Two selects that never wrote anything, and a queue

The approval card in Auto mode and the missing /effort were one bug. Both
selects hung their hx-patch on an empty sibling form reached by form="…",
and htmx binds a trigger to the annotated element: change fires on the
select and bubbles to its ancestors, which a sibling is not. The live rows
read agent_mode=manual and params_json={} while the browser showed Auto and
Effort: high. policy.py was never involved.

The verb moves onto the control; the empty form stays as value scoping,
which is the half of the CLAUDE.md note that was right. conftest gains
control_named so a test asserts the element carrying the name carries the
verb, rather than asserting the markup that was there throughout.

The composer's highlight was a third instance of the same carelessness in
CSS: .tok-mention is written for the transcript and scoped to nothing, so
the mirror painted its token in accent-coloured monospace over the
textarea's own text. Scoped under .msg; the mirror restates transparency
and font rather than inheriting them, and bleeds by box-shadow.

/effort is now offered before the first prompt and _new_chat reads it.
/index re-walks the project directory on demand, file_write drops the
listing it just invalidated, and the index ladder falls through to SFTP on
a host that refuses exec instead of returning nothing.

A second message during a reply is queued rather than starting a second
concurrent generation: a real Message row with queued set, so it survives a
restart and can be withdrawn. _drain hands one on at the end of a reply,
_inject takes one in at a tool-round boundary so an agent can be steered
mid-task. Stop leaves the queue undelivered. The terminal's Auto toggle
becomes off/copy/send, and send posts straight to the chat without touching
the composer.

@ now offers notes, skills, this chat's attachments and a URL to fetch; a
knowledge base attaches as a reference rather than a copy. copy_document
carries provenance, which was the one attach path that dropped it.

Also fixes an unrelated live bug: the round loop compared against the
global MAX_ROUNDS of 3 while sizing itself from the agent budget of 40, so
agent replies stopped after three rounds and reported forty.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/web/static/css/chat.css

@@ -576,6 +576,24 @@
 .msg:focus-within .msg__actions { opacity: 1; }
 .msg__actions .is-copied { color: var(--success); }
 
+/* --- A turn that is waiting to be sent ------------------------------------
+   Its actions do not fade in on hover like the others: they are the only way
+   to withdraw something that has not happened yet, and a control you have to
+   find by hovering is one somebody will not find. */
+.msg--queued { opacity: 0.75; }
+.msg--queued .msg__body {
+  border-inline-start: 2px dashed var(--border-strong);
+  padding-inline-start: var(--sp-2);
+}
+.msg__actions--queued { opacity: 1; align-items: center; }
+.msg__note {
+  display: inline-flex;
+  align-items: center;
+  gap: var(--sp-1);
+  color: var(--ink-muted);
+  font-size: var(--text-xs);
+}
+
 /* --- Rendered Markdown ---------------------------------------------------- */
 .msg__body > :first-child { margin-top: 0; }
 .msg__body > :last-child { margin-bottom: 0; }
@@ -761,16 +779,32 @@
 .composer__mirror .tok-mention,
 .composer__mirror .tok-command {
   border-radius: var(--radius-sm);
-  /* Bled sideways so the rectangle does not sit hard against the next word,
-     and the negative margin keeps the text metrics identical. */
-  padding: 0 2px;
-  margin: 0 -2px;
+  /* Restated rather than inherited. `color: transparent` on the mirror is an
+     inherited value, and a colour the span declares itself beats it -- which is
+     exactly what the transcript's rule below used to do from across the file,
+     painting the token in accent-coloured mono at 0.95em on top of the
+     textarea's own text. Doubled, and shifted from there on, because the
+     metrics differ. The font must be restated for the same reason. */
+  color: transparent;
+  font: inherit;
+  /* Bled sideways by a shadow, not by padding: a rectangle that spreads cannot
+     move a glyph, and the negative margin that used to do this was the only
+     thing in the mirror that could. */
+  padding: 0;
+  margin: 0;
+}
+.composer__mirror .tok-mention {
+  background: var(--accent-soft);
+  box-shadow: 0 0 0 2px var(--accent-soft);
+}
+.composer__mirror .tok-command {
+  background: var(--leaf-soft);
+  box-shadow: 0 0 0 2px var(--leaf-soft);
 }
-.composer__mirror .tok-mention { background: var(--accent-soft); }
-.composer__mirror .tok-command { background: var(--leaf-soft); }
 
-/* The same two in a sent message, where they are text rather than a backdrop. */
-.tok-mention {
+/* The same two in a sent message, where they are text rather than a backdrop --
+   and scoped to it, because unscoped they also matched the mirror's spans. */
+.msg .tok-mention {
   border-radius: var(--radius-sm);
   padding: 0 2px;
   background: var(--accent-soft);