talon-agent 3.33.3 → 3.34.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "talon-agent",
-  "version": "3.33.3",
+  "version": "3.34.0",
   "description": "Multi-frontend AI agent with full tool access, streaming, cron jobs, and plugin system",
   "author": "Dylan Neve",
   "license": "MIT",
@@ -68,8 +68,8 @@
     "test:integration": "vitest run --reporter=verbose --reporter=json --outputFile=integration-results.json src/__tests__/integration/talon-mcp-functional.test.ts",
     "test:integration:all": "vitest run --reporter=verbose src/__tests__/integration/",
     "test:claude:backend": "vitest run --reporter=verbose --reporter=json --outputFile=claude-backend-results.json src/__tests__/integration/claude-live-discovery.test.ts",
-    "test:kilo:backend": "vitest run --reporter=verbose --reporter=json --outputFile=kilo-backend-results.json src/__tests__/integration/kilo-live-discovery.test.ts",
-    "test:opencode:backend": "vitest run --reporter=verbose --reporter=json --outputFile=opencode-backend-results.json src/__tests__/integration/opencode-live-discovery.test.ts",
+    "test:kilo:backend": "vitest run --reporter=verbose --reporter=json --outputFile=kilo-backend-results.json src/__tests__/integration/kilo-live-discovery.test.ts src/__tests__/integration/kilo-real-bootstrap.test.ts",
+    "test:opencode:backend": "vitest run --reporter=verbose --reporter=json --outputFile=opencode-backend-results.json src/__tests__/integration/opencode-live-discovery.test.ts src/__tests__/integration/opencode-real-bootstrap.test.ts",
     "test:codex:backend": "vitest run --reporter=verbose --reporter=json --outputFile=codex-backend-results.json src/__tests__/integration/codex-live-discovery.test.ts",
     "test:openai-agents:backend": "vitest run --reporter=verbose --reporter=json --outputFile=openai-agents-backend-results.json src/__tests__/integration/openai-agents-live-discovery.test.ts",
     "build:sql": "tsx scripts/embed-sql.ts",
@@ -83,6 +83,7 @@
     "lint": "oxlint src/",
     "depcruise": "node scripts/check-architecture.mjs",
     "ratchets": "node scripts/check-ratchets.mjs",
+    "function-size": "node scripts/check-function-size.mjs",
     "knip": "knip",
     "format": "prettier --write src/ prompts/",
     "format:check": "prettier --check src/ prompts/",
@@ -142,14 +143,14 @@
     "@types/node": "^26.0.0",
     "@types/qrcode-terminal": "^0.12.2",
     "@types/write-file-atomic": "^4.0.3",
-    "@vitest/coverage-v8": "^4.1.3",
+    "@vitest/coverage-v8": "^5.0.0",
     "dependency-cruiser": "^18.1.0",
     "fast-check": "^4.6.0",
     "knip": "^6.3.1",
     "oxlint": "^1.59.0",
     "prettier": "^3.8.1",
     "typescript": "^7.0.2",
-    "vitest": "^4.1.3"
+    "vitest": "^5.0.0"
   },
   "overrides": {
     "@anthropic-ai/sdk": "^0.104.1",

package/src/app.ts

@@ -27,6 +27,7 @@ import { pruneSettledTriggers } from "./storage/trigger-store.js";
 import { startWatchdog, stopWatchdog } from "./util/watchdog.js";
 import { spawnSuccessor } from "./util/respawn.js";
 import { log, logError, logWarn } from "./util/log.js";
+import { bootPhase, bootReport } from "./util/boot-timer.js";
 import {
   getVfs,
   mountNamespaceFs,
@@ -51,7 +52,7 @@ import {
   removePidRecordIfOwnedBy,
 } from "./core/daemon/pidfile.js";
 
-const { config } = await bootstrap();
+const { config } = await bootPhase("bootstrap", () => bootstrap());
 
