agent-horde 0.1.5 → 0.1.6

package/src/ledger/facts.ts

@@ -1,8 +1,11 @@
 import * as fs from "node:fs";
 import { oneLine } from "../format.js";
+import { listClaims } from "./claims.js";
+import { CLUSTER_THRESHOLD } from "./clusters.js";
 import { appendEntry, hordePaths, requireText, writeFileAtomic } from "./files.js";
+import { listIdeas } from "./ideas.js";
 import { withHordeLock } from "./lock.js";
-import { bestTextMatch, factAnchors, salientTokens, stripLeadingId } from "./text-match.js";
+import { bestTextMatch, factAnchors, hardOverlap, salientTokens, stripLeadingId, textOverlap } from "./text-match.js";
 
 export interface FactEntry {
   id: number;
@@ -10,6 +13,8 @@ export interface FactEntry {
   author: string;
   deltaOf?: number | undefined;
   corroborators: string[];
+  /** The open idea (`#12`) or contested claim (`C3`) that was still auditing the subject when the fact was filed. */
+  provisionalOn?: string | undefined;
   headingLine: number;
 }
 
@@ -23,18 +28,58 @@ export function parseFacts(content: string): FactEntry[] {
     const meta = match[4] ?? "";
     const delta = /delta=#?T?(\d+)/.exec(meta);
     const corr = /corr=([^\s]+)/.exec(meta);
+    const prov = /prov=([^\s]+)/.exec(meta);
     facts.push({
       id: Number(match[1]),
       text: match[2] ?? "",
       author: match[3] ?? "",
       deltaOf: delta ? Number(delta[1]) : undefined,
       corroborators: corr?.[1] ? corr[1].split(",").map((s) => s.trim()).filter(Boolean) : [],
+      provisionalOn: prov?.[1],
       headingLine: lineIndex,
     });
   });
   return facts;
 }
 
+/**
+ * A fact asserting what an open idea is still auditing, or what a contested claim disputes, is
+ * provisional: it is recorded, but the answer may not quote it as settled until the idea closes
+ * or the claim resolves. Returns the subject it is provisional on, if any.
+ */
+function provisionalSubject(hordeDir: string, text: string): string | undefined {
+  const matches = (candidates: string[]): number | undefined => {
+    const match = textOverlap(candidates, text);
+    if (!match) return undefined;
+    return hardOverlap(match) || Math.max(match.jaccard, match.overlap) >= CLUSTER_THRESHOLD ? match.index : undefined;
+  };
+  const open = listIdeas(hordeDir).filter((idea) => idea.mark === " " || idea.mark === "~");
+  const idea = matches(open.map((entry) => entry.text));
+  if (idea !== undefined) return `#${open[idea]?.id}`;
+  const contested = listClaims(hordeDir).filter((claim) => claim.state === "contested");
+  const claim = matches(contested.map((entry) => entry.statement));
+  return claim === undefined ? undefined : `C${contested[claim]?.id}`;
+}
+
+/** Whether a fact's provisional subject is still open: an unclosed idea or a still-contested claim. */
+export function factUnsettled(hordeDir: string, fact: FactEntry): boolean {
+  if (!fact.provisionalOn) return false;
+  if (fact.provisionalOn.startsWith("#")) {
+    const idea = listIdeas(hordeDir).find((entry) => entry.id === Number(fact.provisionalOn?.slice(1)));
+    return idea !== undefined && (idea.mark === " " || idea.mark === "~");
+  }
+  const claim = listClaims(hordeDir).find((entry) => entry.id === Number(fact.provisionalOn?.slice(1)));
+  return claim?.state === "contested";
+}
+
+/** T# ids a text quotes whose provisional subject has not closed, each named with that subject. */
+export function unsettledFactCitations(hordeDir: string, text: string): string[] {
+  const cited = new Set([...text.matchAll(/\bT(\d+)\b/g)].map((m) => Number(m[1])));
+  return listFacts(hordeDir)
+    .filter((fact) => cited.has(fact.id) && factUnsettled(hordeDir, fact))
+    .map((fact) => `T${fact.id} (provisional on ${fact.provisionalOn})`);
+}
+
 /** Record a second reporter of the same fact on its heading, mirroring findings. */
 function addFactCorroborator(content: string, entry: FactEntry, author: string): string {
   if (entry.author === author || entry.corroborators.includes(author)) return content;
@@ -46,9 +91,10 @@ function addFactCorroborator(content: string, entry: FactEntry, author: string):
   return lines.join("\n");
 }
 
