arcane-os 0.80.0 → 0.82.0

package/docs/reference/inventory/runtime-components.json

@@ -194,13 +194,14 @@
       "slots": [],
       "dependencies": [
         "MD.js",
+        "MarkdownMedia.js",
         "File.js",
         "ConversationTimebox.js",
         "AIRuntimeState.js"
       ],
       "availability": "Browser and supported native WebViews",
       "transport": "HTMLImport + DOM; injected Arcane/provider modules where listed",
-      "normalization": "Default completed-transcription submit or opt-in transcriptionMode=draft, complete appendDraft text with preserved existing selection, native interim-range ownership, and rendered conversation print/printTitle are normalized. No-retention submissions stay outside transcript, recurring context, memory, and DBOPFS. UI/runtime state, honest model progress, complete timestamped transcript including ui_hidden stored records, exact saved nonblank assistant display names with AI fallback rather than current-name inference, live session name capture with host.aiName display fallback, user-facing structural arguments.message, nonblank all-ID tool-result restoration, collapsed complete raw inspection, ordered parallel-call replay validation, per-choice streamed/terminal complete-envelope correlation, complete nonstructural stream rendering, automatic repeated-formatting-mark removal from only the outbound speech-input copy while displayed and stored Markdown stays exact, generic visible failure outcomes with complete console diagnostics, atomic executed/declined/cancelled/not-executed result batches with one continuation, plural pending-call reload recovery, reentrant terminal-event ownership, and BFCache-preserving page lifecycle are normalized; destroy aborts observation and returns true once/false thereafter; AI/storage/media behavior remains mixed"
+      "normalization": "Default completed-transcription submit or opt-in transcriptionMode=draft, complete appendDraft text with preserved existing selection, native interim-range ownership, and rendered conversation print/printTitle are normalized. Local MarkdownMedia images hydrate independently in restored, new, streamed and final content without changing original Markdown or delaying text. Per-render ownership releases obsolete display URLs on replacement, removal and destruction; requested print snapshots retain them through afterprint, while explicit print awaits current image readiness. No-retention submissions stay outside transcript, recurring context, memory, and DBOPFS. UI/runtime state, honest model progress, complete timestamped transcript including ui_hidden stored records, exact saved nonblank assistant display names with AI fallback rather than current-name inference, live session name capture with host.aiName display fallback, user-facing structural arguments.message, nonblank all-ID tool-result restoration, collapsed complete raw inspection, ordered parallel-call replay validation, per-choice streamed/terminal complete-envelope correlation, complete nonstructural stream rendering, automatic repeated-formatting-mark removal from only the outbound speech-input copy while displayed and stored Markdown stays exact, generic visible failure outcomes with complete console diagnostics, atomic executed/declined/cancelled/not-executed result batches with one continuation, plural pending-call reload recovery, reentrant terminal-event ownership, and BFCache-preserving page lifecycle are normalized; destroy aborts observation and returns true once/false thereafter; AI/storage/media behavior remains mixed"
     },
     {
       "file": "runtime/arcane/components/conversation-view.html",