 // Record this process as the daemon. The gateway port is appended once
 // the gateway binds (it may fall back from the default on EADDRINUSE).
@@ -69,15 +70,19 @@ gateway.onShutdownRequest((reason) => void gracefulShutdown(reason));
 const configuredFrontends = [...new Set(getFrontends(config))];
 
 const frontends: Frontend[] = [];
-for (const name of configuredFrontends) {
-  const frontend = await createFrontendById(name, config, gateway);
-  frontends.push(frontend);
-  log("bot", `Frontend: ${getFrontendDescriptor(name)?.label ?? name}`);
-}
+await bootPhase("frontends create", async () => {
+  for (const name of configuredFrontends) {
+    const frontend = await createFrontendById(name, config, gateway);
+    frontends.push(frontend);
+    log("bot", `Frontend: ${getFrontendDescriptor(name)?.label ?? name}`);
+  }
+});
 
 // ── Create backend + wire dispatcher ─────────────────────────────────────────
 
-const { backend } = await initBackendAndDispatcher(config, frontends);
+const { backend } = await bootPhase("backend + dispatcher", () =>
+  initBackendAndDispatcher(config, frontends),
+);
 gateway.backend = backend;
 
 // Subscribe the gateway to chat-role rebinds so `/model`, `/settings`,
@@ -303,7 +308,10 @@ async function main(): Promise<void> {
       "Terminal frontend shares stdin with the other frontends; it will run alongside them without blocking startup.",
     );
   }
-  await Promise.all(blockingFrontends.map((frontend) => frontend.start()));
+  await bootPhase("frontends start", () =>
+    Promise.all(blockingFrontends.map((frontend) => frontend.start())),
+  );
+  log("bot", `Ready in ${bootReport()}`);
   for (const frontend of stdinFrontends) {
     void frontend
       .start()

package/src/backend/claude-sdk/stream.ts

@@ -334,6 +334,79 @@ export function extractToolResults(msg: SDKUserMessage): ToolResultInfo[] {
   return results;
 }
 
+/** Context fill of the last API iteration + whether the turn's first request hit the cache. */
+function readContextFill(
+  state: StreamState,
+  usage: SDKResultMessage["usage"],
+): void {
+  if (
+    !usage ||
+    !Array.isArray(usage.iterations) ||
+    usage.iterations.length === 0
+  )
+    return;
+  const last = usage.iterations[usage.iterations.length - 1];
+  state.contextTokens =
+    (last.input_tokens ?? 0) +
+    (last.cache_read_input_tokens ?? 0) +
+    (last.cache_creation_input_tokens ?? 0);
+  // The same array answers a question the per-turn totals can't: whether
+  // the FIRST request of this turn read a cache or paid to write one.
+  state.cacheStats = turnCacheStats(usage.iterations);
+}
+
+/**
+ * Token counts from the ACTIVE model's usage only. modelUsage is keyed by
+ * the exact SDK model string (e.g. "sonnet[1m]") and holds cumulative
+ * session totals per model — summing all entries double-counts when
+ * switching models mid-session.
+ */
+function readModelUsage(
+  state: StreamState,
+  modelUsage: Record<string, ModelUsage>,
+  sdkModel: string,
+): void {
+  // Drift check: modelUsage is keyed by the model that ACTUALLY served
+  // the turn. If none of the keys is (an alias of) the model we asked
+  // for, the API substituted — warn instead of burying it in the
+  // accounting line.
+  checkModelDrift(sdkModel, Object.keys(modelUsage ?? {}));
+  const mu = modelUsage[sdkModel] ?? Object.values(modelUsage).at(-1);
+  if (!mu) return;
+  state.sdkInputTokens = mu.inputTokens ?? 0;
+  state.sdkOutputTokens = mu.outputTokens ?? 0;
+  state.sdkCacheRead = mu.cacheReadInputTokens ?? 0;
+  state.sdkCacheWrite = mu.cacheCreationInputTokens ?? 0;
+  if (mu.contextWindow > 0) {
+    state.contextWindow = mu.contextWindow;
+  }
+}
+
+/**
+ * Failed turn. Two shapes (see StreamState.resultErrorText):
+ *  - error subtype: no `result` field, but `errors[]` carries diagnostics.
+ *  - success subtype with is_error: `result` (and the trailing assistant
+ *    text) IS the API error message, e.g. "You've hit your weekly limit
+ *    · resets Jul 10, 9am". Prefer that text — it's the user-facing one.
+ */
+function readResultError(msg: SDKResultMessage, state: StreamState): void {
+  if (msg.subtype !== "success") {
+    const diagnostics = (msg.errors ?? [])
+      .filter((e) => typeof e === "string" && !e.startsWith("[ede_diagnostic]"))
+      .join("; ")
+      .slice(0, 500);
+    state.resultErrorText =
+      state.lastTrailingText.trim() ||
+      diagnostics ||
+      `Claude SDK turn failed (${msg.subtype})`;
+  } else if (msg.is_error) {
+    state.resultErrorText =
+      (typeof msg.result === "string" && msg.result.trim()) ||
+      state.lastTrailingText.trim() ||
+      "Claude SDK turn failed (API error)";
+  }
+}
+
 /**
  * Process the final result message — extracts token counts, context info,
  * and API call counts from the typed SDK result.
@@ -350,39 +423,8 @@ export function processResultMessage(
     state.costUsd = msg.total_cost_usd;
   }
 
