Files that outlived the chats that held them, and a page that led with its footnotes

The second audit pass. Four things, and the first two were reported.

The Prompts page put a screen of variables and a screen of preview above
the editor, so the tabs began two screens down and switching one had to
drag the whole page to be any use -- and on a short tab it could not drag
far enough, leaving the panel stranded above a screenful of nothing.
Editor first, reference after, bar sticky. Custom themes were three fixed
slots: fifty-seven empty colour boxes on a fresh instance and no way to
make a fourth theme. One block per theme plus a blank one, colours behind
a disclosure. Both measured rather than argued about -- rendered through
TestClient and driven under headless Chromium, where the tab bar moved
385->642px before and does not move now, and the themes page went from
5495px to 2820px.

Asking where generated images go found the other two. Deleting a chat
cascades to the attachment rows and leaves every file on disk; the helper
written for exactly that was called from one place, and it was not the
delete button, a schedule's chat, a helper's chat or deleting an account.
Underneath it, `claim` bound message_id and never chat_id, so anything
picked before a chat existed kept an empty chat_id forever -- which six
readers filter on, so those files were also unnamed in the prompt,
unopenable in the canvas, and invisible to the one caller the cleanup had.

And folders nest now. The route has handled parent_id since folders
existed, with a cycle guard and a depth cap the move path never applied;
the sidebar has always drawn a tree. Nothing could ask for one.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/__init__.py

@@ -1,3 +1,3 @@
 """LLeMbas - a Middle-earth themed web UI for OpenAI-compatible LLM endpoints."""
 
-__version__ = "0.9.9"
+__version__ = "0.9.10"

src/lembas/api/admin_branding.py

@@ -30,6 +30,14 @@ router = APIRouter(prefix="/admin/customization", tags=["admin-branding"])
 
 MAX_CUSTOM_CSS = 40_000
 
+# How many custom themes an instance may keep. Not a design limit -- there is
+# nothing in `theme_css` that cares -- but the whole set lives in one settings
+# row read into a process-level snapshot on every render, and the page offers a
+# blank block whenever there is room, so *some* number has to say when to stop
+# offering. Twelve is far past what anybody wants and small enough that the
+# stylesheet stays a stylesheet.
+MAX_THEMES = 12
+
 
 def _page(request: Request, db: Db, saved: str = "", error: str = "") -> Response:
     values = settings_store.get_group(db, branding_service.BRANDING)
@@ -55,6 +63,7 @@ def _page(request: Request, db: Db, saved: str = "", error: str = "") -> Respons
             "tokens": branding_service.THEME_TOKENS,
             "custom_themes": [t for t in brand.themes if not t.built_in],
             "bases": [name for name, _, _ in branding_service.BUILT_IN],
+            "max_themes": MAX_THEMES,
             "saved": saved,
             "error": error,
         },
@@ -167,6 +176,11 @@ async def save_themes(request: Request, db: Db, user: AdminUser) -> Response:
     every **read**, so a theme written straight into the settings table by hand,
     or stored by an earlier version, still has to produce a stylesheet that
     parses. Validating only on save would put that guarantee in the wrong place.
+
+    The indices need not be contiguous and are not renumbered. The page renders
+    one block per theme plus a blank one, so clearing an id in the middle leaves
+    a gap -- and a gap is simply an index with no id, which the loop already
+    skips. Renumbering would be work in aid of nothing.
     """
     form = await request.form()
     themes = []
@@ -186,6 +200,10 @@ async def save_themes(request: Request, db: Db, user: AdminUser) -> Response:
                 },
             }
         )
+    # Enforced here as well as in the template, because the template's job is to
+    # stop offering and this one's is to stop accepting -- a crafted POST is not
+    # the page.
+    themes = themes[:MAX_THEMES]
     _write(db, {"themes": themes})
     log.info("%d custom theme(s) saved by %s", len(themes), user.email)
     return RedirectResponse(

