arcane-os 0.67.0 → 0.69.0

package/docs/reference/runtime-components.md

@@ -112,7 +112,7 @@ snapshot remains owned until the browser's `afterprint` event.
 | [`task-progress.html`](#task-progresshtml) | Runs and displays a task list with started/change/complete/error state. | `configure()`<br>`setTasks()`<br>`updateTask()`<br>`runTasks()`<br>`clear()`<br>`destroy()` | `task-progress-ready`<br>`task-progress-started`<br>`task-progress-change`<br>`task-progress-complete`<br>`task-progress-error` | Task state normalized; injected task results mixed |
 | [`terminal-workspace.html`](#terminal-workspacehtml) | Presents multiple terminal sessions, output, active selection, theme, and terminal actions. | `configure()`<br>`addSession()`<br>`removeSession()`<br>`activateSession()`<br>`append()`<br>`clear()`<br>`setState()`<br>`setTheme()`<br>`focus()`<br>`destroy()` | `terminal-workspace-ready`<br>`terminal-submit`<br>`terminal-interrupt`<br>`terminal-clear`<br>`terminal-session-new`<br>`terminal-session-close`<br>`terminal-session-select`<br>`terminal-settings` | UI/session state normalized; native command results supplied externally |
 | [`theme-editor.html`](#theme-editorhtml) | Edits, previews, saves, and resets semantic custom theme tokens. | `configure()`<br>`getTheme()`<br>`setTheme()`<br>`setBusy()`<br>`setStatus()`<br>`destroy()` | `theme-editor-ready`<br>`theme-preview`<br>`theme-save`<br>`theme-reset` | Fully normalized Theme values |
-| [`theme-switcher.html`](#theme-switcherhtml) | Selects and refreshes system, light, dark, or custom theme mode. | `setMode()`<br>`refresh()` | No component-specific event | Preference/native appearance behavior mixed; no component-ready contract |
+| [`theme-switcher.html`](#theme-switcherhtml) | Selects and refreshes system, light, dark, or custom theme mode with per-instance choices and labels. | `configure()`<br>`setMode()`<br>`refresh()` | No component-specific event | Preference/native appearance behavior mixed; no component-ready contract |
 | [`unified-inbox.html`](#unified-inboxhtml) | Displays provider-neutral communication threads with active/loading state. | `configure()`<br>`setThreads()`<br>`setActive()`<br>`setLoading()`<br>`destroy()` | `unified-inbox-ready`<br>`inbox-refresh`<br>`thread-select` | DOM-normalized |
 | [`voice-transcription.html`](#voice-transcriptionhtml) | Records manual clips or optional continuous microphone audio with pause/periodic segments, ordered transcription and saves, retained failures, and complete transcript delivery. | `configure()`<br>`requestSTTActivation()`<br>`startRecording()`<br>`stopRecording()`<br>`retryTranscription()`<br>`cancelRecording()`<br>`save()`<br>`completeTranscription()/complete()`<br>`clear()`<br>`reset()`<br>`destroy()` | `voice-transcription-ready`<br>`voice-transcription-state`<br>`voice-transcription-segment`<br>`voice-transcription-empty`<br>`voice-transcription-error`<br>`voice-transcription-change`<br>`voice-transcription-complete`<br>`speech-transcription-complete`<br>`speech-transcription-cancelled`<br>`speech-stt-activation-request`<br>`speech-stt-activation-error` | Sticky STT readiness, capture/queue lifecycle, retry, cancellation, and complete state/text are normalized; media/provider behavior remains external |
 | [`weather-widget.html`](#weather-widgethtml) | Displays normalized current and daily weather with refresh intent. | `setWeather()`<br>`clear()`<br>`destroy()` | `weather-widget-ready`<br>`weather-refresh` | Display normalized; provider supplied externally |
@@ -2015,11 +2015,63 @@ Shared dependencies: [`Theme.js`](runtime-entities.md#themejs).
 
 ### Overview
 
-Selects and refreshes system, light, dark, or custom theme mode.
+Selects and refreshes system, light, dark, or custom theme mode. Native buttons
+retain complete readable labels and wrap when their component runs out of room,
+independently of viewport width. Each button has a `2.75rem` minimum target in
+both dimensions. Selected buttons retain `aria-pressed`, their selected colors
+and an inset outline while hovered; ordinary hover fill applies only to
+unselected, enabled choices. Disabled choices and keyboard focus have distinct
+presentation.
 
