gcf-aif-ext 0.5.1 → 0.5.3

package/README.md

@@ -50,6 +50,20 @@ Updating preserves `gcf/`, `cnlp.config.json` and the pre-commit hook. Run `ai-f
 
 On Windows, run `extension add` and `extension update` from PowerShell or cmd, not Git Bash: the installer unpacks with `tar`, and Git Bash's GNU tar reads `C:\…` as a remote host (`Cannot connect to C: resolve failed`). The Windows `tar.exe` handles it.
 
+### 0.5.3
+
+- `gcf init` restamps an unplayed item frozen by 0.4.0 (the hash of its body alone), so its `live:` is guarded too — only while that `live:` is still the one its close committed. Commit the restamped items it names.
+- While a harness run drives an item (`.gcf-session/runs/<id>.lock` held by a live process), the core refuses any move on it, `/gcf-run` on main included, and `gcf integrate` leaves its branch unmerged; the audit and the board read it as `running`. A lock left by a run that died is taken over. `gcf board --json` reports WIP as `{count, limit, over}`.
+- The audit reads the `until:` of every D2 record in `open-questions.md`: a fired one is a stale until record, and the assumption goes back to the human.
+- `gcf design check` reads the text of an HTML comment in a unit or an item for forbidden words (M4) and numbers (M5); a `gcf:allow` pragma and a tool's marked region are skipped.
+- An unplayed tune or kill keeps a systems-doc line the doc held before the item's close.
+- `gcf playtest session` groups the checklist by subsystem and warns when the build is not of main: the remote's default branch when the clone knows it, else any branch but a detached HEAD or a `work/` one.
+
+### 0.5.2
+
+- Bundles `cnlp-kit` 3.9, so `gcf design check` and the commit gate accept a bullet written in Cyrillic alone.
+- With `cnlp-kit` 3.9 or later, the `AGENTS.md` block between `<!-- gcf:start -->` and `<!-- gcf:end -->` is a marked region that the project's guide profile does not shape: the `custom_sections` entries 0.5.1 asked for are no longer needed. Update the `cnlp-kit` your project runs `npx cnlp check` with.
+
 ### 0.5.1
 
 - A provenance record `assumed: q-NNN` must name a record still in `gcf/open-questions.md` (M9). A D2 record lives until its `until:` fires; once the human confirms the value, cite `answer: q-NNN` instead and remove it. After updating, run `ai-factory gcf design check`: every citation of a removed question blocks the commit gate until it is rewritten.

package/commands/gcf.js

@@ -166,6 +166,9 @@ function registerInit(gcf, program) {
       const block = await readFile(path.join(EXT_ROOT, 'templates', 'agents-block.md'), 'utf8');
       const agents = await (await lib('agents-block')).writeAgentsBlock(process.cwd(), block);
       if (agents.length) console.log(`agent instructions written: ${agents.join(', ')}`);
+      const restamped = await (await lib('work-ops')).restampFrozen(process.cwd());
+      if (restamped.length)
+        console.log(`frozen: restamped to guard live: too, commit them: ${restamped.join(', ')}`);
       console.log(
         'gcf/ ready. Write PILLARS.md through /gcf-init, then import a GDD with /gcf-ingest ' +
           'or start the design with /gcf-vision.',
@@ -253,17 +256,30 @@ function buildText(b) {
   return b.skipped ? 'no build step (dod.build: none)' : 'built with dod.build';
 }
 
