arcane-os 0.70.0 → 0.71.1

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.71.1
+
+- Correct explicit disabled PWA lifecycle in standalone source development by
+  serving a retirement worker when the root worker file is absent. Native
+  installation requests activation and unregisters only its own registration,
+  preserving saved data, authored workers, open-page content and other modes.
+  Browser update timing remains native; no page reload or polling is added.
+
+## 0.71.0
+
+- Add public theme-switcher CSS properties for group radius, option radius,
+  option font and group background. Applications can select modest rounded
+  rectangles and ordinary labels through the shared component while retaining
+  its existing literal defaults, complete labels, wrapping, native-button
+  targets, selected hover, keyboard focus, disabled state and theme persistence.
+
 ## 0.70.0
 
 - Add app-scoped DBOPFS committed-change subscriptions through the existing

package/README.md

@@ -20,7 +20,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.70.0` SDK contract. Development applications declare
+This checkout defines the `0.71.1` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/docs/reference/README.md

@@ -50,14 +50,21 @@ alone does not make bare module names resolve in a browser.
 | Use a shared entity | [Runtime entity modules](runtime-entities.md) and [exact export contracts](core/arcane-entities.md) |
 | Load a reusable HTML component | [Runtime component catalog](runtime-components.md) |
 | Present Light / Dark / System choices with complete labels | [Theme-switcher configuration](runtime-components.md#theme-switcherhtml) |
+| Choose theme-switcher corner radii, label font and group background through host CSS | [Theme-switcher styling properties](runtime-components.md#theme-switcherhtml) |
 | Use optional Core preferences and appearance without masking real failures | [PreferenceStore](runtime-modules.md#preferencestorejs), [SystemAppearance](runtime-modules.md#systemappearancejs), and [Core lookup errors](core-runtime.md#state-and-frames) |
 | Submit complete speech parts immediately and play them in order | [`SpeechPlayback`](runtime-modules.md#speechplaybackjs) and the [basic browser example](ai/browser-speech.md#play-a-complete-array-with-speechplayback) |
+| Preserve exact text in an explicit complete synthesis call | [Exact complete synthesis input](ai/browser-speech.md#exact-complete-synthesis-input) and [managed AI narration](sdk-api.md#managed-ai-narration) |
+| Select initial native window dimensions and resizing behavior | [Initial native window size](core-native-packaging.md#initial-native-window-size) and [Windows provider](sdk-api.md#createwindowsnativeprovider) |
 | Call `globalThis.Arcane` | [Arcane Core API](core/arcane-api.md) |
 | Connect a browser to one Core transport | [Core browser client](core-client.md) |
 | Cancel one Core speech synthesis request without changing its payload | [Speech request lifetime](core-client.md#events-and-request-lifetime) and [Core facade](sdk-api.md#createcorefacade) |
 | Compose native Core dispatch, service lifecycle, and stdio hosting | [Native Core runtime](core-runtime.md) |
 | Reuse dependency-ready native services without a renderer | [Core service composition](core-runtime.md#native-service-composition) and [existing ONNX owner](local-ai.md#native-service-owners) |
 | Compose application Core services during source development, independently of local AI | [Development Core services](core-development.md) |
+| Share one application service runtime between its native UI and MCP process | [Shared Core host](core-shared-host.md) |
+| Store complete browser model resources through one DBOPFS owner | [Model resources](ai/browser-decisions.md#shared-dbopfs-model-resources) and [speech routing](ai/browser-speech.md#ordinary-module-routing) |
+| Observe committed storage changes across live application documents | [DBOPFS change subscriptions](runtime-modules.md#dbopfsjs) |
+| Cancel cold speech preparation while preserving other activation interests | [Prepared narration](ai/browser-speech.md#prepare-narration-once-and-replay-stored-audio) |
 | Own an explicitly selected native Codex App Server session | [Codex App Server](codex-app-server.md) |
 | Expose application-owned tools and static resources through Node STDIO | [MCP STDIO server](mcp-stdio.md) |
 | Run application-selected llama.cpp, Ollama or ONNX through Core | [Local AI through Core](local-ai.md) |

