arcane-os 0.67.0 → 0.69.0

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # Changelog
 
+## 0.69.0
+
+- Add explicit `textFormat:'plain'` speech input through prepared speech,
+  direct TTS requests and the browser Kokoro provider. Preserve complete input,
+  whitespace and formatting characters, original-part cache identity and
+  cancellation while leaving default narration behavior unchanged. This input
+  option does not change the selected engine's synthesis limits.
+- Add optional `native.window` width, height and resizable configuration.
+  Forward logical client dimensions through native manifests; the matching
+  Windows host applies initial DPI-aware usable-screen fitting while preserving
+  omitted defaults and subsequent application/user sizing. Other platform
+  adapters retain their existing sizing behavior.
+- Preserve selected theme-switcher colors during hover by applying ordinary
+  hover fill only to unselected enabled buttons. Keep complete labels, focus,
+  disabled states, tokens and per-instance configuration unchanged.
+
+## 0.68.0
+
+- Add per-instance theme-switcher `configure({modes,labels})` and initial
+  `data-modes` / `data-system-label` presentation. Applications can select
+  Light / Dark / System with complete readable labels while the default
+  Auto / Light / Dark / Skin choices remain unchanged. Preserve selected,
+  disabled and keyboard-focus states with wrapping based on component space.
+- Distinguish a wholly absent Core namespace from a missing method in a
+  registered service. Retain `METHOD_NOT_ALLOWED` and add exact `method`,
+  `namespace` and `reason` lookup metadata; genuine handler errors remain intact.
+- Let the default preference adapter complete single operations through its
+  existing app-scoped local store only after an exact absent preferences
+  namespace response, retaining cancellation, disposal and full values.
+  An advertised rejected atomic batch is never retried as serial writes.
+- Treat an exactly absent optional appearance namespace as unsupported, keeping
+  the original diagnostic. Preserve partial-service and genuine errors, the
+  existing theme persistence order, native window theming and app-owned host
+  preferences. No OS-wide appearance change, migration or dependency is added.
+
 ## 0.67.0
 
 - Add native Laya FP32 typed decisions through `arcane-os/local-ai/decisions`

package/README.md

@@ -20,7 +20,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.67.0` SDK contract. Development applications declare
+This checkout defines the `0.69.0` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;
@@ -469,11 +469,16 @@ keeping apostrophes, commas, and hyphens that join Unicode letters or numbers
 inside the same segment.
 Mute, stop, provider transition, and cancellation still govern the whole queue.
 
-Every TTS call automatically removes repeated same formatting marks (`*`, `#`,
+TTS narration removes repeated same formatting marks (`*`, `#`,
 `_`, backtick, `~`) from its outbound speech-input copy before synthesis.
 Streaming calls also recognize a run split across chunks. Single marks and
-ordinary repeated punctuation remain literal. No application option is needed;
-an existing `textFormat` extra is ignored and cannot disable cleanup. Original
+ordinary repeated punctuation remain literal. Complete synthesis calls may
+select `textFormat:'plain'` to preserve exact input: supply it in `prepareTTS`
+options or the payload of `fetchTTS`, provider-runtime TTS requests, or direct
+Kokoro requests. The SDK consumes this control before engine/host dispatch;
+omission keeps the default cleanup. Streaming narration and `SpeechPlayback`
+retain their existing formatting behavior. This option does not change the
+selected engine's input capacity or establish complete upstream synthesis. Original
 messages and caller payloads remain unchanged for display, storage, and model
 input. The `arcane-os/speech-text` entrypoint exports the same
 `MarkdownSpeech` streaming class and `stripSpeechFormatting()` one-pass helper

package/browser-runtime/ai/browser-speech-providers.mjs

@@ -906,7 +906,7 @@ function normalizeSynthesisPayload(payload, authority, speechInputPrepared) {
   if (shared) {
     descriptors = genericPayloadDescriptors(
       payload,
-      ["model", "voice", "input", "responseFormat", "speed"],
+      ["model", "voice", "input", "textFormat", "responseFormat", "speed"],
       ["model", "input", "responseFormat"],
       "Shared speech synthesis payload",
       "tts-synthesis",
@@ -927,7 +927,7 @@ function normalizeSynthesisPayload(payload, authority, speechInputPrepared) {
   } else {
     descriptors = genericPayloadDescriptors(
       payload,
-      ["model", "voice", "text", "speed"],
+      ["model", "voice", "text", "textFormat", "speed"],
       ["text"],
       "Browser Kokoro synthesis payload",
       "tts-synthesis",
@@ -936,7 +936,9 @@ function normalizeSynthesisPayload(payload, authority, speechInputPrepared) {
     textValue = descriptors.text.value;
   }
   const suppliedText = is.string(textValue) ? textValue : "";
-  const text = speechInputPrepared === true ? suppliedText : stripSpeechFormatting(suppliedText);
+  const text = speechInputPrepared === true || descriptors.textFormat?.value === "plain"
+    ? suppliedText
+    : stripSpeechFormatting(suppliedText);
   const voiceValue = Object.hasOwn(descriptors, "voice")
     ? descriptors.voice.value
     : authority.defaultVoice;

