A crowd in one chat

The chat's own model answers, then each other member in order, then the order runs
backwards asking each whether it disagrees, ending at the main model, which either
closes or sends them round again. Design and reasoning: LLeMbas.wiki/Crowd-chats.

THE SPEAKER SEAM, WHICH IS ALSO A BUG FIX

`chat_service.speaker_for` makes the *message* name the answering model and the
chat only the default. That closes a live half-wired feature -- `wake_chat` takes a
model override and `schedule/runner` passes one, and it reached the row and never
the request, so a schedule naming another model got the chat's model wearing the
other one's name.

The seam is wider than `build_request`: `{{model_name}}`, the authored prompt's
model layer, `vision` (where a wrong answer makes the endpoint reject the whole
request), the effort vocabulary (which raises inside the model's own chat template,
and whose refusal narrows every Model row sharing the id), `resolve_tools`,
`context_length` -> `_too_big`, and `ToolContext.model_id`. `resolve_endpoint` may
now only write back `chat.connection_id` when the speaker *is* the chat's model.

WHY N CHAINED REPLIES

`Generation` is one reply's state and `_follow` streams per message, so one
generation cannot stream into nine bubbles and `ensure` would not know which of the
nine it was after a restart. A subagent per speaker cannot work either: its answer
comes back as a tool result and tool results are never replayed, so speaker 3 could
not see speaker 2 -- which is the whole point. Chained, exactly one incomplete row
exists at a time, and `tests/test_crowd_chain.py` asserts that at every
observation.

The round lives on `Message.crowd_json`, not on the chat: the row is the authority,
and chat-level state would describe turns a rewind or a restart had removed.
`crowd.next_turn` is pure, so all eight refusals are tested with no endpoint.

THREE RULES, EACH A BUG WRITTEN THE OTHER WAY ROUND

- `if not _advance_crowd(g): _drain(g)` -- advancing must *suppress* draining, or a
  queued human turn puts a second incomplete row beside the next speaker's.
- `_advance_crowd` refuses unless the finishing row is the newest, or regenerating
  member 2 creates a second member 3 and two chains race down one turn.
- an error skips one speaker and two in a row end the round: the usual failure is a
  small member's window overflowing, and `_drain`'s stop-on-error would kill every
  crowd at whichever member is smallest.

Each other speaker's turn is relabelled as attributed user content, which is both
how a model can disagree with words it did not write and how the history keeps
alternating. The per-speaker instruction is payload-only -- as a row it could be
dropped from the request by a `created_at` tie, and every later speaker would answer
it. Compaction, titling and the notification are gated to once per turn; `_inject`
is off during a round; the way back gets no tools and a member is treated as
unattended.

Membership stores the model as text with no foreign key: "Test & refresh" deletes
and recreates Model rows, and a cascade would empty the crowd out of every chat.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/lembas/db/models/__init__.py

@@ -31,6 +31,7 @@ from lembas.db.models.chat import (
     ROLE_TOOL,
     ROLE_USER,
     Chat,
+    CrowdMember,
     Folder,
     Message,
 )
@@ -163,6 +164,7 @@ __all__ = [
     "Report",
     "Schedule",
     "Chat",
+    "CrowdMember",
     "Job",
     "Connection",
     "CustomTool",

src/lembas/db/models/chat.py

@@ -5,7 +5,15 @@ from __future__ import annotations
 from datetime import datetime
 from typing import TYPE_CHECKING, Any
 
-from sqlalchemy import Boolean, DateTime, ForeignKey, Integer, String, Text
+from sqlalchemy import (
+    Boolean,
+    DateTime,
+    ForeignKey,
+    Integer,
+    String,
+    Text,
+    UniqueConstraint,
+)
 from sqlalchemy.orm import Mapped, mapped_column, relationship
 
 from lembas.db.base import Base, Timestamps, UUIDPrimaryKey
@@ -309,10 +317,60 @@ class Chat(UUIDPrimaryKey, Timestamps, Base):
         "KnowledgeBase", secondary="chat_knowledge_bases"
     )
 
+    # The other models answering in this chat, in the order they speak. Empty is
+    # every chat that has ever existed: one model, answering on its own.
+    crowd: Mapped[list[CrowdMember]] = relationship(
+        back_populates="chat",
+        cascade="all, delete-orphan",
+        order_by="CrowdMember.position",
+    )
+
     def __repr__(self) -> str:
         return f"<Chat {self.title!r}>"
 
