arcane-os 0.67.0 → 0.68.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.68.0
+
+- Add per-instance theme-switcher `configure({modes,labels})` and initial
+  `data-modes` / `data-system-label` presentation. Applications can select
+  Light / Dark / System with complete readable labels while the default
+  Auto / Light / Dark / Skin choices remain unchanged. Preserve selected,
+  disabled and keyboard-focus states with wrapping based on component space.
+- Distinguish a wholly absent Core namespace from a missing method in a
+  registered service. Retain `METHOD_NOT_ALLOWED` and add exact `method`,
+  `namespace` and `reason` lookup metadata; genuine handler errors remain intact.
+- Let the default preference adapter complete single operations through its
+  existing app-scoped local store only after an exact absent preferences
+  namespace response, retaining cancellation, disposal and full values.
+  An advertised rejected atomic batch is never retried as serial writes.
+- Treat an exactly absent optional appearance namespace as unsupported, keeping
+  the original diagnostic. Preserve partial-service and genuine errors, the
+  existing theme persistence order, native window theming and app-owned host
+  preferences. No OS-wide appearance change, migration or dependency is added.
+
 ## 0.67.0
 
 - Add native Laya FP32 typed decisions through `arcane-os/local-ai/decisions`

package/README.md

@@ -20,7 +20,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.67.0` SDK contract. Development applications declare
+This checkout defines the `0.68.0` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/docs/reference/README.md

@@ -54,6 +54,7 @@ alone does not make bare module names resolve in a browser.
 | Connect a browser to one Core transport | [Core browser client](core-client.md) |
 | Cancel one Core speech synthesis request without changing its payload | [Speech request lifetime](core-client.md#events-and-request-lifetime) and [Core facade](sdk-api.md#createcorefacade) |
 | Compose native Core dispatch, service lifecycle, and stdio hosting | [Native Core runtime](core-runtime.md) |
+| Reuse dependency-ready native services without a renderer | [Core service composition](core-runtime.md#native-service-composition) and [existing ONNX owner](local-ai.md#native-service-owners) |
 | Compose application Core services during source development, independently of local AI | [Development Core services](core-development.md) |
 | Own an explicitly selected native Codex App Server session | [Codex App Server](codex-app-server.md) |
 | Expose application-owned tools and static resources through Node STDIO | [MCP STDIO server](mcp-stdio.md) |
@@ -66,12 +67,14 @@ alone does not make bare module names resolve in a browser.
 | Select the optional Intel NPU encoder with independent CUDA or CPU decoding | [Intel NPU Whisper](../guides/native-whisper-openvino.md) |
 | Edit an original PNG with a complete prompt and explicit strength | [Local image editing](local-image-editing.md) |
 | Project complete stored model files into native working files | [Model assets through Core](model-assets.md) |
+| Prepare selected upstream model members in native services | [Native preparation and retained lifetime](model-assets.md#native-ownership) |
 | Retain a Nemotron model and diarize caller-fed audio streams | [Native speaker diarization](diarization.md) |
 | Persist application-selected preferences through Core | [Core preferences service](core-preferences.md) |
 | Read complete selected Git text without changing a checkout | [Git text snapshots](git-text-snapshot.md) |
 | Own a native working checkout under per-user ArcaneData/Repos | [Native repository workspaces](core-repositories.md) |
 | Read Git identity defaults or select child-only author and credential hints | [Git identity configuration](core-repositories.md#git-identity-configuration) |
 | Write, commit and push complete selected repository text | [Selected-text repository writing](core-repositories.md#write-commit-and-push-selected-text) |
+| Observe existing checkout configuration and capture an explicit remote/ref | [Repository configuration and selected targets](core-repositories.md#existing-checkout-configuration-and-selected-targets) |
 | Build an installed-SDK portable Core payload | [Portable Core packaging](core-native-packaging.md) |
 | Pass host-selected state defaults and unchanged explicit launch values to services | [Launch-time locations](core-native-packaging.md#launch-time-locations) |
 | Build a Windows executable without an OS checkout | [Windows executable packaging](core-native-packaging.md#windows-executable) |
@@ -79,6 +82,7 @@ alone does not make bare module names resolve in a browser.
 | Subscribe to native events | [Arcane event reference](core/arcane-events.md) |
 | Use provider-neutral AI lifecycle, chat, speech, persistence, or document context | [Normalized AI](#normalized-ai) |
 | Choose a normalized typed browser decision surface | [Browser typed decisions](ai/browser-decisions.md) |
+| Score complete typed options with native Laya FP32 | [Native typed decisions](native-decisions.md) |
 | Run a caller-selected local LLM in the browser | [Browser-WASM local AI](ai/browser-wasm.md) |
 | Run caller-selected Whisper/Kokoro, native browser recognition/voices or cloud TTS | [Browser speech providers](ai/browser-speech.md) |
 | Send TWiN chat, System One state/questions or image requests | [TWiN Cloud guide](ai/twin-cloud.md) |
@@ -239,6 +243,7 @@ Ollama, Wllama, Whisper, Kokoro, native, or cloud transport:
 | Run application-selected native llama.cpp/Ollama chat | [`arcane-os/ai/core-local`, `arcane-os/core/local-ai`](local-ai.md) | Explicit Core connection and selected native runtimes; installation, availability and loaded-model readiness remain distinct. |
 | Transcribe complete recordings with a retained native Whisper model | [`arcane-os/local-ai/whisper`](local-whisper.md) and [Core speech](native-speech.md) | Matching native helper, Whisper libraries, decoder and selected model; Windows defaults and explicit other-platform distributions have distinct preparation requirements. |
 | Run a local ONNX graph with named tensors | [`arcane-os/local-ai/onnx`, `arcane-os/ai/core-onnx`](local-ai.md#native-onnx-sessions) | Retained native workers; browser access requires an available Core ONNX service. |
+| Score typed options without a renderer | [`arcane-os/local-ai/decisions`, `arcane-os/core/decisions`](native-decisions.md) | Explicit native Laya FP32 activation using the existing ONNX owner; complete scores and outputs, joined Worker cleanup. |
 | Generate local images from complete prompts and selected model resources | [`arcane-os/local-ai/image`, `arcane-os/ai/core-image`](local-image-generation.md) | Prepared native image runtime; browser access requires its Core service. CPU Windows/Linux and Mac Metal/CPU paths have distinct actual host requirements. |
 | Supply complete stored model members to a native engine | [`arcane-os/ai/core-model-assets`, `arcane-os/core/model-assets`](model-assets.md) | Available Core service; DBOPFS originals stay authoritative while native owners retain working files. |
 | Run caller-selected Whisper/Kokoro locally | [`arcane-os/ai/browser-speech`](ai/browser-speech.md) | Browser with DBOPFS, Web Locks, Workers and selected upstream sources; automatic WebNN NPU, WebGPU, then WASM loading, or an explicit backend. |

package/docs/reference/availability-and-normalization.md

@@ -74,6 +74,7 @@ where listed. See [native output and host requirements](core-native-packaging.md
 | Share one native WebSocket by exact URI and ordered protocols | `arcane-os/websocket-client` | **Node** and **Browser**, using the host's native `WebSocket` | The selected upstream `ws-share` instance owns the connection pool and global observation. Native socket messages and events remain unchanged; there is no reconnect, heartbeat, application envelope, storage, or fallback. |
 | Build browser UI and app-local behavior | `/arcane/modules/*.js`, shared entities, and components | **Browser**; many modules also run inside every native renderer | Pure modules own their result contracts. Modules that call `Arcane` inherit the bridge boundary described below. |
 | Score caller-supplied typed options with Laya or Julia | `arcane-os/ai/browser-decisions` | **Browser** only; caller-selected upstream runtime/model and backend | Typed decisions retain complete rows and return typed values, scores, probabilities, and diagnostics in caller order. This surface is separate from chat and speech and does not silently change model, precision, backend, or family. |
+| Score complete typed options with native Laya FP32 | [`arcane-os/local-ai/decisions`, `arcane-os/core/decisions`](native-decisions.md) | **Node** Windows/Linux/macOS with selected ONNX Runtime and model; Android needs host adaptation | Reuses the existing native ONNX owner and a tokenizer Worker, with explicit load and joined cleanup. Preserves separate state/question/options/type, original rows, raw scores and complete graph outputs. GPU preference attempts actual advertised providers before CPU; provider configuration does not prove physical acceleration. No renderer, chat provider or automatic persistence is required. |
 | Select and observe independent LLM/STT/TTS roles | `/arcane/modules/AIProviderRuntime.js` and `AIRuntimeState.js` | **Cross-host** controller/state; registered providers retain their own host requirements | Required/projected provider members, route/configuration records, and status fields; per-role lifecycle, cancellation, stream cleanup, sticky state, and startup barriers are normalized. `localOnly` creates no fallback. |
 | Run a caller-selected local LLM entirely in a browser renderer | `arcane-os/ai/browser-wasm` through `createArcaneAI()` | **Browser** only; secure context, WebAssembly, and OPFS/DBOPFS; full WebGPU offload by default or explicit CPU with `gpuLayers:0` | The public AI API module normalizes multi-model lifecycle, status, complete all-choice streaming, cancellation, exact ordered structural tool-call visibility, and session persistence. Model sources are canonical ordered file descriptors; licenses and model choice remain application policy. |
 | Run caller-selected Whisper or Kokoro in a browser renderer | `arcane-os/ai/browser-speech` registered with `AIProviderRuntime` | **Browser** only; DBOPFS, Web Locks, Workers, Fetch/object URLs, and a caller-supplied self-contained runtime/model closure are required | Independent provider/2 lifecycle and status, with `auto`, `webnn-npu`, `webgpu`, or `wasm` execution. Whisper owns one Worker/session; Kokoro defaults to four and accepts one through four. Complete model/runtime selection, offline behavior, cancellation, Worker teardown, and request/result shapes are normalized. No runtime/model content or cloud fallback is supplied. |

