agent-horde 0.1.5 → 0.2.0

package/src/ledger/findings.ts

@@ -242,7 +242,7 @@ function findingEntry(
   if (meta.concern) tag += ` concern=${meta.concern}`;
   if (meta.deltaOf !== undefined) tag += ` delta=#F${meta.deltaOf}`;
   if (meta.supersedes !== undefined) tag += ` supersedes=#F${meta.supersedes}`;
-  return `\n### ${formatClock(now)} ${author}${tag}\n${neutralizeHeadings(text.trim())}\n`;
+  return `\n### ${formatClock(now)} ${author}${tag}\n${neutralizeNotes(neutralizeHeadings(text.trim()))}\n`;
 }
 
 /** Record another independent member on an existing finding's heading. */
@@ -495,6 +495,96 @@ export async function verifyFinding(
   });
 }
 
+interface AmendFindingInput {
+  id: number;
+  /** The whole replacement text: title line first, as for `finding`. */
+  text: string | undefined;
+  /** Why the prose changed; recorded in the body so the revision carries its own errata note. */
+  note: string | undefined;
+}
+
+/**
+ * Rewrite a finding's prose in place at its current revision. Evidence appends cannot fix a
+ * sentence and `supersedes` replaces whole findings, so a refuted sentence stayed in FINDINGS.md
+ * at freeze. The subject hash changes, reviews of the old revision stay pinned to it, and
+ * reviewers reattest when what they checked is unchanged. Verification notes are kept.
+ */
+export async function amendFinding(
+  hordeDir: string,
+  runId: string,
+  member: string,
+  { id, text, note }: AmendFindingInput,
+): Promise<{ finding: FindingEntry; previous: string; titleChanged: boolean }> {
+  const body = stripLeadingId(requireText(text, "amend")).trim();
+  const reason = oneLineReason(note);
+  return withHordeLock(hordeDir, member, () => {
+    const findingsPath = hordePaths(hordeDir).findings;
+    const content = readStampedFindings(findingsPath);
+    const all = parseFindings(content);
+    const entry = all.find((f) => f.runId === runId && f.id === id);
+    if (!entry) throw new Error(`horde: finding F${id} is not in run ${runId}; amend only this run's findings`);
+    if (entry.author !== member) throw new Error(`horde: F${id} belongs to ${entry.author}; a correction by another member is a finding with supersedes: ${id}`);
+    if (entry.supersededBy !== undefined) throw new Error(`horde: F${id} was superseded by F${entry.supersededBy}; amend the successor`);
+    const scoped = all.filter((f) => f.runId === runId && f.id !== id);
+    checkBodyReferences(scoped, { runId, author: member, body, meta: { supersedes: entry.supersedes, deltaOf: entry.deltaOf } });
+    const previous = findingRevision(entry);
+    const subjectEnd = entry.body.search(/\n(?:Verified|Reviewed) by /);
+    // Verification notes were written against the previous subject; they stay as history, labelled
+    // as such, and the heading's legacy verified label goes so the new text reads as unreviewed.
+    const notes = subjectEnd === -1 ? "" : `\n${entry.body.slice(subjectEnd)}`;
+    const predate = notes ? ` (verification notes below were recorded against revision ${previous.slice(0, 12)})` : "";
+    const amended = `${neutralizeNotes(neutralizeHeadings(body))}\nAmended ${formatClock(new Date())} by ${member}: ${reason}${predate}${notes}`;
+    const lines = content.split("\n");
+    // Corroborators and the legacy verifier confirmed the previous text; they confirm the new one again.
+    lines[entry.headingLine] = (lines[entry.headingLine] ?? "").replace(/\s+(?:verified|vsupport|corr)=[^\s]+/g, "");
+    lines.splice(entry.headingLine + 1, entry.body.split("\n").length, ...amended.split("\n"));
+    writeFileAtomic(findingsPath, lines.join("\n"));
+    const title = amended.split("\n")[0] ?? "";
+    const finding = { ...entry, body: amended, title, verifiedBy: undefined, verifiedSupport: undefined, corroborators: [] };
+    return { finding, previous, titleChanged: title.trim() !== entry.title.trim() };
+  });
+}
+
+function oneLineReason(note: string | undefined): string {
+  const reason = (note ?? "").replace(/\s+/g, " ").trim();
+  if (!reason) throw new Error("horde: amend needs note=<why the prose changed>, so the revision carries its errata");
+  return reason.slice(0, 300);
+}
+
+/** Superseded findings a text still cites, each with its successor. */
+export function supersededCitations(text: string, findings: FindingEntry[]): string[] {
+  return findings
+    .filter((finding) => finding.supersededBy !== undefined && new RegExp(`\\bF${finding.id}\\b`).test(text))
+    .map((finding) => `F${finding.id} (now F${finding.supersededBy})`);
+}
+
+/** The current revision of every live finding a text cites, pinned so a later amend is visible. */
+export function answerCitations(findings: FindingEntry[], text: string): Record<string, string> {
+  const cites: Record<string, string> = {};
+  for (const finding of findings) {
+    if (finding.supersededBy === undefined && new RegExp(`\\bF${finding.id}\\b`).test(text)) cites[`F${finding.id}`] = findingRevision(finding);
+  }
+  return cites;
+}
+
+/**
+ * Citations an answer can no longer stand on: findings superseded since it was written, and
+ * findings amended since the revisions it pinned. Both ship a stale reading as the result.
+ */
+export function staleAnswerCitations(findings: FindingEntry[], text: string, cites: Record<string, string> = {}): string[] {
+  const stale = supersededCitations(text, findings).map((citation) => `superseded ${citation}`);
+  for (const [target, revision] of Object.entries(cites)) {
+    const finding = findings.find((entry) => `F${entry.id}` === target);
+    if (finding && finding.supersededBy === undefined && findingRevision(finding) !== revision) stale.push(`amended ${target}`);
+  }
+  return stale;
+}
+
+/** A body line that reads as a verification note would move the subject boundary the revision hashes. */
+function neutralizeNotes(text: string): string {
+  return text.replace(/^((?:Verified|Reviewed) by )/gm, "\\$1");
+}
+
 export function listFindingsForRun(hordeDir: string, runId: string): FindingEntry[] {
   const findingsPath = hordePaths(hordeDir).findings;
   if (!fs.existsSync(findingsPath)) return [];