src/lembas/api/admin_users.py

@@ -16,6 +16,7 @@ from lembas.db.models import (
     ROLE_ADMIN,
     ROLE_PENDING,
     ROLE_USER,
+    Chat,
     Group,
     Model,
     User,
@@ -23,6 +24,7 @@ from lembas.db.models import (
 from lembas.security import permissions
 from lembas.security.passwords import hash_password, validate_password
 from lembas.security.sessions import revoke_all_for_user
+from lembas.services import chat as chat_service
 from lembas.services import settings_store, sharing
 from lembas.services import usage as usage_service
 from lembas.web.templating import render
@@ -249,6 +251,11 @@ async def delete_user(db: Db, user: AdminUser, user_id: str) -> Response:
     # still there to be found.
     sharing.forget_owner(db, target.id)
     sharing.forget_principal(db, PRINCIPAL_USER, target.id)
+    # And the same shape a third time: the chats cascade, their attachment rows
+    # cascade, and every file those rows named stays on disk with nothing left
+    # that will ever look at it. Before the delete, while the rows still say
+    # which files they are.
+    chat_service.delete_chats(db, list(db.scalars(select(Chat).where(Chat.user_id == target.id))))
     db.delete(target)
     db.commit()
     log.info("%s deleted account %s", user.email, email)

src/lembas/api/chats.py

@@ -2098,7 +2098,9 @@ async def delete_chat(db: Db, user: RequiredUser, chat_id: str) -> Response:
     # there would be nothing left to find it by and a shell would sit open on
     # somebody's machine until the idle timeout noticed.
     await terminal_service.close_chat(chat_id)
-    db.delete(chat)
+    # Not `db.delete(chat)`: that cascades to the attachment rows and leaves
+    # every file they name on disk forever. See `chat_service.delete_chats`.
+    chat_service.delete_chats(db, [chat])
     db.commit()
 
     response = Response(status_code=status.HTTP_204_NO_CONTENT)

src/lembas/api/folders.py

@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from fastapi import APIRouter, Depends, Form, HTTPException, Request, Response, status
+from sqlalchemy import select
 from sqlalchemy.orm import Session as DBSession
 
 from lembas.api.deps import Db, RequiredUser, require_permission
@@ -36,6 +37,62 @@ def _depth_of(db: DBSession, folder: Folder | None) -> int:
     return depth
 
 
+def _descendants(db: DBSession, folder: Folder) -> set[str]:
+    """Every folder under this one, and this one. Bounded by MAX_DEPTH."""
+    found = {folder.id}
+    frontier = [folder.id]
+    for _ in range(MAX_DEPTH + 1):
+        if not frontier:
+            break
+        children = list(
+            db.scalars(select(Folder).where(Folder.parent_id.in_(frontier)))
+        )
+        frontier = [c.id for c in children if c.id not in found]
+        found.update(frontier)
+    return found
+
+
+def _subtree_height(db: DBSession, folder: Folder) -> int:
+    """How many levels this folder's own subtree occupies, itself included.
+
+    A move has to consider it: the constraint is on the *deepest leaf* after the
+    move, not on the folder being dragged.
+    """
+    height = 1
+    frontier = [folder.id]
+    for _ in range(MAX_DEPTH + 1):
+        children = list(
+            db.scalars(select(Folder.id).where(Folder.parent_id.in_(frontier)))
+        )
+        if not children:
+            break
+        height += 1
+        frontier = children
+    return height
+
+
+def candidate_parents(db: DBSession, user_id: str, folder: Folder) -> list[Folder]:
+    """Folders this one could be moved into.
+
+    Everything the person owns, minus the folder itself and its own subtree --
+    which is the cycle guard in `update_folder` stated as a list rather than as
+    a refusal. A picker that offers a move the route will reject is a control
+    that looks like it works.
+
+    Depth is checked at the route rather than filtered here: it depends on how
+    tall *this* folder's subtree is, and a select that silently omitted a folder
+    for that reason would be unexplainable from the screen.
+    """
+    blocked = _descendants(db, folder)
+    return [
+        candidate
+        for candidate in db.scalars(
+            select(Folder).where(Folder.user_id == user_id).order_by(Folder.name)
+        )
+        if candidate.id not in blocked
+    ]
+
+
 def _refresh_sidebar() -> Response:
     """Tell the browser to reload so the tree re-renders.
 
