gcf-aif-ext 0.3.0 → 0.4.0

package/hooks/pre-commit.js

@@ -6,13 +6,15 @@
 import { existsSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import path from 'node:path';
-import { listSystems } from '../lib/gcf-paths.js';
-import { validateCard, validateUntil } from '../lib/validate-card.js';
+import { listSystems, legacyCards } from '../lib/gcf-paths.js';
+import { validateItem, validateUntil } from '../lib/validate-item.js';
 import { stemMatches } from '../lib/id.js';
 import { writeIndex } from '../lib/index-gen.js';
 import { lint } from '../lib/linter.js';
 import { buildLedger } from '../lib/ledger.js';
 import { designCheck } from '../lib/design-check.js';
+import { bodyHash } from '../lib/work-ops.js';
+import { checkLive } from '../lib/live.js';
 
 const projectDir = process.cwd();
 const root = path.join(projectDir, 'gcf');
@@ -26,36 +28,58 @@ const fail = (msg) => {
 // null when git itself failed (unborn HEAD, no work tree) — then fall through to the gate
 // rather than letting a broken probe wave a commit past every check.
 function git(args) {
-  const res = spawnSync('git', args, { cwd: projectDir, encoding: 'utf8' });
+  // quotePath off: a non-ASCII path in the refusal reads as itself, not as octal escapes.
+  const res = spawnSync('git', ['-c', 'core.quotePath=false', ...args], {
+    cwd: projectDir,
+    encoding: 'utf8',
+  });
 
   return res.status === 0 ? res.stdout.trim() : null;
 }
 
-const staged = git(['diff', '--cached', '--name-only', '--', root]);
+// gcf/.metrics is left out: `gcf audit` and `gcf context` append to it on every run, and the
+// gate reads none of it. Hooks run from the repository root, so the pathspecs are relative.
+const scope = ['--', 'gcf', ':(exclude)gcf/.metrics'];
+const staged = git(['diff', '--cached', '--name-only', ...scope]);
 if (staged === '') process.exit(0); // this commit does not touch gcf/
 if (staged !== null) {
-  // Untracked counts: cards and units are found by reading directories, so an uncommitted file
+  // Untracked counts: items and units are found by reading directories, so an uncommitted file
   // would be validated and written into the staged INDEX while not being in the repository.
-  const unstaged = git(['diff', '--name-only', '--', root]);
-  const untracked = git(['ls-files', '--others', '--exclude-standard', '--', root]);
-  if (unstaged || untracked) {
+  const outside = [
+    git(['diff', '--name-only', ...scope]),
+    git(['ls-files', '--others', '--exclude-standard', ...scope]),
+  ]
+    .filter(Boolean)
+    .join('\n');
+  if (outside) {
+    // A move (verdict, take, close, drop…) commits only its own files, so staging does not help it.
     fail(
-      'gcf/ has changes outside the index — stage them, or commit gcf/ separately ' +
+      `gcf/ has changes outside the index (${outside.split('\n').join(', ')}) — stage them, ` +
+        'or commit gcf/ separately; before a gcf move, commit or stash them ' +
         '(the gate reads the working tree)',
     );
   }
 }
 
+// Schema 2 cards are not read by 0.4: left in place they would silently stop being checked.
+const legacy = legacyCards(root);
+if (legacy.length)
+  fail(
+    `gcf/cards/ holds schema 2 card(s) (${legacy.join(', ')}): GCF 0.4 keeps work in ` +
+      'gcf/work/<id>.md with schema 3 and does not migrate — put each card back into ' +
+      'gcf/design/ as a unit and run ai-factory gcf take, then delete gcf/cards/',
+  );
+
 const ledger = await buildLedger(projectDir);
 
