agent-horde 0.2.0 → 0.2.1

package/README.md

@@ -90,7 +90,7 @@ pi install npm:agent-horde
 Or from the repository, pinned to a tag:
 
 ```
-pi install git:github.com/eliyastein/agent-horde@v0.2.0
+pi install git:github.com/eliyastein/agent-horde@v0.2.1
 ```
 
 To hack on it, clone and install in place. pi loads the files from the clone, so edits take effect

package/docs/REFERENCE.md

@@ -42,7 +42,14 @@ synthesize it.
    The default totals follow the queues' demand (one floor per queue plus one per further review
    request or blocking challenge), each attempt's share is cut in proportion to its demand, and
    every attempt gets at least a floor; the phase start records the budget, `repair-start` the
-   attempt's demand, and `repair-end` its turns and first-turn cost. A user stop skips this phase.
+   attempt's demand, and `repair-end` its turns, first-turn cost and the threads it left
+   `unchanged`. A thread that two consecutive completed attempts did not move (same state and
+   response revision) is held back from that member until another member changes it; a member
+   whose whole queue is held is recorded as `repair-skipped` with reason `no-progress` and costs
+   later rounds nothing. Each round serves a member at most once, but a round other than the last
+   ends early when the only blocking threads left belong to members it already served, so a
+   requester rechecks a correction before unserved members' non-blocking threads.
+   A user stop skips this phase.
 4. **Finalize.** Acceptance is frozen (`ACCEPTANCE.*`, `snapshot/`), resource cleanup commands
    run, `SUMMARY.md` and `REPORT.md` are written, then a synthesis member writes `DELIVERABLE.md`
    and a read-only reviewer writes `POSTMORTEM.md`. The widget shows `synthesizing` until both
@@ -225,9 +232,12 @@ from the same actor as an idempotent retry. The parent appends its own lifecycle
   other member running, or no validation within `PI_HORDE_SOLVED_CONFIRM_MS`, an uncontested
   proposal commits as `solved-unvalidated`. Findings no other member reproduced hold wind-down
   while other members run, unless `PI_HORDE_ALLOW_UNVERIFIED=1`. A proposal pins the revision of
-  every finding it cites. An answer that cites a superseded F# or quotes a provisional T# is
-  refused at `solved` and at `confirm-solved`; a pending proposal whose cited finding is
-  superseded or amended later is withdrawn (`solved-withdrawn`) for re-proposal. A contest that names idea ids reopens the proposal under a new revision
+  every finding and artifact it cites. An answer that cites a superseded F# or quotes a provisional
+  T# is refused at `solved` and at `confirm-solved`; a pending proposal whose cited finding is
+  superseded or amended later, or whose cited A# is republished, is withdrawn (`solved-withdrawn`)
+  for re-proposal, and ANSWER.md's status says so instead of keeping an earlier validation. At
+  finalize, ANSWER.md's status names every citation that changed after the proposal pinned it. A
+  contest that names idea ids reopens the proposal under a new revision
   (`solved-reopened`) once every named idea is done or ruled out, with the citations it pinned;
   if a cited finding changed or a quoted fact is still provisional by then, it is withdrawn instead. Repair serves a request about
   the pending answer (`target=answer`) with the blockers.
@@ -248,7 +258,10 @@ from the same actor as an idempotent retry. The parent appends its own lifecycle
   still `respond` to a deferred request, and the requester then resolves it. A challenger can
   withdraw its own blocking challenge on an F# or A# before any response by recording a
   supporting review of the current revision and resolving with evidence on it; limits that
-  review discloses remain acceptance debt. Acceptance names an open blocker as `blocked by Q#`.
+  review discloses remain acceptance debt. A blocking request about the sender's own work (a
+  re-review after a correction) resolves on the recipient's supporting review of the current
+  revision, full-scope for an A#, since the owner may not review it. Acceptance names an open
+  blocker as `blocked by Q#`.
 - **Verifier.** The verifier's idea claims are refused while other members' findings await its
   review at their current revision; the pending F# list follows every review, reattest and board
   post. A verifier whose session closes with critical or high-importance findings unreviewed is
@@ -350,7 +363,9 @@ for an abnormal end after measurable work; distinct finding clusters with review
 superseded findings in their own section, and any resets; claim states; this run's facts split
 from carried context; resources and cleanup results; coverage (released and still-open ideas,
 the solved answer); late board posts; and consistency warnings for missing metadata,
-mixed-concern clusters, unknown R# citations, and cited paths that do not exist. A killed
+mixed-concern clusters, unknown R# citations, and cited paths that do not exist (rooted URL paths
+and templates with a date or placeholder slot, such as `logs/gate-YYYY-MM-DD.jsonl` or
+`out/<id>.json`, are not checked). A killed
 member's summary is reconstructed from its last board post. The message injected into the parent
 carries a one-line diagnosis and, when generated, the post-mortem text.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-horde",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Run a horde of pi agents on one task: shared ledgers, peer review, an auditable event log, and a live dashboard",
   "license": "MIT",
   "type": "module",

package/src/citations.ts

@@ -32,6 +32,12 @@ const DATA_EXT =
 /** Path roots that are worth checking even without a file extension. */
 const RUN_ROOT = /^(?:\.horde|\.tmp|runs|artifacts)(?:[/-]|$)/;
 
+/**
+ * A path with a date or placeholder slot (`logs/gate-YYYY-MM-DD.jsonl`, `out/<id>.json`,
+ * `%Y%m%d.log`) names a pattern the code writes, not one file that must exist.
+ */
+const PATH_TEMPLATE = /(?:^|[^A-Za-z])(?:YYYY|YYYYMMDD|yyyy|yyyymmdd)(?:[^A-Za-z]|$)|<[^<>]+>|%[YmdHMS]/;
+
 /** Host-anchored references such as docs.example.com/page are URLs, not local paths. */
 const HOST_PATH = /^(?:[a-z0-9-]+\.)+[a-z]{2,}\//i;
 