package/docs/reference/ai/browser-speech.md

@@ -1443,7 +1443,7 @@ const store = createDbopfsSpeechArtifactStore({
 });
 ```
 
-The store exposes `{protocol,tableName,prepare,remove}`. It serializes updates
+The store exposes `{protocol,tableName,prepare,remove,fetchResource}`. It serializes updates
 to one selected authority with Web Locks, downloads each caller-selected file
 after explicit provider activation, stores it in DBOPFS, and reopens the stored
 file before materialization. Missing storage, an unreadable response, a failed

package/docs/reference/ai/browser-wasm.md

@@ -655,35 +655,46 @@ when the default estimator is unavailable or an application owns a more precise
 quota view. `downloadConcurrency` must be a positive safe integer and bounds
 the selected file or Range worker pool; the default is four. The mutable result
 contains `kind`, `tableName`, `downloadConcurrency`, the original `adapter`,
-and `ready`, `install`, `ensure`, and `remove`. `ensure()` preserves the complete
+and `ready`, `install`, `ensure`, `remove`, and `fetchResource`. `ensure()` preserves the complete
 ordered model set and reports whether it was cached or installed.
 `install(source,{signal,onProgress})` and
 `ensure(source,{signal,onProgress,offline})` publish `cache-check` and
-`download` records using ordered file counts plus aggregate transfer telemetry
-when `onProgress` is supplied. Chunk-driven changes are coalesced on a 250 ms
-cadence, with immediate boundary records at start, plan/total discovery,
-active-worker changes, and completion. Multi-file sources use up to that many concurrent member workers
+`download` records using ordered file counts and per-member closed-part progress
+when `onProgress` is supplied. Each member reports `completed`, `total`, and
+`unit:'shards'`; streaming totals remain `null` until completion. Records retain
+`activeTransfers`, `transferLimit`, and `transferMode`, with prompt part/lifecycle
+updates and an existing 250 ms heartbeat. They contain no transfer rate or ETA.
+Multi-file sources use up to that many concurrent member workers
 while retaining descriptor order, preserve completed members and completed
 Range parts within members across an interrupted attempt, and fetch only
-missing work on retry. A complete set of optional member
-`bytes` values makes aggregate total and remaining progress available from the
-start; otherwise those fields remain `null` until an honest aggregate total is
-known. Each missing source member first requests `bytes=0-0`. If a followed
+missing work on retry. Each missing source member first requests the HTTP
+Range `bytes=0-0`. If a followed
 redirect turns that probe into a full `200`, the source probes the final URL directly;
 confirmed support cancels the original body and starts parallel Range workers,
 while refusal keeps the original full response as the single-fetch fallback. A
 valid `Content-Range`, or optional descriptor `bytes` when that header is not
 exposed, supplies the total for deterministic resumable Range parts of roughly
-4 MB each, up to 4,096 parts. Without an observable or declared total, the store falls back to one full fetch and
-uses its readable `Content-Length` when available. A later non-206,
+4 MB each, up to 4,096 parts. These values belong only to HTTP Range framing,
+not product progress or content admission. Without an observable or declared
+total, one full fetch streams into ordered persistent parts without requiring
+a response length. Existing complete whole files remain readable without
+migration. A later non-206,
 contradictory exposed Range response, or incorrectly framed Range body fails
 rather than silently assembling a partial model. A transfer failure lets peer
 transfers settle; explicit cancellation stops active transfers. Both preserve
 completed members and exact Range parts for retry, while unfinished active
 parts restart after refresh. A complete whole member supersedes its current
 Range fragments.
-Cleanup failure is warned without replacing a usable model. Zero-length abandoned entries are removed
-because Wllama cannot consume an empty model Blob or File.
+Cleanup failure is warned without replacing a usable model.
+
+`fetchResource(input,{signal,onProgress,...requestOptions})` returns the complete
+stored response as `{file,status,statusText,headers,url,redirected}`. SDK model
+loaders share this owner for actual configuration, tokenizer, graph,
+external-data and support-file requests. Complete successful GET resources may
+be reused. Cancellation joins reader/writer cleanup and preserves closed parts
+for supported HTTP resume; a full response restarts that resource without
+duplicating its saved prefix. Resource progress uses `unit:'shards'` with
+`total:null` until completion. Independent resource requests remain concurrent.
 
 ### Availability and normalization
 

package/docs/reference/inventory/package-api.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.68.0",
+  "sdkVersion": "0.71.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
     "moduleSystem": "ESM"
   },
-  "memberCount": 293,
+  "memberCount": 297,
   "runtimeSubpathPatterns": {
     "arcane-os/modules/*": "./runtime/arcane/modules/*",
     "arcane-os/entities/*": "./runtime/arcane/entities/*"
@@ -535,14 +535,14 @@
       "name": "createBrowserDecisionModel",
       "displayName": "createBrowserDecisionModel()",
       "kind": "function",
-      "signature": "createBrowserDecisionModel({family,model,revision,device,dtype,runtime}={})",
+      "signature": "createBrowserDecisionModel({family,model,revision,device,dtype,runtime,store}={})",
       "entrypoints": ["arcane-os/ai/browser-decisions"],
       "primaryImport": "arcane-os/ai/browser-decisions",
       "group": "Browser typed decisions",
       "summary": "Explicit-load Laya and Julia-1 decisions with caller-selected precision, complete inputs and graph results.",
       "availability": "Browser module Workers and the selected Transformers.js backend; import/construction starts no model load",
       "protocol": "Caller-owned state/question/options rows; five-input decision graph; native Worker request/result lifecycle",
-      "normalization": "Full field tokenization, raw logits and unrounded softmax; dtype defaults to fp16 for Laya and fp32 for Julia, with explicit values forwarded unchanged to the upstream loader; no policy thresholds, storage or precision fallback"
+      "normalization": "Full field tokenization, raw logits and unrounded softmax; dtype defaults to fp16 for Laya and fp32 for Julia, with explicit values forwarded unchanged. Optional existing SDK store routes actual loader resources through fetchResource outside cloned Worker configuration; stored mode disables competing model caches, preserves complete HTTP responses and joins resource cleanup before outstanding calls settle. Omission retains upstream loading; no decision-result persistence or precision fallback"
     },
     {
       "id": "root:acceptWebSocket",
@@ -3529,10 +3529,10 @@
       ],
       "primaryImport": "arcane-os/ai/browser-wasm",
       "group": "Browser-WASM local AI",
-      "summary": "Adapts an existing DBOPFS instance into a resumable model cache with bounded parallel shard or monolithic Range-part transfer and live aggregate byte progress.",
+      "summary": "Adapts an existing DBOPFS instance into complete resumable model and Fetch-resource storage with bounded transfers and semantic shard progress.",
       "availability": "Browser with a ready DBOPFS instance and OPFS support",
       "protocol": "Resumable ordered model members and deterministic per-member Range parts over existing DBOPFS method semantics",
-      "normalization": "Uses one bounded transfer axis, preserves ordered completed shards and deterministic current Range parts within any member across interruption, emits coalesced additive loaded/total/remaining/rate/ETA/active-worker telemetry, rolls discarded partial writes back out of progress, cleans superseded current Range parts after a complete replacement exists, and settles failed or cancelled peers while retaining completed work for retry"
+      "normalization": "New full and Range responses stream into ordered persistent parts; complete logical files preserve existing formats without migration. Progress uses file and closed-shard counts with unknown totals until completion. fetchResource(input,{signal,onProgress,...requestOptions}) returns complete {file,status,statusText,headers,url,redirected}; successful complete GET resources may be reused. Cancellation joins reader/writer cleanup and retains closed parts for supported resume. Independent resources remain concurrent"
     },
     {
       "id": "browser-device:getBrowserDeviceClass",
@@ -3772,7 +3772,7 @@
       "summary": "Adapts an existing DBOPFS instance into a caller-scoped speech runtime/model artifact store and ordinary module router.",
       "availability": "Browser with a ready DBOPFS instance, Web Locks, Fetch or an explicit fetch implementation, File/Blob, and object URLs",
       "protocol": "arcane-ai-browser-speech-artifacts/1 ordinary DBOPFS storage and module routing",
-      "normalization": "Serializes complete caller-selected content, invalidates stale cache selections without byte identities, routes known materialized imports/fetches/Workers/cache reads, falls back to native browser behavior for unmapped operations, and keeps secure intent dormant"
