arcane-os 0.71.0 → 0.71.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.71.1
+
+- Correct explicit disabled PWA lifecycle in standalone source development by
+  serving a retirement worker when the root worker file is absent. Native
+  installation requests activation and unregisters only its own registration,
+  preserving saved data, authored workers, open-page content and other modes.
+  Browser update timing remains native; no page reload or polling is added.
+
 ## 0.71.0
 
 - Add public theme-switcher CSS properties for group radius, option radius,

package/README.md

@@ -20,7 +20,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.71.0` SDK contract. Development applications declare
+This checkout defines the `0.71.1` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/docs/reference/README.md

@@ -50,6 +50,7 @@ alone does not make bare module names resolve in a browser.
 | Use a shared entity | [Runtime entity modules](runtime-entities.md) and [exact export contracts](core/arcane-entities.md) |
 | Load a reusable HTML component | [Runtime component catalog](runtime-components.md) |
 | Present Light / Dark / System choices with complete labels | [Theme-switcher configuration](runtime-components.md#theme-switcherhtml) |
+| Choose theme-switcher corner radii, label font and group background through host CSS | [Theme-switcher styling properties](runtime-components.md#theme-switcherhtml) |
 | Use optional Core preferences and appearance without masking real failures | [PreferenceStore](runtime-modules.md#preferencestorejs), [SystemAppearance](runtime-modules.md#systemappearancejs), and [Core lookup errors](core-runtime.md#state-and-frames) |
 | Submit complete speech parts immediately and play them in order | [`SpeechPlayback`](runtime-modules.md#speechplaybackjs) and the [basic browser example](ai/browser-speech.md#play-a-complete-array-with-speechplayback) |
 | Preserve exact text in an explicit complete synthesis call | [Exact complete synthesis input](ai/browser-speech.md#exact-complete-synthesis-input) and [managed AI narration](sdk-api.md#managed-ai-narration) |
@@ -60,6 +61,10 @@ alone does not make bare module names resolve in a browser.
 | Compose native Core dispatch, service lifecycle, and stdio hosting | [Native Core runtime](core-runtime.md) |
 | Reuse dependency-ready native services without a renderer | [Core service composition](core-runtime.md#native-service-composition) and [existing ONNX owner](local-ai.md#native-service-owners) |
 | Compose application Core services during source development, independently of local AI | [Development Core services](core-development.md) |
+| Share one application service runtime between its native UI and MCP process | [Shared Core host](core-shared-host.md) |
+| Store complete browser model resources through one DBOPFS owner | [Model resources](ai/browser-decisions.md#shared-dbopfs-model-resources) and [speech routing](ai/browser-speech.md#ordinary-module-routing) |
+| Observe committed storage changes across live application documents | [DBOPFS change subscriptions](runtime-modules.md#dbopfsjs) |
+| Cancel cold speech preparation while preserving other activation interests | [Prepared narration](ai/browser-speech.md#prepare-narration-once-and-replay-stored-audio) |
 | Own an explicitly selected native Codex App Server session | [Codex App Server](codex-app-server.md) |
 | Expose application-owned tools and static resources through Node STDIO | [MCP STDIO server](mcp-stdio.md) |
 | Run application-selected llama.cpp, Ollama or ONNX through Core | [Local AI through Core](local-ai.md) |

