@oar-sh/oar 0.9.1 → 0.9.3

package/server/server-runtime.mjs

@@ -24,6 +24,9 @@ import {
   normalizeWorkspaceRootKey,
 } from './services/workspace-root-path-policy.mjs';
 import { stopSessionWorkerProcesses } from './services/session-worker-stop-service.mjs';
+import { pickLiveTurnRowId } from './services/live-turn-picker.mjs';
+import { buildSteerSettleFailure, steerAgentLabelForProvider } from '../shared/steer-settle-failure.mjs';
+import { sanitizeRelayQuestionContext as sanitizeRelayQuestionContextWith } from './services/relay-question-context.mjs';
 import { isRealPathWithinRoot } from './services/workspace-symlink-guard.mjs';
 import { applySchema } from './db-schema.mjs';
 import { createSessionRepository } from './repositories/session-repository.mjs';
@@ -64,20 +67,21 @@ import { createCursorDashboardUsageFetcher, readCursorIdeSessionToken } from './
 import { fetchPersonalBillingUsage } from './services/github-billing-usage.mjs';
 import { createSessionTranscriptService } from './services/session-transcript-service.mjs';
 import { createSdkSessionImportService } from './services/sdk-session-import-service.mjs';
-import { createInstalledCopilotClient } from './copilot-sdk-runtime.mjs';
+import { createCopilotModelDiscoveryService } from './services/copilot-model-discovery-service.mjs';
+import { createInstalledCopilotClient, getCopilotBaseDirs, resolveInstalledCopilotPaths } from './copilot-sdk-runtime.mjs';
 import { createSessionHistoryRefreshService } from './services/session-history-refresh-service.mjs';
 import { createContextSnapshotService } from './services/context-snapshot-service.mjs';
 import { createClaudeSessionRootResolver } from './services/claude-session-root-service.mjs';
 import { createCursorSessionRootResolver } from './services/cursor-session-root-service.mjs';
 import { createGitChangesService } from './services/git-changes-service.mjs';
 import { createRelaySingletonGuard } from './services/relay-singleton-guard.mjs';
+import { resolveDataDir } from './services/data-dir-resolution.mjs';
 import { createRelayRestartOrchestrator } from './services/relay-restart-orchestrator-service.mjs';
 import { createRelayBridgeOwnerService } from './services/relay-bridge-owner-service.mjs';
 import { createRelayCliLauncherService } from './services/relay-cli-launcher-service.mjs';
 import { createSessionWorkerRegistry } from './services/session-worker-registry-service.mjs';
 import { createSessionWorkerSupervisor } from './services/session-worker-supervisor-service.mjs';
 import { createSessionWorkerProcessInspector } from './services/session-worker-process-service.mjs';
-import { latestModelCatalogRefresh } from '../shared/model-catalog-freshness.mjs';
 import { applyClaudeProviderEnvironment, applyCopilotSdkProviderEnvironment, applyCursorProviderEnvironment, applyGrokProviderEnvironment, applyOpenAIProviderEnvironment, copilotSdkEngineUnavailableReason, killTmuxSession, launchSessionCli } from './services/session-worker-launch-service.mjs';
 import { createSshTunnelManager } from './services/ssh-tunnel-manager-service.mjs';
 import { createCloudflaredTunnelManager } from './services/cloudflared-tunnel-service.mjs';
@@ -89,6 +93,7 @@ import { createPreviewProxyServer } from './services/preview-proxy-server.mjs';
 import { createPreviewHealthProbe } from './services/preview-health-probe.mjs';
 import { createTunnelWorkerPathGuard } from './services/tunnel-worker-path-guard.mjs';
 import { createWindowsAutostartService } from './services/windows-autostart-service.mjs';
+import { createWindowsBootAutostartService } from './services/windows-boot-autostart-service.mjs';
 import { createSessionWorkerWebSocketService } from './services/session-worker-websocket-service.mjs';
 import { createTmuxInspectorAccessPolicy } from './services/tmux-inspector-access-policy.mjs';
 import { createTmuxInspectorStreamService } from './services/tmux-inspector-stream-service.mjs';
@@ -98,7 +103,13 @@ import {
   resolveLaunchWorkspaceRootPath,
 } from './services/workspace-root-defaults-service.mjs';
 import { maybeStartTtyConsole } from './tty-console-bootstrap.mjs';
-import { FEATURES, normalizeFeatureFlags } from './features.mjs';
+import {
+  computeFeatureFlagState,
+  FEATURE_REGISTRY,
+  featureSettingKey,
+  migrateLegacyConfigFeatures,
+  resolveBootFeatureFlags,
+} from './features.mjs';
 import { RELAY_RESTART_EXIT_CODE } from './relay-exit-codes.mjs';
 import { DEFAULT_QUESTION_TIMEOUT_MS, questionExpiresAt } from '../shared/question-timeout.mjs';
 import {
@@ -106,6 +117,24 @@ import {
   readTurnCeilingSetting,
   turnCeilingMinutesToMs,
 } from '../shared/turn-ceiling.mjs';
+import {
+  normalizePwaAppName,
+  readPwaAppNameSetting,
+  resolvePwaManifestNames,
+} from '../shared/pwa-app-name.mjs';
+import {
+  createUpdateCheckService,
+  isUpdateCheckKilled,
+  resolveUpdateManifestUrl,
+} from './services/update-check-service.mjs';
+import {
+  createUpdateInstallService,
+  reconcileUpdateAttempt,
+} from './services/update-install-service.mjs';
+import {
+  mergeClaudeModelEfforts,
+  mergeDiscoveredClaudeModels,
+} from '../shared/claude-model-catalog.mjs';
 import { parseAutoCompactWindow } from '../shared/auto-compact-window.mjs';
 import { parseThinkingDisplay, parseThinkingEnabled } from '../shared/claude-thinking.mjs';
 import {
@@ -116,19 +145,30 @@ import {
 import { normalizeRelayThoughtList } from './public/app/relay-thoughts.mjs';
 import { capRelayActivityEntries } from './public/app/activity-replay-state.mjs';
 import {
-  canonicalizeModelId,
-  filterValidModelIds,
   isOpenAIModelId,
   isSafeClaudeModelId,
   isSafeCursorModelId,
   isSafeGrokModelId,
   isSafeProviderModelId,
-  isValidModelId,
 } from '../shared/model-id.mjs';
-import { selectModelIdsForVariantRefresh } from '../shared/model-refresh.mjs';
+import { createModelVariantCatalogService } from './services/model-variant-catalog-service.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const REPO_ROOT = path.resolve(__dirname, '..');
+// The installed package root: set by bin/oar.js for launched relays, falling
+// back to the checkout for direct `node server/server.js` runs. Version and
+// install method feed the update mechanism and /api/status.
+const PACKAGE_ROOT = String(process.env.COPILOT_WEB_RELAY_ROOT || '').trim()
+  ? path.resolve(String(process.env.COPILOT_WEB_RELAY_ROOT).trim())
+  : REPO_ROOT;
+const RUNNING_VERSION = (() => {
+  try {
+    return String(JSON.parse(fs.readFileSync(path.join(PACKAGE_ROOT, 'package.json'), 'utf8')).version || '0.0.0');
+  } catch {
+    return '0.0.0';
+  }
+})();
+const INSTALL_METHOD = fs.existsSync(path.join(PACKAGE_ROOT, '.git')) ? 'git-checkout' : 'npm-global';
 const PUBLIC_DIR = path.join(__dirname, 'public');
 const INDEX_HTML_PATH = path.join(PUBLIC_DIR, 'index.html');
 const PWA_MANIFEST_PATH = path.join(PUBLIC_DIR, 'manifest.webmanifest');
@@ -146,9 +186,10 @@ const ttyConsoleRuntime = await maybeStartTtyConsole({
 const CONFIG_PATH    = process.env.COPILOT_WEB_RELAY_CONFIG
   ? path.resolve(String(process.env.COPILOT_WEB_RELAY_CONFIG))
   : path.join(__dirname, 'config.json');
-const DATA_DIR       = process.env.COPILOT_WEB_RELAY_DATA_DIR
-  ? path.resolve(String(process.env.COPILOT_WEB_RELAY_DATA_DIR))
-  : path.join(__dirname, 'data');
+// env var > config.json `dataDir` > <server>/data — see data-dir-resolution.mjs
+// for why the config can carry it (a dev checkout pointing at a release
+// install's data, and autostart launchers that only pin the config path).
+const DATA_DIR = resolveDataDir({ env: process.env, configPath: CONFIG_PATH, serverDir: __dirname });
 const DB_PATH        = path.join(DATA_DIR, 'copilot.db');
 const RELAY_LOCK_PATH = path.join(DATA_DIR, 'relay-server.lock');
 const UPLOAD_DIR     = process.env.COPILOT_WEB_RELAY_DATA_DIR
@@ -492,9 +533,17 @@ async function refreshClaudeProviderModels() {
       return { ok: false, models: settings.models, error: 'Claude model discovery returned no models' };
     }
     const nowIso = new Date().toISOString();
-    const models = Array.from(new Set([settings.model, ...discovered])).filter(Boolean);
+    // Merge rather than replace: supportedModels() reports only the current
+    // lineup, so replacing would drop a model mid-use the moment a successor
+    // ships (Fable 5 -> Fable 5.1). Retained ids still run via `--model`.
+    const models = mergeDiscoveredClaudeModels({
+      defaultModel: settings.model,
+      discovered,
+      previouslyKnown: readClaudeModelListSetting(CLAUDE_MODELS_SETTING_KEY),
+    });
+    const mergedEfforts = mergeClaudeModelEfforts(readClaudeModelEffortsSetting(), effortsByModel);
     stmts.upsertAppSetting.run(CLAUDE_MODELS_SETTING_KEY, JSON.stringify(models), nowIso);
-    stmts.upsertAppSetting.run(CLAUDE_MODEL_EFFORTS_SETTING_KEY, JSON.stringify(effortsByModel), nowIso);
+    stmts.upsertAppSetting.run(CLAUDE_MODEL_EFFORTS_SETTING_KEY, JSON.stringify(mergedEfforts), nowIso);
     return { ok: true, models, error: null };
   } catch (error) {
     return {
@@ -1222,7 +1271,12 @@ const DEFAULT_OPENAI_BASE_URL = 'https://api.openai.com/v1';
 // spawn, so model catalogs, usage cards and routing all stay put.
 const COPILOT_ENGINE_SETTING_KEY = 'copilot_engine';
 const COPILOT_ENGINES = ['extension', 'sdk'];
-const DEFAULT_COPILOT_ENGINE = 'extension';
+// Phase 6 of the extension retirement (2026-09-07): the headless SDK worker is
+// the default engine. The extension remains reachable two ways until deletion:
+// an explicit stored setting, or automatically when this relay cannot run the
+// SDK engine at all (no resolvable Copilot CLI, or session-worker routing off).
+const DEFAULT_COPILOT_ENGINE = 'sdk';
+const FALLBACK_COPILOT_ENGINE = 'extension';
 const CLAUDE_ENABLED_SETTING_KEY = 'claude_enabled';
 const CLAUDE_MODEL_SETTING_KEY = 'claude_model';
 const CLAUDE_MODELS_SETTING_KEY = 'claude_models';
@@ -1533,8 +1587,6 @@ const CURATED_MODEL_IDS = [
   'claude-sonnet-4.6',
   'claude-haiku-4.5',
 ];
-const SUPPORTED_REASONING_EFFORTS = ['none', 'low', 'medium', 'high', 'xhigh', 'max'];
-const REASONING_VARIANT_SUPPORTED_PREFIXES = ['gpt-', 'claude-'];
 
 let config = { ...DEFAULT_CONFIG };
 if (fs.existsSync(CONFIG_PATH)) {
@@ -1704,15 +1756,6 @@ function socketIoPath() {
 const remotePath = normalizeRemotePath(config.remotePath);
 const COOKIE_PATH = remotePath || '/';
 