-/** The session sheet: the build, then per item what to check and how to get there. */
-function sessionText(s) {
+/** The sheet's head: what was built, and why it may not be what main holds. */
+function sessionHead(s) {
   const build = buildText(s.build);
-  const lines = [
+
+  return [
     s.commit ? `build: ${s.branch} @ ${s.commit} — ${build}` : 'build: no commit to build yet',
-    // shortcut: the main branch is named main; read the remote default when a project differs.
-    ...(s.branch !== 'main' ? ['warning: not on main — the session plays main'] : []),
+    // Main by the remote's default when known, else any branch but detached or a worktree's.
+    ...(s.branch === 'HEAD' || s.branch?.startsWith('work/') || (s.main && s.branch !== s.main)
+      ? [`warning: ${s.branch} is not ${s.main ?? 'main'} — the session plays main`]
+      : []),
     ...(s.dirty ? ['warning: uncommitted changes — the build is not the commit'] : []),
   ];
+}
+
+/** The session sheet: the build, then per item what to check and how to get there. */
+function sessionText(s) {
+  const lines = sessionHead(s);
   if (!s.items.length) return [...lines, 'nothing waits for a playtest'].join('\n');
+  let group = null;
+  // Items come sorted by their first subsystem: one header each, so play goes system by system.
   for (const c of s.items) {
+    const system = c.system[0] ?? '(no subsystem)';
+    if (system !== group) lines.push('', `## ${system}`);
+    group = system;
     lines.push(
       '',
       `[ ] ${c.id} (${c.status}) [${c.system.join(',')}] ${c.title ?? c.intent ?? ''}`,
@@ -840,7 +856,7 @@ function registerBoard(gcf) {
           ...Object.entries(x.columns).map(
             ([s, ids]) => `${s}: ${ids.map((id) => tag(byId.get(id))).join(', ') || '-'}`,
           ),
-          `wip: ${x.wip.verdict}/${x.wip.limit}`,
+          `wip: ${x.wip.count}/${x.wip.limit}`,
           `inbox: ${x.inbox.length}, open questions: ${x.questions.length}`,
         ].join('\n'),
       );

package/extension.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://raw.githubusercontent.com/lee-to/ai-factory/2.x/schemas/extension.schema.json",
   "name": "gcf-aif-ext",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "description": "Game Context Framework for AI Factory",
   "skills": [
     "skills/gcf-init",

package/lib/audit-core.js

@@ -9,6 +9,7 @@ import { designCheck, recordsIn } from './design-check.js';
 import { buildLedger } from './ledger.js';
 import { STORED } from './transitions.js';
 import { openDepends } from './work-ops.js';
+import { runHolder } from './main-lock.js';
 
 function git(args, cwd) {
   // A blame of a long file overflows the 1 MiB default, and an overflow reads as a git failure.
@@ -32,7 +33,7 @@ const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
  * @property {string[]} legacy_cards
  * @property {{tokens: number, budget: number, over: boolean, count: number, too_many: boolean}
  *   | null} pillars
- * @property {Array<{file: string, trigger: string, status: string}>} until
+ * @property {Array<{file: string, id?: string, trigger: string, status: string}>} until
  * @property {Record<string, object[]>} linter
  * @property {object[]} pragmas
  * @property {boolean} index_drift
@@ -40,7 +41,8 @@ const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
  * @property {Array<{id: string, commits: number | null, limit: number}>} stale_questions
  * @property {number} [schema]
  * @property {Array<{id: string, type: string, gate: string, status: string, system: string[],
- *   depends: string[], parent: string | null, tune_count: number}>} [items]
+ *   depends: string[], parent: string | null, tune_count: number, parallel: string,
+ *   running: boolean}>} [items]
  * @property {{blocking: number, units: number, ready: number}} [design]
  */
 
@@ -70,7 +72,12 @@ export async function audit(projectDir) {
     },
     legacy_cards: legacyCards(root),
     pillars: await pillarsOf(root, config),
-    until: untilRecords(items, systems, projectDir, ledger),
+    until: untilRecords(
+      items,
+      systems,
+      verdictMatchers(projectDir, ledger, items),
+      await questionsText(root),
+    ),
     linter: {},
     pragmas: [],
     index_drift: await drifted(root),
@@ -89,6 +96,7 @@ export async function audit(projectDir) {
     parent: c.data.parent ?? null,
     tune_count: c.data.tune_count ?? 0,
     parallel: c.data.parallel ?? 'serial',
+    running: runHolder(projectDir, c.data.id) !== null,
   }));
   const design = await designCheck(projectDir);
   checkItems(report, items, config, { projectDir, ledger });
@@ -159,7 +167,7 @@ function staleEntry(c, config, projectDir) {
 }
 