-function factEntry(author: string, text: string, id: number, deltaOf?: number): string {
+function factEntry(author: string, text: string, id: number, deltaOf?: number, provisionalOn?: string): string {
   const delta = deltaOf !== undefined ? `  delta=#T${deltaOf}` : "";
-  return `\n- [T${id}] ${text}  @${author}${delta}\n`;
+  const prov = provisionalOn ? `  prov=${provisionalOn}` : "";
+  return `\n- [T${id}] ${text}  @${author}${delta}${prov}\n`;
 }
 
 interface AddFactResult {
@@ -117,8 +163,9 @@ export async function addFact(
       if (hit) return accrete(hit);
     }
     const id = facts.reduce((max, fact) => Math.max(max, fact.id), 0) + 1;
-    appendEntry(factsPath, factEntry(author, body, id, deltaOf));
-    return { fact: { id, text: body, author, deltaOf, corroborators: [], headingLine: -1 } };
+    const provisionalOn = provisionalSubject(hordeDir, body);
+    appendEntry(factsPath, factEntry(author, body, id, deltaOf, provisionalOn));
+    return { fact: { id, text: body, author, deltaOf, corroborators: [], provisionalOn, headingLine: -1 } };
   });
 }
 

package/src/ledger/findings.ts

@@ -242,7 +242,7 @@ function findingEntry(
   if (meta.concern) tag += ` concern=${meta.concern}`;
   if (meta.deltaOf !== undefined) tag += ` delta=#F${meta.deltaOf}`;
   if (meta.supersedes !== undefined) tag += ` supersedes=#F${meta.supersedes}`;
-  return `\n### ${formatClock(now)} ${author}${tag}\n${neutralizeHeadings(text.trim())}\n`;
+  return `\n### ${formatClock(now)} ${author}${tag}\n${neutralizeNotes(neutralizeHeadings(text.trim()))}\n`;
 }
 
 /** Record another independent member on an existing finding's heading. */
@@ -495,6 +495,96 @@ export async function verifyFinding(
   });
 }
 
+interface AmendFindingInput {
+  id: number;
+  /** The whole replacement text: title line first, as for `finding`. */
+  text: string | undefined;
+  /** Why the prose changed; recorded in the body so the revision carries its own errata note. */
+  note: string | undefined;
+}
+
+/**
+ * Rewrite a finding's prose in place at its current revision. Evidence appends cannot fix a
+ * sentence and `supersedes` replaces whole findings, so a refuted sentence stayed in FINDINGS.md
+ * at freeze. The subject hash changes, reviews of the old revision stay pinned to it, and
+ * reviewers reattest when what they checked is unchanged. Verification notes are kept.
+ */
+export async function amendFinding(
+  hordeDir: string,
+  runId: string,
+  member: string,
+  { id, text, note }: AmendFindingInput,
+): Promise<{ finding: FindingEntry; previous: string; titleChanged: boolean }> {
+  const body = stripLeadingId(requireText(text, "amend")).trim();
+  const reason = oneLineReason(note);
+  return withHordeLock(hordeDir, member, () => {
+    const findingsPath = hordePaths(hordeDir).findings;
+    const content = readStampedFindings(findingsPath);
+    const all = parseFindings(content);
+    const entry = all.find((f) => f.runId === runId && f.id === id);
+    if (!entry) throw new Error(`horde: finding F${id} is not in run ${runId}; amend only this run's findings`);
+    if (entry.author !== member) throw new Error(`horde: F${id} belongs to ${entry.author}; a correction by another member is a finding with supersedes: ${id}`);
+    if (entry.supersededBy !== undefined) throw new Error(`horde: F${id} was superseded by F${entry.supersededBy}; amend the successor`);
+    const scoped = all.filter((f) => f.runId === runId && f.id !== id);
+    checkBodyReferences(scoped, { runId, author: member, body, meta: { supersedes: entry.supersedes, deltaOf: entry.deltaOf } });
+    const previous = findingRevision(entry);
+    const subjectEnd = entry.body.search(/\n(?:Verified|Reviewed) by /);
+    // Verification notes were written against the previous subject; they stay as history, labelled
+    // as such, and the heading's legacy verified label goes so the new text reads as unreviewed.
+    const notes = subjectEnd === -1 ? "" : `\n${entry.body.slice(subjectEnd)}`;
+    const predate = notes ? ` (verification notes below were recorded against revision ${previous.slice(0, 12)})` : "";
+    const amended = `${neutralizeNotes(neutralizeHeadings(body))}\nAmended ${formatClock(new Date())} by ${member}: ${reason}${predate}${notes}`;
+    const lines = content.split("\n");
+    // Corroborators and the legacy verifier confirmed the previous text; they confirm the new one again.
+    lines[entry.headingLine] = (lines[entry.headingLine] ?? "").replace(/\s+(?:verified|vsupport|corr)=[^\s]+/g, "");
+    lines.splice(entry.headingLine + 1, entry.body.split("\n").length, ...amended.split("\n"));
+    writeFileAtomic(findingsPath, lines.join("\n"));
+    const title = amended.split("\n")[0] ?? "";
+    const finding = { ...entry, body: amended, title, verifiedBy: undefined, verifiedSupport: undefined, corroborators: [] };
+    return { finding, previous, titleChanged: title.trim() !== entry.title.trim() };
+  });
+}
+
+function oneLineReason(note: string | undefined): string {
+  const reason = (note ?? "").replace(/\s+/g, " ").trim();
+  if (!reason) throw new Error("horde: amend needs note=<why the prose changed>, so the revision carries its errata");
+  return reason.slice(0, 300);
+}
+
+/** Superseded findings a text still cites, each with its successor. */
+export function supersededCitations(text: string, findings: FindingEntry[]): string[] {
+  return findings
+    .filter((finding) => finding.supersededBy !== undefined && new RegExp(`\\bF${finding.id}\\b`).test(text))
+    .map((finding) => `F${finding.id} (now F${finding.supersededBy})`);
+}
+
+/** The current revision of every live finding a text cites, pinned so a later amend is visible. */
+export function answerCitations(findings: FindingEntry[], text: string): Record<string, string> {
+  const cites: Record<string, string> = {};
+  for (const finding of findings) {
+    if (finding.supersededBy === undefined && new RegExp(`\\bF${finding.id}\\b`).test(text)) cites[`F${finding.id}`] = findingRevision(finding);
+  }
+  return cites;
+}
+
+/**
+ * Citations an answer can no longer stand on: findings superseded since it was written, and
+ * findings amended since the revisions it pinned. Both ship a stale reading as the result.
+ */
+export function staleAnswerCitations(findings: FindingEntry[], text: string, cites: Record<string, string> = {}): string[] {
+  const stale = supersededCitations(text, findings).map((citation) => `superseded ${citation}`);
+  for (const [target, revision] of Object.entries(cites)) {
+    const finding = findings.find((entry) => `F${entry.id}` === target);
+    if (finding && finding.supersededBy === undefined && findingRevision(finding) !== revision) stale.push(`amended ${target}`);
+  }
+  return stale;
+}
+
+/** A body line that reads as a verification note would move the subject boundary the revision hashes. */
+function neutralizeNotes(text: string): string {
+  return text.replace(/^((?:Verified|Reviewed) by )/gm, "\\$1");
+}
+
 export function listFindingsForRun(hordeDir: string, runId: string): FindingEntry[] {
   const findingsPath = hordePaths(hordeDir).findings;
   if (!fs.existsSync(findingsPath)) return [];

