arcane-os 0.89.0 → 0.91.0

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## 0.91.0
+
+- Persist complete native `modelAssets.prepare()` acquisitions across release,
+  unload, service disposal and process restart. Reuse the complete ordered
+  source selection from its selected store, with independent caller lifetimes,
+  cancellation and progress. Explicit `refresh: true` acquires a new complete
+  set while preserving earlier completed acquisitions and retained uses.
+- Add `packageApp({browserDecisions: true})` to acquire the upstream browser
+  decision distribution inside the package stage beside the actual selected
+  SDK module, including installed aliases and relocated routes. Both module
+  formats retain complete executables and licenses; default and dry-run
+  behavior stay unchanged. Existing workspace materialization remains supported.
+- Reuse the retained Windows host, Whisper and ONNX runtime archives; this
+  release changes shared JavaScript acquisition and packaging, not those native
+  binaries. Application adoption and native model acceptance remain separately
+  owned.
+
+## 0.90.0
+
+- Add optional `remoteBase` to repository workspaces, Git text snapshots and
+  explicit pull/push targets. Applications can declare a remote as a local
+  filesystem locator and capture its native absolute Git argument before
+  asynchronous work or queueing, independently of later directory changes.
+- Preserve original remote, ref and base text in public outcomes. Omission
+  retains ordinary Git remote names, URLs, SCP-like addresses and remote-helper
+  strings without guessed parsing; existing identity, cancellation, complete
+  diagnostics and configured-operation behavior remain unchanged.
+- Reuse the retained compatible Windows host, Whisper and ONNX runtime assets
+  on this numeric release. No native implementation change is included.
+
 ## 0.89.0
 
 - Add explicitly selected clone-local author name/email before the first

package/README.md

@@ -25,7 +25,7 @@ selected SDK projection or an explicit live SDK source mount. Both profiles
 share the theme, packaging, event, cancellation,
 and browser run contracts while retaining their selected application layout.
 
-This checkout defines the `0.88.1` SDK contract. Development applications declare
+This checkout defines the `0.91.0` SDK contract. Development applications declare
 `arcane-os` as `latest` and retain their lockfile. Exact SDK pins begin when Roshi
 designates a production build. Follow [Consumer updates](docs/consumer-updates.md)
 to refresh and compare the installed SDK and lockfile with the published channel;

package/docs/reference/ai/browser-decisions.md

@@ -95,14 +95,18 @@ pipeline. Existing Wllama, cloud, speech and chat APIs are unchanged.
 
 ## Extension-local executables (Manifest V3)
 
-During the application's ordinary SDK materialization, opt into the upstream
-browser distribution through the public Node API:
+When packaging the application, opt into the upstream browser distribution
+through the public Node API:
 
 ```js
-import {materializeInstalledSdkRuntime} from 'arcane-os';
+import {packageApp} from 'arcane-os';
 
-await materializeInstalledSdkRuntime({
+const release = await packageApp({
     workspaceRoot: process.cwd(),
+    appId: 'moon-dashboard',
+    outputDirectory: 'dist/extension/app',
+    moduleFormat: 'native',
+    browserPwa: false,
     browserDecisions: true
 });
 ```
@@ -111,30 +115,50 @@ This acquires the official bundled Transformers.js `4.3.0`
 `transformers.min.js`, matching ONNX Runtime
 `1.31.0-dev.20260914-8d85527a0` `ort-wasm-simd-threaded.asyncify.mjs` and
 `ort-wasm-simd-threaded.asyncify.wasm`, plus `TRANSFORMERS-LICENSE` and
-`ONNX-RUNTIME-LICENSE`. The five complete files are staged under
-`arcane/sdk/ai/decisions-runtime/` before replacing the projected runtime.
-Retain the supplied licenses with the distribution. No bundler, Node engine
-dependency tree, model graph or tokenizer is installed by this option.
-Repeat `browserDecisions: true` on each materialization that should retain
-this closure; whole-tree replacement removes files absent from a later selection.
-
-The result's `workspaceRuntime.browserDecisions` contains `directory`,
-`transformersVersion`, `onnxRuntimeVersion` and `files`. The lower-level
+`ONNX-RUNTIME-LICENSE`. The five complete files are acquired only into the
+package stage, under `decisions-runtime/` beside the selected SDK
+`ai/browser-decisions.mjs`. Installed-package routes retain their actual
+dependency path, including npm aliases: for example,
+`node_modules/arcane-os/browser-runtime/ai/decisions-runtime/` inside
+`release.outputRoot`. The installed dependency and application source remain
+unchanged; this route creates no workspace-root `arcane/` projection.
+
+Acquisition follows SDK module/asset rewriting, preserving complete upstream
+executable content and licenses unchanged. It works with both
+`moduleFormat: 'native'` and the default `'import-map'`. The returned `files`
+and release manifest include the distribution; when browser PWA generation
+is enabled, its ordinary offline include/exclude selection applies too.
+Retain the supplied licenses with the deployment. No bundler, Node engine
+dependency tree, model graph or tokenizer is installed by this option. Select
+`browserDecisions: true` on each package build that should acquire the closure.
+The default `false` and `dryRun: true` perform no optional acquisition; dry runs
+report selected input files rather than downloaded distribution files.
+
+Existing physical workspace projections retain
+`materializeInstalledSdkRuntime({workspaceRoot, browserDecisions: true})`.
+That operation stages these files under `arcane/sdk/ai/decisions-runtime/`
+before replacing the projection, returning `directory`, `transformersVersion`,
+`onnxRuntimeVersion` and `files` under `workspaceRuntime.browserDecisions`.
 `materializeWorkspaceRuntimeContent()` accepts the same option and returns
-that record directly as `result.browserDecisions`. Omission performs no
-optional network acquisition. The fixed distribution files are acquired
-concurrently, once each per selected materialization. Events
+that record as `result.browserDecisions`. Repeat the option on each projection
+refresh that should retain the closure. Installed-package applications use
+`packageApp()` above, because their routes read from the installed dependency
+rather than this separate projection.
+
+Both operations share one distribution owner. Its fixed files are acquired
+concurrently, once each per operation. Events
 `workspace.decisions.started` and `workspace.decisions.progress` expose
 `completed`/`total` file counts; each progress event also has `file` and `url`.
 Cancellation and HTTP or observer failure abort/join pending acquisition and
-preserve the prior runtime. An HTTP failure retains the complete response as
+preserve the prior package output or physical runtime. An HTTP failure retains
+the complete response as
 `error.response` (`url`, `status`, `statusText`, `headers`, `content`), including
 inside `AggregateError.errors` when several operations fail.
 