 // 1-2: frontmatter validity, storable statuses, until grammar, filename invariant.
-for (const c of ledger.cards) {
+for (const c of ledger.items) {
   const errors = [
-    ...validateCard(c.data),
+    ...validateItem(c.data),
     ...validateUntil(c.body),
     ...(stemMatches(c.file, c.data.id) ? [] : [`filename must be ${c.data.id}.md`]),
   ];
-  if (errors.length) fail(`${c.name}: ${errors[0]}`);
+  if (errors.length) fail(`work/${c.name}: ${errors[0]}`);
 }
 
 for (const s of await listSystems(root)) {
@@ -63,35 +87,35 @@ for (const s of await listSystems(root)) {
   if (errors.length) fail(`systems/${s.name}: ${errors[0]}`);
 }
 
-// A unit or card leaving without its move (take, done, drop, a verdict) loses its reason, not
-// its integrity: a card or unit still citing it fails M2 below, in this commit. A warning, not a
-// refusal — a revert of the commit that added it removes an id legitimately.
+// An unplayed item's body is the source of its systems/ lines (Methodology §5.4): edited after
+// its close, a tune or a kill would take the wrong lines out. `close` froze it by hash.
+for (const c of ledger.items.filter((x) => x.data.status === 'unplayed')) {
+  if (bodyHash(c.body) !== c.data.frozen)
+    fail(`work/${c.name}: an unplayed item's body is frozen — tune it to change it`);
+}
+
+// A unit or item leaving without its move loses its reason, not its integrity: one still citing
+// it fails M2 below, in this commit. A warning, not a refusal — a revert of the commit that
+// added it removes an id legitimately.
 for (const id of ledger.vanished()) {
   console.error(
-    `gcf pre-commit: warning: ${id} left design/ or cards/ without done, drop or a verdict — ` +
+    `gcf pre-commit: warning: ${id} left design/ or work/ without a move — ` +
       'no history or graveyard line keeps why',
   );
 }
 
-// Design model and card bodies: every finding of severity `block` refuses the commit.
+// Design model and item bodies: every finding of severity `block` refuses the commit.
 const first = (await designCheck(projectDir)).issues.find((i) => i.severity === 'block');
 if (first) fail(`${first.file}:${first.line}: ${first.check}: ${first.message}`);
 
-// 4: a built card must not sit on an unplayed dependency — a live card, or a unit still in
-// design/. A collapsed, done or killed id is played; an unknown one is a typo (design check).
-for (const c of ledger.cards.filter((x) => x.data.status === 'built')) {
-  for (const dep of c.data.depends ?? []) {
-    const live = ledger.where(dep).live[0];
-    if (live)
-      fail(`${c.data.id} is built on top of unplayed ${dep} (${live.state} — GCF-PRD §7.2)`);
-  }
-}
+// Dependencies are held by the moves, not here (Methodology §4.1): `submit` refuses an unplayed
+// one, `close` and `keep` a not-yet-kept one. A gate check would refuse the tune or the kill of
+// a dependency whose dependent is already waiting for its verdict — a legal move, blocked.
 
-for (const c of ledger.cards) {
-  const unknown = (c.data.depends ?? []).find((d) => !ledger.known(d));
-  if (unknown)
-    fail(`${c.data.id} depends on unknown ${unknown} (no unit, card, history or graveyard line)`);
-}
+// LIVE.md form: a malformed record would hide from every reader of the snapshot.
+const live = await checkLive(projectDir);
+const form = live.problems[0] ?? live.issues.find((i) => /summary|twice/.test(i));
+if (form) fail(`LIVE.md: ${form}`);
 
 // 5: П2 linter over systems docs.
 for (const s of await listSystems(root)) {

package/injections/commit-status.md

@@ -1,7 +1,9 @@
-## GCF: card status before commit (from gcf-aif-ext)
+## GCF: work item status after commit (from gcf-aif-ext)
 