package/docs/reference/core-runtime.md

@@ -123,6 +123,20 @@ The shared `arcane-os/core/contracts` module owns `CORE_PROTOCOL` (`arcane/1`),
 availability errors remain observable; unavailable services are not replaced
 with browser behavior.
 
+A request with no registered handler retains code `METHOD_NOT_ALLOWED` and
+adds the exact `method`, its first dotted `namespace`, and a `reason`.
+`core-namespace-unavailable` means the dispatcher has neither a service with
+that name nor any registered method in that namespace. Otherwise the reason is
+`core-method-unavailable`; the built-in `system`, `app`, and `version`
+namespaces also count as present. This is a dispatch lookup result before any
+handler or permission decision, not a capability-discovery call. A read-only
+or partially registered service therefore never appears wholly absent.
+Handler/startup/permission errors remain unchanged and acquire none of these
+lookup markers. Generic or older `METHOD_NOT_ALLOWED` errors do not establish
+namespace absence. An optional browser adapter may recognize the exact absent
+namespace and method according to its own documented contract; the dispatcher
+does not select or create another implementation.
+
 Events have `{protocol, type:'event', event, data, time}`:
 
 - `core.ready`: the dispatcher is connected; service/model readiness is separate.

package/docs/reference/inventory/package-api.json

@@ -1,17 +1,59 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.66.0",
+  "sdkVersion": "0.67.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
     "moduleSystem": "ESM"
   },
-  "memberCount": 290,
+  "memberCount": 293,
   "runtimeSubpathPatterns": {
     "arcane-os/modules/*": "./runtime/arcane/modules/*",
     "arcane-os/entities/*": "./runtime/arcane/entities/*"
   },
   "members": [
+    {
+      "id": "local-ai-decisions:createNativeDecisionModel",
+      "name": "createNativeDecisionModel",
+      "displayName": "createNativeDecisionModel()",
+      "kind": "function",
+      "signature": "createNativeDecisionModel({onnx,modelAssets,workingDirectory,paths,model='onnx-community/laya-typed-decisions-ONNX',revision='main',dtype='fp32',sessionOptions,executionPreference='gpu',signal}={})",
+      "entrypoints": ["arcane-os/local-ai/decisions"],
+      "primaryImport": "arcane-os/local-ai/decisions",
+      "group": "Native typed decisions",
+      "summary": "Explicit native Laya FP32 option scoring through an existing ONNX owner and a tokenizer Worker.",
+      "availability": "Node on Windows/Linux/macOS with selected ONNX Runtime and model files; Android needs host adaptation",
+      "protocol": "Shared browser/native decision encoding with native named tensor results",
+      "normalization": "Returns load/evaluate/classify/current/status/subscribe/unload/dispose; preserves complete separate state/question/options/type and original rows, raw scores and every graph output. Explicit load prepares selected upstream files or uses caller-owned paths; GPU preference attempts advertised providers then CPU. Cancellation retires the shared activation; files remain retained through actual ONNX and tokenizer Worker exit. No chat history or duplicate inference engine."
+    },
+    {
+      "id": "core-decisions:createNativeDecisionService",
+      "name": "createNativeDecisionService",
+      "displayName": "createNativeDecisionService()",
+      "kind": "function",
+      "signature": "createNativeDecisionService(configuration={}, {appRoot=process.cwd()}={})",
+      "entrypoints": ["arcane-os/core/decisions"],
+      "primaryImport": "arcane-os/core/decisions",
+      "group": "Native typed decisions",
+      "summary": "Renderer-independent native Laya service reusing the registered local-AI and model-assets owners.",
+      "availability": "Node Core with selected native ONNX and model files",
+      "protocol": "arcane/1 decisions.status/load/evaluate/unload and decisions.state",
+      "normalization": "Registration starts no model or tokenizer. Explicit load obtains dependency-ready same-process owners and reacquires getONNXRuntime after recovery. Native load/evaluate/classify/current/subscribe/unload/dispose preserve complete results; RPC uses the existing tensor codec. Unload has accepted service lifetime; host shutdown cancels request-lifetime load/evaluation."
+    },
+    {
+      "id": "core-decisions:default",
+      "name": "default",
+      "displayName": "createNativeDecisionService default export",
+      "kind": "function",
+      "signature": "default as createNativeDecisionService",
+      "entrypoints": ["arcane-os/core/decisions"],
+      "primaryImport": "arcane-os/core/decisions",
+      "group": "Native typed decisions",
+      "summary": "Default binding for the same native decision Core service factory.",
+      "availability": "Node Core runtime",
+      "protocol": "arcane/1 service definition",
+      "normalization": "Binding identity equals the named createNativeDecisionService export"
+    },
     {
       "id": "local-ai-whisper:createWhisperRuntime",
       "name": "createWhisperRuntime",
@@ -227,14 +269,14 @@
       "name": "createCoreImageRuntime",
       "displayName": "createCoreImageRuntime()",
       "kind": "function",
-      "signature": "createCoreImageRuntime({client=getInstalledCoreClient(),signal,onEvent}={})",
+      "signature": "createCoreImageRuntime({client,signal,onEvent}={})",
       "entrypoints": ["arcane-os/ai/core-image"],
       "primaryImport": "arcane-os/ai/core-image",
       "group": "Core local images",
       "summary": "Uses an available Core image service for generation and original-PNG editing with synchronous Thinking acknowledgement, lifecycle replay and complete PNG Blobs.",
       "availability": "Browser/native WebView with an available Core image service; construction opens no connection or model",
       "protocol": "arcane/1 image.status/load/generate/edit/unload and image.state/progress",
-      "normalization": "Returns load/generate/edit/unload/inspect/current/subscribe/close; edit preserves the complete original PNG Blob/File through transport with explicit strength; timeoutMs is zero, close cancels only this accessor and explicit unload owns the shared model"
+      "normalization": "Returns load/generate/edit/unload/inspect/current/subscribe/close; omitted client follows installation/replacement/retirement, explicit client including null remains fixed. Retirement cancels owned work and clears readiness; late old-client output is suppressed. Edit preserves the complete original PNG Blob/File through transport with explicit strength; timeoutMs is zero, close cancels only this accessor and explicit unload owns the shared model"
     },
     {
       "id": "core-image-service:createLocalImageService",
@@ -290,7 +332,7 @@
       "summary": "Owns selected native working-file projections and engine retain handles while original stored model files remain unchanged.",
       "availability": "Node Core with an application-selected working directory",
       "protocol": "arcane/1 modelAssets.open/write/complete/release/status and modelAssets.state",
-      "normalization": "Returns current/retain/dispose and Core service lifecycle; final native release joins writes and closes before deleting only its working projection"
+      "normalization": "Returns current/prepare/retain/release/dispose and Core service lifecycle. Explicit prepare({id,workingDirectory,members:[{path,url}],signal,onProgress}) streams complete upstream members through the existing file owner and reports file/phase progress. release(id) relinquishes preparation ownership; cancellation and cleanup join fetches/writes. Native retains survive until actual engine release before deleting only the owned working projection. Startup downloads nothing."
     },
     {
       "id": "core-model-assets-service:default",
@@ -318,21 +360,21 @@
       "summary": "Owns explicitly loaded ONNX graphs and complete named tensor inference in retained native workers.",
       "availability": "Node on Windows/Linux/macOS x64/arm64 with prepared onnxruntime-node; Android needs host adaptation",
       "protocol": "Per-session worker lifecycle with structured-clone tensors and replaying state",
-      "normalization": "Returns load/run/unload/current/subscribe/close; explicit model and session IDs; native calls may delay worker termination, and close observes actual exit"
+      "normalization": "Returns load/run/unload/current/subscribe/close; load accepts executionPreference gpu for advertised provider creation attempts then CPU, while explicit sessionOptions.executionProviders takes precedence. Complete execution diagnostics distinguish configured providers from physical acceleration. stopping revokes new runs while exited records actual Worker exit; recoverable run errors preserve the session. Cleanup joins exit and output delivery even when termination fails."
     },
     {
       "id": "core-onnx:createCoreONNXRuntime",
       "name": "createCoreONNXRuntime",
       "displayName": "createCoreONNXRuntime()",
       "kind": "function",
-      "signature": "createCoreONNXRuntime({client=getInstalledCoreClient()}={})",
+      "signature": "createCoreONNXRuntime({client}={})",
       "entrypoints": ["arcane-os/ai/core-onnx"],
       "primaryImport": "arcane-os/ai/core-onnx",
       "group": "Core local AI",
       "summary": "Accesses local system ONNX through an existing Core client with complete tensor transport.",
       "availability": "Browser with available Core ONNX service; construction installs no runtime or model",
       "protocol": "arcane/1 onnx.status/load/run/unload and localai.state",
-      "normalization": "Returns load/run/unload/inspect/current/subscribe/close; preserves typed and string tensors; accessor close cancels its requests without closing shared Core or implicitly unloading shared models"
+      "normalization": "Returns load/run/unload/inspect/current/subscribe/close; omitted client follows late installation/replacement/retirement and reads current status, while explicit client including null stays fixed. Retirement clears readiness and cancels owned work; late old-client results are suppressed. Preserves typed and string tensors; close removes subscriptions and cancels requests without closing shared Core or implicitly unloading shared models"
     },
     {
       "id": "root:createGitTextSnapshot",
@@ -409,14 +451,14 @@
       "name": "createCoreLocalAIProvider",
       "displayName": "createCoreLocalAIProvider()",
       "kind": "function",
-      "signature": "createCoreLocalAIProvider({client=getInstalledCoreClient(),id='llama.cpp'}={})",
+      "signature": "createCoreLocalAIProvider({client,id='llama.cpp'}={})",
       "entrypoints": ["arcane-os/ai/core-local"],
       "primaryImport": "arcane-os/ai/core-local",
       "group": "Core local AI",
       "summary": "Browser llama.cpp provider through an explicitly connected Core, with application-owned model selection and complete response streaming.",
       "availability": "Browser with an available Core local AI service; construction installs no runtime or model",
       "protocol": "arcane-ai-provider/2 LLM lifecycle over arcane/1",
-      "normalization": "Preserves complete payloads and original parsed chunks; waits for the exact requested model and cancels on observed readiness loss"
+      "normalization": "Preserves complete payloads and original parsed chunks; waits for the exact requested model and cancels on observed readiness loss. Omitted client follows installation/replacement/retirement; explicit client including null stays fixed. Inspect reports load capability separately from loaded readiness; disposal releases only an actually retained selection through its captured client. Provider/2 role state reconciles at existing operation boundaries, not through an idle state subscription."
     },
     {
       "id": "core-local-ai:createLocalAIService",
@@ -430,7 +472,7 @@
       "summary": "Composes selected native llama.cpp, Ollama and ONNX engines as a Core service with retained process/worker ownership and model lifecycle.",
       "availability": "Node with selected upstream runtime distributions or available configured system services",
       "protocol": "arcane/1 methods and events; llama.cpp OpenAI HTTP/SSE, Ollama native HTTP/NDJSON and ONNX tensor transport",
-      "normalization": "Application-owned runtime and model requirements; optional prepare supplies installed records during this service startup; independent services, complete responses and exact owned-process cleanup"
+      "normalization": "Application-owned runtime and model requirements; optional prepare supplies installed records during this service startup. getONNXRuntime() returns the actual prepared ONNX owner for native composition after context.getService('local-ai'); callers reacquire after recovery and retain the acquired handle for cleanup. llama.status/models observe without starting or restarting an engine. Independent services, complete responses and exact owned-process cleanup remain unchanged."
     },
     {
       "id": "core-local-ai:default",
@@ -4276,7 +4318,7 @@
       "summary": "Creates an app-neutral Core dispatcher with explicit services, request lifetimes, events and graceful drain.",
       "availability": "Node on Windows, Linux and macOS native hosts; Android requires its host adaptation",
       "protocol": "arcane/1 dispatcher and service lifecycle",
-      "normalization": "Starts services independently, preserves complete results/errors, cancels only request-lifetime work and drains accepted service work; runtime.replay publishes current dispatcher/service state without restart and preserves reentrant lifecycle publication order"
+      "normalization": "Starts services independently; runtime.getService(name) and context.getService(name) return the same registered object after only its shared startup, without a renderer or global barrier. Lookup is readiness, not a lifetime lease; new lookups reject during shutdown. Preserves complete results/errors, cancels request-lifetime work and drains accepted service work; runtime.replay publishes current dispatcher/service state without restart and preserves reentrant lifecycle publication order"
     },
     {
       "id": "core-stdio:encodeCoreFrame",