 Load from an extension-owned module script, using the deployed SDK path:
 
 ```js
-import {createBrowserDecisionModel} from './arcane/sdk/ai/browser-decisions.mjs';
+import {createBrowserDecisionModel} from './node_modules/arcane-os/browser-runtime/ai/browser-decisions.mjs';
 
 const decisions = createBrowserDecisionModel({
     family: 'laya',
@@ -147,6 +171,9 @@ const decisions = createBrowserDecisionModel({
 await decisions.load();
 ```
 
+Use the actual deployed alias path when the dependency has another name;
+physical projections instead use `./arcane/sdk/ai/browser-decisions.mjs`.
+
 For Julia-1, change the family/model to `julia` /
 `SupersonicLabs/Julia-1-ONNX` and select `dtype: 'fp32'`. Model and tokenizer
 data remain upstream resources served through the same store, preserving its

package/docs/reference/core-native-packaging.md

@@ -401,6 +401,11 @@ or service. Availability of a particular engine belongs to the selected
 local-AI installer and service; a generic ONNX runtime is not a speech model.
 
 Selected `onnx` bundles its complete managed `onnxruntime-node` dependency tree.
+For the SDK-selected Windows x64 ONNX `1.30.0` distribution, that tree includes
+the corrected native libraries and its runtime record retains
+`nativeDistributionRevision: '1.30.0-directml-reshape-1'`. See
+[ONNX runtime preparation](local-ai.md#development) for selection,
+release-asset acquisition and existing-installation behavior.
 Its `modulePath` resolves against the artifact root just as a server runtime's
 `executable` does. Library/module records need no executable. The generated Core
 service exposes retained worker sessions through `onnx.load/run/unload/status`;

package/docs/reference/core-repositories.md

@@ -47,7 +47,7 @@ const status = await repository.status({signal});
 await repository.close();
 ```
 
-`createRepositoryWorkspace({name,directory,dataRoot,remote,branch,longPaths,cloneIdentity,gitIdentity,onEvent,run}={})`
+`createRepositoryWorkspace({name,directory,dataRoot,remote,remoteBase,branch,longPaths,cloneIdentity,gitIdentity,onEvent,run}={})`
 returns `{directory,open,status,configuration,pull,push,write,close,drain,dispose}`. The `directory`
 property is the absolute selected working path.
 
@@ -63,6 +63,10 @@ property is the absolute selected working path.
   `branch`, when supplied, is passed unchanged to Git's `clone --branch` option;
   otherwise Git selects the remote's default branch. Existing checkouts keep
   their own branch, remote, tracked files, untracked files and local changes.
+- Supplying `remoteBase` explicitly declares this initial-clone `remote` to be
+  a local filesystem locator. Its native absolute command argument is captured
+  during construction. Omission leaves Git's original string interpretation
+  unchanged. See [relative local repository locators](#relative-local-repository-locators).
 - Optional `longPaths` is a boolean for newly cloned Windows checkouts. Explicit
   `true` or `false` supplies `clone --config core.longpaths=<value>`, so Git
   writes that choice to the new repository before its first checkout. Omission
@@ -173,13 +177,13 @@ commands for an attached local branch, or three otherwise. Results are not a
 transaction with later work or external Git activity. The app owns any decision
 that the current checkout corresponds to its selected repository and branch.
 
-The optional `target:{remote,ref}` on `pull`, `push` and `write` selects that
-operation's Git destination. Both fields are nonempty strings representable by
+The optional `target:{remote,ref,remoteBase?}` on `pull`, `push` and `write` selects
+that operation's Git destination. `remote` and `ref` are nonempty strings representable by
 the native process transport. The SDK captures their exact strings when the
 call is accepted; later edits to the target object or UI selection cannot
 redirect queued or active work. Git owns ref parsing, URL interpretation,
 credentials, hooks and remote outcomes. This target is independent of the
-factory's `remote`/`branch`, which remain initial-clone inputs only.
+factory's `remote`/`remoteBase`/`branch`, which remain initial-clone inputs only.
 