-let modelCatalog = {
-  models: [DEFAULT_MODEL],
-  currentModel: DEFAULT_MODEL,
-  defaultModel: DEFAULT_MODEL,
-  source: 'bootstrap',
-  refreshedAt: null,
-  error: null,
-};
-let modelSelectorSql = null;
 
 const workspaceFileMetaCache = new Map();
 let workspaceFileWatcher = null;
@@ -1810,14 +1853,22 @@ function readAppSettingValue(key) {
 }
 
 /**
- * The Copilot engine setting, normalised. An unset or unrecognised stored value
- * reads as the default (`extension`) rather than throwing: this value picks a
- * worker kind at spawn time, and a relay that cannot decide must still be able
- * to start a conversation on the engine that has been shipping.
+ * The Copilot engine setting, normalised. An explicit stored value always
+ * wins. Unset (or unrecognised) reads as the SDK default — but only when this
+ * relay can actually run the SDK engine: the save path refuses to persist
+ * 'sdk' on a relay that cannot honour it, and the default must not sneak past
+ * that same guard. A relay with no resolvable Copilot CLI or with
+ * session-worker routing disabled falls back to the extension engine so a
+ * Copilot conversation can still start at all.
  */
 function getCopilotEngine() {
   const stored = readAppSettingValue(COPILOT_ENGINE_SETTING_KEY).toLowerCase();
-  return COPILOT_ENGINES.includes(stored) ? stored : DEFAULT_COPILOT_ENGINE;
+  if (COPILOT_ENGINES.includes(stored)) return stored;
+  const unavailable = copilotSdkEngineUnavailableReason({
+    env: sessionWorkerLaunchEnv,
+    routingEnabled: featureFlags?.SESSION_WORKER_ROUTING_ENABLED === true,
+  });
+  return unavailable ? FALLBACK_COPILOT_ENGINE : DEFAULT_COPILOT_ENGINE;
 }
 
 function getCopilotProviderSettings() {
@@ -1861,6 +1912,54 @@ function setTurnCeilingMinutes(value) {
   return { ok: true, ceilingMinutes: parsed.minutes };
 }
 
+const PWA_APP_NAME_SETTING_KEY = 'pwa_app_name';
+
+/** '' means "no custom name": the manifest falls back to the template default. */
+function getPwaAppName() {
+  return readPwaAppNameSetting(readAppSettingValue(PWA_APP_NAME_SETTING_KEY));
+}
+
+function setPwaAppName(rawValue) {
+  if (typeof stmts?.upsertAppSetting?.run !== 'function' || typeof stmts?.deleteAppSetting?.run !== 'function') {
+    // status carries the intended HTTP mapping so the route never has to key
+    // off the error text (a reworded message must not turn 500s into 400s).
+    return { ok: false, status: 500, error: 'App name settings are unavailable' };
+  }
+  const normalized = normalizePwaAppName(rawValue);
+  if (!normalized.ok) return normalized;
+  if (normalized.value) {
+    stmts.upsertAppSetting.run(PWA_APP_NAME_SETTING_KEY, normalized.value, new Date().toISOString());
+  } else {
+    stmts.deleteAppSetting.run(PWA_APP_NAME_SETTING_KEY);
+  }
+  return { ok: true, appName: normalized.value };
+}
+
+function getFeatureFlagsSettingsState() {
+  // `featureFlags` is const-declared later in boot; this only runs from request
+  // handlers, well after the snapshot exists (same shape as setCopilotProviderSettings).
+  return computeFeatureFlagState({
+    readSetting: readAppSettingValue,
+    env: process.env,
+    activeFlags: featureFlags,
+  });
+}
+
+function setFeatureFlagSetting(name, enabled) {
+  if (typeof stmts?.upsertAppSetting?.run !== 'function') {
+    return { ok: false, error: 'Feature settings are unavailable' };
+  }
+  const normalized = String(name || '').trim();
+  if (!FEATURE_REGISTRY.some((entry) => entry.name === normalized)) {
+    return { ok: false, error: 'Unknown feature flag' };
+  }
+  if (typeof enabled !== 'boolean') {
+    return { ok: false, error: 'enabled must be a boolean' };
+  }
+  stmts.upsertAppSetting.run(featureSettingKey(normalized), enabled ? '1' : '0', new Date().toISOString());
+  return { ok: true };
+}
+
 const BACKGROUND_TASK_TIMEOUT_SETTING_KEY = 'background_task_timeout_minutes';
 
 function getBackgroundTaskTimeoutMinutes() {
@@ -2164,447 +2263,30 @@ function uniqueStringList(values) {
   return out;
 }
 
