per-session models: every session owns its model + thinking level from birth

The reported bug (2026-09-28): every chat ran glm-5.3-flash regardless of
any pick, while composer and settings UIs agreed with each other and lied
about the run. Root cause: a fossil default-settings record (settings.json
chat section, frozen pre-slots-wave) was stamped verbatim into every new
chat at birth by the new-session flow, and resolveConversationSpec prefers
the per-chat record over the strong slot forever.

Owner redesign — models are per session, always; the strong slot is the
new-session default:

- POST /api/chats stamps the newborn verbatim from the strong slot
  (model + thinking level); no client settings PUT on create anymore
- the composer control is dual-bound: in-session it reads/writes the
  session's own record (GET /api/chats/:id, PUT .../settings); on the
  draft surfaces it binds the strong slot (picking there = changing the
  default)
- thinking levels follow the identical mechanics (confirmed by owner)
- the zombie default-settings system dies whole: useDefaultSettings,
  /api/settings/defaults, src/store/default-settings.ts, the chat
  section of UserSettings (sanitizer strips fossil copies), the legacy
  default-settings.json fold, and DEFAULT_SETTINGS_FILE
- catalogDefaultsFor collapses to the strong slot alone
- thinking display for a legacy unstamped session resolves exactly like
  the engine (session ?? strong ?? model ladder)

Tests: new chat-birth-stamp suite pins the stamp, the unconfigured boot,
the unset level, and the copy-not-live-view regression; defaults pins
rewritten strong-only; legacy-migration suite deleted.

components/chat.tsx

@@ -1672,6 +1672,7 @@ function DockOverlay({
 					<StatsBar
 						turns={turns}
 						dictationSlot={dictationSlot}
+						chatId={chatId}
 					/>
 					{/* The scroll-down disc (moved here from the Conversation,
 					    owner refinement round 2026-09-24): anchored to the BLOCK's

components/default-settings.ts

@@ -1,44 +0,0 @@
-"use client";
-
-/**
- * THE default settings (owner, 2026-09-18): the new-session surfaces'
- * model + thinking + knowledge-context controls are the settings page for
- * the default model. There is NO baked-in default — BYOK first boot shows
- * "no model" until the user picks one, and their last choice IS the
- * default from then on. Both surfaces (the home graph view's topic dock
- * and /chat/new) share ONE server-side record (GET/PUT
- * /api/settings/defaults → data/default-settings.json).
- *
- * No loading state, no flash: the PAGES server-render the record
- * (readDefaultSettings → initialSettings), so the controls show truth on
- * the first frame — dynamic routes aren't cached client-side (staleTimes
- * .dynamic = 0), so every navigation gets fresh server truth. This hook
- * only holds the state between saves: initialSettings seeds it, and every
- * change applies locally (optimistic — the controls only send valid
- * values: the picker offers catalog models, the slider sends its stops)
- * and persists fire-and-forget; a failed write logs, and the next
- * navigation re-reads the persisted truth.
- */
-
-import { useCallback, useState } from "react";
-import type { ChatSettings } from "@/src/core";
-
-export function useDefaultSettings(initialSettings: ChatSettings | null): {
-	settings: ChatSettings | undefined;
-	save: (settings: ChatSettings) => void;
-} {
-	const [settings, setSettings] = useState<ChatSettings | undefined>(initialSettings ?? undefined);
-
-	const save = useCallback((next: ChatSettings) => {
-		setSettings(next);
-		void fetch("/api/settings/defaults", {
-			method: "PUT",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify(next),
-		}).catch((err: unknown) => {
-			console.error("default settings write failed:", err);
-		});
-	}, []);
-
-	return { settings, save };
-}

components/home.tsx

@@ -6,11 +6,10 @@ import { CornerDownLeftIcon } from "lucide-react";
 import { GraphView } from "@/components/graph-view";
 import { SetupDialog } from "@/components/setup-dialog";
 import { useStrongKeyless, useZeroKeys, ZeroKeysPill } from "@/components/setup-cta";
-import { useDefaultSettings } from "@/components/default-settings";
 import { DictationBar, useDictation } from "@/components/dictation";
 import { SidebarToggle } from "@/components/sidebar";
 import { StatsBar } from "@/components/stats-bar";
-import type { ChatSettings, TurnUsage } from "@/src/core";
+import type { TurnUsage } from "@/src/core";
 