package/src/ledger/run-signals.ts

@@ -81,6 +81,8 @@ export interface SolvedSignal {
   member: string;
   text: string;
   at: string;
+  /** Revision of each finding the text cited when it was proposed, so a later amend is visible. */
+  cites?: Record<string, string>;
 }
 
 function solvedPath(runDir: string): string {
@@ -127,7 +129,8 @@ function readSignal(file: string): SolvedSignal | undefined {
   try {
     const parsed = JSON.parse(fs.readFileSync(file, "utf-8")) as Partial<SolvedSignal>;
     if (typeof parsed?.member === "string" && typeof parsed?.text === "string") {
-      return { member: parsed.member, text: parsed.text, at: parsed.at ?? "", revision: parsed.revision };
+      const cites = parsed.cites && typeof parsed.cites === "object" ? parsed.cites : undefined;
+      return { member: parsed.member, text: parsed.text, at: parsed.at ?? "", revision: parsed.revision, ...(cites ? { cites } : {}) };
     }
   } catch {
     // No signal, or a torn write; treat as none.
@@ -195,6 +198,7 @@ export async function markSolved(
   runId: string,
   member: string,
   text: string | undefined,
+  cites?: Record<string, string>,
 ): Promise<{ signal: SolvedSignal; alreadySolved: boolean }> {
   // The full answer is stored untruncated; only the board line is shortened.
   const full = requireText(text, "solved").trim();
@@ -203,7 +207,7 @@ export async function markSolved(
   return withHordeLock(hordeDir, member, () => {
     const existing = readSolved(runDir);
     if (existing) return { signal: existing, alreadySolved: true };
-    const signal: SolvedSignal = { member, text: full, at: new Date().toISOString(), revision: randomUUID() };
+    const signal: SolvedSignal = { member, text: full, at: new Date().toISOString(), revision: randomUUID(), ...(cites ? { cites } : {}) };
     writeFileAtomic(solvedPath(runDir), `${JSON.stringify(signal)}\n`);
     // Capture the answer immediately so it survives even if the run is killed
     // before finalize; the status is upgraded on validation and at finalize.
@@ -213,6 +217,17 @@ export async function markSolved(
   });
 }
 