 ### Public surface
 
-Methods/properties: `setMode()`, `refresh()`.
+Methods/properties: `configure(options)`, `setMode(mode='system')`, `refresh()`.
+
+`configure({modes,labels})` changes only this component's presentation:
+
+- `modes` is an ordered array of the available identifiers `system`, `light`,
+  `dark`, and `custom`. It selects both visible choices and DOM/keyboard order.
+  Omitted `modes` retains the current presentation; an empty array displays no
+  choices. Unknown or repeated identifiers throw `TypeError` before changing
+  the presentation.
+- `labels` is a partial record of complete string labels keyed by those mode
+  identifiers. Omitted labels keep their current text. Text is assigned through
+  `textContent`, never interpreted as markup or reduced to initials. A label for
+  a built-in mode that is not a string throws `TypeError`.
+- The return value is `{modes,labels}` containing independent mutable copies of
+  the current presentation. Later changes to supplied/returned records do not
+  reconfigure the component.
+
+Label-only and unchanged-order configuration retain the existing buttons in
+place. An actual reorder restores keyboard focus to the previously focused
+button when that choice remains visible and enabled, without scrolling.
+
+The default remains Auto / Light / Dark / Skin, using identifiers
+`system`, `light`, `dark`, and `custom`. A caller may omit Skin or change Auto's
+label to System without removing custom-theme support from other instances.
+Configuration never changes preferences, activates a theme, or replaces the
+current selected mode. If the active mode is omitted, no visible button claims
+to be selected. Restoring that choice restores its existing pressed and disabled
+state. Skin remains disabled until the manager has a saved custom theme.
+
+For the initial presentation, `data-modes` accepts whitespace-separated mode
+identifiers and `data-system-label` supplies the complete system-mode label.
+These attributes are read once before the asynchronous ThemeManager import and
+preference refresh, so initial choices do not wait for `html-import-ready`.
+Use `configure()` after that event for subsequent presentation changes;
+changing these attributes later does not reconfigure an existing instance.
+
+`setMode()` updates pressed state and the host's `data-mode` only. `refresh()`
+loads the existing ThemeManager state, updates selection and Skin availability,
+and resolves with the complete manager state. Clicking a choice uses the same
+manager persistence/activation operation; buttons remain disabled while that
+operation is pending. Presentation configuration preserves that pending state.
+
+The host inherits text color. Existing `--app-bar-border` (falling back to
+`--border-color`), `--app-bar-accent` (then `--secondary-color`),
+`--app-bar-active-text` (then `--primary-color`), and `--focus-color` overrides
+remain supported. Applications own their palette and surrounding placement;
+the component adds no application-specific palette or settings section.
 
 This fragment declares no component-specific readiness or action event; use the loader's `html-import-ready` only to know that import execution completed.
 
@@ -2033,11 +2085,18 @@ Shared dependencies: [`ThemeManager.js`](runtime-modules.md#thememanagerjs).
 
 ```html
 <html-import
-  id="theme-switcher.html"
-  href="/arcane/components/theme-switcher.html">
+  id="theme-switcher"
+  href="/node_modules/arcane-os/runtime/arcane/components/theme-switcher.html"
+  data-modes="light dark system"
+  data-system-label="System">
 </html-import>
 ```
 
+This instance displays Light / Dark / System in that order. An instance without
+the two configuration attributes retains all four default choices. Both use
+the existing shared preference owner; presentation does not create a new store
+or migrate saved themes.
+
 ## unified-inbox.html
 