@@ -57,6 +63,7 @@ export function citedDataFiles(text: string): string[] {
     if (ref === "") return;
     if (ref.startsWith("/") || /^[a-z][a-z0-9+.-]*:\/\//i.test(ref)) return;
     if (/[{}*$]/.test(ref)) return;
+    if (PATH_TEMPLATE.test(ref)) return;
     if (HOST_PATH.test(ref)) return;
     const isRooted = RUN_ROOT.test(ref);
     // Under a run root, any extension is a member artifact worth checking. Off a
@@ -66,7 +73,9 @@ export function citedDataFiles(text: string): string[] {
     out.add(ref);
   };
   for (const match of text.matchAll(/`([^`\s]+)`/g)) consider(match[1] ?? "");
-  for (const match of text.matchAll(/(?<![\w:/.])(?:\.{1,2}\/)?[\w.-]+(?:\/[\w.-]+)+(?:\.[A-Za-z0-9]{1,6})?/g)) {
+  // A match never starts inside a hyphenated word: `/standalone-client-gate/logs` is one URL path,
+  // not a relative `client-gate/logs` with its leading slash cut off.
+  for (const match of text.matchAll(/(?<![\w:/.-])(?:\.{1,2}\/)?[\w.-]+(?:\/[\w.-]+)+(?:\.[A-Za-z0-9]{1,6})?/g)) {
     consider(match[0] ?? "", text[(match.index ?? 0) + match[0].length] ?? "");
   }
   for (const match of text.matchAll(/(?<![\w/.-])([\w-]+\.[A-Za-z0-9]{1,6})\b/g)) consider(match[1] ?? "");
@@ -95,14 +104,16 @@ function fileNamedUnder(dir: string, name: string, depth = 6): boolean {
 
 /**
  * True when a cited file cannot be resolved to an existing file on disk. Paths
- * are tried against the repo root, the run directory, its artifacts directory,
- * and the directory of the citing file. Because generated artifacts usually cite
- * retained files by a relative name, and a deliverable cites the reviewed project's
+ * are tried against the repo root, the horde directory (where `runs/<id>/...`
+ * references resolve, in a single run and in a swarm horde alike), the run
+ * directory, its artifacts directory, and the directory of the citing file; a
+ * path without a file extension may name a directory. Because generated artifacts
+ * usually cite retained files by a relative name, and a deliverable cites the reviewed project's
  * own files by bare name, a basename match in this run's tree or in the project tree
  * also counts, which keeps the warning precise instead of noisy.
  */
 function citedFileMissing(run: HordeRun, ref: string, baseDir?: string): boolean {
-  const roots = [run.cwd, run.runDir, path.join(run.runDir, "artifacts")];
+  const roots = [run.cwd, run.hordeDir, run.runDir, path.join(run.runDir, "artifacts")];
   if (baseDir) roots.push(baseDir);
   const mustBeFile = FILE_EXT.test(ref);
   for (const root of roots) {

package/src/ledger/findings.ts

@@ -1,7 +1,7 @@
 import * as fs from "node:fs";
 import { createHash } from "node:crypto";
 import { collaborationState } from "./collaboration.js";
-import type { PeerMessage, ReviewRecord } from "./collaboration.js";
+import type { ArtifactRecord, PeerMessage, ReviewRecord } from "./collaboration.js";
 import { formatClock } from "../format.js";
 import { RUN_HEADING } from "./board.js";
 import { registerConcern } from "./concerns.js";
@@ -558,28 +558,47 @@ export function supersededCitations(text: string, findings: FindingEntry[]): str
     .map((finding) => `F${finding.id} (now F${finding.supersededBy})`);
 }
 
-/** The current revision of every live finding a text cites, pinned so a later amend is visible. */
-export function answerCitations(findings: FindingEntry[], text: string): Record<string, string> {
+/**
+ * The current revision of every live finding and published artifact a text cites, pinned so a
+ * later amend or republish is visible.
+ */
+export function answerCitations(findings: FindingEntry[], text: string, artifacts: ArtifactRecord[] = []): Record<string, string> {
   const cites: Record<string, string> = {};
   for (const finding of findings) {
     if (finding.supersededBy === undefined && new RegExp(`\\bF${finding.id}\\b`).test(text)) cites[`F${finding.id}`] = findingRevision(finding);
   }
+  for (const artifact of artifacts) {
+    if (new RegExp(`\\b${artifact.id}\\b`).test(text)) cites[artifact.id] = artifact.hash;
+  }
   return cites;
 }
 
 /**
- * Citations an answer can no longer stand on: findings superseded since it was written, and
- * findings amended since the revisions it pinned. Both ship a stale reading as the result.
+ * Citations an answer can no longer stand on: findings superseded since it was written, findings
+ * amended and artifacts republished since the revisions it pinned. Each ships a stale reading as
+ * the result.
  */
-export function staleAnswerCitations(findings: FindingEntry[], text: string, cites: Record<string, string> = {}): string[] {
+export function staleAnswerCitations(
+  findings: FindingEntry[],
+  text: string,
+  cites: Record<string, string> = {},
+  artifacts: ArtifactRecord[] = [],
+): string[] {
   const stale = supersededCitations(text, findings).map((citation) => `superseded ${citation}`);
   for (const [target, revision] of Object.entries(cites)) {
     const finding = findings.find((entry) => `F${entry.id}` === target);
     if (finding && finding.supersededBy === undefined && findingRevision(finding) !== revision) stale.push(`amended ${target}`);
+    const artifact = artifacts.find((entry) => entry.id === target);
+    if (artifact && artifact.hash !== revision) stale.push(`republished ${target}`);
   }
   return stale;
 }
 