package/docs/reference/ai/browser-speech.md

@@ -1443,7 +1443,7 @@ const store = createDbopfsSpeechArtifactStore({
 });
 ```
 
-The store exposes `{protocol,tableName,prepare,remove}`. It serializes updates
+The store exposes `{protocol,tableName,prepare,remove,fetchResource}`. It serializes updates
 to one selected authority with Web Locks, downloads each caller-selected file
 after explicit provider activation, stores it in DBOPFS, and reopens the stored
 file before materialization. Missing storage, an unreadable response, a failed

package/docs/reference/ai/browser-wasm.md

@@ -655,35 +655,46 @@ when the default estimator is unavailable or an application owns a more precise
 quota view. `downloadConcurrency` must be a positive safe integer and bounds
 the selected file or Range worker pool; the default is four. The mutable result
 contains `kind`, `tableName`, `downloadConcurrency`, the original `adapter`,
-and `ready`, `install`, `ensure`, and `remove`. `ensure()` preserves the complete
+and `ready`, `install`, `ensure`, `remove`, and `fetchResource`. `ensure()` preserves the complete
 ordered model set and reports whether it was cached or installed.
 `install(source,{signal,onProgress})` and
 `ensure(source,{signal,onProgress,offline})` publish `cache-check` and
-`download` records using ordered file counts plus aggregate transfer telemetry
-when `onProgress` is supplied. Chunk-driven changes are coalesced on a 250 ms
-cadence, with immediate boundary records at start, plan/total discovery,
-active-worker changes, and completion. Multi-file sources use up to that many concurrent member workers
+`download` records using ordered file counts and per-member closed-part progress
+when `onProgress` is supplied. Each member reports `completed`, `total`, and
+`unit:'shards'`; streaming totals remain `null` until completion. Records retain
+`activeTransfers`, `transferLimit`, and `transferMode`, with prompt part/lifecycle
+updates and an existing 250 ms heartbeat. They contain no transfer rate or ETA.
+Multi-file sources use up to that many concurrent member workers
 while retaining descriptor order, preserve completed members and completed
 Range parts within members across an interrupted attempt, and fetch only
-missing work on retry. A complete set of optional member
-`bytes` values makes aggregate total and remaining progress available from the
-start; otherwise those fields remain `null` until an honest aggregate total is
-known. Each missing source member first requests `bytes=0-0`. If a followed
+missing work on retry. Each missing source member first requests the HTTP
+Range `bytes=0-0`. If a followed
 redirect turns that probe into a full `200`, the source probes the final URL directly;
 confirmed support cancels the original body and starts parallel Range workers,
 while refusal keeps the original full response as the single-fetch fallback. A
 valid `Content-Range`, or optional descriptor `bytes` when that header is not
 exposed, supplies the total for deterministic resumable Range parts of roughly
-4 MB each, up to 4,096 parts. Without an observable or declared total, the store falls back to one full fetch and
-uses its readable `Content-Length` when available. A later non-206,
+4 MB each, up to 4,096 parts. These values belong only to HTTP Range framing,
+not product progress or content admission. Without an observable or declared
+total, one full fetch streams into ordered persistent parts without requiring
+a response length. Existing complete whole files remain readable without
+migration. A later non-206,
 contradictory exposed Range response, or incorrectly framed Range body fails
 rather than silently assembling a partial model. A transfer failure lets peer
 transfers settle; explicit cancellation stops active transfers. Both preserve
 completed members and exact Range parts for retry, while unfinished active
 parts restart after refresh. A complete whole member supersedes its current
 Range fragments.
-Cleanup failure is warned without replacing a usable model. Zero-length abandoned entries are removed
-because Wllama cannot consume an empty model Blob or File.
+Cleanup failure is warned without replacing a usable model.
+
+`fetchResource(input,{signal,onProgress,...requestOptions})` returns the complete
+stored response as `{file,status,statusText,headers,url,redirected}`. SDK model
+loaders share this owner for actual configuration, tokenizer, graph,
+external-data and support-file requests. Complete successful GET resources may
+be reused. Cancellation joins reader/writer cleanup and preserves closed parts
+for supported HTTP resume; a full response restarts that resource without
+duplicating its saved prefix. Resource progress uses `unit:'shards'` with
+`total:null` until completion. Independent resource requests remain concurrent.
 
 ### Availability and normalization
 

package/docs/reference/inventory/package-api.json

@@ -1,12 +1,12 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.69.0",
+  "sdkVersion": "0.71.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
     "moduleSystem": "ESM"
   },
-  "memberCount": 293,
+  "memberCount": 297,
   "runtimeSubpathPatterns": {
     "arcane-os/modules/*": "./runtime/arcane/modules/*",
     "arcane-os/entities/*": "./runtime/arcane/entities/*"
@@ -535,14 +535,14 @@
       "name": "createBrowserDecisionModel",
       "displayName": "createBrowserDecisionModel()",
       "kind": "function",
-      "signature": "createBrowserDecisionModel({family,model,revision,device,dtype,runtime}={})",
+      "signature": "createBrowserDecisionModel({family,model,revision,device,dtype,runtime,store}={})",
       "entrypoints": ["arcane-os/ai/browser-decisions"],
       "primaryImport": "arcane-os/ai/browser-decisions",
       "group": "Browser typed decisions",
       "summary": "Explicit-load Laya and Julia-1 decisions with caller-selected precision, complete inputs and graph results.",
       "availability": "Browser module Workers and the selected Transformers.js backend; import/construction starts no model load",
       "protocol": "Caller-owned state/question/options rows; five-input decision graph; native Worker request/result lifecycle",
