SorraTheOrc · Sep 30, 2026 · Sep 27, 2026 · Sep 27, 2026 · Sep 27, 2026 · Sep 27, 2026
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,31 @@
 # Changelog
 
+## v1.0.17 (2026-09-30)
+### Features
+- Press r then i to start an interview on the selected work item. (WL-0MU95SGEB006HQAM)
+- Downtime work now always picks the top item from your Herdr list, so automated choices match what you see. (WL-0MTK1ILM2009QYB2)
+- Completed agent sessions now close automatically, freeing up your machine's resources. (WL-0MUJL1NAH0042GOS)
+- Audited child items now show a dimmed "covered" icon so the queue accurately reflects their audit status. (WL-0MUBVH8QG0020H9L)
+- Audit freshness now works consistently everywhere, so items no longer show as fresh in one view and stale in another. (WL-0MUBVH7ZR009PP80)
+- Automated work panes now appear in your project's own workspace, grouped by work item. (WL-0MU321YK70035AYT)
+- Completed work is now checked for proper review, with warnings and a report to catch anything missed. (WL-0MUBVH9FV0027COG)
+- Audits no longer reset for harmless edits like comments or assignee changes. (WL-0MU1EWMHN000YUCG)
+- Audits now run one at a time per machine, so they finish reliably instead of failing when busy. (WL-0MUIVE0YG000UVIA)
+- Press f d to see the 20 most recent auto-dispatched items and their outcomes. (WL-0MUGLL9SS002E1D2)
+### Bug Fixes
+- Fixed a broken internal test so updates can be delivered more reliably. (WL-0MUJTF9SA0034BSP)
+- Help info now stays visible even when text wraps. (WL-0MTV979LK005YB1B)
+- Rejection reasons with apostrophes no longer break the audit reject shortcut. (WL-0MU7KEX65004X0U9)
+- Shortcut commands with special characters now run correctly. (WL-0MUKH3DVA00488U0)
+- Long-running sessions no longer crash from a stale recovery notification. (WL-0MUIV50EJ007VH9B)
+- Panes will no longer close unexpectedly while you're still working. (WL-0MUMEKDK0008LKH8)
+- Panes no longer close when an agent stops, and idle auto-close is off by default. (WL-0MUMEJHT9004EQPI)
+- The review queue banner now tells you whether to keep auditing or ship. (WL-0MUJQFXYC009CFRJ)
+- Fixed a test that expected an outdated keyboard shortcut in the review worklist. (WL-0MUKDNC7L000I1JO)
+### Other
+- Test runs now stay properly paced, so your game sessions won't be slowed by overloaded servers. (WL-0MUL1DSEF004IJU9)
+- Old debug logs are now cleaned up automatically, keeping the game running fast and smooth. (WL-0MUJL0PTS009MC8F)
+
 ## v1.0.16 (2026-09-27)
 ### Features
 - Projects now take turns getting work done, and urgent tasks jump to the front. (WL-0MTJ7IEI80055V2V)