+/** The answer's stale citations against this run's current findings and artifacts. */
+export function staleAnswerFor(hordeDir: string, runId: string, text: string, cites?: Record<string, string>): string[] {
+  return staleAnswerCitations(listFindingsForRun(hordeDir, runId), text, cites, collaborationState(hordeDir, runId).artifacts);
+}
+
 /** A body line that reads as a verification note would move the subject boundary the revision hashes. */
 function neutralizeNotes(text: string): string {
   return text.replace(/^((?:Verified|Reviewed) by )/gm, "\\$1");

package/src/prompt.ts

@@ -34,6 +34,8 @@ export interface RunSummaryInput {
   solvedCommitted?: boolean | undefined;
   /** Members whose queued repair work was skipped for budget. */
   repairSkipped?: string[] | undefined;
+  /** Members held back from later rounds because their attempt left every thread unchanged. */
+  repairStalled?: string[] | undefined;
   /** The REPORT.md outcome, so SUMMARY.md states the same end cause. */
   outcome?: string | undefined;
   /** One-line run diagnosis shown in the report message. */
@@ -126,6 +128,8 @@ Collaboration loop:
   a finding on that idea, explicitly set responseTarget=F#. Superseded F# requests follow the correction.
   Requester: attach/review evidence on the current response target, then resolve target=Q# refs=[E#]
   revision=current-hash text=decision, or defer with a reason. Disclosed finding limitations remain debt.
+  A blocking request about your own work resolves on the recipient's full supporting review of the
+  current revision, since you cannot review it yourself.
   Do not repeat your existing check: inspect collaboration first and test a specific remaining gap.
   A deferred blocking issue stays visible as acceptance debt; its recipient can still respond to it and
   the requester then resolves it. Never silently ignore a peer's failed test.
@@ -273,7 +277,8 @@ Protocol:
     proposal reopens for validation once every idea it named is done or ruled out. Pass the revision
     from ANSWER.md or 'horde inspect' target=answer to either action, so stale reviews cannot approve
     a newer proposal. An answer that cites a superseded F# or quotes a provisional T# is refused, and a
-    pending proposal is withdrawn for re-proposal when a finding it cites is superseded. A request to
+    pending proposal is withdrawn for re-proposal when a finding it cites is superseded or amended,
+    or an artifact it cites is republished. A request to
     the proposer or a validator about the pending answer (target=answer) is served with the blockers.
     The parent enforces coverage before wind-down.
 
@@ -462,10 +467,12 @@ export function runEndSentence(run: RunSummaryInput): string {
   const attempts = run.members.reduce((n, m) => n + (m.repairs ?? 0), 0);
   const killed = run.members.filter((m) => ["tokens", "turns", "time"].includes(m.repairStopReason ?? ""));
   const skipped = run.repairSkipped ?? [];
+  const stalled = run.repairStalled ?? [];
   if (attempts > 0 || skipped.length > 0) {
     const detail = [
       killed.length ? `${killed.length} killed on budget (${killed.map((m) => `${m.name}: ${m.repairStopReason}`).join(", ")})` : "",
       skipped.length ? `${skipped.length} skipped for budget (${skipped.join(", ")})` : "",
+      stalled.length ? `${stalled.length} held after no progress (${stalled.join(", ")})` : "",
     ].filter(Boolean).join(", ");
     parts.push(`Repair: ${attempts} attempt(s)${detail ? `, ${detail}` : ""}.`);
   }

package/src/run/finalize.ts

@@ -20,7 +20,7 @@ import { clusterFindings } from "../ledger/clusters.js";
 import { listFacts } from "../ledger/facts.js";
 import type { FactEntry } from "../ledger/facts.js";
 import { readHordeFile } from "../ledger/files.js";
-import { listFindingsForRun, parseFindings, supersededCitations } from "../ledger/findings.js";
+import { listFindingsForRun, parseFindings, staleAnswerFor } from "../ledger/findings.js";
 import type { FindingEntry } from "../ledger/findings.js";
 import { countIdeas, parseIdeas, reconcileOwnedIdeas } from "../ledger/ideas.js";
 import type { Idea } from "../ledger/ideas.js";
@@ -137,19 +137,18 @@ interface SettledAnswer {
   status: string;
 }
 