 ```javascript
 const observed = await repository.configuration({signal});
@@ -208,6 +212,54 @@ observe, refresh, write and publish. See Git's [pull](https://git-scm.com/docs/g
 [push](https://git-scm.com/docs/git-push) and [configuration](https://git-scm.com/docs/git-config)
 contracts.
 
+### Relative local repository locators
+
+`remoteBase` is an explicit local-path choice, not a hint for a URL parser.
+With it, the SDK derives the Git remote argument using the host's native
+`path.resolve(remoteBase, remote)`. A relative base, including `''` for the
+current directory, is resolved once when a workspace/snapshot owner is
+constructed or a targeted operation is accepted. Later working-directory or
+options-object changes cannot redirect that accepted operation. Base text
+must be representable as a native filesystem path; invalid non-string, NUL or
+unpaired-surrogate input reports `TypeError` without changing the supplied text.
+
+Use the same selected absolute base for owners created at different times:
+
+```javascript
+import {createGitTextSnapshot} from 'arcane-os';
+import {createRepositoryWorkspace} from 'arcane-os/core/repositories';
+
+const remote = connection.locator; // Keep the original catalog string.
+const remoteBase = connection.localBaseDirectory; // App-selected absolute base.
+const repository = createRepositoryWorkspace({name: connection.name, remote, remoteBase});
+const snapshot = createGitTextSnapshot({
+    cacheDirectory: connection.cacheDirectory,
+    remote, remoteBase, ref: connection.ref, selectPath: applicationSelectPath
+});
+const target = {remote, remoteBase, ref: connection.ref};
+await repository.write({files: selectedFiles, message, target, signal});
+// This reader wants the newly published selection, so refresh after the write.
+await snapshot.refresh({signal});
+```
+
+The original locator and ref remain unchanged. Public targeted results and
+writer failure outcomes also retain the explicitly supplied original
+`remoteBase`, including its relative spelling or empty string; the derived
+absolute argument stays with the Git invocation. No catalog/configuration
+rewrite, directory change or extra Git command is introduced. The existing
+Git clone may save its supplied remote argument as its ordinary origin setting.
+
+Omit `remoteBase` for configured names such as `origin`, URLs, SCP-like addresses,
+remote-helper syntax, or any other string Git should interpret normally. With
+an explicit base, even `origin` means the local path under that base. The SDK
+does not infer intent from slashes, colons or platform path spelling. Factory
+`remoteBase` affects only cloning; an individual pull/push/write uses only its
+own `target.remoteBase`. Omitting `target` retains configured Git behavior.
+The public `repositoryPull` and `repositoryPush` functions accept the same
+target field and capture it before their first asynchronous status operation.
+Actual filesystem, Git, credential and remote failures retain their existing
+complete diagnostics; this option adds no fallback, retry or unborn-state rule.
+
 ## Git identity configuration
 
 ```javascript
@@ -438,8 +490,8 @@ Successful completion returns:
 
 Each output record retains complete stdout/stderr. `code` and the process
 termination `signal` are included when a completed process result is available.
-When supplied, `target:{remote,ref}` is included in the result or failure outcome
-with the original accepted strings.
+When supplied, `target:{remote,ref,remoteBase?}` is included in the result or
+failure outcome with the original accepted strings.
 An in-progress write also records its current `path` on a failure outcome.
 `writtenPaths` records successful filesystem writes in input order; `written`
 becomes true only after every requested write succeeds. The other booleans

package/docs/reference/git-text-snapshot.md

@@ -33,12 +33,27 @@ policy stable for the lifetime of its snapshot owner.
 
 ## API and lifecycle
 
-`createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,gitIdentity,onEvent,run})`
+`createGitTextSnapshot({cacheDirectory,remote,remoteBase,ref,selectPath,gitIdentity,onEvent,run})`
 returns `{refresh,close,drain,dispose}`. `run` defaults to the SDK's existing
 `runProcess`; applications normally omit it. It is the same process adapter
 contract, not a second process supervisor. `onEvent` is the ordinary SDK event
 callback and follows its asynchronous completion/error contract.
 
+Optional `remoteBase` explicitly selects `remote` as a local filesystem locator.
+The owner derives its native absolute Git argument once during construction
+using `path.resolve(remoteBase, remote)`, independently of the cache location
+and later working-directory changes. A relative base is captured against the
+construction-time working directory; `''` explicitly selects that directory.
+The caller's original locator and options remain unchanged. Without this field,
+every existing Git remote string keeps its ordinary meaning; the SDK does not
+guess whether a name, URL, colon or slash describes a local path.
+
+Use the same app-selected absolute base for snapshot, workspace clone and each
+explicit pull/push/write target. Factory clone inputs do not become operation
+targets. See [relative local repository locators](core-repositories.md#relative-local-repository-locators)
+for the shared contract, original target outcomes and example. This option adds
+no I/O, remote probe, configuration change, retry or empty-remote success path.
+
 Optional `gitIdentity:{name?,email?,username?}` uses the shared
 [Git identity configuration contract](core-repositories.md#git-identity-configuration).
 Supplied strings are captured during construction and accompany every Git

package/docs/reference/inventory/package-api.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "sdkVersion": "0.88.1",
+  "sdkVersion": "0.90.0",
   "environment": {
     "runtime": "Node.js for Node entrypoints; browser for browser-only entrypoints",
     "minimumVersion": "22.23.2 for Node entrypoints",
@@ -311,14 +311,14 @@
       "name": "createRepositoryWorkspace",
       "displayName": "createRepositoryWorkspace()",
       "kind": "function",
-      "signature": "createRepositoryWorkspace({name,directory,dataRoot,remote,branch,longPaths,cloneIdentity,gitIdentity,onEvent,run=runProcess}={})",
+      "signature": "createRepositoryWorkspace({name,directory,dataRoot,remote,remoteBase,branch,longPaths,cloneIdentity,gitIdentity,onEvent,run=runProcess}={})",
       "entrypoints": ["arcane-os/core/repositories"],
       "primaryImport": "arcane-os/core/repositories",
       "group": "Native repository workspaces",
       "summary": "Owns one selected native working checkout with ArcaneData/Repos defaults and existing Git/process lifecycle.",
       "availability": "Node with Git on Windows, Linux and macOS; Android requires host process adaptation",
       "protocol": "Git working repository and SDK process adapter",
