arcane-os 0.84.0 → 0.86.0

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## 0.86.0
+
+- Add fixed `Tab`, `Shift+Tab`, `Enter` and `Space` key operations to
+  `connectAppControl` and the public `arcane app-control key` command. Each
+  request sends an ordered press/release pair to the selected WebView's current
+  focus without desktop activation or global input. Preserve complete phase
+  outcomes, original errors and observation of a dispatched release after
+  cancellation or navigation; never replay an ambiguous action.
+- Add `resize` to the same client and CLI for a Normal window's native client
+  dimensions. Return actual previous and resulting dimensions plus the observed
+  CSS viewport; restoration is an explicit second request. Preserve window
+  state, position, profile, origin and zoom, and report minimized or maximized
+  state without changing it.
+- Include viewport, document focus and accessible open-shadow focus-path
+  observations in inspection. These are DOM/native observations, not proof of
+  an application action or completed asynchronous handler. The matching Windows
+  host asset is required for the new operations; existing consumer artifacts
+  must adopt the public package and rebuild through their owning workflow.
+
+## 0.85.0
+
+- Add `createModelObservationService({runtime, localAI, image, decisions})`
+  through `arcane-os/core/model-observation`, and renderer
+  `attachModelObservation` / observer `subscribeModelObservation` through
+  `arcane-os/ai/model-observation`. Observe the actual existing Core and
+  renderer model owners without creating, loading or replacing a runtime,
+  provider or model.
+- Replay complete current owner state and retain its reported errors, with
+  explicit opt-in live diagnostics and connection-owned cancellation. Keep
+  original client request identity separate from actual internal Core request
+  identity. Native `coreListener` composition reuses existing selected services;
+  applications explicitly attach their renderer owners.
+- Preserve the complete Windows PnP property batch while narrowing only the
+  property cmdlet's internal concurrency. Keep asynchronous shared discovery,
+  cancellation, explicit refresh and model/device selection unchanged. This
+  addresses the observed missing/duplicate property rows without adding retries
+  or another hardware query.
+- These capabilities expose current state and correct the property query;
+  they do not claim to repair or verify native model inference. No dependency
+  changes or native host rebuild are required for this revision.
+
 ## 0.84.0
 
 - Add `startCoreListener({runtime, endpoint, onError})` through

package/README.md

@@ -25,7 +25,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.84.0` SDK contract. Development applications declare
+This checkout defines the `0.86.0` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/browser-runtime/ai/model-observation.mjs