package/src/ledger/run-signals.ts

@@ -81,6 +81,8 @@ export interface SolvedSignal {
   member: string;
   text: string;
   at: string;
+  /** Revision of each finding the text cited when it was proposed, so a later amend is visible. */
+  cites?: Record<string, string>;
 }
 
 function solvedPath(runDir: string): string {
@@ -127,7 +129,8 @@ function readSignal(file: string): SolvedSignal | undefined {
   try {
     const parsed = JSON.parse(fs.readFileSync(file, "utf-8")) as Partial<SolvedSignal>;
     if (typeof parsed?.member === "string" && typeof parsed?.text === "string") {
-      return { member: parsed.member, text: parsed.text, at: parsed.at ?? "", revision: parsed.revision };
+      const cites = parsed.cites && typeof parsed.cites === "object" ? parsed.cites : undefined;
+      return { member: parsed.member, text: parsed.text, at: parsed.at ?? "", revision: parsed.revision, ...(cites ? { cites } : {}) };
     }
   } catch {
     // No signal, or a torn write; treat as none.
@@ -195,6 +198,7 @@ export async function markSolved(
   runId: string,
   member: string,
   text: string | undefined,
+  cites?: Record<string, string>,
 ): Promise<{ signal: SolvedSignal; alreadySolved: boolean }> {
   // The full answer is stored untruncated; only the board line is shortened.
   const full = requireText(text, "solved").trim();
@@ -203,7 +207,7 @@ export async function markSolved(
   return withHordeLock(hordeDir, member, () => {
     const existing = readSolved(runDir);
     if (existing) return { signal: existing, alreadySolved: true };
-    const signal: SolvedSignal = { member, text: full, at: new Date().toISOString(), revision: randomUUID() };
+    const signal: SolvedSignal = { member, text: full, at: new Date().toISOString(), revision: randomUUID(), ...(cites ? { cites } : {}) };
     writeFileAtomic(solvedPath(runDir), `${JSON.stringify(signal)}\n`);
     // Capture the answer immediately so it survives even if the run is killed
     // before finalize; the status is upgraded on validation and at finalize.
@@ -213,6 +217,17 @@ export async function markSolved(
   });
 }
 