-      "normalization": "Full field tokenization, raw logits and unrounded softmax; dtype defaults to fp16 for Laya and fp32 for Julia, with explicit values forwarded unchanged to the upstream loader; no policy thresholds, storage or precision fallback"
+      "normalization": "Full field tokenization, raw logits and unrounded softmax; dtype defaults to fp16 for Laya and fp32 for Julia, with explicit values forwarded unchanged. Optional existing SDK store routes actual loader resources through fetchResource outside cloned Worker configuration; stored mode disables competing model caches, preserves complete HTTP responses and joins resource cleanup before outstanding calls settle. Omission retains upstream loading; no decision-result persistence or precision fallback"
     },
     {
       "id": "root:acceptWebSocket",
@@ -3529,10 +3529,10 @@
       ],
       "primaryImport": "arcane-os/ai/browser-wasm",
       "group": "Browser-WASM local AI",
-      "summary": "Adapts an existing DBOPFS instance into a resumable model cache with bounded parallel shard or monolithic Range-part transfer and live aggregate byte progress.",
+      "summary": "Adapts an existing DBOPFS instance into complete resumable model and Fetch-resource storage with bounded transfers and semantic shard progress.",
       "availability": "Browser with a ready DBOPFS instance and OPFS support",
       "protocol": "Resumable ordered model members and deterministic per-member Range parts over existing DBOPFS method semantics",
-      "normalization": "Uses one bounded transfer axis, preserves ordered completed shards and deterministic current Range parts within any member across interruption, emits coalesced additive loaded/total/remaining/rate/ETA/active-worker telemetry, rolls discarded partial writes back out of progress, cleans superseded current Range parts after a complete replacement exists, and settles failed or cancelled peers while retaining completed work for retry"
+      "normalization": "New full and Range responses stream into ordered persistent parts; complete logical files preserve existing formats without migration. Progress uses file and closed-shard counts with unknown totals until completion. fetchResource(input,{signal,onProgress,...requestOptions}) returns complete {file,status,statusText,headers,url,redirected}; successful complete GET resources may be reused. Cancellation joins reader/writer cleanup and retains closed parts for supported resume. Independent resources remain concurrent"
     },
     {
       "id": "browser-device:getBrowserDeviceClass",
@@ -3772,7 +3772,7 @@
       "summary": "Adapts an existing DBOPFS instance into a caller-scoped speech runtime/model artifact store and ordinary module router.",
       "availability": "Browser with a ready DBOPFS instance, Web Locks, Fetch or an explicit fetch implementation, File/Blob, and object URLs",
       "protocol": "arcane-ai-browser-speech-artifacts/1 ordinary DBOPFS storage and module routing",
-      "normalization": "Serializes complete caller-selected content, invalidates stale cache selections without byte identities, routes known materialized imports/fetches/Workers/cache reads, falls back to native browser behavior for unmapped operations, and keeps secure intent dormant"
+      "normalization": "Exposes prepare, remove and fetchResource; streams new declared files and fetched resources into ordered DBOPFS parts, preserves complete old files and closed parts, reports file/shard progress and joins cancellation cleanup. Known graph mappings remain explicit; dedicated speech and nested module Worker fetches share the store with complete HTTP response metadata. Competing native caches are unavailable only in that Worker lifetime and restored afterward without saved-cache deletion. Native ESM imports and unmapped classic Worker internals remain platform-owned"
     },
     {
       "id": "mail:MAIL_OUTBOX_IDEMPOTENCY_WINDOW_MS",
@@ -4557,6 +4557,62 @@
       "availability": "Node with readable input and writable output streams",
       "protocol": "arcane/1 over Content-Length framed stdio",
       "normalization": "Returns the existing {runtime,closed,close} transport owner; an optional abort signal invokes the same idempotent drain without killing the process, replacing service readiness or cancelling accepted service-lifetime work"
+    },
+    {
+      "id": "core-host:startSharedCoreHost",
+      "name": "startSharedCoreHost",
+      "displayName": "startSharedCoreHost()",
+      "kind": "function",
+      "signature": "startSharedCoreHost({endpoint,application,version,configure,getReplayEvents,signal,onError}={})",
+      "entrypoints": ["arcane-os/core/host"],
+      "primaryImport": "arcane-os/core/host",
+      "group": "Shared Core host",
+      "summary": "Claims an app-selected local endpoint before composing one shared Core runtime.",
+      "availability": "Node named pipes on Windows and Unix-domain sockets on Linux/macOS; Android requires its host adaptation",
+      "protocol": "arcane/1 over local IPC with per-connection request correlation and current-state replay",
+      "normalization": "Returns {runtime,endpoint,closed,close}; configure(runtime,{signal}) registers independently started services after the endpoint claim. Close joins composition, accepted service work, disposal and queued frames before releasing the endpoint. Complete transport/startup/shutdown errors remain observable; an occupied endpoint never invokes the factory"
+    },
+    {
+      "id": "core-host:connectSharedCoreHost",
+      "name": "connectSharedCoreHost",
+      "displayName": "connectSharedCoreHost()",
+      "kind": "function",
+      "signature": "connectSharedCoreHost({endpoint,start,signal,onError}={})",
+      "entrypoints": ["arcane-os/core/host"],
+      "primaryImport": "arcane-os/core/host",
+      "group": "Shared Core host",
+      "summary": "Connects to one selected host and optionally starts an explicit headless entry when absent.",
+      "availability": "Node local IPC and optional explicit child process with diagnostic file",
+      "protocol": "arcane/1 Core client; optional Node startup IPC handshake",
+      "normalization": "Returns {client,endpoint,closed,close,shutdown}. Only ENOENT/ECONNREFUSED selects start {command,args,cwd,env,logFile}; no request retry. Close cancels this connection's request work while preserving the host and accepted service work. Explicit shutdown drains all clients' shared host; cancelling a launch wait does not kill the host"