-      "normalization": "Returns directory, open, status, configuration, pull, push, write and identical close/drain/dispose hooks. Only missing or empty destinations clone; existing roots are preserved. Optional longPaths captures a boolean: explicit Windows true/false supplies clone-local core.longpaths before the first checkout, persisting only in the new repository under ordinary Git configuration precedence. Omission preserves configuration; existing repositories and non-Windows clone commands remain unchanged. No global setting or migration. configuration observes the existing root, symbolic HEAD, origin URL/pushURL arrays and branch remote/merge/upstream URL arrays without clone/init/fetch, preserving unset, empty and repeated values. Explicit paths remain selected. Same-directory operations serialize within the process; cancellation and shutdown join accepted process work. pull/push/write accept a captured target {remote,ref} for current-branch fast-forward pull or non-force current-HEAD selected-ref push; omission retains ordinary configured behavior. write snapshots exact text and paths, stages/commits only literal owned paths and preserves unrelated staged files and Git filters. Complete outputs and causal failures retain confirmed local/committed/pushed and uncertain outcomes plus the supplied target. Optional gitIdentity captures name/email/username for child Git operations only; omitted fields remain inherited and identity selection writes no config file. Optional cloneIdentity captures exact name/email strings and persists only supplied fields through clone --config before the first checkout on every supported platform. Empty strings are explicit; omitted or undefined fields preserve inherited/template configuration. Existing checkouts are never reconfigured. Unrepresentable process arguments fail honestly without transforming them. This option changes no global configuration or credentials and does not identify an authenticated account; command-local gitIdentity remains independent."
+      "normalization": "Returns directory, open, status, configuration, pull, push, write and identical close/drain/dispose hooks. Only missing or empty destinations clone; existing roots are preserved. Optional factory remoteBase explicitly selects the initial-clone remote as a local filesystem locator and captures path.resolve(remoteBase, remote) once at construction. A relative base, including an empty string, uses the construction-time working directory. Only the Git argument is derived; the caller's original locator remains unchanged. Omission preserves every Git remote name, URL, SCP-like address and remote-helper string without guessed parsing. Optional longPaths captures a boolean: explicit Windows true/false supplies clone-local core.longpaths before the first checkout, persisting only in the new repository under ordinary Git configuration precedence. Omission preserves configuration; existing repositories and non-Windows clone commands remain unchanged. No global setting or migration. configuration observes the existing root, symbolic HEAD, origin URL/pushURL arrays and branch remote/merge/upstream URL arrays without clone/init/fetch, preserving unset, empty and repeated values. Explicit paths remain selected. Same-directory operations serialize within the process; cancellation and shutdown join accepted process work. pull/push/write accept a captured target {remote,ref,remoteBase?} for current-branch fast-forward pull or non-force current-HEAD selected-ref push; omission retains ordinary configured behavior. An operation's own remoteBase declares local-path intent and captures its native absolute argument once at acceptance, before queueing; factory remote/remoteBase/branch remain independent clone inputs. Targeted pull/push results and writer results/failure outcomes retain the original remote, ref and supplied remoteBase, including relative or empty base text. Unrepresentable base text reports TypeError without transformation. write snapshots exact text and paths, stages/commits only literal owned paths and preserves unrelated staged files and Git filters. Complete outputs and causal failures retain confirmed local/committed/pushed and uncertain outcomes plus the supplied target. Optional gitIdentity captures name/email/username for child Git operations only; omitted fields remain inherited and identity selection writes no config file. Optional cloneIdentity captures exact name/email strings and persists only supplied fields through clone --config before the first checkout on every supported platform. Empty strings are explicit; omitted or undefined fields preserve inherited/template configuration. Existing checkouts are never reconfigured. Unrepresentable process arguments fail honestly without transforming them. This option changes no global configuration or credentials and does not identify an authenticated account; command-local gitIdentity remains independent."
     },
     {
       "id": "core-repositories:readGitIdentity",
@@ -441,10 +441,10 @@
       "entrypoints": ["arcane-os/core/model-assets"],
       "primaryImport": "arcane-os/core/model-assets",
       "group": "Core model assets",
-      "summary": "Owns selected native working-file projections and engine retain handles while original stored model files remain unchanged.",
+      "summary": "Owns persistent native model acquisitions, temporary browser projections and actual engine retain lifetimes.",
       "availability": "Node Core with an application-selected working directory",
       "protocol": "arcane/1 modelAssets.open/write/complete/release/status and modelAssets.state",
-      "normalization": "Returns current/prepare/retain/release/dispose and Core service lifecycle. Explicit prepare({id,workingDirectory,members:[{path,url}],signal,onProgress}) streams complete upstream members through the existing file owner and reports file/phase progress. release(id) relinquishes preparation ownership; cancellation and cleanup join fetches/writes. Native retains survive until actual engine release before deleting only the owned working projection. Startup downloads nothing."
+      "normalization": "Returns current/prepare/retain/release/dispose and Core service lifecycle. Explicit prepare({id,workingDirectory,members:[{path,url}],signal,onProgress,refresh=false}) reuses complete exact ordered source selections stored beneath workingDirectory/model-assets or streams every selected upstream member concurrently. Complete acquisitions survive release, disposal and restart. refresh:true acquires a separate complete set without overwriting retained originals; ordinary reuse makes no network freshness claim. Matching same-process callers share acquisition with independent callbacks/cancellation, and the final interested cancellation joins unfinished I/O before removing only that attempt. Separate processes may fetch independently. release(id) relinquishes live preparation ownership; actual native retain lifetimes remain. Browser open/write/complete projections retain temporary cleanup after final native use. Startup downloads nothing; no migration, eviction or partial-transfer resumption."
     },
     {
       "id": "core-model-assets-service:default",
@@ -493,14 +493,14 @@
       "name": "createGitTextSnapshot",
       "displayName": "createGitTextSnapshot()",
       "kind": "function",
-      "signature": "createGitTextSnapshot({cacheDirectory,remote,ref,selectPath,gitIdentity,onEvent,run=runProcess}={})",
+      "signature": "createGitTextSnapshot({cacheDirectory,remote,remoteBase,ref,selectPath,gitIdentity,onEvent,run=runProcess}={})",
       "entrypoints": ["arcane-os"],
       "primaryImport": "arcane-os",
       "group": "Workspace, doctor, repository, and server",
       "summary": "Reads complete selected text from one fetched revision using a dedicated bare Git object cache and batched retrieval.",
       "availability": "Node with Git; Android requires a host supplying Git/process capability",
       "protocol": "Git tree and batched blob transport through the shared process owner",
