# Problem Backlog — Line 3 History Archive of displaced `docs/problems/README.md` line 3 "Last reviewed" fragments per P134 (the line 3 accumulator-doc carve-out). Newest fragments append at the bottom under date headings; earlier fragments stay above for grep+tail browsing. ## 2026-05-14 - README reconciled — 4 drift entries corrected: P004, P005, P006, P007. Reconciliation contract per P118 + ADR-014 amended ("Reconciliation as preflight robustness layer"). - P001 closed (verified end-to-end via `auto-update.yml` run 25805539989); P004/P005/P007 auto-transitioned Open → Known Error; P008 captured (auto-update workflow push fails with duplicate `Authorization` header). - P008 known error — duplicate `Authorization` from `actions/checkout@v4`'s `persist-credentials: true` default conflicting with the manual App-token `-c http.extraheader=...` on push. Architect + JTBD reviews PASS; fix is single-line workflow change. - P008 verification pending — `persist-credentials: false` added to `actions/checkout@v4` in `.github/workflows/auto-update.yml`; awaiting `gh workflow run auto-update.yml` dispatch to confirm `Push branch` succeeds and a PR opens under the App identity (ADR-0009 §Confirmation criterion 4). ## 2026-05-15 - P008 flipped Verification Pending → Known Error. v2.7.2's candidate-1 fix (persist-credentials: false) cleared the duplicate-header surface symptom but exposed the previously-masked bearer-vs-basic auth-scheme bug for git transport (workflow run 25905430469 failed with "fatal: could not read Username"). Layer-2 fix in flight: switch Push branch to URL-embedded `x-access-token` basic auth (P008 candidate 3). - P008 verification pending again (layer-2 fix). Push branch step swapped from `git -c http.extraheader=bearer` to URL-embedded `x-access-token` basic auth (P008 candidate 3) — the GitHub-documented auth scheme for App installation tokens over git transport. v2.7.2's `persist-credentials: false` stays on the Checkout step. Awaiting one more `gh workflow run auto-update.yml` dispatch to confirm Push branch succeeds end-to-end. ## 2026-05-16 - P008 **closed**. Verified end-to-end via workflow run 25953546547: Push branch succeeded, PR #8 opened by `app/claude`, auto-merge enabled, `Build & Test` passed, PR auto-merged to main (commit `d8d80b9`). ADR-0009 §Confirmation criterion 4 satisfied. Autonomous loop is now load-bearing — daily cron can be armed in a follow-up. - P002 **closed** (release-trigger heuristic verified by v2.7.3 drain's "Commits include release-triggering types" line). Verification Queue is empty. Dev-work queue top: P004 (WSJF 16.0). Autonomous-loop verification complete (P008 closed earlier this session); daily cron can be armed in a follow-up. - P009 captured (Edit-tool markdown writes skip prettier; pre-commit format:check fails — observed ≥5 times in this retro's parent session). Captured at deferred Priority/Effort placeholders; re-rate at next `/wr-itil:review-problems`. Dev-work queue top: P004 (WSJF 16.0). Verification Queue empty. - P004 parked (`upstream-blocked` on windyroad/agent-plugins#123, filed 2026-05-13). Local work complete: upstream issue filed + ADR-0015 narrow exception keeps the project unblocked. Un-park trigger: upstream issue closes. Dev-work queue top now P007 (WSJF 10.0). Verification Queue empty. Parked: 1 (P004). - P007 parked (`upstream-blocked` on `@windyroad/risk-scorer`). Both fix paths land upstream: Option 2 (grant Bash to `wr-risk-scorer:external-comms` subagent for `shasum`) recommended as the smaller change; Option 1 (hook recomputes key from draft + surface) preserved as the cleaner follow-up refactor. Un-park trigger: upstream ships either path. Dev-work queue top now P005 (WSJF 4.0). Verification Queue empty. Parked: 2 (P004, P007). - P005 parked (`upstream-blocked` on `@windyroad/voice-tone`). Upstream issue [windyroad/agent-plugins#124](https://github.com/windyroad/agent-plugins/issues/124) already filed 2026-05-13; this project's `docs/VOICE-AND-TONE.md` was bootstrapped in commit 47143c4 so the gate works locally — the upstream improvement (self-bootstrap or fail-open-with-prompt) benefits other