+      "normalization": "Exposes prepare, remove and fetchResource; streams new declared files and fetched resources into ordered DBOPFS parts, preserves complete old files and closed parts, reports file/shard progress and joins cancellation cleanup. Known graph mappings remain explicit; dedicated speech and nested module Worker fetches share the store with complete HTTP response metadata. Competing native caches are unavailable only in that Worker lifetime and restored afterward without saved-cache deletion. Native ESM imports and unmapped classic Worker internals remain platform-owned"
     },
     {
       "id": "mail:MAIL_OUTBOX_IDEMPOTENCY_WINDOW_MS",
@@ -4374,7 +4374,7 @@
       "summary": "Creates the SDK-owned provider that assembles one selected app and explicit services into a portable Core payload.",
       "availability": "Node; produces a portable payload rather than an executable host",
       "protocol": "arcane-native-builder/1 portable provider",
-      "normalization": "Preserves complete selected app and dependency releases; an explicit services selection overrides appDescriptor.native.services, otherwise the descriptor selection is used; reports executable:false and never substitutes for an unavailable platform host"
+      "normalization": "Preserves complete selected app and dependency releases; an explicit services selection overrides appDescriptor.native.services, otherwise the descriptor selection is used; optional appDescriptor.native.window carries positive integral logical client width/height and optional resizable into manifest.window with omitted fields preserved; reports executable:false and never substitutes for an unavailable platform host"
     },
     {
       "id": "native-portable-provider:arcaneNativeBuilderProvider",
@@ -4416,7 +4416,7 @@
       "summary": "Assembles selected application services and browser content with the SDK-owned Windows x64 WebView2 and SEA host.",
       "availability": "Node for assembly; Windows x64 with WebView2 Runtime for execution",
       "protocol": "arcane-native-builder/1 windows-x64 provider",
-      "normalization": "Uses a selected hostDirectory or the exact installed SDK version's numeric release asset; preserves complete payloads; app displayName plus .exe (app ID fallback) and matching .exe.config use Windows filename substitutions only; manifest.host.executable owns inventory, icon, verify and run while generic cache/Core names remain unchanged; native.icon PNG/ICO derives the copied executable and host.icon without an app compiler, while other formats retain assembly with native.icon.unsupported and executableIcon:false; the matching host loads the selected window/taskbar icon and handles window.setTheme with per-field applied/unsupported results; run cancellation closes stdin and waits for host-owned graceful shutdown"
+      "normalization": "Uses a selected hostDirectory or the exact installed SDK version's numeric release asset; preserves complete payloads; app displayName plus .exe (app ID fallback) and matching .exe.config use Windows filename substitutions only; manifest.host.executable owns inventory, icon, verify and run while generic cache/Core names remain unchanged; native.icon PNG/ICO derives the copied executable and host.icon without an app compiler, while other formats retain assembly with native.icon.unsupported and executableIcon:false; the matching host loads the selected window/taskbar icon and handles window.setTheme with per-field applied/unsupported results; native.window selects initial 96-DPI logical client width/height and optional resizable through manifest.window, the matching host scales to actual DPI and fits initial placement to the usable screen while omitted fields and existing restored non-normal state remain unchanged; no saved-bounds subsystem is added and initial-fit logic is not reapplied during later resizing; run cancellation closes stdin and waits for host-owned graceful shutdown"
     },
     {
       "id": "native-windows-provider:arcaneNativeBuilderProvider",
@@ -4557,6 +4557,62 @@
       "availability": "Node with readable input and writable output streams",
       "protocol": "arcane/1 over Content-Length framed stdio",
       "normalization": "Returns the existing {runtime,closed,close} transport owner; an optional abort signal invokes the same idempotent drain without killing the process, replacing service readiness or cancelling accepted service-lifetime work"
+    },
+    {
+      "id": "core-host:startSharedCoreHost",
+      "name": "startSharedCoreHost",
+      "displayName": "startSharedCoreHost()",
+      "kind": "function",
+      "signature": "startSharedCoreHost({endpoint,application,version,configure,getReplayEvents,signal,onError}={})",
+      "entrypoints": ["arcane-os/core/host"],
+      "primaryImport": "arcane-os/core/host",
+      "group": "Shared Core host",
+      "summary": "Claims an app-selected local endpoint before composing one shared Core runtime.",
+      "availability": "Node named pipes on Windows and Unix-domain sockets on Linux/macOS; Android requires its host adaptation",
+      "protocol": "arcane/1 over local IPC with per-connection request correlation and current-state replay",
+      "normalization": "Returns {runtime,endpoint,closed,close}; configure(runtime,{signal}) registers independently started services after the endpoint claim. Close joins composition, accepted service work, disposal and queued frames before releasing the endpoint. Complete transport/startup/shutdown errors remain observable; an occupied endpoint never invokes the factory"
+    },
+    {
+      "id": "core-host:connectSharedCoreHost",
+      "name": "connectSharedCoreHost",
+      "displayName": "connectSharedCoreHost()",
+      "kind": "function",
+      "signature": "connectSharedCoreHost({endpoint,start,signal,onError}={})",
+      "entrypoints": ["arcane-os/core/host"],
+      "primaryImport": "arcane-os/core/host",
+      "group": "Shared Core host",
+      "summary": "Connects to one selected host and optionally starts an explicit headless entry when absent.",
+      "availability": "Node local IPC and optional explicit child process with diagnostic file",
+      "protocol": "arcane/1 Core client; optional Node startup IPC handshake",
+      "normalization": "Returns {client,endpoint,closed,close,shutdown}. Only ENOENT/ECONNREFUSED selects start {command,args,cwd,env,logFile}; no request retry. Close cancels this connection's request work while preserving the host and accepted service work. Explicit shutdown drains all clients' shared host; cancelling a launch wait does not kill the host"
+    },
+    {
+      "id": "core-host:runSharedCoreHost",
+      "name": "runSharedCoreHost",
+      "displayName": "runSharedCoreHost()",
+      "kind": "function",
+      "signature": "runSharedCoreHost(options)",
+      "entrypoints": ["arcane-os/core/host"],
+      "primaryImport": "arcane-os/core/host",
+      "group": "Shared Core host",
+      "summary": "Runs the explicit headless entry with one endpoint winner and startup result reporting.",
+      "availability": "Node host entry; parent IPC reporting when present",
+      "protocol": "Shared local Core endpoint and Node startup handshake",
+      "normalization": "Accepts startSharedCoreHost options; returns the winning host handle or null after a losing launcher connects to the existing owner and confirms dispatcher response. The loser does not construct services. Reports complete startup errors and never calls process.exit"
+    },
+    {
+      "id": "core-host:startSharedCoreBridge",
+      "name": "startSharedCoreBridge",
+      "displayName": "startSharedCoreBridge()",
+      "kind": "function",
+      "signature": "startSharedCoreBridge({endpoint,start,input=process.stdin,output=process.stdout,signal,onError}={})",
+      "entrypoints": ["arcane-os/core/host"],
+      "primaryImport": "arcane-os/core/host",
+      "group": "Shared Core host",
+      "summary": "Connects a complete framed stdio stream to the shared application's Core host.",
+      "availability": "Node readable/writable streams and local IPC",
+      "protocol": "arcane/1 Content-Length stdio to the selected shared Core endpoint",
+      "normalization": "Returns {endpoint,closed,close}; EOF or cancellation disconnects this client without shutting down shared services. Terminal stream errors settle pending writes and reject closed. Native launch opts in through sharedHost:{endpoint,logFile}; omitted sharedHost preserves ordinary stdio ownership"
     }
   ]
 }

package/docs/reference/inventory/runtime-components.json

@@ -967,7 +967,7 @@
     {
       "file": "runtime/arcane/components/theme-switcher.html",
       "name": "theme-switcher.html",
-      "purpose": "Selects and refreshes system, light, dark, or custom theme mode with per-instance choices and labels.",
+      "purpose": "Selects and refreshes system, light, dark, or custom theme mode with per-instance choices, labels, and CSS-configurable group/option radii, option font and group background.",
       "methods": [
         "configure()",
         "setMode()",
@@ -980,7 +980,7 @@
       ],
       "availability": "Browser and supported native WebViews",