 ### Overview

package/docs/reference/runtime-modules.md

@@ -120,7 +120,7 @@ own asynchronous work, cancellation, and backpressure.
 | [`OllamaSettings.js`](#ollamasettingsjs) | esm | Defines complete runtime/service preference schemas and deterministic Arcane brain alias names. | Cross-host | Fully normalized settings/name contract. |
 | [`OpenMeteoWeatherProvider.js`](#openmeteoweatherproviderjs) | esm | Searches and loads Open-Meteo data into complete mutable Arcane weather entities. | Browser / native WebView / server with fetch + cloud | Provider data normalized to mutable entities; transport errors mixed. |
 | [`PersistentAIChatSession.js`](#persistentaichatsessionjs) | esm | Adds explicit retained-history/memory policy to complete configured chat without changing DBOPFS or ChatEntity semantics. | Browser / native WebView with DBOPFS and configured chat | Retained context commits atomically; `persist:false` turns are one-operation-only. |
-| [`PreferenceStore.js`](#preferencestorejs) | esm | Loads and updates schema-defined app preferences through native storage with a narrow browser fallback. | Browser/native hybrid | Complete ordinary values remain mutable; setAll uses one optional atomic adapter batch for every selected value when advertised, otherwise performs complete ordered serial writes, and only exact unsupported native capability changes future operations to the browser fallback. |
+| [`PreferenceStore.js`](#preferencestorejs) | esm | Loads and updates schema-defined app preferences through native storage with a narrow browser fallback. | Browser/native hybrid | Complete values and operation context retained; exact optional namespace absence or existing Android unsupported capability selects the existing local adapter; partial-service and genuine failures remain errors; an advertised rejected batch is never retried serially. |
 | [`PreparedSpeech.js`](#preparedspeechjs) | esm | Owns detached ordered preparation, semantic audio reuse, and per-caller cancellation behind AI.prepareTTS. | Browser / native WebView with injected synthesis and optional DBOPFS | Complete original inputs, ordered audio metadata, durable reuse, and observable preparation results. |
 | [`PrintView.js`](#printviewjs) | esm | Prints current rendered content and title through one document-owned print lifecycle. | Browser / supported native WebView print implementation | Complete rendered snapshot, preparation cancellation, resource lifetime, and honest request result. |
 | [`QRCode.min.js`](#qrcodeminjs) | classic-script | Vendored QRCode generator for DOM, canvas, SVG, and image output. | Browser vendor script | Vendor-native. |
@@ -134,7 +134,7 @@ own asynchronous work, cancellation, and backpressure.
 | [`ScreenCapture.js`](#screencapturejs) | esm | Captures a display surface as image, video, or GIF with explicit lifecycle events. | Browser / native WebView | State/events normalized; permission and codec errors mixed. |
 | [`SpeechPlayback.js`](#speechplaybackjs) | esm | Admits complete speech segments to a capacity-advertising provider immediately, retains serialized native/custom lookahead, and plays every result in exact indexed order. | Browser + native bridge | Stored part text stays exact; the outbound speech-input copy receives automatic formatting-mark cleanup; provider/media failures remain mixed. |
 | [`StaticDocumentCatalog.js`](#staticdocumentcatalogjs) | esm | Loads a positive static document inventory with cache, search, and complete context. | Browser / native WebView / server with fetch | Mutable complete catalog/content normalization; malformed data and transport failures remain visible. |
-| [`SystemAppearance.js`](#systemappearancejs) | esm | Reads or applies native appearance, returning an explicit unsupported browser state when no bridge exists. | Browser/native hybrid | Absent bridge normalized; native result/error preserved. |
+| [`SystemAppearance.js`](#systemappearancejs) | esm | Reads or applies native appearance, returning an explicit unsupported result when the bridge or optional namespace is absent. | Browser/native hybrid | Exact absent optional namespace normalized with its complete error; partial-method and genuine native errors preserved. |
 | [`SystemPlatformPresentation.js`](#systemplatformpresentationjs) | classic-script | Maps kernel names to presentation labels/classes without granting platform authority. | Browser / native WebView classic script | Fully normalized presentation only. |
 | [`SystemToolRegistry.js`](#systemtoolregistryjs) | esm | Registers validated command builders and constructs command strings without executing them. | Cross-host | Fully normalized definitions/quoting. |
 | [`TerminalClient.js`](#terminalclientjs) | esm | Maps native terminal sessions and Arcane events into an EventTarget client. | Native bridge | Client events/state normalized; native result/error mixed. |
@@ -170,7 +170,7 @@ default `AI`; read-only `providerRuntime`, `speechActivationPending`, `browserSp
 `streamRequest()`, `streamMessage()`, `fetchRequest()`, `fetch()`,
 read-only `ttsSegmentation`, `configureTTSSegmentation()`,
 `streamTTS(text='',end=false,options={})`,
-`prepareTTS({parts,storage,identity,signal,onState})`,
+`prepareTTS({parts,textFormat,storage,identity,signal,onState})`,
 `playPreparedTTS(prepared,{signal,onState})`,
 `finishTTS()`, `prepareTTSPlayback()`, `fetchTTS()`, `fetchSTT()`, `stopAudio()`, `resumeAudio()`,
 `playAudio()`; consumes `user-entity-loaded` and `arcane-ollama-ready`,
@@ -393,14 +393,17 @@ synthesis payload to `Arcane.speech.synthesize(request, {signal})`; Core aborts
 are normalized to `AbortError` with `ARCANE_AI_REQUEST_ABORTED`. Actual engine
 interruption belongs to the registered service. It does not independently
 choose a provider, cloud fallback, model, runtime, or
-voice policy for the application. Every call removes repeated same formatting
-marks from a cloned outbound input before delegation; the caller's payload stays
-unchanged. The third `preparation` argument is reserved for SDK-internal
+voice policy for the application. By default, calls remove repeated same
+formatting marks from a cloned outbound input before delegation; the caller's
+payload stays unchanged. Public payload field `textFormat:'plain'` preserves
+the complete input, including whitespace and repeated marks. The SDK consumes
+that field before provider/host dispatch. Omission and other values retain the
+default cleanup. The third `preparation` argument is reserved for SDK-internal
 delegation, where `{speechInputPrepared:true}` prevents a second cleanup pass;
 applications omit it. `streamTTS(text='',end=false,options={})` and
 `finishTTS()` use the selected playback boundary. The third-argument options below
-are available in SDK `0.5.12`. The `textFormat` compatibility extra added in
-SDK `0.5.16` is ignored beginning in `0.5.17`:
+are available in SDK `0.5.12`. In these streaming options, the `textFormat`
+compatibility extra added in SDK `0.5.16` remains ignored:
 
 | Field | Default | Meaning |
 | --- | --- | --- |
@@ -408,7 +411,7 @@ SDK `0.5.16` is ignored beginning in `0.5.17`:
 | `speed` | Current `ai.voiceSpeed` | A supplied positive speed is captured for those segments and forwarded to `fetchTTS()`. It does not change `ai.voiceSpeed`. |
 | `pauseAfterMs` | `0` | Finite, nonnegative milliseconds placed after the final extracted segment on the existing audio clock. Invalid values throw `RangeError`; no pause is inserted between this call's other segments. |
 | `waitForPlayback` | `false` | Omission retains the preparation promise. With `true`, the promise resolves after every extracted segment reaches a terminal playback state: `true` when all naturally end, or `false` after terminal cancellation or failure. |
-| `textFormat` | Ignored compatibility extra | Repeated same formatting marks are removed automatically from every TTS call. This value no longer selects or disables cleanup. |
+| `textFormat` | Ignored streaming compatibility extra | Streaming narration retains automatic cleanup. The public plain selection belongs to complete synthesis payloads or `prepareTTS` options. |
 