 /**
  * Home — the knowledge graph is the main view, full-bleed edge to edge
@@ -18,7 +17,7 @@ import type { ChatSettings, TurnUsage } from "@/src/core";
  * under the header and the new-session dock, both of which float over it
  * with no gradient scrims. Sessions live in the toggleable sidebar.
  */
-export function Home({ initialSettings, initialConfigured }: { initialSettings: ChatSettings | null; initialConfigured: boolean }) {
+export function Home({ initialConfigured }: { initialConfigured: boolean }) {
 	const router = useRouter();
 	const [topic, setTopic] = useState("");
 	// First-run gate (model-slots wave, owner 2026-09-20): chats cannot
@@ -41,13 +40,6 @@ export function Home({ initialSettings, initialConfigured }: { initialSettings:
 		append: (t) => setTopic((v) => (v ? v.replace(/\s+$/, "") + " " + t : t)),
 	});
 	const [busy, setBusy] = useState(false);
-	// THE default settings (owner, 2026-09-18): this topic dock IS the
-	// settings page for the default model — no baked-in default exists; the
-	// user's last choice (server-rendered in via initialSettings, shared
-	// with /chat/new through data/default-settings.json) IS the default.
-	// Still carried to the chat POST then PUT-on-create (the model picker
-	// defers its save when chatId is empty; see components/model-picker).
-	const { settings, save: saveDraft } = useDefaultSettings(initialSettings);
 
 	const start = async (force = false) => {
 		const t = topic.trim();
@@ -79,14 +71,9 @@ export function Home({ initialSettings, initialConfigured }: { initialSettings:
 				body: JSON.stringify({ title: t }),
 			});
 			const { id } = (await res.json()) as { id: string };
-			if (settings) {
-				// Best-effort persist — the selection was made pre-chat.
-				await fetch(`/api/chats/${id}/settings`, {
-					method: "PUT",
-					headers: { "Content-Type": "application/json" },
-					body: JSON.stringify(settings),
-				}).catch(() => {});
-			}
+			// No settings PUT on create (per-session models, owner
+			// 2026-09-28): the SERVER stamps the newborn from the strong
+			// slot — the same default this surface's model control edits.
 			router.push(`/chat/${id}?prompt=${encodeURIComponent(t)}`);
 		} catch {
 			setBusy(false);

components/model-picker.tsx

@@ -1,7 +1,7 @@
 "use client";
 
 import { useCallback, useEffect, useRef, useState } from "react";
-import type { ModelCatalogEntry, ModelCatalogResponse, ModelsSettings, UserSettings } from "@/src/core";
+import type { ChatSettings, ModelCatalogEntry, ModelCatalogResponse, ModelsSettings, UserSettings } from "@/src/core";
 import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
 import { prettyModel } from "@/components/usage-format";
 import { ModelMenuList, ThinkingMenuList } from "@/components/settings/model-menu";
@@ -77,23 +77,25 @@ export function catalogLimits(catalog: Pick<ModelCatalogResponse, "models">): Ma
 }
 