-/** Findings the proposal names that a later finding corrected; labeled, not re-versioned. */
 /**
  * The proposal body is the member's verbatim text and can predate later challenges and corrections.
- * The status names the blockers still open at freeze and the findings a later finding superseded,
- * and, once synthesis wrote it, points the operator at DELIVERABLE.md as the reconciled output.
+ * The status names the blockers still open at freeze and the citations that changed after the
+ * proposal pinned them (superseded or amended findings, republished artifacts), and, once
+ * synthesis wrote it, points the operator at DELIVERABLE.md as the reconciled output.
  */
-function annotateAnswer(run: HordeRun, answer: SettledAnswer, acceptance: { hash: string; issues: string[] }, findings: FindingEntry[]): void {
+function annotateAnswer(run: HordeRun, answer: SettledAnswer, acceptance: { hash: string; issues: string[] }, stale: string[]): void {
   const blockers = acceptance.issues.filter((issue) => /^Q\d+ .*: \w+ blocking /.test(issue)).map((issue) => issue.replace(/:/, ""));
   const parts = [answer.status];
   if (acceptance.issues.length) parts.push("acceptance incomplete");
   if (blockers.length) parts.push(`open blocking at freeze: ${blockers.join(", ")}`);
-  const superseded = supersededCitations(answer.proposal.text, findings);
-  if (superseded.length) parts.push(`cites superseded ${superseded.join(", ")}`);
+  if (stale.length) parts.push(`cites ${stale.join(", ")}`);
   parts.push(`see ACCEPTANCE.md (snapshot ${acceptance.hash})`);
   if (run.deliverable) parts.push("reconciled operator output: DELIVERABLE.md; the proposal text below is verbatim and may be superseded there");
   try {
@@ -559,16 +558,16 @@ export async function finalizeRun(state: HordeState, swarm: Swarm, run: HordeRun
     run.acceptance = acceptance.status;
     run.snapshotHash = acceptance.hash;
     await recordLifecycle(run, "acceptance", { status: acceptance.status, hash: acceptance.hash, issues: acceptance.issues.length });
-    const annotate = answer !== undefined &&
-      (acceptance.issues.length > 0 || supersededCitations(answer.proposal.text, ledgers.findings).length > 0);
-    if (annotate) annotateAnswer(run, answer, acceptance, ledgers.findings);
+    const stale = answer ? staleAnswerFor(run.hordeDir, run.id, answer.proposal.text, answer.proposal.cites) : [];
+    const annotate = answer !== undefined && (acceptance.issues.length > 0 || stale.length > 0);
+    if (annotate) annotateAnswer(run, answer, acceptance, stale);
     // Workers and bounded repairs have exited; only now may their labs be torn down.
     const cleanups = await runCleanups(run);
     const reportInput = writeRunReports(run, ledgers, releasedIdeas, cleanups, now);
     // Free the slot before the (possibly slow) synthesis so a new run can start.
     noteRunReported(state, swarm, run);
     await synthesize(state, run, ledgers, reportInput, now);
-    if (annotate && run.deliverable) annotateAnswer(run, answer, acceptance, ledgers.findings);
+    if (annotate && run.deliverable) annotateAnswer(run, answer, acceptance, stale);
     sendReport(state, swarm, run, ledgers, now);
     await recordLifecycle(run, "run-end", { outcome: runOutcome(run), elapsedMs: Date.now() - run.startedAt, stopLabel: run.stopLabel });
     writeRunGraph(run);

package/src/run/repair.ts

@@ -4,6 +4,7 @@ import { randomUUID } from "node:crypto";
 import { inboxFor } from "../tool/inbox.js";
 import type { PeerMessage } from "../ledger/collaboration.js";
 import { recordEvent } from "../ledger/events.js";
+import type { EventContext } from "../ledger/events.js";
 import { recordPhase } from "./lifecycle.js";
 import { envNumber } from "../format.js";
 import { resetMemberState } from "../member.js";
@@ -24,11 +25,94 @@ function repairPriority(message: PeerMessage): number {
   return 3;
 }
 
-function queueFor(launch: RunLaunch, member: MemberState): PeerMessage[] {
-  return inboxFor({ hordeDir: launch.run.hordeDir, runId: launch.run.id, actor: member.name })
+/** The repair phase's scheduling state, shared by every round. */
+interface RepairPhase {
+  launch: RunLaunch;
+  floors: RepairFloors;
+  /**
+   * Threads a member's completed attempts left exactly as they found them, by member then
+   * message id: the signature the thread was stuck at and how many consecutive attempts left it
+   * there. The thread is held back from that member once the count reaches `UNMOVED_ATTEMPTS`,
+   * until its signature changes, which only another member's action or a new response can cause.
+   */
+  stalled: Map<string, Map<string, UnmovedThread>>;
+}
+
+interface UnmovedThread {
+  signature: string;
+  attempts: number;
+}
+
+/**
+ * Completed attempts that may leave a thread untouched before it is held. One miss is routine: a
+ * member that answered the rest of its queue, or re-answered the task, often clears the thread on
+ * its next attempt within seconds. Two misses on the same signature are the loop this guards.
+ */
+const UNMOVED_ATTEMPTS = 2;
+
+function memberContext(phase: RepairPhase, member: MemberState): EventContext {
+  return { hordeDir: phase.launch.run.hordeDir, runId: phase.launch.run.id, actor: member.name };
+}
+
+/**
+ * What an attempt can change on a thread: its state and the revision it was answered with.
+ * Delivery receipts and a re-worded response on the same revision are not progress, so neither
+ * the inbox read of a fresh attempt nor a recipient repeating itself re-qualifies a thread.
+ */
+function threadSignature(m: PeerMessage): string {
+  return `${m.state}:${m.responseRevision ?? ""}:${m.responseTarget ?? ""}`;
+}
+
+function isStalled(phase: RepairPhase, member: MemberState, m: PeerMessage): boolean {
+  const unmoved = phase.stalled.get(member.name)?.get(m.id);
+  return unmoved !== undefined && unmoved.signature === threadSignature(m) && unmoved.attempts >= UNMOVED_ATTEMPTS;
+}
+
+/** The threads currently held back from the member, in inbox order. */
+function heldThreads(phase: RepairPhase, member: MemberState): string[] {
+  return inboxFor(memberContext(phase, member)).filter((m) => isStalled(phase, member, m)).map((m) => m.id);
+}
+
+/** The threads an attempt for the member would be handed: its inbox minus the threads held back. */
+function queueFor(phase: RepairPhase, member: MemberState): PeerMessage[] {
+  return inboxFor(memberContext(phase, member)).filter((m) => !isStalled(phase, member, m))
     .sort((a, b) => repairPriority(a) - repairPriority(b) || a.createdAt.localeCompare(b.createdAt));
 }
 