 Audio-file voice and speed use the existing `fetchTTS()` validation and error path.
 The automatic cleanup changes only the outbound speech-input copy; displayed,
@@ -418,7 +421,7 @@ text, single marks, ordinary punctuation, and other characters remain literal.
 A trailing candidate mark waits for the next character so a repeated run split
 across chunks is still omitted. Ordinary prose streams immediately.
 `end:true`, `finishTTS()`, muted terminal calls, and `stopAudio()` clear pending
-formatting state. `textFormat` is not an opt-out.
+formatting state. Streaming `textFormat` is not an opt-out.
 
 Voice, speed, pause, and playback overrides belong to the segments
 extracted in that invocation, including any text buffered by an earlier call.
@@ -458,12 +461,16 @@ last audio buffer ends, without waiting out that pause. Completion describes
 the playback lifecycle, not proof that a listener heard the sound. See the
 [complete-passage example](ai/browser-speech.md#queue-complete-passages-and-wait-for-playback).
 
-`prepareTTS({parts,storage,identity,signal,onState})` returns an immediate
+`prepareTTS({parts,textFormat,storage,identity,signal,onState})` returns an immediate
 `{segments,state,ready,getAudio(index),cancel()}` handle for detached complete
 speech preparation. Parts are strings or `{input,voice?,speed?,pauseAfterMs?}`
 records. It retains the full source for semantic matching, snapshots the
 selected speech configuration and segmentation, and applies automatic
-formatting cleanup once to the speech copy. Generation uses the existing
+formatting cleanup once to the speech copy by default. `textFormat:'plain'`
+preserves each complete input before the same ordered segmentation. Prepared
+segment text participates in reuse, keeping cleaned and exact synthesis inputs
+distinct when they differ. This SDK text-treatment choice does not change the
+selected engine's own input capacity. Generation uses the existing
 bounded provider queue without adding playback. Optional
 `storage:{db,table,key}` saves complete audio files and their MIME metadata in
 the caller's ready DBOPFS instance; the separate JSON-compatible `identity`
@@ -1032,9 +1039,12 @@ records are the closed `{llm,stt,tts}`, `{stt,tts}`, or
 `{providers,routes,expectedProviders}` shapes described below.
 `configureFromTuple()` accepts exactly six provider/model preference entries.
 
-Every direct TTS `request()` or `synthesize()` call removes repeated same
-formatting marks from a cloned outbound payload's `input` or `text` field. The
-caller's payload and request records remain unchanged. The optional
+By default, direct TTS `request()` and `synthesize()` remove repeated same
+formatting marks from a cloned outbound payload's `input` or `text` field.
+Public payload field `textFormat:'plain'` preserves that input exactly. The SDK
+consumes this field before queuing/dispatch; queued requests retain their
+selected text treatment. Omission and other values keep the default cleanup.
+The caller's payload and request records remain unchanged. The optional
 `preparation` argument is reserved for SDK-owned delegation;
 `{speechInputPrepared:true}` prevents a second pass after another SDK speech
 boundary has already cleaned the copy. Applications omit that argument. LLM
@@ -3475,9 +3485,31 @@ Exact exports: `PREFERENCE_STORE_ERROR_CODES`,
 
 **Browser/native hybrid.** Complete ordinary values and returned snapshots remain
 mutable after schema normalization. Non-Android
-`Arcane.preferences.setMany()` supplies the optional atomic batch. Only exact
-unsupported native capability changes future operations to app-scoped
-localStorage; an in-flight advertised batch is never downgraded after rejection.
+`Arcane.preferences.setMany()` supplies the optional atomic batch. The default
+adapter uses the existing app-scoped localStorage owner when there is no native
+preferences facade, on the existing Android route, or after either the existing
+`ANDROID_CAPABILITY_UNSUPPORTED` error or an exact Core lookup error:
+`code:'METHOD_NOT_ALLOWED'`, `reason:'core-namespace-unavailable'`,
+`namespace:'preferences'`, and `method:'preferences.<current operation>'`.
+This marker proves the entire optional namespace was absent before dispatch.
+A missing method in a partial/read-only service, an older unmarked error,
+permission denial, persistence failure, transport error, or cancellation never
+selects local storage. Explicit caller adapters retain their own behavior.
+
+For `get`, `set`, and `delete`, that positively absent namespace retries the
+same operation once through the existing local adapter, then keeps that adapter
+for the store's later operations. Complete arguments and the existing
+`{operationId,signal}` context are retained. Disposal and caller cancellation
+are checked before selecting or invoking the local adapter, so a late native
+absence result cannot start a cancelled local write. No data location, schema,
+saved value, or migration is introduced.
+
+An in-flight advertised `setMany` batch is never downgraded to serial writes
+after rejection. Exact namespace absence selects the local adapter for later
+operations and preserves that batch's original rejection with no local write.
+ThemeManager's first Light/Dark/System choice uses two ordinary `set` calls,
+not a batch: both may complete through the existing local owner before the
+selected theme is applied. Its persistence-first ordering is unchanged.
 If cancellation settles after a native batch was dispatched, reload the store to
 reconcile any atomic host commit that completed before cancellation. Transport:
 Arcane.preferences or app-scoped localStorage. [Deep protocol details](protocols.md).
@@ -4064,7 +4096,8 @@ console.log(Object.keys(module));
 
 ### Overview
 
-Reads or applies native appearance, returning an explicit unsupported browser state when no bridge exists.
+Reads or applies native appearance, returning an explicit unsupported result
+when the bridge or its optional namespace is absent.
 