       "transport": "HTMLImport + DOM; injected Arcane/provider modules where listed",
-      "normalization": "Preference/native appearance behavior mixed; no component-ready contract"
+      "normalization": "Preference/native appearance behavior mixed; selected button background, text and outline remain visible during hover while the hover fill applies only to unselected enabled buttons; no component-ready contract"
     },
     {
       "file": "runtime/arcane/components/unified-inbox.html",

package/docs/reference/inventory/runtime-modules.json

@@ -29,8 +29,8 @@
       "summary": "Owns provider-selectable chat and the one-time caller-authority browser STT/TTS configuration, lifecycle, synthesis, transcription, and playback boundary.",
       "availability": "Browser + native bridge + TWiN Cloud",
       "protocol": "arcane-ai-browser-speech-configuration/1, AIProviderRuntime arcane-ai-provider/2 routes, globalThis.arcaneEvents, TWiN Cloud HTTPS, Arcane.ollama, Arcane.speech, Android WebView bridge",
-      "normalization": "Complete mutable caller-owned browser speech authority, SDK-owned provider registration/replacement/disposal, explicit STT/TTS activation, normalized Whisper STT and Kokoro TTS execution with default capacities 1 and 4 respectively, explicit provider-neutral execution snapshots through status(role,{execution:true}), sticky readiness, canonical window.user readiness without compatibility-event object-identity admission or polling, exact ordered structural calls with required arguments.message, atomic nonblank all-ID tool-result sequencing, complete all-choice streaming/data validation, native Ollama structural adaptation, complete-response then all validated tool callbacks then completion ordering, observed async callbacks, Blob/File transcription, automatic repeated-formatting-mark removal from cloned outbound TTS input while caller and visible content stays exact, immediate exact-segment synthesis, per-call voice/speed capture, optional final-segment pause on the existing audio clock, optional per-call terminal playback completion, detached preparation with complete semantic DBOPFS audio reuse and same-owner pending request sharing, independent prepared playback without a model load for cached audio, ordered audio-clock scheduling, playable audio, active-generation TTS operation-failure routing, mute, and cancellation are normalized; provider/model/runtime/voice policy remains caller-owned. Both speech roles default execution.device to auto: webnn-npu when navigator.ml.createContext is exposed, then webgpu when navigator.gpu is exposed, then wasm for CPU execution. Failed backend loads clean up the pool before trying fresh Workers with the same prepared model and dtype; explicit devices never fall back. STT capacity only accepts 1; TTS accepts 1 through 4. Execution snapshots expose requestedDevice, selectedDevice, maxConcurrentRequests, and activeRequestCount for both roles; selectedDevice is null while unloaded and names the successful upstream session backend request when loaded. It does not prove every operation used the physical NPU: WebNN unsupported operations may use WASM, and compatibility depends on the browser, driver, hardware, and graph.",
-      "surface": "Native fetchTTS(payload,signal) and fetchSTT(audio,signal) forward caller cancellation separately from their complete Core speech payloads, normalize aborts to AbortError and suppress late results; actual engine interruption remains service-owned. prepareTTSPlayback(payload,signal) silently returns a real Blob or native-speech descriptor; native controls expose finished/released/state/error/pause/resume/stop, and actual release owns the playback lane. fetchTTS and durable prepareTTS report ARCANE_AI_TTS_AUDIO_EXPORT_UNAVAILABLE for native voices. Request-local model overrides remain exact and never mutate the configured model. Browser-speech protocol/event/error/reason constants; default `AI`; read-only `providerRuntime`, `browserSpeechConfiguration`, and `browserSpeechDescriptor`; explicit `providerRuntime.status(role,{execution:true})` snapshots; `streamTTS(text,end,options={})` with optional voice, speed, pauseAfterMs, and waitForPlayback; automatic speech-input cleanup with SDK-internal preparation metadata; `prepareTTS({parts,storage,identity,signal,onState})` returning ordered segments, state, ready, getAudio(index), and cancel(); `playPreparedTTS(prepared,{signal,onState})` returning state, error, finished, pause(), resume(), and stop() with one playback lane per AI and observational state/error callbacks; configure/dispose speech, route lifecycle, declaration-validated chat/stream requests with exact ordered calls; optional streamRequest toolText:{name,field} and onToolText(text,call,displayId) for decoded selected argument text with actual call identity, distinct from ordinary prose and terminal tool execution; synthesis/transcription and playback controls; initializes from current canonical user readiness, installs `window.ai`, and projects `ai-ready` plus active-generation `ai-tts-failure`."
+      "normalization": "Complete mutable caller-owned browser speech authority, SDK-owned provider registration/replacement/disposal, explicit STT/TTS activation, normalized Whisper STT and Kokoro TTS execution with default capacities 1 and 4 respectively, explicit provider-neutral execution snapshots through status(role,{execution:true}), sticky readiness, canonical window.user readiness without compatibility-event object-identity admission or polling, exact ordered structural calls with required arguments.message, atomic nonblank all-ID tool-result sequencing, complete all-choice streaming/data validation, native Ollama structural adaptation, complete-response then all validated tool callbacks then completion ordering, observed async callbacks, Blob/File transcription, default repeated-formatting-mark removal from cloned outbound TTS input, explicit textFormat:'plain' preservation for complete synthesis/preparation while streaming cleanup remains automatic and caller/visible content stays exact, immediate exact-segment synthesis, per-call voice/speed capture, optional final-segment pause on the existing audio clock, optional per-call terminal playback completion, detached preparation with complete semantic DBOPFS audio reuse and same-owner pending request sharing; each preparation owns its pending activation interest, final-interest cancellation aborts that activation while other interests preserve it, complete cache hits start no model, and cancellation after readiness leaves the ready model loaded; independent prepared playback without a model load for cached audio, ordered audio-clock scheduling, playable audio, active-generation TTS operation-failure routing, mute, and cancellation are normalized; provider/model/runtime/voice policy remains caller-owned. Both speech roles default execution.device to auto: webnn-npu when navigator.ml.createContext is exposed, then webgpu when navigator.gpu is exposed, then wasm for CPU execution. Failed backend loads clean up the pool before trying fresh Workers with the same prepared model and dtype; explicit devices never fall back. STT capacity only accepts 1; TTS accepts 1 through 4. Execution snapshots expose requestedDevice, selectedDevice, maxConcurrentRequests, and activeRequestCount for both roles; selectedDevice is null while unloaded and names the successful upstream session backend request when loaded. It does not prove every operation used the physical NPU: WebNN unsupported operations may use WASM, and compatibility depends on the browser, driver, hardware, and graph.",
+      "surface": "Native fetchTTS(payload,signal) and fetchSTT(audio,signal) forward caller cancellation separately from their complete Core speech payloads, normalize aborts to AbortError and suppress late results; actual engine interruption remains service-owned. prepareTTSPlayback(payload,signal) silently returns a real Blob or native-speech descriptor; native controls expose finished/released/state/error/pause/resume/stop, and actual release owns the playback lane. fetchTTS and durable prepareTTS report ARCANE_AI_TTS_AUDIO_EXPORT_UNAVAILABLE for native voices. Request-local model overrides remain exact and never mutate the configured model. Browser-speech protocol/event/error/reason constants; default `AI`; read-only `providerRuntime`, `browserSpeechConfiguration`, and `browserSpeechDescriptor`; explicit `providerRuntime.status(role,{execution:true})` snapshots; `streamTTS(text,end,options={})` with optional voice, speed, pauseAfterMs, and waitForPlayback; default speech-input cleanup with SDK-internal preparation metadata and explicit complete-call textFormat:'plain' consumed before engine dispatch; `prepareTTS({parts,storage,identity,textFormat,signal,onState})` returning ordered segments, state, ready, getAudio(index), and cancel(); `playPreparedTTS(prepared,{signal,onState})` returning state, error, finished, pause(), resume(), and stop() with one playback lane per AI and observational state/error callbacks; configure/dispose speech, route lifecycle, declaration-validated chat/stream requests with exact ordered calls; optional streamRequest toolText:{name,field} and onToolText(text,call,displayId) for decoded selected argument text with actual call identity, distinct from ordinary prose and terminal tool execution; synthesis/transcription and playback controls; initializes from current canonical user readiness, installs `window.ai`, and projects `ai-ready` plus active-generation `ai-tts-failure`."