+/**
+ * Put a withdrawn or contested proposal back before the members, under a new revision so a
+ * confirmation of the old one cannot validate it. Call under the horde lock.
+ */
+export function reopenSolved(runDir: string, runId: string, proposal: SolvedSignal, status: string, cites?: Record<string, string>): SolvedSignal {
+  const signal: SolvedSignal = { member: proposal.member, text: proposal.text, at: new Date().toISOString(), revision: randomUUID(), ...(cites ? { cites } : {}) };
+  writeFileAtomic(solvedPath(runDir), `${JSON.stringify(signal)}\n`);
+  writeAnswer(runDir, runId, signal, status);
+  return signal;
+}
+
 interface SolvedAnswer {
   ok: boolean;
   reason: string;

package/src/member.ts

@@ -55,6 +55,8 @@ export interface MemberState {
   summaryIncomplete?: boolean | undefined;
   /** How many fresh-context sessions replaced this member's earlier ones. */
   resets?: number | undefined;
+  /** Fresh sessions an `--until-stop` run gave this member after an earlier one finished. */
+  continuations?: number | undefined;
   /** Set by the parent before it kills a stalled member, so the exit is treated as a reset. */
   resetPending?: string | undefined;
   /** Extra identity line for a replacement session, naming what was reset and why. */
@@ -75,12 +77,30 @@ export interface MemberReset {
   tokens: number;
 }
 
+/** Another horde of the same swarm, whose ledgers a member may read but never write. */
+export interface SiblingHorde {
+  /** `h1`, `h2`, ... */
+  label: string;
+  hordeDir: string;
+  /** That horde's workstream, when the swarm partitioned the task. */
+  slice?: string | undefined;
+}
+
 export interface MemberRunInfo {
   id: string;
   hordeDir: string;
   runDir: string;
   prompt: string;
   count: number;
+  /** True when started with `--until-stop`: the run continues until the user stops it. */
+  untilStop?: boolean | undefined;
+  /** 1-based horde index in the swarm and the swarm's size; a single run is horde 1 of 1. */
+  horde?: number | undefined;
+  hordes?: number | undefined;
+  /** This horde's workstream, told to every member, when the swarm partitioned the task. */
+  slice?: string | undefined;
+  /** The other hordes of the swarm. */
+  siblings?: SiblingHorde[] | undefined;
 }
 
 interface SpawnMemberInput {
@@ -283,11 +303,31 @@ export function memberSessionDir(runDir: string, member: string): string {
   return path.join(runDir, "sessions", member);
 }
 