package/docs/reference/inventory/runtime-components.json

@@ -967,8 +967,9 @@
     {
       "file": "runtime/arcane/components/theme-switcher.html",
       "name": "theme-switcher.html",
-      "purpose": "Selects and refreshes system, light, dark, or custom theme mode.",
+      "purpose": "Selects and refreshes system, light, dark, or custom theme mode with per-instance choices and labels.",
       "methods": [
+        "configure()",
         "setMode()",
         "refresh()"
       ],

package/docs/reference/inventory/runtime-modules.json

@@ -1083,7 +1083,7 @@
       "summary": "Loads and updates schema-defined app preferences through native storage with a narrow browser fallback.",
       "availability": "Browser/native hybrid",
       "protocol": "Arcane.preferences or app-scoped localStorage + per-realm globalThis.arcaneEvents authority",
-      "normalization": "Complete ordinary values remain mutable; setAll uses one optional atomic adapter batch for every selected value when advertised, otherwise retains complete serial per-key compatibility, never retries a rejected dispatched batch serially, and only exact unsupported native capability changes future operations to the browser fallback.",
+      "normalization": "Complete values and operation context retained; the default adapter recognizes only exact missing preferences namespace/matching method or existing Android unsupported capability before selecting existing app-scoped localStorage. Single operations retry once after disposal/cancellation checks; partial-service and genuine failures reject unchanged. An advertised rejected batch is never retried serially, and its original rejection is preserved before later local operations.",
       "surface": "Event/error constants, default `PreferenceStore`, re-exported `Preference`/schema; load/set/setAll/reset APIs, required adapter get/set/delete plus optional setMany, state-free EventTarget/on compatibility, and `dispose()`."
     },
     {
@@ -1291,10 +1291,10 @@
       "exports": [
         "default"
       ],
-      "summary": "Reads or applies native appearance, returning an explicit unsupported browser state when no bridge exists.",
+      "summary": "Reads or applies native appearance, returning an explicit unsupported result when the bridge or optional namespace is absent.",
       "availability": "Browser/native hybrid",
       "protocol": "Arcane.appearance",
-      "normalization": "Absent bridge normalized; native result/error preserved.",
+      "normalization": "Absent bridge keeps its browser result. Exact missing appearance namespace/matching method returns supported:false with the complete original diagnostic; no platform guess or cached absence. Partial-method, permission, transport, cancellation and other genuine errors reject unchanged; available() is callable bridge presence only.",
       "surface": "default `SystemAppearance`; `available()`, `current()`, `apply()`."
     },
     {