 /**
- * THE STRONG-SLOT CONTROL (fix wave, owner ruling: "one and the same").
- * The composer's model + thinking pills ARE the strong slot — the tier
- * that runs prober + teacher. Reads: the raw models section (GET
- * /api/settings) for the user's pick, plus the federated catalog for the
- * menus. Writes: PUT /api/settings/models via composeSlotModel — the same
- * seam the settings Agent section and the SetupDialog write, so there is
- * exactly one strong slot in the world and every surface edits it.
+ * THE CONVERSATION MODEL CONTROL — dual-bound (owner, per-session models,
+ * 2026-09-28). WITH a chatId (the in-session stats bar): the pills bind
+ * THE SESSION'S OWN record — reads GET /api/chats/:id (its settings field;
+ * a legacy unstamped record falls back to the strong slot's display,
+ * exactly what the engine resolves), writes PUT /api/chats/:id/settings
+ * (validated + level-clamped server-side). The session owns its model +
+ * thinking level from birth; the strong slot never reaches it again.
  *
- * Unpicked reads "—" (the no-factory-fallback language: the UI never
- * presents a default model; the engine-side pin still resolves, the UI
- * never claims it). Legacy per-chat model overrides on old records keep
- * resolving server-side — the UI simply no longer writes that field
- * anywhere.
+ * WITHOUT a chatId (the draft surfaces — home + /chat/new): the pills
+ * bind the STRONG SLOT (reads the raw models section, GET /api/settings;
+ * writes PUT /api/settings/models via composeSlotModel — the same seam
+ * the settings Agent section and the SetupDialog write): picking there IS
+ * changing the new-session default. Unpicked reads "—" (the
+ * no-factory-fallback language: the UI never presents a default model).
  */
-export function ModelControl() {
+export function ModelControl({ chatId }: { chatId?: string }) {
 	const { catalog, refresh } = useModelCatalog();
 	const [models, setModels] = useState<ModelsSettings | undefined>();
+	const [session, setSession] = useState<ChatSettings | undefined>();
 	const [open, setOpen] = useState<"model" | "thinking" | null>(null);
 	const [error, setError] = useState<string | null>(null);
 	const containerRef = useRef<HTMLDivElement>(null);
@@ -101,7 +103,19 @@ export function ModelControl() {
 	// The record read — BOTH mount and the cross-surface signal land
 	// here (fix wave: another surface's models write re-reads into the
 	// pill live; own writes also notify, and the refetch is idempotent).
+	// Dual-bound: chat mode reads BOTH the session record (the source of
+	// truth) and the models section (the display fallback for a legacy
+	// unstamped session — exactly what the engine resolves); draft mode
+	// reads the models section alone.
 	const readRecord = useCallback(() => {
+		if (chatId) {
+			fetch(`/api/chats/${chatId}`)
+				.then((r) => r.json() as Promise<{ settings?: ChatSettings }>)
+				.then((body) => setSession(body.settings))
+				.catch(() => {
+					/* same read-only posture as a models-section failure */
+				});
+		}
 		fetch("/api/settings")
 			.then((r) => r.json() as Promise<{ settings: { models?: ModelsSettings } | null }>)
 			.then((body) => setModels(body.settings?.models ?? undefined))
@@ -110,7 +124,7 @@ export function ModelControl() {
 				   ("—" triggers, closed menus) — same posture as a
 				   catalog failure */
 			});
-	}, []);
+	}, [chatId]);
 
 	useEffect(() => {
 		readRecord();
@@ -120,7 +134,17 @@ export function ModelControl() {
 		if (section === "models") readRecord();
 	});
 
-	const override = models?.strong;
+	// Dual-bound truth: chat mode displays the session's own record,
+	// falling back to the strong slot for legacy unstamped sessions —
+	// EXACTLY what resolveConversationSpec runs. Draft mode is the strong
+	// slot itself.
+	const strong = models?.strong;
+	const override: ChatSettings | undefined = chatId
+		? {
+				model: session?.model ?? strong?.model,
+				thinkingLevel: session?.thinkingLevel ?? strong?.thinkingLevel,
+			}
+		: strong;
 	const effectiveId = override?.model?.id;
 	const effectiveProvider = override?.model?.provider;
 	const storedLevel = override?.thinkingLevel;
@@ -200,6 +224,51 @@ export function ModelControl() {
 		[],
 	);
 
+	// The session write seam (chat mode): PUT the per-chat settings route
+	// — validated + level-clamped server-side; the response is the stored
+	// truth (a pick riding an unsupported level lands CLAMPED — the pill
+	// shows the stored value). No notifySettingsSaved: the write touches
+	// one session's record, not the slots — no other surface reads it.
+	const saveChat = useCallback(
+		async (next: ChatSettings) => {
+			setError(null);
+			try {
+				const res = await fetch(`/api/chats/${chatId}/settings`, {
+					method: "PUT",
+					headers: { "Content-Type": "application/json" },
+					body: JSON.stringify(next),
+				});
+				if (!res.ok) {
+					const body = (await res.json().catch(() => ({}))) as { error?: string };
+					setError(body.error ?? `settings rejected (${res.status})`);
+					return;
+				}
+				const stored = (await res.json().catch(() => null)) as { settings?: ChatSettings } | null;
+				setSession(stored?.settings ?? next);
+				setOpen(null);
+			} catch {
+				setError("Could not reach the server — try again.");
+			}
+		},
+		[chatId],
+	);
+
+	// One apply seam over both write paths: a pick names provider + id +
+	// level; chat mode writes the session's own record (any pick pins it),
+	// draft mode composes the strong slot (siblings preserved,
+	// replace-whole-section discipline).
+	const apply = useCallback(
+		(provider: string, id: string, level: ThinkingLevel | undefined) => {
+			if (chatId) {
+				void saveChat({ model: { provider, id }, thinkingLevel: level });
+			} else {
+				// composeSlotModel's empty-string convention: no level = unset.
+				void save(composeSlotModel(models, "strong", provider, id, level ?? ""));
+			}
+		},
+		[chatId, models, save, saveChat],
+	);
+
 	// Shortcut seams (keyboard wave A): ⌘K opens the model menu (the
 	// universal command convention); Shift+Tab cycles the thinking level
 	// up the ladder (wrapping) — the owner's replacement for browser
@@ -220,11 +289,11 @@ export function ModelControl() {
 			const idx = effectiveLevel === undefined ? -1 : levels.indexOf(effectiveLevel);
 			const next = levels[(idx + 1) % levels.length];
 			if (next === undefined) return;
-			void save(composeSlotModel(models, "strong", effectiveProvider ?? "", effectiveId ?? "", next));
+			apply(effectiveProvider ?? "", effectiveId ?? "", next);
 		};
 		window.addEventListener("lh:kbd-cycle-thinking", onCycleThinking);
 		return () => window.removeEventListener("lh:kbd-cycle-thinking", onCycleThinking);
-	}, [levels, effectiveLevel, effectiveProvider, effectiveId, models, save]);
+	}, [levels, effectiveLevel, effectiveProvider, effectiveId, apply]);
 