-/** The per-member system line: name, assigned role, and a reset note for a replacement. */
-function identityLine(member: MemberState, role: string | undefined): string {
+/** What an `--until-stop` member does instead of stopping when the board runs dry. */
+export const UNTIL_STOP_NOTE =
+  "This run continues until the user stops it. When nothing worthwhile remains on the board, add " +
+  "ideas that extend, stress-test, or deepen the work and pursue them instead of stopping. Propose " +
+  "SOLVED when the task has a complete answer; once an answer is banked, propose again only when a " +
+  "materially better one exists.";
+
+/** What a member of a partitioned swarm is told about its horde's workstream. */
+export function sliceNote(run: MemberRunInfo): string | undefined {
+  if (!run.slice || !run.horde || !run.hordes || run.hordes < 2) return undefined;
+  return (
+    `Your horde is h${run.horde} of ${run.hordes} hordes working the same task in parallel, each in its own ` +
+    `ledgers. Your horde owns workstream ${run.horde}: "${run.slice}". Work only on your horde's workstream; ` +
+    "do not duplicate another horde's."
+  );
+}
+
+/** The per-member system line: name, assigned role, a reset note for a replacement, the until-stop rule. */
+function identityLine(run: MemberRunInfo, member: MemberState, role: string | undefined): string {
   const parts = [`You are ${member.name}.`];
+  const slice = sliceNote(run);
+  if (slice) parts.push(slice);
   if (role) parts.push(role);
   if (member.resetNote) parts.push(member.resetNote);
+  if (run.untilStop) parts.push(UNTIL_STOP_NOTE);
   return parts.join(" ");
 }
 
@@ -297,7 +337,7 @@ export function buildMemberArgs(input: SpawnMemberInput): string[] {
     "--mode", "json", "-p",
     "--session-dir", memberSessionDir(run.runDir, member.name),
     "--append-system-prompt", path.join(run.runDir, "SYSTEM.md"),
-    "--append-system-prompt", identityLine(member, input.role),
+    "--append-system-prompt", identityLine(run, member, input.role),
   ];
   if (input.model) args.push("--model", `${input.model.provider}/${input.model.id}`);
   if (input.thinkingLevel) args.push("--thinking", input.thinkingLevel);
@@ -307,6 +347,7 @@ export function buildMemberArgs(input: SpawnMemberInput): string[] {
 }
 
 export function memberEnv(input: SpawnMemberInput): NodeJS.ProcessEnv {
+  const siblings = input.run.siblings ?? [];
   return childEnv({
     PI_HORDE_MEMBER: "1",
     PI_HORDE_DIR: input.run.hordeDir,
@@ -314,9 +355,27 @@ export function memberEnv(input: SpawnMemberInput): NodeJS.ProcessEnv {
     PI_HORDE_RUN: input.run.id,
     PI_HORDE_ROLE: input.role ?? "",
     PI_HORDE_ATTEMPT: input.member.attempt ??= randomUUID(),
+    PI_HORDE_SIBLINGS: siblings.length > 0 ? JSON.stringify(siblings.map((s) => ({ label: s.label, hordeDir: s.hordeDir }))) : "",
   });
 }
 
+/** The sibling hordes a member process was given, from `PI_HORDE_SIBLINGS`; empty outside a swarm. */
+export function parseSiblings(raw: string | undefined): SiblingHorde[] {
+  if (!raw) return [];
+  try {
+    const items = JSON.parse(raw) as unknown;
+    if (!Array.isArray(items)) return [];
+    return items
+      .filter((item): item is { label: string; hordeDir: string } =>
+        typeof item === "object" && item !== null &&
+        typeof (item as { label?: unknown }).label === "string" &&
+        typeof (item as { hordeDir?: unknown }).hordeDir === "string")
+      .map((item) => ({ label: item.label, hordeDir: item.hordeDir }));
+  } catch {
+    return [];
+  }
+}
+
 export function splitNdjson(buffer: string, onLine: (line: string) => void): string {
   const lines = buffer.split("\n");
   const remainder = lines.pop() ?? "";

package/src/prompt.ts

@@ -9,7 +9,7 @@ import type { PeerMessage, ReviewRecord } from "./ledger/collaboration.js";
 import type { Idea } from "./ledger/ideas.js";
 import type { ResourceEntry } from "./ledger/resources.js";
 import type { SolvedSignal } from "./ledger/run-signals.js";
-import type { MemberReset, MemberState } from "./member.js";
+import type { MemberReset, MemberState, SiblingHorde } from "./member.js";
 
 /** A resource with the non-owner members whose findings, evidence, reviews or leases cite it. */
 export type ReportResource = ResourceEntry & { citedBy?: string[] | undefined };
@@ -58,17 +58,36 @@ export interface RunSummaryInput {
   memberPosts?: Map<string, string> | undefined;
 }
 