+/**
+ * Put a withdrawn or contested proposal back before the members, under a new revision so a
+ * confirmation of the old one cannot validate it. Call under the horde lock.
+ */
+export function reopenSolved(runDir: string, runId: string, proposal: SolvedSignal, status: string, cites?: Record<string, string>): SolvedSignal {
+  const signal: SolvedSignal = { member: proposal.member, text: proposal.text, at: new Date().toISOString(), revision: randomUUID(), ...(cites ? { cites } : {}) };
+  writeFileAtomic(solvedPath(runDir), `${JSON.stringify(signal)}\n`);
+  writeAnswer(runDir, runId, signal, status);
+  return signal;
+}
+
 interface SolvedAnswer {
   ok: boolean;
   reason: string;

package/src/member.ts

@@ -55,6 +55,8 @@ export interface MemberState {
   summaryIncomplete?: boolean | undefined;
   /** How many fresh-context sessions replaced this member's earlier ones. */
   resets?: number | undefined;
+  /** Fresh sessions an `--until-stop` run gave this member after an earlier one finished. */
+  continuations?: number | undefined;
   /** Set by the parent before it kills a stalled member, so the exit is treated as a reset. */
   resetPending?: string | undefined;
   /** Extra identity line for a replacement session, naming what was reset and why. */
@@ -81,6 +83,8 @@ export interface MemberRunInfo {
   runDir: string;
   prompt: string;
   count: number;
+  /** True when started with `--until-stop`: the run continues until the user stops it. */
+  untilStop?: boolean | undefined;
 }
 
 interface SpawnMemberInput {
@@ -283,11 +287,19 @@ export function memberSessionDir(runDir: string, member: string): string {
   return path.join(runDir, "sessions", member);
 }
 
-/** The per-member system line: name, assigned role, and a reset note for a replacement. */
-function identityLine(member: MemberState, role: string | undefined): string {
+/** What an `--until-stop` member does instead of stopping when the board runs dry. */
+export const UNTIL_STOP_NOTE =
+  "This run continues until the user stops it. When nothing worthwhile remains on the board, add " +
+  "ideas that extend, stress-test, or deepen the work and pursue them instead of stopping. Propose " +
+  "SOLVED when the task has a complete answer; once an answer is banked, propose again only when a " +
+  "materially better one exists.";
+
+/** The per-member system line: name, assigned role, a reset note for a replacement, the until-stop rule. */
+function identityLine(run: MemberRunInfo, member: MemberState, role: string | undefined): string {
   const parts = [`You are ${member.name}.`];
   if (role) parts.push(role);
   if (member.resetNote) parts.push(member.resetNote);
+  if (run.untilStop) parts.push(UNTIL_STOP_NOTE);
   return parts.join(" ");
 }
 
@@ -297,7 +309,7 @@ export function buildMemberArgs(input: SpawnMemberInput): string[] {
     "--mode", "json", "-p",
     "--session-dir", memberSessionDir(run.runDir, member.name),
     "--append-system-prompt", path.join(run.runDir, "SYSTEM.md"),
-    "--append-system-prompt", identityLine(member, input.role),
+    "--append-system-prompt", identityLine(run, member, input.role),
   ];
   if (input.model) args.push("--model", `${input.model.provider}/${input.model.id}`);
   if (input.thinkingLevel) args.push("--thinking", input.thinkingLevel);

package/src/prompt.ts

@@ -58,17 +58,36 @@ export interface RunSummaryInput {
   memberPosts?: Map<string, string> | undefined;
 }
 