@@ -141,6 +198,17 @@ async def update_folder(
                     "A folder cannot be moved inside itself.",
                 )
             cursor = db.get(Folder, cursor.parent_id) if cursor.parent_id else None
+        # And the depth cap, which `create_folder` has always applied and this
+        # path never did -- moving a three-deep subtree under a six-deep folder
+        # builds a tree nine deep, which is what MAX_DEPTH exists to keep out of
+        # the recursive sidebar template. It went unnoticed because nothing in
+        # the interface could submit `parent_id` at all until now.
+        subtree = _subtree_height(db, folder)
+        if new_parent is not None and _depth_of(db, new_parent) + subtree > MAX_DEPTH:
+            raise HTTPException(
+                status.HTTP_400_BAD_REQUEST,
+                f"Folders cannot be nested more than {MAX_DEPTH} deep.",
+            )
         folder.parent_id = new_parent.id if new_parent else None
 
     if "collapsed" in form:

src/lembas/api/pages.py

@@ -606,6 +606,12 @@ async def chat_index(
     )
 
 
+def _candidate_parents(db: DBSession, user_id: str, folder: Folder) -> list[Folder]:
+    from lembas.api.folders import candidate_parents
+
+    return candidate_parents(db, user_id, folder)
+
+
 @router.get("/folders/{folder_id}")
 async def folder_settings(request: Request, db: Db, user: RequiredUser, folder_id: str):
     """What a folder hands to the chats started inside it.
@@ -631,6 +637,10 @@ async def folder_settings(request: Request, db: Db, user: RequiredUser, folder_i
         {
             "folder": folder,
             "chat": None,
+            # Imported here rather than at module scope: `api.folders` imports
+            # `api.deps`, which this module is a peer of, and the pair have been
+            # kept apart deliberately.
+            "parents": _candidate_parents(db, user.id, folder),
             "models": chat_service.available_models(db, user),
             **_agent_context(db, user, None),
             **sidebar_context(db, user),

src/lembas/services/chat.py

@@ -621,6 +621,37 @@ async def summarise_for_compaction(
     return raw.strip()
 
 
+def delete_chats(db: DBSession, chats) -> int:
+    """Delete chats, and the files their attachments point at.
+
+    **The one way to delete a chat.** `db.delete(chat)` cascades to its messages
+    and to its attachment *rows*, and leaves every file on disk -- a generated
+    image, an uploaded PDF, a photo -- with nothing that will ever look at them
+    again: `sweep_orphans` only considers uploads that were never attached.
+
+    `files_service.remove_files_for_chats` was written for exactly this and was
+    called from one place, the temporary sweep. The delete button, a schedule's
+    task chat, a helper's hidden chat and deleting an account all went straight
+    to `db.delete`, so four of the five ways a chat can end leaked its files.
+    That is `sharing.forget_principal` again: a helper that exists, is correct,
+    and is not called on the path that needs it.
+
+    The order matters and is why this is a function rather than a note. The
+    files have to be unlinked **while the rows still say which they are**, so it
+    happens before the delete and in the same session.
+
+    Does not commit -- the caller decides, because some of them are deleting
+    other things in the same transaction.
+    """
+    live = [chat for chat in chats if chat is not None]
+    if not live:
+        return 0
+    files_service.remove_files_for_chats(db, [chat.id for chat in live])
+    for chat in live:
+        db.delete(chat)
+    return len(live)
+
+
 def sweep_temporary(db: DBSession, older_than: timedelta = TEMPORARY_LIFETIME) -> int:
     """Delete temporary chats nobody has touched for a day.
 
@@ -652,9 +683,7 @@ def sweep_temporary(db: DBSession, older_than: timedelta = TEMPORARY_LIFETIME) -
     if not stale:
         return 0
 
-    files_service.remove_files_for_chats(db, [chat.id for chat in stale])
-    for chat in stale:
-        db.delete(chat)
+    delete_chats(db, stale)
     db.commit()
     log.info("swept %d temporary chat(s)", len(stale))
     return len(stale)

src/lembas/services/files.py

@@ -29,7 +29,7 @@ from sqlalchemy import select
 from sqlalchemy.orm import Session as DBSession
 
 from lembas.config import settings
-from lembas.db.models import KIND_DOCUMENT, KIND_IMAGE, KIND_TEXT, Attachment
+from lembas.db.models import KIND_DOCUMENT, KIND_IMAGE, KIND_TEXT, Attachment, Message
 
 log = logging.getLogger(__name__)
 
@@ -621,6 +621,19 @@ def claim(db: DBSession, *, ids: list[str], user_id: str, message_id: str) -> li
 