 /** WIP counts what waits for the playtest; unplayed items have their own warning (§4). */
-function wipOf(items, config) {
+export function wipOf(items, config) {
   const count = items.filter((c) => c.data.status === 'awaiting-verdict').length;
 
   return { count, limit: config.wip_built_limit, over: count > config.wip_built_limit };
@@ -257,9 +265,20 @@ function untilStatus(trigger, fired) {
   return 'manual';
 }
 
-/** Until annotations across work items and systems docs. */
-function untilRecords(items, systems, projectDir, ledger) {
-  const fired = verdictMatchers(projectDir, ledger, items);
+/** open-questions.md, or '' without one. */
+const questionsText = async (root) => {
+  const file = path.join(root, 'open-questions.md');
+
+  return existsSync(file) ? readFile(file, 'utf8') : '';
+};
+
+const D2_UNTIL_RE = /^\s+until:\s*(verdict\([a-z0-9-]+\)|retune\([a-z0-9-]+\)|manual\([^)]*\))/m;
+
+/**
+ * Until annotations across work items and systems docs, and the `until:` of each D2 record in
+ * open-questions.md (`questions` its text): a fired one is an assumption to ask the human again.
+ */
+function untilRecords(items, systems, fired, questions) {
   const docs = [
     ...items.map((c) => ({ rel: `work/${c.name}`, body: c.body })),
     ...systems.map((s) => ({ rel: `systems/${s.name}`, body: s.body })),
@@ -271,6 +290,18 @@ function untilRecords(items, systems, projectDir, ledger) {
     }
   }
 
+  for (const rec of questions.replace(/\r\n/g, '\n').split(/\n(?=- id:)/)) {
+    const id = rec.match(/^- id:\s*(\S+)/)?.[1];
+    const trigger = rec.match(D2_UNTIL_RE)?.[1];
+    if (!id || !trigger || !/^\s+class:\s*D2\b/m.test(rec)) continue;
+    until.push({
+      file: 'gcf/open-questions.md',
+      id,
+      trigger,
+      status: untilStatus(trigger, fired),
+    });
+  }
+
   return until;
 }
 

package/lib/board.js

@@ -10,6 +10,8 @@ import { listInbox } from './inbox.js';
 import { phaseStatus } from './phase.js';
 import { verifiedBranches, worktreeOf } from './integrate.js';
 import { resolveInside } from './safe-path.js';
+import { wipOf } from './audit-core.js';
+import { runHolder } from './main-lock.js';
 
 const COLUMNS = ['ready', 'blocked', 'awaiting-verdict', 'awaiting-decision', 'unplayed', 'parked'];
 
@@ -86,8 +88,11 @@ export async function board(projectDir) {
       system: c.data.system ?? [],
       ...(c.data.severity ? { severity: c.data.severity } : {}),
       ...(c.data.blocked ? { blocked: c.data.blocked } : {}),
-      // `running` and `verify` are not stored (§4): a worktree is a run, a trailer a passed DoD.
-      running: existsSync(worktreeOf(projectDir, id)) && !ready,
+      // `running` and `verify` are not stored (§4): a live harness run, or a worktree of a ready
+      // item, is a run; a trailer is a passed DoD.
+      running:
+        runHolder(projectDir, id) !== null ||
+        (c.data.status === 'ready' && !ready && existsSync(worktreeOf(projectDir, id))),
       verified: ready,
       plan: await progress(projectDir, c),
     });
@@ -103,10 +108,7 @@ export async function board(projectDir) {
       COLUMNS.map((s) => [s, items.filter((i) => i.status === s).map((i) => i.id)]),
     ),
     items,
-    wip: {
-      verdict: items.filter((i) => i.status === 'awaiting-verdict').length,
-      limit: config.wip_built_limit,
-    },
+    wip: wipOf(ledger.items, config),
     inbox: await listInbox(root),
     questions: await questions(root),
   };

package/lib/design-check.js

@@ -270,6 +270,23 @@ async function bodyProblems(body, type, stage = 'card') {
   return { profile, issues };
 }
 