 ### Public surface
 
@@ -4074,7 +4107,21 @@ Exact exports: `default`.
 
 ### Availability and normalization
 
-**Browser/native hybrid.** Absent bridge normalized; native result/error preserved. Transport: Arcane.appearance. [Deep protocol details](protocols.md).
+**Browser/native hybrid.** No bridge or callable method retains the existing
+`{supported:false,platform:'browser'}` result. A callable facade is not proof of
+an installed service: `available()` reports callable `apply` presence only.
+`current()` and `apply()` recognize only a matching Core
+`METHOD_NOT_ALLOWED` error with `reason:'core-namespace-unavailable'`,
+`namespace:'appearance'`, and the exact requested method. They return
+`{supported:false,reason:'core-namespace-unavailable',error}`, retaining the
+complete original error for diagnostics and making no platform or native
+application claim. Absence is not cached, so later service registration can
+serve the next operation. Partial-method absence, unmarked permission errors,
+transport/cancellation failures and all other native errors reject unchanged.
+Native success values and existing appearance input normalization remain
+unchanged. ThemeManager may therefore complete a browser color-scheme change
+when native appearance is explicitly unsupported, while genuine failures stay
+observable. Transport: Arcane.appearance. [Deep protocol details](protocols.md).
 
 ### Example
 

package/docs/reference/sdk-api.md

@@ -69,6 +69,8 @@ runtime layouts.
 | `arcane-os/core/local-ai` | Native llama.cpp, Ollama and ONNX Core service, model readiness, complete responses and owned lifecycle. See [local AI through Core](local-ai.md). |
 | `arcane-os/local-ai` | Official runtime installation and native artifact bundling for selected llama.cpp/Ollama/ONNX/image requirements and NeMo libraries. |
 | `arcane-os/local-ai/onnx` | Retained native ONNX worker sessions with explicit graph loading and complete tensor inference. |
+| `arcane-os/local-ai/decisions` | Explicit native Laya FP32 decisions using the existing ONNX owner and a tokenizer Worker. |
+| `arcane-os/core/decisions` | Renderer-independent typed-decision service composed with existing local-AI and model-assets owners. |
 | `arcane-os/ai/core-onnx` | Optional browser access to system ONNX through an existing Core connection. |
 | `arcane-os/local-ai/image` | Retained native stable-diffusion.cpp context, complete PNG generation and owned worker lifetime. |
 | `arcane-os/ai/core-image` | Browser image lifecycle and complete PNG Blobs through an available Core service. |
@@ -169,6 +171,9 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `acceptWebSocket()` | function | `arcane-os`, `arcane-os/websocket` | WebSocket protocol | Node; browser-native client interoperability |
 | `WS` | class | `arcane-os`, `arcane-os/websocket-client` | Shared WebSocket clients | Node and native-WebSocket browser hosts |
 | `createBrowserDecisionModel()` | function | `arcane-os/ai/browser-decisions` | Browser typed decisions | Browser module Workers and the caller-selected inference backend |
+| `createNativeDecisionModel()` | function | `arcane-os/local-ai/decisions` | Native typed decisions | Node with an existing native ONNX owner and selected Laya FP32 files |
+| `createNativeDecisionService()` | function | `arcane-os/core/decisions` | Native typed decisions | Node Core with existing local-AI and model-assets services |
+| `createNativeDecisionService default export` | function | `arcane-os/core/decisions` | Native typed decisions | Same native decision service factory |
 | `fetchRequest()` | function | `arcane-os/ai/twin-cloud` | TWiN Cloud requests | Node and Browser; remote HTTPS provider |
 | `fetchSystemOneRequest()` | function | `arcane-os/ai/twin-cloud` | TWiN Cloud state-and-questions requests | Node and Browser; remote HTTPS provider |
 | `generateImages()` | function | `arcane-os/ai/twin-cloud` | TWiN Cloud image generation | Node and Browser with Fetch and Blob; remote HTTPS provider |
@@ -1901,6 +1906,20 @@ default class PreferenceStore extends EventTarget
 subpath and managed browser key both resolve directly to the canonical runtime
 module. Deep protocol: [Browser runtime delivery](protocols.md#browser-runtime-delivery).
 
