arcane-os 0.87.0 → 0.88.1

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # Changelog
 
+## 0.88.1
+
+- Recover an ordinary workspace-operation lock when its recorded runner is
+  confirmed absent, including before the six-hour expiry. Retrying the public
+  operation uses the shared lock owner; existing published records stay readable.
+- Preserve live or indeterminate owners and complete process-probe errors.
+  Recheck cancellation, nonce, PID and owner presence after asynchronous recovery
+  observation so an observed replacement remains owned by its actual writer.
+  The existing cooperative read/remove protocol is not an atomic cross-process
+  compare-and-delete.
+
+## 0.88.0
+
+- Add optional `signal` and `startLanguageModel` controls to `AI.setAI`,
+  `configureProviders`, `transitionAI`, and `transitionProviders`, preserving
+  their existing arguments, return values, and eager default. Explicitly
+  deferred selections stay unloaded through later readiness notifications;
+  an explicit runtime load or startup can activate them.
+- Keep cancellation and supersession with the owning selection. Accepted
+  cleanup settles before a cancelled transition can configure or preload a
+  replacement, and stale continuations cannot alter a newer selection.
+  Completed activation is independent of a later caller abort.
+- Preserve truthful busy, loaded `unloading` state while an accepted request
+  finishes cancellation; new inference remains unavailable during cleanup.
+- Preserve keyboard focus in the shared theme switcher during asynchronous
+  selection. Pending choices remain focusable and expose `aria-disabled` while
+  repeated activation is ignored; completion never overrides an intentional
+  focus move. Unavailable Skin choices remain natively disabled.
+
 ## 0.87.0
 
 - Add `createDocumentAcquisitionService` through

package/README.md

@@ -25,7 +25,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.87.0` SDK contract. Development applications declare
+This checkout defines the `0.88.1` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/docs/reference/README.md

@@ -71,6 +71,7 @@ alone does not make bare module names resolve in a browser.
 | Expose application-owned tools and static resources through Node STDIO | [MCP STDIO server](mcp-stdio.md) |
 | Run application-selected llama.cpp, Ollama or ONNX through Core | [Local AI through Core](local-ai.md) |
 | Observe existing renderer and Core model state, progress and failures | [Existing model observation](model-observation.md) |
+| Acquire complete HTTP(S) documents and redirect responses through an application-selected native Core service | [Native document acquisition](document-acquisition.md) |
 | Generate complete local PNG images with a retained native model | [Local image generation](local-image-generation.md) |
 | Select FLUX.2 Klein 4B and its three complementary model resources | [FLUX.2 Klein 4B through Core](local-image-flux.md) |
 | Select the complete SDXL Base 1.0 checkpoint for generation and whole-image editing | [SDXL Base 1.0 through Core](local-image-sdxl.md) |

package/docs/reference/cli.md

@@ -405,6 +405,16 @@ not package the app or produce `dist` output. With PWA enabled, the server
 generates the installation and offline manifests directly; see
 [PWA development and versioning](pwa.md#development-and-hosting).
 
+Ordinary operation acquisition can recover a workspace-operation lock whose
+recorded process is confirmed absent, including before its six-hour expiry.
+Retry the intended command through its usual public entrypoint; no separate
+unlock command or caller-created lease is needed. A live or indeterminate owner
+remains `ARCANE_WORKSPACE_BUSY`, with an indeterminate process-probe error
+retained as the cause. Recovery rechecks cancellation, nonce, PID and owner
+presence after asynchronous observation, preserving a replacement detected
+there. This cooperative read-then-remove protocol does not provide an
+atomic compare-and-delete across competing processes.
+
 The startup URL remains the selected app entry. At `/`, the server serves an
 existing authored host-root `index.html` and suppresses the app-entry redirect
 and PWA alias. A root outside the selected app mapping is served unchanged only

package/docs/reference/inventory/package-api.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.86.1",
+  "sdkVersion": "0.87.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",

package/docs/reference/local-ai.md

@@ -267,6 +267,23 @@ owners; they are separate from this runtime service.
 
 ### Selected Ollama model readiness
 
+High-level `AI.setAI()` and `AI.transitionAI()` accept optional
+`{signal,startLanguageModel}` after their six existing preference arguments;
+`configureProviders()` and `transitionProviders()` accept it as their second
+argument. The default remains eager. `startLanguageModel:false` registers the
+built-in adapter and commits the selected provider/model without preloading it,
+including when later Ollama-ready, credential, or residency callbacks arrive.
+Activate that selection explicitly with `ai.providerRuntime.load('llm',{signal})`
+or `ai.startProviders({startLanguageModel:true,signal})`.
+
+Transition cancellation waits for accepted old-provider cleanup and prevents a
+subsequent configuration or preload. Cancellation during the first owned preload
+reaches the native request, retaining the already-committed selection and its real
+runtime state. A newer selection supersedes older pending transition work.
+Cancelled activation stays inactive through readiness callbacks; a caller abort
+after successful settlement does not unload the ready model. These selection
+controls do not change the ownership of separate callers joining an existing load.
+
 The built-in `OLLAMA` LLM provider loads its selected model through Ollama's
 empty `generate` request and separately confirms that selected model in
 `running()` (`/api/ps`). A model catalog entry, a connected bridge, and a

package/docs/reference/protocols.md

@@ -943,6 +943,21 @@ switches, or falls back implicitly. Generic provider-promise settlement is not
 a claim that underlying work stopped; only a provider's documented positive
 acknowledgement or destructive worker teardown can prove that stronger fact.
 