adopter projects. Un-park trigger: upstream issue #124 closes. Dev-work queue top now P006 (WSJF 3.0). Verification Queue empty. Parked: 3 (P004, P005, P007). ## 2026-05-17 - P009 fix released. ADR-0013 (`pre-commit hook read-only policy`) superseded by **ADR-0016** (`pre-commit hook auto-write and re-stage policy`). The `.husky/pre-commit` hook now formats staged files via `prettier --write --ignore-unknown` and re-stages via `git add` BEFORE the commit completes, so the formatted output lands IN the commit and the working tree stays clean post-commit. The existing read-only contract test was rewritten to `REQ-PRECOMMIT-AUTO-WRITE-RESTAGE` under ADR-0016. P009 → Verification Pending; close trigger: ≥ 3 consecutive markdown-touching commits land cleanly without manual `npm run format` retry. Dev-work queue top: P006 (WSJF 3.0). Verification Queue: 1 (P009). Parked: 3 (P004, P005, P007). - P010 captured (manage-problem SKILL.md commit-message convention `docs(problems): P — ...` fails `@commitlint/config-conventional` subject-case rule; working shape is ` P` confirmed 3x in this session's AFK loop). Reported upstream as [windyroad/agent-plugins#137](https://github.com/windyroad/agent-plugins/issues/137). Captured at deferred Priority/Effort placeholders. - P006 reported upstream as [windyroad/agent-plugins#138](https://github.com/windyroad/agent-plugins/issues/138) (assistant defers actionable items to "next session" when user is observably present — behavioural-pattern fix; three candidate structural fix shapes left for upstream maintainer judgement). - v2.8.0 published to npm. semantic-release triggered by `feat: implement ADR-0016 — pre-commit auto-write+restage hook (P009 fix)` commit; minor bump from v2.7.3. Pipeline run [25990912860](https://github.com/voder-ai/dry-aged-deps/actions/runs/25990912860). ## 2026-05-18 - P012 upstream report filed as `windyroad/agent-plugins#139` (Step 5 problem-shaped, no dedup matches). P011 upstream report filed as comment on `windyroad/agent-plugins#126` (Step 5c dedup match — uncertain verdict on same deferred-README seam, different layer; user direction: comment with hook-layer evidence). Earlier (2026-05-17): retro captured P012 (`@windyroad/itil`'s `migrate-problems-layout.sh` helper uses bashisms but `/wr-itil:work-problems` Step 0a SKILL.md doesn't specify bash — sourcing fails under zsh; recovered via `bash -c` wrap). Step 0a auto-migrated 11 tickets from flat to per-state subdir layout (commit `f44c661`). P011 captured + P010 + P006 upstream reports filed (`windyroad/agent-plugins#137` + `#138`); v2.8.0 released. Dev-work queue top: P006 (WSJF 3.0). Verification Queue: 1 (P009). Parked: 3 (P004, P005, P007). ## 2026-05-13 - P003 transitioned Known Error → Verification Pending (fix landed: `.husky/pre-commit` now runs `format:check` per ADR-0013; awaiting user verification of clean post-commit working tree). - P003 closed on agent-evidence (read-only `format:check` hook held clean across iter 2's commit cycle AND the v2.7.1 drain push; ADR-022 agent-evidence closure sanctioned by user via /wr-itil:work-problems Step 2.5 routing). Dev-work queue empty; 2 tickets (P001, P002) remain in Verification Queue. ## 2026-05-30 - Re-rated 7 open + 1 verifying ticket per RISK-POLICY.md. Auto-transitioned P010 + P011 + P012 + P015 Open → Known Error (root cause + workaround documented per Step 2 transition rule). Deferred-score tickets P013 + P014 + P015 now scored: P013/P014 = 9 (Medium) Effort L; P015 = 4 (Low) Effort S. P012 priority drop 3 → 2 (Very Low) reflects local migration already complete — value-remaining is upstream-shipping for other adopters. Dev-work queue top: P015 (WSJF 8.0, Known Error, S). Verification Queue: 1 (P009 — `Likely verified?