-      "normalization": "Returns {refresh,close,drain,dispose}; refresh yields {revision,files:[{path,content}]}, shares concurrent work, reuses unchanged revisions, preserves exact UTF-8 text, isolates caller cancellation and drains accepted work. Optional gitIdentity captures name/email/username for child Git commands including bare init and fetch, without changing config files, payloads or shared acquisition lifetime. See git-text-snapshot.md."
+      "normalization": "Returns {refresh,close,drain,dispose}; refresh yields {revision,files:[{path,content}]}, shares concurrent work, reuses unchanged revisions, preserves exact UTF-8 text, isolates caller cancellation and drains accepted work. Optional remoteBase explicitly selects remote as a local filesystem locator and derives only its Git fetch argument through path.resolve(remoteBase, remote), once at construction independently of the cache location and later working-directory changes. A relative base, including an empty string, uses the construction-time working directory; original locator/options remain unchanged. Omission preserves every Git remote name, URL, SCP-like address and remote-helper string without guessed parsing. Unrepresentable base text reports TypeError without transformation; existing Git failures remain errors. Optional gitIdentity captures name/email/username for child Git commands including bare init and fetch, without changing config files, payloads or shared acquisition lifetime. See git-text-snapshot.md."
     },
     {
       "id": "diarization:createDiarization",
@@ -609,10 +609,10 @@
       "entrypoints": ["arcane-os/local-ai"],
       "primaryImport": "arcane-os/local-ai",
       "group": "Core local AI",
-      "summary": "Reuses selected managed native runtimes or installs complete official llama.cpp/Ollama/image distributions, ONNX npm runtime trees or NeMo libraries.",
-      "availability": "Node; upstream platform and architecture assets determine runtime availability",
-      "protocol": "Official upstream release archives and selected ONNX/Koffi npm runtime installations",
-      "normalization": "Returns absolute runtime records, including image library/binding/variant/model metadata; shares matching installs, preserves libraries, reports failures without changing global PATH or services and prepares no model files"
+      "summary": "Reuses selected managed native runtimes or installs complete llama.cpp/Ollama/image distributions, ONNX npm runtime trees with selected SDK native libraries, or NeMo libraries.",
+      "availability": "Node; selected distribution platform and architecture assets determine runtime availability",
+      "protocol": "Upstream release archives and selected ONNX/Koffi npm installations; corrected Windows x64 ONNX native libraries from the installed SDK numeric release",
+      "normalization": "Returns absolute runtime records, including image library/binding/variant/model metadata; Windows x64 ONNX with no explicit URL and omitted version or 1.30.0 adds nativeDistributionRevision 1.30.0-directml-reshape-1, reuses that revision or prepares a fresh installation while preserving older trees; explicit URLs and other ONNX versions/platforms retain their upstream package path; shares matching installs, preserves libraries, reports failures without changing global PATH or services and prepares no model files"
     },
     {
       "id": "local-ai:bundleLocalAIRuntimes",
@@ -624,9 +624,9 @@
       "primaryImport": "arcane-os/local-ai",
       "group": "Core local AI",
       "summary": "Copies selected complete runtime distributions into a fresh native artifact staging root.",
-      "availability": "Node; supports bundling published upstream platform assets independently of the build host",
+      "availability": "Node; supports bundling selected published platform assets independently of the build host",
       "protocol": "Artifact-relative runtime/local-ai layout",
-      "normalization": "Returns {runtimes,files} with artifact-relative runtime/variant paths and complete inventory; image URL descriptors remain for post-launch preparation and external model working paths report portability incompatibility"
+      "normalization": "Returns {runtimes,files} with artifact-relative runtime/variant paths and complete inventory; corrected Windows x64 ONNX retains nativeDistributionRevision and complete native libraries while modulePath becomes artifact-relative; image URL descriptors remain for post-launch preparation and external model working paths report portability incompatibility"
     },
     {
       "id": "root:WS",
@@ -654,7 +654,7 @@
       "summary": "Explicit-load Laya and Julia-1 decisions with caller-selected precision, complete inputs and graph results.",
       "availability": "Browser module Workers and the selected Transformers.js backend; import/construction starts no model load",
       "protocol": "Caller-owned state/question/options rows; five-input decision graph; native Worker request/result lifecycle",
-      "normalization": "Full field tokenization, raw logits and unrounded softmax; dtype defaults to fp16 for Laya and fp32 for Julia, with explicit values forwarded unchanged. Optional existing SDK store routes actual loader resources through fetchResource outside cloned Worker configuration. By default stored activation also materializes the unchanged runtime entry as a JavaScript object URL, retains its configured URL for later loads and revokes the object URL after Worker termination. Explicit runtime.local:true instead imports same-deployment moduleUrl and wasmPaths.mjs/wasm directly, defaulting to ai/decisions-runtime installed by browserDecisions:true materialization; only those exact executable URLs bypass the model store. It disables upstream executable WASM caching/proxy and selects one WASM thread, preserving the requested inference backend. Stored mode disables competing model caches, preserves complete HTTP responses and joins resource cleanup before outstanding calls settle. Default runtime-entry HTTP failures retain error.response; custom stored entries must support an object URL and changed import.meta.url. Omission retains existing browser behavior; no decision-result persistence or precision fallback"
+      "normalization": "Full field tokenization, raw logits and unrounded softmax; dtype defaults to fp16 for Laya and fp32 for Julia, with explicit values forwarded unchanged. Optional existing SDK store routes actual loader resources through fetchResource outside cloned Worker configuration. By default stored activation also materializes the unchanged runtime entry as a JavaScript object URL, retains its configured URL for later loads and revokes the object URL after Worker termination. Explicit runtime.local:true instead imports same-deployment moduleUrl and wasmPaths.mjs/wasm directly, defaulting to adjacent ai/decisions-runtime acquired by packageApp({browserDecisions:true}) for installed-package routes or by the existing physical materializer option; only those exact executable URLs bypass the model store. It disables upstream executable WASM caching/proxy and selects one WASM thread, preserving the requested inference backend. Stored mode disables competing model caches, preserves complete HTTP responses and joins resource cleanup before outstanding calls settle. Default runtime-entry HTTP failures retain error.response; custom stored entries must support an object URL and changed import.meta.url. Omission retains existing browser behavior; no decision-result persistence or precision fallback"
     },
     {
       "id": "root:acceptWebSocket",
@@ -1858,7 +1858,7 @@