 gcf_commit:
-- when `gcf/` exists and the commit implements a card, verify the card frontmatter is current
-- an implementation commit that completes a build flips `status:` to `built` and records `built_at:` with the commit hash in the same commit
-- do not commit a card file whose `status:` is `validated` or `killed`: those are terminal and never stored
-- when the commit makes a hard unit's tests green, run `ai-factory gcf done <id>` after it: the unit leaves `gcf/design/` in its own fixed-format commit
+- when `gcf/` exists and the commit implements a work item, commit the implementation first, then move the item with its own command in a follow-up commit
+- gate `verdict` or `decision`: run `ai-factory gcf submit <item-id>` — it waits for the operator, `since:` records where the wait began
+- gate `auto`, every check green: write the item's `live:` delta, then run `ai-factory gcf close <item-id>` — never edit `status:` by hand
+- the work cannot go on: run `ai-factory gcf block <item-id> --reason "<why or the question>"`
+- do not write a terminal status into an item file: a terminal move deletes the file and writes the history or graveyard line itself
+- when the commit makes the tests of a hard unit still in `gcf/design/` green, run `ai-factory gcf done <id>` after it

package/injections/plan-context.md

@@ -1,9 +1,12 @@
 ## GCF: readset before planning (from gcf-aif-ext)
 
 gcf_gate:
-- when `gcf/` exists and the task names a card, run `ai-factory gcf context <card-id>` first
-- the returned file list is the readset: read those files and nothing else under `gcf/`
+- when `gcf/` exists and the task names a work item, run `ai-factory gcf context <item-id>` first
+- the returned file list is the readset: read those files and nothing else under `gcf/`; `gcf/LIVE.md` in it says what the game already does
 - `over_budget: true` in the result: stop and record a D1 question instead of planning
-- an id in `depends:` that still lives as a card or as a unit of `gcf/design/` is unplayed: do not plan on top of it, stop
-- shape the plan by the card slots: intent, behavior, refusal, boundaries, persistence, feel envelopes, contract, interactions, constraints, miss criterion
-- when the task names a hard unit (rule, constraint, entity), there is no card: read its section only, from the file `ai-factory gcf where <id>` names, and plan its tests from `statement`, `threshold` or `fields`
+- an id in `depends:` that lives in `gcf/design/`, or as an item in any status but unplayed, parked or awaiting-verdict, is not played: do not plan on top of it, stop
+- a dependency awaiting its verdict is planned on: the close of this item then waits for that verdict (`ai-factory gcf block <id> --reason "waits for <dep>"`)
+- write the plan to the item's `plan:` path, by default `.ai-factory/plans/<item-id>.md`, with task checkboxes
+- a design-unit item: shape the plan by its slots — intent, behavior, refusal, boundaries, persistence, feel envelopes, contract, interactions, constraints, miss criterion; a hard unit plans its tests from `statement`, `threshold` or `fields`
+- a bug item: the first task writes the test that reproduces `repro:`, the fix comes after it
+- after the plan, run `ai-factory gcf plan check <item-id>`: a failure is fixed in the plan before implementation

package/injections/review-pillars.md

@@ -1,7 +1,8 @@
 ## GCF: pillar and constraint review (from gcf-aif-ext)
 
 gcf_review:
-- when `gcf/` exists and the change implements a card, read the card and `gcf/PILLARS.md` when it exists (it stays absent until the pillars interview)
-- check the diff against every negative constraint of the card: name each violation with file and line
+- when `gcf/` exists and the change implements a work item, read the item and `gcf/PILLARS.md` when it exists (it stays absent until the pillars interview)
+- check the diff against every negative constraint of the item: name each violation with file and line
 - check the diff against each pillar's review question: a contradiction is a finding, not a note
-- numeric feel values in code outside the card's envelope: report the value and the envelope bounds
+- numeric feel values in code outside the item's envelope: report the value and the envelope bounds
+- a capability the diff adds, changes or removes that the item's `live:` delta does not name: a finding

package/lib/anchors.js

@@ -26,6 +26,28 @@ const EMPTY_HASH = h8('');
 // human with D1 questions about a GDD nobody edited.
 export const HASH_VERSION = 2;
 