+/**
+ * Counts, per thread, the consecutive completed attempts that left it as they found it; a thread
+ * the attempt moved starts over. A killed attempt counts nothing: it may have been about to act.
+ * Returns the ids this attempt left unchanged.
+ */
+function noteUnchanged(phase: RepairPhase, member: MemberState, queue: PeerMessage[]): string[] {
+  if (member.endCause !== "completed") return [];
+  const after = new Map(inboxFor(memberContext(phase, member)).map((m) => [m.id, threadSignature(m)]));
+  const unmoved = phase.stalled.get(member.name) ?? new Map<string, UnmovedThread>();
+  const unchanged: string[] = [];
+  for (const m of queue) {
+    const signature = threadSignature(m);
+    if (after.get(m.id) !== signature) { unmoved.delete(m.id); continue; }
+    const previous = unmoved.get(m.id);
+    unmoved.set(m.id, { signature, attempts: previous?.signature === signature ? previous.attempts + 1 : 1 });
+    unchanged.push(m.id);
+  }
+  phase.stalled.set(member.name, unmoved);
+  return unchanged;
+}
+
+/**
+ * Once every thread in the member's inbox is one its own completed attempt could not move, later
+ * rounds skip the member and its threads drop out of the demand that sizes the shares, until
+ * another member changes one. Recorded so the post-mortem sees why the member stopped appearing.
+ */
+async function recordStalled(phase: RepairPhase, member: MemberState): Promise<void> {
+  const held = heldThreads(phase, member);
+  if (!held.length || queueFor(phase, member).length) return;
+  const { run } = phase.launch;
+  run.repairStalled = [...new Set([...(run.repairStalled ?? []), member.name])];
+  await recordEvent({ ...memberContext(phase, member), actor: "parent", attempt: "scheduler" }, "repair-skipped", { payload: { reason: "no-progress", members: [{ member: member.name, messages: held }] } });
+}
+
 /**
  * What a queue costs in floors: one cold session covers the administrative threads in it, and
  * each review request or blocking challenge is an inspect/attach/review cycle of about a floor
@@ -114,10 +198,10 @@ export function repairBudget(demands: number[], floors: RepairFloors, rounds: nu
 
 type SkipReason = "insufficient-budget" | "insufficient-time";
 
-async function recordSkipped(launch: RunLaunch, pending: MemberState[], reason: SkipReason, detail: Record<string, number>): Promise<void> {
-  const { run } = launch;
+async function recordSkipped(phase: RepairPhase, pending: MemberState[], reason: SkipReason, detail: Record<string, number>): Promise<void> {
+  const { run } = phase.launch;
   const ctx = { hordeDir: run.hordeDir, runId: run.id, actor: "parent", attempt: "scheduler" };
-  const members = pending.map((member) => ({ member: member.name, messages: queueFor(launch, member).map((m) => m.id) }))
+  const members = pending.map((member) => ({ member: member.name, messages: queueFor(phase, member).map((m) => m.id) }))
     .filter((entry) => entry.messages.length);
   if (!members.length) return;
   run.repairSkipped = [...new Set([...(run.repairSkipped ?? []), ...members.map((entry) => entry.member)])];
@@ -143,10 +227,11 @@ interface FirstTurnCost {
  * share is the allowance recorded and the deadline is derived from it once, so the record cannot
  * read a millisecond under the floor the share was raised to.
  */
-async function repairMember(launch: RunLaunch, member: MemberState, ms: number, limits: RepairLimits, floors: RepairFloors): Promise<void> {
+async function repairMember(phase: RepairPhase, member: MemberState, ms: number, limits: RepairLimits): Promise<void> {
+  const { launch, floors } = phase;
   const { run } = launch;
-  const ctx = { hordeDir: run.hordeDir, runId: run.id, actor: member.name };
-  const queue = queueFor(launch, member);
+  const ctx = memberContext(phase, member);
+  const queue = queueFor(phase, member);
   if (!queue.length || stopReason(launch)) return;
   const prior = { turns: member.turns, toolCalls: member.toolCalls, usage: { ...member.usage }, startedAt: member.startedAt };
   resetMemberState(member);
@@ -181,7 +266,8 @@ async function repairMember(launch: RunLaunch, member: MemberState, ms: number,
   const timeout = setTimeout(() => halt("time"), Math.max(1, deadline - Date.now()));
   const watchdog = setInterval(check, 100);
   try {
-    await recordEvent({ ...ctx, attempt: member.attempt }, "repair-start", { payload: { messages: queue.map((m) => m.id), demand: repairDemand(queue), prior, allowance, floors } });
+    const held = heldThreads(phase, member);
+    await recordEvent({ ...ctx, attempt: member.attempt }, "repair-start", { payload: { messages: queue.map((m) => m.id), demand: repairDemand(queue), prior, allowance, floors, ...(held.length ? { held } : {}) } });
     if (stopReason(launch) || Date.now() >= deadline) {
       halt(stopReason(launch) ?? "time");
       member.status = "stopped";
@@ -191,10 +277,12 @@ async function repairMember(launch: RunLaunch, member: MemberState, ms: number,
       // Enforce a share on every usage update, rather than waiting for the next poll.
       await spawnOne(launch, member, undefined, check);
     }
+    const unchanged = noteUnchanged(phase, member, queue);
     await recordEvent({ ...ctx, attempt: member.attempt }, "repair-end", { payload: {
       cause: member.endCause, stopReason: member.repairStopReason, allowance, usage: member.usage, turns: member.turns, firstTurn,
-      messages: queue.map((m) => m.id),
+      messages: queue.map((m) => m.id), unchanged,
     } });
+    if (unchanged.length) await recordStalled(phase, member);
   } finally {
     clearTimeout(timeout);
     clearInterval(watchdog);
@@ -223,19 +311,42 @@ export async function drainRepairs(launch: RunLaunch): Promise<void> {
   }
 }
 