package/docs/reference/README.md

@@ -49,11 +49,14 @@ alone does not make bare module names resolve in a browser.
 | Import a shipped renderer module | [Runtime module catalog](runtime-modules.md) |
 | Use a shared entity | [Runtime entity modules](runtime-entities.md) and [exact export contracts](core/arcane-entities.md) |
 | Load a reusable HTML component | [Runtime component catalog](runtime-components.md) |
+| Present Light / Dark / System choices with complete labels | [Theme-switcher configuration](runtime-components.md#theme-switcherhtml) |
+| Use optional Core preferences and appearance without masking real failures | [PreferenceStore](runtime-modules.md#preferencestorejs), [SystemAppearance](runtime-modules.md#systemappearancejs), and [Core lookup errors](core-runtime.md#state-and-frames) |
 | Submit complete speech parts immediately and play them in order | [`SpeechPlayback`](runtime-modules.md#speechplaybackjs) and the [basic browser example](ai/browser-speech.md#play-a-complete-array-with-speechplayback) |
 | Call `globalThis.Arcane` | [Arcane Core API](core/arcane-api.md) |
 | Connect a browser to one Core transport | [Core browser client](core-client.md) |
 | Cancel one Core speech synthesis request without changing its payload | [Speech request lifetime](core-client.md#events-and-request-lifetime) and [Core facade](sdk-api.md#createcorefacade) |
 | Compose native Core dispatch, service lifecycle, and stdio hosting | [Native Core runtime](core-runtime.md) |
+| Reuse dependency-ready native services without a renderer | [Core service composition](core-runtime.md#native-service-composition) and [existing ONNX owner](local-ai.md#native-service-owners) |
 | Compose application Core services during source development, independently of local AI | [Development Core services](core-development.md) |
 | Own an explicitly selected native Codex App Server session | [Codex App Server](codex-app-server.md) |
 | Expose application-owned tools and static resources through Node STDIO | [MCP STDIO server](mcp-stdio.md) |
@@ -66,12 +69,14 @@ alone does not make bare module names resolve in a browser.
 | Select the optional Intel NPU encoder with independent CUDA or CPU decoding | [Intel NPU Whisper](../guides/native-whisper-openvino.md) |
 | Edit an original PNG with a complete prompt and explicit strength | [Local image editing](local-image-editing.md) |
 | Project complete stored model files into native working files | [Model assets through Core](model-assets.md) |
+| Prepare selected upstream model members in native services | [Native preparation and retained lifetime](model-assets.md#native-ownership) |
 | Retain a Nemotron model and diarize caller-fed audio streams | [Native speaker diarization](diarization.md) |
 | Persist application-selected preferences through Core | [Core preferences service](core-preferences.md) |
 | Read complete selected Git text without changing a checkout | [Git text snapshots](git-text-snapshot.md) |
 | Own a native working checkout under per-user ArcaneData/Repos | [Native repository workspaces](core-repositories.md) |
 | Read Git identity defaults or select child-only author and credential hints | [Git identity configuration](core-repositories.md#git-identity-configuration) |
 | Write, commit and push complete selected repository text | [Selected-text repository writing](core-repositories.md#write-commit-and-push-selected-text) |
+| Observe existing checkout configuration and capture an explicit remote/ref | [Repository configuration and selected targets](core-repositories.md#existing-checkout-configuration-and-selected-targets) |
 | Build an installed-SDK portable Core payload | [Portable Core packaging](core-native-packaging.md) |
 | Pass host-selected state defaults and unchanged explicit launch values to services | [Launch-time locations](core-native-packaging.md#launch-time-locations) |
 | Build a Windows executable without an OS checkout | [Windows executable packaging](core-native-packaging.md#windows-executable) |
@@ -79,6 +84,7 @@ alone does not make bare module names resolve in a browser.
 | Subscribe to native events | [Arcane event reference](core/arcane-events.md) |
 | Use provider-neutral AI lifecycle, chat, speech, persistence, or document context | [Normalized AI](#normalized-ai) |
 | Choose a normalized typed browser decision surface | [Browser typed decisions](ai/browser-decisions.md) |
+| Score complete typed options with native Laya FP32 | [Native typed decisions](native-decisions.md) |
 | Run a caller-selected local LLM in the browser | [Browser-WASM local AI](ai/browser-wasm.md) |
 | Run caller-selected Whisper/Kokoro, native browser recognition/voices or cloud TTS | [Browser speech providers](ai/browser-speech.md) |
 | Send TWiN chat, System One state/questions or image requests | [TWiN Cloud guide](ai/twin-cloud.md) |
@@ -239,6 +245,7 @@ Ollama, Wllama, Whisper, Kokoro, native, or cloud transport:
 | Run application-selected native llama.cpp/Ollama chat | [`arcane-os/ai/core-local`, `arcane-os/core/local-ai`](local-ai.md) | Explicit Core connection and selected native runtimes; installation, availability and loaded-model readiness remain distinct. |
 | Transcribe complete recordings with a retained native Whisper model | [`arcane-os/local-ai/whisper`](local-whisper.md) and [Core speech](native-speech.md) | Matching native helper, Whisper libraries, decoder and selected model; Windows defaults and explicit other-platform distributions have distinct preparation requirements. |
 | Run a local ONNX graph with named tensors | [`arcane-os/local-ai/onnx`, `arcane-os/ai/core-onnx`](local-ai.md#native-onnx-sessions) | Retained native workers; browser access requires an available Core ONNX service. |
+| Score typed options without a renderer | [`arcane-os/local-ai/decisions`, `arcane-os/core/decisions`](native-decisions.md) | Explicit native Laya FP32 activation using the existing ONNX owner; complete scores and outputs, joined Worker cleanup. |
 | Generate local images from complete prompts and selected model resources | [`arcane-os/local-ai/image`, `arcane-os/ai/core-image`](local-image-generation.md) | Prepared native image runtime; browser access requires its Core service. CPU Windows/Linux and Mac Metal/CPU paths have distinct actual host requirements. |
 | Supply complete stored model members to a native engine | [`arcane-os/ai/core-model-assets`, `arcane-os/core/model-assets`](model-assets.md) | Available Core service; DBOPFS originals stay authoritative while native owners retain working files. |
 | Run caller-selected Whisper/Kokoro locally | [`arcane-os/ai/browser-speech`](ai/browser-speech.md) | Browser with DBOPFS, Web Locks, Workers and selected upstream sources; automatic WebNN NPU, WebGPU, then WASM loading, or an explicit backend. |