       "summary": "Builds one complete app release with browser selection by default. Nonbrowser targets add explicit nativeResources through a late complete-content copy and separate native input output; moduleFormat is independent. Adapters receive actual target and effective browserPwa. Explicit operation outputDirectory wins; staged replacement preserves source and unrelated outputs. No tests or checks run automatically.",
       "availability": "Node",
       "protocol": "SDK packager and deterministic bundle contract",
-      "normalization": "Normalized SDK validation with complete canonical archive and release content"
+      "normalization": "Complete selected release content. Optional browserDecisions:true acquires bundled Transformers.js 4.3.0 and matched ONNX Runtime 1.31.0-dev.20260914-8d85527a0 asyncify module/WASM plus licenses beside the selected SDK browser-decisions module in staging only, following installed routes and aliases. Acquisition follows native-module and asset rewriting, preserves complete upstream content, and joins the final release inventory and enabled PWA offline selection. Default false and dryRun perform no optional acquisition. Existing workspace.decisions started/progress events, cancellation, full HTTP errors and joined failure cleanup are preserved; prior output, source and installed dependencies remain unchanged on acquisition failure. Repeat the option per selected package build."
     },
     {
       "id": "root:packageApplication",
@@ -2269,7 +2269,7 @@
       "summary": "Runs one fast-forward-only pull into the selected clean worktree, optionally from a captured remote/ref target.",
       "availability": "Node; network-assisted Git",
       "protocol": "Node ESM",
-      "normalization": "SDK-normalized inputs, errors, events, and documented result"
+      "normalization": "Optional target {remote,ref,remoteBase?} is captured before the first asynchronous status operation. A supplied remoteBase declares local-path intent and derives only the Git remote argument using path.resolve(remoteBase, remote), once at acceptance; relative and empty bases use that working directory. Omitted remoteBase preserves Git remote names, URLs, SCP-like addresses and remote-helper strings unchanged. Targeted results retain original remote/ref/supplied remoteBase text and complete stdout/stderr alongside the existing pull result. Unrepresentable base text reports TypeError without transformation. Omitted target preserves configured pull behavior and result shape; clean-worktree, fast-forward-only, cancellation and actual Git error behavior remain unchanged."
     },
     {
       "id": "root:repositoryPush",
@@ -2285,7 +2285,7 @@
       "summary": "Pushes the attached branch through ordinary configured Git or an explicit captured current-HEAD destination without force.",
       "availability": "Node; network-assisted Git",
       "protocol": "Node ESM",
-      "normalization": "SDK-normalized inputs, errors, events, and documented result"
+      "normalization": "Optional target {remote,ref,remoteBase?} is captured before the first asynchronous status operation. A supplied remoteBase declares local-path intent and derives only the Git remote argument using path.resolve(remoteBase, remote), once at acceptance; relative and empty bases use that working directory. Omitted remoteBase preserves Git remote names, URLs, SCP-like addresses and remote-helper strings unchanged. Targeted results retain original remote/ref/supplied remoteBase text and complete stdout/stderr alongside the existing push result. Unrepresentable base text reports TypeError without transformation. Omitted target preserves configured push behavior and result shape; attached-branch, non-force current-HEAD publication, cancellation and actual Git error behavior remain unchanged."
     },
     {
       "id": "root:repositoryStatus",

package/docs/reference/local-ai.md

@@ -138,10 +138,23 @@ Zstandard archives use the supported Node runtime's decompressor.
 
 Selected ONNX preparation installs `onnxruntime-node@1.30.0` by default into a
 managed npm prefix, retaining its complete published runtime dependency tree.
-It uses the upstream CPU installation option to skip supplementary GPU downloads.
+The npm installation skips supplementary upstream GPU downloads. On Windows
+x64, an omitted version or explicit `1.30.0`, with no explicit `url`, also
+selects the SDK's corrected native distribution, revision
+`1.30.0-directml-reshape-1`. The installer downloads
+`arcane-onnx-runtime-windows-x64.tar.gz` from the installed `arcane-os` package's
+numeric GitHub release and extracts its native libraries into the new
+installation. Its URL is
+`https://github.com/TheWizardNexus/arcane-os-sdk/releases/download/<sdk-version>/arcane-onnx-runtime-windows-x64.tar.gz`.
+The same-version npm JavaScript and binding remain in place. Explicit URLs,
+other ONNX versions and other platform/architecture selections retain their
+upstream package path. For the corrected selection, an existing installation
+without the matching `nativeDistributionRevision` is left intact and a fresh
+installation is prepared; running installations keep their original trees.
 Node/npm must be available while preparing that runtime; a native app consumes
 the bundled tree without installing it again. Applications that omit ONNX do
-not install its package.
+not install its package. Runtime preparation alone establishes no model or
+device execution result.
 
 For the optional development browser connection, load the bootstrap after the
 managed import map and before creating a Core-backed provider:
@@ -722,7 +735,7 @@ not execution evidence on each platform.
 
 ## Native bundling
 
-The SDK portable native build includes selected official runtime trees under
+The SDK portable native build includes complete selected runtime trees under
 `runtime/local-ai/<runtime-id>`. Runtime records in the artifact are relative
 to the artifact root and resolve on the destination machine. The generated
 Core entry composes the local AI service only when the application selects it.
@@ -732,13 +745,16 @@ Model files remain application-selected native resources.
 `arcane-os/local-ai`. Both accept `{runtimes,directory,platform,architecture,
 signal,onEvent}`; bundling also requires `outputRoot`. Platform names follow
 Node: `win32`, `linux`, `darwin`, and supported Android distributions.
-Architectures are `x64` or `arm64`. Availability depends on the upstream
-runtime's published platform assets; Ollama has no official Android runtime
+Architectures are `x64` or `arm64`. Availability depends on the selected
+distribution's published platform assets; Ollama has no official Android runtime
 archive in this installer.
 
 Ensure returns absolute `{id,version,platform,architecture,root}` records.
 Server runtimes also include `executable`; ONNX includes `modulePath` pointing
-to its public package entry. Image records include `libraryPath`,
+to its public package entry. The corrected Windows x64 ONNX selection also
+includes `nativeDistributionRevision: '1.30.0-directml-reshape-1'`; bundling
+retains that metadata with the complete native libraries. Image records include
+`libraryPath`,
 `bindingModulePath`, requested `backend`, installed `variants` and selected
 `models` metadata. Variant records carry backend, runtime root and library path.
 Bundle returns `{runtimes,files}`,

package/docs/reference/model-assets.md

@@ -1,4 +1,4 @@
-# Native working files from model assets
+# Native model acquisitions and working projections
 
 Browser preparation and native retain/release ownership were first published in `arcane-os@0.61.0`. Browser
 preparation is exported by `arcane-os/ai/core-model-assets`, and the native
@@ -110,29 +110,65 @@ try {
 }
 ```
 