diff --git a/CLI.md b/CLI.md
@@ -299,6 +299,53 @@ wl audit-set WL-ABC123 --ready-to-close yes --audit-file report.md --summary "Fr
 wl audit-set WL-ABC123 --ready-to-close yes --fingerprint sha256-abc123 --summary "Content unchanged"
 ```
 
+### `audit-waive` [options] <id>
+
+Record an explicit, durable audit-gap waiver on a work item (WL-0MUBVH9FV0027COG).
+
+A waiver is a deliberate, auditable exception to the "no audit" gate. It suppresses the
+non-fatal closure warning emitted by `wl close` and excludes the item from the
+`wl doctor audit-gaps` flagged set. The record is stored in the nullable
+`workitems.auditWaiver` column, surfaced by `wl show --json`, and round-trips through
+JSONL sync. Absence is fail-safe: a missing waiver never suppresses a flag.
+
+Behavior:
+
+- Requires a non-empty `--reason` (a waiver must record why the gap is accepted).
+- `--author` defaults to the current user (`WL_USER` / `USER` / `USERNAME`).
+- Records `{ reason, author, waivedAt }` on the work item.
+
+Options:
+
+- `-r, --reason <reason>` — Why the audit gap is deliberately accepted (required).
+- `-a, --author <author>` — Who recorded the waiver (defaults to the current user).
+- `--prefix <prefix>` — Override default ID prefix (optional).
+- `--json` — Output in JSON format.
+
+Examples:
+
+```sh
+wl audit-waive WL-ABC123 --reason "Legacy item completed before audits were enforced"
+wl audit-waive WL-ABC123 --reason "Accepted by producer" --author "producer" --json
+```
+
+### `audit-unwaive` [options] <id>
+
+Remove an explicit audit-gap waiver from a work item. Idempotent: an item that is not
+waived is left unchanged.
+
+Options:
+
+- `--prefix <prefix>` — Override default ID prefix (optional).
+- `--json` — Output in JSON format.
+
+Examples:
+
+```sh
+wl audit-unwaive WL-ABC123
+wl audit-unwaive WL-ABC123 --json
+```
+
 ### `delete` [options] <id>
 
 Delete a work item (marks as deleted): this sets the work item status to `deleted` in the local database. If you prefer to set the status explicitly, use `wl update <id> -s deleted` instead.
@@ -364,6 +411,22 @@ are closed deepest-first so that leaf items are completed before their parents.
   bypassing the audit/stage checks. For items without children, `--force` behaves
   identically to a standard close.
 
+**Non-fatal audit-gap warning (WL-0MUBVH9FV0027COG):** When the non-force close path
+closes an item from the `in_review` stage whose audit is absent or stale (per the shared
+`isAuditFresh` predicate), and the item is not covered by a fresh-audited direct parent
+and has no waiver, a clear non-fatal warning is printed to stderr (and returned in the
+`auditGapWarnings` array in `--json` mode). The close still succeeds. To silence the
+warning, re-audit the item or record a deliberate exception:
+
+```
+Warning: WL-ABC123 (root) is being closed from in_review with a missing audit and no waiver.
+This is an audit gate leak; re-audit it or record a deliberate exception with
+`wl audit-waive WL-ABC123 --reason "<why>"`.
+```
+
+`wl close --force` bypasses the warning and records a durable waiver on an uncovered
+`in_review` root, so the bypass is auditable.
+
 **Output format (recursive close):** When the audit-gated recursive close path is triggered:
 
 - **Human-readable output** reports the count of successfully closed descendants:
@@ -552,7 +615,7 @@ The `--recency-policy` flag controls how recently updated items are weighted dur
 When multiple candidate items exist, `wl next` ranks them using the following criteria (highest weight first):
 
 1. **Priority** — higher-priority items always rank above lower-priority items. **`critical` is a hard top tier that no other boost can overtake.**
-2. **Audit-not-ready tier (WL-0MTH7G2O1004BHN5)** — any non-critical item with a **fresh** audit (`readyToClose === false` and `auditedAt >= updatedAt`) that is not ready to close is ranked **ahead of every unaudited / ready-to-close / stale non-critical item**, regardless of base priority (high/medium/low) and regardless of age/effort/recency. The tier is second only to `critical`. Missing audit, `readyToClose === true`, or stale (`auditedAt < updatedAt`) audits receive no boost. The same tier governs `wl re-sort`/`reSort` and `wl next --no-re-sort` (via the `selectBySortIndex` stale-index prefix) and `wl next --json` ordering.
+2. **Audit-not-ready tier (WL-0MTH7G2O1004BHN5)** — any non-critical item with a **fresh** audit (`readyToClose === false` and fresh per the shared `isAuditFresh` predicate) that is not ready to close is ranked **ahead of every unaudited / ready-to-close / stale non-critical item**, regardless of base priority (high/medium/low) and regardless of age/effort/recency. The tier is second only to `critical`. Missing audit, `readyToClose === true`, or stale audits receive no boost. Freshness is the single shared definition; with no fingerprint available the one-sided fallback time gate applies — fresh iff `auditedAt > updatedAt - 60 s`, i.e. an audit at or after the content timestamp is fresh (WL-0MUBVH7ZR009PP80). The same tier governs `wl re-sort`/`reSort` and `wl next --no-re-sort` (via the `selectBySortIndex` stale-index prefix) and `wl next --json` ordering.
 3. **Blocks high-priority work** — among equal-tier candidates, an item that is a prerequisite for a `high` or `critical` downstream item is preferred. This ensures that unblocking high-value work takes precedence over unrelated tasks at the same priority.
 4. **Blocked penalty** — items with active dependency blockers are excluded by default (see `--include-blocked`).
 5. **Tie-breakers** — sort_index, then age (older items first) break remaining ties.
@@ -970,6 +1033,7 @@ Subcommands:
 - `prune [options]` — Prune soft-deleted work items older than a specified age. Options: `--days <n>` (age threshold in days), `--dry-run` (show what would be pruned).
 - `file-paths [options]` — Check intake-stage items for missing or incorrect `**Key Files:**` sections. Options: `--add-placeholder` (add a placeholder section).
 - `foreign-items [options]` — Report work items whose ID prefix does not match the project prefix (cross-project pollution detection). Options: `--dry-run` (read-only; default), `--apply` (hard-delete foreign items with full cascade — destructive, requires explicit opt-in), `--push` (after `--apply`, rewrite the remote worklog ref so it contains only own items — destructive; requires `--apply`), `--prefix <prefix>` (override classification prefix).
+- `audit-gaps [options]` — Read-only report of every `completed`/`in_review` item with **no audit record**, showing root vs `child of <parent-id>`, age (from `activityAt`/`updatedAt`), and coverage/waiver status (`uncovered` / `covered` / `waived`). Omits items with a fresh audit; a child covered by a fresh-audited direct parent is reported as `covered`, not flagged. Options: `--prefix <prefix>`. No `--apply` (read-only).
 
 Examples:
 
@@ -989,6 +1053,8 @@ wl doctor foreign-items                  # Report foreign-prefix work items (rea
 wl doctor foreign-items --dry-run --json # JSON report of foreign items
 wl doctor foreign-items --apply          # Hard-delete foreign items (destructive)
 wl doctor foreign-items --apply --push  # Clean DB and rewrite remote worklog ref
+wl doctor audit-gaps                    # Report completed/in_review items with no audit (read-only)
+wl doctor audit-gaps --json             # Machine-readable audit-gap report
 
 Known stale combinations detected by `stage-sync`:
 

diff --git a/DATA_FORMAT.md b/DATA_FORMAT.md
@@ -56,7 +56,8 @@ Worklog uses a **dual-storage model** to combine the benefits of persistent data
   "activityAt": "2024-01-01T00:00:00.000Z",
   "tags": ["feature", "backend"],
   "assignee": "john.doe",
-  "stage": "development"
+  "stage": "development",
+  "auditWaiver": null
 }
 ```
 