+The default adapter recognizes an absent optional preferences namespace only
+from the exact Core lookup tuple `code:'METHOD_NOT_ALLOWED'`,
+`reason:'core-namespace-unavailable'`, `namespace:'preferences'`, and the
+matching `method:'preferences.<operation>'`. Single `get`, `set`, and `delete`
+operations then retry once through the existing app-scoped local adapter after
+checking disposal and cancellation, preserving complete values and operation
+context. The existing Android unsupported-capability route is unchanged.
+An advertised `setMany` batch rejected for that exact absence retains its
+original rejection and performs no serial retry; subsequent operations use the
+selected local adapter.
+Partial-service, permission, persistence, transport and cancellation failures
+remain errors. Explicit adapters retain their own behavior. See the
+[complete PreferenceStore contract](runtime-modules.md#preferencestorejs).
+
 ### Example
 
 ```javascript
@@ -7297,9 +7316,18 @@ createCoreRuntime({application, version, services=[]}={})
 ```
 
 Import it from `arcane-os/core/runtime`. The runtime exposes `current()`,
-`subscribe()`, `onFrame()`, `emit()`, `registerService()`, `start()`, `handle()`
+`subscribe()`, `onFrame()`, `emit()`, `registerService()`, `getService()`, `start()`, `handle()`
 and idempotent `close()`.
 
+`await runtime.getService(name)` and service `context.getService(name)` return
+the actual registered service after its shared startup. They wait for that
+dependency alone, may start it before `runtime.start()`, and add no renderer or
+all-service barrier. Unknown services reject with `CORE_SERVICE_UNAVAILABLE`;
+new lookups during shutdown reject with `CORE_CLOSING`. Startup failures retain
+their original error. This is readiness, not a lifetime lease: retain acquired
+native handles for their actual cleanup rather than looking them up during
+disposal. See [native service composition](core-runtime.md#native-service-composition).
+
 Services start independently. Request-lifetime work receives cooperative
 cancellation; accepted `lifetime:'service'` work survives renderer cancellation.
 Shutdown stops admission, waits accepted responses, then runs each service's
@@ -7311,6 +7339,15 @@ without restarting services. Its snapshot preserves complete service errors
 and active request state; see [runtime replay](core-runtime.md#state-and-frames)
 for authoritative readiness and reentrant lifecycle ordering.
 
+An unregistered method returns `METHOD_NOT_ALLOWED` with its exact `method`,
+first dotted `namespace`, and `reason:'core-namespace-unavailable'` when that
+namespace has neither a named service nor any registered method. Otherwise
+the reason is `core-method-unavailable`; built-in `system`, `app` and `version`
+namespaces count as present. This is a lookup result before handler or
+permission decisions. Handler/startup errors and older unmarked errors do not
+establish namespace absence. The dispatcher does not choose a replacement
+service; optional browser adapters own their documented response to absence.
+
 ### Availability and normalization
 
 **Node on Windows, Linux and macOS native hosts; Android requires its native host
@@ -8011,7 +8048,7 @@ Construction selects no model and installs no runtime or transport.
 ### Signature and result
 
 ```text
-createCoreLocalAIProvider({client=getInstalledCoreClient(),id='llama.cpp'}={})
+createCoreLocalAIProvider({client,id='llama.cpp'}={})
 ```
 
 Import it from `arcane-os/ai/core-local`. The provider implements
@@ -8023,6 +8060,16 @@ payloads and parsed streaming chunks, and cancel on observed readiness loss.
 Missing Core reports unavailability; it does not choose a browser or cloud route.
 Dispose/unregister at the caller's owning lifecycle boundary.
 