-function validatedModelIdList(values) {
-  return filterValidModelIds(uniqueStringList(values));
-}
-
-function curatedModelList() {
-  return uniqueStringList(CURATED_MODEL_IDS);
-}
-
-function normalizeReasoningEffort(value) {
-  const text = String(value || '').trim().toLowerCase();
-  if (!text) return null;
-  return SUPPORTED_REASONING_EFFORTS.includes(text) ? text : null;
-}
-
-function isReasoningVariantEligibleModel(modelId) {
-  const normalized = String(modelId || '').trim().toLowerCase();
-  if (!normalized) return false;
-  return REASONING_VARIANT_SUPPORTED_PREFIXES.some((prefix) => normalized.startsWith(prefix));
-}
-
-function modelProviderForId(modelId) {
-  const text = String(modelId || '').trim().toLowerCase();
-  if (!text) return 'other';
-  if (
-    text.startsWith('gpt-')
-    || text.startsWith('o1-')
-    || text.startsWith('o3-')
-    || text.startsWith('codex-')
-    || text.startsWith('openai/')
-  ) return 'openai';
-  if (text.startsWith('claude-')) return 'anthropic';
-  if (text.startsWith('gemini-')) return 'google';
-  if (text.startsWith('mai-')) return 'microsoft';
-  return 'other';
-}
-
-function titleCaseWord(word) {
-  const text = String(word || '').trim();
-  if (!text) return '';
-  return text.charAt(0).toUpperCase() + text.slice(1);
-}
-
-function modelDisplayLabel(modelId) {
-  const text = String(modelId || '').trim();
-  if (!text) return '';
-  if (/^gpt-/i.test(text)) {
-    return text
-      .replace(/^gpt-/i, 'GPT-')
-      .replace(/-codex$/i, ' Codex')
-      .replace(/-mini$/i, ' Mini')
-      .replace(/\bmini\b/gi, 'Mini')
-      .replace(/\s+/g, ' ')
-      .trim();
-  }
-  if (/^claude-/i.test(text)) {
-    return text
-      .replace(/^claude-/i, 'Claude ')
-      .split('-')
-      .map((part) => (/^\d+(\.\d+)?$/.test(part) ? part : titleCaseWord(part)))
-      .join(' ')
-      .replace(/\s+/g, ' ')
-      .trim();
-  }
-  if (/^gemini-/i.test(text)) {
-    return text
-      .replace(/^gemini-/i, 'Gemini ')
-      .split('-')
-      .map((part) => (/^\d+(\.\d+)?$/.test(part) ? part : titleCaseWord(part)))
-      .join(' ')
-      .replace(/\s+/g, ' ')
-      .trim();
-  }
-  return text;
-}
-
-function buildModelVariantId(baseModelId, reasoningEffort = null) {
-  const base = String(baseModelId || '').trim();
-  if (!base) return '';
-  const effort = normalizeReasoningEffort(reasoningEffort);
-  if (!effort) return base;
-  return `${base}-${effort}`;
-}
-
-function parseModelVariantId(variantId = '', {
-  knownBaseModels = [],
-} = {}) {
-  const value = String(variantId || '').trim();
-  if (!value) return null;
-  const known = Array.isArray(knownBaseModels)
-    ? knownBaseModels.map((entry) => String(entry || '').trim()).filter(Boolean)
-    : [];
-  const orderedKnown = known.sort((a, b) => b.length - a.length);
-  for (const candidate of orderedKnown) {
-    if (!value.toLowerCase().startsWith(`${candidate.toLowerCase()}-`)) continue;
-    const suffix = value.slice(candidate.length + 1);
-    const effort = normalizeReasoningEffort(suffix);
-    if (effort) {
-      return {
-        variantId: buildModelVariantId(candidate, effort),
-        baseModelId: candidate,
-        reasoningEffort: effort,
-      };
-    }
-  }
-  const trailingEffortMatch = value.match(/^(.*?)-([a-z]+)$/i);
-  if (trailingEffortMatch) {
-    const effort = normalizeReasoningEffort(trailingEffortMatch[2]);
-    const maybeBase = String(trailingEffortMatch[1] || '').trim();
-    if (effort && maybeBase) {
-      return {
-        variantId: buildModelVariantId(maybeBase, effort),
-        baseModelId: maybeBase,
-        reasoningEffort: effort,
-      };
-    }
-  }
-  return {
-    variantId: value,
-    baseModelId: value,
-    reasoningEffort: null,
-  };
-}
-
-function normalizeModelVariantRow(row = {}) {
-  const rawBaseModelId = String(row?.base_model_id || row?.baseModelId || '').trim();
-  const baseModelId = canonicalizeModelId(rawBaseModelId) || rawBaseModelId;
-  const reasoningEffort = normalizeReasoningEffort(row?.reasoning_effort ?? row?.reasoningEffort);
-  const rawVariantId = String(row?.variant_id || row?.variantId || buildModelVariantId(baseModelId, reasoningEffort)).trim();
-  const parsed = parseModelVariantId(rawVariantId, { knownBaseModels: baseModelId ? [baseModelId] : [] });
-  const normalizedBaseModelId = canonicalizeModelId(parsed?.baseModelId || baseModelId) || baseModelId;
-  const normalizedReasoningEffort = normalizeReasoningEffort(parsed?.reasoningEffort || reasoningEffort);
-  const variantId = buildModelVariantId(normalizedBaseModelId, normalizedReasoningEffort);
-  const provider = String(row?.provider || row?.providerId || modelProviderForId(baseModelId)).trim() || 'other';
-  const label = String(row?.label || row?.displayName || modelDisplayLabel(normalizedBaseModelId)).trim() || normalizedBaseModelId;
-  const enabledValue = Number(row?.enabled);
-  const enabled = Number.isFinite(enabledValue) ? enabledValue === 1 : !!row?.enabled;
-  return {
-    variantId,
-    baseModelId: normalizedBaseModelId,
-    provider,
-    reasoningEffort: normalizedReasoningEffort,
-    label,
-    releaseStatus: String(row?.release_status || row?.releaseStatus || '').trim() || null,
-    contextLimitTokens: Number.isFinite(Number(row?.context_limit_tokens ?? row?.contextLimitTokens))
-      && Number(row?.context_limit_tokens ?? row?.contextLimitTokens) > 0
-      ? Math.round(Number(row?.context_limit_tokens ?? row?.contextLimitTokens))
-      : null,
-    longContextLimitTokens: Number.isFinite(Number(row?.long_context_limit_tokens ?? row?.longContextLimitTokens))
-      && Number(row?.long_context_limit_tokens ?? row?.longContextLimitTokens) > 0
-      ? Math.round(Number(row?.long_context_limit_tokens ?? row?.longContextLimitTokens))
-      : null,
-    pricing: (() => {
-      const value = row?.pricing_json ?? row?.pricing;
-      if (!value || typeof value === 'object') return value || null;
-      try { return JSON.parse(value); } catch { return null; }
-    })(),
-    enabled,
-    sortOrder: Number.isFinite(Number(row?.sort_order ?? row?.sortOrder))
-      ? Math.max(0, Math.trunc(Number(row?.sort_order ?? row?.sortOrder)))
-      : 0,
-    updatedAt: row?.updated_at || row?.updatedAt || null,
-  };
-}
-
-function buildModelVariantEntries(baseModels = [], {
-  defaultEnabled = true,
-  contextLimitsByModel = {},
-  modelMetadataByModel = {},
-} = {}) {
-  const models = uniqueStringList(baseModels);
-  const entries = [];
-  let sortOrder = 0;
-  for (const baseModelId of models) {
-    const provider = modelProviderForId(baseModelId);
-    const label = modelDisplayLabel(baseModelId);
-    const contextLimitTokens = Number(contextLimitsByModel?.[baseModelId]);
-    const normalizedContextLimitTokens = Number.isFinite(contextLimitTokens) && contextLimitTokens > 0
-      ? Math.round(contextLimitTokens)
-      : null;
-    const metadata = modelMetadataByModel?.[baseModelId] || {};
-    if (isReasoningVariantEligibleModel(baseModelId)) {
-      for (const effort of SUPPORTED_REASONING_EFFORTS) {
-        entries.push({
-          variantId: buildModelVariantId(baseModelId, effort),
-          baseModelId,
-          provider,
-          label,
-          reasoningEffort: effort,
-          releaseStatus: null,
-          contextLimitTokens: normalizedContextLimitTokens,
-          longContextLimitTokens: toNullableInt(metadata.longContextLimitTokens),
-          pricing: metadata.pricing || null,
-          enabled: defaultEnabled ? 1 : 0,
-          sortOrder: sortOrder++,
-        });
-      }
-      continue;
-    }
-    entries.push({
-      variantId: buildModelVariantId(baseModelId),
-      baseModelId,
-      provider,
-      label,
-      reasoningEffort: null,
-      releaseStatus: null,
-      contextLimitTokens: normalizedContextLimitTokens,
-      longContextLimitTokens: toNullableInt(metadata.longContextLimitTokens),
-      pricing: metadata.pricing || null,
-      enabled: defaultEnabled ? 1 : 0,
-      sortOrder: sortOrder++,
-    });
-  }
-
-  return entries;
-}
-
-function normalizeModelMetadataByModel(value = {}) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
-  const normalized = {};
-  for (const [rawModelId, rawMetadata] of Object.entries(value)) {
-    const modelId = canonicalizeModelId(rawModelId);
-    if (!isValidModelId(modelId) || !rawMetadata || typeof rawMetadata !== 'object') continue;
-    const defaultContextLimitTokens = toNullableInt(rawMetadata.defaultContextLimitTokens);
-    const longContextLimitTokens = toNullableInt(rawMetadata.longContextLimitTokens);
-    const pricing = rawMetadata.pricing && typeof rawMetadata.pricing === 'object' ? rawMetadata.pricing : null;
-    if (defaultContextLimitTokens === null && longContextLimitTokens === null && pricing === null) continue;
-    normalized[modelId] = { defaultContextLimitTokens, longContextLimitTokens, pricing };
-  }
-  return normalized;
-}
-
-function normalizeContextLimitsByModel(value = {}) {
-  if (!value || typeof value !== 'object' || Array.isArray(value)) return {};
-  const normalized = {};
-  for (const [rawModelId, rawLimit] of Object.entries(value)) {
-    const modelId = canonicalizeModelId(rawModelId);
-    const limit = Number(rawLimit);
-    if (!isValidModelId(modelId) || !Number.isFinite(limit) || limit <= 0) continue;
-    normalized[modelId] = Math.round(limit);
-  }
-  return normalized;
-}
-
-function hasValidReasoningByModel(reasoningByModel = {}) {
-  if (!reasoningByModel || typeof reasoningByModel !== 'object') return false;
-  const modelIds = Object.keys(reasoningByModel).filter((modelId) => modelId !== AUTO_MODEL_SENTINEL);
-  if (!modelIds.length) return false;
-  return modelIds.every((modelId) => {
-    const efforts = reasoningByModel[modelId];
-    return Array.isArray(efforts) && efforts.length > 0;
-  });
-}
-
-function getModelCatalogState() {
-  const selectorState = getModelVariantSelectorState();
-  const enabledRows = listEnabledModelVariantRows();
-  const modelRows = enabledRows.length ? enabledRows : listModelVariantRows().filter((row) => row.enabled);
-  const allRows = listModelVariantRows();
-  const reasoningByModel = {};
-  const contextLimitsByModel = {};
-  const modelMetadataByModel = {};
-  const models = [];
-  const seenModels = new Set();
-  for (const row of modelRows) {
-    const baseModelId = String(row?.baseModelId || '').trim();
-    if (!baseModelId) continue;
-    if (!seenModels.has(baseModelId)) {
-      seenModels.add(baseModelId);
-      models.push(baseModelId);
-    }
-    const effort = normalizeReasoningEffort(row?.reasoningEffort || 'none') || 'none';
-    const current = reasoningByModel[baseModelId] || [];
-    if (!current.includes(effort)) current.push(effort);
-    reasoningByModel[baseModelId] = current;
-    if (row.contextLimitTokens !== null && row.contextLimitTokens > 0) {
-      contextLimitsByModel[baseModelId] = row.contextLimitTokens;
-    }
-    if (!modelMetadataByModel[baseModelId]) {
-      modelMetadataByModel[baseModelId] = {
-        defaultContextLimitTokens: row.contextLimitTokens,
-        longContextLimitTokens: row.longContextLimitTokens,
-        pricing: row.pricing,
-      };
-    }
-  }
-  const knownModelIds = new Set(Object.keys(reasoningByModel));
-  for (const row of allRows) {
-    const baseModelId = String(row?.baseModelId || '').trim();
-    if (!baseModelId) continue;
-    knownModelIds.add(baseModelId);
-    const effort = normalizeReasoningEffort(row?.reasoningEffort || 'none') || 'none';
-    const current = reasoningByModel[baseModelId] || [];
-    if (!current.includes(effort)) current.push(effort);
-    reasoningByModel[baseModelId] = current;
-    if (row.contextLimitTokens !== null && row.contextLimitTokens > 0) {
-      contextLimitsByModel[baseModelId] = row.contextLimitTokens;
-    }
-    if (!modelMetadataByModel[baseModelId]) {
-      modelMetadataByModel[baseModelId] = {
-        defaultContextLimitTokens: row.contextLimitTokens,
-        longContextLimitTokens: row.longContextLimitTokens,
-        pricing: row.pricing,
-      };
-    }
-  }
-  for (const modelId of knownModelIds) {
-    const efforts = uniqueStringList(
-      (reasoningByModel[modelId] || [])
-        .map((value) => normalizeReasoningEffort(value))
-        .filter(Boolean),
-    );
-    reasoningByModel[modelId] = efforts;
-  }
-  const autoEfforts = uniqueStringList(
-    Object.entries(reasoningByModel)
-      .filter(([modelId]) => modelId !== AUTO_MODEL_SENTINEL)
-      .flatMap(([, list]) => Array.isArray(list) ? list : [])
-      .map((value) => normalizeReasoningEffort(value))
-      .filter(Boolean),
-  );
-  if (autoEfforts.length) {
-    reasoningByModel[AUTO_MODEL_SENTINEL] = autoEfforts;
-  } else {
-    delete reasoningByModel[AUTO_MODEL_SENTINEL];
-  }
-  const catalogModels = [AUTO_MODEL_SENTINEL, ...models.filter((value) => value.toLowerCase() !== AUTO_MODEL_SENTINEL)];
-  const currentResolved = parseModelVariantSelection(selectorState.currentModel);
-  const defaultResolved = parseModelVariantSelection(selectorState.defaultModel);
-  const currentModel = String(currentResolved?.baseModelId || selectorState.currentModel || '').trim() || catalogModels[0] || DEFAULT_MODEL;
-  const defaultModel = String(defaultResolved?.baseModelId || selectorState.defaultModel || '').trim() || currentModel || catalogModels[0] || DEFAULT_MODEL;
-  const reasoningMetadataValid = hasValidReasoningByModel(reasoningByModel);
-  const inMemoryRefresh = modelCatalog.refreshedAt || null;
-  const refreshedAt = latestModelCatalogRefresh(selectorState.refreshedAt, inMemoryRefresh);
-  const metadataError = !reasoningMetadataValid || !!selectorState.error || modelRows.length === 0;
-  const stale = metadataError;
-  const metadataValid = !metadataError;
-  const warning = selectorState.warning || null;
-  const reasoningEfforts = uniqueStringList(
-    Object.values(reasoningByModel)
-      .flatMap((list) => Array.isArray(list) ? list : [])
-      .map((value) => normalizeReasoningEffort(value))
-      .filter(Boolean),
-  );
-  return {
-    models: catalogModels,
-    currentModel,
-    defaultModel,
-    source: selectorState.source,
-    refreshedAt,
-    stale,
-    metadataValid,
-    reasoningMetadataValid,
-    warning,
-    error: selectorState.error,
-    reasoningByModel,
-    reasoningEfforts,
-    contextLimitsByModel,
-    modelMetadataByModel,
-  };
-}
-
-function touchModelSelectorState({
-  source = 'snapshot',
-  error = null,
-  refreshedAt = new Date().toISOString(),
-} = {}) {
-  if (!modelSelectorSql?.upsertSelectorState?.run) return;
-  const timestamp = latestModelCatalogRefresh(refreshedAt) || new Date().toISOString();
-  modelSelectorSql.upsertSelectorState.run(
-    String(source || 'snapshot').trim() || 'snapshot',
-    timestamp,
-    error ? String(error).trim().slice(0, 300) : null,
-    timestamp,
-  );
-}
+// The Copilot model catalog (snapshot state + model_variants rows) lives in
+// its own service so it can be tested against an in-memory database; the
+// runtime only wires it to its constants and the copilot CLI runner. It is
+// created BEFORE the database so the bootstrap catalog publish below keeps
+// its historical ordering; bindDatabase() attaches the statements later.
+const modelVariantCatalog = createModelVariantCatalogService({
+  defaultModel: DEFAULT_MODEL,
+  curatedModelIds: CURATED_MODEL_IDS,
+  autoModelSentinel: AUTO_MODEL_SENTINEL,
+  runCopilotCliCommand,
+});
+const {
+  SUPPORTED_REASONING_EFFORTS,
+  normalizeReasoningEffort,
+  buildModelVariantId,
+  getModelCatalogState,
+  updateModelCatalog,
+  listModelVariantRows,
+  getModelContextLimitTokens,
+  parseModelVariantSelection,
+  setEnabledModelVariants,
+  refreshModelVariantCatalogFromCli,
+} = modelVariantCatalog;
 