` `no — not observed`). Parked: 3 (P004, P005, P007). - P015 fix released → Verification Pending (`npm test` + `npm run test:cli` now wrapped with a 300s wall-clock bound via `scripts/run-with-timeout.mjs`; hung runners exit 124 instead of running unbounded). Dev-work queue top: P010 (WSJF 6.0, Known Error, M). Verification Queue: 2 (P009, P015 — both `no — not observed`). Parked: 3 (P004, P005, P007). - P009 closed (verified across 4 markdown-touching commits this session — `527c026` / `1d8b306` / `50a2eda` / `2d737f3` — pre-commit auto-write+restage held under every shape of markdown edit; ADR-0016 fix contract confirmed). Dev-work queue top: P010 (WSJF 6.0, Known Error, M). Verification Queue: 1 (P015 — `no — not observed`). Parked: 3 (P004, P005, P007). - run-retro Step 4b captured P016 / P017 / P018 / P019 with Fix Strategy sections (push:watch verify-on-fetch-failure, work-problems Step 0 reconcile-readme unscored-ticket route, pre-commit diff-filter R gap, work-problems Step 5 duration_ms in P089 Gap 2). All four placeholder WSJF 1.5 / Effort M (deferred) — re-rate at next /wr-itil:review-problems. Dev-work queue top: P010 (WSJF 6.0, Known Error, M). Verification Queue: 1 (P015 — `no — not observed`). Parked: 3 (P004, P005, P007). - Re-rated P016 / P017 / P018 / P019 from placeholder WSJF 1.5 to scored. P016 (push:watch network-flake fallback) and P018 (pre-commit diff-filter R gap) now WSJF 6.0 Effort S — both local fixes. P017 (Step 0 reconcile unscored-ticket route) WSJF 3.0; P019 (Step 5 duration_ms) WSJF 2.0 — both upstream-blocked at `@windyroad/itil`. Dev-work queue top non-upstream-blocked: P016 (WSJF 6.0, Open, S). Verification Queue: 1 (P015 — `no — not observed`). Parked: 3 (P004, P005, P007). - P016 fix released → Verification Pending (`scripts/push-watch.sh` step 5 now verifies CI status via `gh run view --json status,conclusion` with bounded retry on watch failure; 3 / 3 structural-contract tests passing). Dev-work queue top non-upstream-blocked: P018 (WSJF 6.0, Open, S — pre-commit diff-filter R gap). Verification Queue: 2 (P015, P016 — both `no — not observed`). Parked: 3 (P004, P005, P007). - P018 Open → Known Error (`.husky/pre-commit` `--diff-filter=ACM` excludes R; fix is ACMR widening; reproduction test added to `test/husky-pre-commit.test.js`). Dev-work queue top non-upstream-blocked: P018 (WSJF 6.0, Known Error, S — same ticket, lifecycle progressed; effort drops it ahead of P010/P011). Verification Queue: 2 (P015, P016 — both `no — not observed`). Parked: 3 (P004, P005, P007). - P015 + P018 closed (in-session evidence: P015 wallclock timeout wrapper exercised via `scripts/run-with-timeout.mjs 300 -- vitest run test/cli.e2e.real-fixture.test.js` in prepush — completed within budget; P018 `--diff-filter=ACMR` auto-write contract exercised via commit `a34aebe` staging 55 git mv renames — format:check passed post-commit). Dev-work queue top non-upstream-blocked: P012 (WSJF 4.0, Known Error, S — zsh migrate-problems-layout bashism). Verification Queue: 1 (P016 — `no — not observed`, failure-path not exercised this session). Parked: 3 (P004, P005, P007). ## 2026-06-02 - README reconciled — 3 drift entries corrected: P020, P021, P022 (committed cross-session MISSING — captured by prior /wr-itil:run-retro Step 4b but never staged into WSJF Rankings). Reconciliation contract per P118 + ADR-014 amended ("Reconciliation as preflight robustness layer"). ## 2026-06-03 - 2026-06-02 **P021 known error** — `calculateAgeInDays(publishDate, now = Date.now())` extension landed (commit `dc64c44`); overrides-hygiene swap-back complete; RFC-001 T3 inline-arithmetic divergence removed. Awaiting next release for Known Error → Verification Pending. - 2026-06-03 **README reconciled** — 2 drift entries corrected: P023, P024 (committed cross-session MISSING — captured by prior session via `/wr-itil:capture-problem` deferred-README contract but never folded into WSJF Rankings). Reconciliation contract per P118 + ADR-014 amended ("Reconciliation as preflight robustness layer"). - 2026-06-03 **Review pass** — closed P011 + P012 as no longer relevant (upstream fixes empirically verified this session; comments posted to windyroad/agent-plugins#126 + #139). Re-rated P022/P023/P024/P025 with this session's evidence. New top of queue: P010 / P022 / P025 tied at WSJF 6.0. P025 (GitHub Actions Node 20 deprecation 2026-06-16, 13 days out) is the highest-urgency new entry. - 2026-06-03 **P025 known error** — actions/checkout + setup-node v4→v6 migrated across 8 refs in 3 workflow