     Only unclaimed attachments belonging to this user are taken, so a stray or
     forged id cannot pull someone else's file into a conversation.
+
+    **`chat_id` is set here, and it was not.** `POST /api/files` takes one, and
+    the composer sends it -- but only once a chat exists. A file picked on the
+    *new-chat* screen is stored before there is a chat to name, so its
+    `chat_id` stayed NULL for the rest of its life even after the message it
+    belongs to was sent. Six places filter on that column, and every one of them
+    was quietly wrong about those files: the harness did not name them among the
+    attached documents, the canvas refused to open them, and
+    `remove_files_for_chats` could not find them to delete -- so the temporary
+    sweep, the one caller it had, was removing nothing.
+
+    Read from the message rather than passed in, so no caller can bind an
+    attachment to one chat and a message in another.
     """
     if not ids:
         return []
@@ -634,8 +647,11 @@ def claim(db: DBSession, *, ids: list[str], user_id: str, message_id: str) -> li
             )
         )
     )
+    message = db.get(Message, message_id)
     for attachment in pending:
         attachment.message_id = message_id
+        if message is not None:
+            attachment.chat_id = message.chat_id
     db.commit()
     return pending
 

src/lembas/services/schedules.py

@@ -221,7 +221,9 @@ def delete(db: DBSession, schedule: Schedule, *, keep_chat: bool = True) -> None
         if keep_chat:
             chat.kind = "chat"
         else:
-            db.delete(chat)
+            from lembas.services import chat as chat_service
+
+            chat_service.delete_chats(db, [chat])
     db.delete(schedule)
     db.commit()
 

src/lembas/services/subagent.py

@@ -338,9 +338,14 @@ def _cleanup(chat_id: str, *, keep: bool) -> None:
         return
     try:
         with session_scope() as db:
+            from lembas.services import chat as chat_service
+
             chat = db.get(Chat, chat_id)
             if chat is not None:
-                db.delete(chat)
+                # A writing helper can generate an image or attach a file, and
+                # `db.delete` would leave both on disk with the row that named
+                # them gone.
+                chat_service.delete_chats(db, [chat])
     except Exception:  # noqa: BLE001 - tidying up is not the result
         log.debug("could not remove subagent chat %s", chat_id, exc_info=True)
 

src/lembas/services/suggestions.py

@@ -27,32 +27,46 @@ MAX_DESCRIPTION = 300
 MAX_PROMPT = 4000
 
 # A card is sent the moment it is clicked, so each of these has to work cold --
-# with nothing pasted and nothing typed. They are written to ask for what they
-# need, which turns the first reply into the right question rather than a guess
-# at material nobody has given yet.
+# with nothing pasted and nothing typed. These four are *self-contained* rather
+# than question-asking: they are what somebody clicks on an instance they have
+# just stood up, to find out whether the thing works and what the model behind
+# it is. That is the honest first use, and it is a different job from the task
+# cards that preceded them, which opened by asking for material the reader had
+# not given.
+#
+# The name and description are read by somebody who has never seen this
+# instance; the prompt is read by the model. They are allowed to differ, and
+# here they do -- "Start a session" says what the card is for, and its prompt is
+# the bare line that produces a clean opening turn.
+#
+# Only a fresh install gets these: `SEEDED_KEY` means an instance that has
+# already seeded keeps whatever its administrator has since made of the list.
 #
 # No Middle-earth flavour: this is functional UI.
 DEFAULTS: tuple[tuple[str, str, str], ...] = (
     (
-        "Explain this",
-        "Get something confusing back in plain language.",
-        "I want something explained in plain language. Ask me what it is, then "
-        "give me one sentence summarising it, the details that actually matter, "
-        "and anything I should watch out for.",
+        "Start a session",
+        "Open a fresh conversation with nothing assumed.",
+        "Initializing a new session.",
     ),
     (
-        "Draft a reply",
-        "Turn a message you have received into an answer you can send.",
-        "I need to reply to a message. Ask me what it says, what tone I want and "
-        "what outcome I am after, then write a draft I could send as it stands.",
+        "What can you do?",
+        "Have the model say which tools, instructions and limits it has.",
+        "Who are you and what are you capable of? What are your available tools? "
+        "What do you already know from your instructions? Do you have any set "
+        "personality?",
     ),
     (
-        "Find the flaw",
-        "Have a plan argued with before you commit to it.",
-        "I want a plan argued with. Ask me what the plan is, then tell me what is "
-        "most likely to go wrong, what I am assuming without evidence, and what "
-        "would change your mind. Do not soften it, and do not agree just because "
-        "I sound confident.",
+        "Show me some code",
+        "See how the model writes, in a language of its own choosing.",
+        "Pick a random programming language and produce a coding example showing "
+        "your coding capabilities.",
+    ),
+    (
+        "Tell me something",
+        "A fact worth knowing, from a subject picked at random.",
+        "Give me a random fun fact from a random topic of your choosing. "
+        "Available topics are science, history, sociology, theology etc.",
     ),
 )
 