+interface MemberContribution {
+  findings: number;
+  verified: number;
+  reviewed: number;
+  /** Current-revision reviews by this member with nothing left unchecked. */
+  fullScope: number;
+  /** Other members' current findings this member has not reviewed at their current revision. */
+  unreviewed: number[];
+  ideasClosed: number;
+  /** True for the member that held the verifier role; its coverage line is printed. */
+  verifier: boolean;
+}
+
 /** Findings filed, verified, and claimed ideas closed by one member, for the summary. */
 function memberContribution(
   name: string,
   findings: FindingEntry[],
   ideas: Idea[],
   reviews: ReviewRecord[] = [],
-): { findings: number; verified: number; reviewed: number; ideasClosed: number } {
+  verifier = false,
+): MemberContribution {
+  const current = findings.filter((f) => f.supersededBy === undefined);
+  const ownReview = (f: FindingEntry): ReviewRecord | undefined => findingReviewState(f, reviews).reviews.find((r) => r.actor === name);
   return {
+    verifier,
     findings: findings.filter((finding) => finding.author === name).length,
     verified: findings.filter((finding) => finding.verifiedBy === name).length,
-    reviewed: findings.filter((f) => f.supersededBy === undefined && findingReviewState(f, reviews).reviews.some((r) => r.actor === name)).length,
+    reviewed: current.filter((f) => ownReview(f) !== undefined).length,
+    fullScope: current.filter((f) => !ownReview(f)?.unchecked.trim() && ownReview(f) !== undefined).length,
+    unreviewed: current.filter((f) => f.author !== name && ownReview(f) === undefined).map((f) => f.id),
     ideasClosed: ideas.filter((idea) => idea.mark === "x" && idea.owner === name).length,
   };
 }
@@ -82,8 +101,10 @@ export const VERIFIER_ROLE =
   "You are the verifier. Reproduce the highest-importance unverified findings first. Record each " +
   "check with 'horde inspect', 'horde attach', then 'horde review': name the exact revision, assertions " +
   "checked, unchecked assertions, method, evidence refs and support. Source reasoning is not a live reproduction. When a finding does not reproduce, send a blocking challenge to its owner and contest its claim C# if one exists, or " +
-  "file a finding with supersedes: F# under the same idea and concern. Do not claim ideas or " +
-  "file findings of your own unless nothing is left to verify.";
+  "file a finding with supersedes: F# under the same idea and concern. The tool refuses your idea claims " +
+  "while other members' findings await your review, and a session that closes with high-importance " +
+  "findings unreviewed is replaced by a fresh one that owes them. Your summary's coverage sentence is " +
+  "derived from your review records, so name what you left unreviewed rather than calling the work verified.";
 