@@ -79,6 +80,7 @@ Worklog uses a **dual-storage model** to combine the benefits of persistent data
 - **createdBy**: Optional interoperability field for imported creator/actor
 - **deletedBy**: Optional interoperability field for imported deleter/actor
 - **deleteReason**: Optional interoperability field for imported deletion reason
+- **auditWaiver** (optional, nullable): Explicit audit-gap waiver record `{ reason, author, waivedAt }`, or `null`/absent when the item is not waived. Suppresses the non-fatal closure warning and excludes the item from `wl doctor audit-gaps`; absence is fail-safe (never suppresses a flag). Managed with `wl audit-waive` / `wl audit-unwaive` (WL-0MUBVH9FV0027COG)
 
 ## Comment Structure
 

diff --git a/DOCTOR_AND_MIGRATIONS.md b/DOCTOR_AND_MIGRATIONS.md
@@ -12,6 +12,7 @@ This document describes the `wl doctor` command and the migration policy for Wor
 - **Dependency edges** — checks that all dependency edges reference existing work items.
 - **Pending migrations** — the `upgrade` subcommand detects and applies schema migrations.
 - **Stale deleted items** — the `prune` subcommand removes soft-deleted items older than a configurable threshold.
+- **Audit gaps** — the `audit-gaps` subcommand reports `completed`/`in_review` items with no audit record (read-only).
 
 ## Running `wl doctor`
 
@@ -100,6 +101,40 @@ See [docs/CROSS_PROJECT_POLLUTION_CLEANUP.md](docs/CROSS_PROJECT_POLLUTION_CLEAN
 
 Adding `--push` rewrites the project's remote worklog ref (`origin refs/worklog/data`, or the configured `syncBranch`) so it contains only the project's own items, bypassing the polluted remote history entirely (a fresh orphan commit is force-pushed and the local tracking ref is updated to match). `--push` requires `--apply` — rewriting the ref without cleaning the DB would publish foreign items. After the push, a subsequent `wl sync` pulls the clean ref and cannot re-import foreign items.
 
+### Reporting audit gaps (`wl doctor audit-gaps`)
+
+Work items can reach `completed`/`in_review` — and ship — without an audit record. `wl doctor audit-gaps` is a **read-only** report of every such item (WL-0MUBVH9FV0027COG):
+
+```bash
+# Report completed/in_review items with no audit record (read-only)
+wl doctor audit-gaps
+
+# Machine-readable report
+wl doctor audit-gaps --json
+```
+
+Each reported row shows:
+
+- **relationship** — `root` or `child of <parent-id>`.
+- **age** — derived from `activityAt` (falling back to `updatedAt`), in milliseconds and whole days.
+- **classification** — one of:
+  - `uncovered` — a genuine gap (flagged);
+  - `covered` — a child whose **direct** parent has a fresh audit (derived depth-1 coverage; never dispatched independently);
+  - `waived` — an explicit, durable waiver is recorded.
+
+Items with a *fresh* audit are omitted; stale-but-present audits are handled by the closure guard and the icon surfaces. The report has **no** `--apply`: it never mutates the database. The JSON payload exposes `items` (all no-audit items with their classification) and `flagged` (the `uncovered` subset), plus `noAuditCount`, `flaggedCount`, `coveredCount`, and `waivedCount`.
+
+#### Recording a waiver (`wl audit-waive` / `wl audit-unwaive`)
+
+To deliberately accept an audit gap, record a waiver with a reason:
+
+```bash
+wl audit-waive WL-ABC123 --reason "Legacy item completed before audits were enforced"
+wl audit-unwaive WL-ABC123   # remove the waiver
+```
+
+The waiver is stored durably in the nullable `workitems.auditWaiver` JSON column (`{ reason, author, waivedAt }`), surfaced by `wl show --json`, and round-trips through JSONL sync. A waived item is excluded from the `audit-gaps` flagged set and produces no closure warning. Absence of a waiver is fail-safe: it never suppresses a flag. This is the only schema addition made by WL-0MUBVH9FV0027COG, applied through `wl doctor upgrade` (migration `20260928-add-audit-waiver`).
+
 ## Backups
 