src/lembas/web/static/css/admin.css

@@ -80,6 +80,18 @@
   flex: none;
   overflow-x: auto;
   scrollbar-width: none;
+  /* Sticky where the *page* is the scroller, which is the admin layout. The
+     Tools panel is longer than a screen, so without this the bar scrolls away
+     and changing tab means scrolling back up to find it. Harmless on the
+     settings page, where `.tabs__body` scrolls underneath a bar that never
+     moves anyway.
+
+     It needs the opaque `background` above it already has, or the panel would
+     show through. `z-index` because a panel's own cards establish stacking
+     contexts and would otherwise paint over it. */
+  position: sticky;
+  top: 0;
+  z-index: 1;
 }
 
 .tabs__tab {

src/lembas/web/templates/admin/customization.html

@@ -123,9 +123,25 @@
 
 {# --- Themes --------------------------------------------------------------- #}
 {#
-  Three blocks, always rendered, so adding a theme needs no JavaScript: an empty
-  id means that block is not a theme. Saving replaces the whole list, which is
-  what makes removing one a matter of clearing its id.
+  One block per theme that exists, plus a single blank one to add the next.
+
+  It used to be three blocks, always rendered, whether or not anybody had made a
+  theme -- so a fresh instance opened on fifty-seven empty colour boxes under
+  three identical headings, and the fourth theme was unreachable without editing
+  the template. The spare-block pattern is the no-JavaScript way to do "add
+  another": fill the blank one, save, and the page comes back with your theme
+  and a new blank. There is no button to press and nothing to clone, which is
+  why this still works with scripting off.
+
+  The colours live in a <details> so a block is a heading and three fields until
+  you ask for them. Nineteen inputs is the right number to *offer* and the wrong
+  number to *show*: everything left empty inherits from the base, so most themes
+  set four or five.
+
+  Saving replaces the whole list, which is what makes removing one a matter of
+  clearing its id -- and why the blocks may have gaps in their numbering without
+  anything caring. `save_themes` skips an index with no id and counts from the
+  keys it was actually sent.
 #}
 <form method="post" action="/admin/customization/themes" class="form-grid">
   <section class="card">
@@ -138,11 +154,14 @@
       are worked out from the accent, so you do not have to.
     </p>
 
-    {% for index in range(3) %}
+    {# The spare block is offered until the cap, so the form cannot grow without
+       end and the page cannot stop offering one while there is room. #}
+    {% set slots = custom_themes | length + (1 if custom_themes | length < max_themes else 0) %}
+    {% for index in range(slots) %}
     {% set existing = custom_themes[index] if index < custom_themes | length else none %}
     <div class="card" style="margin-top: var(--sp-4)">
       <h3 class="section-title">
-        {{ existing.label if existing else "A theme of your own" }}
+        {{ existing.label or existing.id if existing else "Add a theme" }}
       </h3>
 
       <div class="field-row">
@@ -152,7 +171,11 @@
                  value="{{ existing.id if existing else '' }}" maxlength="24"
                  pattern="[a-z][a-z0-9-]*" placeholder="dusk">
           <p class="field__hint">
-            Lowercase letters, digits and hyphens. Clear it to remove the theme.
+            {% if existing %}
+            Lowercase letters, digits and hyphens. Clear it to remove this theme.
+            {% else %}
+            Lowercase letters, digits and hyphens. Give it one to make a theme.
+            {% endif %}
           </p>
         </div>
         <div class="field">
@@ -172,23 +195,42 @@
         </div>
       </div>
 