package/docs/reference/native-app-control.md

@@ -0,0 +1,147 @@
+# Native application control
+
+`connectAppControl` from `arcane-os/core/app-control` connects to one explicitly
+selected running application window. The Windows WebView2 host provides document
+inspection, a PNG of its rendered viewport, and targeted DOM actions through its
+own local named pipe. The application keeps its existing Core child, profile,
+origin and window lifecycle. These operations do not activate the desktop window
+or send global keyboard or pointer input.
+
+The Node client uses the SDK's existing `arcane/1` framing and local pipe/socket
+transport on Windows, Linux and macOS. The native window adapter described here
+is Windows WebView2; macOS, Linux and Android hosts do not yet expose these
+operations. An installed generic browser tool does not automatically discover
+this endpoint. A caller must use this public client or CLI explicitly.
+
+## Select the running instance
+
+Add an explicit endpoint to the application's existing native launch context:
+
+```json
+{
+  "native": {
+    "launchContext": {
+      "appControl": {
+        "endpoint": "\\\\.\\pipe\\arcane-pm-control"
+      }
+    }
+  }
+}
+```
+
+The same `appControl` record can be supplied in the launch JSON already selected
+by `--arcane-launch-config`. That record is merged by the existing launcher; it
+does not select a different profile or Core topology. Omission starts the usual
+application without a control listener. Each simultaneous application instance
+needs its own endpoint. An occupied endpoint reports the actual startup failure;
+the host does not silently attach to another window or choose another name.
+
+Use a matching published Windows host asset when assembling the application.
+The host producer generates `arcane-app-control.js` from the canonical standalone
+DOM operation function and includes it beside `Arcane.exe`. Direct C# composition
+uses `ArcaneHostOptions.ApplicationId`, `AppControlEndpoint`, and
+`AppControlSource` with the same generated source. Ordinary composition leaves
+the two control options unset.
+
+## Public client
+
+```js
+import {connectAppControl} from 'arcane-os/core/app-control';
+
+const app = await connectAppControl({
+    endpoint: String.raw`\\.\pipe\arcane-pm-control`
+});
+try {
+    const page = await app.inspect();
+    await app.act({
+        documentGeneration: page.documentGeneration,
+        selector: 'a[data-route="connections"]',
+        action: 'click'
+    });
+    const contents = await app.inspect({selector: '#pm-content'});
+    console.log(contents);
+} finally {
+    await app.close();
+}
+```
+
+This example selects an existing navigation link. Its returned action result
+describes the immediate DOM operation. Inspect the resulting page to establish
+the application outcome; a click alone does not establish an asynchronous save,
+connection or other business result.
+
+| Member | Contract |
+| --- | --- |
+| `connectAppControl({endpoint, signal?, onError?})` | Connect once to the explicit running host. It never launches an app, creates Core, changes a profile or reconnects automatically. |
+| `status(options?)` | Returns app identity, platform/host, current URL, document generation, readiness, window title/state/client dimensions and available operations. Readiness describes the document, not models or application services. |
+| `inspect(parameters={}, options?)` | Optional CSS `selector` selects zero or more roots; omission selects the document. Optional `documentGeneration` selects the expected document. Returns complete HTML/text, live control state and DOM-derived role/name hints. |
+| `capture(parameters={}, options?)` | Returns `{mimeType:'image/png', data, documentGeneration, url}`. `data` contains the complete base64 PNG. Optional `documentGeneration` selects the expected document. |
+| `act(parameters, options?)` | Requires `documentGeneration`, one unambiguous CSS `selector`, and the action fields below. |
+| `close()` | Closes this caller's connection and cancels its pending requests. It never closes the app or Core. Returns the connection's completion promise. |
+| `closed` | Connection lifetime promise; actual transport failures remain observable. |
+| `endpoint` | The caller-selected local endpoint. |
+
+Each operation's separate `options` uses the existing Core client request
+contract, including `signal` and `timeoutMs`. Connection cancellation closes only
+that connection. Cancellation before UI dispatch prevents execution. Once a
+script or capture has been dispatched, cancellation cannot reverse its effects;
+the host still observes its completion. A disconnected caller's completed result
+is retained in the host diagnostics instead of being represented as delivered.
+
+## Document operations
+
+Inspection covers the top-level light DOM. Its result contains `scope`, `title`,
+`readyState`, `doctype`, `roots`, `controls`, `frames`, `shadowHosts`,
+`activeElement`, `scrollingElement`, `selection`, `documentGeneration`, and
+`url`. Each root retains its complete `html` and `text`; controls retain their
+attributes and current form, selection, disabled, scrolling and related state.
+Generated CSS selectors are useful for the inspected document; a later DOM edit
+can change their meaning. Application-authored stable selectors are preferable
+when available.
+
+Role/name hints are derived from DOM attributes and labels, not a native
+accessibility-tree computation. Frame documents and shadow-root contents are
+outside this selector scope. Frame elements and open-shadow hosts are described;
+closed shadow roots cannot be discovered. Capture is the current rendered
+viewport, not an offscreen full-document rendering. Covered and minimized-window
+capture behavior requires execution evidence in the selected environment.
+
+| Action | Parameters and immediate behavior |
+| --- | --- |
+| `click` | Calls the uniquely selected element's DOM `click()` method. |
+| `fill` | Exact string `value` replaces an input, textarea or contenteditable value; input/change events are dispatched. Read-only, disabled and non-text input controls report their actual unsupported state. |
+| `select` | Exact `value` string or `values` string array selects native `<select>` options and dispatches input/change. Multiple values require a multiple-select control. |
+| `scroll` | Absolute numeric `left`, `top`, or both in CSS pixels; the omitted axis retains its position. Returns the resulting scroll state, including browser clamping. |
+
+DOM actions use programmatic, untrusted events. They do not supply physical user
+activation for browser features that require it. Results describe the actual
+immediate state, including browser value sanitization; input is not silently
+rewritten by the SDK.
+
+The host publishes a new generation when an actual replacement document becomes
+ready. A creation-time document marker is also checked inside the executing
+script so a queued action cannot run against a successor page. During navigation,
+operations report that the document is not ready. A change during completion
+reports the actual result with that failure; actions are never retried. These
+markers are transient document lifecycle state and are not written to saved data.
+
+## CLI
+
+```powershell
+arcane app-control status --endpoint '\\.\pipe\arcane-pm-control'
+arcane app-control inspect --endpoint '\\.\pipe\arcane-pm-control' --selector '#pm-content'
+arcane app-control capture --endpoint '\\.\pipe\arcane-pm-control' --output '.arcane\view.png'
+arcane app-control act --endpoint '\\.\pipe\arcane-pm-control' --request '.arcane\action.json'
+```
+
+The action file is the complete action parameter object, including the actual
+`documentGeneration` returned by the preceding status or inspection. The CLI
+reads that file completely. Paths are relative to the current directory. Capture
+writes the PNG to the explicitly selected file and prints its metadata. The other
+operations print complete JSON. `app-control --help` describes this command's
+options; other Arcane commands retain their existing global output-format option.
+
+Pipe startup, framing, document, image and output-file errors remain observable.
+Host shutdown stops new control work and observes accepted operations alongside
+the existing Core drain. It does not wait for desktop input or leave an
+independent controller process running.