     },
     {
       "file": "runtime/arcane/modules/AIModelSelectionController.js",
@@ -90,8 +90,8 @@
       "summary": "Provider-neutral selection, lifecycle, routing, startup, request, streaming, cancellation, and independent LLM/STT/TTS state.",
       "availability": "Cross-host in-process runtime; registered providers remain browser, native, or cloud specific",
       "protocol": "arcane-ai-runtime/2, arcane-ai-provider/2, arcane-ai-model-authority/1",
-      "normalization": "Normalizes mutable complete per-role routes, lifecycle/status, cancellation, streaming cleanup, capacity-1 FIFO LLM/STT lanes, bounded provider-declared parallel TTS requests with FIFO overflow, automatic repeated-formatting-mark removal from cloned direct TTS payloads, local-only selection, direct LLM history/declaration/terminal structural contracts, complete all-choice content/reasoning FIFO iteration, private automatic provider draining with result-first buffering, terminal-only structural calls, exact per-choice observed/terminal correlation, and a separate complete validated terminal result without creating a fallback.",
-      "surface": "Protocol constants; singleton-only `AIProviderRuntime`; `aiProviderRuntime`; `getAIProviderRuntime()`; provider registration/identity/selection, closed three-role and STT/TTS-only validation/configuration/replacement, status/catalog/inspection, startup, per-role load/unload/dispose/cancel, dispose-all, request/stream/speech aliases, SDK-internal speech-input preparation metadata, and mute controls."
+      "normalization": "Normalizes mutable complete per-role routes, lifecycle/status, cancellation, streaming cleanup, capacity-1 FIFO LLM/STT lanes, bounded provider-declared parallel TTS requests with FIFO overflow, default repeated-formatting-mark removal from cloned direct TTS payloads or explicit textFormat:'plain' preservation with the control consumed before engine dispatch, local-only selection, direct LLM history/declaration/terminal structural contracts, complete all-choice content/reasoning FIFO iteration, private automatic provider draining with result-first buffering, terminal-only structural calls, exact per-choice observed/terminal correlation, and a separate complete validated terminal result without creating a fallback.",
+      "surface": "Protocol constants; singleton-only `AIProviderRuntime`; `aiProviderRuntime`; `getAIProviderRuntime()`; provider registration/identity/selection, closed three-role and STT/TTS-only validation/configuration/replacement, status/catalog/inspection, startup, per-role load/unload/dispose/cancel, dispose-all, request/stream/speech aliases, SDK-internal speech-input preparation metadata, and setSpeechMuted(muted,{signal}={}) controls. Each pending unmute caller owns its abortable interest; the final interest aborts the owned activation while other preparation/playback or joining direct TTS-load interests preserve it. A pre-aborted unmute starts no activation. Explicit mute retains global cancellation and joined unload even with an aborted observer signal."
     },
     {
       "file": "runtime/arcane/modules/AIResponseURLPolicy.js",

package/docs/reference/pwa.md

@@ -169,6 +169,44 @@ Reference updates finish before file removal begins. Cancellation or a file
 error is reported without undoing earlier completed changes; a later call can
 finish retirement. The operation does not claim an all-or-nothing transaction.
 
+### Disabled worker retirement on the source server
+
+`startDevServer()` and `developApplication()` serve a retirement worker at
+`/arcane-sw.js` when source mode selects a standalone `appsRoot:"."` application
+with explicit `pwa.enabled:false` and that root worker file is absent. This
+browser lifecycle is separate from the import-map filesystem operation above.
+The existing server returns JavaScript with `Cache-Control: no-cache`, including
+when the request carries a former enabled worker's `If-Modified-Since` date.
+It writes no replacement worker file and performs no offline-inventory scan.
+
+When the browser updates the existing registration from that URL, the
+retirement worker calls `skipWaiting()` during installation and unregisters its
+own registration during activation. It has no fetch handler, so subsequent
+requests reaching it use the ordinary network path. It never clears caches,
+DBOPFS, profiles or other saved data; it does not enumerate or claim clients,
+reload pages, or start a polling loop. Other service-worker registrations remain
+untouched.
+
+Native service-worker update and activation timing remains browser-owned. An
+already open page may retain the neutral retirement worker as its controller
+for the rest of its lifetime, and its already rendered content stays unchanged.
+Unregistration removes the registration from future navigation matching;
+retirement does not promise immediate `controller === null` or automatic page
+refresh. These boundaries follow the platform's
+[activation](https://w3c.github.io/ServiceWorker/#activate-algorithm) and
+[unregistration](https://w3c.github.io/ServiceWorker/#dom-serviceworkerregistration-unregister)
+contracts.
+
+An existing root `arcane-sw.js` retains its ordinary authored-file routing,
+including its normal application selection; only an `ENOENT` filesystem result
+selects the retirement response. Omitted PWA configuration, enabled PWA,
+multi-app source workspaces, other URLs and packaged serving keep their existing
+behavior. A separately operated static host must own its worker lifecycle;
+filesystem retirement alone does not establish browser retirement on that host.
+The server path uses the existing portable Node serving owner, and browser
+retirement requires the browser's native service-worker support and an existing
+registration eligible for that update.
+
 ### Authored host root and app entry
 
 An authored `index.html` at the source host root keeps `/` separate from the

package/docs/reference/runtime-components.md

@@ -112,7 +112,7 @@ snapshot remains owned until the browser's `afterprint` event.
 | [`task-progress.html`](#task-progresshtml) | Runs and displays a task list with started/change/complete/error state. | `configure()`<br>`setTasks()`<br>`updateTask()`<br>`runTasks()`<br>`clear()`<br>`destroy()` | `task-progress-ready`<br>`task-progress-started`<br>`task-progress-change`<br>`task-progress-complete`<br>`task-progress-error` | Task state normalized; injected task results mixed |
 | [`terminal-workspace.html`](#terminal-workspacehtml) | Presents multiple terminal sessions, output, active selection, theme, and terminal actions. | `configure()`<br>`addSession()`<br>`removeSession()`<br>`activateSession()`<br>`append()`<br>`clear()`<br>`setState()`<br>`setTheme()`<br>`focus()`<br>`destroy()` | `terminal-workspace-ready`<br>`terminal-submit`<br>`terminal-interrupt`<br>`terminal-clear`<br>`terminal-session-new`<br>`terminal-session-close`<br>`terminal-session-select`<br>`terminal-settings` | UI/session state normalized; native command results supplied externally |
 | [`theme-editor.html`](#theme-editorhtml) | Edits, previews, saves, and resets semantic custom theme tokens. | `configure()`<br>`getTheme()`<br>`setTheme()`<br>`setBusy()`<br>`setStatus()`<br>`destroy()` | `theme-editor-ready`<br>`theme-preview`<br>`theme-save`<br>`theme-reset` | Fully normalized Theme values |
-| [`theme-switcher.html`](#theme-switcherhtml) | Selects and refreshes system, light, dark, or custom theme mode with per-instance choices and labels. | `configure()`<br>`setMode()`<br>`refresh()` | No component-specific event | Preference/native appearance behavior mixed; no component-ready contract |
+| [`theme-switcher.html`](#theme-switcherhtml) | Selects and refreshes system, light, dark, or custom theme mode with per-instance choices, labels, and CSS-configurable group/option radii, option font and group background. | `configure()`<br>`setMode()`<br>`refresh()` | No component-specific event | Preference/native appearance behavior mixed; no component-ready contract |
 | [`unified-inbox.html`](#unified-inboxhtml) | Displays provider-neutral communication threads with active/loading state. | `configure()`<br>`setThreads()`<br>`setActive()`<br>`setLoading()`<br>`destroy()` | `unified-inbox-ready`<br>`inbox-refresh`<br>`thread-select` | DOM-normalized |
 | [`voice-transcription.html`](#voice-transcriptionhtml) | Records manual clips or optional continuous microphone audio with pause/periodic segments, ordered transcription and saves, retained failures, and complete transcript delivery. | `configure()`<br>`requestSTTActivation()`<br>`startRecording()`<br>`stopRecording()`<br>`retryTranscription()`<br>`cancelRecording()`<br>`save()`<br>`completeTranscription()/complete()`<br>`clear()`<br>`reset()`<br>`destroy()` | `voice-transcription-ready`<br>`voice-transcription-state`<br>`voice-transcription-segment`<br>`voice-transcription-empty`<br>`voice-transcription-error`<br>`voice-transcription-change`<br>`voice-transcription-complete`<br>`speech-transcription-complete`<br>`speech-transcription-cancelled`<br>`speech-stt-activation-request`<br>`speech-stt-activation-error` | Sticky STT readiness, capture/queue lifecycle, retry, cancellation, and complete state/text are normalized; media/provider behavior remains external |