-function updateModelCatalog(snapshot = {}) {
-  const incomingModels = validatedModelIdList(Array.isArray(snapshot.models) ? snapshot.models : []);
-  const incomingCurrentRaw = String(snapshot.currentModel || '').trim();
-  const incomingDefaultRaw = String(snapshot.defaultModel || '').trim();
-  const incomingCurrent = isValidModelId(incomingCurrentRaw) ? incomingCurrentRaw : '';
-  const incomingDefault = isValidModelId(incomingDefaultRaw) ? incomingDefaultRaw : '';
-  const contextLimitsByModel = normalizeContextLimitsByModel(snapshot.contextLimitsByModel);
-  const modelMetadataByModel = normalizeModelMetadataByModel(snapshot.modelMetadataByModel);
-  const receivedMetadata = incomingModels.length > 0 || Object.keys(contextLimitsByModel).length > 0 || Object.keys(modelMetadataByModel).length > 0;
-  const merged = validatedModelIdList([
-    ...curatedModelList(),
-    ...incomingModels,
-    incomingCurrent,
-    incomingDefault,
-    ...(Array.isArray(modelCatalog.models) ? modelCatalog.models : []),
-    modelCatalog.currentModel,
-    modelCatalog.defaultModel,
-  ]);
-  if (!merged.length) merged.push(DEFAULT_MODEL);
-  const currentModel = incomingCurrent || modelCatalog.currentModel || incomingDefault || merged[0] || DEFAULT_MODEL;
-  const defaultModel = incomingDefault || modelCatalog.defaultModel || currentModel || DEFAULT_MODEL;
-  const models = uniqueStringList([currentModel, defaultModel, ...merged]);
-
-  modelCatalog = {
-    models,
-    currentModel,
-    defaultModel,
-    source: String(snapshot.source || modelCatalog.source || 'unknown').trim() || 'unknown',
-    refreshedAt: receivedMetadata ? new Date().toISOString() : modelCatalog.refreshedAt,
-    error: snapshot.error ? String(snapshot.error).trim().slice(0, 300) : null,
-  };
-  if (modelSelectorSql?.upsertVariant?.run) {
-    const existingBaseIds = new Set(listModelVariantRows().map((r) => r.baseModelId));
-    const newBaseIds = models.filter((id) => !existingBaseIds.has(id));
-    if (newBaseIds.length) {
-      const newEntries = buildModelVariantEntries(newBaseIds, { defaultEnabled: false, contextLimitsByModel, modelMetadataByModel });
-      upsertModelVariantCatalogEntries(newEntries, {
-        source: String(modelCatalog.source || 'snapshot').trim() || 'snapshot',
-        error: modelCatalog.error || null,
-        preserveEnabled: true,
-      });
-    }
-    const nowIso = new Date().toISOString();
-    for (const [modelId, contextLimitTokens] of Object.entries(contextLimitsByModel)) {
-      modelSelectorSql.updateContextLimitForBase.run(contextLimitTokens, nowIso, modelId);
-    }
-    for (const [modelId, metadata] of Object.entries(modelMetadataByModel)) {
-      modelSelectorSql.updateModelMetadataForBase.run(
-        metadata.defaultContextLimitTokens,
-        metadata.longContextLimitTokens,
-        metadata.pricing ? JSON.stringify(metadata.pricing) : null,
-        nowIso,
-        modelId,
-      );
-    }
-  }
-  if (receivedMetadata && modelSelectorSql?.upsertSelectorState?.run) {
-    touchModelSelectorState({
-      source: modelCatalog.source,
-      error: modelCatalog.error,
-      refreshedAt: modelCatalog.refreshedAt,
-    });
-  }
-  return getModelCatalogState();
-}
 
 function getSupportedReasoningEffortsForModel(model = '') {
   const modelId = String(model || '').trim().toLowerCase();
@@ -2693,200 +2375,6 @@ function resolveRequestedModel(model) {
   };
 }
 
-function listModelVariantRows() {
-  if (!modelSelectorSql?.listVariants?.all) return [];
-  return modelSelectorSql.listVariants.all().map((row) => normalizeModelVariantRow(row));
-}
-
-function listEnabledModelVariantRows() {
-  if (!modelSelectorSql?.listEnabledVariants?.all) return [];
-  return modelSelectorSql.listEnabledVariants.all().map((row) => normalizeModelVariantRow(row));
-}
-
-function getModelContextLimitTokens(modelId = '') {
-  const normalizedModelId = canonicalizeModelId(modelId);
-  if (!normalizedModelId) return null;
-  const row = listModelVariantRows().find((entry) => entry.baseModelId === normalizedModelId
-    && entry.contextLimitTokens !== null
-    && entry.contextLimitTokens > 0);
-  return row?.contextLimitTokens || null;
-}
-
-function parseModelVariantSelection(value) {
-  const variantId = String(value || '').trim();
-  if (!variantId) return null;
-  const knownBaseModels = listModelVariantRows().map((row) => row.baseModelId);
-  const parsed = parseModelVariantId(variantId, { knownBaseModels });
-  if (!parsed) return null;
-  const match = listModelVariantRows().find((row) => row.variantId === parsed.variantId);
-  if (match) {
-    return {
-      variantId: match.variantId,
-      baseModelId: match.baseModelId,
-      reasoningEffort: match.reasoningEffort,
-      provider: match.provider,
-      label: match.label,
-    };
-  }
-  return parsed;
-}
-
-function getModelVariantSelectorState() {
-  const fallbackVariant = buildModelVariantId(DEFAULT_MODEL, isReasoningVariantEligibleModel(DEFAULT_MODEL) ? 'none' : null);
-  if (!modelSelectorSql?.listEnabledVariants?.all) {
-    const fallbackModels = buildModelVariantEntries(curatedModelList(), { defaultEnabled: true }).map((entry) => entry.variantId);
-    const models = fallbackModels.length ? fallbackModels : [fallbackVariant];
-    return {
-      models,
-      currentModel: models[0] || fallbackVariant,
-      defaultModel: models[0] || fallbackVariant,
-      source: 'bootstrap',
-      refreshedAt: null,
-      warning: null,
-      error: null,
-    };
-  }
-  const enabledRows = listEnabledModelVariantRows();
-  const selectorState = modelSelectorSql.getSelectorState.get() || null;
-  const enabledVariants = enabledRows.map((row) => row.variantId);
-  const models = enabledVariants.length ? enabledVariants : [fallbackVariant];
-  const warning = enabledVariants.length
-    ? null
-    : 'No model variants are enabled. Using fallback.';
-  return {
-    models,
-    currentModel: models[0] || fallbackVariant,
-    defaultModel: models[0] || fallbackVariant,
-    source: String(selectorState?.source || 'db').trim() || 'db',
-    refreshedAt: selectorState?.refreshed_at || null,
-    warning,
-    error: selectorState?.error ? String(selectorState.error) : null,
-  };
-}
-
-function upsertModelVariantCatalogEntries(entries = [], {
-  source = 'manual-refresh',
-  error = null,
-  preserveEnabled = true,
-} = {}) {
-  if (!modelSelectorSql?.upsertVariant?.run || !modelSelectorSql?.upsertSelectorState?.run) {
-    return getModelVariantSelectorState();
-  }
-  const normalizedEntries = Array.isArray(entries)
-    ? entries.map((entry) => normalizeModelVariantRow(entry)).filter((entry) => entry.variantId && entry.baseModelId)
-    : [];
-  const existingEnabled = new Map(
-    listModelVariantRows().map((row) => [row.variantId, row.enabled ? 1 : 0]),
-  );
-  const incomingIds = new Set(normalizedEntries.map((entry) => entry.variantId));
-  const incomingBaseIds = new Set(normalizedEntries.map((entry) => entry.baseModelId));
-  const nowIso = new Date().toISOString();
-  const tx = db.transaction(() => {
-    for (const entry of normalizedEntries) {
-      const enabled = preserveEnabled && existingEnabled.has(entry.variantId)
-        ? existingEnabled.get(entry.variantId)
-        : (entry.enabled ? 1 : 0);
-      modelSelectorSql.upsertVariant.run(
-        entry.variantId,
-        entry.baseModelId,
-        entry.provider || modelProviderForId(entry.baseModelId),
-        entry.label || modelDisplayLabel(entry.baseModelId),
-        entry.releaseStatus || null,
-        entry.reasoningEffort || null,
-        entry.contextLimitTokens || null,
-        entry.longContextLimitTokens || null,
-        entry.pricing ? JSON.stringify(entry.pricing) : null,
-        enabled,
-        entry.sortOrder,
-        nowIso,
-      );
-    }
-    for (const row of listModelVariantRows()) {
-      if (incomingIds.has(row.variantId)) continue;
-      const shouldMarkUnavailable = row.enabled || incomingBaseIds.has(row.baseModelId);
-      if (shouldMarkUnavailable) {
-        modelSelectorSql.upsertVariant.run(
-          row.variantId,
-          row.baseModelId,
-          row.provider || modelProviderForId(row.baseModelId),
-          row.label || modelDisplayLabel(row.baseModelId),
-          'unavailable',
-          row.reasoningEffort || null,
-          row.contextLimitTokens || null,
-          row.longContextLimitTokens || null,
-          row.pricing ? JSON.stringify(row.pricing) : null,
-          row.enabled ? 1 : 0,
-          row.sortOrder,
-          nowIso,
-        );
-        continue;
-      }
-      // Variants that are both disabled and fully absent from the incoming base set
-      // are no longer relevant; prune them so they do not linger as selectable.
-      modelSelectorSql.deleteVariant.run(row.variantId);
-    }
-    modelSelectorSql.upsertSelectorState.run(
-      String(source || 'manual-refresh').trim() || 'manual-refresh',
-      nowIso,
-      error ? String(error).trim().slice(0, 300) : null,
-      nowIso,
-    );
-  });
-  tx();
-  return getModelVariantSelectorState();
-}
-
-function setEnabledModelVariants(variantIds = []) {
-  if (!modelSelectorSql?.disableAllVariants?.run || !modelSelectorSql?.enableVariant?.run) {
-    return getModelVariantSelectorState();
-  }
-  const nextEnabled = new Set(
-    Array.isArray(variantIds) ? variantIds.map((value) => String(value || '').trim()).filter(Boolean) : [],
-  );
-  const existingRows = listModelVariantRows();
-  const nowIso = new Date().toISOString();
-  const tx = db.transaction(() => {
-    modelSelectorSql.disableAllVariants.run(nowIso);
-    for (const row of existingRows) {
-      if (!nextEnabled.has(row.variantId)) continue;
-      modelSelectorSql.enableVariant.run(nowIso, row.variantId);
-    }
-  });
-  tx();
-  return getModelVariantSelectorState();
-}
-
-function parseModelsFromHelpConfigOutput(text) {
-  const content = String(text || '');
-  if (!content) return [];
-  const sectionMatch = content.match(/`model`:[\s\S]*?(?=\n\s*`[a-zA-Z][^`]*`:\s|$)/);
-  const section = sectionMatch ? sectionMatch[0] : content;
-  const models = [];
-  const regex = /"([^"]+)"/g;
-  let match;
-  while ((match = regex.exec(section))) {
-    const candidate = String(match[1] || '').trim();
-    if (!candidate || candidate === 'auto') continue;
-    if (!isValidModelId(candidate)) continue;
-    models.push(candidate);
-  }
-  return validatedModelIdList(models);
-}
-
-function parseReasoningEffortsFromHelpOutput(text) {
-  const content = String(text || '');
-  if (!content) return SUPPORTED_REASONING_EFFORTS.slice();
-  const values = [];
-  const regex = /"([a-z]+)"/g;
-  let match;
-  while ((match = regex.exec(content))) {
-    const effort = normalizeReasoningEffort(match[1]);
-    if (effort) values.push(effort);
-  }
-  const unique = uniqueStringList(values);
-  return unique.length ? unique : SUPPORTED_REASONING_EFFORTS.slice();
-}
-
 function runCopilotCliCommand(args = [], timeoutMs = 30_000) {
   const commandArgs = Array.isArray(args) ? args.map((item) => String(item || '').trim()).filter(Boolean) : [];
   return new Promise((resolve, reject) => {
@@ -2915,71 +2403,6 @@ function runCopilotCliCommand(args = [], timeoutMs = 30_000) {
   });
 }
 