+Omitted `client` follows late installation, replacement and retirement through
+the shared Core installation subscription. An explicit client, including
+`null`, remains fixed. Replacement revokes readiness and cancels owned work;
+late results cannot restore it. `inspect()` distinguishes explicit load
+capability from loaded readiness, while `status()` remains observational.
+Disposal releases only an actually retained selection through its captured
+client, so never-loaded and already-unloaded providers send no native unload.
+The provider/2 runtime reconciles status at its operation boundaries; this
+does not add an idle role-state subscription.
+
 ```javascript
 import {createCoreLocalAIProvider} from 'arcane-os/ai/core-local';
 import {getAIProviderRuntime} from 'arcane-os/ai-provider-runtime';
@@ -8055,6 +8102,13 @@ resolved installed runtime records. It returns a Core service definition with
 existing Core lifecycle. Shutdown cancels owned work and joins owned processes;
 an already running external service remains under its external owner.
 
+After `await context.getService('local-ai')`, `service.getONNXRuntime()` returns
+that service's actual prepared ONNX owner. It creates no engine and rejects
+unavailable or closing access. Reacquire on each explicit load after recovery;
+retain the returned handle for cleanup. Core shutdown cancels request-lifetime
+work, and independent services dispose concurrently. See
+[native service owners](local-ai.md#native-service-owners).
+
 Optional `prepare({signal,onEvent})` supplies resolved runtime records during
 this service's startup. Only operations depending on that service wait for its
 preparation; the development listener and independently composed image/model
@@ -8064,7 +8118,10 @@ requirements. The managed development and native entrypoints separate them.
 
 The service provides `localai.status`, explicit `localai.services.recover`,
 `llama.status/models/load/unload/chat`, `onnx.status/load/run/unload`, and the documented native Ollama methods.
-`localai.state` reports runtime/model changes. `llama.chunk` and `ollama.chunk`
+`localai.state` reports runtime/model changes. `llama.status` and `llama.models`
+observe current state without starting, restarting or waiting for an engine.
+Explicit load retains startup and exact catalog-membership checks.
+`llama.chunk` and `ollama.chunk`
 carry original parsed chunks with `streamId`; terminal responses remain complete.
 There is no background health polling or implicit model choice.
 
@@ -8081,7 +8138,7 @@ and [native bundling](local-ai.md#native-bundling).
 
 `createONNXRuntime({modulePath,signal?,onEvent?})` from `arcane-os/local-ai/onnx`
 owns retained native ONNX sessions in workers. It exposes `load({id,model,
-sessionOptions?,signal?})`, `run({id,feeds,fetches?,runOptions?,signal?})`,
+sessionOptions?,executionPreference?,signal?})`, `run({id,feeds,fetches?,runOptions?,signal?})`,
 `unload({id,signal?})`, `current()`, replaying `subscribe(listener)` and `close()`.
 The direct model path is absolute. Complete typed tensor records use
 `{type,dims,data}`; callers own the actual graph's inputs and preprocessing.
@@ -8091,11 +8148,22 @@ before replacement. Independent sessions run concurrently; same-session work
 waits at that session's loading/execution boundary. Queued cancellation removes
 that request; active cancellation retires the affected worker and suppresses
 its response. Native code can delay termination; cleanup waits for actual exit.
+`current().sessions[].stopping` revokes new-run availability at terminal
+shutdown; `exited` records actual Worker exit. A recoverable run error leaves
+the loaded session usable. Unload joins exit and output delivery even when a
+termination request fails, preserving the complete cleanup error.
+
+The generic load defaults to CPU. `executionPreference:'gpu'` tries advertised
+CUDA, TensorRT, DirectML, CoreML and WebGPU session creation before CPU.
+Explicit `sessionOptions.executionProviders` takes precedence unchanged.
+The complete `execution` record reports discovery, provider attempts and
+fallback; successful creation establishes configuration, not physical GPU
+execution. Inference is never replayed on a different provider after failure.
 See [complete signatures, readiness, cancellation and usage](local-ai.md#native-onnx-sessions).
 
 ## createCoreONNXRuntime()
 
-`createCoreONNXRuntime({client=getInstalledCoreClient()}={})` from
+`createCoreONNXRuntime({client}={})` from
 `arcane-os/ai/core-onnx` accesses an available Core ONNX service. Its `load`,
 `run`, and `unload` mirror the native session selection and accept `signal` and
 `timeoutMs` (default `0`). Relative model paths resolve at Core's `appRoot`.
@@ -8103,7 +8171,11 @@ The accessor owns complete tensor transport encoding/decoding, `inspect()`,
 `current()`, replaying `subscribe(listener)` and `close()`. Closing cancels this
 accessor's requests and subscriptions; unloading shared models is explicit.
 Construction installs no runtime and opens no transport. Existing browser
-ONNX/Wllama remain independent. See [Core and browser usage](local-ai.md#onnx-through-core-and-the-browser).
+ONNX/Wllama remain independent. Omitted `client` follows late installation and
+reads each installed connection's current status; explicit clients, including
+`null`, remain fixed. Retirement or replacement clears readiness and cancels
+owned work, with late old-client results suppressed. Close also removes the
+installation subscription. See [Core and browser usage](local-ai.md#onnx-through-core-and-the-browser).
 
 ## createImageRuntime()
 
@@ -8143,12 +8215,18 @@ browser accessor's detach-only ownership below. See the
 
 ## createCoreImageRuntime()
 
-`createCoreImageRuntime({client=getInstalledCoreClient(),signal?,onEvent?})`
+`createCoreImageRuntime({client,signal?,onEvent?})`
 from `arcane-os/ai/core-image` returns immediately with `load`, `generate`, `edit`,
 `unload`, `inspect`, `current`, `subscribe` and `close`. It subscribes before
 requesting an initial status snapshot so newer lifecycle events win. It opens
 no connection and installs or selects no model.
 
+Omitted `client` follows late Core installation, replacement and retirement;
+an explicit client, including `null`, remains fixed. Each installed client is
+observed before its status request. Retirement cancels owned work and removes