+interface MemberContribution {
+  findings: number;
+  verified: number;
+  reviewed: number;
+  /** Current-revision reviews by this member with nothing left unchecked. */
+  fullScope: number;
+  /** Other members' current findings this member has not reviewed at their current revision. */
+  unreviewed: number[];
+  ideasClosed: number;
+  /** True for the member that held the verifier role; its coverage line is printed. */
+  verifier: boolean;
+}
+
 /** Findings filed, verified, and claimed ideas closed by one member, for the summary. */
 function memberContribution(
   name: string,
   findings: FindingEntry[],
   ideas: Idea[],
   reviews: ReviewRecord[] = [],
-): { findings: number; verified: number; reviewed: number; ideasClosed: number } {
+  verifier = false,
+): MemberContribution {
+  const current = findings.filter((f) => f.supersededBy === undefined);
+  const ownReview = (f: FindingEntry): ReviewRecord | undefined => findingReviewState(f, reviews).reviews.find((r) => r.actor === name);
   return {
+    verifier,
     findings: findings.filter((finding) => finding.author === name).length,
     verified: findings.filter((finding) => finding.verifiedBy === name).length,
-    reviewed: findings.filter((f) => f.supersededBy === undefined && findingReviewState(f, reviews).reviews.some((r) => r.actor === name)).length,
+    reviewed: current.filter((f) => ownReview(f) !== undefined).length,
+    fullScope: current.filter((f) => !ownReview(f)?.unchecked.trim() && ownReview(f) !== undefined).length,
+    unreviewed: current.filter((f) => f.author !== name && ownReview(f) === undefined).map((f) => f.id),
     ideasClosed: ideas.filter((idea) => idea.mark === "x" && idea.owner === name).length,
   };
 }
@@ -82,8 +101,10 @@ export const VERIFIER_ROLE =
   "You are the verifier. Reproduce the highest-importance unverified findings first. Record each " +
   "check with 'horde inspect', 'horde attach', then 'horde review': name the exact revision, assertions " +
   "checked, unchecked assertions, method, evidence refs and support. Source reasoning is not a live reproduction. When a finding does not reproduce, send a blocking challenge to its owner and contest its claim C# if one exists, or " +
-  "file a finding with supersedes: F# under the same idea and concern. Do not claim ideas or " +
-  "file findings of your own unless nothing is left to verify.";
+  "file a finding with supersedes: F# under the same idea and concern. The tool refuses your idea claims " +
+  "while other members' findings await your review, and a session that closes with high-importance " +
+  "findings unreviewed is replaced by a fresh one that owes them. Your summary's coverage sentence is " +
+  "derived from your review records, so name what you left unreviewed rather than calling the work verified.";
 