package/docs/reference/ai/browser-speech.md

@@ -805,14 +805,17 @@ does not select another page or speak background work.
 
 ### Preparation inputs and reuse
 
-`ai.prepareTTS({parts,storage,identity,signal,onState})` accepts an ordered array
+`ai.prepareTTS({parts,textFormat,storage,identity,signal,onState})` accepts an ordered array
 of strings or `{input,voice?,speed?,pauseAfterMs?}` records. An omitted voice
 uses the selected model default; omitted speed uses `ai.voiceSpeed`; omitted
 pause is zero. The SDK snapshots the selected speech configuration and current
 punctuation/word-cadence options for that preparation. A part's pause applies
 after its final extracted segment. Complete original input remains available
-for semantic comparison; automatic Markdown cleanup affects only the speech
-copy and occurs once before segmentation.
+for semantic comparison; default Markdown cleanup affects only the speech
+copy and occurs once before segmentation. Set `textFormat:'plain'` to preserve
+each supplied input exactly through that segmentation. The prepared segment
+text participates in semantic reuse, so a changed synthesis input does not
+reuse audio produced from the cleaned version.
 
 `storage` is optional. When supplied, `{db,table,key}` names the caller's ready
 DBOPFS instance and its application-owned table/key. The SDK stores complete
@@ -977,7 +980,7 @@ speech method retain their existing behavior.
 ## Automatic speech-input formatting cleanup
 
 The shared streaming, audio-file, and `SpeechPlayback` paths remove repeated
-same formatting marks from the outbound speech-input copy automatically:
+same formatting marks from the outbound speech-input copy by default:
 
 ```javascript
 ai.streamTTS('## Heading\n**Hello');
@@ -994,10 +997,13 @@ waits for its next character or the final flush.
 
 `end:true`, `finishTTS()`, or cancellation clears pending streaming formatting
 state. `fetchTTS()`, provider-runtime TTS requests, direct Kokoro provider
-requests, and `SpeechPlayback` apply the same cleanup to complete input. An
-existing `textFormat` extra is ignored and cannot disable or select cleanup.
+requests, and `SpeechPlayback` apply the same default cleanup to complete input.
+Complete-input APIs can explicitly select `textFormat:'plain'` as described
+below. The streaming `streamTTS()` options still ignore `textFormat`;
+streaming narration and `SpeechPlayback` keep their existing cleanup.
 SDK-internal delegation carries `{speechInputPrepared:true}` outside the speech
-payload only after one cleanup pass, preventing a second non-idempotent pass.
+payload after its owner selects text treatment, preventing a second
+non-idempotent cleanup pass or cleanup of explicitly plain input.
 Applications omit that internal metadata. Displayed messages, saved history,
 model input, caller payload objects, language, voice, synthesis capacity, and
 playback timing are not changed by the filter.
@@ -1023,6 +1029,39 @@ console.log(speechText.append('## Head', false)); // ' Head'
 console.log(speechText.append('ing', true)); // ing
 ```
 
