revise bulk-clear to explicit ids per mara's feedback, fix clippy line count

hive-agent/prompts/system.md

@@ -2,7 +2,7 @@ You are hyperhive agent `{label}` (qualified: `{qualified_label}`){hive_identity
 
 Tools (hyperhive surface). Full signature + behavior for each comes from the tool's own MCP description (you already received it via the MCP tool schema) — this is just the map of what exists and which ones are gated, so you know where to look:
 
-- **Inbox / messaging** (always available): `mcp__hyperhive__recv`, `mcp__hyperhive__ack_until`, `mcp__hyperhive__send`, `mcp__hyperhive__ask`, `mcp__hyperhive__answer`, `mcp__hyperhive__get_loose_ends`, `mcp__hyperhive__cancel_loose_end`, `mcp__hyperhive__ack_todos_until`, `mcp__hyperhive__remind`, `mcp__hyperhive__set_status`, `mcp__hyperhive__get_agent_meta`. Two habits worth internalizing beyond the tool descriptions themselves: prefer ending the turn over repeatedly polling `recv` when idle (only turn-boundaries observe in-container todo wakes — bash-task completions, matrix unread, forge activity — and ending the turn is also your checkpoint); and `ask`/`answer` are async — `ask` returns immediately with a question id, the reply lands later as a `question_answered` system event, never block a turn waiting on it inline. If `get_loose_ends` reports a large todo backlog (it caps rendered rows at 40), don't try to triage hundreds of ids by hand — call `ack_todos_until` with the suggested cutoff to bulk-clear the stale tail in one shot.
+- **Inbox / messaging** (always available): `mcp__hyperhive__recv`, `mcp__hyperhive__ack_until`, `mcp__hyperhive__send`, `mcp__hyperhive__ask`, `mcp__hyperhive__answer`, `mcp__hyperhive__get_loose_ends`, `mcp__hyperhive__cancel_loose_end`, `mcp__hyperhive__mark_todos_done`, `mcp__hyperhive__remind`, `mcp__hyperhive__set_status`, `mcp__hyperhive__get_agent_meta`. Two habits worth internalizing beyond the tool descriptions themselves: prefer ending the turn over repeatedly polling `recv` when idle (only turn-boundaries observe in-container todo wakes — bash-task completions, matrix unread, forge activity — and ending the turn is also your checkpoint); and `ask`/`answer` are async — `ask` returns immediately with a question id, the reply lands later as a `question_answered` system event, never block a turn waiting on it inline. If `get_loose_ends` reports a large todo backlog (it caps rendered rows at 40), don't try to cancel hundreds of ids one at a time — review the shown batch and clear the ones you've actually looked at in one `mark_todos_done(ids: [...])` call, then call `get_loose_ends` again for the next batch. There's deliberately no blind range-clear for todos (unlike `ack_until` for messages) — only clear ids you've reviewed.
 - **Extra MCP tools** (some agents only): `mcp__<server>__<tool>` — agent-specific (matrix client, scraper, db connector, etc.) declared in your `agent.nix` under `hyperhive.extraMcpServers`. First-class tools, already operator-approved at deploy time.
 - **Lifecycle** (_requires `lifecycle` tool group_, direct children only, no approval needed): `restart`, `kill`, `start`, `update`, `list_containers`.
 - **Approvals** (_requires `approvals` tool group_, queues an operator approval): `request_init_config`, `request_apply_commit`, `request_update_meta_inputs`.

hive-agent/src/todo_server.rs

@@ -202,7 +202,7 @@ fn dispatch(
         } => clear_todo(store, &subsystem, key.as_deref(), all),
         Request::ListTodos { subsystem } => list_todos(store, subsystem.as_deref()),
         Request::MarkTodoDone { id } => mark_todo_done(store, id),
-        Request::MarkTodosDoneUntil { up_to } => mark_todos_done_until(store, up_to),
+        Request::MarkTodosDone { ids } => mark_todos_done(store, &ids),
         Request::StoreReminder {
             message,
             timing,
@@ -418,13 +418,13 @@ fn mark_todo_done(store: &Todos, id: i64) -> Response {
     }
 }
 
-/// `MarkTodosDoneUntil` handler: bulk-acks every un-acked todo id at or
-/// below `up_to` — the escape hatch for a backlog too large to triage
-/// one-by-one (see `Todos::mark_done_until`'s doc for why it's needed).
-fn mark_todos_done_until(store: &Todos, up_to: i64) -> Response {
-    match store.mark_done_until(up_to) {
+/// `MarkTodosDone` handler: bulk-acks an explicit list of todo ids — the
+/// escape hatch for a backlog too large to triage one-by-one (see
+/// `Todos::mark_done_many`'s doc for why it's ids, not a threshold).
+fn mark_todos_done(store: &Todos, ids: &[i64]) -> Response {
+    match store.mark_done_many(ids) {
         Ok(count) => {
-            tracing::debug!(up_to, count, "todo bulk mark-done");
+            tracing::debug!(n_ids = ids.len(), count, "todo bulk mark-done");
             Response::Acked {
                 count: u64::try_from(count).unwrap_or(0),
             }