+/**
+ * Line indexes inside a closed fenced block: a `# comment` there is code, not a heading. A fence
+ * that never closes is ignored — a stray ``` must not swallow every heading after it.
+ */
+function fencedLines(lines) {
+  const inside = new Set();
+  let open = -1;
+  let fence = '';
+  for (const [i, line] of lines.entries()) {
+    const f = line.match(/^ {0,3}(`{3,}|~{3,})(.*)$/);
+    if (!f) continue;
+    if (open < 0) [open, fence] = [i, f[1]];
+    // CommonMark: the closing fence is the same character, at least as long, with no info string.
+    else if (f[1][0] === fence[0] && f[1].length >= fence.length && !f[2].trim()) {
+      for (let j = open + 1; j < i; j++) inside.add(j);
+      open = -1;
+    }
+  }
+
+  return inside;
+}
+
 /**
  * Split markdown into heading-addressed sections.
  * Text before the first heading is `GDD#preamble`.
@@ -44,8 +66,9 @@ export function splitSections(markdown) {
     sections.push(current);
   };
 
+  const fenced = fencedLines(lines);
   for (const [i, line] of lines.entries()) {
-    const m = line.match(/^(#{1,6})\s+(.+?)\s*$/);
+    const m = !fenced.has(i) && line.match(/^(#{1,6})\s+(.+?)\s*$/);
     if (m) {
       flush();
       current = { heading: m[2], level: m[1].length, start: i + 1, lines: [] };
@@ -171,10 +194,10 @@ export async function sourceBodies(sourceDir) {
   return bodies;
 }
 
-/** gcf-relative files that cite anchors: units, cards, and the `sections:` of questions. */
+/** gcf-relative files that cite anchors: units, work items, and the `sections:` of questions. */
 async function anchorCiters(root) {
   const out = [];
-  for (const dir of ['design', 'cards']) {
+  for (const dir of ['design', 'work']) {
     if (!existsSync(path.join(root, dir))) continue;
     const names = (await readdir(path.join(root, dir))).filter((n) => n.endsWith('.md'));
     out.push(...names.map((n) => `${dir}/${n}`));
@@ -187,7 +210,7 @@ async function anchorCiters(root) {
 
 /**
  * A renamed heading changes its anchor (GCF-PRD §11.6): rewrite `GDD#<from>` to `GDD#<to>` in
- * design/, cards/ and open-questions.md, so provenance, `source:` and `sections:` follow the
+ * design/, work/ and open-questions.md, so provenance, `source:` and `sections:` follow the
  * section instead of pointing at an anchor that no longer exists. Returns the files it changed.
  */
 export async function rewriteAnchors(projectDir, renamed) {

package/lib/audit-core.js

@@ -2,74 +2,96 @@ import { readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { listCards, listSystems, readConfig, tokensEst } from './gcf-paths.js';
+import { listItems, listSystems, readConfig, tokensEst, legacyCards } from './gcf-paths.js';
 import { lint } from './linter.js';
 import { drifted } from './index-gen.js';
-import { designCheck } from './design-check.js';
+import { designCheck, recordsIn } from './design-check.js';
 import { buildLedger } from './ledger.js';
+import { STORED } from './transitions.js';
+import { openDepends } from './work-ops.js';
 
 function git(args, cwd) {
-  const res = spawnSync('git', args, { cwd, encoding: 'utf8' });
+  // A blame of a long file overflows the 1 MiB default, and an overflow reads as a git failure.
+  const res = spawnSync('git', args, { cwd, encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 });
 
   return res.status === 0 ? res.stdout.trim() : null;
 }
 
 const UNTIL_RE = /\[until:\s*(verdict\([a-z0-9-]+\)|retune\([a-z0-9-]+\)|manual\([^)]*\))\]/g;
 const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-const LEGAL_STATUS = ['proposed', 'built', 'tuning'];
 