 const COLLABORATION_PROTOCOL = `
 Collaboration loop:
@@ -114,14 +135,29 @@ Collaboration loop:
   review can accept a document; runnable outputs require tested/reproduced support. Document acceptance
   does not establish execution or remove finding limitations. Kind is immutable. Updates need target=A#
   and revision=previous-hash; changed criteria/dependencies require changed file bytes and a fresh review.
-  Ask a peer to review A# before settling.
-- Review with target=F#/A#, revision=current-hash, checked=assertions-and-method, unchecked=remaining-gaps,
-  verdict=supports|partially-supports|refutes|inconclusive, support=tested|reproduced|derived|sourced,
-  refs=[E#], text=observations. Empty unchecked means you checked the whole stated claim.
+  Ask a peer to review A# before settling. Once other artifacts pin your A# (a spec they build against),
+  its revision is a frozen contract: route clarifications to a follow-up, and republish only with text=
+  naming the change and whether behaviour is unchanged, so dependents can reattest instead of re-reviewing.
+- Review with target=F#/A#, revision=current-hash, checked=assertions-and-method, unchecked=in-criteria-gaps,
+  limits=out-of-criteria-disclosures, verdict=supports|partially-supports|refutes|inconclusive,
+  support=tested|reproduced|derived|sourced, refs=[E#], text=observations. Judge unchecked against the
+  target's stated claim or criteria: a gap inside them keeps acceptance open until a full review covers it;
+  a limit outside them (one engine, no hardened deployment) goes in limits and is recorded on the
+  acceptance, never as a blocker. Empty unchecked means you checked the whole stated scope. A partial
+  verdict refutes nothing and opens no challenge: the acceptance names what it left unchecked. Only
+  refutes opens a challenge to the owner; send a challenge yourself when a partial check found a defect.
   To avoid a separate attach call, review may include evidenceText=full-observation and optional
   artifactPath instead of (or alongside) refs. Evidence and review commit atomically with separate E#/V#
   IDs and the same independence/revision checks. Keep text a decision summary; do not repeat the raw
   evidence in checked, text and evidenceText. The separate attach/review workflow remains available.
+- When a target you reviewed is re-hashed without changing what you checked (an amended sentence, a
+  republish against a corrected dependency, a spec clarification), horde reattest target=F#/A#
+  revision=current-hash evidenceText=what-you-compared text=why carries your earlier review forward
+  instead of repeating it. Reattest only what is unchanged; a changed claim needs a new review.
+- Fix wrong prose in your own finding with horde amend id=F# text=full-replacement note=why: the
+  revision changes, reviews stay pinned to what they checked, and reviewers reattest or re-review.
+  A reviewer's unchecked text or refutation that contradicts a sentence of your body is a request to
+  amend or supersede, not to leave the sentence standing. Another member corrects you with supersedes.
 - horde resource-state target=R# resourceState=building|ready|broken|retired text=health-result ports=[port]
   leaseSeconds=300 generation=last-generation. Ready needs refs=[health-evidence-E#]. Read collaboration first.
   Only the lease holder mutates a lab. Expired leases require checking its state before takeover.
@@ -172,7 +208,9 @@ Protocol:
    deletion is refused: reproducers under the run artifacts directory are retained as evidence.
 4. Record each checkable environment fact once with 'horde fact' (include the command and the
    observed result). If it extends an existing fact, pass delta-of: T# instead of restating it.
-   Read FACTS.md before re-deriving anything, and do not duplicate it.
+   Read FACTS.md before re-deriving anything, and do not duplicate it. A fact about what an open
+   idea is still auditing, or what a contested claim disputes, is recorded as provisional on it:
+   the answer may not quote it until that idea closes or the claim resolves.
 5. Record each finding with 'horde finding'. The claimed idea id and a concern slug are required.
    A concern is a short stable slug for the subject or issue, for example auth-token-refresh or
    chapter-3-voice; different subjects or entry points need different concerns and separate
@@ -185,6 +223,10 @@ Protocol:
    from primary documents, or speculative. If the tool
    returns an existing F#, cite that id and file only distinct evidence with delta-of: F# and the
    exact same concern. Prefer attach for new evidence on an existing finding; stronger follow-up reviews are welcome.
+   Before reproducing an existing F#, run 'horde findings': one with a corroborator or a full-scope
+   review is settled, and a further reproduction is refused. Bring a new vector or distinct evidence
+   as delta-of: F#, or take a different slice. Register the harness, driver, lab or corpus you build
+   as an R# before others need it, with its path in note, so they reuse it instead of rewriting it.
    If your finding corrects or overturns an earlier finding, pass supersedes: F#. Cite R# for every run artifact. If it contradicts an earlier
    finding, use supersedes: F#, or record a claim with assert/contest, instead of leaving the
    correction in prose. Independent review is recorded by another member at the exact revision.
@@ -192,8 +234,9 @@ Protocol:
    inconclusive reviews remain reviewed-with-gaps. Neither a review count nor full claim coverage
    automatically establishes runtime exploitation. Keep source checks, controlled tests, and
    end-to-end reproductions distinct; legacy verified= headings are not the scoped-review count.
-6. When a lead is a confirmed negative, use 'horde rule-out' so later runs do not retry it.
-   Use 'horde drop' only to return work you are not pursuing to the open pool.
+6. When a lead is a confirmed negative, use 'horde rule-out' so later runs do not retry it; 'done'
+   with a negative result line is refused. Contradicting evidence attached to an idea is a rule-out
+   candidate for its owner. Use 'horde drop' only to return work you are not pursuing to the open pool.
 7. When two members actually disagree on a hypothesis, 'horde assert' it and use
    'confirm'/'contest'/'retract' with primary evidence. Do not use CLAIMS.md for work ownership.
 8. Post progress and dead ends in one or two lines so others do not repeat them. Re-read
@@ -207,8 +250,12 @@ Protocol:
     Continue distinct claimed work while another member validates it. For a broad task,
     one finding is never the complete answer: every current-run priority idea must first be done or
     ruled out. Call 'horde confirm-solved' only after independent verification, or
-    'horde contest-solved' with what is missing. Pass the revision from ANSWER.md or
-    'horde inspect' target=answer to either action, so stale reviews cannot approve a newer proposal.
+    'horde contest-solved' with what is missing, naming the open ideas (#12, #14) that block it: the
+    proposal reopens for validation once every idea it named is done or ruled out. Pass the revision
+    from ANSWER.md or 'horde inspect' target=answer to either action, so stale reviews cannot approve
+    a newer proposal. An answer that cites a superseded F# or quotes a provisional T# is refused, and a
+    pending proposal is withdrawn for re-proposal when a finding it cites is superseded. A request to
+    the proposer or a validator about the pending answer (target=answer) is served with the blockers.
     The parent enforces coverage before wind-down.
 