-  // Context fill from last API iteration
-  const usage = msg.usage;
-  if (usage && Array.isArray(usage.iterations) && usage.iterations.length > 0) {
-    const last = usage.iterations[usage.iterations.length - 1];
-    state.contextTokens =
-      (last.input_tokens ?? 0) +
-      (last.cache_read_input_tokens ?? 0) +
-      (last.cache_creation_input_tokens ?? 0);
-    // The same array answers a question the per-turn totals can't: whether
-    // the FIRST request of this turn read a cache or paid to write one.
-    state.cacheStats = turnCacheStats(usage.iterations);
-  }
-
-  // Read token counts from the ACTIVE model's usage only.
-  // modelUsage is keyed by the exact SDK model string (e.g. "sonnet[1m]")
-  // and contains cumulative session totals per model — summing all entries
-  // double-counts when switching models mid-session.
-  const modelUsage: Record<string, ModelUsage> = msg.modelUsage;
-  // Drift check: modelUsage is keyed by the model that ACTUALLY served
-  // the turn. If none of the keys is (an alias of) the model we asked
-  // for, the API substituted — warn instead of burying it in the
-  // accounting line.
-  checkModelDrift(sdkModel, Object.keys(modelUsage ?? {}));
-  const mu = modelUsage[sdkModel] ?? Object.values(modelUsage).at(-1);
-  if (mu) {
-    state.sdkInputTokens = mu.inputTokens ?? 0;
-    state.sdkOutputTokens = mu.outputTokens ?? 0;
-    state.sdkCacheRead = mu.cacheReadInputTokens ?? 0;
-    state.sdkCacheWrite = mu.cacheCreationInputTokens ?? 0;
-    if (mu.contextWindow > 0) {
-      state.contextWindow = mu.contextWindow;
-    }
-  }
+  readContextFill(state, msg.usage);
+  readModelUsage(state, msg.modelUsage, sdkModel);
 
   log(
     "agent",
@@ -400,26 +442,7 @@ export function processResultMessage(
     state.currentBlockText = msg.result;
   }
 