 const COLLABORATION_PROTOCOL = `
 Collaboration loop:
@@ -114,14 +135,29 @@ Collaboration loop:
   review can accept a document; runnable outputs require tested/reproduced support. Document acceptance
   does not establish execution or remove finding limitations. Kind is immutable. Updates need target=A#
   and revision=previous-hash; changed criteria/dependencies require changed file bytes and a fresh review.
-  Ask a peer to review A# before settling.
-- Review with target=F#/A#, revision=current-hash, checked=assertions-and-method, unchecked=remaining-gaps,
-  verdict=supports|partially-supports|refutes|inconclusive, support=tested|reproduced|derived|sourced,
-  refs=[E#], text=observations. Empty unchecked means you checked the whole stated claim.
+  Ask a peer to review A# before settling. Once other artifacts pin your A# (a spec they build against),
+  its revision is a frozen contract: route clarifications to a follow-up, and republish only with text=
+  naming the change and whether behaviour is unchanged, so dependents can reattest instead of re-reviewing.
+- Review with target=F#/A#, revision=current-hash, checked=assertions-and-method, unchecked=in-criteria-gaps,
+  limits=out-of-criteria-disclosures, verdict=supports|partially-supports|refutes|inconclusive,
+  support=tested|reproduced|derived|sourced, refs=[E#], text=observations. Judge unchecked against the
+  target's stated claim or criteria: a gap inside them keeps acceptance open until a full review covers it;
+  a limit outside them (one engine, no hardened deployment) goes in limits and is recorded on the
+  acceptance, never as a blocker. Empty unchecked means you checked the whole stated scope. A partial
+  verdict refutes nothing and opens no challenge: the acceptance names what it left unchecked. Only
+  refutes opens a challenge to the owner; send a challenge yourself when a partial check found a defect.
   To avoid a separate attach call, review may include evidenceText=full-observation and optional
   artifactPath instead of (or alongside) refs. Evidence and review commit atomically with separate E#/V#
   IDs and the same independence/revision checks. Keep text a decision summary; do not repeat the raw
   evidence in checked, text and evidenceText. The separate attach/review workflow remains available.
+- When a target you reviewed is re-hashed without changing what you checked (an amended sentence, a
+  republish against a corrected dependency, a spec clarification), horde reattest target=F#/A#
+  revision=current-hash evidenceText=what-you-compared text=why carries your earlier review forward
+  instead of repeating it. Reattest only what is unchanged; a changed claim needs a new review.
+- Fix wrong prose in your own finding with horde amend id=F# text=full-replacement note=why: the
+  revision changes, reviews stay pinned to what they checked, and reviewers reattest or re-review.
+  A reviewer's unchecked text or refutation that contradicts a sentence of your body is a request to
+  amend or supersede, not to leave the sentence standing. Another member corrects you with supersedes.
 - horde resource-state target=R# resourceState=building|ready|broken|retired text=health-result ports=[port]
   leaseSeconds=300 generation=last-generation. Ready needs refs=[health-evidence-E#]. Read collaboration first.
   Only the lease holder mutates a lab. Expired leases require checking its state before takeover.
@@ -133,7 +169,26 @@ Collaboration loop:
   attempt after discovery exits. Repair attempts must address assigned feedback only.
 `;
 
-export function memberSystemPrompt(input: { hordeDir: string; count: number }): string {
+/** What a member of a swarm is told about the other hordes: shared read, local write. */
+function siblingsSection(siblings: SiblingHorde[]): string {
+  if (siblings.length === 0) return "";
+  const lines = siblings.map(
+    (sibling) => `- ${sibling.label}: ${sibling.hordeDir}/${sibling.slice ? ` (workstream: ${sibling.slice})` : ""}`,
+  );
+  return `
+Your horde is one of ${siblings.length + 1} hordes working the same task in parallel, each with its
+own ledgers. The other hordes' directories are read-only for you:
+
+${lines.join("\n")}
+
+'horde facts' and 'horde resources' include their entries tagged [hN], and 'horde list' includes
+their done and ruled-out ideas, so a fact, a rule-out, or a resource another horde recorded is not
+re-derived here; reuse a sibling's resource by its path. Every write goes to your own horde's
+ledgers; never write to a sibling's directory, and never claim or cite a sibling's ideas as yours.
+`;
+}
+
+export function memberSystemPrompt(input: { hordeDir: string; count: number; siblings?: SiblingHorde[] | undefined }): string {
   const count = input.count;
   return `You are one member of a horde of ${count} agents. Every member received the same task
 and works in parallel in this repository with its own separate context. Coordinate through the
@@ -152,9 +207,9 @@ horde tool. Durable run events retain messages, evidence, reviews and revisions;
 - PLAN.md     workstream partition and your assigned layer, when the run was started with plan.
 