-`prepare({id,workingDirectory,members,signal,onProgress})` performs standard
-fetches only when explicitly called. Every member has its original relative
-`path` and selected `url`; the caller supplies the complete companion-file set.
-Independent members download concurrently. Each complete response stream is
-written directly through the existing ordered native file owner, without a
-whole-model buffer or base64 conversion. No model or runtime is selected or
-downloaded by service startup. The result is the ready projection snapshot with
-ordered `members: [{path,nativePath}]`.
+`prepare({id,workingDirectory,members,signal,onProgress,refresh=false})` reuses
+a complete native acquisition or fetches the explicitly selected members.
+Every member has its original relative `path` and selected `url`; the caller
+supplies the complete companion-file set. Independent members download
+concurrently. Each complete response stream is written directly to its native
+file, without a whole-model buffer or base64 conversion. No model or runtime
+is selected or downloaded by service startup. The result remains the ready
+projection snapshot with ordered `members: [{path,nativePath}]`.
 
-Progress uses `open`, `download`, `complete` and `ready` phases, with
+Complete acquisitions persist under `workingDirectory/model-assets/` across
+release, native unload, service disposal and process restart. Relative working
+directories resolve from `appRoot`. Reuse matches the entire ordered
+`[{path,url}]` selection in that actual store; the operation `id` is a separate
+live lifetime, not the stored selection. Different URLs, relative paths, member
+order or stores select separate acquisitions. Original member names and content
+stay unchanged, and native engines use those files directly. Model, revision,
+precision and device choices remain with their existing owners.
+
+Ordinary preparation performs no network freshness check for a completed
+selection. To acquire a mutable source again, explicitly pass `refresh:true` to
+this native `prepare` method. Refresh fetches a new complete set in its own
+directory and keeps earlier complete acquisitions and retained engine uses
+untouched. Later ordinary preparations reuse the newer completed selection.
+A failed refresh leaves the earlier completed acquisition available. Refresh
+does not change the selected URLs or imply upstream revision discovery.
+
+Progress uses `open`, `download`, `complete`, `reuse` and `ready` phases, with
 `completed`, `total` and `unit:'files'`; member progress additionally includes
 `memberIndex` and `path`. Progress callbacks may return a promise, which the
-preparation observes. They must not await cleanup of the preparation currently
-calling them. Callback failures remain preparation failures. HTTP failures
+preparation observes in order. Each caller owns its callbacks; a slow or failed
+callback does not hold another caller's transfer or result. Callbacks must not
+await cleanup of the preparation currently calling them. Callback failures
+reject that caller's preparation. HTTP failures
 retain `url`, `status` and the complete response text in `response`.
 
