Files that outlived the chats that held them, and a page that led with its footnotes

The second audit pass. Four things, and the first two were reported.

The Prompts page put a screen of variables and a screen of preview above
the editor, so the tabs began two screens down and switching one had to
drag the whole page to be any use -- and on a short tab it could not drag
far enough, leaving the panel stranded above a screenful of nothing.
Editor first, reference after, bar sticky. Custom themes were three fixed
slots: fifty-seven empty colour boxes on a fresh instance and no way to
make a fourth theme. One block per theme plus a blank one, colours behind
a disclosure. Both measured rather than argued about -- rendered through
TestClient and driven under headless Chromium, where the tab bar moved
385->642px before and does not move now, and the themes page went from
5495px to 2820px.

Asking where generated images go found the other two. Deleting a chat
cascades to the attachment rows and leaves every file on disk; the helper
written for exactly that was called from one place, and it was not the
delete button, a schedule's chat, a helper's chat or deleting an account.
Underneath it, `claim` bound message_id and never chat_id, so anything
picked before a chat existed kept an empty chat_id forever -- which six
readers filter on, so those files were also unnamed in the prompt,
unopenable in the canvas, and invisible to the one caller the cleanup had.

And folders nest now. The route has handled parent_id since folders
existed, with a cycle guard and a depth cap the move path never applied;
the sidebar has always drawn a tree. Nothing could ask for one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/notes/audit-0.9.md

@@ -183,10 +183,43 @@ Written and never read: `Chat.compacted_at`, `User.last_login_at`,
 `general.require_approval` (its comment says "reserved"), and the `back` form
 parameter on two `admin_models` routes.
 
+**A third, found by asking where generated images go.** `db.delete(chat)`
+cascades to the message and attachment *rows* and leaves every file on disk;
+`files.remove_files_for_chats` was written for exactly that and was called from
+one place, the temporary-chat sweep. The delete button, a schedule's task chat,
+a helper's chat and account deletion all went straight to `db.delete`.
+
+Underneath it, a second fault that made the first invisible: `files.claim`
+bound `message_id` and never `chat_id`, so anything uploaded on the *new-chat*
+screen kept an empty `chat_id` for the rest of its life. Six readers filter on
+that column, so for those files the harness did not name them among the attached
+documents, the canvas refused to open them, and the one caller the cleanup
+helper had found nothing to remove. Both fixed, and `chat_service.delete_chats`
+is now the only way a chat is deleted.
+
 *Stated:* `Message.parent_id` and `content_parts_json` are deliberate forward
 -looking columns; `Chat.archived` is already recorded in `PLAN.md` as a column
 nothing surfaces.
 
+## Verified by rendering, not by reading — *Stage 2*
+
+There is no browser extension on this machine, so `/admin/prompts` and
+`/admin/customization` were checked by rendering them through `TestClient`,
+rewriting the asset URLs to `file://`, and driving headless Chromium against the
+result. Worth recording because the first run of that harness **measured an
+unstyled page**: the templates emit absolute `http://testserver/static/…` URLs
+via `url_for`, not `/static/…`, so the replacement matched nothing and no CSS
+loaded. It reported all five tab panels visible at once — a dramatic finding
+that was entirely an artefact. The harness now fails loudly on any unrewritten
+asset URL.
+
+What it measured once fixed:
+
+- `/admin/prompts`, tab bar's on-screen position across the five tabs:
+  **385 → 642px before** (the page moving under the reader), **195px constant
+  after**, with `scrollTop` staying at 0.
+- `/admin/customization`, document height: **5495px before, 2820px after**.
+
 ## Documentation — *Stage 2*
 
 - `README.md` is stale by six phases. "Planned: Image generation · OCR ·