-  // Failed turn. Two shapes (see StreamState.resultErrorText):
-  //  - error subtype: no `result` field, but `errors[]` carries diagnostics.
-  //  - success subtype with is_error: `result` (and the trailing assistant
-  //    text) IS the API error message, e.g. "You've hit your weekly limit
-  //    · resets Jul 10, 9am". Prefer that text — it's the user-facing one.
-  if (msg.subtype !== "success") {
-    const diagnostics = (msg.errors ?? [])
-      .filter((e) => typeof e === "string" && !e.startsWith("[ede_diagnostic]"))
-      .join("; ")
-      .slice(0, 500);
-    state.resultErrorText =
-      state.lastTrailingText.trim() ||
-      diagnostics ||
-      `Claude SDK turn failed (${msg.subtype})`;
-  } else if (msg.is_error) {
-    state.resultErrorText =
-      (typeof msg.result === "string" && msg.result.trim()) ||
-      state.lastTrailingText.trim() ||
-      "Claude SDK turn failed (API error)";
-  }
+  readResultError(msg, state);
 }
 
 // ── Trailing-text fallback dedup ────────────────────────────────────────────

package/src/backend/remote-server/turn.ts

@@ -241,6 +241,60 @@ interface SubscribeInputs {
   abortSignal: AbortSignal;
 }
 
+/** The SSE wire format wraps every event in `{payload: {type, properties}}`. */
+function unwrapSseEvent(
+  evt: unknown,
+): { type?: string; properties?: Record<string, unknown> } | undefined {
+  if (!evt || typeof evt !== "object") return undefined;
+  const payload =
+    "payload" in evt ? (evt as { payload?: unknown }).payload : evt;
+  if (!payload || typeof payload !== "object") return undefined;
+  return payload as { type?: string; properties?: Record<string, unknown> };
+}
+
+/**
+ * A `session.error` on the global stream: ignored when it belongs to
+ * another session (a heartbeat's error must not pollute this chat's log),
+ * stashed as the turn's synthetic error otherwise. Returns whether the
+ * event was ours — ours ends the turn, since the server produces nothing
+ * more for this prompt.
+ */
+function noteSessionError(
+  props: Record<string, unknown>,
+  inputs: Pick<SubscribeInputs, "label" | "sessionId" | "state" | "chatId">,
+): "ours" | "other" {
+  const evtSessionID =
+    typeof props.sessionID === "string" ? props.sessionID : undefined;
+  if (evtSessionID && evtSessionID !== inputs.sessionId) return "other";
+  const errProp = props.error as
+    | { name?: string; message?: string; data?: Record<string, unknown> }
+    | undefined;
+  // MessageAbortedError is expected for an explicit user interrupt.
+  const isOurAbort =
+    inputs.state.turnTerminated &&
+    (errProp?.name === "MessageAbortedError" ||
+      /abort/i.test(errProp?.name ?? "") ||
+      /abort/i.test(errProp?.message ?? ""));
+  if (errProp && !isOurAbort) {
+    const detail = [
+      errProp.name && `name=${errProp.name}`,
+      errProp.message && `message=${errProp.message}`,
+      errProp.data && `data=${JSON.stringify(errProp.data)}`,
+    ]
+      .filter(Boolean)
+      .join(" ");
+    logWarn(
+      "agent",
+      `[${inputs.chatId}] ${inputs.label} session.error: ${detail}`,
+    );
+    // Stash the error message so the handler's delivery branch can
+    // surface it as `⚠️ <label>: <message>` instead of silence.
+    const msg = errProp.message ?? errProp.name;
+    if (msg) inputs.state.syntheticError = msg;
+  }
+  return "ours";
+}
+
 /**
  * Subscribe to the server's global SSE event stream and translate relevant
  * events into stream-state mutations / callback firings. Only events scoped
@@ -271,61 +325,12 @@ async function subscribeToTurnEvents(inputs: SubscribeInputs): Promise<void> {
   try {
     for await (const evt of stream) {
       if (abortSignal.aborted) break;
-      if (!evt || typeof evt !== "object") continue;
-
-      // The SSE wire format wraps every event in `{payload: {type,
-      // properties}}`. Unwrap here so type/properties land where the rest
-      // of the loop expects them.
-      const payload =
-        "payload" in evt ? (evt as { payload?: unknown }).payload : evt;
-      if (!payload || typeof payload !== "object") continue;
-      const event = payload as {
-        type?: string;
-        properties?: Record<string, unknown>;
-      };
+      const event = unwrapSseEvent(evt);
+      if (!event) continue;
 