-async function refreshModelVariantCatalogFromCli() {
-  let source = 'rpc-snapshot';
-  let modelIds = [];
-  let reasoningEfforts = SUPPORTED_REASONING_EFFORTS.slice();
-  const hasAuthoritativeSnapshot = /^(web-relay-extension|standalone-relay):/.test(String(modelCatalog.source || ''));
-  const refreshSelectionFromSnapshot = selectModelIdsForVariantRefresh({
-    snapshotModels: hasAuthoritativeSnapshot && Array.isArray(modelCatalog.models) ? modelCatalog.models : [],
-    currentModel: modelCatalog.currentModel,
-    defaultModel: modelCatalog.defaultModel,
-    helpModelIds: [],
-  });
-  source = refreshSelectionFromSnapshot.source;
-  modelIds = refreshSelectionFromSnapshot.modelIds;
-  const genericHelpText = await runCopilotCliCommand(['help']).catch(() => '');
-  reasoningEfforts = parseReasoningEffortsFromHelpOutput(genericHelpText);
-  if (!modelIds.length) {
-    const configHelpText = await runCopilotCliCommand(['help', 'config']);
-    const helpModelIds = parseModelsFromHelpConfigOutput(configHelpText);
-    const refreshSelectionFromHelp = selectModelIdsForVariantRefresh({
-      snapshotModels: [],
-      currentModel: '',
-      defaultModel: '',
-      helpModelIds,
-    });
-    source = refreshSelectionFromHelp.source;
-    modelIds = refreshSelectionFromHelp.modelIds;
-  }
-  const entries = [];
-  let sortOrder = 0;
-  for (const modelId of modelIds) {
-    const provider = modelProviderForId(modelId);
-    const label = modelDisplayLabel(modelId);
-    if (isReasoningVariantEligibleModel(modelId)) {
-      for (const effort of reasoningEfforts) {
-        entries.push({
-          variantId: buildModelVariantId(modelId, effort),
-          baseModelId: modelId,
-          provider,
-          label,
-          reasoningEffort: effort,
-          enabled: 0,
-          sortOrder: sortOrder++,
-        });
-      }
-      continue;
-    }
-    entries.push({
-      variantId: buildModelVariantId(modelId),
-      baseModelId: modelId,
-      provider,
-      label,
-      reasoningEffort: null,
-      enabled: 0,
-      sortOrder: sortOrder++,
-    });
-  }
-  if (!entries.length) {
-    throw new Error('No models found in snapshot/help model output');
-  }
-  return upsertModelVariantCatalogEntries(entries, {
-    source,
-    error: null,
-    preserveEnabled: true,
-  });
-}
 
 function normalizeRelayMode(mode) {
   const value = String(mode || '').trim().toLowerCase();
@@ -3115,154 +2538,7 @@ const imageOperationService = createImageOperationService({
   uuidv4,
 });
 