 | [`weather-widget.html`](#weather-widgethtml) | Displays normalized current and daily weather with refresh intent. | `setWeather()`<br>`clear()`<br>`destroy()` | `weather-widget-ready`<br>`weather-refresh` | Display normalized; provider supplied externally |
@@ -2073,6 +2073,24 @@ The host inherits text color. Existing `--app-bar-border` (falling back to
 remain supported. Applications own their palette and surrounding placement;
 the component adds no application-specific palette or settings section.
 
+Set these public CSS custom properties on the `html-import` host or an ancestor
+to style one instance through the ordinary cascade. Omitting them preserves the
+existing presentation:
+
+| Property | Controls | Default |
+| --- | --- | --- |
+| `--theme-switcher-radius` | Outer group border radius | `1.6rem` |
+| `--theme-switcher-option-radius` | Each option's border radius | `1.4rem` |
+| `--theme-switcher-font` | Complete option `font` shorthand | `700 .875rem/1.25 system-ui,sans-serif` |
+| `--theme-switcher-background` | Group background, independent of option state | `color-mix(in srgb,currentColor 8%,transparent)` |
+
+The font value includes its size and family, plus any weight and line height.
+Use an application-owned complete font token or value, rather than the
+CSS-wide keyword `inherit` as the custom-property value. The host still inherits
+text color. These properties do not alter the `2.75rem` minimum targets,
+full-label wrapping, selected/hover/focus/disabled states, or theme persistence.
+Applications retain responsibility for readable font and color choices.
+
 This fragment declares no component-specific readiness or action event; use the loader's `html-import-ready` only to know that import execution completed.
 
 Shared dependencies: [`ThemeManager.js`](runtime-modules.md#thememanagerjs).
@@ -2097,6 +2115,22 @@ the two configuration attributes retains all four default choices. Both use
 the existing shared preference owner; presentation does not create a new store
 or migrate saved themes.
 
+An application can give that instance modest rounded corners and its own
+ordinary label font without accessing the shadow root:
+
+```css
+#theme-switcher {
+  --theme-switcher-radius: .65rem;
+  --theme-switcher-option-radius: .5rem;
+  --theme-switcher-font: 400 1rem/1.25 var(--app-font-family, system-ui, sans-serif);
+  --theme-switcher-background: transparent;
+  --app-bar-border: var(--border-color);
+}
+```
+
+These are example application values, not new component defaults. Other
+instances retain the defaults unless the application cascades overrides to them.
+
 ## unified-inbox.html
 
 ### Overview

package/docs/reference/sdk-api.md

@@ -136,12 +136,16 @@ Root applications import `AI` through `arcane-os/ai` in the managed browser map.
 `ai.prepareTTSPlayback(payload,signal)` silently prepares real Blob audio or a
 native speech descriptor for playback. Native browser voices expose no audio
 file; use this path or shared streaming/SpeechPlayback for native output.
-`ai.prepareTTS({parts,storage,identity,signal,onState})` prepares complete
+`ai.prepareTTS({parts,storage,identity,textFormat,signal,onState})` prepares complete
 punctuation segments without playing them and optionally saves/reuses their
 audio through application-owned DBOPFS. Its immediate handle exposes ordered
 segments, preparation state, `ready`, `getAudio(index)`, and `cancel()`.
 `ai.playPreparedTTS(prepared,{signal,onState})` attaches ordered playback and
 returns `state`, `error`, `finished`, `pause()`, `resume()`, and `stop()`.
+Each preparation owns its pending activation interest. Cancelling the final
+interest aborts that activation; other preparation, playback or joining direct
+TTS-load interests preserve it. Cancelling after readiness leaves the model
+loaded, and complete cache hits start no model. Actual cleanup is provider-owned.
 Each AI has one playback lane; replacing playback preserves independent
 preparation. Fully cached replay does not load the speech
 model. See [prepared narration](ai/browser-speech.md#prepare-narration-once-and-replay-stored-audio)
@@ -149,6 +153,17 @@ for complete inputs, storage ownership, progress, errors, and cancellation,
 and [AI.js](runtime-modules.md#aijs) for the managed runtime contract.
 These are AI instance methods, not new npm export names.
 
+Complete synthesis calls can select `textFormat:'plain'` to preserve supplied
+speech text, including repeated formatting marks and surrounding whitespace.
+This applies to `ai.fetchTTS(payload,signal)`, audio-file preparation through
+`ai.prepareTTSPlayback(payload,signal)`, durable `ai.prepareTTS(...)`, provider
+runtime TTS requests and direct Kokoro synthesis. The SDK consumes the control
+before engine dispatch; durable preparation retains the existing punctuation
+segmentation. Omitted or other values retain automatic speech cleanup.
+Streaming `streamTTS`, `finishTTS` and shared `SpeechPlayback` retain their
+automatic cleanup; this option does not change upstream engine capacity.
+See [exact complete synthesis input](ai/browser-speech.md#exact-complete-synthesis-input).
+
 ## Shared operation contract
 
 High-level operations accept one options object. Common fields are `workspaceRoot`, `appId`, `target`, `signal`, and `onEvent`; only fields meaningful to that operation are consumed. Long work acknowledges first, owns its child tasks, keeps event delivery ordered and backpressured, emits progress or heartbeats, observes cancellation where safe, and rejects with `ArcaneError` on failure.
@@ -410,6 +425,10 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `arcaneNativeBuilderProvider` | singleton | `arcane-os/native/portable-provider` | Portable native provider | Node; produces a portable payload rather than an executable host |
 | `arcaneNativeBuilderProvider default export` | singleton | `arcane-os/native/portable-provider` | Portable native provider | Node; produces a portable payload rather than an executable host |
 | `startCoreHost()` | function | `arcane-os/core/host` | Native Core host composition | Node with readable input and writable output streams |
+| `startSharedCoreHost()` | function | `arcane-os/core/host` | Shared Core host | Node local IPC on Windows, Linux and macOS |
+| `connectSharedCoreHost()` | function | `arcane-os/core/host` | Shared Core host | Node local IPC and optional explicit headless startup |
+| `runSharedCoreHost()` | function | `arcane-os/core/host` | Shared Core host | Node headless entry and optional parent startup IPC |
+| `startSharedCoreBridge()` | function | `arcane-os/core/host` | Shared Core host | Node readable/writable streams and local IPC |
 | `readCoreLaunchContext()` | function | `arcane-os/core/host` | Native Core host composition | Node; reads explicitly selected launch JSON |
 | `resolveArcaneDataPaths()` | function | `arcane-os/core/repositories` | Native repository workspaces | Node on Windows, Linux and macOS; Android supplies its data root |
 | `createRepositoryWorkspace()` | function | `arcane-os/core/repositories` | Native repository workspaces | Node with Git; Android requires host process adaptation |
@@ -4229,6 +4248,17 @@ External source mode accepts both the installed-package route layout and the
 existing physical runtime layout. Installed-package mode serves the configured
 SDK resources directly from `node_modules` at their logical browser URLs;
 it does not create a workspace `arcane/` directory or require `arcane.lock.json`.
+
+For a standalone `appsRoot:'.'` source application with explicit
+`pwa.enabled:false` and an absent root `arcane-sw.js`, the exact worker URL
+returns a small retirement worker. Its native install requests `skipWaiting()`;
+activation unregisters only its own registration, without a fetch handler,
+storage/cache changes, client claiming or page reload. The browser owns update
+timing and an open page may retain the neutral controller until its lifetime
+ends. An existing authored worker, omitted/enabled PWA, multi-app source routes
+and packaged mode stay unchanged. See the complete
+[disabled-worker lifecycle](pwa.md#disabled-worker-retirement-on-the-source-server).
+
 `host` defaults to `127.0.0.1` and accepts an
 explicit network address or hostname. Use `0.0.0.0` for all IPv4 interfaces or
 `::` for the platform's IPv6 wildcard listeners. `port` selects the HTTPS
@@ -4738,6 +4768,14 @@ lifecycle. Package-only apps remain unchanged. The operation generates
 no packaged output; enabled PWA manifests
 are served directly from the selected source resources.
 
+The source listener also supplies the
+[disabled-worker retirement lifecycle](pwa.md#disabled-worker-retirement-on-the-source-server)
+for explicit disabled standalone PWA configuration when the root worker is
+absent. This does not grant filesystem retirement authority or change the
+refresh operation's preservation of authored files. Browser activation and
+unregistration proceed through the native lifecycle without clearing saved data
+or reloading an open page.
+
 ### Signature and result
 