+### Exact complete synthesis input
+
+Use the public `textFormat:'plain'` selection for already-authored speech or an
+exact generated preview. It belongs in `prepareTTS` options, or alongside the
+`input`/`text` field of a complete synthesis payload:
+
+```javascript
+function preparePreview(ai, preview, signal) {
+  return ai.prepareTTS({parts: [preview], textFormat: 'plain', signal});
+}
+
+function fetchPreview(ai, preview, signal) {
+  return ai.fetchTTS({input: preview, textFormat: 'plain'}, signal);
+}
+```
+
+The same payload field is supported by `AI.prepareTTSPlayback()` for audio-file
+providers, `AIProviderRuntime.request('tts', {operation:'synthesize', payload,
+localOnly, signal})`, its `synthesize(payload, options)` alias, and direct
+Kokoro `request()` calls using either `{text,...}` or `{model,input,...}`.
+The SDK consumes `textFormat` before engine/host dispatch. The original nonblank input,
+including whitespace and repeated formatting marks, remains unchanged; voice,
+speed, selected model, cancellation and audio ordering retain their existing
+owners. Only `'plain'` selects exact input; omission and other values retain
+the existing narration cleanup. Applications never supply the internal
+`speechInputPrepared` argument.
+
+This selection governs SDK text treatment, not the selected engine's input
+capacity or pronunciation. [Kokoro.js 1.2.1](https://github.com/hexgrad/kokoro/blob/664c76a704021239ba59c84dcbaa4d3dece01fe9/kokoro.js/src/kokoro.js)
+still tokenizes with truncation in both `generate()` and `stream()`; plain input
+does not establish complete audio for an oversized engine input. The SDK's existing complete-text forwarding
+fixture does not prove upstream synthesis completeness.
+
 ## Choose a device or reduce memory use
 
 Local Whisper and Kokoro roles accept
@@ -1610,10 +1649,11 @@ const result = await kokoro.request({
 The voice belongs to the caller-selected inventory; omission uses that model's
 default voice. The provider-native result is
 `{audio:Float32Array,sampleRate,voice}`. The provider/2 shared request form accepts
-`{model,input,responseFormat:'wav',voice?,speed?}` and returns
+`{model,input,textFormat?,responseFormat:'wav',voice?,speed?}` and returns
 `{audio:Uint8Array,contentType:'audio/wav'}`. High-level `AI.fetchTTS()` wraps
 that provider result in a WAV `Blob`. Returned provider records remain ordinary
-mutable values.
+mutable values. Both payload forms accept `textFormat:'plain'` to retain exact
+input; omission keeps the default speech-formatting cleanup.
 
 ## Lifecycle and cancellation
 

package/docs/reference/availability-and-normalization.md

@@ -74,6 +74,7 @@ where listed. See [native output and host requirements](core-native-packaging.md
 | Share one native WebSocket by exact URI and ordered protocols | `arcane-os/websocket-client` | **Node** and **Browser**, using the host's native `WebSocket` | The selected upstream `ws-share` instance owns the connection pool and global observation. Native socket messages and events remain unchanged; there is no reconnect, heartbeat, application envelope, storage, or fallback. |
 | Build browser UI and app-local behavior | `/arcane/modules/*.js`, shared entities, and components | **Browser**; many modules also run inside every native renderer | Pure modules own their result contracts. Modules that call `Arcane` inherit the bridge boundary described below. |
 | Score caller-supplied typed options with Laya or Julia | `arcane-os/ai/browser-decisions` | **Browser** only; caller-selected upstream runtime/model and backend | Typed decisions retain complete rows and return typed values, scores, probabilities, and diagnostics in caller order. This surface is separate from chat and speech and does not silently change model, precision, backend, or family. |
+| Score complete typed options with native Laya FP32 | [`arcane-os/local-ai/decisions`, `arcane-os/core/decisions`](native-decisions.md) | **Node** Windows/Linux/macOS with selected ONNX Runtime and model; Android needs host adaptation | Reuses the existing native ONNX owner and a tokenizer Worker, with explicit load and joined cleanup. Preserves separate state/question/options/type, original rows, raw scores and complete graph outputs. GPU preference attempts actual advertised providers before CPU; provider configuration does not prove physical acceleration. No renderer, chat provider or automatic persistence is required. |
 | Select and observe independent LLM/STT/TTS roles | `/arcane/modules/AIProviderRuntime.js` and `AIRuntimeState.js` | **Cross-host** controller/state; registered providers retain their own host requirements | Required/projected provider members, route/configuration records, and status fields; per-role lifecycle, cancellation, stream cleanup, sticky state, and startup barriers are normalized. `localOnly` creates no fallback. |
 | Run a caller-selected local LLM entirely in a browser renderer | `arcane-os/ai/browser-wasm` through `createArcaneAI()` | **Browser** only; secure context, WebAssembly, and OPFS/DBOPFS; full WebGPU offload by default or explicit CPU with `gpuLayers:0` | The public AI API module normalizes multi-model lifecycle, status, complete all-choice streaming, cancellation, exact ordered structural tool-call visibility, and session persistence. Model sources are canonical ordered file descriptors; licenses and model choice remain application policy. |
 | Run caller-selected Whisper or Kokoro in a browser renderer | `arcane-os/ai/browser-speech` registered with `AIProviderRuntime` | **Browser** only; DBOPFS, Web Locks, Workers, Fetch/object URLs, and a caller-supplied self-contained runtime/model closure are required | Independent provider/2 lifecycle and status, with `auto`, `webnn-npu`, `webgpu`, or `wasm` execution. Whisper owns one Worker/session; Kokoro defaults to four and accepts one through four. Complete model/runtime selection, offline behavior, cancellation, Worker teardown, and request/result shapes are normalized. No runtime/model content or cloud fallback is supplied. |

