dev-server.test.mjs test/dev-pwa.test.mjs test/dom-event-instrumentation.test.mjs test/event-manager.test.mjs test/events.test.mjs test/file-preview.test.mjs test/import-map.test.mjs test/local-image-editing.test.mjs test/mail-cli.test.mjs test/mail-runtime.test.mjs test/mail-server.test.mjs test/markdown-editor.test.mjs test/markdown-media.test.mjs test/markdown-source-map.test.mjs test/modal.test.mjs test/native-module-packaging.test.mjs test/native-module-resource-references.test.mjs test/packaging.test.mjs test/pwa-packaging.test.mjs test/pwa-client.test.mjs test/pwa-install.test.mjs test/pwa-worker.test.mjs test/persistent-ai-chat-session.test.mjs test/reference-completeness.test.mjs test/rendered-print.test.mjs test/runtime-api-behavior.test.mjs test/runtime.test.mjs test/scaffold.test.mjs test/speech-playback.test.mjs test/site.test.mjs test/theme-manager.test.mjs test/twin-cloud-images.test.mjs test/twin-cloud.test.mjs test/websocket-client-import-map.test.mjs test/websocket.test.mjs test/update-check.test.mjs test/user-explicit-updates.test.mjs",
     "test:integration": "node ./bin/arcane-test.mjs test/installed-package-runtime.test.mjs test/root-app-layout.test.mjs test/integrated-shared.test.mjs test/integrated-workspace.test.mjs test/mail-browser.test.mjs test/native-macos-provider.test.mjs test/native-plan.test.mjs test/native-portable-provider.test.mjs test/native-provider-loader.test.mjs test/npm-release.test.mjs test/release-bundle.test.mjs test/release-capability-smoke.test.mjs test/shared-payload-batch.test.mjs test/tarball.test.mjs test/browser-wasm-cpu.test.mjs test/wllama-webgpu-runtime.test.mjs",
     "test:regression": "node ./bin/arcane-test.mjs test/channel-workflows.test.mjs test/html-import-registration.test.mjs test/html-import-packaged-script.test.mjs test/logging-regression.test.mjs test/markdown-speech.test.mjs test/prepared-speech.test.mjs test/native-provider-generation.test.mjs test/speech-queue-regression.test.mjs test/testing.test.mjs test/test-sets.test.mjs",
     "check": "node tools/check-source.mjs && npm test",

package/runtime/arcane/modules/AI.js

@@ -4084,11 +4084,19 @@ class AI {
             if(signal?.aborted){
                 throw normalizeAIRequestAbort(signal.reason);
             }
-            const response=await nativeSpeech.transcribe({
-                audioBase64:this.#arrayBufferToBase64(audioBytes),
-                mimeType,
-                model
-            });
+            let response;
+            try{
+                response=await nativeSpeech.transcribe({
+                    audioBase64:this.#arrayBufferToBase64(audioBytes),
+                    mimeType,
+                    model
+                },{signal});
+            }catch(error){
+                if(isAIRequestAbort(error,signal)){
+                    throw normalizeAIRequestAbort(error);
+                }
+                throw error;
+            }
             if(signal?.aborted){
                 throw normalizeAIRequestAbort(signal.reason);
             }
@@ -4138,13 +4146,21 @@ class AI {
         const speed=is.finite(payload.speed)?payload.speed:this.voiceSpeed;
         const nativeSpeech=this.#nativeSpeech(this.ttsService,'tts');
         if(nativeSpeech){
-            const response=await nativeSpeech.synthesize({
-                model,
-                voice,
-                input,
-                responseFormat,
-                speed
-            });
+            let response;
+            try{
+                response=await nativeSpeech.synthesize({
+                    model,
+                    voice,
+                    input,
+                    responseFormat,
+                    speed
+                },{signal});
+            }catch(error){
+                if(isAIRequestAbort(error,signal)){
+                    throw normalizeAIRequestAbort(error);
+                }
+                throw error;
+            }
             if(signal?.aborted){
                 throw normalizeAIRequestAbort(signal.reason);
             }