+/**
+ * Text an HTML comment holds in a body: cnlp-kit gives it no block, but an agent reads the raw
+ * file, so M4 and M5 read it too.
+ */
+function commentValues(body) {
+  const { lines, prose, regions } = parseBlocks(body);
+  // A tool's region and its markers belong to the tool; a pragma is an instruction, not prose.
+  const owned = (n) => regions.some((r) => n >= r.line && n <= r.end);
+  const markup = /^\s*<!--\s*(?:gcf:allow\b|[\w-]+:(?:start|end)\s*-->)/;
+
+  return prose.flatMap((l, i) =>
+    l.trim() && !lines[i].trim() && !owned(i + 1) && !markup.test(l)
+      ? [{ block: 'comment', value: l.trim(), line: i + 1 }]
+      : [],
+  );
+}
+
 /** M4 and M5 over the values of a unit. */
 function valueIssues(values, ctx) {
   const out = [];
@@ -372,7 +389,8 @@ async function checkUnit(u, ctx, ledger) {
   const { profile, issues: shape } = await bodyProblems(u.body, u.header.type, 'design');
   for (const i of shape) add('M1', atBody(i.line), i.message);
   const values = slotValues(u.body, profile);
-  for (const [c, line, m] of valueIssues(values, ctx)) add(c, atBody(line), m);
+  for (const [c, line, m] of valueIssues([...values, ...commentValues(u.body)], ctx))
+    add(c, atBody(line), m);
   for (const [c, line, m, sev] of provenanceIssues(u, values, ctx)) add(c, atBody(line), m, sev);
 
   return { issues, values };
@@ -462,7 +480,8 @@ async function checkItem(item, ctx, ledger) {
   // An unplayed body is frozen (§5.4): a later glossary word or unit, or a gone question, cannot
   // be fixed there, only reported until a tune or a kill takes the item back.
   const frozen = item.data.status === 'unplayed' ? 'report' : 'block';
-  for (const [c, line, m] of valueIssues(values, ctx)) add(c, line, m, frozen);
+  for (const [c, line, m] of valueIssues([...values, ...commentValues(item.body)], ctx))
+    add(c, line, m, frozen);
   for (const r of provenanceOf(item.body)) {
     const problem = recordProblem(r, ctx);
     // An item's quotes go stale when the GDD moves on: that is a D1 for the human, not a gate.

package/lib/integrate.js

@@ -8,7 +8,7 @@ import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { buildLedger } from './ledger.js';
 import { parse } from './frontmatter.js';
-import { withMainLock } from './main-lock.js';
+import { withMainLock, runHolder } from './main-lock.js';
 import { verifyItem, deltaProblems } from './verify.js';
 import { submitItem, closeItem, blockItem } from './work-ops.js';
 import { isValidId } from './id.js';
@@ -242,6 +242,9 @@ async function integrateMerged(projectDir, id, item) {
 }
 
 async function integrateOne(projectDir, id) {
+  // Its run records the move itself once it ends: merging now would land code with no move.
+  const run = runHolder(projectDir, id);
+  if (run) return { id, skipped: `${id} is driven by a harness run (pid ${run})` };
   const item = (await buildLedger(projectDir)).item(id);
   const ancestor = ['merge-base', '--is-ancestor', branchOf(id), 'HEAD'];
   if (git(projectDir, ancestor, { check: false }).ok) return integrateMerged(projectDir, id, item);

package/lib/main-lock.js

@@ -3,7 +3,8 @@
 // each other instead of committing over each other. Re-entrant along one call chain: `integrate`
 // holds it across the merge and the move it records.
 import { AsyncLocalStorage } from 'node:async_hooks';
-import { link, mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises';
+import { link, mkdir, readFile, stat, unlink, writeFile } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
 import { randomUUID } from 'node:crypto';
 import path from 'node:path';
 