@@ -0,0 +1,315 @@
+import Is from '../dependencies/strong-type/index.js';
+import {CoreError, serializeCoreError} from '../core/contracts.mjs';
+import {getInstalledCoreClient, subscribeCoreClient} from '../core/client.mjs';
+
+const is = new Is(false);
+
+/** Attach the caller's existing renderer owners to its existing Core client. */
+export function attachModelObservation({client, aiRuntimeState = null, imageRuntime = null,
+    decisionModel = null, modelController = null, signal, onError} = {}) {
+    requireOwner(aiRuntimeState, ['getAIRuntimeState', 'subscribeAIRuntimeState'], 'aiRuntimeState');
+    requireOwner(imageRuntime, ['current', 'subscribe'], 'imageRuntime');
+    requireOwner(decisionModel, ['status', 'subscribe'], 'decisionModel');
+    requireOwner(modelController, ['status', 'on'], 'modelController');
+    const lifetime = observationLifetime({client, signal, onError});
+    let attachmentRequestId;
+    let coreRequestId;
+    let snapshot = null;
+    let attached = false;
+
+    function readOwners() {
+        return {
+            aiRuntimeState: aiRuntimeState?.getAIRuntimeState() ?? null,
+            imageRuntime: imageRuntime?.current() ?? null,
+            decisionModel: decisionModel?.status() ?? null,
+            modelController: modelController?.status() ?? null
+        };
+    }
+
+    function publishOwners() {
+        if (!attached || lifetime.stopped) return;
+        try {
+            snapshot = readOwners();
+            lifetime.invoke('model.observation.renderer.publish', {
+                attachmentRequestId, coreRequestId, snapshot: transportSnapshot(snapshot)
+            });
+        } catch (error) {
+            lifetime.fail(error);
+        }
+    }
+
+    function observeOwners() {
+        if (aiRuntimeState) lifetime.cleanup(aiRuntimeState.subscribeAIRuntimeState(
+            publishOwners, {emitCurrent: false, signal: lifetime.signal}
+        ));
+        if (imageRuntime) lifetime.cleanup(imageRuntime.subscribe(
+            publishOwners, {replay: false, signal: lifetime.signal}
+        ));
+        if (decisionModel) lifetime.cleanup(decisionModel.subscribe(
+            publishOwners, {emitCurrent: false, signal: lifetime.signal}
+        ));
+        if (modelController) {
+            lifetime.cleanup(modelController.on('statechange', publishOwners));
+            lifetime.cleanup(modelController.on('progress', publishOwners));
+        }
+    }
+
+    function acknowledgeAttachment(value) {
+        if (lifetime.stopped || attached || value?.attachmentRequestId !== attachmentRequestId) return;
+        try {
+            if (!is.string(value.coreRequestId)) {
+                throw observationError('MODEL_OBSERVATION_CONTEXT_UNAVAILABLE',
+                    'The renderer acknowledgement omitted the actual Core request identity.');
+            }
+            coreRequestId = value.coreRequestId;
+            attached = true;
+            observeOwners();
+            // Read again after all subscriptions exist so changes during the
+            // attachment handshake are represented by current owner state.
+            publishOwners();
+            lifetime.acknowledge(value);
+        } catch (error) {
+            lifetime.fail(error);
+        }
+    }
+
+    if (!lifetime.stopped) {
+        try {
+            snapshot = readOwners();
+            lifetime.cleanup(client.events.on('model.observation.renderer.attached', acknowledgeAttachment));
+            lifetime.invoke('model.observation.renderer.attach', {snapshot: transportSnapshot(snapshot)}, {
+                long: true,
+                onRequest: function identifyAttachment(value) { attachmentRequestId = value.requestId; }
+            });
+        } catch (error) {
+            lifetime.fail(error);
+        }
+    }
+
+    return {
+        ready: lifetime.ready,
+        closed: lifetime.closed,
+        current: function currentRendererObservation() { return snapshot; },
+        close: lifetime.close
+    };
+}
+
+/** Subscribe through an existing Core client; model diagnostics are explicit. */
+export function subscribeModelObservation({client, signal, onState, onDiagnostic, onError} = {}) {
+    if (!is.function(onState)) throw new TypeError('Model observation requires an onState listener.');
+    if (onDiagnostic !== undefined && !is.function(onDiagnostic)) {
+        throw new TypeError('onDiagnostic must be a function.');
+    }
+    const lifetime = observationLifetime({client, signal, onError});
+    let watchRequestId;
+    let snapshot = null;
+
+    function receiveState(value) {
+        if (lifetime.stopped || value?.watchRequestId !== watchRequestId) return;
+        if (!value.snapshot || !is.object(value.snapshot)) {
+            lifetime.fail(observationError('MODEL_OBSERVATION_STATE_INVALID', 'Core omitted the observation snapshot.'));
+            return;
+        }
+        snapshot = value.snapshot;
+        lifetime.acknowledge(snapshot);
+        lifetime.notify(onState, snapshot);
+    }
+
+    function receiveDiagnostic(value) {
+        if (lifetime.stopped || value?.watchRequestId !== watchRequestId) return;
+        lifetime.notify(onDiagnostic, value);
+    }
+
+    if (!lifetime.stopped) {
+        try {
+            lifetime.cleanup(client.events.on('model.observation.state', receiveState));
+            if (onDiagnostic) lifetime.cleanup(client.events.on('model.observation.error', receiveDiagnostic));
+            lifetime.invoke('model.observation.watch', {diagnostics: Boolean(onDiagnostic)}, {
+                long: true,
+                onRequest: function identifyWatch(value) { watchRequestId = value.requestId; }
+            });
+        } catch (error) {
+            lifetime.fail(error);
+        }
+    }
+
+    return {
+        ready: lifetime.ready,
+        closed: lifetime.closed,
+        current: function currentModelObservation() { return snapshot; },
+        close: lifetime.close
+    };
+}
+
+function requireOwner(owner, methods, label) {
+    if (owner === null) return;
+    for (const method of methods) {
+        if (!is.function(owner?.[method])) throw new TypeError(`${label} must be an existing owner exposing ${method}().`);
+    }
+}
+
+function observationError(code, message) {
+    return new CoreError({code, message});