 /**
  * @typedef {object} AuditReport
  * @property {string} first_line
- * @property {Array<{id: string, commits: number | null, limit: number}>} stale_built
+ * @property {Array<{id: string, status: string, commits: number | null, limit: number}>}
+ *   stale_waiting
  * @property {Array<{id: string, tune_count: number, limit: number}>} tune_limit
  * @property {Array<{id: string, depends: string[]}>} open_depends
  * @property {{count: number, limit: number, over: boolean}} wip
- * @property {{tokens: number, budget: number, over: boolean} | null} pillars
+ * @property {{count: number, warn_after: number, over: boolean}} unplayed
+ * @property {string[]} legacy_cards
+ * @property {{tokens: number, budget: number, over: boolean, count: number, too_many: boolean}
+ *   | null} pillars
  * @property {Array<{file: string, trigger: string, status: string}>} until
  * @property {Record<string, object[]>} linter
  * @property {object[]} pragmas
  * @property {boolean} index_drift
  * @property {Array<{id: string, status: string}>} illegal_status
+ * @property {Array<{id: string, commits: number | null, limit: number}>} stale_questions
  * @property {number} [schema]
- * @property {Array<{id: string, status: string, system: string[], depends: string[]}>} [cards]
+ * @property {Array<{id: string, type: string, gate: string, status: string, system: string[],
+ *   depends: string[], parent: string | null, tune_count: number}>} [items]
  * @property {{blocking: number, units: number, ready: number}} [design]
  */
 
 /**
- * Deterministic audit core (GCF-PRD §10.1): until triggers, built staleness, tune
- * limits, WIP, PILLARS budget, П2 linter, INDEX drift. No LLM anywhere; the
+ * Deterministic audit core (GCF-PRD §10.1): until triggers, waiting staleness, tune limits,
+ * WIP, unplayed count, PILLARS budget, П2 linter, INDEX drift. No LLM anywhere; the
  * contradiction hunt is a separate optional skill pass.
  */
 export async function audit(projectDir) {
   const root = path.join(path.resolve(projectDir), 'gcf');
   const config = await readConfig(root);
-  const cards = await listCards(root);
+  const items = await listItems(root);
   const systems = await listSystems(root);
+  const ledger = await buildLedger(projectDir);
+  const unplayed = items.filter((c) => c.data.status === 'unplayed').length;
   /** @type {AuditReport} */
   const report = {
     first_line: '',
-    stale_built: [],
+    stale_waiting: [],
     tune_limit: [],
     open_depends: [],
-    wip: wipOf(cards, config),
+    wip: wipOf(items, config),
+    unplayed: {
+      count: unplayed,
+      warn_after: config.unplayed_warn_after,
+      over: unplayed > config.unplayed_warn_after,
+    },
+    legacy_cards: legacyCards(root),
     pillars: await pillarsOf(root, config),
-    until: untilRecords(cards, systems, projectDir, await buildLedger(projectDir)),
+    until: untilRecords(items, systems, projectDir, ledger),
     linter: {},
     pragmas: [],
     index_drift: await drifted(root),
     illegal_status: [],
+    stale_questions: staleQuestions(projectDir, root, config),
   };
   // The harness gate reads everything from this one report — it never parses gcf/ itself.
   report.schema = config.schema;
-  report.cards = cards.map((c) => ({
+  report.items = items.map((c) => ({
     id: c.data.id,
+    type: c.data.type,
+    gate: c.data.gate,
     status: c.data.status,
     system: c.data.system ?? [],
     depends: c.data.depends ?? [],
+    parent: c.data.parent ?? null,
+    tune_count: c.data.tune_count ?? 0,
+    parallel: c.data.parallel ?? 'serial',
   }));
   const design = await designCheck(projectDir);
-  checkCards(report, cards, config, { projectDir, designIds: design.units.map((u) => u.id) });
+  checkItems(report, items, config, { projectDir, ledger });
   report.design = {
     blocking: design.blocking,
     units: design.units.length,
@@ -82,24 +104,25 @@ export async function audit(projectDir) {
 }
 
 /**
- * Per-card checks: illegal status, built staleness, tune limit, open depends. `designIds` are
- * units still in gcf/design/: a card depending on one builds on what nobody has played yet.
+ * Per-item checks: illegal status, waiting staleness, tune limit, open depends — a dependency
+ * still in design/ or in work, not unplayed or parked, is what nobody has played yet.
  */
-function checkCards(report, cards, config, { projectDir, designIds }) {
-  const liveIds = new Set([...cards.map((c) => c.data.id), ...designIds]);
+function checkItems(report, items, config, { projectDir, ledger }) {
   // Staleness is measured in commits, so outside a repository there is no answer to give.
-  // Without this probe every built card would read as stale and stop the harness.
+  // Without this probe every waiting item would read as stale and stop the harness.
   const inRepo = git(['rev-parse', '--git-dir'], projectDir) !== null;
 