package/docs/reference/core-native-packaging.md

@@ -372,6 +372,47 @@ observes complete diagnostics and exit. Cancelling that operation closes its
 input, allowing the window and accepted Core service work to drain without a
 forced process termination.
 
+### Initial native window size
+
+An application can select its initial client area and resizing behavior in
+`arcane-app.json`, independently of its page layout:
+
+```json
+{
+  "native": {
+    "type": "app",
+    "icon": "img/icon.png",
+    "order": 100,
+    "bundledApps": [],
+    "window": {"width": 1280, "height": 800, "resizable": true}
+  }
+}
+```
+
+This is the `native` portion of the existing app descriptor. Each `window`
+member is optional. `width` and `height` are positive integral client dimensions
+in logical pixels at 96 DPI; `resizable` is a boolean. Omitting a member retains
+the host's existing choice, and omitting `window` preserves existing startup.
+The native registry projection preserves the record; the browser package
+projection gains no window controls. Portable and Windows assembly copy the
+record to `arcane-native.json` as `window`, without changing page or service
+content.
+
+The matching Windows host applies the dimensions once on initial load, using
+the display DPI and fitting the outer window within the selected monitor's
+usable work area. This fit does not impose a persistent maximum size. Explicit
+`resizable:false` uses a fixed frame and disables the maximize control; `true`
+permits ordinary resizing and maximizing. Later app/user resizing remains
+untouched. A composing launcher's `Load` handler runs after this initial sizing
+and can restore its own saved window state. The SDK adds no saved-bounds store.
+
+Direct Windows host composition uses nullable `ArcaneHostOptions` members
+`InitialClientWidth`, `InitialClientHeight`, and `Resizable` with the same
+semantics. Older precompiled Windows hosts do not read these options; use the
+matching SDK host archive when rebuilding an application. The portable record
+is available to platform adapters; this addition implements its Windows host
+behavior and leaves window sizing on other platforms unchanged.
+
 ### Application icon and window colors
 
 `appDescriptor.native.icon` selects the application's existing app-relative

package/docs/reference/core-runtime.md

@@ -123,6 +123,20 @@ The shared `arcane-os/core/contracts` module owns `CORE_PROTOCOL` (`arcane/1`),
 availability errors remain observable; unavailable services are not replaced
 with browser behavior.
 
+A request with no registered handler retains code `METHOD_NOT_ALLOWED` and
+adds the exact `method`, its first dotted `namespace`, and a `reason`.
+`core-namespace-unavailable` means the dispatcher has neither a service with
+that name nor any registered method in that namespace. Otherwise the reason is
+`core-method-unavailable`; the built-in `system`, `app`, and `version`
+namespaces also count as present. This is a dispatch lookup result before any
+handler or permission decision, not a capability-discovery call. A read-only
+or partially registered service therefore never appears wholly absent.
+Handler/startup/permission errors remain unchanged and acquire none of these
+lookup markers. Generic or older `METHOD_NOT_ALLOWED` errors do not establish
+namespace absence. An optional browser adapter may recognize the exact absent
+namespace and method according to its own documented contract; the dispatcher
+does not select or create another implementation.
+
 Events have `{protocol, type:'event', event, data, time}`:
 
 - `core.ready`: the dispatcher is connected; service/model readiness is separate.