+}
+
+function cancelledObservation() {
+    return new CoreError({name: 'AbortError', code: 'ARCANE_REQUEST_ABORTED', message: 'Model observation was cancelled.'});
+}
+
+function isCancellation(error) {
+    return error?.name === 'AbortError' || error?.code === 'ARCANE_REQUEST_ABORTED' || error?.code === 'REQUEST_ABORTED';
+}
+
+/** Error encoding belongs only to the existing JSON transport boundary. */
+function transportSnapshot(snapshot) {
+    return Object.fromEntries(Object.entries(snapshot).map(function transportOwner([name, value]) {
+        return [name, value && is.error(value.error) ? {...value, error: serializeCoreError(value.error)} : value];
+    }));
+}
+
+function reportObservationFailure(error) {
+    globalThis.console?.error('Model observation failed.', error);
+}
+
+/** Own only observation RPCs and subscriptions, never the supplied owners. */
+function observationLifetime({client, signal, onError = reportObservationFailure}) {
+    if (!is.function(client?.invoke) || !is.function(client?.events?.on)) {
+        throw new TypeError('Model observation requires an existing Core client.');
+    }
+    if (!is.function(onError)) throw new TypeError('onError must be a function.');
+    const controller = new AbortController();
+    const cleanups = [];
+    const pending = new Set();
+    const failures = [];
+    let stopped = false;
+    let acknowledged = false;
+    let completed = false;
+    let resolveReady;
+    let rejectReady;
+    let resolveClosed;
+    let rejectClosed;
+    const ready = new Promise(function ownObservationReadiness(resolve, reject) {
+        resolveReady = resolve;
+        rejectReady = reject;
+    });
+    const closed = new Promise(function ownObservationClosure(resolve, reject) {
+        resolveClosed = resolve;
+        rejectClosed = reject;
+    });
+    // The same failures are reported through onError and retained on these
+    // public promises; unused companion promises must not create extra alerts.
+    ready.catch(function readinessFailureObservedByLifetime() {});
+    closed.catch(function closureFailureObservedByLifetime() {});
+
+    function recordFailure(error) {
+        if (failures.includes(error)) return;
+        failures.push(error);
+        try {
+            Promise.resolve(onError(error)).catch(function reportErrorCallbackFailed(callbackError) {
+                reportObservationFailure(callbackError);
+            });
+        } catch (callbackError) {
+            reportObservationFailure(callbackError);
+        }
+    }
+
+    function finish() {
+        if (!stopped || pending.size || completed) return;
+        completed = true;
+        if (failures.length === 1) rejectClosed(failures[0]);
+        else if (failures.length) rejectClosed(new AggregateError(failures, 'Model observation closed with errors.'));
+        else resolveClosed();
+    }
+
+    function close() {
+        if (!stopped) {
+            stopped = true;
+            for (const cleanup of cleanups.splice(0)) {
+                try { cleanup(); } catch (error) { recordFailure(error); }
+            }
+            controller.abort();
+            if (!acknowledged) rejectReady(failures[0] ?? cancelledObservation());
+        }
+        finish();
+        return closed;
+    }
+
+    function fail(error) {
+        recordFailure(error);
+        close();
+    }
+
+    function cleanup(release) {
+        if (!is.function(release)) throw new TypeError('An observation subscription must return an unsubscribe function.');
+        if (stopped) release();
+        else cleanups.push(release);
+    }
+
+    function invoke(method, parameters, {long = false, onRequest} = {}) {
+        if (stopped) return;
+        // Reserve ownership before invoke: an in-process transport can deliver
+        // acknowledgement synchronously while invoke is still on the stack.
+        const operation = {};
+        pending.add(operation);
+        let task;
+        try {
+            task = client.invoke(method, parameters, {signal: controller.signal, timeoutMs: 0, onRequest});
+        } catch (error) {
+            task = Promise.reject(error);
+        }
+        Promise.resolve(task).then(function observationCompleted() {
+            pending.delete(operation);
+            if (long && !stopped) {
+                if (!acknowledged) fail(observationError('MODEL_OBSERVATION_ENDED', 'The observation ended before acknowledgement.'));
+                else close();
+            }
+            finish();
+        }, function observationFailed(error) {
+            pending.delete(operation);
+            if (isCancellation(error)) close();
+            else fail(error);
+            finish();
+        });
+    }
+
+    function acknowledge(value) {
+        if (stopped || acknowledged) return;
+        acknowledged = true;
+        resolveReady(value);
+    }
+
+    function notify(listener, value) {
+        if (stopped || !listener) return;
+        try {
+            // Callback lifetimes belong to callers, who may await close().
+            // Observe rejection without making that callback a close barrier.
+            Promise.resolve(listener(value)).catch(fail);
+        } catch (error) {
+            fail(error);
+        }
+    }
+
+    function retireObservation() { close(); }
+    if (signal) {
+        signal.addEventListener('abort', retireObservation, {once: true});
+        cleanup(function releaseCallerSignal() { signal.removeEventListener('abort', retireObservation); });
+    }
+    if (is.function(globalThis.addEventListener)) {
+        globalThis.addEventListener('pagehide', retireObservation, {once: true});
+        cleanup(function releasePageLifetime() { globalThis.removeEventListener('pagehide', retireObservation); });
+    }
+    if (getInstalledCoreClient() === client) {
+        cleanup(subscribeCoreClient(function installedOwnerChanged(value) {
+            if (value.client !== client) {
+                if (value.error) fail(value.error);
+                else close();
+            }
+        }, {emitCurrent: false}));
+    }
+    if (signal?.aborted) close();
+
+    return {
+        ready, closed, signal: controller.signal, cleanup, invoke, acknowledge, notify, fail, close,
+        get stopped() { return stopped; }
+    };
+}