 
+class CrowdMember(UUIDPrimaryKey, Timestamps, Base):
+    """One extra model answering in a chat, and where it sits in the order.
+
+    A row rather than an association table because it carries an order and has
+    nothing to associate *to*:
+
+    🚨 **the model is stored as text, with no foreign key to `models`.** "Test &
+    refresh" on the connection screen deletes every model the endpoint has
+    stopped listing and creates it again when it comes back, so a foreign key
+    with `ON DELETE CASCADE` -- which is what copying `chat_knowledge_bases`
+    would have given -- means one refresh taken while an endpoint happened to be
+    loading something else silently empties the crowd out of every chat, with no
+    row left to explain it. This is the reasoning `Chat.model_id`,
+    `ssh_profile_id` and `compacted_through_id` all carry, and the same trap that
+    lost the image reviewer its model in 1.4.x.
+
+    A member that no longer resolves is therefore skipped at send time and shown
+    struck through, rather than being deleted by something nobody asked.
+
+    `connection_id` is nullable and usually empty, meaning "resolve it from the
+    id"; it matters only where two connections offer the same model, since their
+    capabilities and effort lists are separate rows.
+    """
+
+    __tablename__ = "chat_crowd"
+    __table_args__ = (UniqueConstraint("chat_id", "model_id"),)
+
+    chat_id: Mapped[str] = mapped_column(
+        String(32), ForeignKey("chats.id", ondelete="CASCADE"), nullable=False, index=True
+    )
+    model_id: Mapped[str] = mapped_column(String(300), nullable=False)
+    connection_id: Mapped[str | None] = mapped_column(String(32), nullable=True)
+    # Where this member speaks. The chat's own model is always first and is not a
+    # row here, so these start at 1 in spirit and are only ever compared.
+    position: Mapped[int] = mapped_column(Integer, default=0, nullable=False)
+
+    chat: Mapped[Chat] = relationship(back_populates="crowd")
+
+    def __repr__(self) -> str:
+        return f"<CrowdMember {self.model_id} at {self.position}>"
+
+
 class Message(UUIDPrimaryKey, Timestamps, Base):
     __tablename__ = "messages"
 
@@ -340,14 +398,46 @@ class Message(UUIDPrimaryKey, Timestamps, Base):
     # Milliseconds spent producing the reasoning, for the "Thought for Xs" label.
     reasoning_ms: Mapped[int] = mapped_column(Integer, default=0, nullable=False)
 
+    # Which model wrote this, or is about to. Written on every assistant
+    # placeholder at creation and, from 1.6.0, **read back as the model that
+    # answers** -- `chat_service.speaker_for`. Before that it was a display
+    # snapshot only, and the two could disagree: `wake_chat` accepts a model
+    # override that reached this column and never reached the request, so a
+    # schedule naming another model got the chat's model wearing this label.
     model_id: Mapped[str] = mapped_column(String(300), default="")
 
+    # Which connection that model was reached through. Nullable and usually
+    # empty, meaning "resolve it from the model id as this application always
+    # has"; it matters only where the same id is offered by two connections,
+    # since `Model` is unique on the pair and their capabilities, context lengths
+    # and effort lists are separate rows.
+    #
+    # No foreign key, deliberately, and the same reasoning `Chat.model_id`
+    # carries: a transcript has to survive an administrator deleting a
+    # connection, and `migrations.py` compiles only the column type -- so a
+    # REFERENCES clause would exist on a fresh database and not on an upgraded
+    # one. Validated on read instead.
+    connection_id: Mapped[str | None] = mapped_column(String(32), nullable=True)
+
     # What the model did before answering: one entry per tool call, with its
     # arguments and results. Shown in the transcript so the sources behind an
     # answer stay visible, and deliberately NOT replayed as context on the next
     # turn -- see services/generation.py for why.
     tool_calls_json: Mapped[list[Any]] = mapped_column(JSONList, default=list)
 
+    # Where this message sits in a crowd round: the turn it belongs to, the
+    # round, the phase, and which speaker it is. NULL on every message that is
+    # not part of one, which is every message this application has ever written
+    # before 1.6.0.
+    #
+    # On the row and not on the chat, deliberately. "The row is the authority,
+    # not the registry" is the rule the reload story was won with, and round
+    # state on the chat reintroduces the split it was won against: a restart
+    # between speakers, or a rewind that deletes these rows, would leave
+    # chat-level state describing turns that no longer exist -- which is the
+    # problem `compacted_through_id` already documents.
+    crowd_json: Mapped[dict[str, Any] | None] = mapped_column(JSONDict, nullable=True)
+
     # Where each round's contribution ended, so `content`, `reasoning` and
     # `tool_calls_json` can be shown as the one sequence they actually were
     # rather than as three stacked zones. One entry per closed step, holding the