+High-level built-in selection has its own activation boundary:
+`AI.setAI(...sixPreferences,{signal,startLanguageModel:false})`,
+`AI.transitionAI(...sixPreferences,{signal,startLanguageModel:false})`,
+`AI.configureProviders(selections,{signal,startLanguageModel:false})`, and
+`AI.transitionProviders(selections,{signal,startLanguageModel:false})` register
+the selected adapters and keep the AI tuple and runtime routes together without
+an implicit LLM load. The omitted option remains eager. Deferred or cancelled
+activation remains inactive through later readiness callbacks; explicit runtime
+load or startup can activate that selected route. Accepted transition cleanup
+settles independently, cancellation is checked before configuring/preloading the
+replacement, and the first owned load receives the caller signal. Newer accepted
+selections supersede older pending work without allowing older continuations to
+alter the newer selection. After settlement, later caller abort does not unload
+the completed model. This does not change same-route runtime-load join ownership.
+
 `startAIRuntime({startLanguageModel:false,startTranscription:false})` is the
 explicit startup boundary for browser-WASM LLM and default STT activation. It
 leaves the selected LLM unloaded until the shared chat control publishes an

package/docs/reference/runtime-components.md

@@ -2084,8 +2084,12 @@ changing these attributes later does not reconfigure an existing instance.
 `setMode()` updates pressed state and the host's `data-mode` only. `refresh()`
 loads the existing ThemeManager state, updates selection and Skin availability,
 and resolves with the complete manager state. Clicking a choice uses the same
-manager persistence/activation operation; buttons remain disabled while that
-operation is pending. Presentation configuration preserves that pending state.
+manager persistence/activation operation. While it is pending, choices expose
+`aria-disabled="true"` and ignore repeated activation while remaining in the
+keyboard focus flow. Native disabling remains for an unavailable Skin choice.
+Selection does not move focus when it completes or fails, so the initiating
+button retains focus unless the user moves elsewhere. Presentation configuration
+preserves that pending state; an actual reorder retains its focus behavior above.
 
 The host inherits text color. Existing `--app-bar-border` (falling back to
 `--border-color`), `--app-bar-accent` (then `--secondary-color`),

package/docs/reference/runtime-modules.md

@@ -257,10 +257,41 @@ provider. `transitionAI()` and `transitionProviders()` are deliberate
 cross-role transitions: each stops queued audio, unloads the current LLM, STT,
 and TTS roles, then applies the replacement configuration. `transitionAI()`
 returns aggregate runtime status; `transitionProviders()` returns the configured
-three-role route configuration. Selected TWiN Cloud `TWIN` LLM, `OLLAMA` LLM,
-and Core `LOCAL_SPEACH` STT/TTS built-in routes expose truthful capability-only
-readiness through internal provider/2 adapters without probing, downloading, or
-hiding a load. Explicit speech preference slots remain unchanged, including a
+three-role route configuration.
+
+`setAI(llmService,sttService,ttsService,model,modelTTS,modelSTT,options)` and
+`transitionAI(llmService,sttService,ttsService,model,modelTTS,modelSTT,options)`
+preserve their six positional preference arguments. `configureProviders(selections,options)`
+and `transitionProviders(selections,options)` accept the same optional
+`{signal=null,startLanguageModel=true}` controls. Omission preserves eager built-in
+LLM activation. `startLanguageModel:false` still registers built-in adapters and
+updates both the runtime routes and AI preference tuple, while leaving the selected
+LLM unloaded. Readiness events, credential changes, and native residency observations
+retain that deferred intent; an explicit `providerRuntime.load('llm',{signal})` or
+`startProviders({startLanguageModel:true,signal})` can activate it. Deferral never
+changes the selected model or substitutes another provider.
+
+An already-aborted signal rejects before selection changes. During an asynchronous
+transition, accepted old-provider cleanup finishes, then cancellation prevents new
+configuration or preload. A newer accepted selection supersedes pending older
+transition work; older completion cannot configure, load, or clean up the newer
+selection. Once replacement routes are committed, cancellation reaches the first
+owned load and leaves that replacement explicitly selected with its actual runtime
+state. Later readiness callbacks do not restart the cancelled activation. Completed
+selection/load settlement detaches its caller signal, so later abort never unloads
+the ready model. `setAI()` retains its synchronous boolean and `configureProviders()`
+its synchronous route result; their asynchronous readiness remains observable through
+the provider runtime. Rejected synchronous configuration preserves the prior owned
+selection/load. A selection accepted by a synchronous registration or configuration
+listener supersedes the older continuation before it can apply preferences or load.
+These controls do not change cancellation ownership for a
+separate caller joining an already-pending runtime load.
+
+Selected TWiN Cloud `TWIN` LLM, `OLLAMA` LLM,
+and Core `LOCAL_SPEACH` STT/TTS built-in routes use internal provider/2 adapters.
+TWiN Cloud and Core speech expose capability readiness; Ollama explicitly
+preloads its selected model and confirms its residency before reporting ready.
+Explicit speech preference slots remain unchanged, including a
 selected external provider that the application registers after AI startup.
 TWiN Cloud availability
 requires the selected LLM route, its model, a credential, and `fetch`; Core speech