package/browser-runtime/core/app-control.mjs

@@ -9,6 +9,9 @@
  * returned completely. Frame documents and unselected shadow-root contents stay
  * outside this scope. Closed shadow roots cannot be discovered or entered.
  * domRole/domName are DOM-derived hints, not an accessibility-tree computation.
+ * Document-level viewport/focus observations also describe the active open-shadow
+ * branch, independently of the selected inspection root. The native-only view
+ * operation reads that observation without collecting HTML/control roots.
  *
  * act({action,selector,shadowPath?,...}) requires one current CSS match in the
  * selected root. fill uses an exact
@@ -36,7 +39,10 @@ export function runAppControl(operation, params = {}) {
         if (operation === 'act') {
             return {ok: true, result: actOnElement()};
         }
-        fail('INVALID_ARGUMENT', 'Expected the inspect or act operation.');
+        if (operation === 'view') {
+            return {ok: true, result: readView()};
+        }
+        fail('INVALID_ARGUMENT', 'Expected the inspect, act, or view operation.');
     } catch (error) {
         return {
             ok: false,
@@ -66,6 +72,25 @@ export function runAppControl(operation, params = {}) {
         return Array.from(root.querySelectorAll(selector));
     }
 
+    // Native keys and resize need only this fixed observation, not a DOM scan.
+    function readView() {
+        const focusPath = [];
+        let element = document.activeElement;
+        while (element) {
+            focusPath.push(describeElement(element, null));
+            element = element.shadowRoot?.activeElement ?? null;
+        }
+        return {
+            viewport: {
+                width: globalThis.innerWidth,
+                height: globalThis.innerHeight,
+                devicePixelRatio: globalThis.devicePixelRatio
+            },
+            documentHasFocus: document.hasFocus(),
+            focusPath
+        };
+    }
+
     function selectedRoot() {
         const shadowPath = params.shadowPath === undefined ? [] : params.shadowPath;
         if (!Array.isArray(shadowPath)) {
@@ -156,6 +181,7 @@ export function runAppControl(operation, params = {}) {
             ...(isDocument ? {} : {shadowPath}),
             title: document.title,
             readyState: document.readyState,
+            ...readView(),
             doctype: document.doctype
                 ? new XMLSerializer().serializeToString(document.doctype)
                 : null,

package/docs/reference/README.md

@@ -70,6 +70,7 @@ alone does not make bare module names resolve in a browser.
 | Own an explicitly selected native Codex App Server session | [Codex App Server](codex-app-server.md) |
 | Expose application-owned tools and static resources through Node STDIO | [MCP STDIO server](mcp-stdio.md) |
 | Run application-selected llama.cpp, Ollama or ONNX through Core | [Local AI through Core](local-ai.md) |
+| Observe existing renderer and Core model state, progress and failures | [Existing model observation](model-observation.md) |
 | Generate complete local PNG images with a retained native model | [Local image generation](local-image-generation.md) |
 | Select FLUX.2 Klein 4B and its three complementary model resources | [FLUX.2 Klein 4B through Core](local-image-flux.md) |
 | Select the complete SDXL Base 1.0 checkpoint for generation and whole-image editing | [SDXL Base 1.0 through Core](local-image-sdxl.md) |