+    },
+    {
+      "id": "core-host:runSharedCoreHost",
+      "name": "runSharedCoreHost",
+      "displayName": "runSharedCoreHost()",
+      "kind": "function",
+      "signature": "runSharedCoreHost(options)",
+      "entrypoints": ["arcane-os/core/host"],
+      "primaryImport": "arcane-os/core/host",
+      "group": "Shared Core host",
+      "summary": "Runs the explicit headless entry with one endpoint winner and startup result reporting.",
+      "availability": "Node host entry; parent IPC reporting when present",
+      "protocol": "Shared local Core endpoint and Node startup handshake",
+      "normalization": "Accepts startSharedCoreHost options; returns the winning host handle or null after a losing launcher connects to the existing owner and confirms dispatcher response. The loser does not construct services. Reports complete startup errors and never calls process.exit"
+    },
+    {
+      "id": "core-host:startSharedCoreBridge",
+      "name": "startSharedCoreBridge",
+      "displayName": "startSharedCoreBridge()",
+      "kind": "function",
+      "signature": "startSharedCoreBridge({endpoint,start,input=process.stdin,output=process.stdout,signal,onError}={})",
+      "entrypoints": ["arcane-os/core/host"],
+      "primaryImport": "arcane-os/core/host",
+      "group": "Shared Core host",
+      "summary": "Connects a complete framed stdio stream to the shared application's Core host.",
+      "availability": "Node readable/writable streams and local IPC",
+      "protocol": "arcane/1 Content-Length stdio to the selected shared Core endpoint",
+      "normalization": "Returns {endpoint,closed,close}; EOF or cancellation disconnects this client without shutting down shared services. Terminal stream errors settle pending writes and reject closed. Native launch opts in through sharedHost:{endpoint,logFile}; omitted sharedHost preserves ordinary stdio ownership"
     }
   ]
 }

package/docs/reference/inventory/runtime-modules.json

@@ -29,7 +29,7 @@
       "summary": "Owns provider-selectable chat and the one-time caller-authority browser STT/TTS configuration, lifecycle, synthesis, transcription, and playback boundary.",
       "availability": "Browser + native bridge + TWiN Cloud",
       "protocol": "arcane-ai-browser-speech-configuration/1, AIProviderRuntime arcane-ai-provider/2 routes, globalThis.arcaneEvents, TWiN Cloud HTTPS, Arcane.ollama, Arcane.speech, Android WebView bridge",
-      "normalization": "Complete mutable caller-owned browser speech authority, SDK-owned provider registration/replacement/disposal, explicit STT/TTS activation, normalized Whisper STT and Kokoro TTS execution with default capacities 1 and 4 respectively, explicit provider-neutral execution snapshots through status(role,{execution:true}), sticky readiness, canonical window.user readiness without compatibility-event object-identity admission or polling, exact ordered structural calls with required arguments.message, atomic nonblank all-ID tool-result sequencing, complete all-choice streaming/data validation, native Ollama structural adaptation, complete-response then all validated tool callbacks then completion ordering, observed async callbacks, Blob/File transcription, default repeated-formatting-mark removal from cloned outbound TTS input, explicit textFormat:'plain' preservation for complete synthesis/preparation while streaming cleanup remains automatic and caller/visible content stays exact, immediate exact-segment synthesis, per-call voice/speed capture, optional final-segment pause on the existing audio clock, optional per-call terminal playback completion, detached preparation with complete semantic DBOPFS audio reuse and same-owner pending request sharing, independent prepared playback without a model load for cached audio, ordered audio-clock scheduling, playable audio, active-generation TTS operation-failure routing, mute, and cancellation are normalized; provider/model/runtime/voice policy remains caller-owned. Both speech roles default execution.device to auto: webnn-npu when navigator.ml.createContext is exposed, then webgpu when navigator.gpu is exposed, then wasm for CPU execution. Failed backend loads clean up the pool before trying fresh Workers with the same prepared model and dtype; explicit devices never fall back. STT capacity only accepts 1; TTS accepts 1 through 4. Execution snapshots expose requestedDevice, selectedDevice, maxConcurrentRequests, and activeRequestCount for both roles; selectedDevice is null while unloaded and names the successful upstream session backend request when loaded. It does not prove every operation used the physical NPU: WebNN unsupported operations may use WASM, and compatibility depends on the browser, driver, hardware, and graph.",
+      "normalization": "Complete mutable caller-owned browser speech authority, SDK-owned provider registration/replacement/disposal, explicit STT/TTS activation, normalized Whisper STT and Kokoro TTS execution with default capacities 1 and 4 respectively, explicit provider-neutral execution snapshots through status(role,{execution:true}), sticky readiness, canonical window.user readiness without compatibility-event object-identity admission or polling, exact ordered structural calls with required arguments.message, atomic nonblank all-ID tool-result sequencing, complete all-choice streaming/data validation, native Ollama structural adaptation, complete-response then all validated tool callbacks then completion ordering, observed async callbacks, Blob/File transcription, default repeated-formatting-mark removal from cloned outbound TTS input, explicit textFormat:'plain' preservation for complete synthesis/preparation while streaming cleanup remains automatic and caller/visible content stays exact, immediate exact-segment synthesis, per-call voice/speed capture, optional final-segment pause on the existing audio clock, optional per-call terminal playback completion, detached preparation with complete semantic DBOPFS audio reuse and same-owner pending request sharing; each preparation owns its pending activation interest, final-interest cancellation aborts that activation