 ```text
@@ -7530,6 +7568,12 @@ published SDK/runtime dependencies and the canonical Core entry/client into a
 fresh output directory. Service factories are imported only when a real native
 host later launches the generated Core entry, never during packaging.
 
+An optional `appDescriptor.native.window` record carries `width`, `height` and
+`resizable` into `manifest.window`. Dimensions are positive integral logical
+client units; `resizable` is an optional boolean. Omitted fields remain omitted.
+The portable payload records the selection; the selected platform host owns
+its window behavior. See [initial native window size](core-native-packaging.md#initial-native-window-size).
+
 ### Availability and normalization
 
 **Node; produces a portable payload rather than an executable host.** Existing
@@ -7641,6 +7685,16 @@ the selected output root. There is no compiler or OS checkout requirement for
 application builds. The build machine needs its normal Node/npm toolchain and
 `tar`; execution needs Windows x64, .NET Framework 4.6.2 or later and WebView2.
 
+The matching Windows host consumes `appDescriptor.native.window` through
+`manifest.window`. Optional `width` and `height` select initial client dimensions
+in 96-DPI logical units; the host scales them for its actual DPI and fits the
+outer window within the current screen's usable area. Optional `resizable:false`
+selects a fixed-size border and disables maximizing. Omitted fields preserve
+the existing host defaults. Initial sizing preserves a window already restored
+to a non-normal state and does not add saved-bounds storage. The initial-fit
+logic is not reapplied during later user resizing. See [initial native window size](core-native-packaging.md#initial-native-window-size)
+for a complete descriptor example and the other-platform boundary.
+
 The returned `arcane-native-builder/1` provider exposes `describe`, `doctor`,
 `prepare`, `build`, `verify` and `run`. Build returns `{app,target,manifest}`
 with the actual directory at `target.rootDir`. Verification reads the artifact;
@@ -8631,8 +8685,156 @@ async function bundleMoonCheeseRuntime(outputRoot){
 The ordinary provider invokes this owner only for an explicit native local-AI
 selection. See [selected local-AI runtimes](core-native-packaging.md#selected-local-ai-runtimes).
 
+## startSharedCoreHost()
+
+### Overview
+
+Owns one application's Core runtime at an explicitly selected local endpoint.
+It claims the endpoint before constructing services, so UI and MCP processes
+can share the same service state without constructing duplicate owners.
+
+### Signature and result
+
+```text
+startSharedCoreHost({endpoint,application,version,configure,getReplayEvents,signal,onError}={})
+```
+
+Resolves `{runtime,endpoint,closed,close}`. `configure(runtime,{signal})`
+registers services through the existing runtime; services start independently.
+Optional synchronous `getReplayEvents()` supplies current `{event,data}`
+snapshots, never historical replies. `close()` joins composition, accepted
+service work, service cleanup and queued frames before releasing the endpoint.
+Request-lifetime work is cancelled; accepted service-lifetime work remains
+service-owned. The supplied signal begins the same shutdown. `closed` rejects
+on shutdown failure; `onError` observes transport/background failures, with
+complete console diagnostics by default.
+
+### Availability and example
+
+Node supports app-selected named pipes on Windows and Unix-domain sockets on
+Linux/macOS; Android needs its host adaptation. Parent directories must exist.
+An occupied endpoint returns native `EADDRINUSE` with
+`coreHostPhase:'listen'`, without calling `configure`. Native failures remain
+observable; the SDK does not delete an existing endpoint to take ownership.
+
+```js
+import {startSharedCoreHost} from 'arcane-os/core/host';
+
+const host = await startSharedCoreHost(
+    {
+        endpoint: selectedEndpoint,
+        application: {id: 'moon-cheese-ledger'},
+        configure(runtime) {
+            runtime.registerService(ledgerService);
+        }
+    }
+);
+// The application owner later calls await host.close().
+```
+
+`selectedEndpoint` and `ledgerService` belong to the application. See
+[shared Core hosting](core-shared-host.md) for correlation, replay and cleanup.
+
+## connectSharedCoreHost()
+
+### Overview and signature
+
+Connects to the selected application host, optionally starting an explicit
+headless entry when that endpoint is absent.
+
+```text
+connectSharedCoreHost({endpoint,start,signal,onError}={})
+```
+
+Resolves `{client,endpoint,closed,close,shutdown}`. `client` is the existing Core
+client with current-runtime replay. Optional `start` is
+`{command,args=[],cwd,env,logFile}`; its entry calls `runSharedCoreHost()`.
+Only `ENOENT` or `ECONNREFUSED` selects startup. Arguments/environment are
+captured at acceptance, diagnostics append completely to the selected log,
+and requests are never automatically repeated. Other connection/start errors
+propagate; `closed` rejects on transport failure. Node/platform availability
+matches `startSharedCoreHost()`.
+
+`close()` disconnects this client and cancels only its request-lifetime work;
+it preserves the host and accepted service work. Cancelling startup wait does
+not kill a host another client may use. No startup timeout is imposed; supply
+`signal` when needed. `shutdown(invokeOptions)` explicitly invokes
+`core.host.shutdown`, drains all shared services and returns `{state:'closed'}`
+before disconnecting. It affects every client; cancellation after acceptance
+does not reverse it. A drain failure returns the full Core error.
+
+```js
+import {connectSharedCoreHost} from 'arcane-os/core/host';
+
+const connection = await connectSharedCoreHost(
+    {endpoint: selectedEndpoint}
+);
+try {
+    const catalog = await connection.client.invoke(
+        'catalog.read',
+        {}
+    );
+    console.log(catalog);
+} finally {
+    await connection.close();
+}
+```
+
+## runSharedCoreHost()
+
+Accepts the same options as `startSharedCoreHost(options)` and adds the headless
+startup handshake. The winning launcher returns the host handle. A losing
+launcher connects to the existing owner, confirms dispatcher response and
+returns `null` without constructing its own services. Startup success or the
+complete error reaches an existing parent Node IPC channel; the helper never
+calls `process.exit()`. Host lifetime, errors and platform requirements retain
+the contracts above.
+
+```js
+import {runSharedCoreHost} from 'arcane-os/core/host';
+
+const host = await runSharedCoreHost(applicationHostOptions);
+await host?.closed;
+```
+
+The application supplies `applicationHostOptions`, including its endpoint and
+service factory. This is the entry selected by the `start` option of
+`connectSharedCoreHost()`.
+
+## startSharedCoreBridge()
+
+Connects one framed stdio client to the shared host, preserving complete
+requests, responses and events through the existing `arcane/1` transport.
+
+```text
+startSharedCoreBridge({endpoint,start,input=process.stdin,output=process.stdout,signal,onError}={})
+```
+
+Resolves `{endpoint,closed,close}`. `start` and connection errors follow
+`connectSharedCoreHost()`. EOF, `close()` or cancellation disconnects this
+client only. Terminal stream errors settle pending writes and reject `closed`;
+service shutdown is separate. Node readable/writable streams and the selected
+local IPC endpoint are required. This is Core framing, not external MCP framing.
+
+```js
+import {startSharedCoreBridge} from 'arcane-os/core/host';
+
+const bridge = await startSharedCoreBridge(
+    {endpoint: selectedEndpoint}
+);
+await bridge.closed;
+```
+
+Generated native entries select this bridge only through explicit launch
+context `sharedHost:{endpoint,logFile}`. Omitting it preserves ordinary
+stdio-owned Core lifetime. See [native shared-host launch](core-shared-host.md#native-launch-and-platforms).
+
 ## startCoreHost()
 
