A crowd in one chat

The chat's own model answers, then each other member in order, then the order runs
backwards asking each whether it disagrees, ending at the main model, which either
closes or sends them round again. Design and reasoning: LLeMbas.wiki/Crowd-chats.

THE SPEAKER SEAM, WHICH IS ALSO A BUG FIX

`chat_service.speaker_for` makes the *message* name the answering model and the
chat only the default. That closes a live half-wired feature -- `wake_chat` takes a
model override and `schedule/runner` passes one, and it reached the row and never
the request, so a schedule naming another model got the chat's model wearing the
other one's name.

The seam is wider than `build_request`: `{{model_name}}`, the authored prompt's
model layer, `vision` (where a wrong answer makes the endpoint reject the whole
request), the effort vocabulary (which raises inside the model's own chat template,
and whose refusal narrows every Model row sharing the id), `resolve_tools`,
`context_length` -> `_too_big`, and `ToolContext.model_id`. `resolve_endpoint` may
now only write back `chat.connection_id` when the speaker *is* the chat's model.

WHY N CHAINED REPLIES

`Generation` is one reply's state and `_follow` streams per message, so one
generation cannot stream into nine bubbles and `ensure` would not know which of the
nine it was after a restart. A subagent per speaker cannot work either: its answer
comes back as a tool result and tool results are never replayed, so speaker 3 could
not see speaker 2 -- which is the whole point. Chained, exactly one incomplete row
exists at a time, and `tests/test_crowd_chain.py` asserts that at every
observation.

The round lives on `Message.crowd_json`, not on the chat: the row is the authority,
and chat-level state would describe turns a rewind or a restart had removed.
`crowd.next_turn` is pure, so all eight refusals are tested with no endpoint.

THREE RULES, EACH A BUG WRITTEN THE OTHER WAY ROUND

- `if not _advance_crowd(g): _drain(g)` -- advancing must *suppress* draining, or a
  queued human turn puts a second incomplete row beside the next speaker's.
- `_advance_crowd` refuses unless the finishing row is the newest, or regenerating
  member 2 creates a second member 3 and two chains race down one turn.
- an error skips one speaker and two in a row end the round: the usual failure is a
  small member's window overflowing, and `_drain`'s stop-on-error would kill every
  crowd at whichever member is smallest.

Each other speaker's turn is relabelled as attributed user content, which is both
how a model can disagree with words it did not write and how the history keeps
alternating. The per-speaker instruction is payload-only -- as a row it could be
dropped from the request by a `created_at` tie, and every later speaker would answer
it. Compaction, titling and the notification are gated to once per turn; `_inject`
is off during a round; the way back gets no tools and a member is treated as
unattended.

Membership stores the model as text with no foreign key: "Test & refresh" deletes
and recreates Model rows, and a cascade would empty the crowd out of every chat.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/lembas/api/chats.py

@@ -1453,6 +1453,32 @@ def _queue_frames(
                 + "</div>"
             )
 
+    # The next speaker of a crowd round, on the same frame and by the same
+    # mechanism -- an incomplete assistant bubble carries `sse-connect`, so htmx
+    # opens the next stream itself and there is no new streaming machinery here at
+    # all.
+    #
+    # Its own branch and not the one above, deliberately. That one also re-renders
+    # "the last user turn at or before this bubble" to take Send now and Discard
+    # off it, and a crowd has no queued user turn: the swap would either re-render
+    # a node that was already correct or target one that is not in the document,
+    # where htmx silently does nothing. A branch that sometimes does nothing is a
+    # branch nobody can reason about.
+    if getattr(generation, "crowded", False):
+        following = list(
+            db.scalars(
+                select(Message)
+                .where(Message.chat_id == chat.id, Message.complete.is_(False))
+                .order_by(Message.created_at, Message.id)
+            )
+        )
+        for speaker_row in following:
+            out_of_band.append(
+                '<div hx-swap-oob="beforeend:#thread">'
+                + _render_bubble(db, chat, owner, speaker_row)
+                + "</div>"
+            )
+
     return "".join(moved), "".join(out_of_band)
 
 
@@ -2089,6 +2115,42 @@ async def update_chat(request: Request, db: Db, user: RequiredUser, chat_id: str
             else []
         )
 
+    if "crowd_model_ids" in form:
+        # The same shape as the bases above: one field always sent, so clearing
+        # every box clears the crowd. Checked against what this person can reach
+        # rather than against what exists, or the picker is advisory and a crafted
+        # request walks past it -- the reasoning the model branch carries.
+        from lembas.db.models import CrowdMember
+
+        settings = settings_store.crowd(db)
+        reachable = {
+            model.model_id for model in chat_service.available_models(db, user)
+        }
+        wanted: list[str] = []
+        for value in form.getlist("crowd_model_ids"):
+            value = str(value).strip()
+            # Never the chat's own model: it would answer twice in a row, which is
+            # nobody's idea of a second opinion.
+            if value and value in reachable and value != chat.model_id and value not in wanted:
+                wanted.append(value)
+        wanted = wanted[: int(settings["max_models"])]
+
+        chat.crowd = [
+            CrowdMember(
+                model_id=model_id,
+                connection_id=next(
+                    (
+                        model.connection_id
+                        for model in chat_service.available_models(db, user)
+                        if model.model_id == model_id
+                    ),
+                    None,
+                ),
+                position=index,
+            )
+            for index, model_id in enumerate(wanted)
+        ]
+
     submitted_params = {name: form[name] for name in _PARAM_RANGES if name in form}
     if submitted_params:
         if not allowed.get("chat.params"):
@@ -2228,7 +2290,14 @@ async def regenerate(
     message.content = ""
     message.error = ""
     message.complete = False
-    message.model_id = chat.model_id
+    # Whose reply this was stays whose reply it is, unless the chat's model has
+    # been changed since -- in which case regenerating is how somebody asks for
+    # the new one. Before 1.6.0 this always reset to the chat's model, which was
+    # merely a wrong label; now that the row *is* the model that answers, it would
+    # silently regenerate somebody else's turn as the chat's model.
+    if not (message.model_id or "").strip():
+        message.model_id = chat.model_id
+        message.connection_id = chat.connection_id
     _note_rewind(chat)
     db.commit()
     # restart, not ensure: this is the one caller that reuses a Message row, and