while other interests preserve it, complete cache hits start no model, and cancellation after readiness leaves the ready model loaded; independent prepared playback without a model load for cached audio, ordered audio-clock scheduling, playable audio, active-generation TTS operation-failure routing, mute, and cancellation are normalized; provider/model/runtime/voice policy remains caller-owned. Both speech roles default execution.device to auto: webnn-npu when navigator.ml.createContext is exposed, then webgpu when navigator.gpu is exposed, then wasm for CPU execution. Failed backend loads clean up the pool before trying fresh Workers with the same prepared model and dtype; explicit devices never fall back. STT capacity only accepts 1; TTS accepts 1 through 4. Execution snapshots expose requestedDevice, selectedDevice, maxConcurrentRequests, and activeRequestCount for both roles; selectedDevice is null while unloaded and names the successful upstream session backend request when loaded. It does not prove every operation used the physical NPU: WebNN unsupported operations may use WASM, and compatibility depends on the browser, driver, hardware, and graph.",
       "surface": "Native fetchTTS(payload,signal) and fetchSTT(audio,signal) forward caller cancellation separately from their complete Core speech payloads, normalize aborts to AbortError and suppress late results; actual engine interruption remains service-owned. prepareTTSPlayback(payload,signal) silently returns a real Blob or native-speech descriptor; native controls expose finished/released/state/error/pause/resume/stop, and actual release owns the playback lane. fetchTTS and durable prepareTTS report ARCANE_AI_TTS_AUDIO_EXPORT_UNAVAILABLE for native voices. Request-local model overrides remain exact and never mutate the configured model. Browser-speech protocol/event/error/reason constants; default `AI`; read-only `providerRuntime`, `browserSpeechConfiguration`, and `browserSpeechDescriptor`; explicit `providerRuntime.status(role,{execution:true})` snapshots; `streamTTS(text,end,options={})` with optional voice, speed, pauseAfterMs, and waitForPlayback; default speech-input cleanup with SDK-internal preparation metadata and explicit complete-call textFormat:'plain' consumed before engine dispatch; `prepareTTS({parts,storage,identity,textFormat,signal,onState})` returning ordered segments, state, ready, getAudio(index), and cancel(); `playPreparedTTS(prepared,{signal,onState})` returning state, error, finished, pause(), resume(), and stop() with one playback lane per AI and observational state/error callbacks; configure/dispose speech, route lifecycle, declaration-validated chat/stream requests with exact ordered calls; optional streamRequest toolText:{name,field} and onToolText(text,call,displayId) for decoded selected argument text with actual call identity, distinct from ordinary prose and terminal tool execution; synthesis/transcription and playback controls; initializes from current canonical user readiness, installs `window.ai`, and projects `ai-ready` plus active-generation `ai-tts-failure`."
     },
     {
@@ -91,7 +91,7 @@
       "availability": "Cross-host in-process runtime; registered providers remain browser, native, or cloud specific",
       "protocol": "arcane-ai-runtime/2, arcane-ai-provider/2, arcane-ai-model-authority/1",
       "normalization": "Normalizes mutable complete per-role routes, lifecycle/status, cancellation, streaming cleanup, capacity-1 FIFO LLM/STT lanes, bounded provider-declared parallel TTS requests with FIFO overflow, default repeated-formatting-mark removal from cloned direct TTS payloads or explicit textFormat:'plain' preservation with the control consumed before engine dispatch, local-only selection, direct LLM history/declaration/terminal structural contracts, complete all-choice content/reasoning FIFO iteration, private automatic provider draining with result-first buffering, terminal-only structural calls, exact per-choice observed/terminal correlation, and a separate complete validated terminal result without creating a fallback.",
-      "surface": "Protocol constants; singleton-only `AIProviderRuntime`; `aiProviderRuntime`; `getAIProviderRuntime()`; provider registration/identity/selection, closed three-role and STT/TTS-only validation/configuration/replacement, status/catalog/inspection, startup, per-role load/unload/dispose/cancel, dispose-all, request/stream/speech aliases, SDK-internal speech-input preparation metadata, and mute controls."
+      "surface": "Protocol constants; singleton-only `AIProviderRuntime`; `aiProviderRuntime`; `getAIProviderRuntime()`; provider registration/identity/selection, closed three-role and STT/TTS-only validation/configuration/replacement, status/catalog/inspection, startup, per-role load/unload/dispose/cancel, dispose-all, request/stream/speech aliases, SDK-internal speech-input preparation metadata, and setSpeechMuted(muted,{signal}={}) controls. Each pending unmute caller owns its abortable interest; the final interest aborts the owned activation while other preparation/playback or joining direct TTS-load interests preserve it. A pre-aborted unmute starts no activation. Explicit mute retains global cancellation and joined unload even with an aborted observer signal."
     },
     {
       "file": "runtime/arcane/modules/AIResponseURLPolicy.js",

package/docs/reference/pwa.md

@@ -169,6 +169,44 @@ Reference updates finish before file removal begins. Cancellation or a file
 error is reported without undoing earlier completed changes; a later call can
 finish retirement. The operation does not claim an all-or-nothing transaction.
 
+### Disabled worker retirement on the source server
+
+`startDevServer()` and `developApplication()` serve a retirement worker at
+`/arcane-sw.js` when source mode selects a standalone `appsRoot:"."` application
+with explicit `pwa.enabled:false` and that root worker file is absent. This
+browser lifecycle is separate from the import-map filesystem operation above.
+The existing server returns JavaScript with `Cache-Control: no-cache`, including
+when the request carries a former enabled worker's `If-Modified-Since` date.
+It writes no replacement worker file and performs no offline-inventory scan.
+