-function eligibleMembers(launch: RunLaunch): Array<{ member: MemberState; queue: PeerMessage[] }> {
-  return launch.run.members.map((member) => ({ member, queue: queueFor(launch, member) })).filter((entry) => entry.queue.length)
+function eligibleMembers(phase: RepairPhase): Array<{ member: MemberState; queue: PeerMessage[] }> {
+  return phase.launch.run.members.map((member) => ({ member, queue: queueFor(phase, member) })).filter((entry) => entry.queue.length)
     .sort((a, b) => repairPriority(a.queue[0]!) - repairPriority(b.queue[0]!) ||
       (a.member.repairs ?? 0) - (b.member.repairs ?? 0) || a.queue[0]!.createdAt.localeCompare(b.queue[0]!.createdAt));
 }
 
+/** The queue a member was handed this round, by message id, at the signature it was handed. */
+type HandedQueues = Map<string, Map<string, string>>;
+
+/**
+ * True when every blocking thread left belongs to a member already served this round, and one of
+ * them is new or moved since that member was handed its queue. A correction answered mid-round
+ * leaves its requester to recheck it; finishing the round on administrative rechecks first spent
+ * the clock that recheck needed, so when a later round exists it starts now. A blocker the member
+ * left as it was handed is no reason to serve it again early; the last round serves everyone.
+ */
+export function blockedOnServed(eligible: Array<{ member: MemberState; queue: PeerMessage[] }>, handed: HandedQueues): boolean {
+  let moved = false;
+  for (const { member, queue } of eligible) {
+    const seen = handed.get(member.name);
+    for (const m of queue) {
+      if (repairPriority(m) !== 0) continue;
+      if (!seen) return false;
+      if (seen.get(m.id) !== threadSignature(m)) moved = true;
+    }
+  }
+  return moved;
+}
+
 async function runRepairRounds(launch: RunLaunch, begin: (budget: RepairBudget) => Promise<void>): Promise<void> {
   const { run } = launch;
   const rounds = Math.max(0, Math.min(6, envNumber("PI_HORDE_REPAIR_ROUNDS", 4)));
   if (rounds === 0 || stopReason(launch)) return;
-  const floors = repairFloors();
+  const phase: RepairPhase = { launch, floors: repairFloors(), stalled: new Map() };
   await scheduleCollaboration(launch, { settleMs: 0, liveOnly: false });
-  const budget = repairBudget(eligibleMembers(launch).map((entry) => repairDemand(entry.queue)), floors, rounds);
+  const budget = repairBudget(eligibleMembers(phase).map((entry) => repairDemand(entry.queue)), phase.floors, rounds);
   if (budget.queued === 0) return;
   const deadline = Date.now() + budget.ms;
   const exhausted = () => stopReason(launch) || Date.now() >= deadline || (run.repairTokens ?? 0) >= budget.tokens;
@@ -245,34 +356,35 @@ async function runRepairRounds(launch: RunLaunch, begin: (budget: RepairBudget)
     // One attempt per member per round, picked in priority order re-read before each attempt:
     // a thread that became blocking during an attempt moves its recipient ahead of the
     // administrative queues that were ordered first at round start.
-    const served = new Set<string>();
+    const handed: HandedQueues = new Map();
     for (;;) {
       if (exhausted()) return;
-      const pending = eligibleMembers(launch).filter((entry) => !served.has(entry.member.name));
-      if (!pending.length) break;
+      const eligible = eligibleMembers(phase);
+      const pending = eligible.filter((entry) => !handed.has(entry.member.name));
+      if (!pending.length || (round < rounds - 1 && blockedOnServed(eligible, handed))) break;
       const next = pending[0]!;
       const pendingUnits = pending.reduce((sum, entry) => sum + repairDemand(entry.queue), 0);
       const units = repairDemand(next.queue);
       const unserved = pending.map((entry) => entry.member);
       const remaining = budget.tokens - (run.repairTokens ?? 0);
       const laterRounds = rounds - round - 1;
-      const tokens = repairAllowance(repairShare(remaining, pendingUnits, laterRounds, units), remaining, floors.tokens);
+      const tokens = repairAllowance(repairShare(remaining, pendingUnits, laterRounds, units), remaining, phase.floors.tokens);
       if (tokens === undefined) {
         await begin(budget);
-        await recordSkipped(launch, unserved, "insufficient-budget", { remaining, floor: floors.tokens });
+        await recordSkipped(phase, unserved, "insufficient-budget", { remaining, floor: phase.floors.tokens });
         return;
       }
       const remainingMs = Math.max(0, deadline - Date.now());
-      const fundable = Math.floor(remaining / Math.max(1, floors.tokens));
-      const ms = repairAllowance(repairTimeShare(remainingMs, pendingUnits, laterRounds, fundable, units), remainingMs, floors.ms);
+      const fundable = Math.floor(remaining / Math.max(1, phase.floors.tokens));
+      const ms = repairAllowance(repairTimeShare(remainingMs, pendingUnits, laterRounds, fundable, units), remainingMs, phase.floors.ms);
       if (ms === undefined || ms < 1) {
         await begin(budget);
-        await recordSkipped(launch, unserved, "insufficient-time", { remainingMs, floorMs: floors.ms });
+        await recordSkipped(phase, unserved, "insufficient-time", { remainingMs, floorMs: phase.floors.ms });
         return;
       }
       await begin(budget);
-      served.add(next.member.name);
-      await repairMember(launch, next.member, ms, { tokens, turns: budget.turns }, floors);
+      handed.set(next.member.name, new Map(next.queue.map((m) => [m.id, threadSignature(m)])));
+      await repairMember(phase, next.member, ms, { tokens, turns: budget.turns });
     }
   }
 }

package/src/run/solved.ts

@@ -4,7 +4,7 @@ import { loadCollaborationReport } from "../collaboration-report.js";
 import { openMessages } from "../ledger/collaboration.js";
 import { postBoard } from "../ledger/board.js";
 import { unsettledFactCitations } from "../ledger/facts.js";
-import { listFindingsForRun, staleAnswerCitations, unverifiedFindings } from "../ledger/findings.js";
+import { staleAnswerFor, unverifiedFindings } from "../ledger/findings.js";
 import { listIdeas } from "../ledger/ideas.js";
 import { archiveSolved, clearCleanStop, clearSolved, readSolvedState, reopenSolved, resolveSolvedState, writeAnswer } from "../ledger/run-signals.js";
 import type { SolvedSignal } from "../ledger/run-signals.js";
@@ -80,14 +80,27 @@ function dropContested(run: HordeRun, proposal: SolvedSignal, contest: SolvedSig
 }
 