@@ -24,6 +25,21 @@ const alive = (pid) => {
   }
 };
 
+/**
+ * The pid of a live harness run that drives item `id` (`.gcf-session/runs/<id>.lock`), or null.
+ * A move on that item from anywhere else would race the run's own record of it.
+ */
+export function runHolder(projectDir, id) {
+  try {
+    const file = path.join(path.resolve(projectDir), '.gcf-session', 'runs', `${id}.lock`);
+    const pid = Number(readFileSync(file, 'utf8').split('\n')[0]);
+
+    return Number.isInteger(pid) && pid > 0 && pid !== process.pid && alive(pid) ? pid : null;
+  } catch {
+    return null;
+  }
+}
+
 /** The lock's text when its holder is gone, else null. The file appears whole: see `take`. */
 async function staleText(file) {
   try {
@@ -59,20 +75,34 @@ async function take(file, token) {
 }
 
 /**
- * Move a dead holder's lock aside. shortcut: two takers that judged the same dead lock may race
- * here — the rename lets one of them win, a fresh lock renamed by the loser is put back.
+ * Remove a dead holder's lock. Only the taker holding `<lock>.break` may: two takers that judged
+ * the same dead lock cannot both clear it, and the second finds the winner's live lock in place.
+ * Nothing else replaces the lock meanwhile — `take` fails on an existing file.
  */
 async function clearStale(file, text) {
-  const aside = `${file}.stale-${randomUUID()}`;
-  try {
-    await rename(file, aside);
-  } catch {
+  const breaker = `${file}.break`;
+  const token = randomUUID();
+  if (!(await take(breaker, token))) {
+    // A breaker is held for a read and an unlink; an old one belongs to a taker that died there.
+    const old = await stat(breaker).then(
+      (s) => Date.now() - s.mtimeMs > 10000,
+      () => false,
+    );
+    if (old) await unlink(breaker).catch(() => {});
+    await sleep(100);
+
     return;
   }
 
-  if ((await readFile(aside, 'utf8').catch(() => text)) !== text)
-    await link(aside, file).catch(() => {});
-  await unlink(aside).catch(() => {});
+  try {
+    if ((await readFile(file, 'utf8').catch(() => null)) === text) await unlink(file);
+  } catch {
+    // released meanwhile
+  } finally {
+    // A breaker taken over as old meanwhile belongs to its new holder.
+    if ((await readFile(breaker, 'utf8').catch(() => '')).includes(token))
+      await unlink(breaker).catch(() => {});
+  }
 }
 
 /**

package/lib/playtest-list.js

@@ -64,6 +64,12 @@ export async function playtestSession(
   const dirty = git(projectDir, ['status', '--porcelain', '--', '.', ':(exclude)gcf/.metrics']);
   const session = {
     branch: git(projectDir, ['rev-parse', '--abbrev-ref', 'HEAD']),
+    // The remote's default branch when the clone knows it: main by any name. Null otherwise.
+    main:
+      git(projectDir, ['symbolic-ref', '--short', 'refs/remotes/origin/HEAD'])?.replace(
+        /^origin\//,
+        '',
+      ) ?? null,
     commit: git(projectDir, ['rev-parse', '--short', 'HEAD']),
     // No commit (no repository, or none yet): the build is unknown, not clean.
     dirty: dirty === null ? null : Boolean(dirty),

package/lib/systems-doc.js

@@ -9,11 +9,15 @@ import { scalarIn } from './design.js';
 
 const NONE_LINE = '- none: no item of this subsystem has collapsed yet';
 