package/docs/reference/native-decisions.md

@@ -1,7 +1,7 @@
-# Native Laya typed decisions
+# Native typed decisions
 
 `arcane-os/local-ai/decisions` and `arcane-os/core/decisions` run the selected
-Laya FP32 graph through the SDK's existing native ONNX owner. Tokenization runs
+Laya FP32, Laya FP16 or Julia FP32 graph through the SDK's existing native ONNX owner. Tokenization runs
 in its own Node Worker. A Core service can load and evaluate decisions without
 a renderer, browser session, WebGPU browser context or chat provider.
 
@@ -58,7 +58,7 @@ name to `decisions`. It exposes `load`, `evaluate`, `classify` (an alias for
 | Method | Parameters and result |
 | --- | --- |
 | `decisions.status` | Current lifecycle snapshot; does not load anything. |
-| `decisions.load` | `{assetProjectionId?, resourcePaths?, executionTarget?}`; explicit activation or source/device replacement, returning the ready lifecycle snapshot. The request signal cancels activation. A target is `{deviceId:string}` or `null`. |
+| `decisions.load` | `{family?, model?, revision?, dtype?, assetProjectionId?, resourcePaths?, executionTarget?}`; explicit activation or model/source/device replacement, returning the ready lifecycle snapshot. The request signal cancels activation. A target is `{deviceId:string}` or `null`. |
 | `decisions.evaluate` | `{rows, runOptions?}`; returns `{decisions, outputs}`. The request signal cancels the active model operation. |
 | `decisions.unload` | Releases the activation. Service-lifetime cleanup continues after the caller disconnects. |
 