package/docs/reference/inventory/package-api.json

@@ -1,17 +1,59 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.66.0",
+  "sdkVersion": "0.68.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
     "moduleSystem": "ESM"
   },
-  "memberCount": 290,
+  "memberCount": 293,
   "runtimeSubpathPatterns": {
     "arcane-os/modules/*": "./runtime/arcane/modules/*",
     "arcane-os/entities/*": "./runtime/arcane/entities/*"
   },
   "members": [
+    {
+      "id": "local-ai-decisions:createNativeDecisionModel",
+      "name": "createNativeDecisionModel",
+      "displayName": "createNativeDecisionModel()",
+      "kind": "function",
+      "signature": "createNativeDecisionModel({onnx,modelAssets,workingDirectory,paths,model='onnx-community/laya-typed-decisions-ONNX',revision='main',dtype='fp32',sessionOptions,executionPreference='gpu',signal}={})",
+      "entrypoints": ["arcane-os/local-ai/decisions"],
+      "primaryImport": "arcane-os/local-ai/decisions",
+      "group": "Native typed decisions",
+      "summary": "Explicit native Laya FP32 option scoring through an existing ONNX owner and a tokenizer Worker.",
+      "availability": "Node on Windows/Linux/macOS with selected ONNX Runtime and model files; Android needs host adaptation",
+      "protocol": "Shared browser/native decision encoding with native named tensor results",
+      "normalization": "Returns load/evaluate/classify/current/status/subscribe/unload/dispose; preserves complete separate state/question/options/type and original rows, raw scores and every graph output. Explicit load prepares selected upstream files or uses caller-owned paths; GPU preference attempts advertised providers then CPU. Cancellation retires the shared activation; files remain retained through actual ONNX and tokenizer Worker exit. No chat history or duplicate inference engine."
+    },
+    {
+      "id": "core-decisions:createNativeDecisionService",
+      "name": "createNativeDecisionService",
+      "displayName": "createNativeDecisionService()",
+      "kind": "function",
+      "signature": "createNativeDecisionService(configuration={}, {appRoot=process.cwd()}={})",
+      "entrypoints": ["arcane-os/core/decisions"],
+      "primaryImport": "arcane-os/core/decisions",
+      "group": "Native typed decisions",
+      "summary": "Renderer-independent native Laya service reusing the registered local-AI and model-assets owners.",
+      "availability": "Node Core with selected native ONNX and model files",
+      "protocol": "arcane/1 decisions.status/load/evaluate/unload and decisions.state",
+      "normalization": "Registration starts no model or tokenizer. Explicit load obtains dependency-ready same-process owners and reacquires getONNXRuntime after recovery. Native load/evaluate/classify/current/subscribe/unload/dispose preserve complete results; RPC uses the existing tensor codec. Unload has accepted service lifetime; host shutdown cancels request-lifetime load/evaluation."
+    },
+    {
+      "id": "core-decisions:default",
+      "name": "default",
+      "displayName": "createNativeDecisionService default export",
+      "kind": "function",
+      "signature": "default as createNativeDecisionService",
+      "entrypoints": ["arcane-os/core/decisions"],
+      "primaryImport": "arcane-os/core/decisions",
+      "group": "Native typed decisions",
+      "summary": "Default binding for the same native decision Core service factory.",
+      "availability": "Node Core runtime",
+      "protocol": "arcane/1 service definition",
+      "normalization": "Binding identity equals the named createNativeDecisionService export"
+    },
     {
       "id": "local-ai-whisper:createWhisperRuntime",
       "name": "createWhisperRuntime",
@@ -227,14 +269,14 @@
       "name": "createCoreImageRuntime",
       "displayName": "createCoreImageRuntime()",
       "kind": "function",
-      "signature": "createCoreImageRuntime({client=getInstalledCoreClient(),signal,onEvent}={})",
+      "signature": "createCoreImageRuntime({client,signal,onEvent}={})",
       "entrypoints": ["arcane-os/ai/core-image"],
       "primaryImport": "arcane-os/ai/core-image",
       "group": "Core local images",
       "summary": "Uses an available Core image service for generation and original-PNG editing with synchronous Thinking acknowledgement, lifecycle replay and complete PNG Blobs.",
       "availability": "Browser/native WebView with an available Core image service; construction opens no connection or model",
       "protocol": "arcane/1 image.status/load/generate/edit/unload and image.state/progress",
-      "normalization": "Returns load/generate/edit/unload/inspect/current/subscribe/close; edit preserves the complete original PNG Blob/File through transport with explicit strength; timeoutMs is zero, close cancels only this accessor and explicit unload owns the shared model"
+      "normalization": "Returns load/generate/edit/unload/inspect/current/subscribe/close; omitted client follows installation/replacement/retirement, explicit client including null remains fixed. Retirement cancels owned work and clears readiness; late old-client output is suppressed. Edit preserves the complete original PNG Blob/File through transport with explicit strength; timeoutMs is zero, close cancels only this accessor and explicit unload owns the shared model"
     },
     {
       "id": "core-image-service:createLocalImageService",
@@ -290,7 +332,7 @@
       "summary": "Owns selected native working-file projections and engine retain handles while original stored model files remain unchanged.",
       "availability": "Node Core with an application-selected working directory",
       "protocol": "arcane/1 modelAssets.open/write/complete/release/status and modelAssets.state",
-      "normalization": "Returns current/retain/dispose and Core service lifecycle; final native release joins writes and closes before deleting only its working projection"
+      "normalization": "Returns current/prepare/retain/release/dispose and Core service lifecycle. Explicit prepare({id,workingDirectory,members:[{path,url}],signal,onProgress}) streams complete upstream members through the existing file owner and reports file/phase progress. release(id) relinquishes preparation ownership; cancellation and cleanup join fetches/writes. Native retains survive until actual engine release before deleting only the owned working projection. Startup downloads nothing."
     },
     {
       "id": "core-model-assets-service:default",
@@ -318,21 +360,21 @@
       "summary": "Owns explicitly loaded ONNX graphs and complete named tensor inference in retained native workers.",
       "availability": "Node on Windows/Linux/macOS x64/arm64 with prepared onnxruntime-node; Android needs host adaptation",
       "protocol": "Per-session worker lifecycle with structured-clone tensors and replaying state",
-      "normalization": "Returns load/run/unload/current/subscribe/close; explicit model and session IDs; native calls may delay worker termination, and close observes actual exit"