package/docs/reference/runtime-components.md

@@ -112,7 +112,7 @@ snapshot remains owned until the browser's `afterprint` event.
 | [`task-progress.html`](#task-progresshtml) | Runs and displays a task list with started/change/complete/error state. | `configure()`<br>`setTasks()`<br>`updateTask()`<br>`runTasks()`<br>`clear()`<br>`destroy()` | `task-progress-ready`<br>`task-progress-started`<br>`task-progress-change`<br>`task-progress-complete`<br>`task-progress-error` | Task state normalized; injected task results mixed |
 | [`terminal-workspace.html`](#terminal-workspacehtml) | Presents multiple terminal sessions, output, active selection, theme, and terminal actions. | `configure()`<br>`addSession()`<br>`removeSession()`<br>`activateSession()`<br>`append()`<br>`clear()`<br>`setState()`<br>`setTheme()`<br>`focus()`<br>`destroy()` | `terminal-workspace-ready`<br>`terminal-submit`<br>`terminal-interrupt`<br>`terminal-clear`<br>`terminal-session-new`<br>`terminal-session-close`<br>`terminal-session-select`<br>`terminal-settings` | UI/session state normalized; native command results supplied externally |
 | [`theme-editor.html`](#theme-editorhtml) | Edits, previews, saves, and resets semantic custom theme tokens. | `configure()`<br>`getTheme()`<br>`setTheme()`<br>`setBusy()`<br>`setStatus()`<br>`destroy()` | `theme-editor-ready`<br>`theme-preview`<br>`theme-save`<br>`theme-reset` | Fully normalized Theme values |
-| [`theme-switcher.html`](#theme-switcherhtml) | Selects and refreshes system, light, dark, or custom theme mode. | `setMode()`<br>`refresh()` | No component-specific event | Preference/native appearance behavior mixed; no component-ready contract |
+| [`theme-switcher.html`](#theme-switcherhtml) | Selects and refreshes system, light, dark, or custom theme mode with per-instance choices and labels. | `configure()`<br>`setMode()`<br>`refresh()` | No component-specific event | Preference/native appearance behavior mixed; no component-ready contract |
 | [`unified-inbox.html`](#unified-inboxhtml) | Displays provider-neutral communication threads with active/loading state. | `configure()`<br>`setThreads()`<br>`setActive()`<br>`setLoading()`<br>`destroy()` | `unified-inbox-ready`<br>`inbox-refresh`<br>`thread-select` | DOM-normalized |
 | [`voice-transcription.html`](#voice-transcriptionhtml) | Records manual clips or optional continuous microphone audio with pause/periodic segments, ordered transcription and saves, retained failures, and complete transcript delivery. | `configure()`<br>`requestSTTActivation()`<br>`startRecording()`<br>`stopRecording()`<br>`retryTranscription()`<br>`cancelRecording()`<br>`save()`<br>`completeTranscription()/complete()`<br>`clear()`<br>`reset()`<br>`destroy()` | `voice-transcription-ready`<br>`voice-transcription-state`<br>`voice-transcription-segment`<br>`voice-transcription-empty`<br>`voice-transcription-error`<br>`voice-transcription-change`<br>`voice-transcription-complete`<br>`speech-transcription-complete`<br>`speech-transcription-cancelled`<br>`speech-stt-activation-request`<br>`speech-stt-activation-error` | Sticky STT readiness, capture/queue lifecycle, retry, cancellation, and complete state/text are normalized; media/provider behavior remains external |
 | [`weather-widget.html`](#weather-widgethtml) | Displays normalized current and daily weather with refresh intent. | `setWeather()`<br>`clear()`<br>`destroy()` | `weather-widget-ready`<br>`weather-refresh` | Display normalized; provider supplied externally |
@@ -2015,11 +2015,61 @@ Shared dependencies: [`Theme.js`](runtime-entities.md#themejs).
 
 ### Overview
 
-Selects and refreshes system, light, dark, or custom theme mode.
+Selects and refreshes system, light, dark, or custom theme mode. Native buttons
+retain complete readable labels and wrap when their component runs out of room,
+independently of viewport width. Each button has a `2.75rem` minimum target in
+both dimensions. Selected buttons retain `aria-pressed` and an inset outline;
+disabled choices and keyboard focus have distinct presentation.
 
 ### Public surface
 
-Methods/properties: `setMode()`, `refresh()`.
+Methods/properties: `configure(options)`, `setMode(mode='system')`, `refresh()`.
+
+`configure({modes,labels})` changes only this component's presentation:
+
+- `modes` is an ordered array of the available identifiers `system`, `light`,
+  `dark`, and `custom`. It selects both visible choices and DOM/keyboard order.
+  Omitted `modes` retains the current presentation; an empty array displays no
+  choices. Unknown or repeated identifiers throw `TypeError` before changing
+  the presentation.
+- `labels` is a partial record of complete string labels keyed by those mode
+  identifiers. Omitted labels keep their current text. Text is assigned through
+  `textContent`, never interpreted as markup or reduced to initials. A label for
+  a built-in mode that is not a string throws `TypeError`.
+- The return value is `{modes,labels}` containing independent mutable copies of
+  the current presentation. Later changes to supplied/returned records do not
+  reconfigure the component.
+
+Label-only and unchanged-order configuration retain the existing buttons in
+place. An actual reorder restores keyboard focus to the previously focused
+button when that choice remains visible and enabled, without scrolling.
+
+The default remains Auto / Light / Dark / Skin, using identifiers
+`system`, `light`, `dark`, and `custom`. A caller may omit Skin or change Auto's
+label to System without removing custom-theme support from other instances.
+Configuration never changes preferences, activates a theme, or replaces the
+current selected mode. If the active mode is omitted, no visible button claims
+to be selected. Restoring that choice restores its existing pressed and disabled
+state. Skin remains disabled until the manager has a saved custom theme.
+
+For the initial presentation, `data-modes` accepts whitespace-separated mode
+identifiers and `data-system-label` supplies the complete system-mode label.
+These attributes are read once before the asynchronous ThemeManager import and
+preference refresh, so initial choices do not wait for `html-import-ready`.
+Use `configure()` after that event for subsequent presentation changes;
+changing these attributes later does not reconfigure an existing instance.
+
+`setMode()` updates pressed state and the host's `data-mode` only. `refresh()`
+loads the existing ThemeManager state, updates selection and Skin availability,
+and resolves with the complete manager state. Clicking a choice uses the same
+manager persistence/activation operation; buttons remain disabled while that
+operation is pending. Presentation configuration preserves that pending state.
+
+The host inherits text color. Existing `--app-bar-border` (falling back to
+`--border-color`), `--app-bar-accent` (then `--secondary-color`),
+`--app-bar-active-text` (then `--primary-color`), and `--focus-color` overrides
+remain supported. Applications own their palette and surrounding placement;
+the component adds no application-specific palette or settings section.
 
 This fragment declares no component-specific readiness or action event; use the loader's `html-import-ready` only to know that import execution completed.
 
@@ -2033,11 +2083,18 @@ Shared dependencies: [`ThemeManager.js`](runtime-modules.md#thememanagerjs).
 
 ```html
 <html-import
-  id="theme-switcher.html"
-  href="/arcane/components/theme-switcher.html">
+  id="theme-switcher"
+  href="/node_modules/arcane-os/runtime/arcane/components/theme-switcher.html"
+  data-modes="light dark system"
+  data-system-label="System">
 </html-import>
 ```
 
+This instance displays Light / Dark / System in that order. An instance without
+the two configuration attributes retains all four default choices. Both use
+the existing shared preference owner; presentation does not create a new store
+or migrate saved themes.
+
 ## unified-inbox.html
 