@@ -94,11 +94,18 @@ const decisions = createNativeDecisionModel({
 These direct paths are native filesystem paths. Keep the graph's external data
 beside it under the exact filename required by the graph. The Core service
 resolves configured `paths` relative to `appRoot`; it does not copy or remove
-caller-owned files. For SDK-prepared files, the default selected upstream is
-`onnx-community/laya-typed-decisions-ONNX`, revision `main`, with exactly:
+caller-owned files. Factory defaults remain `family:'laya'`,
+`model:'onnx-community/laya-typed-decisions-ONNX'`, `revision:'main'` and
+`dtype:'fp32'`. SDK upstream preparation selects these exact layouts:
 
-- `onnx/model.onnx` and `onnx/model.onnx_data`;
-- `tokenizer.json` and `tokenizer_config.json`.
+| Family and dtype | Graph | Complete external data |
+| --- | --- | --- |
+| `laya`, `fp32` | `onnx/model.onnx` | `onnx/model.onnx_data` |
+| `laya`, `fp16` | `onnx/model_fp16.onnx` | `onnx/model_fp16.onnx_data` |
+| `julia`, `fp32` | `model.onnx` | `model.onnx.data` |
+
+Each selection uses `tokenizer.json` and `tokenizer_config.json` from its own
+selected repository. Julia's public repository is `SupersonicLabs/Julia-1-ONNX`.
 
 ## Load complete files already stored in DBOPFS
 
@@ -144,7 +151,7 @@ After loading, invoke `decisions.evaluate` with the complete `rows`, then
 `decisions.unload` when that native activation is no longer needed.
 
 Direct model and service calls accept
-`load({assetProjectionId, resourcePaths, executionTarget, signal})`; their
+`load({family, model, revision, dtype, assetProjectionId, resourcePaths, executionTarget, signal})`; their
 factory configuration accepts the same source selection. A direct model needs
 the existing `modelAssets` owner when selecting a projection. `resourcePaths`
 maps all three roles (`model`, `tokenizer`, `tokenizerConfig`) to exact
@@ -161,7 +168,8 @@ Omitted or `undefined` source fields retain the selected source and mappings.
 `assetProjectionId: null` returns to the factory's configured `paths`, or its
 existing upstream preparation when no paths were configured. Selecting another
 projection or changing any resource mapping replaces the activation even when
-the execution target stays the same. Equal source, mapping and device selections
+the execution target stays the same. Equal family, model, revision, dtype,
+source, mapping and device selections
 coalesce. The incoming retain is acquired before the prior activation retires,
 so device replacement can reuse a projection after the caller has released its
 preparation ownership. Superseded pending retains are released as their cleanup
@@ -178,8 +186,12 @@ model store. The approved `@huggingface/tokenizers@0.2.0` dependency reads the
 selected tokenizer files in its Worker. No Transformers or second ONNX runtime
 is loaded by this API.
 
-This graph selection requires `dtype:'fp32'`, which is also the default; another
-dtype reports the incompatible selection rather than substituting a graph.
+Native graph selections support Laya `fp32` and `fp16`, and Julia `fp32`.
+Other family/precision combinations report an unsupported selection. Laya FP16
+uses the published mixed-precision graph, which retains selected operations
+and outputs in FP32; it does not claim every graph operation uses FP16. Julia
+uses its typed five-input ONNX graph and raw option logits, without the upstream
+display-rounded `predict()` wrapper or invented action outputs.
 `sessionOptions` and `runOptions` pass to the existing native ONNX API unchanged.
 With no `executionTarget` selection, `executionPreference` defaults to `gpu`
 here: actual advertised native GPU provider creation is attempted, followed by
@@ -189,6 +201,49 @@ continues to default to CPU. Accepted provider configuration is not evidence
 that GPU nodes executed. Full provider-attempt diagnostics remain in
 `execution`; see [native ONNX sessions](local-ai.md#native-onnx-sessions).
 