-  for (const c of cards) {
-    if (!LEGAL_STATUS.includes(c.data.status)) {
+  for (const c of items) {
+    if (!STORED.includes(c.data.status)) {
       report.illegal_status.push({ id: c.data.id, status: c.data.status });
     }
 
     const stale = inRepo ? staleEntry(c, config, projectDir) : null;
-    if (stale) report.stale_built.push(stale);
+    if (stale) report.stale_waiting.push(stale);
 
-    if ((c.data.tune_count ?? 0) >= config.tune_limit) {
+    // At the limit, only the next verdict matters: a ready item still gets its last build.
+    const verdictDue = ['awaiting-verdict', 'unplayed'].includes(c.data.status);
+    if (verdictDue && (c.data.tune_count ?? 0) >= config.tune_limit) {
       report.tune_limit.push({
         id: c.data.id,
         tune_count: c.data.tune_count,
@@ -107,23 +130,26 @@ function checkCards(report, cards, config, { projectDir, designIds }) {
       });
     }
 
-    // A depends id that still has a card file is unplayed (GCF-PRD §7.2). Data for the
-    // harness gate, not an alert: a proposed card waiting on its dependency is normal.
-    const open = (c.data.depends ?? []).filter((d) => liveIds.has(d));
+    // Data for the harness gate, not an alert: a ready item waiting on its dependency is normal.
+    // A run may start on a dependency awaiting its verdict (Methodology §3.2); close and keep
+    // check the stricter rule themselves.
+    const open = openDepends(ledger, c.data.depends ?? [], { waiting: true });
     if (open.length) report.open_depends.push({ id: c.data.id, depends: open });
   }
 }
 
-/** A stale_built entry for a built card past the commit limit, else null. */
+/** A stale_waiting entry for an item waiting on the operator past the commit limit, else null. */
 function staleEntry(c, config, projectDir) {
-  if (c.data.status !== 'built' || !c.data.built_at) return null;
+  const waits = ['awaiting-verdict', 'awaiting-decision', 'blocked'].includes(c.data.status);
+  if (!waits || !c.data.since) return null;
   // git() is null when the ref no longer resolves (rebase, squash, amend, shallow clone).
   // Number(null) is 0, which reads as "fresh" — the one answer that must never be guessed.
-  const raw = git(['rev-list', '--count', `${c.data.built_at}..HEAD`], projectDir);
+  const raw = git(['rev-list', '--count', `${c.data.since}..HEAD`], projectDir);
   const n = raw === null ? NaN : Number(raw);
   if (!Number.isFinite(n) || n > config.built_stale_after_commits) {
     return {
       id: c.data.id,
+      status: c.data.status,
       commits: Number.isFinite(n) ? n : null,
       limit: config.built_stale_after_commits,
     };
@@ -132,33 +158,84 @@ function staleEntry(c, config, projectDir) {
   return null;
 }
 
-function wipOf(cards, config) {
-  const count = cards.filter((c) => c.data.status === 'built').length;
+/** WIP counts what waits for the playtest; unplayed items have their own warning (§4). */
+function wipOf(items, config) {
+  const count = items.filter((c) => c.data.status === 'awaiting-verdict').length;
 
   return { count, limit: config.wip_built_limit, over: count > config.wip_built_limit };
 }
 