+old readiness; late results cannot restore it. Close removes both service and
+installation subscriptions without closing the shared client or model.
+
 `load({model,context?,assetProjectionId?,resourcePaths?,signal?})` and
 `generate({model,prompt,parameters?,assetProjectionId?,resourcePaths?,signal?,
 onProgress?})` use the selected Core service. Generation acknowledges with
@@ -8445,6 +8523,14 @@ directory and complete member files.
 
 `current()` returns `{closing,projections}`. `retain(id)` accepts a completed
 projection and returns `{id,directory,members,release}` for a native owner.
+Native `prepare({id,workingDirectory,members,signal,onProgress})` accepts
+ordered `{path,url}` members and returns their ready projection. Explicit calls
+stream complete upstream responses through the same file owner; startup
+downloads nothing. Independent members transfer concurrently and progress
+reports phases and completed files. `release(id)` relinquishes preparation
+ownership; cancellation, release and disposal join fetches and writes before
+cleanup. Native retain handles keep completed files alive until actual engine
+release. See [native preparation](model-assets.md#native-ownership).
 `dispose()` releases preparation ownership and joins file writes, closes and
 all native retain lifetimes before cleanup. The native owner releases its
 handle only after its actual context/worker use ends. Original stored model
@@ -9106,6 +9192,110 @@ See the [mounting contract](pwa.md#mountpwainstallprompt) and
 [component reference](runtime-components.md#pwa-installhtml). The browser owns
 native installation eligibility and URL-bar promotion.
 
+## createNativeDecisionModel()
+
+### Overview
+
+Runs explicitly selected Laya FP32 option scoring through an existing native
+ONNX owner, with tokenization in a Node Worker. It creates no second inference
+engine and starts no model download at construction.
+
+### Signature and result
+
+```text
+createNativeDecisionModel({onnx,modelAssets,workingDirectory,paths,model='onnx-community/laya-typed-decisions-ONNX',revision='main',dtype='fp32',sessionOptions,executionPreference='gpu',signal}={})
+```
+
+Import from `arcane-os/local-ai/decisions`. Supply the existing `onnx` owner and
+either `modelAssets` plus `workingDirectory`, or native `paths` for the model,
+tokenizer and tokenizer configuration. The selected graph requires FP32. The
+handle exposes `load`, `evaluate`, `classify`, `current`, `status`, `subscribe`,
+`unload` and terminal `dispose`; `classify` aliases `evaluate` and `status`
+aliases `current`.
+
+`evaluate(rows,{signal,runOptions})` preserves each complete `state`, `question`,
+`options` and optional `type` separately. It returns `{decisions,outputs}` with
+original rows, typed values, raw logits, unrounded probabilities and every
+named tensor output. It requires a loading or loaded activation. Cancellation
+retires the shared activation and joins its actual ONNX/tokenizer lifetime;
+working files remain retained until both Workers exit. Ordinary invalid rows
+leave a healthy session and sibling evaluations intact.
+
+### Availability and normalization
+
+**Node on Windows, Linux and macOS with the selected ONNX Runtime; Android needs
+host adaptation.** GPU preference attempts actual advertised providers before
+CPU fallback; accepted configuration does not prove GPU node execution. Model
+selection, unchanged payloads, scoring interpretation and persistence remain
+application-owned. Complete lifecycle, errors and paths are documented in
+[native typed decisions](native-decisions.md).
+
+### Example
+
+```javascript
+import {createNativeDecisionModel} from 'arcane-os/local-ai/decisions';
+
+function createMoonChefDecisions({onnx, paths}) {
+    return createNativeDecisionModel({onnx, paths});
+}
+```
+
+The caller explicitly loads the returned model before evaluation and unloads
+or disposes it at its owning boundary; defining this function downloads nothing.
+
+## createNativeDecisionService()
+
+### Overview
+
+Composes the same native decision model into an existing Core runtime without
+a renderer. The factory starts no inference, tokenizer or model preparation.
+
+### Signature and result
+
+```text
+createNativeDecisionService(configuration={}, {appRoot=process.cwd()}={})
+```
+
+Import from `arcane-os/core/decisions`. Configuration selects the model options
+above and an optional service `name` (default `decisions`); relative supplied
+`paths` resolve from `appRoot`. Explicit load obtains the registered local-AI
+and, when needed, model-assets owners through `context.getService`, then
+reacquires `getONNXRuntime()` after any recovery. Native members are `load`,
+`evaluate`, `classify`, `current`, `subscribe`, `unload`, `dispose` and Core
+`start(context)`.
+
+RPC exposes `decisions.status`, `decisions.load`, `decisions.evaluate` and
+`decisions.unload`. Evaluation accepts `{rows,runOptions?}` and returns complete
+`{decisions,outputs}` using the existing tensor codec at the JSON boundary.
+`decisions.state` and replaying `subscribe(listener,{emitCurrent:true,signal})`
+report lifecycle. Unload is accepted service-lifetime cleanup; host shutdown
+still cancels request-lifetime load/evaluation.
+
+### Availability and normalization
+
+**Node Core with an existing local-AI ONNX service and selected model files.**
+Registration does not wait for all services or open another host. Original
+inputs, complete outputs, failures and cleanup semantics match the native
+model. See [composition and example](native-decisions.md#compose-with-existing-core-services).
+
+### Example
+
+```javascript
+import {createNativeDecisionService} from 'arcane-os/core/decisions';
+
+const decisions = createNativeDecisionService({
+    model: 'onnx-community/laya-typed-decisions-ONNX',
+    dtype: 'fp32',
+    workingDirectory: '.models/laya'
+});
+// Add decisions to the application's existing Core services; load explicitly.
+```
+
+## createNativeDecisionService default export
+
+The default export from `arcane-os/core/decisions` is exactly the named
+`createNativeDecisionService` factory, with the same arguments and lifecycle.
+
 ## createBrowserDecisionModel()
 
 ### Overview

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.67.0",
+  "version": "0.69.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",