 ${COLLABORATION_PROTOCOL}
@@ -227,6 +274,7 @@ export function taskMarkdown(input: {
   thinkingLevel?: string | undefined;
   startedAt: number;
   verifier?: string | undefined;
+  untilStop?: boolean | undefined;
 }): string {
   return [
     `# Horde run ${input.id}`,
@@ -236,6 +284,7 @@ export function taskMarkdown(input: {
     `Model: ${input.model ?? "parent default"}`,
     `Thinking: ${input.thinkingLevel ?? "parent default"}`,
     `Verifier: ${input.verifier ?? "none"}`,
+    `Until stop: ${input.untilStop ? "yes (the run continues until stop-clean or stop-hard)" : "no"}`,
     `Task-SHA256: ${taskHash(input.prompt)}`,
     "",
     "## Prompt",
@@ -315,7 +364,7 @@ function memberElapsed(m: MemberState, now: number): string {
 function memberSummarySection(
   m: MemberState,
   now: number,
-  stats?: { findings: number; verified: number; reviewed: number; ideasClosed: number },
+  stats?: MemberContribution,
   resets: MemberReset[] = [],
   memberPosts?: Map<string, string>,
 ): string[] {
@@ -324,9 +373,17 @@ function memberSummarySection(
   lines.push(`${m.turns} turns, ${m.toolCalls} tool calls, ${tokens}, ${memberElapsed(m, now)}`);
   if (stats) {
     lines.push(
-      `${stats.findings} findings filed, ${stats.reviewed} independently reviewed (scoped), ${stats.verified} legacy verification labels, ` +
+      `${stats.findings} findings filed, ${stats.reviewed} independently reviewed (scoped: ${stats.fullScope} full, ` +
+        `${stats.reviewed - stats.fullScope} with unchecked scope), ${stats.verified} legacy verification labels, ` +
         `${stats.ideasClosed} claimed idea(s) closed`,
     );
+    // The coverage sentence comes from the review records, not from the member's prose: a
+    // verifier's "all work is verified" over twelve reviews with unchecked scope stated zero.
+    if (stats.verifier) {
+      const total = stats.reviewed + stats.unreviewed.length;
+      const owed = stats.unreviewed.length ? `; unreviewed: ${stats.unreviewed.map((id) => `F${id}`).join(", ")}` : "";
+      lines.push(`verifier coverage from review records: ${stats.reviewed} of ${total} other members' current findings reviewed, ${stats.fullScope} at full scope${owed}`);
+    }
   }
   if (resets.length > 0) {
     lines.push(`resets: ${resets.length} (${resets.map((reset) => reset.reason).join("; ")})`);
@@ -411,7 +468,7 @@ export function summaryMarkdown(run: RunSummaryInput, now: number = Date.now()):
   const ideas = run.ideas ?? [];
   const haveLedger = findings.length > 0 || ideas.length > 0;
   for (const m of run.members) {
-    const stats = haveLedger ? memberContribution(m.name, findings, ideas, run.scopedReviews) : undefined;
+    const stats = haveLedger ? memberContribution(m.name, findings, ideas, run.scopedReviews, m.name === run.verifier) : undefined;
     lines.push(...memberSummarySection(m, now, stats, resetsOf(m.name, run.resets), run.memberPosts));
   }
   return lines.join("\n");

package/src/run/completions.ts

@@ -25,7 +25,12 @@ const NO_VERIFIER_COMPLETION = {
   description: "do not assign the verifier role to the last member of a 3+ member run",
 };
 
-const LAUNCH_FLAG_COMPLETIONS = [DASHBOARD_COMPLETION, NO_VERIFIER_COMPLETION];
+const UNTIL_STOP_COMPLETION = {
+  value: "--until-stop ",
+  description: "keep the whole horde working until stop-clean or stop-hard; validated solves are banked",
+};
+
+const LAUNCH_FLAG_COMPLETIONS = [DASHBOARD_COMPLETION, NO_VERIFIER_COMPLETION, UNTIL_STOP_COMPLETION];
 
 /** Argument completions that are not member targets. */
 const EXTRA_COMPLETIONS: Record<string, Array<{ value: string; description: string }>> = {

package/src/run/finalize.ts

@@ -20,7 +20,7 @@ import { clusterFindings } from "../ledger/clusters.js";
 import { listFacts } from "../ledger/facts.js";
 import type { FactEntry } from "../ledger/facts.js";
 import { readHordeFile } from "../ledger/files.js";
-import { listFindingsForRun, parseFindings } from "../ledger/findings.js";
+import { listFindingsForRun, parseFindings, supersededCitations } from "../ledger/findings.js";
 import type { FindingEntry } from "../ledger/findings.js";
 import { countIdeas, parseIdeas, reconcileOwnedIdeas } from "../ledger/ideas.js";
 import type { Idea } from "../ledger/ideas.js";
@@ -109,6 +109,11 @@ function settleSolved(run: HordeRun): SettledAnswer | undefined {
   ) {
     run.solvedValidatedBy = solvedState.confirm.member;
   }
+  // `--until-stop`: the last banked answer stands unless a later proposal was validated too.
+  if (run.lastRound && !(run.solved && run.solvedValidatedBy)) {
+    run.solved = run.lastRound.proposal;
+    run.solvedValidatedBy = run.lastRound.validator;
+  }
   if (run.solved) {
     const status = run.solvedValidatedBy
       ? `validated by ${run.solvedValidatedBy}`
@@ -132,12 +137,6 @@ interface SettledAnswer {
 }
 