+// GCF-PRD §5.3: no more than 7 pillars.
+const PILLARS_MAX = 7;
+
 async function pillarsOf(root, config) {
   const pillarsFile = path.join(root, 'PILLARS.md');
   if (!existsSync(pillarsFile)) return null;
-  const tokens = tokensEst(await readFile(pillarsFile, 'utf8'));
+  const text = await readFile(pillarsFile, 'utf8');
+  const tokens = tokensEst(text);
+  const count = recordsIn(text, 'pillars').length;
+
+  return {
+    tokens,
+    budget: config.pillars_budget,
+    over: tokens > config.pillars_budget,
+    count,
+    too_many: count > PILLARS_MAX,
+  };
+}
+
+/**
+ * Open questions older than the limit, aged by the last commit that changed their `- id:` line
+ * beyond whitespace (GCF-PRD §7.4): a pile of unanswered ones means the human has dropped out
+ * of the loop.
+ */
+function staleQuestions(projectDir, root, config) {
+  if (!existsSync(path.join(root, 'open-questions.md'))) return [];
+  // null for an untracked file or outside a repository: no commit to age from. -w: a respaced
+  // or re-ended (CRLF/LF) line keeps the commit that wrote it.
+  const blame = git(['blame', '-w', '--porcelain', '--', 'gcf/open-questions.md'], projectDir);
+  if (blame === null) return [];
+  const added = [];
+  let hash = '';
+  for (const line of blame.split('\n')) {
+    const head = line.match(/^([0-9a-f]{40,64}) \d+ \d+/);
+    if (head) hash = head[1];
+    const id = line.match(/^\t\uFEFF?- id:\s*(\S+)/)?.[1];
+    // An uncommitted line blames to the all-zero hash: it is new, not old.
+    if (id && !/^0+$/.test(hash)) added.push({ id, hash });
+  }
+
+  const ages = new Map();
+  const ageOf = (h) => {
+    if (!ages.has(h)) {
+      const raw = git(['rev-list', '--count', `${h}..HEAD`], projectDir);
+      // Number(null) is 0, "fresh" — the one answer that must never be guessed (see staleEntry).
+      ages.set(h, raw === null ? null : Number(raw));
+    }
+
+    return ages.get(h);
+  };
+
+  const limit = config.question_stale_after_commits;
 
-  return { tokens, budget: config.pillars_budget, over: tokens > config.pillars_budget };
+  return added
+    .map(({ id, hash: h }) => ({ id, commits: ageOf(h), limit }))
+    .filter((q) => q.commits === null || q.commits > limit);
 }
 
 /**
  * Whether a verdict fired. `verdict(id)` reads the files, as the ledger does (GCF-PRD §5.8): a
- * keep or kill left a history or graveyard line, a tune left the card's tune_count — so a
+ * keep or kill left a history or graveyard line, a tune left the item's tune_count — so a
  * squash or a shallow clone does not hide it, and a revert takes it back.
  */
-function verdictMatchers(projectDir, ledger, cards) {
-  const tuned = cards.filter((c) => (c.data.tune_count ?? 0) > 0);
+function verdictMatchers(projectDir, ledger, items) {
+  const tuned = items.filter((c) => (c.data.tune_count ?? 0) > 0);
   const verdictLog = git(['log', '--grep', '^gcf(verdict):', '--format=%s'], projectDir) ?? '';
 
   return {
     verdict: (id) =>
       ledger.where(id).terminal.some((t) => t !== 'done') || tuned.some((c) => c.data.id === id),
-    // shortcut: a kept card's tunes leave no file behind, so retune(sys) also greps the verdict
+    // shortcut: a kept item's tunes leave no file behind, so retune(sys) also greps the verdict
     // subjects; upgrade when tunes get their own history line.
     retune: (system) =>
       tuned.some((c) => (c.data.system ?? []).includes(system)) ||
@@ -180,11 +257,11 @@ function untilStatus(trigger, fired) {
   return 'manual';
 }
 
-/** Until annotations across cards and systems docs. */
-function untilRecords(cards, systems, projectDir, ledger) {
-  const fired = verdictMatchers(projectDir, ledger, cards);
+/** Until annotations across work items and systems docs. */
+function untilRecords(items, systems, projectDir, ledger) {
+  const fired = verdictMatchers(projectDir, ledger, items);
   const docs = [
-    ...cards.map((c) => ({ rel: `cards/${c.name}`, body: c.body })),
+    ...items.map((c) => ({ rel: `work/${c.name}`, body: c.body })),
     ...systems.map((s) => ({ rel: `systems/${s.name}`, body: s.body })),
   ];
   const until = [];
@@ -206,19 +283,29 @@ function lintSystems(report, systems) {
   }
 }
 