-modelSelectorSql = {
-  listVariants: db.prepare(`
-    SELECT variant_id, base_model_id, provider, label, release_status, reasoning_effort, context_limit_tokens, long_context_limit_tokens, pricing_json, enabled, sort_order, updated_at
-    FROM model_variants
-    ORDER BY provider ASC, sort_order ASC, variant_id ASC
-  `),
-  listEnabledVariants: db.prepare(`
-    SELECT variant_id, base_model_id, provider, label, release_status, reasoning_effort, context_limit_tokens, long_context_limit_tokens, pricing_json, enabled, sort_order, updated_at
-    FROM model_variants
-    WHERE enabled = 1
-    ORDER BY provider ASC, sort_order ASC, variant_id ASC
-  `),
-  upsertVariant: db.prepare(`
-    INSERT INTO model_variants (
-      variant_id, base_model_id, provider, label, release_status, reasoning_effort, context_limit_tokens, long_context_limit_tokens, pricing_json, enabled, sort_order, updated_at
-    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
-    ON CONFLICT(variant_id) DO UPDATE SET
-      base_model_id = excluded.base_model_id,
-      provider = excluded.provider,
-      label = excluded.label,
-      release_status = excluded.release_status,
-      reasoning_effort = excluded.reasoning_effort,
-      context_limit_tokens = COALESCE(excluded.context_limit_tokens, model_variants.context_limit_tokens),
-      long_context_limit_tokens = COALESCE(excluded.long_context_limit_tokens, model_variants.long_context_limit_tokens),
-      pricing_json = COALESCE(excluded.pricing_json, model_variants.pricing_json),
-      enabled = excluded.enabled,
-      sort_order = excluded.sort_order,
-      updated_at = excluded.updated_at
-  `),
-  updateContextLimitForBase: db.prepare(`
-    UPDATE model_variants
-    SET context_limit_tokens = ?, updated_at = ?
-    WHERE base_model_id = ?
-  `),
-  updateModelMetadataForBase: db.prepare(`
-    UPDATE model_variants
-    SET context_limit_tokens = COALESCE(?, context_limit_tokens),
-        long_context_limit_tokens = COALESCE(?, long_context_limit_tokens),
-        pricing_json = COALESCE(?, pricing_json),
-        updated_at = ?
-    WHERE base_model_id = ?
-  `),
-  disableAllVariants: db.prepare(`UPDATE model_variants SET enabled = 0, updated_at = ?`),
-  enableVariant: db.prepare(`UPDATE model_variants SET enabled = 1, updated_at = ? WHERE variant_id = ?`),
-  deleteVariant: db.prepare(`DELETE FROM model_variants WHERE variant_id = ?`),
-  getSelectorState: db.prepare(`SELECT source, refreshed_at, error, updated_at FROM model_selector_state WHERE id = 1 LIMIT 1`),
-  upsertSelectorState: db.prepare(`
-    INSERT INTO model_selector_state (id, source, refreshed_at, error, updated_at)
-    VALUES (1, ?, ?, ?, ?)
-    ON CONFLICT(id) DO UPDATE SET
-      source = excluded.source,
-      refreshed_at = excluded.refreshed_at,
-      error = excluded.error,
-      updated_at = excluded.updated_at
-  `),
-};
-
-{
-  const existingCount = Number(db.prepare(`SELECT COUNT(*) AS cnt FROM model_variants`).get()?.cnt || 0);
-  const normalizeLegacyVariantIdsTx = db.transaction(() => {
-    const rows = modelSelectorSql.listVariants.all();
-    const canonicalRows = new Map();
-    for (const rawRow of rows) {
-      const row = normalizeModelVariantRow(rawRow);
-      const canonicalBaseModelId = canonicalizeModelId(row.baseModelId);
-      if (!canonicalBaseModelId) continue;
-      const canonicalVariantId = buildModelVariantId(canonicalBaseModelId, row.reasoningEffort);
-      const existing = canonicalRows.get(canonicalVariantId);
-      if (!existing) {
-        canonicalRows.set(canonicalVariantId, {
-          variantId: canonicalVariantId,
-          baseModelId: canonicalBaseModelId,
-          provider: row.provider || modelProviderForId(canonicalBaseModelId),
-          label: row.label || modelDisplayLabel(canonicalBaseModelId),
-          releaseStatus: row.releaseStatus || null,
-          reasoningEffort: row.reasoningEffort || null,
-          enabled: row.enabled ? 1 : 0,
-          sortOrder: row.sortOrder,
-          updatedAt: row.updatedAt,
-        });
-        continue;
-      }
-      existing.enabled = existing.enabled || (row.enabled ? 1 : 0) ? 1 : 0;
-      if (existing.releaseStatus !== null && row.releaseStatus === null) {
-        existing.releaseStatus = null;
-      }
-      existing.sortOrder = Math.min(existing.sortOrder, row.sortOrder);
-      if (!existing.label && row.label) existing.label = row.label;
-    }
-
-    const nowIso = new Date().toISOString();
-    for (const entry of canonicalRows.values()) {
-      modelSelectorSql.upsertVariant.run(
-        entry.variantId,
-        entry.baseModelId,
-        entry.provider || modelProviderForId(entry.baseModelId),
-        entry.label || modelDisplayLabel(entry.baseModelId),
-        entry.releaseStatus || null,
-        entry.reasoningEffort || null,
-        entry.contextLimitTokens || null,
-        entry.longContextLimitTokens || null,
-        entry.pricing ? JSON.stringify(entry.pricing) : null,
-        entry.enabled ? 1 : 0,
-        entry.sortOrder,
-        nowIso,
-      );
-    }
-    for (const rawRow of rows) {
-      const rawVariantId = String(rawRow?.variant_id || '').trim();
-      const rawBaseModelId = String(rawRow?.base_model_id || '').trim();
-      const canonicalBaseModelId = canonicalizeModelId(rawBaseModelId);
-      if (!canonicalBaseModelId) continue;
-      const canonicalReasoningEffort = normalizeReasoningEffort(rawRow?.reasoning_effort);
-      const canonicalVariantId = buildModelVariantId(canonicalBaseModelId, canonicalReasoningEffort);
-      if (rawVariantId !== canonicalVariantId) {
-        modelSelectorSql.deleteVariant.run(rawVariantId);
-      }
-    }
-  });
-  if (existingCount === 0) {
-    const nowIso = new Date().toISOString();
-    const seedEntries = buildModelVariantEntries(curatedModelList(), { defaultEnabled: true });
-    const tx = db.transaction(() => {
-      for (const entry of seedEntries) {
-        modelSelectorSql.upsertVariant.run(
-          entry.variantId,
-          entry.baseModelId,
-          entry.provider,
-          entry.label,
-          entry.releaseStatus || null,
-          entry.reasoningEffort || null,
-          entry.contextLimitTokens || null,
-          entry.longContextLimitTokens || null,
-          entry.pricing ? JSON.stringify(entry.pricing) : null,
-          entry.enabled ? 1 : 0,
-          entry.sortOrder,
-          nowIso,
-        );
-      }
-      modelSelectorSql.upsertSelectorState.run('bootstrap-seed', nowIso, null, nowIso);
-    });
-    tx();
-  } else if (!modelSelectorSql.getSelectorState.get()) {
-    const nowIso = new Date().toISOString();
-    modelSelectorSql.upsertSelectorState.run('legacy', nowIso, null, nowIso);
-  }
-  normalizeLegacyVariantIdsTx();
-}
+modelVariantCatalog.bindDatabase(db);
 
 const deleteArchiveService = createDeleteArchiveService(db, null, { resolveSessionStateRoot });
 void deleteArchiveService.retryPendingDeletesOnStartup()
@@ -3311,21 +2587,32 @@ function buildSessionWorkerLaunchEnv() {
       const candidate = path.join(versionDir, 'preloads', 'extension_bootstrap.mjs');
       if (fs.existsSync(candidate)) return candidate;
     }
-    const platformName = process.platform === 'linux'
-      ? (process.arch === 'x64' ? 'linux-x64' : `linux-${process.arch}`)
-      : `${process.platform}-${process.arch}`;
-    const cacheRoot = path.join(os.homedir(), '.cache', 'copilot', 'pkg', platformName);
-    try {
-      const versions = fs.readdirSync(cacheRoot)
-        .filter((entry) => fs.existsSync(path.join(cacheRoot, entry, 'preloads', 'extension_bootstrap.mjs')))
-        .sort()
-        .reverse();
-      if (versions.length) {
-        return path.join(cacheRoot, versions[0], 'preloads', 'extension_bootstrap.mjs');
+    // The CLI cache lives in a per-platform location (LOCALAPPDATA on Windows,
+    // Application Support on macOS, XDG dirs on Linux) — scan the same base
+    // dirs as the SDK client instead of assuming the Linux layout. Selection
+    // deliberately keys on the bootstrap file itself rather than the bundled
+    // SDK: CLI versions without a copilot-sdk directory must still resolve
+    // here for the extension engine.
+    const subdirs = [`${process.platform}-${process.arch}`, 'universal'];
+    const candidates = [];
+    for (const [baseDirIdx, baseDir] of getCopilotBaseDirs().entries()) {
+      for (const [subdirIdx, subdir] of subdirs.entries()) {
+        let entries = [];
+        try { entries = fs.readdirSync(path.join(baseDir, subdir)); } catch { continue; }
+        for (const version of entries) {
+          if (!/^\d+\.\d+\.\d+$/.test(version)) continue;
+          const candidate = path.join(baseDir, subdir, version, 'preloads', 'extension_bootstrap.mjs');
+          if (fs.existsSync(candidate)) candidates.push({ version, baseDirIdx, subdirIdx, candidate });
+        }
       }
-    } catch {
-      // The CLI cache is optional; retain the normal fallback when unavailable.
     }
+    candidates.sort((a, b) => {
+      const aVersion = a.version.split('.').map(Number);
+      const bVersion = b.version.split('.').map(Number);
+      return bVersion[0] - aVersion[0] || bVersion[1] - aVersion[1] || bVersion[2] - aVersion[2]
+        || a.baseDirIdx - b.baseDirIdx || a.subdirIdx - b.subdirIdx;
+    });
+    if (candidates.length) return candidates[0].candidate;
     return null;
   };
 
@@ -3503,7 +2790,65 @@ const sessionWorkerSupervisor = createSessionWorkerSupervisor({
   diagnosticPlanReference: () => path.join(currentWorkspaceRootPath(), '.cursor', 'plans', 'worker-startup-monitoring-plan.md'),
   log: (message) => console.warn(`${runtimeLogPrefix()}${message}`),
 });
-const featureFlags = normalizeFeatureFlags(FEATURES);
+// Feature flags moved from config.json into app_settings; adopt any legacy
+// `features` key once, then resolve the boot snapshot (defaults < stored rows
+// < COPILOT_REMOTE_* env). The snapshot is frozen for the process lifetime —
+// the Features settings tab persists changes and asks for a relay restart.
+migrateLegacyConfigFeatures({
+  configPath: CONFIG_PATH,
+  readSetting: readAppSettingValue,
+  writeSetting: (key, value) => stmts.upsertAppSetting.run(key, value, new Date().toISOString()),
+});
+const featureFlags = resolveBootFeatureFlags({ readSetting: readAppSettingValue });
+
+// Settle any persisted self-update attempt from the previous run: an unchanged
+// version after the restart becomes a visible failure carrying the npm log.
+reconcileUpdateAttempt({
+  readSetting: readAppSettingValue,
+  writeSetting: (key, value) => stmts.upsertAppSetting.run(key, value, new Date().toISOString()),
+  deleteSetting: (key) => stmts.deleteAppSetting.run(key),
+  runningVersion: RUNNING_VERSION,
+});
+
+// Update checking is opt-in (zero telemetry by default): the service exists so
+// manual "check now" and the settings toggle work, but never fetches unless
+// the stored setting says so. OAR_NO_UPDATE_CHECK=1 kills even that.
+const updateCheckKilled = isUpdateCheckKilled(process.env);
+const updateCheckService = updateCheckKilled ? null : createUpdateCheckService({
+  runningVersion: RUNNING_VERSION,
+  installMethod: INSTALL_METHOD,
+  manifestUrl: resolveUpdateManifestUrl(process.env),
+  readSetting: readAppSettingValue,
+  writeSetting: (key, value) => stmts.upsertAppSetting.run(key, value, new Date().toISOString()),
+  logger: console,
+  onStateChange: () => emitUpdateState(),
+});
+const updateInstallService = createUpdateInstallService({
+  runningVersion: RUNNING_VERSION,
+  installMethod: INSTALL_METHOD,
+  readSetting: readAppSettingValue,
+  writeSetting: (key, value) => stmts.upsertAppSetting.run(key, value, new Date().toISOString()),
+  deleteSetting: (key) => stmts.deleteAppSetting.run(key),
+  requestRelayShutdown: (options) => requestRelayShutdown(options),
+  logger: console,
+});
+updateInstallService.subscribe(() => emitUpdateState());
+
+function buildUpdateStatePayload() {
+  return {
+    runningVersion: RUNNING_VERSION,
+    installMethod: INSTALL_METHOD,
+    checkKilled: updateCheckKilled,
+    check: updateCheckService?.getSnapshot() || null,
+    install: updateInstallService.getSnapshot(),
+  };
+}
+
+function emitUpdateState() {
+  // `io` is created later in boot; emits only fire from user actions and
+  // timers, both post-boot, so the reference is safe by then.
+  try { io.emit('update_state', buildUpdateStatePayload()); } catch {}
+}
 
 async function stopSessionWorkerForProviderRebind(sdkSessionId) {
   const sessionId = String(sdkSessionId || '').trim();
@@ -5538,8 +4883,35 @@ const backgroundTaskStore = {
   },
 };
 