+## Select an activation's model
+
+Both factories and each direct/Core `load` accept `family`, `model`, `revision`
+and `dtype`. The same service persists while its selected activation changes:
+
+```js
+await client.invoke('decisions.load', {
+    family: 'julia',
+    model: 'SupersonicLabs/Julia-1-ONNX',
+    revision: 'main',
+    dtype: 'fp32',
+    assetProjectionId: juliaProjection.id,
+    resourcePaths: {
+        model: 'model.onnx',
+        tokenizer: 'tokenizer.json',
+        tokenizerConfig: 'tokenizer_config.json'
+    }
+}, {signal, timeoutMs: 0});
+```
+
+Here `juliaProjection` is the caller's ready projection containing Julia's
+complete graph, `model.onnx.data` and its own tokenizer files. The caller may
+release its preparation ownership after loading, as in the projection example.
+For upstream preparation without configured paths, select the same four model
+fields with `assetProjectionId: null`.
+
+Omitting a model field, or supplying `undefined`, retains its most recent
+selection, initially the factory default. The selection survives unload for a
+later explicit load. Changing any field replaces the activation; equal complete
+selections share it. Supply the complete new model selection when changing
+family, including its matching projection/mapping or configured native files.
+Changing `family` alone does not infer a repository, change precision, replace
+configured files, or rewrite a projection. Metadata describes the caller's
+selection; the SDK does not inspect weights to establish checkpoint identity.
+Configured `paths` and a selected projection keep their existing precedence
+over upstream preparation.
+
+Top-level `current().family`, `model`, `revision` and `dtype` follow the
+activation being loaded, used or retired. While replacement waits for prior
+cleanup, those fields and `execution` still describe the prior activation;
+`pendingActivation` carries the requested successor separately. The new
+selection takes ownership when its activation begins.
+
 ## Select an activation's execution device
 
 Both factories accept `executionTarget: {deviceId:string}` or `null` in their
@@ -228,15 +283,16 @@ resolution, accepted configuration and actual execution evidence. An unknown
 `observedTarget` remains `null`; successful configuration alone does not establish
 which device executed graph nodes.
 
-`pendingActivation` is separately `null` or `{executionTarget}` while a load or
-replacement is pending; its `executionTarget` property is omitted at JSON
+`pendingActivation` is separately `null` or a selection containing `family`,
+`model`, `revision`, `dtype` and `executionTarget` while a load or replacement
+is pending; its `executionTarget` property is omitted at JSON
 transport when the selection is `undefined`. A projected selection also includes
 `assetProjectionId` and its complete `resourcePaths` mapping. A pending target never overwrites the previous
 activation's `execution` record. The old record remains attributable to the
 retiring activation until its cleanup completes, then the new activation owns
 its own record. A request is not a claim that the requested device is running.
 
-Concurrent loads for the same source, resource mapping and target share their
+Concurrent loads for the same family, model, revision, dtype, source, resource mapping and target share their
 pending activation. A different selection supersedes the earlier pending request, which rejects with
 cancellation instead of returning another target's ready result. Replacement
 joins this model's actual tokenizer/native cleanup before creating its
@@ -280,7 +336,8 @@ progress includes model preparation, tokenization and evaluation; downloaded
 members report files, not byte progress. Complete technical errors belong in
 developer diagnostics, while the application owns its user-facing status.
 
-Concurrent callers selecting the same source, mapping and target share one explicit activation.
+Concurrent callers selecting the same family, model, revision, dtype, source,
+mapping and target share one explicit activation.
 Cancelling a load or evaluation cancels that activation and its outstanding operations, because the
 native session and tokenizer have one owner. Use separately owned models when
 independent cancellation is required. The construction `signal` governs the
@@ -304,5 +361,6 @@ availability. Android requires the host's supported native adaptation. Static
 source review and synthetic authored fixtures are not model execution or a
 claim of tested platform, precision or accelerator behavior.
 