+For independent UI and MCP processes sharing one application runtime, use the
+[shared host functions](#startsharedcorehost) above. Ordinary `startCoreHost()`
+retains its existing stdio-owned lifetime.
+
 ### Overview
 
 Composes explicitly supplied application services with the shared Core runtime
@@ -9311,7 +9513,7 @@ Existing chat and speech providers are unchanged.
 ### Signature and result
 
 ```text
-createBrowserDecisionModel({family,model,revision,device,dtype,runtime}={})
+createBrowserDecisionModel({family,model,revision,device,dtype,runtime,store}={})
 ```
 
 ```js
@@ -9346,6 +9548,15 @@ selections report its failure without precision fallback. For Laya FP32, pass
 Cancellation terminates that client's Worker and rejects its in-flight work.
 No decisions are inserted into chat history or durable storage.
 
+Optional `store` is an existing SDK DBOPFS model or speech store exposing
+`fetchResource(input, options)`. It remains outside cloned Worker configuration.
+The selected loader routes its actual model/configuration/tokenizer resources
+through that owner and disables competing model caches in this explicit mode.
+Omission preserves ordinary upstream loading. Native ESM imports retain their
+platform loader. Resource progress counts closed shards; cancellation joins
+resource cleanup before outstanding `load()`/`evaluate()` calls settle.
+`unload()` and `dispose()` acknowledge their state transition synchronously.
+
 ### Example
 
 ```js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.70.0",
+  "version": "0.71.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/runtime/arcane/components/theme-switcher.html

@@ -15,8 +15,8 @@
         max-inline-size:100%;
         padding:.2rem;
         border:1px solid var(--app-bar-border,var(--border-color,rgba(255,255,255,.25)));
-        border-radius:1.6rem;
-        background:color-mix(in srgb,currentColor 8%,transparent);
+        border-radius:var(--theme-switcher-radius,1.6rem);
+        background:var(--theme-switcher-background,color-mix(in srgb,currentColor 8%,transparent));
     }
 
     button {
@@ -28,11 +28,11 @@
         min-block-size:2.75rem;
         padding:.5rem .75rem;
         border:0;
-        border-radius:1.4rem;
+        border-radius:var(--theme-switcher-option-radius,1.4rem);
         background:transparent;
         color:inherit;
         cursor:pointer;
-        font:700 .875rem/1.25 system-ui,sans-serif;
+        font:var(--theme-switcher-font,700 .875rem/1.25 system-ui,sans-serif);
         text-align:center;
         white-space:normal;
         overflow-wrap:anywhere;

package/src/dev-server.mjs

@@ -17,6 +17,7 @@ import {
     readWorkspaceAssetVersion,resolveAssetReference,rewriteAssetReferences,versionAssetUrl
 } from './import-map.mjs';
 import {createPwaArtifacts,selectPwaFiles} from './pwa.mjs';
+import {createPwaRetirementWorkerScript} from './pwa-worker.mjs';
 
 const is = new Is(false);
 
@@ -1301,6 +1302,30 @@ async function startOwnedDevServer({
                 );
                 return;
             }
+            if (mode === 'source' && selectedRoutes.config.appsRoot === '.'
+                && selectedRoutes.app?.pwa?.enabled === false && target.path === '/arcane-sw.js') {
+                let rootWorkerExists = true;
+                try {
+                    await lstat(path.join(selectedRoutes.workspaceRoot, 'arcane-sw.js'));
+                } catch (error) {
+                    if (error?.code !== 'ENOENT') throw error;
+                    rootWorkerExists = false;
+                }
+                if (!rootWorkerExists) {
+                    response.setHeader('Cache-Control', 'no-cache');
+                    await serveGeneratedRepresentation(
+                        fileServer,
+                        request,
+                        response,
+                        {
+                            // A former enabled worker's date cannot validate this retirement script.
+                            contentType: contentTypes.js,
+                            body: createPwaRetirementWorkerScript
+                        }
+                    );
+                    return;
+                }
+            }
             const rootRequest = segments.length === 0;
             if (rootRequest && !selectedRoutes.rootDocument) {
                 response.writeHead(302,{location:`${selectedRoutes.startPath}${target.search}`});

package/src/pwa-worker.mjs

@@ -2,6 +2,25 @@ export function createPwaWorkerScript(manifest, clientUrl = 'arcane/sdk/pwa.mjs'
     return `(${installPwaWorker.toString()})(${JSON.stringify(manifest, null, 4)}, ${JSON.stringify(clientUrl)});\n`;
 }
 
+export function createPwaRetirementWorkerScript() {
+    return `(${installPwaRetirementWorker.toString()})();\n`;
+}
+
+function installPwaRetirementWorker() {
+    self.addEventListener(
+        'install',
+        function installRetiringWorker(event) {
+            event.waitUntil(self.skipWaiting());
+        }
+    );
+    self.addEventListener(
+        'activate',
+        function activateRetiringWorker(event) {
+            event.waitUntil(self.registration.unregister());
+        }
+    );
+}
+
 function installPwaWorker(manifest, clientUrl) {
     const scope = self.registration.scope;
     const scopeOrigin = new URL(scope).origin;