 Read them with the read tool. Write them ONLY with the horde tool; never edit them directly.
-Put reproduction snippets under .horde/runs/<run-id>/artifacts/ using PI_HORDE_RUN, so evidence
-survives finalization and line references do not drift.
-
+Put reproduction snippets under ${input.hordeDir}/runs/<run-id>/artifacts/ using PI_HORDE_RUN, so
+evidence survives finalization and line references do not drift.
+${siblingsSection(input.siblings ?? [])}
 Protocol:
 1. Run 'horde list', 'horde findings', 'horde facts', and read BOARD.md before planning.
 2. Prefer the shared queue. Add an idea only for an uncovered question or concrete evidence gap.
@@ -172,7 +227,9 @@ Protocol:
    deletion is refused: reproducers under the run artifacts directory are retained as evidence.
 4. Record each checkable environment fact once with 'horde fact' (include the command and the
    observed result). If it extends an existing fact, pass delta-of: T# instead of restating it.
-   Read FACTS.md before re-deriving anything, and do not duplicate it.
+   Read FACTS.md before re-deriving anything, and do not duplicate it. A fact about what an open
+   idea is still auditing, or what a contested claim disputes, is recorded as provisional on it:
+   the answer may not quote it until that idea closes or the claim resolves.
 5. Record each finding with 'horde finding'. The claimed idea id and a concern slug are required.
    A concern is a short stable slug for the subject or issue, for example auth-token-refresh or
    chapter-3-voice; different subjects or entry points need different concerns and separate
@@ -185,6 +242,10 @@ Protocol:
    from primary documents, or speculative. If the tool
    returns an existing F#, cite that id and file only distinct evidence with delta-of: F# and the
    exact same concern. Prefer attach for new evidence on an existing finding; stronger follow-up reviews are welcome.
+   Before reproducing an existing F#, run 'horde findings': one with a corroborator or a full-scope
+   review is settled, and a further reproduction is refused. Bring a new vector or distinct evidence
+   as delta-of: F#, or take a different slice. Register the harness, driver, lab or corpus you build
+   as an R# before others need it, with its path in note, so they reuse it instead of rewriting it.
    If your finding corrects or overturns an earlier finding, pass supersedes: F#. Cite R# for every run artifact. If it contradicts an earlier
    finding, use supersedes: F#, or record a claim with assert/contest, instead of leaving the
    correction in prose. Independent review is recorded by another member at the exact revision.
@@ -192,8 +253,9 @@ Protocol:
    inconclusive reviews remain reviewed-with-gaps. Neither a review count nor full claim coverage
    automatically establishes runtime exploitation. Keep source checks, controlled tests, and
    end-to-end reproductions distinct; legacy verified= headings are not the scoped-review count.
-6. When a lead is a confirmed negative, use 'horde rule-out' so later runs do not retry it.
-   Use 'horde drop' only to return work you are not pursuing to the open pool.
+6. When a lead is a confirmed negative, use 'horde rule-out' so later runs do not retry it; 'done'
+   with a negative result line is refused. Contradicting evidence attached to an idea is a rule-out
+   candidate for its owner. Use 'horde drop' only to return work you are not pursuing to the open pool.
 7. When two members actually disagree on a hypothesis, 'horde assert' it and use
    'confirm'/'contest'/'retract' with primary evidence. Do not use CLAIMS.md for work ownership.
 8. Post progress and dead ends in one or two lines so others do not repeat them. Re-read
@@ -207,8 +269,12 @@ Protocol:
     Continue distinct claimed work while another member validates it. For a broad task,
     one finding is never the complete answer: every current-run priority idea must first be done or
     ruled out. Call 'horde confirm-solved' only after independent verification, or
-    'horde contest-solved' with what is missing. Pass the revision from ANSWER.md or
-    'horde inspect' target=answer to either action, so stale reviews cannot approve a newer proposal.
+    'horde contest-solved' with what is missing, naming the open ideas (#12, #14) that block it: the
+    proposal reopens for validation once every idea it named is done or ruled out. Pass the revision
+    from ANSWER.md or 'horde inspect' target=answer to either action, so stale reviews cannot approve
+    a newer proposal. An answer that cites a superseded F# or quotes a provisional T# is refused, and a
+    pending proposal is withdrawn for re-proposal when a finding it cites is superseded. A request to
+    the proposer or a validator about the pending answer (target=answer) is served with the blockers.
     The parent enforces coverage before wind-down.
 