-Upstream selection: [Laya FP32 model files](https://huggingface.co/onnx-community/laya-typed-decisions-ONNX/tree/main),
+Upstream selection: [Laya model files](https://huggingface.co/onnx-community/laya-typed-decisions-ONNX/tree/main),
+[Julia-1 model files](https://huggingface.co/SupersonicLabs/Julia-1-ONNX/tree/main),
 [Tokenizer package](https://www.npmjs.com/package/@huggingface/tokenizers).

package/docs/reference/runtime-components.md

@@ -372,6 +372,26 @@ reach developer diagnostics and a concise recovery status stays outside the
 transcript. Destruction cancels pending preparation, while an already requested
 print retains its snapshot through `afterprint`.
 
+Markdown images with local `arcane-media:` references saved through
+[`MarkdownMedia`](runtime-modules.md#markdownmediajs) display automatically in
+new messages, live response chunks, final responses, and restored history.
+Chat resolves references through the existing application-scoped DBOPFS owner
+while preserving the complete original Markdown, model payloads, saved history,
+image descriptions, and ordinary image URLs. Text appears immediately; local
+image reads and decoding proceed independently without delaying streaming or
+session readiness. Failed images retain complete developer diagnostics and show
+a concise message beside that card; successful sibling images remain visible.
+
+Each rendered card owns its display URLs. Re-rendering, history replacement,
+transient-message removal, and destruction cancel obsolete display work and
+release those URLs without deleting stored images. Back/Forward Cache retains
+the existing component lifecycle. Explicit `print()` awaits the current images;
+native Print reports images that are still loading or failed instead of claiming
+they are ready. A requested print snapshot retains its image URLs across later
+message changes or component destruction until `afterprint` releases them.
+Applications continue to own image-record names, associations, and cleanup;
+Chat introduces no renderer callback or additional storage API.
+
 Before any session binding begins, callback-mode `sessionStatus` follows the
 selected sticky LLM role and the existing application-owned `modelName` label
 (or the selected model ID). Assigning `modelName` refreshes that status even