+// The live turn among a conversation's processing rows. Mid-turn steering can
+// leave several processing at once — the running turn, steered messages the
+// CLI folded into it (no output of their own), a handed-off row still settling
+// — so the live turn is the row that produced output most recently; with
+// nothing to separate them yet, the oldest processing row (the turn a steered
+// message joins) wins. See live-turn-picker.mjs for why recency, not per-row
+// stream seq. Returns the whole row so callers get relay_mode/timestamps too.
+function resolveLiveTurnQueueRow(conversationId) {
+  const rows = stmts.listProcessingQueueByConversation?.all(conversationId)
+    || (stmts.getLatestProcessingQueueByConversation.get(conversationId)
+      ? [stmts.getLatestProcessingQueueByConversation.get(conversationId)]
+      : []);
+  if (!rows.length) return null;
+  if (rows.length === 1) return rows[0];
+  const byId = new Map(rows.map((row) => [String(row.id), row]));
+  const liveId = pickLiveTurnRowId(rows.map((row) => {
+    const output = stmts.getLastOutputAtByQueueMessage?.get({ id: row.id }) || null;
+    return {
+      id: String(row.id),
+      lastOutputAtMs: Date.parse(String(output?.last_output_at || '')) || 0,
+      streamDone: Number(output?.stream_done || 0) === 1,
+      processingAtMs: Date.parse(String(row.processing_at || row.timestamp || '')) || 0,
+    };
+  }));
+  return byId.get(liveId) || rows[0];
+}
+
 function inFlightStateForConversation(conversationId) {
-  const row = stmts.getLatestProcessingQueueByConversation.get(conversationId);
+  const row = resolveLiveTurnQueueRow(conversationId);
   if (!row) return null;
   const streamEvents = relayStreamEventsForQueueMessage(row.id);
   const lastStreamEvent = streamEvents.length ? streamEvents[streamEvents.length - 1] : null;
@@ -5564,14 +4936,17 @@ function inFlightStateForConversation(conversationId) {
 // retry_count like /api/requeue does, but bypasses that route's budget check,
 // so the sweep enforces it here). Minimal mirror of the route-side
 // failQueueMessage: mark failed, insert the assistant failure message, emit.
-function failRecoveredRowTerminally(row, reason) {
+function failRecoveredRowTerminally(row, reason, { failureRecord = null, failureText: presetText = null } = {}) {
   const now = new Date().toISOString();
   const responseId = uuidv4();
   const retryCount = Number(row?.retry_count || 0) + 1;
-  const failureText = `Relay recovery limit reached after ${retryCount} attempts (${reason}). The worker kept dying before completing this turn, so the message was failed to keep the queue moving. Send it again to retry.`;
+  const failureText = presetText || `Relay recovery limit reached after ${retryCount} attempts (${reason}). The worker kept dying before completing this turn, so the message was failed to keep the queue moving. Send it again to retry.`;
   const requestedModel = String(row?.model || '').trim() || null;
   const tx = db.transaction(() => {
-    stmts.setFailed.run(JSON.stringify({
+    // setFailed is compare-and-set on status (processing/pending/parked): a
+    // row that settled between the sweep's listing and this write must not
+    // grow an orphan failure bubble on top of its real outcome.
+    const result = stmts.setFailed.run(JSON.stringify(failureRecord || {
       kind: 'recovery-limit',
       error: 'recovery-limit',
       code: 'recovery-limit',
@@ -5580,6 +4955,7 @@ function failRecoveredRowTerminally(row, reason) {
       retryCount,
       failedAt: now,
     }), row.id);
+    if (result.changes === 0) return false;
     stmts.setQueueResponseMessageId?.run(responseId, row.id);
     stmts.insertMsg.run(
       responseId,
@@ -5594,12 +4970,14 @@ function failRecoveredRowTerminally(row, reason) {
       null,
       requestedModel ? 'user' : 'auto',
     );
+    stmts.setMessageSourceId?.run(row.id, responseId);
     stmts.linkActivityToResponse?.run(responseId, row.id);
     stmts.linkStreamEventsToResponse?.run(responseId, row.id);
     stmts.linkThoughtsToResponse?.run(responseId, row.id);
     stmts.updateConvTime.run(now, row.conversation_id);
+    return true;
   });
-  tx();
+  if (!tx()) return;
   io.emit('assistant_message', {
     conversationId: row.conversation_id,
     sourceMessageId: row.id,
@@ -5607,7 +4985,20 @@ function failRecoveredRowTerminally(row, reason) {
     message: { role: 'assistant', text: failureText, model: requestedModel || 'unknown', mode: String(row?.relay_mode || '').trim() || null, timestamp: now },
   });
   io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
-  console.warn(`${runtimeLogPrefix()}RECOVERY LIMIT ${String(row.id).slice(0, 8)} conv=${String(row.conversation_id).slice(0, 8)} retries=${retryCount} reason=${reason}`);
+  console.warn(`${runtimeLogPrefix()}${failureRecord ? 'CONSUMED FAILED' : 'RECOVERY LIMIT'} ${String(row.id).slice(0, 8)} conv=${String(row.conversation_id).slice(0, 8)} retries=${retryCount} reason=${reason}`);
+}
+
+// A row whose prompt the worker's runtime already consumed (queue.consumed_at)
+// is at-most-once: recovery must never requeue it — a re-delivery would run the
+// prompt twice — so it fails terminally with the steer-settle wording, naming
+// the provider's runtime the way the workers' own settle wording does.
+function failConsumedRowTerminally(row, reason) {
+  const providerType = stmts.getRuntimeSessionByConversation?.get?.(row?.conversation_id)?.provider_type;
+  const failureRecord = buildSteerSettleFailure(row, { agentLabel: steerAgentLabelForProvider(providerType) });
+  failRecoveredRowTerminally(row, reason, {
+    failureRecord: { ...failureRecord, error: 'terminal-error', reason: String(reason || 'recovery') },
+    failureText: `${failureRecord.message} Error code: ${failureRecord.stableCode}. ${failureRecord.guidance}`,
+  });
 }
 
 function recoverProcessingOlderThan(cutoffIso, requeueAtIso, { ceilingBeforeIso = null } = {}) {
@@ -5619,7 +5010,9 @@ function recoverProcessingOlderThan(cutoffIso, requeueAtIso, { ceilingBeforeIso
     stmts.dropStaleContinuation?.run?.(row.id);
     io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
   }
-  const allRows = stmts.listRecoverableProcessing.all(params);
+  const listedRows = stmts.listRecoverableProcessing.all(params);
+  for (const row of listedRows.filter((entry) => entry?.consumed_at)) failConsumedRowTerminally(row, 'stale-recovery');
+  const allRows = listedRows.filter((entry) => !entry?.consumed_at);
   if (!allRows.length) return [];
   // Enforce the retry budget before requeueing: failing these rows first
   // flips them out of 'processing' so the recovery UPDATE below skips them.
@@ -5873,9 +5266,9 @@ function renderIndexHtmlWithPwaVersion(appConfigOverrides = {}) {
 
 function loadPwaManifestTemplate() {
   const fallback = {
-    name: 'Copilot Remote',
-    short_name: 'Copilot',
-    description: 'Installable Copilot Remote web app with standalone launcher support.',
+    name: 'OAR',
+    short_name: 'OAR',
+    description: 'OAR — Open Agent Relay: drive your local coding agents from any browser.',
     display_override: ['standalone'],
     display: 'standalone',
     background_color: '#161b22',
@@ -5896,9 +5289,15 @@ function loadPwaManifestTemplate() {
 
 function buildScopedPwaManifest({ shared = false } = {}) {
   const manifest = loadPwaManifestTemplate();
+  // The custom name must be baked into every served manifest: Android's WebAPK
+  // update check re-fetches this route outside any page session, so a name the
+  // route doesn't know reverts on the phone with an accept-or-uninstall prompt.
+  const names = resolvePwaManifestNames(getPwaAppName(), manifest.name);
   if (shared) {
     return {
       ...manifest,
+      name: names.name,
+      short_name: names.short_name,
       id: './__copilot_remote_shared__',
       start_url: './',
       scope: './',
@@ -5909,6 +5308,8 @@ function buildScopedPwaManifest({ shared = false } = {}) {
   }
   return {
     ...manifest,
+    name: names.name,
+    short_name: names.short_name,
     id: './__copilot_remote_pwa__',
     start_url: './',
     scope: './',
@@ -5942,6 +5343,30 @@ const sdkSessionImportService = createSdkSessionImportService({
   parseSessionEventsToMessages,
   replaceRetrievableHistory: sessionHistoryRefreshService.replaceRetrievableHistory,
   ensureRuntimeSessionBinding,
+  // A registered/supervised worker means the relay executes this session even
+  // when no queue row is visible (e.g. between turns) — the importer must not
+  // overwrite its history.
+  hasRelayExecutionSignal: (sdkSessionId) => !!(
+    sessionWorkerRegistry?.getWorker?.(sdkSessionId)
+    || sessionWorkerSupervisor?.getWorkerState?.(sdkSessionId)
+  ),
+  logger: console,
+});
+// Phase 5A: server-side Copilot model discovery. Once the extension retires,
+// nothing populates the model catalog on a fresh boot until a worker spawns;
+// this asks the installed CLI runtime for `listModels()` directly (deferred —
+// see the listen callback) and feeds updateModelCatalog in-process. It
+// feature-detects the CLI before spawning anything, so a relay without Copilot
+// stays silent.
+const copilotModelDiscoveryService = createCopilotModelDiscoveryService({
+  createClient: () => createInstalledCopilotClient({
+    config,
+    cwd: currentWorkspaceRootPath(),
+    baseDirectory: path.dirname(resolveSessionStateRoot()),
+    logLevel: 'error',
+  }),
+  resolveInstalledPaths: () => resolveInstalledCopilotPaths({ config }),
+  updateModelCatalog,
   logger: console,
 });
 const contextSnapshotService = createContextSnapshotService({
@@ -6325,16 +5750,24 @@ async function recoverUndeliveredSessionWorkerMessage({ pending = null, sessionI
 
   const retryCount = Number(row.retry_count || 0) + 1;
   const nextAttemptAt = addMsIso(Math.min(5_000, computeRetryDelayMs(retryCount)));
+  // The undelivered payload names the exact attempt that was minted for it, so
+  // this requeue can be fenced precisely: if the row has moved on to another
+  // attempt since the failed send, leave it alone.
+  const deliveredAttemptId = String(pending?.message?.attemptId || '').trim() || null;
   const result = db.prepare(`
     UPDATE queue
     SET status = 'pending',
         processing_at = NULL,
+        attempt_id = NULL,
         retry_count = ?,
         next_attempt_at = ?,
         owner_lease_expires_at = NULL
     WHERE id = ?
-      AND status = 'processing'
-  `).run(retryCount, nextAttemptAt, messageId);
+      AND status = 'processing'${deliveredAttemptId ? `
+      AND attempt_id = ?` : ''}
+  `).run(...(deliveredAttemptId
+    ? [retryCount, nextAttemptAt, messageId, deliveredAttemptId]
+    : [retryCount, nextAttemptAt, messageId]));
   if (result.changes <= 0) return false;
 