package/docs/reference/sdk-api.md

@@ -57,6 +57,8 @@ runtime layouts.
 | `arcane-os/core/runtime` | App-neutral native Core dispatcher and service lifecycle. |
 | `arcane-os/core/model-observation` | Passive observation of an existing Core and its actual native model service owners. |
 | `arcane-os/ai/model-observation` | Attach existing renderer model owners and subscribe through an existing Core client. |
+| `arcane-os/document-acquisition` | Acquire complete document and redirect bodies through the selected native Core service. |
+| `arcane-os/core/document-acquisition` | Native HTTP(S) GET service, application-owned destination predicate and acquisition lifecycle. |
 | `arcane-os/core/development` | App-service composition and document-owned Core transport during source development, independently of local AI. |
 | `arcane-os/core/stdio` | Framed Node stdio transport with graceful runtime drain. |
 | `arcane-os/core/host` | Node-only reusable Core host lifecycle, app-selected native launch defaults and shared native location resolution. |
@@ -425,6 +427,8 @@ The remaining data-only subpaths are eight JSON Schemas and package metadata.
 | `createModelObservationService()` | function | `arcane-os/core/model-observation` | Existing model observation | Node with an existing Core runtime and optional existing native model services |
 | `attachModelObservation()` | function | `arcane-os/ai/model-observation` | Existing model observation | JavaScript with an existing Core client and optional existing renderer owners |
 | `subscribeModelObservation()` | function | `arcane-os/ai/model-observation` | Existing model observation | JavaScript with an existing Core client and composed observation service |
+| `acquireCoreDocument()` | function | `arcane-os/document-acquisition` | Native document acquisition | Browser or native WebView with an existing Core client and selected document service |
+| `createDocumentAcquisitionService()` | function | `arcane-os/core/document-acquisition` | Native document acquisition | Node Core on Windows, Linux and macOS; Android requires host adaptation |
 | `encodeCoreFrame()` | function | `arcane-os/core/stdio` | Native Core stdio transport | Node |
 | `createCoreFrameDecoder()` | function | `arcane-os/core/stdio` | Native Core stdio transport | Node |
 | `startCoreStdio()` | function | `arcane-os/core/stdio` | Native Core stdio transport | Node |
@@ -1864,6 +1868,17 @@ whole-tree replacement. The mutable result includes the installed-package
 location, materialized workspace runtime paths, and `workspaceLock` path and
 document. It does not install dependencies or merge application source.
 
+Ordinary acquisition automatically recovers a workspace-operation lock when
+the recorded owner process is confirmed absent, without waiting solely for its
+six-hour expiry. Retry this public operation normally; `workspaceOperationLease`
+is for active nested SDK work and cannot be reconstructed from the lock JSON.
+Live or indeterminate owners remain `ARCANE_WORKSPACE_BUSY`; an indeterminate
+process-probe error is retained as the cause. Existing published lock documents
+remain readable. Recovery rechecks cancellation, the captured nonce and PID,
+and owner presence after asynchronous observation, preserving a replacement
+detected there. This cooperative read-then-remove protocol does not provide an
+atomic compare-and-delete across competing processes.
+
 Replacement removes files absent from the selected runtime content and restores
 the prior tree if commit fails. `signal` and
 `onEvent` remain caller-owned before commit. Once the atomic replacement starts,
@@ -7671,6 +7686,64 @@ promises may await `close()` without becoming its completion barrier. It starts
 no model, refresh, polling, endpoint discovery, host or reconnect. See
 [observation records and limits](model-observation.md#read-or-subscribe-from-an-existing-client).
 
+## acquireCoreDocument()
+
+```text
+acquireCoreDocument({url,client,signal,onProgress}={})
+```
+
+Import from `arcane-os/document-acquisition`. The asynchronous helper uses the
+supplied or installed Core client to invoke `documents.acquire` with `{url}`.
+The application must compose the native document service. Missing Core reports
+`DOCUMENT_ACQUISITION_CORE_UNAVAILABLE`; a missing service retains the existing
+unavailable-method error. Browser-only previews have no browser Fetch fallback.
+
+Resolves with `{requestedUrl,finalUrl,url,status,statusText,ok,headers,mediaType,
+body,complete,redirects}`. The final body and every ordered redirect body are
+complete `Blob` values. An HTTP error response retains its status and content;
+`ok:false` is a result, not a generic acquisition error. Headers and entity
+content reflect Fetch's public response, including ordinary content decoding.
+
+`signal` cancels this request; there is no implicit timeout. `onProgress` receives
+request-correlated `documents.progress` records with phases, document counts
+and status fields, never body content. All accepted callback promises settle
+before the helper settles. Callback failures cancel acquisition and remain
+observable; concurrent operation and callback failures retain an `AggregateError`.
+A late callback or subscription cleanup failure retains the completed response
+in `error.documentAcquisition` with the original cause or aggregated failures.
+Every settlement removes the subscription. Local abort rejects immediately and
+does not wait for native error evidence. See
+[complete result, progress and error records](document-acquisition.md).
+
+## createDocumentAcquisitionService()
+
+```text
+createDocumentAcquisitionService({destinationPredicate,signal}={})
+```
+
+Import from `arcane-os/core/document-acquisition`. This synchronous factory
+returns the Core service definition with `documents.acquire`, direct
+`acquire({url,signal,onProgress})` and idempotent asynchronous `dispose()`.
+Select it through the application's existing native service composition. The
+ordinary service performs HTTP(S) GET acquisition without a predicate.
+
+An application-selected `destinationPredicate(destinationUrl,
+{requestedUrl,previousUrl,signal})` runs locally before every actual GET,
+including the first destination and each redirect. Only `true` permits the
+request; other returns produce `DOCUMENT_DESTINATION_DECLINED`, and a thrown
+or rejected value remains the original cause. The predicate is never serialized.
+Redirects retain every response body; no automatic retry or redirect-count cap
+is imposed. The caller can cancel a repeating redirect chain.
+
+Direct results and error evidence retain `Uint8Array` bodies. Acquisition errors
+keep the original cause and `documentAcquisition` response/redirect records;
+an interrupted body read retains available content marked `complete:false`.
+Only Core JSON transport encodes bodies as base64; the browser restores Blobs.
+The factory signal owns the service lifetime; each call signal owns only its
+request and leaves sibling acquisitions active. `dispose()` aborts and joins all
+active operations. Bodies are buffered completely; progress is not a body stream.
+See [native composition and lifecycle](document-acquisition.md).
+
 ## createPortableNativeProvider()
 