-      // session.error is observed here for logging; everything else goes
-      // through the shared pure helper. The SSE stream is global, so
-      // scope-filter to our own sessionId before attributing the error to
-      // this chat — a heartbeat session.error would otherwise pollute the
-      // chat's log.
       if (event.type === "session.error") {
-        const props = event.properties ?? {};
-        const evtSessionID =
-          typeof props.sessionID === "string" ? props.sessionID : undefined;
-        if (evtSessionID && evtSessionID !== sessionId) {
-          continue;
-        }
-        const errProp = props.error as
-          | {
-              name?: string;
-              message?: string;
-              data?: Record<string, unknown>;
-            }
-          | undefined;
-        // MessageAbortedError is expected for an explicit user interrupt.
-        const isOurAbort =
-          state.turnTerminated &&
-          (errProp?.name === "MessageAbortedError" ||
-            /abort/i.test(errProp?.name ?? "") ||
-            /abort/i.test(errProp?.message ?? ""));
-        if (errProp && !isOurAbort) {
-          const detail = [
-            errProp.name && `name=${errProp.name}`,
-            errProp.message && `message=${errProp.message}`,
-            errProp.data && `data=${JSON.stringify(errProp.data)}`,
-          ]
-            .filter(Boolean)
-            .join(" ");
-          logWarn("agent", `[${chatId}] ${label} session.error: ${detail}`);
-          // Stash the error message so the handler's delivery branch can
-          // surface it as `⚠️ <label>: <message>` instead of silence.
-          const msg = errProp.message ?? errProp.name;
-          if (msg) state.syntheticError = msg;
-        }
-        // session.error for OUR session ends the turn — the server isn't
-        // going to produce more events for this prompt.
-        return;
+        if (noteSessionError(event.properties ?? {}, inputs) === "ours") return;
+        continue;
       }
 
       const outcome = await processStreamEvent(event, {
@@ -338,7 +343,6 @@ async function subscribeToTurnEvents(inputs: SubscribeInputs): Promise<void> {
         onTextBlock,
         onToolUse,
       });
-
       if (outcome.kind === "terminator_fired") {
         // tool_calls counter increment happens per-tool inside
         // events.ts processPartUpdate. Don't double-count here.
@@ -347,7 +351,6 @@ async function subscribeToTurnEvents(inputs: SubscribeInputs): Promise<void> {
         // Delivery is already complete, so wait for natural idle instead.
         continue;
       }
-
       if (outcome.kind === "stop") {
         if (outcome.reason === "out_of_scope") continue;
         return; // turn.close or idle — stop iterating

package/src/bootstrap.ts

@@ -35,6 +35,8 @@ import {
 import { initDream, maybeStartDream } from "./core/background/dream.js";
 import { initHeartbeat } from "./core/background/heartbeat/index.js";
 import { log, logWarn, logDebug } from "./util/log.js";
+import { bootPhase } from "./util/boot-timer.js";
+import { mapConcurrent } from "./util/concurrency.js";
 import type { TalonConfig } from "./util/config.js";
 import { resolveFrontendIdAmong } from "./core/frontend-runtime/routing.js";
 import type { Frontend } from "./core/frontend-runtime/index.js";
@@ -122,11 +124,11 @@ export async function bootstrap(
       const frontends =
         options.frontendNames ??
         (Array.isArray(config.frontend) ? config.frontend : [config.frontend]);
-      await loadPlugins(config.plugins, frontends);
+      await bootPhase("plugins", () => loadPlugins(config.plugins, frontends));
     }
 