   if (requesterSessionId) {
@@ -6356,7 +5789,11 @@ async function recoverUndeliveredSessionWorkerMessage({ pending = null, sessionI
 const WORKER_DEATH_GRACE_MS = 15_000;
 
 function isWorkerSessionProcessAlive(sessionId, hintPid = null) {
-  if (sessionWorkerWebSocketService?.hasWorkerSocket?.(sessionId)) return true;
+  // A merely-retained socket is not proof of life: a dead worker's socket
+  // lingers until its close event lands, and counting it stalled recovery.
+  // The socket only counts with a recent heartbeat or a PID that probes
+  // alive; otherwise fall through to the process probes below.
+  if (sessionWorkerWebSocketService?.hasLiveWorkerSocket?.(sessionId)) return true;
   try {
     if (sessionWorkerProcessInspector?.findProcessForSession?.(sessionId)) return true;
   } catch {}
@@ -6381,6 +5818,10 @@ function recoverDeadWorkerProcessingRows(sessionId, reason) {
       io.emit('message_status', { messageId: row.id, conversationId: row.conversation_id, status: 'failed' });
       continue;
     }
+    if (row.consumed_at) {
+      failConsumedRowTerminally(row, `worker-died-${reason}`);
+      continue;
+    }
     if (Number(row.retry_count || 0) + 1 >= MAX_REQUEUE_RETRIES) {
       failRecoveredRowTerminally(row, `worker-died-${reason}`);
       continue;
@@ -6423,11 +5864,15 @@ function handleWorkerSocketClosed({ sessionId, pid = null } = {}) {
   const sid = String(sessionId || '').trim();
   if (!sid) return;
   const owned = stmts.listProcessingRowsForOwner?.all?.(sid) || [];
-  if (!owned.length) return;
+  // A dead worker's steering snapshot must not keep holding the composer even
+  // when it owned no rows (the hold can outlive them, e.g. a continuation's).
+  const heldSteering = Boolean(sessionWorkerRegistry?.getWorker?.(sid)?.steering);
+  if (!owned.length && !heldSteering) return;
   const timer = setTimeout(() => {
     try {
       if (runtimeShutdownStarted) return;
       if (isWorkerSessionProcessAlive(sid, pid)) return; // reconnect or socket flap
+      sessionWorkerRegistry?.clearSteering?.(sid);
       const stillOwned = stmts.listProcessingRowsForOwner?.all?.(sid) || [];
       if (!stillOwned.length) return;
       console.warn(`${runtimeLogPrefix()}WORKER DIED session=${sid.slice(0, 8)} rows=${stillOwned.length} trigger=socket-close — recovering owned turns`);
@@ -6605,6 +6050,10 @@ const windowsAutostartService = createWindowsAutostartService({
   packageRoot: REPO_ROOT,
   configPath: CONFIG_PATH,
 });
+const windowsBootAutostartService = createWindowsBootAutostartService({
+  packageRoot: REPO_ROOT,
+  configPath: CONFIG_PATH,
+});
 
 const gitChangesService = createGitChangesService();
 const sharedRouteDeps = {
@@ -6718,6 +6167,7 @@ const sharedRouteDeps = {
   previewCardsForResponse,
   sanitizeActivityText,
   inFlightStateForConversation,
+  resolveLiveTurnQueueRow,
   backgroundTaskStore,
   // A closure, not the registry itself: this deps object is built before the
   // preview lane is constructed further down the file.
@@ -6741,6 +6191,7 @@ const sharedRouteDeps = {
   readContextFromSessionEvents,
   sessionHistoryRefreshService,
   sdkSessionImportService,
+  copilotModelDiscoveryService,
   readSessionTranscriptMessages,
   readSessionUsageSummary,
   collectOrphanedUploadsFromConversation,
@@ -6783,15 +6234,24 @@ const sharedRouteDeps = {
   setTurnCeilingMinutes,
   getBackgroundTaskTimeoutMinutes,
   setBackgroundTaskTimeoutMinutes,
+  getFeatureFlagsSettingsState,
+  setFeatureFlagSetting,
+  getPwaAppName,
+  setPwaAppName,
   requestRelayShutdown,
   markSharedViewerPresence,
   getSharedWatcherCount,
   statusEventService,
   claudeAuthService,
   cliInstallService,
+  updateCheckService,
+  updateInstallService,
+  buildUpdateStatePayload,
+  runningVersion: RUNNING_VERSION,
   grokAuthService,
   imageOperationService,
   windowsAutostartService,
+  windowsBootAutostartService,
   pushDispatchService,
 };
 registerMessagesRoutes(app, sharedRouteDeps);
@@ -6895,6 +6355,8 @@ if (sweptUploads > 0) {
 }
 runtimeTimers.uploadSweep = setInterval(sweepUnreferencedUploadBlobs, 6 * 60 * 60 * 1000);
 if (typeof runtimeTimers.uploadSweep.unref === 'function') runtimeTimers.uploadSweep.unref();
+// Arms the 12h update poller only when the user opted in; otherwise silent.
+updateCheckService?.startIfEnabled();
 const runtimeBindingsBootstrapped = bootstrapRuntimeSessionBindings();
 if (runtimeBindingsBootstrapped > 0) {
   console.log(`${runtimeLogPrefix()}Runtime sessions bootstrapped: ${runtimeBindingsBootstrapped}`);
@@ -6959,7 +6421,10 @@ function ensureRuntimeSessionBinding(
   const normalizedModel = String(model || '').trim() || null;
   const normalizedSdkSessionId = String(sdkSessionId || '').trim() || null;
   if (normalizedSdkSessionId) {
-    stmts.setConvSdkSessionIdIfMissing.run(normalizedConversationId, nowIso, normalizedSdkSessionId);
+    // Statement shape is (sdk_session_id, updated_at, WHERE id): these args
+    // were swapped for as long as sdk session ids equalled conversation ids,
+    // which made the bug invisible — distinct ids made it a silent no-op.
+    stmts.setConvSdkSessionIdIfMissing.run(normalizedSdkSessionId, nowIso, normalizedConversationId);
   }
   const existing = stmts.getRuntimeSessionByConversation.get(normalizedConversationId);
   if (existing?.id) {
@@ -7113,25 +6578,10 @@ function sanitizeRelayQuestionRequest(requestBody) {
   }
 }
 
+// The allow-list lives in services/relay-question-context.mjs (unit-tested);
+// this binds it to the relay's own mode normalizer.
 function sanitizeRelayQuestionContext(rawContext) {
-  if (!rawContext || typeof rawContext !== 'object' || Array.isArray(rawContext)) return null;
-  const context = {};
-  if (typeof rawContext.source === 'string' && rawContext.source.trim()) {
-    context.source = rawContext.source.trim().slice(0, 64);
-  }
-  if (typeof rawContext.rationale === 'string' && rawContext.rationale.trim()) {
-    context.rationale = rawContext.rationale.trim().slice(0, 240);
-  }
-  if (typeof rawContext.queueMessageId === 'string' && rawContext.queueMessageId.trim()) {
-    context.queueMessageId = rawContext.queueMessageId.trim();
-  }
-  if (typeof rawContext.conversationId === 'string' && rawContext.conversationId.trim()) {
-    context.conversationId = rawContext.conversationId.trim();
-  }
-  if (typeof rawContext.relayMode === 'string' && rawContext.relayMode.trim()) {
-    context.relayMode = normalizeRelayMode(rawContext.relayMode) || DEFAULT_RELAY_MODE;
-  }
-  return Object.keys(context).length ? context : null;
+  return sanitizeRelayQuestionContextWith(rawContext, { normalizeRelayMode, defaultRelayMode: DEFAULT_RELAY_MODE });
 }
 
 
@@ -7303,9 +6753,19 @@ function shutdownRuntime(reason = 'unknown', { exitCode = 0 } = {}) {
   runtimeShutdownStarted = true;
   console.log(`${runtimeLogPrefix()}Runtime shutdown started (${reason}, exitCode=${runtimeShutdownExitCode})`);
   clearRuntimeTimers();
-  void sdkSessionImportService.dispose().catch((error) => {
+  try { updateCheckService?.stop(); } catch {}
+  // Started here (flips the importer's closing flag synchronously) but awaited
+  // below before the transports close: fire-and-forget disposal let a
+  // mid-import sweep keep running while the process exited under it.
+  const importerShutdown = sdkSessionImportService.dispose().catch((error) => {
     console.warn(`${runtimeLogPrefix()}SDK session importer shutdown failed: ${error?.message || error}`);
   });
+  // Same treatment for a model discovery in flight: its dispose() tears the
+  // live client down first, so this settles promptly rather than waiting out
+  // the discovery timeout (the force-exit timer below still caps everything).
+  const discoveryShutdown = copilotModelDiscoveryService.dispose().catch((error) => {
+    console.warn(`${runtimeLogPrefix()}Copilot model discovery shutdown failed: ${error?.message || error}`);
+  });
   try { claudeAuthService.dispose(); } catch (error) {
     console.warn(`${runtimeLogPrefix()}Claude auth service shutdown failed: ${error?.message || error}`);
   }
@@ -7364,7 +6824,12 @@ function shutdownRuntime(reason = 'unknown', { exitCode = 0 } = {}) {
     // inside the 2s force-exit budget above.
     // Deliberately not unref'd: this timer must fire for the process to exit
     // cleanly. The unref'd force-exit timer above is the backstop if it does not.
-    setTimeout(closeTransports, SHUTDOWN_SOCKET_FLUSH_MS);
+    // Importer and discovery disposal are awaited first so an in-flight
+    // session import or model discovery settles before the process exits; the
+    // force-exit timer caps how long that can take.
+    setTimeout(() => {
+      void Promise.allSettled([importerShutdown, discoveryShutdown]).then(closeTransports);
+    }, SHUTDOWN_SOCKET_FLUSH_MS);
   });
 
   return runtimeShutdownPromise;
@@ -7460,4 +6925,7 @@ httpServer.listen(config.port, listenHost, () => {
   void sdkSessionImportService.runStartupImport().catch((error) => {
     console.warn(`${runtimeLogPrefix()}SDK session import startup failed: ${error?.message || error}`);
   });
+  // Deferred and unref'd (a few seconds behind the startup import's own CLI
+  // spawn); a relay without an installed Copilot CLI skips it entirely.
+  copilotModelDiscoveryService.scheduleStartupRefresh();
 });