-      <div class="field-row">
-        {% for name, description in tokens %}
-        <div class="field">
-          <label class="field__label" for="theme-{{ index }}-{{ name }}">
-            {{ description }}
-          </label>
-          <input class="input" id="theme-{{ index }}-{{ name }}"
-                 name="theme_{{ index }}_{{ name }}" type="text"
-                 value="{{ existing.tokens.get(name, '') if existing else '' }}"
-                 maxlength="40" placeholder="inherited"
-                 spellcheck="false">
-          <p class="field__hint"><code>--{{ name }}</code></p>
+      {# Open on a theme that has set something, so an existing override is never
+         hidden behind a disclosure somebody has to know to open. #}
+      <details{{ ' open' if existing and existing.tokens }}>
+        <summary class="text-sm">
+          Colours
+          {% if existing and existing.tokens %}
+          <span class="badge">{{ existing.tokens | length }} set</span>
+          {% else %}
+          <span class="faint">all inherited</span>
+          {% endif %}
+        </summary>
+        <div class="field-row">
+          {% for name, description in tokens %}
+          <div class="field">
+            <label class="field__label" for="theme-{{ index }}-{{ name }}">
+              {{ description }}
+            </label>
+            <input class="input" id="theme-{{ index }}-{{ name }}"
+                   name="theme_{{ index }}_{{ name }}" type="text"
+                   value="{{ existing.tokens.get(name, '') if existing else '' }}"
+                   maxlength="40" placeholder="inherited"
+                   spellcheck="false">
+            <p class="field__hint"><code>--{{ name }}</code></p>
+          </div>
+          {% endfor %}
         </div>
-        {% endfor %}
-      </div>
+      </details>
     </div>
     {% endfor %}
+
+    {% if custom_themes | length >= max_themes %}
+    <p class="field__hint" style="margin-top: var(--sp-4)">
+      That is {{ max_themes }} themes, which is the limit. Clear one's id and
+      save to make room for another.
+    </p>
+    {% endif %}
   </section>
 
   <div class="btn-row">

src/lembas/web/templates/admin/prompts.html

@@ -18,6 +18,77 @@
 <div class="alert alert--success">{{ icon("check", "icon--sm") }} <span>Prompts saved.</span></div>
 {% endif %}
 
+{#
+  The editor first, the reference after, and that ordering is the fix rather
+  than a preference.
+
+  The Variables legend and the Preview both run to a screen each, and they used
+  to sit *above* the tabs -- so the thing this page exists for started two
+  screens down. Every tab switch then had to move the viewport to be any use,
+  and `ui.js` did: it put the tab bar at the top of the scroller. On a short
+  panel the scroller cannot go that far, so the browser clamped to the maximum
+  and left the panel stranded above a screen of nothing, which reads as a page
+  that failed to load. That is the empty space; the scrolling was the cause and
+  not the cure.
+
+  With the tabs near the top there is nothing to scroll past: switching panels
+  changes what is below the bar and leaves the bar where it is. The reference
+  cards keep their place in the reading order -- after the work, where you go
+  to look something up -- and the preview still watches the form through
+  `hx-include`, which does not care about document order.
+#}
+<form method="post" action="/admin/prompts" id="prompt-form">
+  <div class="tabs">
+    <div class="tabs__bar" role="tablist">
+      {% for key, label, fragments in groups %}
+      <input class="visually-hidden" type="radio" name="prompts-tab"
+             id="tab-{{ key }}" {{ 'checked' if loop.first }}>
+      <label class="tabs__tab" for="tab-{{ key }}">{{ label }}</label>
+      {% endfor %}
+    </div>
+
+    <div class="tabs__body">
+      {% for key, label, fragments in groups %}
+      <section class="tabs__panel" data-tab="tab-{{ key }}">
+        {% for fragment in fragments %}
+        {% with value = values[fragment.key], overridden = fragment.key in overridden %}
+        {% include "admin/_prompt_field.html" %}
+        {% endwith %}
+        {% endfor %}
+      </section>
+      {% endfor %}
+    </div>
+  </div>
+
+  <section class="card">
+    <h2 class="card__title">Length</h2>
+    <div class="field">
+      <label class="field__label" for="max-harness-chars">Preamble character cap</label>
+      <input class="input" id="max-harness-chars" name="max_harness_chars" type="number"
+             min="0" max="100000" value="{{ max_harness_chars }}">
+      <p class="field__hint">
+        Everything above is cut off past this. <code>0</code> means the built-in
+        {{ default_harness_chars }}. It is a backstop against a large skill index
+        or memory list quietly eating the context window, not a budget to tune.
+      </p>
+    </div>
+  </section>
+
+  <div class="form-actions">
+    <button class="btn btn--primary" type="submit">Save settings</button>
+    {#
+      data-confirm-button, not data-confirm: this button acts on its own through
+      formaction, and confirming the whole form would also catch plain Save.
+    #}
+    <button class="btn" type="submit" formaction="/admin/prompts/reset"
+            data-confirm-button="Put every prompt back to its built-in wording? Everything you have edited here is lost."
+            data-confirm-title="Restore defaults" data-confirm-label="Restore">
+      Restore all defaults
+    </button>
+  </div>
+</form>
+
+
 <section class="card">
   <h2 class="card__title">Variables</h2>
   <p class="card__lede">
@@ -134,57 +205,6 @@
                    keyup changed delay:700ms from:#prompt-form"></div>
 </section>
 