package/docs/reference/sdk-api.md

@@ -58,6 +58,7 @@ runtime layouts.
 | `arcane-os/core/development` | App-service composition and document-owned Core transport during source development, independently of local AI. |
 | `arcane-os/core/stdio` | Framed Node stdio transport with graceful runtime drain. |
 | `arcane-os/core/host` | Node-only reusable Core host lifecycle, app-selected native launch defaults and shared native location resolution. |
+| `arcane-os/core/app-control` | Explicit connection to an existing native window for background document inspection, capture and DOM actions. |
 | `arcane-os/codex/app-server` | Explicit native Codex App Server session, complete live turns, server requests and recovery. |
 | `arcane-os/mcp/stdio` | Node MCP STDIO server for app-owned tools and static resources. |
 | `arcane-os/core/repositories` | Native persistent ArcaneData paths, connected working repositories and scoped non-secret Git identity configuration. |
@@ -69,7 +70,7 @@ runtime layouts.
 | `arcane-os/core/local-ai` | Native llama.cpp, Ollama and ONNX Core service, model readiness, complete responses and owned lifecycle. See [local AI through Core](local-ai.md). |
 | `arcane-os/local-ai` | Official runtime installation and native artifact bundling for selected llama.cpp/Ollama/ONNX/image requirements and NeMo libraries. |
 | `arcane-os/local-ai/onnx` | Retained native ONNX worker sessions with explicit graph loading and complete tensor inference. |
-| `arcane-os/local-ai/decisions` | Explicit native Laya FP32 decisions using the existing ONNX owner and a tokenizer Worker. |
+| `arcane-os/local-ai/decisions` | Explicit native Laya FP32/FP16 and Julia FP32 decisions using the existing ONNX owner and a tokenizer Worker. |
 | `arcane-os/core/decisions` | Renderer-independent typed-decision service composed with existing local-AI and model-assets owners. |
 | `arcane-os/ai/core-onnx` | Optional browser access to system ONNX through an existing Core connection. |
 | `arcane-os/local-ai/image` | Retained native stable-diffusion.cpp context, complete PNG generation and owned worker lifetime. |
@@ -186,7 +187,7 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `acceptWebSocket()` | function | `arcane-os`, `arcane-os/websocket` | WebSocket protocol | Node; browser-native client interoperability |
 | `WS` | class | `arcane-os`, `arcane-os/websocket-client` | Shared WebSocket clients | Node and native-WebSocket browser hosts |
 | `createBrowserDecisionModel()` | function | `arcane-os/ai/browser-decisions` | Browser typed decisions | Browser module Workers and the caller-selected inference backend |
-| `createNativeDecisionModel()` | function | `arcane-os/local-ai/decisions` | Native typed decisions | Node with an existing native ONNX owner and selected Laya FP32 files |
+| `createNativeDecisionModel()` | function | `arcane-os/local-ai/decisions` | Native typed decisions | Node with an existing native ONNX owner and selected Laya FP32/FP16 or Julia FP32 files |
 | `createNativeDecisionService()` | function | `arcane-os/core/decisions` | Native typed decisions | Node Core with existing local-AI and model-assets services |
 | `createNativeDecisionService default export` | function | `arcane-os/core/decisions` | Native typed decisions | Same native decision service factory |
 | `fetchRequest()` | function | `arcane-os/ai/twin-cloud` | TWiN Cloud requests | Node and Browser; remote HTTPS provider |
@@ -428,6 +429,7 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `startCoreHost()` | function | `arcane-os/core/host` | Native Core host composition | Node with readable input and writable output streams |
 | `startSharedCoreHost()` | function | `arcane-os/core/host` | Shared Core host | Node local IPC on Windows, Linux and macOS |
 | `connectSharedCoreHost()` | function | `arcane-os/core/host` | Shared Core host | Node local IPC and optional explicit headless startup |
+| `connectAppControl()` | function | `arcane-os/core/app-control` | Native application control | Node local IPC; current window adapter is Windows WebView2 |
 | `runSharedCoreHost()` | function | `arcane-os/core/host` | Shared Core host | Node headless entry and optional parent startup IPC |
 | `startSharedCoreBridge()` | function | `arcane-os/core/host` | Shared Core host | Node readable/writable streams and local IPC |
 | `readCoreLaunchContext()` | function | `arcane-os/core/host` | Native Core host composition | Node; combines packaged defaults, host state and explicitly selected launch JSON |
@@ -8886,6 +8888,31 @@ try {
 }
 ```
 
+## connectAppControl()
+
+```text
+connectAppControl({endpoint,signal,onError}={})
+```
+
+Connects once to the explicit running native window and resolves
+`{endpoint,closed,status,inspect,capture,act,close}`. The Windows host selects its
+own listener through `native.launchContext.appControl.endpoint` and preserves the
+existing Core child, origin, profile and application lifetime. The client uses
+portable Node local IPC; other native host adapters do not yet implement these
+document operations. No application is launched, no desktop window is activated,
+and no automatic reconnect or action retry occurs.
+
+`status(options)` reports current app/window/document readiness.
+`inspect(parameters={},options)` returns complete selected light-DOM HTML/text
+and live control state. `capture(parameters={},options)` returns a full base64 PNG
+of the rendered viewport. `act(parameters,options)` requires a returned
+`documentGeneration`, one CSS selector, and `click`, `fill`, `select` or `scroll`
+fields. Options preserve the Core client signal/timeout contract. `close()`
+cancels this connection's requests and returns `closed`, without closing the app.
+Document changes and actual errors remain observable; a dispatched action is
+not reversed by later cancellation. Full parameter/result, CLI and platform
+contracts are in [native application control](native-app-control.md).
+
 ## runSharedCoreHost()
 
 Accepts the same options as `startSharedCoreHost(options)` and adds the headless
@@ -9505,23 +9532,35 @@ native installation eligibility and URL-bar promotion.
 
 ### Overview
 
-Runs explicitly selected Laya FP32 option scoring through an existing native
+Runs explicitly selected Laya FP32/FP16 or Julia FP32 option scoring through an existing native
 ONNX owner, with tokenization in a Node Worker. It creates no second inference
 engine and starts no model download at construction.
 
 ### Signature and result
 