 ### Overview

package/docs/reference/runtime-modules.md

@@ -120,7 +120,7 @@ own asynchronous work, cancellation, and backpressure.
 | [`OllamaSettings.js`](#ollamasettingsjs) | esm | Defines complete runtime/service preference schemas and deterministic Arcane brain alias names. | Cross-host | Fully normalized settings/name contract. |
 | [`OpenMeteoWeatherProvider.js`](#openmeteoweatherproviderjs) | esm | Searches and loads Open-Meteo data into complete mutable Arcane weather entities. | Browser / native WebView / server with fetch + cloud | Provider data normalized to mutable entities; transport errors mixed. |
 | [`PersistentAIChatSession.js`](#persistentaichatsessionjs) | esm | Adds explicit retained-history/memory policy to complete configured chat without changing DBOPFS or ChatEntity semantics. | Browser / native WebView with DBOPFS and configured chat | Retained context commits atomically; `persist:false` turns are one-operation-only. |
-| [`PreferenceStore.js`](#preferencestorejs) | esm | Loads and updates schema-defined app preferences through native storage with a narrow browser fallback. | Browser/native hybrid | Complete ordinary values remain mutable; setAll uses one optional atomic adapter batch for every selected value when advertised, otherwise performs complete ordered serial writes, and only exact unsupported native capability changes future operations to the browser fallback. |
+| [`PreferenceStore.js`](#preferencestorejs) | esm | Loads and updates schema-defined app preferences through native storage with a narrow browser fallback. | Browser/native hybrid | Complete values and operation context retained; exact optional namespace absence or existing Android unsupported capability selects the existing local adapter; partial-service and genuine failures remain errors; an advertised rejected batch is never retried serially. |
 | [`PreparedSpeech.js`](#preparedspeechjs) | esm | Owns detached ordered preparation, semantic audio reuse, and per-caller cancellation behind AI.prepareTTS. | Browser / native WebView with injected synthesis and optional DBOPFS | Complete original inputs, ordered audio metadata, durable reuse, and observable preparation results. |
 | [`PrintView.js`](#printviewjs) | esm | Prints current rendered content and title through one document-owned print lifecycle. | Browser / supported native WebView print implementation | Complete rendered snapshot, preparation cancellation, resource lifetime, and honest request result. |
 | [`QRCode.min.js`](#qrcodeminjs) | classic-script | Vendored QRCode generator for DOM, canvas, SVG, and image output. | Browser vendor script | Vendor-native. |
@@ -134,7 +134,7 @@ own asynchronous work, cancellation, and backpressure.
 | [`ScreenCapture.js`](#screencapturejs) | esm | Captures a display surface as image, video, or GIF with explicit lifecycle events. | Browser / native WebView | State/events normalized; permission and codec errors mixed. |
 | [`SpeechPlayback.js`](#speechplaybackjs) | esm | Admits complete speech segments to a capacity-advertising provider immediately, retains serialized native/custom lookahead, and plays every result in exact indexed order. | Browser + native bridge | Stored part text stays exact; the outbound speech-input copy receives automatic formatting-mark cleanup; provider/media failures remain mixed. |
 | [`StaticDocumentCatalog.js`](#staticdocumentcatalogjs) | esm | Loads a positive static document inventory with cache, search, and complete context. | Browser / native WebView / server with fetch | Mutable complete catalog/content normalization; malformed data and transport failures remain visible. |
-| [`SystemAppearance.js`](#systemappearancejs) | esm | Reads or applies native appearance, returning an explicit unsupported browser state when no bridge exists. | Browser/native hybrid | Absent bridge normalized; native result/error preserved. |
+| [`SystemAppearance.js`](#systemappearancejs) | esm | Reads or applies native appearance, returning an explicit unsupported result when the bridge or optional namespace is absent. | Browser/native hybrid | Exact absent optional namespace normalized with its complete error; partial-method and genuine native errors preserved. |
 | [`SystemPlatformPresentation.js`](#systemplatformpresentationjs) | classic-script | Maps kernel names to presentation labels/classes without granting platform authority. | Browser / native WebView classic script | Fully normalized presentation only. |
 | [`SystemToolRegistry.js`](#systemtoolregistryjs) | esm | Registers validated command builders and constructs command strings without executing them. | Cross-host | Fully normalized definitions/quoting. |
 | [`TerminalClient.js`](#terminalclientjs) | esm | Maps native terminal sessions and Arcane events into an EventTarget client. | Native bridge | Client events/state normalized; native result/error mixed. |
@@ -3475,9 +3475,31 @@ Exact exports: `PREFERENCE_STORE_ERROR_CODES`,
 
 **Browser/native hybrid.** Complete ordinary values and returned snapshots remain
 mutable after schema normalization. Non-Android
-`Arcane.preferences.setMany()` supplies the optional atomic batch. Only exact
-unsupported native capability changes future operations to app-scoped
-localStorage; an in-flight advertised batch is never downgraded after rejection.
+`Arcane.preferences.setMany()` supplies the optional atomic batch. The default
+adapter uses the existing app-scoped localStorage owner when there is no native
+preferences facade, on the existing Android route, or after either the existing
+`ANDROID_CAPABILITY_UNSUPPORTED` error or an exact Core lookup error:
+`code:'METHOD_NOT_ALLOWED'`, `reason:'core-namespace-unavailable'`,
+`namespace:'preferences'`, and `method:'preferences.<current operation>'`.
+This marker proves the entire optional namespace was absent before dispatch.
+A missing method in a partial/read-only service, an older unmarked error,
+permission denial, persistence failure, transport error, or cancellation never
+selects local storage. Explicit caller adapters retain their own behavior.
+
+For `get`, `set`, and `delete`, that positively absent namespace retries the
+same operation once through the existing local adapter, then keeps that adapter
+for the store's later operations. Complete arguments and the existing
+`{operationId,signal}` context are retained. Disposal and caller cancellation
+are checked before selecting or invoking the local adapter, so a late native
+absence result cannot start a cancelled local write. No data location, schema,
+saved value, or migration is introduced.
+
+An in-flight advertised `setMany` batch is never downgraded to serial writes
+after rejection. Exact namespace absence selects the local adapter for later
+operations and preserves that batch's original rejection with no local write.
+ThemeManager's first Light/Dark/System choice uses two ordinary `set` calls,
+not a batch: both may complete through the existing local owner before the
+selected theme is applied. Its persistence-first ordering is unchanged.
 If cancellation settles after a native batch was dispatched, reload the store to
 reconcile any atomic host commit that completed before cancellation. Transport:
 Arcane.preferences or app-scoped localStorage. [Deep protocol details](protocols.md).
@@ -4064,7 +4086,8 @@ console.log(Object.keys(module));
 
 ### Overview
 
-Reads or applies native appearance, returning an explicit unsupported browser state when no bridge exists.
+Reads or applies native appearance, returning an explicit unsupported result
+when the bridge or its optional namespace is absent.
 
 ### Public surface
 
@@ -4074,7 +4097,21 @@ Exact exports: `default`.
 
 ### Availability and normalization
 
-**Browser/native hybrid.** Absent bridge normalized; native result/error preserved. Transport: Arcane.appearance. [Deep protocol details](protocols.md).
+**Browser/native hybrid.** No bridge or callable method retains the existing
+`{supported:false,platform:'browser'}` result. A callable facade is not proof of
+an installed service: `available()` reports callable `apply` presence only.
+`current()` and `apply()` recognize only a matching Core
+`METHOD_NOT_ALLOWED` error with `reason:'core-namespace-unavailable'`,
+`namespace:'appearance'`, and the exact requested method. They return
+`{supported:false,reason:'core-namespace-unavailable',error}`, retaining the
+complete original error for diagnostics and making no platform or native
+application claim. Absence is not cached, so later service registration can
+serve the next operation. Partial-method absence, unmarked permission errors,
+transport/cancellation failures and all other native errors reject unchanged.
+Native success values and existing appearance input normalization remain
+unchanged. ThemeManager may therefore complete a browser color-scheme change
+when native appearance is explicitly unsupported, while genuine failures stay
+observable. Transport: Arcane.appearance. [Deep protocol details](protocols.md).
 
 ### Example
 

package/docs/reference/sdk-api.md

@@ -69,6 +69,8 @@ runtime layouts.
 | `arcane-os/core/local-ai` | Native llama.cpp, Ollama and ONNX Core service, model readiness, complete responses and owned lifecycle. See [local AI through Core](local-ai.md). |
 | `arcane-os/local-ai` | Official runtime installation and native artifact bundling for selected llama.cpp/Ollama/ONNX/image requirements and NeMo libraries. |
 | `arcane-os/local-ai/onnx` | Retained native ONNX worker sessions with explicit graph loading and complete tensor inference. |
+| `arcane-os/local-ai/decisions` | Explicit native Laya FP32 decisions using the existing ONNX owner and a tokenizer Worker. |
+| `arcane-os/core/decisions` | Renderer-independent typed-decision service composed with existing local-AI and model-assets owners. |
 | `arcane-os/ai/core-onnx` | Optional browser access to system ONNX through an existing Core connection. |
 | `arcane-os/local-ai/image` | Retained native stable-diffusion.cpp context, complete PNG generation and owned worker lifetime. |
 | `arcane-os/ai/core-image` | Browser image lifecycle and complete PNG Blobs through an available Core service. |
@@ -169,6 +171,9 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `acceptWebSocket()` | function | `arcane-os`, `arcane-os/websocket` | WebSocket protocol | Node; browser-native client interoperability |
 | `WS` | class | `arcane-os`, `arcane-os/websocket-client` | Shared WebSocket clients | Node and native-WebSocket browser hosts |
 | `createBrowserDecisionModel()` | function | `arcane-os/ai/browser-decisions` | Browser typed decisions | Browser module Workers and the caller-selected inference backend |
+| `createNativeDecisionModel()` | function | `arcane-os/local-ai/decisions` | Native typed decisions | Node with an existing native ONNX owner and selected Laya FP32 files |
+| `createNativeDecisionService()` | function | `arcane-os/core/decisions` | Native typed decisions | Node Core with existing local-AI and model-assets services |
+| `createNativeDecisionService default export` | function | `arcane-os/core/decisions` | Native typed decisions | Same native decision service factory |
 | `fetchRequest()` | function | `arcane-os/ai/twin-cloud` | TWiN Cloud requests | Node and Browser; remote HTTPS provider |
 | `fetchSystemOneRequest()` | function | `arcane-os/ai/twin-cloud` | TWiN Cloud state-and-questions requests | Node and Browser; remote HTTPS provider |
 | `generateImages()` | function | `arcane-os/ai/twin-cloud` | TWiN Cloud image generation | Node and Browser with Fetch and Blob; remote HTTPS provider |
@@ -7297,9 +7302,18 @@ createCoreRuntime({application, version, services=[]}={})
 ```
 
 Import it from `arcane-os/core/runtime`. The runtime exposes `current()`,
-`subscribe()`, `onFrame()`, `emit()`, `registerService()`, `start()`, `handle()`
+`subscribe()`, `onFrame()`, `emit()`, `registerService()`, `getService()`, `start()`, `handle()`
 and idempotent `close()`.
 
+`await runtime.getService(name)` and service `context.getService(name)` return
+the actual registered service after its shared startup. They wait for that
+dependency alone, may start it before `runtime.start()`, and add no renderer or
+all-service barrier. Unknown services reject with `CORE_SERVICE_UNAVAILABLE`;
+new lookups during shutdown reject with `CORE_CLOSING`. Startup failures retain
+their original error. This is readiness, not a lifetime lease: retain acquired
+native handles for their actual cleanup rather than looking them up during
+disposal. See [native service composition](core-runtime.md#native-service-composition).
+
 Services start independently. Request-lifetime work receives cooperative
 cancellation; accepted `lifetime:'service'` work survives renderer cancellation.
 Shutdown stops admission, waits accepted responses, then runs each service's
@@ -8011,7 +8025,7 @@ Construction selects no model and installs no runtime or transport.
 ### Signature and result
 