 /** Findings the proposal names that a later finding corrected; labeled, not re-versioned. */
-export function supersededCitations(text: string, findings: FindingEntry[]): string[] {
-  return findings
-    .filter((finding) => finding.supersededBy !== undefined && new RegExp(`\\bF${finding.id}\\b`).test(text))
-    .map((finding) => `F${finding.id} (now F${finding.supersededBy})`);
-}
-
 /**
  * The proposal body is the member's verbatim text and can predate later challenges and corrections.
  * The status names the blockers still open at freeze and the findings a later finding superseded,

package/src/run/launch.ts

@@ -194,7 +194,7 @@ async function launchRun(
   try {
     await seedRun(run);
     await recordLifecycle(run, "run-start", {
-      count: run.count, model: run.model, verifier: run.verifier, plan: run.plan,
+      count: run.count, model: run.model, verifier: run.verifier, plan: run.plan, untilStop: run.untilStop,
       roles: roles.map((role) => oneLine(role, 120)), dashboardUrl: run.dashboardUrl,
     });
     await recordPhase(run, "discovery", "start");

package/src/run/repair.ts

@@ -13,9 +13,12 @@ import { scheduleCollaboration, stopReason } from "./schedule.js";
 import { spawnOne } from "./supervise.js";
 import type { RunLaunch } from "./supervise.js";
 
-/** Blockers and independent checks take precedence over administrative exchanges. */
+/**
+ * Blockers and independent checks take precedence over administrative exchanges. A request to
+ * validate the pending answer decides the run's outcome, so it ranks with the blockers.
+ */
 function repairPriority(message: PeerMessage): number {
-  if (message.blocking) return 0;
+  if (message.blocking || message.target === "answer") return 0;
   if (message.kind === "review-request" && /^[AF]\d+$/.test(message.target)) return 1;
   if (message.state === "responded") return 2;
   return 3;
@@ -33,7 +36,7 @@ function queueFor(launch: RunLaunch, member: MemberState): PeerMessage[] {
  * three reviews demands three, so its share is sized to the work rather than to the member.
  */
 export function repairDemand(queue: PeerMessage[]): number {
-  const checks = queue.filter((m) => m.blocking || (m.kind === "review-request" && /^[AF]\d+$/.test(m.target))).length;
+  const checks = queue.filter((m) => m.blocking || m.target === "answer" || (m.kind === "review-request" && /^[AF]\d+$/.test(m.target))).length;
   return Math.max(1, checks);
 }
 
@@ -135,8 +138,12 @@ interface FirstTurnCost {
   cacheWrite: number;
 }
 
-/** A finished worker receives a fresh, bounded attempt with a precise evidence handoff. */
-async function repairMember(launch: RunLaunch, member: MemberState, deadline: number, limits: RepairLimits, floors: RepairFloors): Promise<void> {
+/**
+ * A finished worker receives a fresh, bounded attempt with a precise evidence handoff. The time
+ * share is the allowance recorded and the deadline is derived from it once, so the record cannot
+ * read a millisecond under the floor the share was raised to.
+ */
+async function repairMember(launch: RunLaunch, member: MemberState, ms: number, limits: RepairLimits, floors: RepairFloors): Promise<void> {
   const { run } = launch;
   const ctx = { hordeDir: run.hordeDir, runId: run.id, actor: member.name };
   const queue = queueFor(launch, member);
@@ -146,7 +153,8 @@ async function repairMember(launch: RunLaunch, member: MemberState, deadline: nu
   member.repairs = (member.repairs ?? 0) + 1;
   member.repairStopReason = undefined;
   member.attempt = randomUUID();
-  const allowance = { ...limits, ms: Math.max(0, deadline - Date.now()) };
+  const deadline = Date.now() + ms;
+  const allowance = { ...limits, ms };
   let firstTurn: FirstTurnCost | undefined;
   member.resetNote = `Repair attempt ${member.repairs}. Discovery is closed. Budget: about ${allowance.tokens} input+output tokens, ${allowance.turns} turns and ${allowance.ms}ms. ` +
     `Read horde inbox and referenced evidence. Work in this priority order: ${queue.map((m) => `${m.id} ${m.target} (${m.state})`).join(", ")}. ` +
@@ -264,7 +272,7 @@ async function runRepairRounds(launch: RunLaunch, begin: (budget: RepairBudget)
       }
       await begin(budget);
       served.add(next.member.name);
-      await repairMember(launch, next.member, Date.now() + ms, { tokens, turns: budget.turns }, floors);
+      await repairMember(launch, next.member, ms, { tokens, turns: budget.turns }, floors);
     }
   }
 }