files (commit 411fa71, 13 days before 2026-06-16 cutover); awaiting release (next push) for K→V transition per ADR-022. ## 2026-06-04 - 2026-06-03 **Review pass + K→V batch backlog (displaced from line 3 by 2026-06-04 K→V iter)** — P016 closed (push:watch network-flake fix verified across recent releases incl. today's RFC-002 ship); 6 Open → Known Error auto-transitions (P013, P014, P017, P019, P023, P024 — root cause + workaround documented). WSJF top of queue: P021 / P022 / P010 / P017 / P023 / P025 tied at 6.0. Verification Queue empty; P013 / P014 / P021 / P025 fixes shipped but await `/wr-itil:transition-problems` for K→V flip. - 2026-06-04 **P021 K→V (displaced from line 3 by P025 K→V iter)** — `calculateAgeInDays(publishDate, now = Date.now())` clock-injectable extension shipped in commit `dc64c44` and reached users via the RFC-001 / RFC-002 ship-trains; WSJF top of queue: P022 / P010 / P017 / P023 / P025 tied at 6.0 (P021 dropped out per ADR-022 verifying-multiplier-0). Verification Queue: 1 (P021 — `no — not observed`); P013 / P014 / P025 fixes shipped but still await K→V flip. - 2026-06-04 **P025 K→V (displaced from line 3 by P014 K→V iter)** — actions/checkout + setup-node v4→v6 migration released in `411fa71` 13 days before 2026-06-16 cutover; ci-publish empirically green across 8+ post-fix runs under v6; auto-update + claude workflows await natural trigger. WSJF top of queue: P022 / P010 / P017 / P023 tied at 6.0 (P025 dropped out per ADR-022 verifying-multiplier-0). Verification Queue: 2 (P021 — `no — not observed`; P025 — `yes — observed: ci-publish surface only`); P013 / P014 fixes shipped but still await K→V flip. - 2026-06-04 **P014 K→V (displaced from line 3 by this review pass)** — `--exposure-aware-soak` flag implementing the locked Critical→0 / High→½ / Moderate-Low-None→default policy shipped in dry-aged-deps@2.12.0 via the RFC-002 ship-train. WSJF top of queue at that point: P022 / P010 / P017 / P023 tied at 6.0 (P014 dropped out per ADR-022 verifying-multiplier-0). Verification Queue: 3 (P021 — `no — not observed`; P025 — `yes — observed: ci-publish surface only`; P014 — `no — not observed`); P013 fix shipped but still awaits K→V flip. - 2026-06-04 **Review pass: P006 auto-transitioned Open → Known Error (displaced from line 3 by P006 K→V iter)** — 2026-06-04 Decision documented: Option 3 "Default to action" + Step 2.4/2.5/2.5b loop-end surfacing. P022 downrated WSJF 6.0 → 4.0 after iter-3 investigation falsified the "commit-gate unstages files" leading hypothesis (re-framed as partial-staging misperception / inter-tool working-tree mutation). Verification Queue drained: P021 closed (structural swap, no observed regression confirmed) + P025 closed (partial evidence — ci-publish 8+ runs green under v6 accepted as sufficient before 2026-06-16 cutover). WSJF top of queue: P006 / P010 / P017 / P023 tied at 6.0 (all KE, M, tier-2 internal/external — tier-order by Reported asc). Verification Queue: 1 (P014 — `no — not observed`, released today). ## 2026-06-17 - 2026-06-04 **P006 K→V (displaced from line 3 by README reconciliation)** — closing condition met via upstream `@windyroad/itil@0.47.9` Step 2.4/2.5/2.5b structural framing (P341 / P135 Phase 3 + P348); "Outstanding for next session" wording absent upstream; THIS iter's action-first orchestration IS the empirical evidence. WSJF top of queue: P010 / P017 / P023 tied at 6.0 (P006 dropped out per ADR-022 verifying-multiplier-0). Verification Queue: 2 (P006 — `yes — observed: this iter's action-first orchestration`; P014 — `no — not observed`). - 2026-06-17 **README reconciled (displaced from line 3 by P028 capture)** — 2 drift entries corrected: P026, P027 (deferred-placeholder Open tickets absent from WSJF Rankings; derived WSJF P027=3.0, P026=1.5 from stored Priority/Effort). Reconciliation contract per P118 + ADR-014 amended ("Reconciliation as preflight robustness layer"). ## 2026-06-18 - 2026-06-17 **P028 captured (displaced from line 3 by P028/P029 split)** — dry-aged-deps --update should flag and skip impossible updates (incompatible peers / deprecated deps) instead of attempting them (lightweight