     // Built-in plugins (GitHub, MemPalace, mem0, Playwright) — shared with hot-reload
-    await loadBuiltinPlugins(config);
+    await bootPhase("builtin plugins", () => loadBuiltinPlugins(config));
 
     rebuildSystemPrompt(config, getPluginPromptAdditions());
   }
@@ -143,12 +145,14 @@ export async function bootstrap(
   });
 
   initWorkspace(config.workspace);
-  loadSessions();
-  loadChatSettings();
-  loadCronJobs();
-  loadTriggers();
-  loadHistory();
-  loadMediaIndex();
+  await bootPhase("stores", () => {
+    loadSessions();
+    loadChatSettings();
+    loadCronJobs();
+    loadTriggers();
+    loadHistory();
+    loadMediaIndex();
+  });
   cleanupOldLogs();
 
   return { config };
@@ -165,6 +169,104 @@ export async function bootstrap(
  * heartbeat all read through `getActiveBackend()` so a runtime swap
  * via `switchBackend(id, config)` propagates without any re-init.
  */
+/** The backend-controller surface `reconcileChatBindings` needs. */
+type ChatBindingDeps = {
+  isBackendAvailable: (id: string, config: TalonConfig) => boolean;
+  releaseChat: (chatId: string) => Promise<void>;
+  rebindChat: (
+    chatId: string,
+    backendId: string,
+    config: TalonConfig,
+  ) => Promise<{ ok: boolean; error?: string }>;
+  getBackendIdForChat: (chatId: string) => string;
+  getBackendForChat: (chatId: string) => Backend;
+  isModelValidForBackend: (backend: Backend, model: string) => Promise<boolean>;
+};
+
+const CHAT_BINDING_CONCURRENCY = 8;
+const REBIND_RETRY_DELAY_MS = 1_500;
+
+/**
+ * Re-establish every chat's stored backend/model override against the
+ * backends this boot actually has. Chats are independent, so they are
+ * reconciled `CHAT_BINDING_CONCURRENCY` at a time; a shared backend that
+ * two chats need at once is initialised exactly once by the pool.
+ */
+export async function reconcileChatBindings(
+  config: TalonConfig,
+  deps: ChatBindingDeps,
+): Promise<void> {
+  const { getAllChatSettings } = await import("./storage/chat-settings.js");
+  await mapConcurrent(
+    Object.entries(getAllChatSettings()),
+    CHAT_BINDING_CONCURRENCY,
+    ([cid, settings]) => reconcileChatBinding(cid, settings, config, deps),
+  );
+}
+
+async function reconcileChatBinding(
+  cid: string,
+  settings: { backend?: string; model?: string },
+  config: TalonConfig,
+  deps: ChatBindingDeps,
+): Promise<void> {
+  const { getAllChatSettings, setChatBackend, setChatModel } =
+    await import("./storage/chat-settings.js");
+  let resetVolatileState = false;
+  if (settings.backend) {
+    if (!deps.isBackendAvailable(settings.backend, config)) {
+      log(
+        "bot",
+        `Per-chat backend ${settings.backend} for ${cid} is no longer available — resetting chat to default backend`,
+      );
+      await deps.releaseChat(cid);
+      setChatBackend(cid, undefined);
+      setChatModel(cid, undefined);
+      resetVolatileState = true;
+    } else {
+      let result = await deps.rebindChat(cid, settings.backend, config);
+      if (!result.ok) {
+        await new Promise((r) => setTimeout(r, REBIND_RETRY_DELAY_MS));
+        result = await deps.rebindChat(cid, settings.backend, config);
+      }
+      if (!result.ok) {
+        log(
+          "bot",
+          `Per-chat backend rebind failed for ${cid} → ${settings.backend}: ${result.error} — keeping the setting; will serve on the default backend until re-selected`,
+        );
+      }
+    }
+  }
+  const bindingMatchesSetting =
+    !settings.backend || deps.getBackendIdForChat(cid) === settings.backend;
+  const currentModel = getAllChatSettings()[cid]?.model;
+  if (currentModel && bindingMatchesSetting) {
+    const be = deps.getBackendForChat(cid);
+    try {
+      const valid = await deps.isModelValidForBackend(be, currentModel);
+      if (!valid) {
+        log(
+          "bot",
+          `Per-chat model ${currentModel} for ${cid} is not valid for its backend — resetting model to default`,
+        );
+        setChatModel(cid, undefined);