-/** Alerts about cards in flight, which lead the line. @param {AuditReport} report */
-const cardAlerts = (report) => [
-  report.illegal_status.length && `${report.illegal_status.length} card(s) in illegal status`,
-  report.stale_built.length && `${report.stale_built.length} built card(s) stale — playtest first`,
+/** Alerts about items in flight, which lead the line. @param {AuditReport} report */
+const itemAlerts = (report) => [
+  report.legacy_cards.length &&
+    `${report.legacy_cards.length} schema 2 card(s) in gcf/cards/ — back to gcf/design/, then take`,
+  report.illegal_status.length && `${report.illegal_status.length} item(s) in illegal status`,
+  report.stale_waiting.length &&
+    `${report.stale_waiting.length} item(s) waiting on you too long — playtest or answer first`,
   report.tune_limit.length &&
-    `${report.tune_limit.length} card(s) at tune limit — kill or redesign`,
+    `${report.tune_limit.length} item(s) at tune limit — kill or redesign`,
   report.wip.over && `WIP over limit (${report.wip.count}/${report.wip.limit})`,
+  report.unplayed.over &&
+    `${report.unplayed.count} unplayed item(s) (warn after ` +
+      `${report.unplayed.warn_after}) — play them`,
 ];
 
 /** Alerts about the documents. @param {AuditReport} report */
 const docAlerts = (report) => [
   report.until.filter((u) => u.status === 'stale').length && 'stale until-records present',
   report.pillars?.over && 'PILLARS over token budget',
+  report.pillars?.too_many && `PILLARS has ${report.pillars.count} pillars (max ${PILLARS_MAX})`,
+  report.stale_questions.length &&
+    `${report.stale_questions.length} open question(s) unanswered for over ` +
+      `${report.stale_questions[0].limit} commits`,
   Object.keys(report.linter).length && 'П2 linter findings in systems docs',
   report.index_drift && 'INDEX drift (regenerate)',
   report.design?.blocking && `${report.design.blocking} blocking design finding(s)`,
@@ -226,7 +313,7 @@ const docAlerts = (report) => [
 
 /** @param {AuditReport} report */
 function firstLine(report) {
-  const alerts = [...cardAlerts(report), ...docAlerts(report)].filter(Boolean);
+  const alerts = [...itemAlerts(report), ...docAlerts(report)].filter(Boolean);
 
   return alerts.length ? alerts.join('; ') : 'clean';
 }

package/lib/bundle.js

@@ -147,14 +147,17 @@ async function currentParts(root) {
 
 /** A design file with the `## <id>` section replaced by `text`, or appended when absent. */
 function putUnit(fileText, id, text) {
-  const lines = fileText.split('\n');
+  // A file kept with CRLF stays CRLF: work in LF, write back in the file's own line ending.
+  const eol = fileText.match(/\r?\n/)?.[0] ?? '\n';
+  const lf = fileText.replace(/\r\n/g, '\n');
+  const lines = lf.split('\n');
   const at = lines.findIndex((l) => l.trimEnd() === `## ${id}`);
-  const section = [`## ${id}`, '', ...text.split('\n'), ''];
-  if (at < 0) return `${fileText.trimEnd()}\n\n${section.join('\n')}`;
+  const section = [`## ${id}`, '', ...text.replace(/\r\n/g, '\n').split('\n'), ''];
+  if (at < 0) return `${lf.trimEnd()}\n\n${section.join('\n')}`.replace(/\n/g, eol);
   let end = lines.findIndex((l, i) => i > at && /^## \S/.test(l));
   if (end < 0) end = lines.length;
 
-  return [...lines.slice(0, at), ...section, ...lines.slice(end)].join('\n');
+  return [...lines.slice(0, at), ...section, ...lines.slice(end)].join('\n').replace(/\n/g, eol);
 }
 
 /** A design file with its preamble purpose replaced; a title of the file's own stays. */