hive-agent/src/todos.rs

@@ -245,17 +245,23 @@ impl Todos {
         Ok(n)
     }
 
-    /// Bulk-ack every un-acked todo with `id <= up_to` in one shot — the
-    /// same "note the highest id you've seen, clear everything up to it"
-    /// pattern the message inbox's `ack_until` already gives agents, applied
-    /// to this store. Exists for the case a per-id triage loop isn't worth
-    /// it: an agent that hasn't called `get_loose_ends` in a long stretch
-    /// (or one whose producers pile up faster than it triages) can end up
-    /// with a backlog large enough that the rendered list itself becomes
-    /// unwieldy — clearing it in one call is the escape hatch, same
-    /// `acked`-not-deleted semantics as [`Self::mark_done`] (a reconciled
-    /// producer's next `upsert` still sees the row to compare against).
-    /// Returns the number of rows newly acked.
+    /// Bulk-ack a specific, explicit list of todo ids in one shot. Exists
+    /// for the case a per-id `mark_done` loop isn't worth the round-trips:
+    /// an agent that hasn't called `get_loose_ends` in a long stretch (or
+    /// one whose producers pile up faster than it triages) can end up with
+    /// a backlog large enough that clearing it one call at a time is
+    /// impractical. Deliberately **explicit ids, not a `<= threshold`
+    /// range** — a reviewer's call on the design: a range-based
+    /// bulk-ack risks silently acking something the agent never actually
+    /// looked at, since todos are heterogeneous unrelated items (bash /
+    /// matrix / forge) rather than a sequentially-read stream the way inbox
+    /// messages are. The caller is expected to have looked at each id
+    /// (typically the ids `get_loose_ends` just rendered) before passing
+    /// them here. Same `acked`-not-deleted semantics as [`Self::mark_done`]
+    /// (a reconciled producer's next `upsert` still sees the row to compare
+    /// against). Unknown/already-acked ids are silently skipped — same "not
+    /// a new action" idempotence as the single-id path. Returns the number
+    /// of rows newly acked.
     ///
     /// # Errors
     ///
@@ -264,13 +270,20 @@ impl Todos {
     /// # Panics
     ///
     /// Panics if the connection mutex is poisoned.
-    pub fn mark_done_until(&self, up_to: i64) -> Result<usize> {
+    pub fn mark_done_many(&self, ids: &[i64]) -> Result<usize> {
+        if ids.is_empty() {
+            return Ok(0);
+        }
         let conn = self.conn.lock().unwrap();
-        let n = conn.execute(
-            "UPDATE todos SET acked = 1, acked_at = ?1 WHERE acked = 0 AND id <= ?2",
-            params![Utc::now().timestamp(), up_to],
-        )?;
-        Ok(n)
+        let now = Utc::now().timestamp();
+        let mut total = 0usize;
+        for id in ids {
+            total += conn.execute(
+                "UPDATE todos SET acked = 1, acked_at = ?1 WHERE acked = 0 AND id = ?2",
+                params![now, id],
+            )?;
+        }
+        Ok(total)
     }
 
     /// List todos, newest-updated first. `subsystem = Some(..)` filters to
@@ -504,25 +517,26 @@ mod tests {
         assert!(!s.has_any().unwrap(), "acked-only table reads as empty");
     }
 
-    /// `mark_done_until` acks everything at-or-below the threshold id and
-    /// leaves later rows untouched, mirroring `ack_until`'s inbox semantics.
+    /// `mark_done_many` acks exactly the ids passed, leaves the rest
+    /// untouched — no threshold/range semantics.
     #[test]
-    fn mark_done_until_acks_up_to_threshold_only() {
+    fn mark_done_many_acks_only_the_listed_ids() {
         let (_dir, s) = store();
         let (id1, _) = s.upsert("bash", None, "task 1", None).unwrap();
         let (id2, _) = s.upsert("bash", None, "task 2", None).unwrap();
         let (id3, _) = s.upsert("bash", None, "task 3", None).unwrap();
         assert_eq!(
-            s.mark_done_until(id2).unwrap(),
+            s.mark_done_many(&[id1, id3]).unwrap(),
             2,
-            "acks id1 and id2, not id3"
+            "acks id1 and id3, not id2 — not a range"
         );
         let left = s.list(None).unwrap();
         assert_eq!(left.len(), 1);
-        assert_eq!(left[0].id, id3);
-        // Idempotent: re-running over the same range acks nothing new.
-        assert_eq!(s.mark_done_until(id2).unwrap(), 0);
-        let _ = id1;
+        assert_eq!(left[0].id, id2);
+        // Idempotent: re-running over the same ids acks nothing new.
+        assert_eq!(s.mark_done_many(&[id1, id3]).unwrap(), 0);
+        // Empty input is a no-op, not an error.
+        assert_eq!(s.mark_done_many(&[]).unwrap(), 0);
     }
 
     /// `reap_acked` only removes acked rows past the cutoff — a recent ack