 	// Selecting a model (click and Enter share one path): keep the
 	// thinking level only when the new model supports it — otherwise
@@ -239,7 +308,7 @@ export function ModelControl() {
 		// rides — it belongs to the OLD model; the fresh pick's level comes
 		// from the fresh model's own ladder.)
 		const nextLevel = populateLevel(storedLevel, m.supportedLevels);
-		void save(composeSlotModel(models, "strong", m.provider, m.id, nextLevel));
+		apply(m.provider, m.id, nextLevel);
 	};
 
 	// Stale-while-revalidate on manual open too (⌘K covers the keyboard
@@ -328,7 +397,9 @@ export function ModelControl() {
 						footer={
 							catalog && catalog.models.length === 0
 								? "No models — add a provider key in Keys"
-								: "Strong tier — runs prober + teacher, app-wide"
+								: chatId
+									? "This session's model"
+									: "Strong tier — the default for new sessions"
 						}
 					/>
 				</MenuShell>
@@ -344,9 +415,7 @@ export function ModelControl() {
 					<ThinkingMenuList
 						levels={catalog ? levels : []}
 						effectiveLevel={effectiveLevel}
-						onPick={(level) =>
-							void save(composeSlotModel(models, "strong", effectiveProvider ?? "", effectiveId ?? "", level as ThinkingLevel))
-						}
+						onPick={(level) => apply(effectiveProvider ?? "", effectiveId ?? "", level as ThinkingLevel)}
 						empty={catalog ? (effectiveId ? `${prettyModel(effectiveId)} has no thinking levels.` : "Pick a model first.") : "Loading…"}
 						footer="Levels this model actually supports"
 					/>

components/new-session.tsx

@@ -5,7 +5,6 @@ import { useRouter } from "next/navigation";
 import { Conversation, ConversationContent, ConversationEmptyState } from "@/components/ai-elements/conversation";
 import { Composer } from "@/components/composer";
 import { DictationBar, useDictation } from "@/components/dictation";
-import { useDefaultSettings } from "@/components/default-settings";
 import { SidebarToggle } from "@/components/sidebar";
 import { SetupDialog } from "@/components/setup-dialog";
 import { useStrongKeyless, useZeroKeys, ZeroKeysPill } from "@/components/setup-cta";
@@ -19,9 +18,9 @@ import type { ChatSettings } from "@/src/core";
  * the session's title (the exact create-then-redirect contract the home
  * composer established). Visually identical to a fresh chat: same header
  * (title + probe chip), the same empty state, the same composer blob +
- * stats dock. The model picker's empty-chatId branch defers its save and
- * lifts the selection here, so the pre-chat model/thinking choice rides
- * the creation.
+ * stats dock. The draft's model control binds the strong slot (the
+ * new-session default); the created session is stamped from it
+ * server-side (per-session models, owner 2026-09-28).
  */
 