+When the browser updates the existing registration from that URL, the
+retirement worker calls `skipWaiting()` during installation and unregisters its
+own registration during activation. It has no fetch handler, so subsequent
+requests reaching it use the ordinary network path. It never clears caches,
+DBOPFS, profiles or other saved data; it does not enumerate or claim clients,
+reload pages, or start a polling loop. Other service-worker registrations remain
+untouched.
+
+Native service-worker update and activation timing remains browser-owned. An
+already open page may retain the neutral retirement worker as its controller
+for the rest of its lifetime, and its already rendered content stays unchanged.
+Unregistration removes the registration from future navigation matching;
+retirement does not promise immediate `controller === null` or automatic page
+refresh. These boundaries follow the platform's
+[activation](https://w3c.github.io/ServiceWorker/#activate-algorithm) and
+[unregistration](https://w3c.github.io/ServiceWorker/#dom-serviceworkerregistration-unregister)
+contracts.
+
+An existing root `arcane-sw.js` retains its ordinary authored-file routing,
+including its normal application selection; only an `ENOENT` filesystem result
+selects the retirement response. Omitted PWA configuration, enabled PWA,
+multi-app source workspaces, other URLs and packaged serving keep their existing
+behavior. A separately operated static host must own its worker lifecycle;
+filesystem retirement alone does not establish browser retirement on that host.
+The server path uses the existing portable Node serving owner, and browser
+retirement requires the browser's native service-worker support and an existing
+registration eligible for that update.
+
 ### Authored host root and app entry
 
 An authored `index.html` at the source host root keeps `/` separate from the

package/docs/reference/sdk-api.md

@@ -142,6 +142,10 @@ audio through application-owned DBOPFS. Its immediate handle exposes ordered
 segments, preparation state, `ready`, `getAudio(index)`, and `cancel()`.
 `ai.playPreparedTTS(prepared,{signal,onState})` attaches ordered playback and
 returns `state`, `error`, `finished`, `pause()`, `resume()`, and `stop()`.
+Each preparation owns its pending activation interest. Cancelling the final
+interest aborts that activation; other preparation, playback or joining direct
+TTS-load interests preserve it. Cancelling after readiness leaves the model
+loaded, and complete cache hits start no model. Actual cleanup is provider-owned.
 Each AI has one playback lane; replacing playback preserves independent
 preparation. Fully cached replay does not load the speech
 model. See [prepared narration](ai/browser-speech.md#prepare-narration-once-and-replay-stored-audio)
@@ -421,6 +425,10 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `arcaneNativeBuilderProvider` | singleton | `arcane-os/native/portable-provider` | Portable native provider | Node; produces a portable payload rather than an executable host |
 | `arcaneNativeBuilderProvider default export` | singleton | `arcane-os/native/portable-provider` | Portable native provider | Node; produces a portable payload rather than an executable host |
 | `startCoreHost()` | function | `arcane-os/core/host` | Native Core host composition | Node with readable input and writable output streams |
+| `startSharedCoreHost()` | function | `arcane-os/core/host` | Shared Core host | Node local IPC on Windows, Linux and macOS |
+| `connectSharedCoreHost()` | function | `arcane-os/core/host` | Shared Core host | Node local IPC and optional explicit headless startup |
+| `runSharedCoreHost()` | function | `arcane-os/core/host` | Shared Core host | Node headless entry and optional parent startup IPC |
+| `startSharedCoreBridge()` | function | `arcane-os/core/host` | Shared Core host | Node readable/writable streams and local IPC |
 | `readCoreLaunchContext()` | function | `arcane-os/core/host` | Native Core host composition | Node; reads explicitly selected launch JSON |
 | `resolveArcaneDataPaths()` | function | `arcane-os/core/repositories` | Native repository workspaces | Node on Windows, Linux and macOS; Android supplies its data root |
 | `createRepositoryWorkspace()` | function | `arcane-os/core/repositories` | Native repository workspaces | Node with Git; Android requires host process adaptation |
@@ -4240,6 +4248,17 @@ External source mode accepts both the installed-package route layout and the
 existing physical runtime layout. Installed-package mode serves the configured
 SDK resources directly from `node_modules` at their logical browser URLs;
 it does not create a workspace `arcane/` directory or require `arcane.lock.json`.
+
+For a standalone `appsRoot:'.'` source application with explicit
+`pwa.enabled:false` and an absent root `arcane-sw.js`, the exact worker URL
+returns a small retirement worker. Its native install requests `skipWaiting()`;
+activation unregisters only its own registration, without a fetch handler,
+storage/cache changes, client claiming or page reload. The browser owns update
+timing and an open page may retain the neutral controller until its lifetime
+ends. An existing authored worker, omitted/enabled PWA, multi-app source routes
+and packaged mode stay unchanged. See the complete
+[disabled-worker lifecycle](pwa.md#disabled-worker-retirement-on-the-source-server).
+
 `host` defaults to `127.0.0.1` and accepts an
 explicit network address or hostname. Use `0.0.0.0` for all IPv4 interfaces or
 `::` for the platform's IPv6 wildcard listeners. `port` selects the HTTPS
@@ -4749,6 +4768,14 @@ lifecycle. Package-only apps remain unchanged. The operation generates
 no packaged output; enabled PWA manifests
 are served directly from the selected source resources.
 
+The source listener also supplies the
+[disabled-worker retirement lifecycle](pwa.md#disabled-worker-retirement-on-the-source-server)
+for explicit disabled standalone PWA configuration when the root worker is
+absent. This does not grant filesystem retirement authority or change the
+refresh operation's preservation of authored files. Browser activation and
+unregistration proceed through the native lifecycle without clearing saved data
+or reloading an open page.
+
 ### Signature and result
 