 /**
- * A proposal that cites a finding superseded or amended after it was made would ship the stale
- * reading as the answer. It is withdrawn for re-proposal rather than validated; the board names
- * the successor or the amendment.
+ * ANSWER.md keeps the withdrawn text for the record, but its status must stop naming the
+ * validation it held, or the run reads as validated after the proposal is gone.
+ */
+function recordWithdrawn(run: HordeRun, proposal: SolvedSignal, reason: string): void {
+  void recordLifecycle(run, "solved-withdrawn", { member: proposal.member, reason });
+  try {
+    writeAnswer(run.runDir, run.id, proposal, `withdrawn: it ${reason}; no validation carries over and no proposal is pending`);
+  } catch (error) {
+    safeNotify(run, `horde ${run.id}: could not write ANSWER.md (${oneLine(String(error), 200)})`, "error");
+  }
+}
+
+/**
+ * A proposal that cites a finding superseded or amended, or an artifact republished, after it was
+ * made would ship the stale reading as the answer. It is withdrawn for re-proposal rather than
+ * validated; the board names the successor, the amendment, or the republish.
  */
 function withdrawStale(run: HordeRun, proposal: SolvedSignal, stale: string[]): void {
   const reason = `cites ${stale.join(", ")}`;
   safeNotify(run, `horde ${run.id}: solved proposal withdrawn; it ${reason}`, "warning");
-  void recordLifecycle(run, "solved-withdrawn", { member: proposal.member, reason });
+  recordWithdrawn(run, proposal, reason);
   void postBoard(
     run.hordeDir,
     "parent",
@@ -111,13 +124,13 @@ function reopenContested(run: HordeRun): void {
   // The proposal returns with the citations it pinned when it was made; what went stale or
   // unsettled meanwhile makes it a re-proposal for its author, not a reopening.
   const stale = [
-    ...staleAnswerCitations(listFindingsForRun(run.hordeDir, run.id), contest.proposal.text, contest.proposal.cites),
+    ...staleAnswerFor(run.hordeDir, run.id, contest.proposal.text, contest.proposal.cites),
     ...unsettledFactCitations(run.hordeDir, contest.proposal.text).map((citation) => `provisional ${citation}`),
   ];
   run.solvedContest = undefined;
   if (stale.length) {
     const why = `cites ${stale.join(", ")}`;
-    void recordLifecycle(run, "solved-withdrawn", { member: contest.proposal.member, reason: why });
+    recordWithdrawn(run, contest.proposal, why);
     void postBoard(run.hordeDir, "parent", `SOLVED proposal by ${contest.proposal.member} is not re-opened after ${reason}: it ${why}. ${contest.proposal.member}: propose again citing the current findings.`);
     return;
   }
@@ -262,7 +275,7 @@ export function checkSolved(run: HordeRun, ctx: ExtensionCommandContext): void {
     dropContested(run, solved, state.contest);
     return;
   }
-  const stale = staleAnswerCitations(listFindingsForRun(run.hordeDir, run.id), solved.text, solved.cites);
+  const stale = staleAnswerFor(run.hordeDir, run.id, solved.text, solved.cites);
   if (stale.length && !run.solvedCommitted) {
     withdrawStale(run, solved, stale);
     return;

package/src/run/types.ts

@@ -38,6 +38,8 @@ export interface HordeRun extends MemberRunInfo {
   repairTokens?: number;
   /** Members whose queued repair work was skipped because the budget could not fund an attempt. */
   repairSkipped?: string[];
+  /** Members whose remaining repair threads their own completed attempt could not move. */
+  repairStalled?: string[];
   /** True when a user command or session shutdown ended the run. */
   userStop?: boolean | undefined;
   /** Human-readable stop reason for the report, e.g. "stopped by user". */

package/src/tool/actions.ts

@@ -7,7 +7,7 @@ import type { FactEntry } from "../ledger/facts.js";
 import * as path from "node:path";
 import { CLUSTER_THRESHOLD } from "../ledger/clusters.js";
 import { collaborationState } from "../ledger/collaboration.js";
-import { addFinding, amendFinding, answerCitations, findingReviewState, findingRevision, findingSummaries, listFindingsForRun, pendingReviewsForMember, staleAnswerCitations, verifyFinding } from "../ledger/findings.js";
+import { addFinding, amendFinding, answerCitations, findingReviewState, findingRevision, findingSummaries, listFindingsForRun, pendingReviewsForMember, staleAnswerFor, verifyFinding } from "../ledger/findings.js";
 import { textOverlap } from "../ledger/text-match.js";
 import { addIdea, claimIdea, dropIdea, finishIdea, listIdeas, ruleOutIdea } from "../ledger/ideas.js";
 import type { Idea } from "../ledger/ideas.js";
@@ -466,13 +466,13 @@ function resourcesAction({ hordeDir, siblings }: ActionContext): ActionResult {
 }
 