 ```text
-createNativeDecisionModel({onnx,modelAssets,workingDirectory,paths,model='onnx-community/laya-typed-decisions-ONNX',revision='main',dtype='fp32',sessionOptions,executionPreference='gpu',signal}={})
+createNativeDecisionModel({onnx,modelAssets,workingDirectory,paths,assetProjectionId,resourcePaths,family='laya',model='onnx-community/laya-typed-decisions-ONNX',revision='main',dtype='fp32',sessionOptions,executionPreference='gpu',executionTarget,signal}={})
 ```
 
 Import from `arcane-os/local-ai/decisions`. Supply the existing `onnx` owner and
 either `modelAssets` plus `workingDirectory`, or native `paths` for the model,
-tokenizer and tokenizer configuration. The selected graph requires FP32. The
+tokenizer and tokenizer configuration, or a ready `assetProjectionId` with
+`resourcePaths` for those three roles. Supported selections are Laya `fp32`,
+Laya `fp16` and Julia `fp32`; constructor defaults remain Laya FP32. The
 handle exposes `load`, `evaluate`, `classify`, `current`, `status`, `subscribe`,
 `unload` and terminal `dispose`; `classify` aliases `evaluate` and `status`
 aliases `current`.
 
+`load({family,model,revision,dtype,assetProjectionId,resourcePaths,executionTarget,signal})`
+selects each activation. Omitted or `undefined` fields retain their prior
+selection. A changed model field, source, mapping or device replaces the
+activation after actual cleanup; equal complete selections coalesce. Supply
+all matching model fields and files when changing family: metadata does not
+infer a repository or rewrite a supplied projection. Top-level model metadata
+continues to describe the retiring activation while `pendingActivation` records
+its successor. See [model selection](native-decisions.md#select-an-activations-model)
+for exact upstream graph/companion layouts and retained projection ownership.
+
 `evaluate(rows,{signal,runOptions})` preserves each complete `state`, `question`,
 `options` and optional `type` separately. It returns `{decisions,outputs}` with
 original rows, typed values, raw logits, unrounded probabilities and every
@@ -9574,7 +9613,11 @@ reacquires `getONNXRuntime()` after any recovery. Native members are `load`,
 `start(context)`.
 
 RPC exposes `decisions.status`, `decisions.load`, `decisions.evaluate` and
-`decisions.unload`. Evaluation accepts `{rows,runOptions?}` and returns complete
+`decisions.unload`. Load accepts optional `family`, `model`, `revision`, `dtype`,
+`assetProjectionId`, `resourcePaths` and `executionTarget`, with the same
+per-activation selection and omission behavior as direct native load; the Core
+request signal owns cancellation. The service persists across model changes.
+Evaluation accepts `{rows,runOptions?}` and returns complete
 `{decisions,outputs}` using the existing tensor codec at the JSON boundary.
 `decisions.state` and replaying `subscribe(listener,{emitCurrent:true,signal})`
 report lifecycle. Unload is accepted service-lifetime cleanup; host shutdown

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.80.0",
+  "version": "0.82.0",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",
@@ -62,6 +62,7 @@
     "./core/development": "./src/core/development.mjs",
     "./core/stdio": "./src/core/stdio.mjs",
     "./core/host": "./src/core/host.mjs",
+    "./core/app-control": "./src/core/app-control.mjs",
     "./codex/app-server": "./src/codex/app-server.mjs",
     "./mcp/stdio": "./src/mcp/stdio-server.mjs",
     "./core/repositories": "./src/core/repositories.mjs",