+      "normalization": "Returns load/run/unload/current/subscribe/close; load accepts executionPreference gpu for advertised provider creation attempts then CPU, while explicit sessionOptions.executionProviders takes precedence. Complete execution diagnostics distinguish configured providers from physical acceleration. stopping revokes new runs while exited records actual Worker exit; recoverable run errors preserve the session. Cleanup joins exit and output delivery even when termination fails."
     },
     {
       "id": "core-onnx:createCoreONNXRuntime",
       "name": "createCoreONNXRuntime",
       "displayName": "createCoreONNXRuntime()",
       "kind": "function",
-      "signature": "createCoreONNXRuntime({client=getInstalledCoreClient()}={})",
+      "signature": "createCoreONNXRuntime({client}={})",
       "entrypoints": ["arcane-os/ai/core-onnx"],
       "primaryImport": "arcane-os/ai/core-onnx",
       "group": "Core local AI",
       "summary": "Accesses local system ONNX through an existing Core client with complete tensor transport.",
       "availability": "Browser with available Core ONNX service; construction installs no runtime or model",
       "protocol": "arcane/1 onnx.status/load/run/unload and localai.state",
-      "normalization": "Returns load/run/unload/inspect/current/subscribe/close; preserves typed and string tensors; accessor close cancels its requests without closing shared Core or implicitly unloading shared models"
+      "normalization": "Returns load/run/unload/inspect/current/subscribe/close; omitted client follows late installation/replacement/retirement and reads current status, while explicit client including null stays fixed. Retirement clears readiness and cancels owned work; late old-client results are suppressed. Preserves typed and string tensors; close removes subscriptions and cancels requests without closing shared Core or implicitly unloading shared models"
     },
     {
       "id": "root:createGitTextSnapshot",
@@ -409,14 +451,14 @@
       "name": "createCoreLocalAIProvider",
       "displayName": "createCoreLocalAIProvider()",
       "kind": "function",
-      "signature": "createCoreLocalAIProvider({client=getInstalledCoreClient(),id='llama.cpp'}={})",
+      "signature": "createCoreLocalAIProvider({client,id='llama.cpp'}={})",
       "entrypoints": ["arcane-os/ai/core-local"],
       "primaryImport": "arcane-os/ai/core-local",
       "group": "Core local AI",
       "summary": "Browser llama.cpp provider through an explicitly connected Core, with application-owned model selection and complete response streaming.",
       "availability": "Browser with an available Core local AI service; construction installs no runtime or model",
       "protocol": "arcane-ai-provider/2 LLM lifecycle over arcane/1",
-      "normalization": "Preserves complete payloads and original parsed chunks; waits for the exact requested model and cancels on observed readiness loss"
+      "normalization": "Preserves complete payloads and original parsed chunks; waits for the exact requested model and cancels on observed readiness loss. Omitted client follows installation/replacement/retirement; explicit client including null stays fixed. Inspect reports load capability separately from loaded readiness; disposal releases only an actually retained selection through its captured client. Provider/2 role state reconciles at existing operation boundaries, not through an idle state subscription."
     },
     {
       "id": "core-local-ai:createLocalAIService",
@@ -430,7 +472,7 @@
       "summary": "Composes selected native llama.cpp, Ollama and ONNX engines as a Core service with retained process/worker ownership and model lifecycle.",
       "availability": "Node with selected upstream runtime distributions or available configured system services",
       "protocol": "arcane/1 methods and events; llama.cpp OpenAI HTTP/SSE, Ollama native HTTP/NDJSON and ONNX tensor transport",
-      "normalization": "Application-owned runtime and model requirements; optional prepare supplies installed records during this service startup; independent services, complete responses and exact owned-process cleanup"
+      "normalization": "Application-owned runtime and model requirements; optional prepare supplies installed records during this service startup. getONNXRuntime() returns the actual prepared ONNX owner for native composition after context.getService('local-ai'); callers reacquire after recovery and retain the acquired handle for cleanup. llama.status/models observe without starting or restarting an engine. Independent services, complete responses and exact owned-process cleanup remain unchanged."
     },
     {
       "id": "core-local-ai:default",
@@ -1849,7 +1891,7 @@
       "summary": "Default binding for the canonical PreferenceStore runtime class in Node and managed browsers.",
       "availability": "Node with injected adapters, or browser/native WebView storage",
       "protocol": "Node ESM / authenticated managed browser import map",
-      "normalization": "Binding identity and namespace come directly from the canonical runtime module"
+      "normalization": "Canonical runtime binding. Default adapter recognizes only exact absent preferences namespace/matching method or existing Android unsupported capability; single operations retry once through existing app-scoped local storage after disposal/cancellation checks, preserving complete values and context. An advertised rejected batch is never retried serially; its original rejection remains before later local operations. Explicit adapters and partial-service/genuine failures retain their behavior."
     },
     {
       "id": "preference-store:PREFERENCE_STORE_ERROR_CODES",
@@ -4276,7 +4318,7 @@
       "summary": "Creates an app-neutral Core dispatcher with explicit services, request lifetimes, events and graceful drain.",
       "availability": "Node on Windows, Linux and macOS native hosts; Android requires its host adaptation",
       "protocol": "arcane/1 dispatcher and service lifecycle",
-      "normalization": "Starts services independently, preserves complete results/errors, cancels only request-lifetime work and drains accepted service work; runtime.replay publishes current dispatcher/service state without restart and preserves reentrant lifecycle publication order"
+      "normalization": "Starts services independently; runtime.getService(name) and context.getService(name) return the same registered object after only its shared startup, without a renderer or global barrier. Lookup is readiness, not a lifetime lease; new lookups reject during shutdown. Preserves complete results/errors, cancels request-lifetime work and drains accepted service work; runtime.replay publishes current dispatcher/service state without restart and preserves reentrant lifecycle publication order. Missing dispatch retains METHOD_NOT_ALLOWED with exact method/namespace and core-namespace-unavailable or core-method-unavailable; named services, registered methods and built-in namespaces establish presence. Handler/startup/permission errors remain unchanged."
     },
     {
       "id": "core-stdio:encodeCoreFrame",