+        resetVolatileState = true;
+      }
+    } catch (err) {
+      log(
+        "bot",
+        `Per-chat model validation failed for ${cid} (${currentModel}): ${
+          err instanceof Error ? err.message : String(err)
+        } — keeping stored model`,
+      );
+    }
+  }
+  if (resetVolatileState) {
+    resetSession(cid);
+    clearHistory(cid);
+  }
+}
+
 export async function initBackendAndDispatcher(
   config: TalonConfig,
   frontend: FrontendSelection,
@@ -258,77 +360,16 @@ export async function initBackendAndDispatcher(
   // for the backend that would serve it, clear the override and reset
   // volatile chat state so the next user message starts a fresh default
   // session instead of crashing on an orphaned model id.
-  const { getAllChatSettings, setChatBackend, setChatModel } =
-    await import("./storage/chat-settings.js");
-  for (const [cid, settings] of Object.entries(getAllChatSettings())) {
-    let resetVolatileState = false;
-
-    if (settings.backend) {
-      if (!isBackendAvailable(settings.backend, config)) {
-        log(
-          "bot",
-          `Per-chat backend ${settings.backend} for ${cid} is no longer available — resetting chat to default backend`,
-        );
-        await releaseChat(cid);
-        setChatBackend(cid, undefined);
-        setChatModel(cid, undefined);
-        resetVolatileState = true;
-      } else {
-        // A boot-time rebind failure is usually TRANSIENT (backend slow to
-        // spawn, auth endpoint briefly unreachable) — it must not destroy
-        // the user's persisted choice, session, and history. Retry once,
-        // then keep the setting and move on: the chat runs on the default
-        // backend until a later switch succeeds, and clients keep showing
-        // the user's chosen backend from settings (the source of truth).
-        let result = await rebindChat(cid, settings.backend, config);
-        if (!result.ok) {
-          await new Promise((r) => setTimeout(r, 1500));
-          result = await rebindChat(cid, settings.backend, config);
-        }
-        if (!result.ok) {
-          log(
-            "bot",
-            `Per-chat backend rebind failed for ${cid} → ${settings.backend}: ${result.error} — keeping the setting; will serve on the default backend until re-selected`,
-          );
-        }
-      }
-    }
-
-    // Only validate the stored model against the backend that will really
-    // serve this chat. After a kept-but-unbound override (transient rebind
-    // failure above) the chat temporarily runs on the default backend — the
-    // stored model belongs to the chosen backend, so validating it against
-    // the default would wrongly clear it.
-    const bindingMatchesSetting =
-      !settings.backend || getBackendIdForChat(cid) === settings.backend;
-    const currentModel = getAllChatSettings()[cid]?.model;
-    if (currentModel && bindingMatchesSetting) {
-      const be = getBackendForChat(cid);
-      try {
-        const valid = await isModelValidForBackend(be, currentModel);
-        if (!valid) {
-          log(
-            "bot",
-            `Per-chat model ${currentModel} for ${cid} is not valid for its backend — resetting model to default`,
-          );
-          setChatModel(cid, undefined);
-          resetVolatileState = true;
-        }
-      } catch (err) {
-        log(
-          "bot",
-          `Per-chat model validation failed for ${cid} (${currentModel}): ${
-            err instanceof Error ? err.message : String(err)
-          } — keeping stored model`,
-        );
-      }
-    }
-
-    if (resetVolatileState) {
-      resetSession(cid);
-      clearHistory(cid);
-    }
-  }
+  await bootPhase("chat bindings", () =>
+    reconcileChatBindings(config, {
+      isBackendAvailable,
+      releaseChat,
+      rebindChat,
+      getBackendIdForChat,
+      getBackendForChat,
+      isModelValidForBackend,
+    }),
+  );
 
   initDispatcher({
     // Dispatcher reads the backend per query so per-chat overrides