package/docs/reference/cli.md

@@ -17,7 +17,10 @@ JSON to stderr and a nonzero exit. Capture writes its image to the explicit
 the general output-format parser below applies to the other commands.
 Inspection accepts either `--selector` or `--request <json-file>`; the latter
 reads the complete inspection object, including an explicit `shadowPath` through
-open shadow roots. Actions continue to use `--request` for their complete object.
+open shadow roots. Actions, fixed keys and Normal-window resizing use `--request`
+for their complete parameter object. Keys require the observed document
+generation; resize returns actual previous native client dimensions for an
+explicit restoration request.
 
 ## Command inventory
 
@@ -41,7 +44,7 @@ open shadow roots. Actions continue to use `--request` for their complete object
 | `arcane run` | Serves an existing browser release, or packages, plans, builds, and launches one paired native artifact. |
 | `arcane update-check` | Performs one explicit, read-only npm dist-tag query for the installed SDK version. |
 | `arcane targets` | Lists target ids, declared status, formats, architectures, signing profiles, methods, and pairing reason. |
-| `arcane app-control status\|inspect\|capture\|act` | Connects to an explicit running native window endpoint for document inspection, viewport capture or targeted DOM actions. |
+| `arcane app-control status\|inspect\|capture\|act\|key\|resize` | Connects to an explicit running native window endpoint for document inspection, viewport capture, targeted DOM actions, fixed keys or Normal-window client resizing. |
 | `arcane repo status\|pull\|push` | Runs one selected repository operation for the current app workspace. |
 | `arcane mail key set\|status\|delete` | Manages one server-only Resend API-key profile in `.arcane.env.json`. |
 | `arcane mail send` | Performs one explicit, idempotency-keyed Resend attempt from a complete JSON report on redirected stdin. |

package/docs/reference/core-native-packaging.md

@@ -245,6 +245,20 @@ listener endpoint has no default and its parent directory must already exist
 where required by the operating system. `coreListener` and `sharedHost` are
 alternative selections; supplying both reports `TypeError`.
 
+That same `coreListener` opt-in registers one
+[`createModelObservationService()`](model-observation.md) after `startCoreHost()`
+and before binding the listener. It receives `host.runtime` and the exact
+already-created service objects exposing `localai.status`, `image.status` and
+`decisions.status`; a configurable decision-service name remains supported.
+Absent owners are `null`. Composition creates no model or second runtime,
+performs no service lookup and adds no model-readiness wait. Ordinary stdio
+without this opt-in and the existing `sharedHost` branches retain their behavior.
+The application separately calls `attachModelObservation()` with its existing
+renderer owners and Core client; native composition cannot infer those objects.
+Observers select `onDiagnostic` to receive complete live model failure frames
+in their developer diagnostic surface. Observation does not start inference or
+establish that an existing model failure has been corrected.
+
 Clients use `connectSharedCoreHost({endpoint})` with `start` omitted and close
 only their own connection. This listener provides no host-shutdown RPC. Closing
 the window still drains its Core, including accepted service-owned operations,

package/docs/reference/core-runtime.md

@@ -67,7 +67,7 @@ complete diagnostic serialization; the startup promise retains its original
 rejection value.
 
 Each lifecycle hook receives `{application, service, emit, getService}`. Each request handler
-receives `(parameters, {application, service, emit, getService, requestId, coreRequestId, signal})`, with
+receives `(parameters, {application, service, emit, getService, requestId, clientRequestId, coreRequestId, signal})`, with
 `this` bound to its service definition. A hook or handler may publish a complete
 service-owned event through `emit(event, data)`.
 
@@ -133,16 +133,25 @@ availability errors remain observable; unavailable services are not replaced
 with browser behavior.
 