+/**
+ * The raw lines of a `key:` block. `prose`, not `lines`: cnlp-kit 3.9 blanks HTML comments in
+ * `lines`, and upsertBlock rewrites the block from these — a `gcf:allow` pragma must survive.
+ */
 export function blockLines(body, key) {
-  const { lines, sections } = parseBlocks(body);
+  const { prose, sections } = parseBlocks(body);
   const at = sections.find((s) => s.key === key);
 
-  return at ? itemsOf(lines, at.line).map((i) => i.text) : [];
+  return at ? itemsOf(prose, at.line).map((i) => i.text) : [];
 }
 
 /**

package/lib/verdict-fs.js

@@ -3,6 +3,7 @@
 // work-ops.js; these are the deterministic pieces they share.
 import { readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import path from 'node:path';
 import { parseBlocks, itemsOf, readRecords } from 'cnlp-kit';
 import { serialize } from './frontmatter.js';
@@ -82,22 +83,60 @@ export async function mergeIntoSystem(root, system, item) {
   await atomicWrite(doc.file, serialize({ ...doc.data, updated_by: item.data.id }, body));
 }
 
+/**
+ * The lines a systems doc held before the item's unplayed close: the merge skipped them, so they
+ * are some earlier item's or unit's, not this one's. None when that commit is not found.
+ */
+function linesBeforeClose(root, system, id) {
+  const cwd = path.dirname(root);
+  const close = unplayedCloseCommit(cwd, id);
+  if (!close) return [];
+  const text = fileAt(cwd, `${close}^`, path.join(root, 'systems', `${system}.md`));
+
+  return text === null ? [] : text.replace(/\r\n/g, '\n').split('\n');
+}
+
+/** The last commit that closed item `id` unplayed, or null. */
+export function unplayedCloseCommit(projectDir, id) {
+  const log = spawnSync(
+    'git',
+    ['log', '-1', '--format=%H', '--fixed-strings', `--grep=gcf(close): ${id} → unplayed`],
+    { cwd: projectDir, encoding: 'utf8' },
+  );
+
+  return (log.status === 0 && log.stdout.trim()) || null;
+}
+
+/** A file's text at a revision, or null when the revision does not hold it. */
+export function fileAt(projectDir, rev, file) {
+  const rel = path.relative(projectDir, file).replace(/\\/g, '/');
+  const show = spawnSync('git', ['show', `${rev}:${rel}`], {
+    cwd: projectDir,
+    encoding: 'utf8',
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  if (show.error) throw show.error;
+
+  return show.status === 0 ? show.stdout : null;
+}
+
 /**
  * Take an unplayed item's lines back out of a systems doc (tune, kill or drop of an unplayed
- * item). `keep` are lines other unplayed items still owe the doc. shortcut: a line shared word
- * for word with an already kept item leaves too — that body is gone; upgrade to per-line origin
- * marks if that ever bites.
+ * item). `keep` are lines other unplayed items still owe the doc; a line the doc held before the
+ * close stays too. shortcut: a line an item kept after this close brought word for word was
+ * skipped by its merge and leaves here; upgrade to per-line origin marks if that ever bites.
  */
 export async function unmergeFromSystem(root, system, item, keep = []) {
   const file = path.join(root, 'systems', `${system}.md`);
   if (!existsSync(file)) return;
   const doc = await openSystemDoc(root, system);
+  const before = linesBeforeClose(root, system, item.data.id);
   let body = doc.body;
   for (const [section, lines] of Object.entries(collapseLines(item.body))) {
     body = removeLines(
       body,
       section,
-      lines.filter((l) => !keep.includes(l)),
+      lines.filter((l) => !keep.includes(l) && !before.includes(l)),
     );
   }
 