 `release(id)` relinquishes preparation ownership without a request signal.
-For active native downloads, release or disposal aborts their fetches and joins
-the transfer tasks and native writes before deleting only their owned child
-directory. Preparation cancellation and failure follow that same cleanup path;
-the original failures and cleanup failures remain observable. A native retain
-handle continues to protect completed files through actual engine release.
-Native preparation leaves browser DBOPFS originals and unrelated files alone.
+Same-process callers sharing the actual store, complete source selection and
+refresh mode share an acquisition, including across service instances. They
+keep independent operation IDs, retain handles, cancellation and callbacks.
+Cancelling, releasing or disposing one interested caller leaves the others
+running. The final interested caller aborts the acquisition and joins its
+streams, writes and closes before removing only its unfinished attempt. Original
+failures and cleanup failures remain observable. A completed acquisition stays
+available even if a caller cancels or its callback fails after completion.
+
+The service records completion only after every selected response and file
+close finishes. That record is ordinary cache state describing the selected
+sources and completed acquisition. A missing original member requires another
+complete acquisition. Failed attempts are removed after their owned I/O drains;
+there is no partial-transfer resumption. An abruptly interrupted process can
+leave an unfinished directory, which later calls ignore without sweeping it.
+There is no automatic migration, eviction or removal of completed acquisitions.
+
+Independent processes use disjoint attempt directories and may fetch the same
+selection concurrently. They do not overwrite each other's files or coordinate
+a cross-process acquisition lock. Concurrent completions can produce multiple
+reusable sets; either complete result may be selected when their completion
+order ties. Applications may retain their existing shared Core owner without
+introducing an additional host or application-local cache copy.
 
 ```javascript
 import {createModelAssetService} from 'arcane-os/core/model-assets';
@@ -158,15 +194,18 @@ release. Multiple contexts can retain one prepared set, and repeated inference
 on a retained context reuses its files.
 
 The browser's `projection.release()` relinquishes preparation ownership. It
-does not delete files retained by a native engine. Deletion follows the final
-native release and removes only that operation's working directory. Core closes
-independent services concurrently, so the model-assets service waits for all
-native retain handles during disposal instead of assuming service order.
-Owners must release their handles after joining their actual engine lifetime.
+does not delete files retained by a native engine. For browser `open`/`write`/
+`complete` projections, deletion follows the final native release and removes
+only that operation's temporary working directory; DBOPFS originals remain
+untouched. Native `prepare` acquisitions remain stored after their final use.
+Core closes independent services concurrently, so the model-assets service
+waits for all native retain handles during disposal instead of assuming service
+order. Owners must release their handles after joining their actual engine
+lifetime.
 
 Closing a browser accessor does not by itself establish native unload.
 Explicitly release unused prepared projections. Core disposal also releases
-preparation ownership and cleans up after retained engine uses end.
+preparation ownership and ends the live records after retained engine uses end.
 
 ### Native Laya decisions