 const DOCK = "mx-auto w-full max-w-[46rem] px-4";
@@ -36,7 +35,6 @@ const DOCK = "mx-auto w-full max-w-[46rem] px-4";
  */
 export async function startDraftSession(
 	text: string,
-	settings: ChatSettings | undefined,
 	fetchLike: typeof fetch,
 ): Promise<string | null> {
 	const t = text.trim();
@@ -47,14 +45,8 @@ export async function startDraftSession(
 		body: JSON.stringify({ title: t }),
 	});
 	const { id } = (await res.json()) as { id: string };
-	if (settings) {
-		// Best-effort persist — the selection was made pre-chat.
-		await fetchLike(`/api/chats/${id}/settings`, {
-			method: "PUT",
-			headers: { "Content-Type": "application/json" },
-			body: JSON.stringify(settings),
-		}).catch(() => {});
-	}
+	// No settings PUT on create (per-session models, owner 2026-09-28):
+	// the SERVER stamps the newborn from the strong slot.
 	return `/chat/${id}?prompt=${encodeURIComponent(t)}`;
 }
 
@@ -65,16 +57,12 @@ export function DraftShell({
 	text,
 	onChange,
 	onSend,
-	settings,
-	onSettingsSaved,
 	setupCta,
 }: {
 	busy: boolean;
 	text: string;
 	onChange: (v: string) => void;
 	onSend: () => void;
-	settings: ChatSettings | undefined;
-	onSettingsSaved: (s: ChatSettings) => void;
 	/** The first-run CTA (fix wave chunk B): the same "Set up your models"
 	 *  affordance home carries, rendered above the draft shell — passed by
 	 *  NewSession, which owns the configured state and the SetupDialog. */
@@ -143,22 +131,10 @@ export function DraftShell({
 	);
 }
 
-export function NewSession({
-	initialSettings,
-	initialConfigured,
-}: {
-	initialSettings: ChatSettings | null;
-	initialConfigured: boolean;
-}) {
+export function NewSession({ initialConfigured }: { initialConfigured: boolean }) {
 	const router = useRouter();
 	const [text, setText] = useState("");
 	const [busy, setBusy] = useState(false);
-	// THE default settings (owner, 2026-09-18): this surface and the home
-	// topic dock carries only the knowledge-context budget now (fix
-	// wave): the model pills ARE the strong slot (PUT /api/settings/models,
-	// app-wide) — the per-chat model pick is retired. saveDraft still
-	// lifts the context budget so it rides the session POST.
-	const { settings, save: saveDraft } = useDefaultSettings(initialSettings);
 
 	// First-run gate (model-slots wave, owner 2026-09-20): the send
 	// INTERCEPTS into the setup flow while unconfigured — no defaults for
@@ -193,13 +169,13 @@ export function NewSession({
 			return;
 		}
 		setBusy(true);
-		void startDraftSession(text, settings, fetch)
+		void startDraftSession(text, fetch)
 			.then((target) => {
 				if (target) router.push(target);
 				else setBusy(false);
 			})
 			.catch(() => setBusy(false));
-	}, [text, busy, settings, router, configured, zeroKeys, strongKeyless]);
+	}, [text, busy, router, configured, zeroKeys, strongKeyless]);
 
 	return (
 		<>
@@ -208,8 +184,6 @@ export function NewSession({
 				text={text}
 				onChange={setText}
 				onSend={send}
-				settings={settings}
-				onSettingsSaved={saveDraft}
 				setupCta={
 					zeroKeys ? (
 						<ZeroKeysPill onOpen={() => setSetupOpen(true)} />

components/stats-bar.tsx

@@ -29,8 +29,14 @@ import { ModelControl, catalogLimits, useModelCatalog } from "@/components/model
 export function StatsBar({
 	turns,
 	dictationSlot,
+	chatId,
 }: {
 	turns: TurnUsage[];
+	/** The bound session (per-session models, owner 2026-09-28): present
+	 *  on the in-session bar — the model control binds THE SESSION'S own
+	 *  record; absent on the draft surfaces, where it binds the strong
+	 *  slot (the new-session default). */
+	chatId?: string;
 	/** The dictation strip (STT wave, 2026-09-17): the row's middle is dead
 	 *  space between the session data and the model control — the mic
 	 *  button lives there, and while recording the meter unfurls to fill
@@ -169,7 +175,7 @@ export function StatsBar({
 			{/* The model + thinking control — one controller for the conversation
 			    agents (prober/teacher); the record's `turns` above still folds
 			    the ACTUAL models billed, regardless of what the picker says. */}
-			<ModelControl />
+			<ModelControl chatId={chatId} />
 		</div>
 	);
 }