 ```text
-createCoreLocalAIProvider({client=getInstalledCoreClient(),id='llama.cpp'}={})
+createCoreLocalAIProvider({client,id='llama.cpp'}={})
 ```
 
 Import it from `arcane-os/ai/core-local`. The provider implements
@@ -8023,6 +8037,16 @@ payloads and parsed streaming chunks, and cancel on observed readiness loss.
 Missing Core reports unavailability; it does not choose a browser or cloud route.
 Dispose/unregister at the caller's owning lifecycle boundary.
 
+Omitted `client` follows late installation, replacement and retirement through
+the shared Core installation subscription. An explicit client, including
+`null`, remains fixed. Replacement revokes readiness and cancels owned work;
+late results cannot restore it. `inspect()` distinguishes explicit load
+capability from loaded readiness, while `status()` remains observational.
+Disposal releases only an actually retained selection through its captured
+client, so never-loaded and already-unloaded providers send no native unload.
+The provider/2 runtime reconciles status at its operation boundaries; this
+does not add an idle role-state subscription.
+
 ```javascript
 import {createCoreLocalAIProvider} from 'arcane-os/ai/core-local';
 import {getAIProviderRuntime} from 'arcane-os/ai-provider-runtime';
@@ -8055,6 +8079,13 @@ resolved installed runtime records. It returns a Core service definition with
 existing Core lifecycle. Shutdown cancels owned work and joins owned processes;
 an already running external service remains under its external owner.
 
+After `await context.getService('local-ai')`, `service.getONNXRuntime()` returns
+that service's actual prepared ONNX owner. It creates no engine and rejects
+unavailable or closing access. Reacquire on each explicit load after recovery;
+retain the returned handle for cleanup. Core shutdown cancels request-lifetime
+work, and independent services dispose concurrently. See
+[native service owners](local-ai.md#native-service-owners).
+
 Optional `prepare({signal,onEvent})` supplies resolved runtime records during
 this service's startup. Only operations depending on that service wait for its
 preparation; the development listener and independently composed image/model
@@ -8064,7 +8095,10 @@ requirements. The managed development and native entrypoints separate them.
 
 The service provides `localai.status`, explicit `localai.services.recover`,
 `llama.status/models/load/unload/chat`, `onnx.status/load/run/unload`, and the documented native Ollama methods.
-`localai.state` reports runtime/model changes. `llama.chunk` and `ollama.chunk`
+`localai.state` reports runtime/model changes. `llama.status` and `llama.models`
+observe current state without starting, restarting or waiting for an engine.
+Explicit load retains startup and exact catalog-membership checks.
+`llama.chunk` and `ollama.chunk`
 carry original parsed chunks with `streamId`; terminal responses remain complete.
 There is no background health polling or implicit model choice.
 
@@ -8081,7 +8115,7 @@ and [native bundling](local-ai.md#native-bundling).
 
 `createONNXRuntime({modulePath,signal?,onEvent?})` from `arcane-os/local-ai/onnx`
 owns retained native ONNX sessions in workers. It exposes `load({id,model,
-sessionOptions?,signal?})`, `run({id,feeds,fetches?,runOptions?,signal?})`,
+sessionOptions?,executionPreference?,signal?})`, `run({id,feeds,fetches?,runOptions?,signal?})`,
 `unload({id,signal?})`, `current()`, replaying `subscribe(listener)` and `close()`.
 The direct model path is absolute. Complete typed tensor records use
 `{type,dims,data}`; callers own the actual graph's inputs and preprocessing.
@@ -8091,11 +8125,22 @@ before replacement. Independent sessions run concurrently; same-session work
 waits at that session's loading/execution boundary. Queued cancellation removes
 that request; active cancellation retires the affected worker and suppresses
 its response. Native code can delay termination; cleanup waits for actual exit.
+`current().sessions[].stopping` revokes new-run availability at terminal
+shutdown; `exited` records actual Worker exit. A recoverable run error leaves
+the loaded session usable. Unload joins exit and output delivery even when a
+termination request fails, preserving the complete cleanup error.
+
+The generic load defaults to CPU. `executionPreference:'gpu'` tries advertised
+CUDA, TensorRT, DirectML, CoreML and WebGPU session creation before CPU.
+Explicit `sessionOptions.executionProviders` takes precedence unchanged.
+The complete `execution` record reports discovery, provider attempts and
+fallback; successful creation establishes configuration, not physical GPU
+execution. Inference is never replayed on a different provider after failure.
 See [complete signatures, readiness, cancellation and usage](local-ai.md#native-onnx-sessions).
 
 ## createCoreONNXRuntime()
 
-`createCoreONNXRuntime({client=getInstalledCoreClient()}={})` from
+`createCoreONNXRuntime({client}={})` from
 `arcane-os/ai/core-onnx` accesses an available Core ONNX service. Its `load`,
 `run`, and `unload` mirror the native session selection and accept `signal` and
 `timeoutMs` (default `0`). Relative model paths resolve at Core's `appRoot`.
@@ -8103,7 +8148,11 @@ The accessor owns complete tensor transport encoding/decoding, `inspect()`,
 `current()`, replaying `subscribe(listener)` and `close()`. Closing cancels this
 accessor's requests and subscriptions; unloading shared models is explicit.
 Construction installs no runtime and opens no transport. Existing browser
-ONNX/Wllama remain independent. See [Core and browser usage](local-ai.md#onnx-through-core-and-the-browser).
+ONNX/Wllama remain independent. Omitted `client` follows late installation and
+reads each installed connection's current status; explicit clients, including
+`null`, remain fixed. Retirement or replacement clears readiness and cancels
+owned work, with late old-client results suppressed. Close also removes the
+installation subscription. See [Core and browser usage](local-ai.md#onnx-through-core-and-the-browser).
 
 ## createImageRuntime()
 
@@ -8143,12 +8192,18 @@ browser accessor's detach-only ownership below. See the
 
 ## createCoreImageRuntime()
 
-`createCoreImageRuntime({client=getInstalledCoreClient(),signal?,onEvent?})`
+`createCoreImageRuntime({client,signal?,onEvent?})`
 from `arcane-os/ai/core-image` returns immediately with `load`, `generate`, `edit`,
 `unload`, `inspect`, `current`, `subscribe` and `close`. It subscribes before
 requesting an initial status snapshot so newer lifecycle events win. It opens
 no connection and installs or selects no model.
 
+Omitted `client` follows late Core installation, replacement and retirement;
+an explicit client, including `null`, remains fixed. Each installed client is
+observed before its status request. Retirement cancels owned work and removes
+old readiness; late results cannot restore it. Close removes both service and
+installation subscriptions without closing the shared client or model.
+
 `load({model,context?,assetProjectionId?,resourcePaths?,signal?})` and
 `generate({model,prompt,parameters?,assetProjectionId?,resourcePaths?,signal?,
 onProgress?})` use the selected Core service. Generation acknowledges with
@@ -8445,6 +8500,14 @@ directory and complete member files.
 