 /**
- * An answer that cites a superseded finding, or one amended since the proposal pinned it, ships a
- * stale reading as the run's result. The proposer cites the current text instead; a validator is
- * refused until the proposer re-proposes.
+ * An answer that cites a superseded finding, or a finding amended or an artifact republished since
+ * the proposal pinned it, ships a stale reading as the run's result. The proposer cites the
+ * current text instead; a validator is refused until the proposer re-proposes.
  */
 function staleAnswer(ctx: ActionContext, text: string, cites?: Record<string, string>): string | undefined {
   const runId = requireRun(ctx);
-  const stale = staleAnswerCitations(listFindingsForRun(ctx.hordeDir, runId), text, cites);
+  const stale = staleAnswerFor(ctx.hordeDir, runId, text, cites);
   if (!stale.length) return undefined;
   return `cites ${stale.join(", ")}`;
 }
@@ -489,7 +489,7 @@ async function solvedAction(ctx: ActionContext): Promise<ActionResult> {
     runId,
     ctx.member,
     ctx.params.text,
-    answerCitations(listFindingsForRun(ctx.hordeDir, runId), text),
+    answerCitations(listFindingsForRun(ctx.hordeDir, runId), text, collaborationState(ctx.hordeDir, runId).artifacts),
   );
   return {
     text: alreadySolved

package/src/tool/collaboration-actions.ts

@@ -107,11 +107,12 @@ function responseSubject(c: CollaborationCommand, m: PeerMessage): string {
 }
 
 /**
- * A blocking request closes on the recipient's response plus the sender's own supporting check of
- * the current revision. Before any response the sender may still withdraw its own challenge on an
- * F# or A#: a challenger that verified the claim itself, or watched others verify it, records a
- * supporting review of the current revision and cites evidence on it. Limits that review
- * discloses stay acceptance debt on the review record; the withdrawal clears only the dispute.
+ * A blocking request closes on the recipient's response plus a supporting check of the current
+ * revision: the sender's own review on a challenge, or the recipient's review when the sender owns
+ * the target and so may not review it. Before any response the sender may still withdraw its own
+ * challenge on an F# or A#: a challenger that verified the claim itself, or watched others verify
+ * it, records a supporting review of the current revision and cites evidence on it. Limits that
+ * review discloses stay acceptance debt on the review record; the withdrawal clears only the dispute.
  */
 function validateResolution(c: CollaborationCommand, m: PeerMessage, refs: string[]): void {
   if (m.sender === m.to) throw new Error("horde: a blocking request needs an independent resolver");
@@ -121,13 +122,19 @@ function validateResolution(c: CollaborationCommand, m: PeerMessage, refs: strin
   if (refs.length === 0 || (withdrawal && !reviewable) || (!withdrawal && !["responded", "deferred"].includes(m.state))) {
     throw new Error("horde: blocking resolution needs a response and evidence");
   }
-  const revision = targetInfo(c.ctx, c.state, target).revision;
+  const { owner, revision } = targetInfo(c.ctx, c.state, target);
   if ((c.params.revision ?? m.responseRevision ?? revision) !== revision) throw new Error(`horde: response is stale; explicitly review and resolve ${target}@${revision}, or ask the owner to respond again`);
   if (!refs.some((id) => c.state.evidence.some((e) => e.id === id && e.target === target && e.revision === revision))) {
     const detail = staleEvidence(c.state, refs, target, revision) ?? `none of ${refs.join(", ")} targets ${target}@${revision.slice(0, 12)}`;
     throw new Error(`horde: resolution evidence must address the current response target revision: ${detail}; attach evidence to that revision first`);
   }
   if (!reviewable) return;
+  if (owner === c.ctx.actor) requireRecipientReview(c, m, target, revision, withdrawal);
+  else requireOwnReview(c, target, revision, withdrawal);
+}
+
+/** A challenger settles its own dispute: its latest review of the current revision must support. */
+function requireOwnReview(c: CollaborationCommand, target: string, revision: string, withdrawal: boolean): void {
   const review = c.state.reviews.findLast((r) => r.target === target && r.revision === revision && r.actor === c.ctx.actor);
   if (!review || review.verdict !== "supports") {
     throw new Error(withdrawal
@@ -137,6 +144,24 @@ function validateResolution(c: CollaborationCommand, m: PeerMessage, refs: strin
   if (!withdrawal && target.startsWith("A") && review.unchecked) throw new Error("horde: resolve requires your supporting review of the current revision; finding limitations remain acceptance debt");
 }
 
+/**
+ * The owner of the target cannot review it, so a request it sent about its own work (a re-review
+ * after a correction) resolves on the recipient's supporting review of the current revision. The
+ * refusal names what is missing, since telling the owner to review its own artifact leads nowhere.
+ */
+function requireRecipientReview(c: CollaborationCommand, m: PeerMessage, target: string, revision: string, withdrawal: boolean): void {
+  const review = c.state.reviews.findLast((r) => r.target === target && r.revision === revision && r.actor === m.to);
+  const short = `${target}@${revision.slice(0, 12)}`;
+  const prefix = `horde: ${target} is yours, so ${m.id} resolves on ${m.to}'s review`;
+  if (!review || review.verdict !== "supports") {
+    const missing = review ? `${review.id} is ${review.verdict}, not supports` : `no supporting review of ${short} by ${m.to} yet`;
+    throw new Error(`${prefix}: ${missing}; ask ${m.to} to review the current revision`);
+  }
+  if (!withdrawal && target.startsWith("A") && review.unchecked) {
+    throw new Error(`${prefix}: ${review.id} left unchecked: ${review.unchecked}; ask ${m.to} for a full review of ${short}`);
+  }
+}
+
 function attachEvidence(c: CollaborationCommand): EventDraft {
   const { ctx, state, params: p, seq } = c;
   const target = requireParam(p.target, "target", p.action);