 ### Overview

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arcane-os",
-  "version": "0.87.0",
+  "version": "0.88.1",
   "description": "Arcane OS JavaScript SDK, project-local CLI, browser runtime, and repository-portable application packager.",
   "type": "module",
   "main": "./src/index.mjs",

package/runtime/arcane/components/theme-switcher.html

@@ -38,7 +38,7 @@
         overflow-wrap:anywhere;
     }
 
-    button:hover:not(:disabled):not([aria-pressed="true"]) {
+    button:hover:not(:disabled):not([aria-disabled="true"]):not([aria-pressed="true"]) {
         background:color-mix(in srgb,currentColor 14%,transparent);
     }
 
@@ -48,7 +48,8 @@
         box-shadow:inset 0 0 0 .1rem currentColor;
     }
 
-    button:disabled {
+    button:disabled,
+    button[aria-disabled="true"] {
         cursor:not-allowed;
         opacity:.55;
     }
@@ -88,7 +89,7 @@
     host.refresh=refresh;
     group.addEventListener('click',async function selectScheme(event){
         const button=event.target.closest('[data-scheme]');
-        if(!button||button.disabled) return;
+        if(!button||button.disabled||busy) return;
         setBusy(true);
         try{
             const state=button.dataset.scheme==='custom'?await manager.activateCustom():await manager.setScheme(button.dataset.scheme);
@@ -134,10 +135,14 @@
     }
     function setBusy(value){
         busy=Boolean(value);
-        for(const button of buttons) button.disabled=busy;
+        // Keep the focused choice in the keyboard flow while its operation
+        // settles. The click owner rejects repeat activation without moving focus.
+        for(const button of buttons) button.setAttribute('aria-disabled',String(busy||button.disabled));
     }
     function setCustomAvailable(value){
-        buttons.find(function customScheme(button){return button.dataset.scheme==='custom';}).disabled=busy||!value;
+        const button=buttons.find(function customScheme(button){return button.dataset.scheme==='custom';});
+        button.disabled=!value;
+        button.setAttribute('aria-disabled',String(busy||button.disabled));
     }
     async function refresh(){const state=await manager.load();setMode(state.mode);setCustomAvailable(Boolean(state.theme));return state;}
 

package/runtime/arcane/modules/AI.js

@@ -759,6 +759,19 @@ function isAbortSignal(value){
         &&is.function(value.removeEventListener);
 }
 
+function normalizeAISelectionOptions({signal=null,startLanguageModel=true}={}){
+    if(signal!==null&&!isAbortSignal(signal)){
+        throw new TypeError('AI selection signal must be an AbortSignal.');
+    }
+    if(!is.boolean(startLanguageModel)){
+        throw new TypeError('AI selection startLanguageModel must be a boolean.');
+    }
+    if(signal?.aborted){
+        throw normalizeAIRequestAbort(signal.reason);
+    }
+    return {signal,startLanguageModel};
+}
+
 function closedRecord(value,keys,required,label){
     if(!value
         ||!is.object(value)
@@ -1173,6 +1186,8 @@ class AI {
     #browserSpeechTransition=Promise.resolve();
     #builtInLLMProviders=new Map();
     #builtInLLMReadiness=Promise.resolve(null);
+    #providerSelectionGeneration=0;
+    #providerSelectionOperation=null;
     #builtInSpeechProviders=new Map();
     #configuredSpeechProviders=new Map();
     #builtInSpeechReadiness=Promise.resolve(null);
@@ -2146,7 +2161,8 @@ class AI {
         });
     }
 
-    #ensureBuiltInLLMProvider(providerId){
+    #ensureBuiltInLLMProvider(providerId,operation=null){
+        if(operation)this.#assertProviderSelection(operation);
         if(providerId!=='TWIN'&&providerId!=='OLLAMA'){
             return false;
         }
@@ -2154,15 +2170,34 @@ class AI {
             return false;
         }
         const provider=this.#createBuiltInLLMProvider(providerId);
-        const unregister=this.#providerRuntime.register(provider);
-        this.#builtInLLMProviders.set(
-            providerId,
-            completeValue({provider,unregister})
-        );
+        const runtime=this;
+        let unregister=null;
+        const record={
+            provider,
+            unregister:function unregisterBuiltInLLMProvider(){
+                if(unregister)return unregister();
+                if(!runtime.#providerRuntime.ownsProvider('llm',provider))return false;
+                return runtime.#providerRuntime.unregister('llm',providerId);
+            }
+        };
+        // Registration can publish a pending route synchronously; its owner must
+        // already be visible to a selection accepted by that callback.
+        this.#builtInLLMProviders.set(providerId,record);
+        try{
+            unregister=this.#providerRuntime.register(provider);
+        }catch(error){
+            if(!this.#providerRuntime.ownsProvider('llm',provider)
+                &&this.#builtInLLMProviders.get(providerId)===record){
+                this.#builtInLLMProviders.delete(providerId);
+            }
+            throw error;
+        }
+        if(operation)this.#assertProviderSelection(operation);
         return true;
     }
 
-    #ensureBuiltInSpeechProvider(role,providerId){
+    #ensureBuiltInSpeechProvider(role,providerId,operation=null){
+        if(operation)this.#assertProviderSelection(operation);
         if(!['stt','tts'].includes(role)||providerId!=='LOCAL_SPEACH'){
             return false;
         }
@@ -2170,33 +2205,54 @@ class AI {
             return false;
         }
         const provider=this.#createBuiltInSpeechProvider(role,providerId);
-        const unregister=this.#providerRuntime.register(provider);
-        this.#builtInSpeechProviders.set(
-            this.#builtInSpeechProviderKey(role,providerId),
-            completeValue({role,providerId,provider,unregister})
-        );
+        const runtime=this;
+        const key=this.#builtInSpeechProviderKey(role,providerId);
+        let unregister=null;
+        const record={
+            role,providerId,provider,
+            unregister:function unregisterBuiltInSpeechProvider(){
+                if(unregister)return unregister();
+                if(!runtime.#providerRuntime.ownsProvider(role,provider))return false;
+                return runtime.#providerRuntime.unregister(role,providerId);
+            }
+        };
+        this.#builtInSpeechProviders.set(key,record);
+        try{
+            unregister=this.#providerRuntime.register(provider);
+        }catch(error){
+            if(!this.#providerRuntime.ownsProvider(role,provider)
+                &&this.#builtInSpeechProviders.get(key)===record){
+                this.#builtInSpeechProviders.delete(key);
+            }
+            throw error;
+        }
+        if(operation)this.#assertProviderSelection(operation);
         return true;
     }
 