 ${COLLABORATION_PROTOCOL}
@@ -227,7 +293,11 @@ export function taskMarkdown(input: {
   thinkingLevel?: string | undefined;
   startedAt: number;
   verifier?: string | undefined;
+  untilStop?: boolean | undefined;
+  /** Set for a horde of a larger swarm: which horde this is and its workstream. */
+  swarm?: { id: string; horde: number; hordes: number; slice?: string | undefined } | undefined;
 }): string {
+  const swarm = input.swarm;
   return [
     `# Horde run ${input.id}`,
     "",
@@ -236,6 +306,9 @@ export function taskMarkdown(input: {
     `Model: ${input.model ?? "parent default"}`,
     `Thinking: ${input.thinkingLevel ?? "parent default"}`,
     `Verifier: ${input.verifier ?? "none"}`,
+    `Until stop: ${input.untilStop ? "yes (the run continues until stop-clean or stop-hard)" : "no"}`,
+    ...(swarm ? [`Swarm: ${swarm.id} (horde h${swarm.horde} of ${swarm.hordes})`] : []),
+    ...(swarm?.slice ? [`Workstream: ${swarm.slice}`] : []),
     `Task-SHA256: ${taskHash(input.prompt)}`,
     "",
     "## Prompt",
@@ -315,7 +388,7 @@ function memberElapsed(m: MemberState, now: number): string {
 function memberSummarySection(
   m: MemberState,
   now: number,
-  stats?: { findings: number; verified: number; reviewed: number; ideasClosed: number },
+  stats?: MemberContribution,
   resets: MemberReset[] = [],
   memberPosts?: Map<string, string>,
 ): string[] {
@@ -324,9 +397,17 @@ function memberSummarySection(
   lines.push(`${m.turns} turns, ${m.toolCalls} tool calls, ${tokens}, ${memberElapsed(m, now)}`);
   if (stats) {
     lines.push(
-      `${stats.findings} findings filed, ${stats.reviewed} independently reviewed (scoped), ${stats.verified} legacy verification labels, ` +
+      `${stats.findings} findings filed, ${stats.reviewed} independently reviewed (scoped: ${stats.fullScope} full, ` +
+        `${stats.reviewed - stats.fullScope} with unchecked scope), ${stats.verified} legacy verification labels, ` +
         `${stats.ideasClosed} claimed idea(s) closed`,
     );
+    // The coverage sentence comes from the review records, not from the member's prose: a
+    // verifier's "all work is verified" over twelve reviews with unchecked scope stated zero.
+    if (stats.verifier) {
+      const total = stats.reviewed + stats.unreviewed.length;
+      const owed = stats.unreviewed.length ? `; unreviewed: ${stats.unreviewed.map((id) => `F${id}`).join(", ")}` : "";
+      lines.push(`verifier coverage from review records: ${stats.reviewed} of ${total} other members' current findings reviewed, ${stats.fullScope} at full scope${owed}`);
+    }
   }
   if (resets.length > 0) {
     lines.push(`resets: ${resets.length} (${resets.map((reset) => reset.reason).join("; ")})`);
@@ -411,7 +492,7 @@ export function summaryMarkdown(run: RunSummaryInput, now: number = Date.now()):
   const ideas = run.ideas ?? [];
   const haveLedger = findings.length > 0 || ideas.length > 0;
   for (const m of run.members) {
-    const stats = haveLedger ? memberContribution(m.name, findings, ideas, run.scopedReviews) : undefined;
+    const stats = haveLedger ? memberContribution(m.name, findings, ideas, run.scopedReviews, m.name === run.verifier) : undefined;
     lines.push(...memberSummarySection(m, now, stats, resetsOf(m.name, run.resets), run.memberPosts));
   }
   return lines.join("\n");