 ```text
@@ -8658,8 +8685,156 @@ async function bundleMoonCheeseRuntime(outputRoot){
 The ordinary provider invokes this owner only for an explicit native local-AI
 selection. See [selected local-AI runtimes](core-native-packaging.md#selected-local-ai-runtimes).
 
+## startSharedCoreHost()
+
+### Overview
+
+Owns one application's Core runtime at an explicitly selected local endpoint.
+It claims the endpoint before constructing services, so UI and MCP processes
+can share the same service state without constructing duplicate owners.
+
+### Signature and result
+
+```text
+startSharedCoreHost({endpoint,application,version,configure,getReplayEvents,signal,onError}={})
+```
+
+Resolves `{runtime,endpoint,closed,close}`. `configure(runtime,{signal})`
+registers services through the existing runtime; services start independently.
+Optional synchronous `getReplayEvents()` supplies current `{event,data}`
+snapshots, never historical replies. `close()` joins composition, accepted
+service work, service cleanup and queued frames before releasing the endpoint.
+Request-lifetime work is cancelled; accepted service-lifetime work remains
+service-owned. The supplied signal begins the same shutdown. `closed` rejects
+on shutdown failure; `onError` observes transport/background failures, with
+complete console diagnostics by default.
+
+### Availability and example
+
+Node supports app-selected named pipes on Windows and Unix-domain sockets on
+Linux/macOS; Android needs its host adaptation. Parent directories must exist.
+An occupied endpoint returns native `EADDRINUSE` with
+`coreHostPhase:'listen'`, without calling `configure`. Native failures remain
+observable; the SDK does not delete an existing endpoint to take ownership.
+
+```js
+import {startSharedCoreHost} from 'arcane-os/core/host';
+
+const host = await startSharedCoreHost(
+    {
+        endpoint: selectedEndpoint,
+        application: {id: 'moon-cheese-ledger'},
+        configure(runtime) {
+            runtime.registerService(ledgerService);
+        }
+    }
+);
+// The application owner later calls await host.close().
+```
+
+`selectedEndpoint` and `ledgerService` belong to the application. See
+[shared Core hosting](core-shared-host.md) for correlation, replay and cleanup.
+
+## connectSharedCoreHost()
+
+### Overview and signature
+
+Connects to the selected application host, optionally starting an explicit
+headless entry when that endpoint is absent.
+
+```text
+connectSharedCoreHost({endpoint,start,signal,onError}={})
+```
+
+Resolves `{client,endpoint,closed,close,shutdown}`. `client` is the existing Core
+client with current-runtime replay. Optional `start` is
+`{command,args=[],cwd,env,logFile}`; its entry calls `runSharedCoreHost()`.
+Only `ENOENT` or `ECONNREFUSED` selects startup. Arguments/environment are
+captured at acceptance, diagnostics append completely to the selected log,
+and requests are never automatically repeated. Other connection/start errors
+propagate; `closed` rejects on transport failure. Node/platform availability
+matches `startSharedCoreHost()`.
+
+`close()` disconnects this client and cancels only its request-lifetime work;
+it preserves the host and accepted service work. Cancelling startup wait does
+not kill a host another client may use. No startup timeout is imposed; supply
+`signal` when needed. `shutdown(invokeOptions)` explicitly invokes
+`core.host.shutdown`, drains all shared services and returns `{state:'closed'}`
+before disconnecting. It affects every client; cancellation after acceptance
+does not reverse it. A drain failure returns the full Core error.
+
+```js
+import {connectSharedCoreHost} from 'arcane-os/core/host';
+
+const connection = await connectSharedCoreHost(
+    {endpoint: selectedEndpoint}
+);
+try {
+    const catalog = await connection.client.invoke(
+        'catalog.read',
+        {}
+    );
+    console.log(catalog);
+} finally {
+    await connection.close();
+}
+```
+
+## runSharedCoreHost()
+
+Accepts the same options as `startSharedCoreHost(options)` and adds the headless
+startup handshake. The winning launcher returns the host handle. A losing
+launcher connects to the existing owner, confirms dispatcher response and
+returns `null` without constructing its own services. Startup success or the
+complete error reaches an existing parent Node IPC channel; the helper never
+calls `process.exit()`. Host lifetime, errors and platform requirements retain
+the contracts above.
+
+```js
+import {runSharedCoreHost} from 'arcane-os/core/host';
+
+const host = await runSharedCoreHost(applicationHostOptions);
+await host?.closed;
+```
+
+The application supplies `applicationHostOptions`, including its endpoint and
+service factory. This is the entry selected by the `start` option of
+`connectSharedCoreHost()`.
+
+## startSharedCoreBridge()
+
+Connects one framed stdio client to the shared host, preserving complete
+requests, responses and events through the existing `arcane/1` transport.
+
+```text
+startSharedCoreBridge({endpoint,start,input=process.stdin,output=process.stdout,signal,onError}={})
+```
+
+Resolves `{endpoint,closed,close}`. `start` and connection errors follow
+`connectSharedCoreHost()`. EOF, `close()` or cancellation disconnects this
+client only. Terminal stream errors settle pending writes and reject `closed`;
+service shutdown is separate. Node readable/writable streams and the selected
+local IPC endpoint are required. This is Core framing, not external MCP framing.
+
+```js
+import {startSharedCoreBridge} from 'arcane-os/core/host';
+
+const bridge = await startSharedCoreBridge(
+    {endpoint: selectedEndpoint}
+);
+await bridge.closed;
+```
+
+Generated native entries select this bridge only through explicit launch
+context `sharedHost:{endpoint,logFile}`. Omitting it preserves ordinary
+stdio-owned Core lifetime. See [native shared-host launch](core-shared-host.md#native-launch-and-platforms).
+
 ## startCoreHost()
 