-    #releaseInactiveBuiltInLLMProviders(activeProviderId){
+    #releaseInactiveBuiltInLLMProviders(activeProviderId,operation=null){
         for(const [providerId,record] of this.#builtInLLMProviders){
+            if(operation)this.#assertProviderSelection(operation);
             if(providerId===activeProviderId){
                 continue;
             }
-            if(record.unregister()){
+            if(record.unregister()&&this.#builtInLLMProviders.get(providerId)===record){
                 this.#builtInLLMProviders.delete(providerId);
             }
         }
     }
 
-    #releaseInactiveBuiltInSpeechProviders(activeProviders){
+    #releaseInactiveBuiltInSpeechProviders(activeProviders,operation=null){
         for(const [key,record] of this.#builtInSpeechProviders){
+            if(operation)this.#assertProviderSelection(operation);
             if(activeProviders[record.role]===record.providerId){
                 continue;
             }
             if(record.unregister()){
                 record.provider.dispose();
-                this.#builtInSpeechProviders.delete(key);
+                if(this.#builtInSpeechProviders.get(key)===record){
+                    this.#builtInSpeechProviders.delete(key);
+                }
             }
         }
     }
@@ -2246,7 +2302,85 @@ class AI {
         return this.#builtInSpeechReadiness;
     }
 
-    #reconcileBuiltInLLMReadiness(){
+    #beginProviderSelection({signal,startLanguageModel},deferSupersession=false){
+        const previous=this.#providerSelectionOperation;
+        const controller=new AbortController();
+        const operation={
+            generation:++this.#providerSelectionGeneration,
+            controller,
+            startLanguageModel,
+            previous:deferSupersession?previous:null,
+            restorePrevious:deferSupersession,
+            committed:false,
+            settled:false,
+            detachSignal:function detachAISelectionSignal(){
+                signal?.removeEventListener('abort',forwardAbort);
+            }
+        };
+        function forwardAbort(){
+            controller.abort(signal.reason);
+        }
+        this.#providerSelectionOperation=operation;
+        signal?.addEventListener('abort',forwardAbort,{once:true});
+        if(signal?.aborted)forwardAbort();
+        if(!deferSupersession)this.#supersedeProviderSelection(previous);
+        return operation;
+    }
+
+    #supersedeProviderSelection(previous){
+        for(let operation=previous;operation;operation=operation.previous){
+            operation.detachSignal();
+            if(!operation.settled){
+                operation.controller.abort(aiProviderError(
+                    'AI provider selection was superseded.',
+                    'ARCANE_AI_OPERATION_SUPERSEDED'
+                ));
+            }
+        }
+    }
+
+    #assertProviderSelection(operation,allowAborted=false){
+        if(operation.generation!==this.#providerSelectionOperation?.generation){
+            throw aiProviderError(
+                'AI provider selection was superseded.',
+                'ARCANE_AI_OPERATION_SUPERSEDED'
+            );
+        }
+        if(!allowAborted&&operation.controller.signal.aborted){
+            throw normalizeAIRequestAbort(operation.controller.signal.reason);
+        }
+    }
+
+    #commitProviderSelection(operation,tuple){
+        // Configuration already committed its routes before notifying listeners.
+        // Keep its tuple together even when that notification aborts this caller;
+        // a newer owner alone prevents this continuation from applying the tuple.
+        this.#assertProviderSelection(operation,true);
+        this.#applyPreferenceTuple(tuple);
+        operation.committed=true;
+        const previous=operation.previous;
+        operation.previous=null;
+        this.#supersedeProviderSelection(previous);
+        this.#assertProviderSelection(operation);
+    }
+
+    #finishProviderSelection(operation){
+        if(operation.restorePrevious&&!operation.committed
+            &&this.#providerSelectionOperation===operation){
+            this.#providerSelectionOperation=operation.previous;
+        }
+        operation.previous=null;
+        operation.settled=true;
+        operation.detachSignal();
+    }
+
+    #reconcileBuiltInLLMReadiness(operation=this.#providerSelectionOperation){
+        if(operation&&(
+            operation!==this.#providerSelectionOperation
+            ||!operation.committed
+        )){
+            return Promise.resolve(this.#providerRuntime.status('llm'));
+        }
         const selection=this.#builtInLLMSelection(false);
         if(!selection){
             return Promise.resolve(this.#providerRuntime.status('llm'));
@@ -2259,10 +2393,14 @@ class AI {
             return this.#providerRuntime.unload('llm');
         }
         if(this.#builtInLLMCapability(selection.providerId)){
-            if(status.state==='ready'&&status.loaded===true){
+            if(operation?.startLanguageModel===false
+                ||operation?.controller.signal.aborted
+                ||(status.state==='ready'&&status.loaded===true)){
                 return Promise.resolve(status);
             }
-            return this.#providerRuntime.load('llm');
+            return this.#providerRuntime.load('llm',{
+                signal:operation?.controller.signal??null
+            });
         }
         if(status.loaded===true
             ||status.busy===true
@@ -2591,12 +2729,15 @@ class AI {
         }
     }
 