 `current()` returns `{closing,projections}`. `retain(id)` accepts a completed
 projection and returns `{id,directory,members,release}` for a native owner.
+Native `prepare({id,workingDirectory,members,signal,onProgress})` accepts
+ordered `{path,url}` members and returns their ready projection. Explicit calls
+stream complete upstream responses through the same file owner; startup
+downloads nothing. Independent members transfer concurrently and progress
+reports phases and completed files. `release(id)` relinquishes preparation
+ownership; cancellation, release and disposal join fetches and writes before
+cleanup. Native retain handles keep completed files alive until actual engine
+release. See [native preparation](model-assets.md#native-ownership).
 `dispose()` releases preparation ownership and joins file writes, closes and
 all native retain lifetimes before cleanup. The native owner releases its
 handle only after its actual context/worker use ends. Original stored model
@@ -9106,6 +9169,110 @@ See the [mounting contract](pwa.md#mountpwainstallprompt) and
 [component reference](runtime-components.md#pwa-installhtml). The browser owns
 native installation eligibility and URL-bar promotion.
 
+## createNativeDecisionModel()
+
+### Overview
+
+Runs explicitly selected Laya FP32 option scoring through an existing native
+ONNX owner, with tokenization in a Node Worker. It creates no second inference
+engine and starts no model download at construction.
+
+### Signature and result
+
+```text
+createNativeDecisionModel({onnx,modelAssets,workingDirectory,paths,model='onnx-community/laya-typed-decisions-ONNX',revision='main',dtype='fp32',sessionOptions,executionPreference='gpu',signal}={})
+```
+
+Import from `arcane-os/local-ai/decisions`. Supply the existing `onnx` owner and
+either `modelAssets` plus `workingDirectory`, or native `paths` for the model,
+tokenizer and tokenizer configuration. The selected graph requires FP32. The
+handle exposes `load`, `evaluate`, `classify`, `current`, `status`, `subscribe`,
+`unload` and terminal `dispose`; `classify` aliases `evaluate` and `status`
+aliases `current`.
+
+`evaluate(rows,{signal,runOptions})` preserves each complete `state`, `question`,
+`options` and optional `type` separately. It returns `{decisions,outputs}` with
+original rows, typed values, raw logits, unrounded probabilities and every
+named tensor output. It requires a loading or loaded activation. Cancellation
+retires the shared activation and joins its actual ONNX/tokenizer lifetime;
+working files remain retained until both Workers exit. Ordinary invalid rows
+leave a healthy session and sibling evaluations intact.
+
+### Availability and normalization
+
+**Node on Windows, Linux and macOS with the selected ONNX Runtime; Android needs
+host adaptation.** GPU preference attempts actual advertised providers before
+CPU fallback; accepted configuration does not prove GPU node execution. Model
+selection, unchanged payloads, scoring interpretation and persistence remain
+application-owned. Complete lifecycle, errors and paths are documented in
+[native typed decisions](native-decisions.md).
+
+### Example
+
+```javascript
+import {createNativeDecisionModel} from 'arcane-os/local-ai/decisions';
+
+function createMoonChefDecisions({onnx, paths}) {
+    return createNativeDecisionModel({onnx, paths});
+}
+```
+
+The caller explicitly loads the returned model before evaluation and unloads
+or disposes it at its owning boundary; defining this function downloads nothing.
+
+## createNativeDecisionService()
+
+### Overview
+
+Composes the same native decision model into an existing Core runtime without
+a renderer. The factory starts no inference, tokenizer or model preparation.
+
+### Signature and result
+
+```text
+createNativeDecisionService(configuration={}, {appRoot=process.cwd()}={})
+```
+
+Import from `arcane-os/core/decisions`. Configuration selects the model options
+above and an optional service `name` (default `decisions`); relative supplied
+`paths` resolve from `appRoot`. Explicit load obtains the registered local-AI
+and, when needed, model-assets owners through `context.getService`, then
+reacquires `getONNXRuntime()` after any recovery. Native members are `load`,
+`evaluate`, `classify`, `current`, `subscribe`, `unload`, `dispose` and Core
+`start(context)`.
+
+RPC exposes `decisions.status`, `decisions.load`, `decisions.evaluate` and
+`decisions.unload`. Evaluation accepts `{rows,runOptions?}` and returns complete
+`{decisions,outputs}` using the existing tensor codec at the JSON boundary.
+`decisions.state` and replaying `subscribe(listener,{emitCurrent:true,signal})`
+report lifecycle. Unload is accepted service-lifetime cleanup; host shutdown
+still cancels request-lifetime load/evaluation.
+
+### Availability and normalization
+
+**Node Core with an existing local-AI ONNX service and selected model files.**
+Registration does not wait for all services or open another host. Original
+inputs, complete outputs, failures and cleanup semantics match the native
+model. See [composition and example](native-decisions.md#compose-with-existing-core-services).
+
+### Example
+
+```javascript
+import {createNativeDecisionService} from 'arcane-os/core/decisions';
+
+const decisions = createNativeDecisionService({
+    model: 'onnx-community/laya-typed-decisions-ONNX',
+    dtype: 'fp32',
+    workingDirectory: '.models/laya'
+});
+// Add decisions to the application's existing Core services; load explicitly.
+```
+
+## createNativeDecisionService default export
+
+The default export from `arcane-os/core/decisions` is exactly the named
+`createNativeDecisionService` factory, with the same arguments and lifecycle.
+
 ## createBrowserDecisionModel()
 
 ### Overview

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.67.0",
+  "version": "0.68.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/runtime/arcane/components/theme-switcher.html

@@ -1,11 +1,62 @@
 <style>
-    :host{display:inline-block;color:inherit}
-    .switcher{align-items:center;display:flex;gap:.15rem;padding:.2rem;border:1px solid var(--app-bar-border,var(--border-color,rgba(255,255,255,.25)));border-radius:999px;background:color-mix(in srgb,currentColor 8%,transparent)}
-    button{appearance:none;border:0;border-radius:999px;background:transparent;color:inherit;cursor:pointer;font:700 .68rem/1 system-ui,sans-serif;min-height:1.85rem;padding:.42rem .58rem}
-    button:hover{background:color-mix(in srgb,currentColor 14%,transparent)}
-    button[aria-pressed="true"]{background:var(--app-bar-accent,var(--secondary-color,#c49a52));color:var(--app-bar-active-text,var(--primary-color,#172238))}
-    button:focus-visible{outline:.18rem solid var(--focus-color,currentColor);outline-offset:.12rem}
-    @media(max-width:32rem){button{font-size:0;padding-inline:.5rem}button::first-letter{font-size:.72rem}}
+    :host {
+        display:inline-block;
+        min-inline-size:0;
+        max-inline-size:100%;
+        color:inherit;
+    }
+
+    .switcher {
+        display:flex;
+        flex-wrap:wrap;
+        align-items:center;
+        gap:.15rem;
+        box-sizing:border-box;
+        max-inline-size:100%;
+        padding:.2rem;
+        border:1px solid var(--app-bar-border,var(--border-color,rgba(255,255,255,.25)));
+        border-radius:1.6rem;
+        background:color-mix(in srgb,currentColor 8%,transparent);
+    }
+
+    button {
+        appearance:none;
+        flex:1 0 auto;
+        box-sizing:border-box;
+        min-inline-size:2.75rem;
+        max-inline-size:100%;
+        min-block-size:2.75rem;
+        padding:.5rem .75rem;
+        border:0;
+        border-radius:1.4rem;
+        background:transparent;
+        color:inherit;
+        cursor:pointer;
+        font:700 .875rem/1.25 system-ui,sans-serif;
+        text-align:center;
+        white-space:normal;
+        overflow-wrap:anywhere;
+    }
+
+    button:hover:not(:disabled) {
+        background:color-mix(in srgb,currentColor 14%,transparent);
+    }
+
+    button[aria-pressed="true"] {
+        background:var(--app-bar-accent,var(--secondary-color,rgb(196,154,82)));
+        color:var(--app-bar-active-text,var(--primary-color,rgb(23,34,56)));
+        box-shadow:inset 0 0 0 .1rem currentColor;
+    }
+
+    button:disabled {
+        cursor:not-allowed;
+        opacity:.55;
+    }
+
+    button:focus-visible {
+        outline:.18rem solid var(--focus-color,currentColor);
+        outline-offset:.12rem;
+    }
 </style>
 <div class="switcher" role="group" aria-label="Color scheme">
     <button type="button" data-scheme="system" aria-pressed="false" title="Use device theme">Auto</button>
@@ -16,31 +67,79 @@
 <script type="module">
     const host=this;
     const root=host.shadowRoot;
+    const group=root.querySelector('.switcher');
     const buttons=Array.from(root.querySelectorAll('[data-scheme]'));
+    let modes=buttons.map(function scheme(button){return button.dataset.scheme;});
+    let labels=Object.fromEntries(buttons.map(function label(button){
+        return [button.dataset.scheme,button.textContent];
+    }));
+    let busy=false;
+
+    host.configure=configure;
+    configure({
+        modes:host.dataset.modes===undefined?modes:host.dataset.modes.split(/\s+/u).filter(Boolean),
+        labels:host.dataset.systemLabel===undefined?{}:{system:host.dataset.systemLabel}
+    });
+
     const {default:ThemeManager}=await import('../modules/ThemeManager.js');
     const manager=new ThemeManager();
 