package/lib/work-ops.js

@@ -8,7 +8,7 @@ import { existsSync } from 'node:fs';
 import { spawnSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
 import path from 'node:path';
-import { serialize } from './frontmatter.js';
+import { parse, serialize } from './frontmatter.js';
 import { buildLedger } from './ledger.js';
 import { readConfig } from './gcf-paths.js';
 import { atomicWrite, withFileRollback } from './safe-path.js';
@@ -25,6 +25,8 @@ import {
   systemFiles,
   buryLine,
   recordLine,
+  unplayedCloseCommit,
+  fileAt,
 } from './verdict-fs.js';
 import {
   readLiveStrict,
@@ -36,6 +38,7 @@ import {
 } from './live.js';
 import { dropInbox } from './inbox.js';
 import { refuseByPhase } from './phase.js';
+import { runHolder } from './main-lock.js';
 
 /**
  * Options of a committed move; each move reads the ones it needs.
@@ -108,15 +111,44 @@ export const frozenHash = (item) =>
     .update(`\nlive: ${JSON.stringify(item.data.live ?? null)}`)
     .digest('hex');
 
+/** The 0.4.0 `frozen:`: the sha1 of the body alone, without the `live:` delta. */
+const legacyFrozen = (item) =>
+  createHash('sha1').update(String(item.body).replace(/\r\n/g, '\n').trim()).digest('hex');
+
 /**
- * Whether an unplayed item still matches its `frozen:`. An item closed by 0.4.0 holds the sha1
- * of its body alone: it still guards the body. shortcut: such an item's live: stays unguarded
- * until it is closed again; drop the legacy form once no 0.4.0 unplayed item is left.
+ * Whether an unplayed item still matches its `frozen:`. An item closed by 0.4.0 holds the
+ * legacy form, which guards the body only, until `gcf init` restamps it (restampFrozen).
  */
 export const matchesFrozen = (item) =>
-  item.data.frozen === frozenHash(item) ||
-  item.data.frozen ===
-    createHash('sha1').update(String(item.body).replace(/\r\n/g, '\n').trim()).digest('hex');
+  item.data.frozen === frozenHash(item) || item.data.frozen === legacyFrozen(item);
+
+/** Whether the item's `live:` is the one its unplayed close committed. */
+function liveAsClosed(projectDir, item) {
+  const close = unplayedCloseCommit(projectDir, item.data.id);
+  const text = close && fileAt(projectDir, close, item.file);
+  if (!text) return false;
+  const live = (data) => JSON.stringify(data.live ?? null);
+
+  return live(parse(text).data) === live(item.data);
+}
+
+/**
+ * Give every unplayed item still frozen in the 0.4.0 form the full hash, so its `live:` is
+ * guarded too — only while that `live:` is still the one its close committed: a later edit is
+ * the drift the guard exists for, and must not be stamped in. Returns the ids.
+ */
+export async function restampFrozen(projectDir) {
+  const ledger = await buildLedger(projectDir);
+  const legacy = ledger.items.filter(
+    (i) =>
+      i.data.status === 'unplayed' &&
+      i.data.frozen === legacyFrozen(i) &&
+      liveAsClosed(projectDir, i),
+  );
+  for (const i of legacy) await writeItem(i, { ...i.data, frozen: frozenHash(i) });
+
+  return legacy.map((i) => String(i.data.id));
+}
 
 /** Children of a feature that are not finished: live in any status but unplayed and parked. */
 function unfinishedChildren(ledger, feature) {
@@ -136,6 +168,12 @@ async function begin(projectDir, id, move) {
   const ledger = await buildLedger(projectDir);
   const item = itemOf(ledger, id);
   need(move, item);
+  const run = runHolder(projectDir, id);
+  if (run)
+    throw new Error(
+      `${id} is driven by a harness run (pid ${run}): wait until that run ends; if no harness ` +
+        `run is going, delete .gcf-session/runs/${id}.lock`,
+    );
   const files = [item.file];
   const steps = [];
   const liveOps = [];