package/docs/reference/inventory/runtime-components.json

@@ -967,8 +967,9 @@
     {
       "file": "runtime/arcane/components/theme-switcher.html",
       "name": "theme-switcher.html",
-      "purpose": "Selects and refreshes system, light, dark, or custom theme mode.",
+      "purpose": "Selects and refreshes system, light, dark, or custom theme mode with per-instance choices and labels.",
       "methods": [
+        "configure()",
         "setMode()",
         "refresh()"
       ],

package/docs/reference/inventory/runtime-modules.json

@@ -1083,7 +1083,7 @@
       "summary": "Loads and updates schema-defined app preferences through native storage with a narrow browser fallback.",
       "availability": "Browser/native hybrid",
       "protocol": "Arcane.preferences or app-scoped localStorage + per-realm globalThis.arcaneEvents authority",
-      "normalization": "Complete ordinary values remain mutable; setAll uses one optional atomic adapter batch for every selected value when advertised, otherwise retains complete serial per-key compatibility, never retries a rejected dispatched batch serially, and only exact unsupported native capability changes future operations to the browser fallback.",
+      "normalization": "Complete values and operation context retained; the default adapter recognizes only exact missing preferences namespace/matching method or existing Android unsupported capability before selecting existing app-scoped localStorage. Single operations retry once after disposal/cancellation checks; partial-service and genuine failures reject unchanged. An advertised rejected batch is never retried serially, and its original rejection is preserved before later local operations.",
       "surface": "Event/error constants, default `PreferenceStore`, re-exported `Preference`/schema; load/set/setAll/reset APIs, required adapter get/set/delete plus optional setMany, state-free EventTarget/on compatibility, and `dispose()`."
     },
     {
@@ -1291,10 +1291,10 @@
       "exports": [
         "default"
       ],
-      "summary": "Reads or applies native appearance, returning an explicit unsupported browser state when no bridge exists.",
+      "summary": "Reads or applies native appearance, returning an explicit unsupported result when the bridge or optional namespace is absent.",
       "availability": "Browser/native hybrid",
       "protocol": "Arcane.appearance",
-      "normalization": "Absent bridge normalized; native result/error preserved.",
+      "normalization": "Absent bridge keeps its browser result. Exact missing appearance namespace/matching method returns supported:false with the complete original diagnostic; no platform guess or cached absence. Partial-method, permission, transport, cancellation and other genuine errors reject unchanged; available() is callable bridge presence only.",
       "surface": "default `SystemAppearance`; `available()`, `current()`, `apply()`."
     },
     {