+For independent UI and MCP processes sharing one application runtime, use the
+[shared host functions](#startsharedcorehost) above. Ordinary `startCoreHost()`
+retains its existing stdio-owned lifetime.
+
 ### Overview
 
 Composes explicitly supplied application services with the shared Core runtime
@@ -9338,7 +9513,7 @@ Existing chat and speech providers are unchanged.
 ### Signature and result
 
 ```text
-createBrowserDecisionModel({family,model,revision,device,dtype,runtime}={})
+createBrowserDecisionModel({family,model,revision,device,dtype,runtime,store}={})
 ```
 
 ```js
@@ -9373,6 +9548,15 @@ selections report its failure without precision fallback. For Laya FP32, pass
 Cancellation terminates that client's Worker and rejects its in-flight work.
 No decisions are inserted into chat history or durable storage.
 
+Optional `store` is an existing SDK DBOPFS model or speech store exposing
+`fetchResource(input, options)`. It remains outside cloned Worker configuration.
+The selected loader routes its actual model/configuration/tokenizer resources
+through that owner and disables competing model caches in this explicit mode.
+Omission preserves ordinary upstream loading. Native ESM imports retain their
+platform loader. Resource progress counts closed shards; cancellation joins
+resource cleanup before outstanding `load()`/`evaluate()` calls settle.
+`unload()` and `dispose()` acknowledge their state transition synchronously.
+
 ### Example
 
 ```js

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.71.0",
+  "version": "0.71.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/src/dev-server.mjs

@@ -17,6 +17,7 @@ import {
     readWorkspaceAssetVersion,resolveAssetReference,rewriteAssetReferences,versionAssetUrl
 } from './import-map.mjs';
 import {createPwaArtifacts,selectPwaFiles} from './pwa.mjs';
+import {createPwaRetirementWorkerScript} from './pwa-worker.mjs';
 
 const is = new Is(false);
 
@@ -1301,6 +1302,30 @@ async function startOwnedDevServer({
                 );
                 return;
             }
+            if (mode === 'source' && selectedRoutes.config.appsRoot === '.'
+                && selectedRoutes.app?.pwa?.enabled === false && target.path === '/arcane-sw.js') {
+                let rootWorkerExists = true;
+                try {
+                    await lstat(path.join(selectedRoutes.workspaceRoot, 'arcane-sw.js'));
+                } catch (error) {
+                    if (error?.code !== 'ENOENT') throw error;
+                    rootWorkerExists = false;
+                }
+                if (!rootWorkerExists) {
+                    response.setHeader('Cache-Control', 'no-cache');
+                    await serveGeneratedRepresentation(
+                        fileServer,
+                        request,
+                        response,
+                        {
+                            // A former enabled worker's date cannot validate this retirement script.
+                            contentType: contentTypes.js,
+                            body: createPwaRetirementWorkerScript
+                        }
+                    );
+                    return;
+                }
+            }
             const rootRequest = segments.length === 0;
             if (rootRequest && !selectedRoutes.rootDocument) {
                 response.writeHead(302,{location:`${selectedRoutes.startPath}${target.search}`});

package/src/pwa-worker.mjs

@@ -2,6 +2,25 @@ export function createPwaWorkerScript(manifest, clientUrl = 'arcane/sdk/pwa.mjs'
     return `(${installPwaWorker.toString()})(${JSON.stringify(manifest, null, 4)}, ${JSON.stringify(clientUrl)});\n`;
 }
 
+export function createPwaRetirementWorkerScript() {
+    return `(${installPwaRetirementWorker.toString()})();\n`;
+}
+
+function installPwaRetirementWorker() {
+    self.addEventListener(
+        'install',
+        function installRetiringWorker(event) {
+            event.waitUntil(self.skipWaiting());
+        }
+    );
+    self.addEventListener(
+        'activate',
+        function activateRetiringWorker(event) {
+            event.waitUntil(self.registration.unregister());
+        }
+    );
+}
+
 function installPwaWorker(manifest, clientUrl) {
     const scope = self.registration.scope;
     const scopeOrigin = new URL(scope).origin;