     host.setMode=setMode;
     host.refresh=refresh;
-    root.querySelector('.switcher').addEventListener('click',async event=>{
+    group.addEventListener('click',async function selectScheme(event){
         const button=event.target.closest('[data-scheme]');
-        if(!button) return;
+        if(!button||button.disabled) return;
         setBusy(true);
         try{
             const state=button.dataset.scheme==='custom'?await manager.activateCustom():await manager.setScheme(button.dataset.scheme);
             setMode(state.mode);setCustomAvailable(Boolean(state.theme));
         }finally{setBusy(false);setCustomAvailable(Boolean(manager.customTheme));}
     });
-    globalThis.addEventListener('arcane-theme-change',()=>refresh().catch(()=>{}));
+    globalThis.addEventListener('arcane-theme-change',function themeChanged(){
+        refresh().catch(function refreshRejected(){});
+    });
+
+    function configure(options={}){
+        const nextModes=options.modes===undefined?modes:[...options.modes];
+        const nextLabels={...labels,...options.labels};
+        const visible=[];
+        for(const mode of nextModes){
+            const button=buttons.find(function matchingScheme(candidate){return candidate.dataset.scheme===mode;});
+            if(!button) throw new TypeError(`Unknown theme-switcher mode: ${mode}`);
+            if(visible.includes(button)) throw new TypeError(`Repeated theme-switcher mode: ${mode}`);
+            visible.push(button);
+        }
+        for(const button of buttons){
+            const label=nextLabels[button.dataset.scheme];
+            if(typeof label!=='string') throw new TypeError('Theme-switcher labels must be strings.');
+        }
+        modes=nextModes;
+        labels=nextLabels;
+        for(const button of buttons) button.textContent=labels[button.dataset.scheme];
+        const reordered=group.children.length!==visible.length||visible.some(function moved(button,index){
+            return group.children[index]!==button;
+        });
+        if(reordered){
+            const focused=root.activeElement;
+            group.replaceChildren(...visible);
+            if(visible.includes(focused)&&!focused.disabled) focused.focus({preventScroll:true});
+        }
+        return {modes:[...modes],labels:{...labels}};
+    }
 
     function setMode(mode='system'){
         for(const button of buttons) button.setAttribute('aria-pressed',String(button.dataset.scheme===mode));
         host.dataset.mode=mode;
         return mode;
     }
-    function setBusy(value){for(const button of buttons) button.disabled=Boolean(value);}
-    function setCustomAvailable(value){root.querySelector('[data-scheme="custom"]').disabled=!value;}
+    function setBusy(value){
+        busy=Boolean(value);
+        for(const button of buttons) button.disabled=busy;
+    }
+    function setCustomAvailable(value){
+        buttons.find(function customScheme(button){return button.dataset.scheme==='custom';}).disabled=busy||!value;
+    }
     async function refresh(){const state=await manager.load();setMode(state.mode);setCustomAvailable(Boolean(state.theme));return state;}
 
-    refresh().catch(()=>setMode('system'));
+    refresh().catch(function refreshRejected(){setMode('system');});
 </script>

package/runtime/arcane/modules/PreferenceStore.js

@@ -153,21 +153,26 @@ function nativeAdapter(){
     return preferences;
 }
 
-function isUnsupportedNativeAdapter(error){
-    return error?.code==='ANDROID_CAPABILITY_UNSUPPORTED';
+function isUnsupportedNativeAdapter(error,method){
+    return error?.code==='ANDROID_CAPABILITY_UNSUPPORTED'
+        ||(error?.code==='METHOD_NOT_ALLOWED'
+            &&error.reason==='core-namespace-unavailable'
+            &&error.namespace==='preferences'
+            &&error.method===`preferences.${method}`);
 }
 
-function preferenceAdapter(){
+function preferenceAdapter(assertActive){
     const local=localAdapter('arcane.preferences');
     if(is.function(globalThis.arcaneAndroid?.postMessage)) return local;
     const native=nativeAdapter();
     if(!native) return local;
     let active=native;
-    async function call(method,args){
+    async function call(method,args,context){
         try{
             return await active[method](...args);
         }catch(error){
-            if(active!==native||!isUnsupportedNativeAdapter(error)) throw error;
+            if(active!==native||!isUnsupportedNativeAdapter(error,method)) throw error;
+            assertActive(context?.signal);
             active=local;
             delete adapter.setMany;
             if(!is.function(active[method])) throw error;
@@ -175,19 +180,19 @@ function preferenceAdapter(){
         }
     }
     const adapter={
-        async get(key){
-            return call('get',[key]);
+        async get(key,context){
+            return call('get',[key,context],context);
         },
-        async set(key,value){
-            return call('set',[key,value]);
+        async set(key,value,context){
+            return call('set',[key,value,context],context);
         },
-        async delete(key){
-            return call('delete',[key]);
+        async delete(key,context){
+            return call('delete',[key,context],context);
         }
     };
     if(is.function(native.setMany)){
         adapter.setMany=async function setMany(entries,context){
-            return call('setMany',[entries,context]);
+            return call('setMany',[entries,context],context);
         };
     }
     return adapter;
@@ -204,7 +209,7 @@ export default class PreferenceStore extends EventTarget{
         super();
         this.namespace=String(namespace||'arcane');
         this.schema=preferenceSchema(schema);
-        this.adapter=validateAdapter(adapter||preferenceAdapter());
+        this.adapter=validateAdapter(adapter||preferenceAdapter(this.#assertOperationActive.bind(this)));
         this.values=this.defaults();
         this.#events=createArcaneEventSource(
             this,

package/runtime/arcane/modules/SystemAppearance.js

@@ -8,16 +8,34 @@ export default class SystemAppearance{
 
     async current(){
         if(!this.api||!is.function(this.api.current)) return {supported:false,platform:'browser'};
-        return this.api.current();
+        try{
+            return await this.api.current();
+        }catch(error){
+            return unsupportedNamespace(error,'current');
+        }
     }
 
     async apply(input={}){
         if(!this.available()) return {supported:false,platform:'browser'};
         const scheme=['system','light','dark'].includes(input.scheme)?input.scheme:'system';
-        return this.api.apply({
-            scheme,
-            captionColor:scheme==='system'?null:input.captionColor||null,
-            textColor:scheme==='system'?null:input.textColor||null
-        });
+        try{
+            return await this.api.apply({
+                scheme,
+                captionColor:scheme==='system'?null:input.captionColor||null,
+                textColor:scheme==='system'?null:input.textColor||null
+            });
+        }catch(error){
+            return unsupportedNamespace(error,'apply');
+        }
     }
 }
+
+function unsupportedNamespace(error,method){
+    if(error?.code==='METHOD_NOT_ALLOWED'
+        &&error.reason==='core-namespace-unavailable'
+        &&error.namespace==='appearance'
+        &&error.method===`appearance.${method}`){
+        return {supported:false,reason:'core-namespace-unavailable',error};
+    }
+    throw error;
+}

package/src/core/runtime.mjs

@@ -267,7 +267,21 @@ class CoreRuntime {
 
     #request(frame) {
         const registration = this.#methods.get(frame.method);
-        if (!registration) throw failure('METHOD_NOT_ALLOWED', `Core does not expose ${frame.method}.`);
+        if (!registration) {
+            const namespace = frame.method.split('.')[0];
+            const prefix = `${namespace}.`;
+            const namespacePresent = this.#services.has(namespace)
+                || [...this.#methods.keys(), 'system.ping', 'app.current', 'version.current'].some(
+                    function inNamespace(method) { return method.startsWith(prefix); }
+                );
+            throw new CoreError({
+                code: 'METHOD_NOT_ALLOWED',
+                message: `Core does not expose ${frame.method}.`,
+                reason: namespacePresent ? 'core-method-unavailable' : 'core-namespace-unavailable',
+                namespace,
+                method: frame.method
+            });
+        }
         const {service, handle, lifetime} = registration;
         const controller = new AbortController();
         const request = {id: frame.id, method: frame.method, lifetime, controller, task: null};