-    async #unloadProviderRolesForTransition(){
-        const settlements=await Promise.allSettled([
-            this.#providerRuntime.unload('llm'),
-            this.#providerRuntime.unload('stt'),
-            this.#providerRuntime.unload('tts')
-        ]);
+    async #unloadProviderRolesForTransition(operation){
+        const runtime=this;
+        const settlements=await Promise.allSettled(
+            ['llm','stt','tts'].map(async function unloadPreviousAIProviderRole(role){
+                runtime.#assertProviderSelection(operation);
+                // Accepted cleanup owns completion independently of page cancellation.
+                return runtime.#providerRuntime.unload(role);
+            })
+        );
         const failure=settlements.find(function findAITransitionCleanupFailure(result){
             return result.status==='rejected';
         });
@@ -2643,7 +2784,8 @@ class AI {
         ttsService,
         model,
         modelTTS,
-        modelSTT
+        modelSTT,
+        options
     ) {
         if (
             !(
@@ -2667,59 +2809,83 @@ class AI {
         ]);
         this.#assertValidProviderTuple(tuple);
         this.#assertSynchronousBrowserSpeechSupersession('AI.setAI');
-        this.#ensureBuiltInLLMProvider(tuple[0]);
-        this.#ensureBuiltInSpeechProvider('stt',tuple[1]);
-        this.#ensureBuiltInSpeechProvider('tts',tuple[2]);
-        this.#providerRuntime.configure(this.#routesFromPreferenceTuple(tuple));
-        this.#invalidateSpeechControl();
-        this.#applyPreferenceTuple(tuple);
-        this.#releaseInactiveBuiltInLLMProviders(tuple[0]);
-        this.#releaseInactiveBuiltInSpeechProviders({
-            stt:tuple[1],
-            tts:tuple[2]
-        });
-        this.#retainBuiltInLLMReadiness(
-            this.#reconcileBuiltInLLMReadiness()
-        );
-        this.#retainBuiltInSpeechReadiness(
-            this.#reconcileBuiltInSpeechReadiness()
-        );
-        return true;
+        const normalized=normalizeAISelectionOptions(options);
+        const operation=this.#beginProviderSelection(normalized,true);
+        try{
+            this.#assertProviderSelection(operation);
+            this.#ensureBuiltInLLMProvider(tuple[0],operation);
+            this.#ensureBuiltInSpeechProvider('stt',tuple[1],operation);
+            this.#ensureBuiltInSpeechProvider('tts',tuple[2],operation);
+            this.#providerRuntime.configure(this.#routesFromPreferenceTuple(tuple));
+            this.#commitProviderSelection(operation,tuple);
+            this.#invalidateSpeechControl();
+            this.#assertProviderSelection(operation);
+            this.#releaseInactiveBuiltInLLMProviders(tuple[0],operation);
+            this.#assertProviderSelection(operation);
+            this.#releaseInactiveBuiltInSpeechProviders({
+                stt:tuple[1],
+                tts:tuple[2]
+            },operation);
+            this.#assertProviderSelection(operation);
+            const runtime=this;
+            this.#retainBuiltInLLMReadiness(
+                this.#reconcileBuiltInLLMReadiness(operation).finally(
+                    function settleAISelectionReadiness(){
+                        runtime.#finishProviderSelection(operation);
+                    }
+                )
+            );
+            this.#assertProviderSelection(operation);
+            this.#retainBuiltInSpeechReadiness(
+                this.#reconcileBuiltInSpeechReadiness()
+            );
+            return true;
+        }catch(error){
+            this.#finishProviderSelection(operation);
+            throw error;
+        }
     }
 
-    configureProviders(selections){
+    configureProviders(selections,options){
         const prepared=this.#providerRuntime.validateConfiguration(selections);
         this.#assertDeviceSpeechConfiguration(prepared);
         this.#assertSynchronousBrowserSpeechSupersession('AI.configureProviders');
-        this.#ensureBuiltInLLMProvider(
-            prepared.llm.default?.providerId
-        );
-        this.#ensureBuiltInSpeechProvider(
-            'stt',
-            prepared.stt.default?.providerId
-        );
-        this.#ensureBuiltInSpeechProvider(
-            'tts',
-            prepared.tts.default?.providerId
-        );
-        this.#assertRegisteredBuiltInRoutes(prepared);
-        const configured=this.#providerRuntime.configure(prepared);
-        this.#invalidateSpeechControl();
-        this.#applyPreferenceTuple(this.#tupleFromProviderRoutes(configured));
-        this.#releaseInactiveBuiltInLLMProviders(
-            configured.llm.default?.providerId
-        );
-        this.#releaseInactiveBuiltInSpeechProviders({
-            stt:configured.stt.default?.providerId,
-            tts:configured.tts.default?.providerId
-        });
-        this.#retainBuiltInLLMReadiness(
-            this.#reconcileBuiltInLLMReadiness()
-        );
-        this.#retainBuiltInSpeechReadiness(
-            this.#reconcileBuiltInSpeechReadiness()
-        );
-        return configured;
+        const normalized=normalizeAISelectionOptions(options);
+        const operation=this.#beginProviderSelection(normalized,true);
+        try{
+            this.#assertProviderSelection(operation);
+            this.#ensureBuiltInLLMProvider(prepared.llm.default?.providerId,operation);
+            this.#ensureBuiltInSpeechProvider('stt',prepared.stt.default?.providerId,operation);
+            this.#ensureBuiltInSpeechProvider('tts',prepared.tts.default?.providerId,operation);
+            this.#assertRegisteredBuiltInRoutes(prepared);
+            const configured=this.#providerRuntime.configure(prepared);
+            this.#commitProviderSelection(operation,this.#tupleFromProviderRoutes(configured));
+            this.#invalidateSpeechControl();
+            this.#assertProviderSelection(operation);
+            this.#releaseInactiveBuiltInLLMProviders(configured.llm.default?.providerId,operation);
+            this.#assertProviderSelection(operation);
+            this.#releaseInactiveBuiltInSpeechProviders({
+                stt:configured.stt.default?.providerId,
+                tts:configured.tts.default?.providerId
+            },operation);
+            this.#assertProviderSelection(operation);
+            const runtime=this;
+            this.#retainBuiltInLLMReadiness(
+                this.#reconcileBuiltInLLMReadiness(operation).finally(
+                    function settleAIProviderConfigurationReadiness(){
+                        runtime.#finishProviderSelection(operation);
+                    }
+                )
+            );
+            this.#assertProviderSelection(operation);
+            this.#retainBuiltInSpeechReadiness(
+                this.#reconcileBuiltInSpeechReadiness()
+            );
+            return configured;
+        }catch(error){
+            this.#finishProviderSelection(operation);
+            throw error;
+        }
     }
 