 A transport that assigns internal dispatch IDs may call
-`runtime.handle(frame, {contextRequestId})`. This optional nonempty string sets
-only the service handler's `context.requestId`. `context.coreRequestId` always
-exposes the actual `frame.id`; it distinguishes simultaneous requests whose
-clients selected equal IDs. The supplied `frame.id` still
-owns active-request state, cancellation lookup, response correlation and the
-request event's top-level envelope. Parameters and event data remain unchanged.
-Ordinary `handle(frame)` keeps its existing behavior: `context.requestId` equals
-`frame.id`, and `coreRequestId` equals that same ID. Stdio and
-the borrowed IPC listener use this metadata to preserve the original client ID
-in service-facing data while their transport owner routes unique dispatch IDs.
+`runtime.handle(frame, {contextRequestId, contextClientRequestId})`. Each supplied
+metadata value must be a nonempty string. Handler identities are:
+
+| Field | Value |
+|---|---|
+| `requestId` | `contextRequestId ?? frame.id`, preserving the transport's established handler contract |
+| `clientRequestId` | `contextClientRequestId ?? contextRequestId ?? frame.id`, exposing the actual incoming client identity |
+| `coreRequestId` | `frame.id`, the actual internal dispatch identity |
+
+Ordinary `handle(frame)` exposes all three equal to `frame.id`. Existing callers
+that supply only `contextRequestId` also receive that value as `clientRequestId`.
+Stdio and both IPC listener forms always supply the actual client ID separately.
+Stdio and the borrowed listener preserve it as `requestId` too; the owning
+shared-host adapter retains its established internal `requestId` contract.
+
+The supplied `frame.id` still owns active-request state, cancellation lookup,
+response correlation and the request event's top-level envelope. It distinguishes
+simultaneous requests whose clients selected equal IDs. Parameters, results and
+event data remain unchanged; these identity fields are separate context metadata.
 
 A request with no registered handler retains code `METHOD_NOT_ALLOWED` and
 adds the exact `method`, its first dotted `namespace`, and a `reason`.

package/docs/reference/core-shared-host.md

@@ -58,7 +58,8 @@ the supplied runtime alive. A draining/closed runtime rejects attachment with
 
 Stdio and each IPC connection have independent request correlation and
 cancellation. Handlers reached through stdio or this listener receive the
-original client ID in `context.requestId`; `context.coreRequestId` exposes the
+original client ID in both `context.requestId` and `context.clientRequestId`;
+`context.coreRequestId` exposes the
 fresh internal ID used by runtime dispatch and protocol routing. Responses and
 top-level event correlation return to their originating connection. The new listener leaves all event data,
 including any authored `data.requestId`, and all parameters/results unchanged.
@@ -186,8 +187,13 @@ substitutes an internal Core request ID and restores the originating ID on respo
 the optional top-level event `requestId`. Existing `data.requestId` values that
 carry that same Core correlation ID are restored too. `parameters`, returned results, schemas,
 documents, and content remain complete and unchanged. A handler's
-`context.requestId` is the Core-side correlation ID; put it in the event's
-separate `requestId` field, not inside application content.
+`context.requestId` remains the Core-side correlation ID, equal to
+`context.coreRequestId`; put it in the event's separate `requestId` field, not
+inside application content. The additive `context.clientRequestId` exposes the
+actual incoming client ID independently of that compatibility behavior. Services
+such as [model observation](model-observation.md) can therefore publish explicit
+client-facing acknowledgement fields without changing the existing adapter or
+rewriting application payloads.
 
 Responses and request-context events go to the originating connection in
 order. Core supplies the top-level request correlation outside `data`, so two

package/docs/reference/execution-devices.md

@@ -41,6 +41,12 @@ An adapter whose stable identity cannot be established remains in the inventory
 with `deviceId: null` and a corresponding issue. The SDK does not invent a key
 from a name, enumeration order, hardware model number or adapter LUID.
 
+Windows discovery reads the present PCI devices' bus and address properties in
+one batched `Get-PnpDeviceProperty` call with `-ThrottleLimit 1`. This limits
+concurrency inside that query because concurrent CIM operations have been
+observed to duplicate some device results and omit others. Discovery remains
+asynchronous at the host, with the same shared catalog and explicit refresh.
+
 The CPU choice uses `deviceId: 'cpu'` and `identitySource: 'host-cpu'`. It selects
 the whole-host CPU execution target, without claiming socket or core affinity.
 Its `processors` entries contain `{deviceId, name, socketDesignation, cores,