aside via /wr-itil:capture-problem). - 2026-06-18 **P028 split into P028 + P029 (displaced from line 3 by P029 loud-surfacing refinement)** — separated the two "should we attempt this update?" signals per user direction: P028 = flag/skip un-landable updates (incompatible peer deps / ERESOLVE); P029 = detect deprecated dependencies + surface recommended replacement (npm `deprecated` field). ## 2026-07-08 - 2026-06-18 **P029 scoped to loud-surfacing only** — per user direction, dry-aged-deps must NOT heuristically extract a replacement from the deprecation message; detect deprecation, surface the verbatim npm message loudly, and leave the decision to the human/LLM (no auto-remediation). Prior fragment rotated to README-history.md. ## 2026-07-11 > Last reviewed: 2026-07-11 **P010 parked** — upstream-blocked on windyroad/agent-plugins#137 (still OPEN, unfixed at SKILL v0.57.2); no local fix in scope. > Last reviewed: 2026-07-11 **P031 verification pending** — `recommended` JSON/XML field now reports the safe target (`latest`) not `wanted`; one-line producer fix in `src/output-utils.js` corrects both surfaces, RED→GREEN test added, ships via semantic-release patch. > Last reviewed: 2026-07-11 **P013 verification pending** — both gaps released: overrides-hygiene surface (`src/overrides-hygiene.js`, RFC-001) + fixAvailable-aware four-class unfixable-reason taxonomy (`src/find-unfixable-vulns.js`, ADR-0018 amended). Original `brace-expansion` mislabel closed; module + classifier suites green (21 tests), live `--check` clean. ## 2026-07-24 > Last reviewed: 2026-07-11 **P032 known error** — confirmed external root cause against upstream source (`wr-architect/0.19.0` + `wr-jtbd/0.12.14` `scripts/mark-oversight-confirmed.sh`: `WINDOW_MINS=1440` 24h announce-marker-only SID enumeration; `CLAUDE_SESSION_ID` unexported so a >24h session's own announce marker ages out of the `-mmin -1440` window). Transitioned Open→Known Error (WSJF 3.0→6.0), upstream report pending (defer marker in `## Related`; not auto-filed in AFK loop). Fix direction decided (unconditionally enumerate the live SID). Prior: **P027 known error** — external root cause (`@windyroad/itil` work-problems SKILL Step 5 P147 halt-contract prose); upstream report pending; fix-shape choice queued for the user. ## 2026-07-25 > Last reviewed: 2026-07-24 **batch transition** — P006 close (yes — observed: action-first orchestration in this session), P031 close (yes — observed: RED→GREEN exact-pin fixture + 387-test suite green), P022 close (open→closed; hypothesis falsified 2026-06-04, upstream hook paths absent in adopter tree). Verification Queue drops to 4 (P014, P013, P030, P028 all `no — not observed`). ## 2026-07-26 > Last reviewed: 2026-07-25 **P029 known error** — root cause confirmed: `dry-aged-deps` never reads the registry `deprecated` field (`src/fetch-version-times.js` fetches `time` only); the per-version signal is available by widening the existing per-package `npm view` call (no extra round-trip). Effort M → L (multi-formatter wiring + new ADR for output-shape / advisory-vs-filtering decisions). Fix proposal (RFC/ADR) deferred per ADR-072. Also corrected P020's stale Open→Known Error status cell in this render. > Last reviewed: 2026-07-26 **P029 verification pending** — deprecation surfacing fix RELEASED via `feat(deprecation)` (commit `7e77036`, RFC-005 slices 1-7, ADR-0023, JTBD-011): widened npm view read → DEPRECATED symbol → dedicated table section + JSON `deprecated` array + XML ``, advisory-only (verbatim, no filtering/--update/exit-code change). Full prepush green, architect + JTBD PASS on every slice. Awaiting user verification against a real deprecated-dep project. > Last reviewed: 2026-07-26 **P033 captured** — CI npm pin drifts from the lockfile-generator npm version, silently stalling the release pipeline (`npm ci` rejects an npm-11 lockfile under a pinned npm-10 CI; 3 consecutive ci-publish failures on 2026-07-25 blocked the P029 `2.17.0` release until all three job pins were aligned to `11.13.0` in `f0cb373`). Sibling ADR-0024 records the pin-alignment invariant. Lightweight aside via /wr-itil:capture-problem.