     configureSpeechProviders(selections){
@@ -2762,7 +2928,8 @@ class AI {
         ttsService,
         model,
         modelTTS,
-        modelSTT
+        modelSTT,
+        options
     ){
         const tuple=this.#nextPreferenceTuple([
             llmService,
@@ -2773,54 +2940,70 @@ class AI {
             modelSTT
         ]);
         this.#assertValidProviderTuple(tuple);
-        await this.#supersedeBrowserSpeechForRouteChange();
-        this.#invalidateSpeechControl();
-        await this.#unloadProviderRolesForTransition();
-        this.#ensureBuiltInLLMProvider(tuple[0]);
-        this.#ensureBuiltInSpeechProvider('stt',tuple[1]);
-        this.#ensureBuiltInSpeechProvider('tts',tuple[2]);
-        this.#providerRuntime.configure(this.#routesFromPreferenceTuple(tuple));
-        this.#applyPreferenceTuple(tuple);
-        this.#releaseInactiveBuiltInLLMProviders(tuple[0]);
-        this.#releaseInactiveBuiltInSpeechProviders({
-            stt:tuple[1],
-            tts:tuple[2]
-        });
-        await this.#reconcileBuiltInLLMReadiness();
-        await this.#reconcileBuiltInSpeechReadiness();
-        return this.#providerRuntime.status();
+        const operation=this.#beginProviderSelection(normalizeAISelectionOptions(options));
+        try{
+            this.#assertProviderSelection(operation);
+            await this.#supersedeBrowserSpeechForRouteChange(operation);
+            this.#assertProviderSelection(operation);
+            this.#invalidateSpeechControl();
+            await this.#unloadProviderRolesForTransition(operation);
+            this.#assertProviderSelection(operation);
+            this.#ensureBuiltInLLMProvider(tuple[0],operation);
+            this.#ensureBuiltInSpeechProvider('stt',tuple[1],operation);
+            this.#ensureBuiltInSpeechProvider('tts',tuple[2],operation);
+            this.#assertProviderSelection(operation);
+            this.#providerRuntime.configure(this.#routesFromPreferenceTuple(tuple));
+            this.#commitProviderSelection(operation,tuple);
+            this.#releaseInactiveBuiltInLLMProviders(tuple[0],operation);
+            this.#assertProviderSelection(operation);
+            this.#releaseInactiveBuiltInSpeechProviders({
+                stt:tuple[1],
+                tts:tuple[2]
+            },operation);
+            this.#assertProviderSelection(operation);
+            await this.#reconcileBuiltInLLMReadiness(operation);
+            this.#assertProviderSelection(operation);
+            await this.#reconcileBuiltInSpeechReadiness();
+            this.#assertProviderSelection(operation);
+            return this.#providerRuntime.status();
+        }finally{
+            this.#finishProviderSelection(operation);
+        }
     }
 
-    async transitionProviders(selections){
+    async transitionProviders(selections,options){
         const prepared=this.#providerRuntime.validateConfiguration(selections);
         this.#assertDeviceSpeechConfiguration(prepared);
-        await this.#supersedeBrowserSpeechForRouteChange();
-        this.#ensureBuiltInLLMProvider(
-            prepared.llm.default?.providerId
-        );
-        this.#ensureBuiltInSpeechProvider(
-            'stt',
-            prepared.stt.default?.providerId
-        );
-        this.#ensureBuiltInSpeechProvider(
-            'tts',
-            prepared.tts.default?.providerId
-        );
-        this.#assertRegisteredBuiltInRoutes(prepared);
-        this.#invalidateSpeechControl();
-        await this.#unloadProviderRolesForTransition();
-        const configured=this.#providerRuntime.configure(prepared);
-        this.#applyPreferenceTuple(this.#tupleFromProviderRoutes(configured));
-        this.#releaseInactiveBuiltInLLMProviders(
-            configured.llm.default?.providerId
-        );
-        this.#releaseInactiveBuiltInSpeechProviders({
-            stt:configured.stt.default?.providerId,
-            tts:configured.tts.default?.providerId
-        });
-        await this.#reconcileBuiltInLLMReadiness();
-        await this.#reconcileBuiltInSpeechReadiness();
-        return configured;
+        const operation=this.#beginProviderSelection(normalizeAISelectionOptions(options));
+        try{
+            this.#assertProviderSelection(operation);
+            await this.#supersedeBrowserSpeechForRouteChange(operation);
+            this.#assertProviderSelection(operation);
+            this.#invalidateSpeechControl();
+            await this.#unloadProviderRolesForTransition(operation);
+            this.#assertProviderSelection(operation);
+            this.#ensureBuiltInLLMProvider(prepared.llm.default?.providerId,operation);
+            this.#ensureBuiltInSpeechProvider('stt',prepared.stt.default?.providerId,operation);
+            this.#ensureBuiltInSpeechProvider('tts',prepared.tts.default?.providerId,operation);
+            this.#assertRegisteredBuiltInRoutes(prepared);
+            this.#assertProviderSelection(operation);
+            const configured=this.#providerRuntime.configure(prepared);
+            this.#commitProviderSelection(operation,this.#tupleFromProviderRoutes(configured));
+            this.#releaseInactiveBuiltInLLMProviders(configured.llm.default?.providerId,operation);
+            this.#assertProviderSelection(operation);
+            this.#releaseInactiveBuiltInSpeechProviders({
+                stt:configured.stt.default?.providerId,
+                tts:configured.tts.default?.providerId
+            },operation);
+            this.#assertProviderSelection(operation);
+            await this.#reconcileBuiltInLLMReadiness(operation);
+            this.#assertProviderSelection(operation);
+            await this.#reconcileBuiltInSpeechReadiness();
+            this.#assertProviderSelection(operation);
+            return configured;
+        }finally{
+            this.#finishProviderSelection(operation);
+        }
     }
 