-<form method="post" action="/admin/prompts" id="prompt-form">
-  <div class="tabs">
-    <div class="tabs__bar" role="tablist">
-      {% for key, label, fragments in groups %}
-      <input class="visually-hidden" type="radio" name="prompts-tab"
-             id="tab-{{ key }}" {{ 'checked' if loop.first }}>
-      <label class="tabs__tab" for="tab-{{ key }}">{{ label }}</label>
-      {% endfor %}
-    </div>
-
-    <div class="tabs__body">
-      {% for key, label, fragments in groups %}
-      <section class="tabs__panel" data-tab="tab-{{ key }}">
-        {% for fragment in fragments %}
-        {% with value = values[fragment.key], overridden = fragment.key in overridden %}
-        {% include "admin/_prompt_field.html" %}
-        {% endwith %}
-        {% endfor %}
-      </section>
-      {% endfor %}
-    </div>
-  </div>
-
-  <section class="card">
-    <h2 class="card__title">Length</h2>
-    <div class="field">
-      <label class="field__label" for="max-harness-chars">Preamble character cap</label>
-      <input class="input" id="max-harness-chars" name="max_harness_chars" type="number"
-             min="0" max="100000" value="{{ max_harness_chars }}">
-      <p class="field__hint">
-        Everything above is cut off past this. <code>0</code> means the built-in
-        {{ default_harness_chars }}. It is a backstop against a large skill index
-        or memory list quietly eating the context window, not a budget to tune.
-      </p>
-    </div>
-  </section>
-
-  <div class="form-actions">
-    <button class="btn btn--primary" type="submit">Save settings</button>
-    {#
-      data-confirm-button, not data-confirm: this button acts on its own through
-      formaction, and confirming the whole form would also catch plain Save.
-    #}
-    <button class="btn" type="submit" formaction="/admin/prompts/reset"
-            data-confirm-button="Put every prompt back to its built-in wording? Everything you have edited here is lost."
-            data-confirm-title="Restore defaults" data-confirm-label="Restore">
-      Restore all defaults
-    </button>
-  </div>
-</form>
-
 <section class="card">
   <h2 class="card__title">Tool descriptions</h2>
   <p class="card__lede">

src/lembas/web/templates/folders/edit.html

@@ -64,6 +64,33 @@
               For you, not for any model. It is never sent anywhere.
             </p>
           </div>
+          {#
+            Nesting has worked at the route since folders existed -- with a cycle
+            guard and a depth cap -- and the sidebar template has always
+            recursed to draw it. Nothing anywhere submitted `parent_id`, so the
+            README advertised "arbitrarily nested" folders that could not be
+            nested. This is that control.
+
+            The options are `candidate_parents`, which is the cycle guard stated
+            as a list rather than as a refusal: a picker offering a move the
+            route will reject is a control that looks like it works.
+          #}
+          <div class="field">
+            <label class="field__label" for="folder-parent">Inside</label>
+            <select class="select" id="folder-parent" name="parent_id">
+              <option value="">Nothing — a folder at the top</option>
+              {% for candidate in parents %}
+              <option value="{{ candidate.id }}"
+                      {{ 'selected' if folder.parent_id == candidate.id }}>
+                {{ candidate.name }}
+              </option>
+              {% endfor %}
+            </select>
+            <p class="field__hint">
+              A folder inside another inherits its system prompt where it has
+              none of its own.
+            </p>
+          </div>
         </div>
 
         <div class="card">