     async transitionSpeechProviders(selections){
@@ -3061,10 +3244,13 @@ class AI {
         );
     }
 
-    async #supersedeBrowserSpeechForRouteChange(){
+    async #supersedeBrowserSpeechForRouteChange(operation=null){
         for(const role of [...this.#configuredSpeechProviders.keys()]){
+            if(operation)this.#assertProviderSelection(operation);
             await this.configureSpeechProvider(role,null);
+            if(operation)this.#assertProviderSelection(operation);
         }
+        if(operation)this.#assertProviderSelection(operation);
         if(!this.#browserSpeechConfigurationRecord
             &&this.#browserSpeechRetiredRecords.size===0){
             return false;

package/runtime/arcane/modules/AIRuntimeState.js

@@ -304,8 +304,11 @@ function copyRoleRecord(role, record) {
     }
     const pendingRecovery = ['recovering', 'error'].includes(record.state)
         && record.operationId !== null;
-    if (record.busy && !pendingRecovery && (record.state !== 'ready' || !record.loaded)) {
-        fail('a busy role must be ready and loaded or retain its recovering/error operation.');
+    const pendingUnload = record.state === 'unloading'
+        && record.loaded && record.operationId !== null;
+    if (record.busy && !pendingRecovery && !pendingUnload
+        && (record.state !== 'ready' || !record.loaded)) {
+        fail('a busy role must be ready and loaded, retain its recovering/error operation, or retain its loaded unloading operation.');
     }
     if (record.state === 'error' && error === null) {
         fail('an error role state must include error details.');

package/src/workspace-operation-lock.mjs

@@ -98,17 +98,20 @@ async function ensureLockDirectory(workspace){
     return physicalDirectory(directory,'Workspace operation-lock directory',{create:true});
 }
 
-function ownerIsAlive(pid){
+function ownerIsAbsent(pid){
     if(!is.safeInteger(pid)||pid<1)return false;
     try{
         process.kill(pid,0);
-        return true;
+        return false;
     }catch(error){
-        return error?.code==='EPERM';
+        if(error?.code==='ESRCH')return true;
+        const busyError=workspaceBusy('The recorded Arcane workspace operation owner could not be determined.');
+        busyError.cause=error;
+        throw busyError;
     }
 }
 
-function lockDocument(value,{workspaceRoot,now=Date.now()}={}){
+function lockDocument(value,{workspaceRoot}={}){
     if(!value||!is.object(value)||is.array(value)
         ||value.schemaVersion!==1
         ||value.kind!=='arcane-workspace-operation-lock'
@@ -124,7 +127,7 @@ function lockDocument(value,{workspaceRoot,now=Date.now()}={}){
     }
     const expiresAt=Date.parse(value.expiresAt);
     if(!is.finite(expiresAt))return null;
-    return {...value,expired:expiresAt<=now};
+    return value;
 }
 
 async function readLock(lockPath,workspaceRoot){
@@ -145,16 +148,24 @@ async function readLock(lockPath,workspaceRoot){
     return lockDocument(value,{workspaceRoot});
 }
 
-async function recoverExpiredLock(lockPath,workspaceRoot,onEvent){
+async function recoverAbsentOwnerLock(lockPath,workspaceRoot,onEvent,signal){
+    throwIfAborted(signal);
     const document=await readLock(lockPath,workspaceRoot);
-    if(!document?.expired||ownerIsAlive(document.owner.pid))return false;
+    throwIfAborted(signal);
+    if(!document||!ownerIsAbsent(document.owner.pid))return false;
     await onEvent?.({
         type:'workspace.operation.stale-recovered',
         workspaceRoot,
         lockPath,
-        previousOwner:document.owner,
+        previousOwner:{...document.owner},
         previousOperation:document.operation
     });
+    throwIfAborted(signal);
+    const current=await readLock(lockPath,workspaceRoot);
+    throwIfAborted(signal);
+    // Observers may replace the record; their completion does not retain ownership.
+    if(current?.nonce!==document.nonce||current?.owner.pid!==document.owner.pid
+        ||!ownerIsAbsent(current.owner.pid))return false;
     await rm(lockPath);
     return true;
 }
@@ -254,15 +265,17 @@ async function acquire({
         lockPath=path.join(directory.canonical,LOCK_NAME);
         let recovered=false;
         for(;;){
+            throwIfAborted(signal);
             try{
                 handle=await open(lockPath,OPEN_EXCLUSIVE,0o600);
                 break;
             }catch(error){
                 if(error?.code!=='EEXIST')throw error;
-                if(recovered||!(await recoverExpiredLock(
+                if(recovered||!(await recoverAbsentOwnerLock(
                     lockPath,
                     workspace.canonical,
-                    onEvent
+                    onEvent,
+                    signal
                 ))){
                     fail(
                         `Workspace is locked by another Arcane operation: ${lockPath}. `