 When `wl doctor upgrade` applies migrations, it automatically:

diff --git a/README.md b/README.md
@@ -121,6 +121,7 @@ You can get a lot of value from using Worklog as a memory for your agents. But y
 | [API.md](API.md) | REST API endpoints and usage |
 | [docs/FILE_PATH_CONVENTION.md](docs/FILE_PATH_CONVENTION.md) | File path convention for work item descriptions |
 | [docs/CROSS_PROJECT_POLLUTION_CLEANUP.md](docs/CROSS_PROJECT_POLLUTION_CLEANUP.md) | Detecting and removing cross-project worklog pollution (`wl doctor foreign-items`) |
+| [DOCTOR_AND_MIGRATIONS.md](DOCTOR_AND_MIGRATIONS.md#reporting-audit-gaps-wl-doctor-audit-gaps) | Reporting and waiving audit gaps: `wl doctor audit-gaps`, `wl audit-waive` / `wl audit-unwaive` |
 | [docs/SYNC_IDENTITY_GATE.md](docs/SYNC_IDENTITY_GATE.md) | Refusing foreign/empty-author commits on sync (`--allow-foreign-author`, polluted-ref recovery) |
 | [docs/AGENTS-INSTALL.md](docs/AGENTS-INSTALL.md) | How `wl init` installs AGENTS.md / workflow guidance and how local rules relate to the global agent file |
 
@@ -145,6 +146,7 @@ You can get a lot of value from using Worklog as a memory for your agents. But y
 | [docs/validation/status-stage-inventory.md](docs/validation/status-stage-inventory.md) | Status/stage validation rules |
 | [docs/SKILL_AUTHORING.md](docs/SKILL_AUTHORING.md) | Skill authoring guide with script best practices |
 | [docs/dev/wl-process-healthcheck.md](docs/dev/wl-process-healthcheck.md) | wl process healthcheck watchdog usage (cron/systemd, thresholds) |
+| [docs/dev/audit-debug-log-retention.md](docs/dev/audit-debug-log-retention.md) | Audit debug log retention policy + runbook: sweep locations/thresholds, dry-run/`--apply`/`--check`, cron install/removal, safety guarantees |
 | [docs/dev/downtime-dispatcher.md](docs/dev/downtime-dispatcher.md) | Leader-election + shared-coordination downtime dispatcher architecture (herdr); critical-first dispatch tier + freeze split-by-skill; dedicated Dispatcher workspace with per-project tabs (one tab per work-item prefix) |
 
 ## Tutorials

diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
@@ -394,9 +394,9 @@ simulates a 6-pane refresh and asserts ≥60% fewer work spawns.
 
 `wl next` and `wl re-sort`/`reSort` apply a hard audit-not-ready tier second only to `critical`:
 
-- Any **fresh** non-critical audit with `readyToClose === false` and `auditedAt >= updatedAt` outranks **any** unaudited / `readyToClose === true` / stale (`auditedAt < updatedAt`) non-critical item regardless of base priority (high/medium/low) or age/effort/recency.
+- Any **fresh** non-critical audit with `readyToClose === false` outranks **any** unaudited / `readyToClose === true` / stale non-critical item regardless of base priority (high/medium/low) or age/effort/recency.
 - `critical` is a hard boundary that no audit-not-ready boost can overtake.
-- Missing/`true`/stale audits receive no boost; stale is defined as `auditedAt < updatedAt`.
+- Missing/`true`/stale audits receive no boost. Freshness is delegated to the single shared predicate `isAuditFresh` (`packages/shared/src/icons.ts`); the ordering tier passes no fingerprints, so the one-sided fallback time gate applies — fresh iff `auditedAt > updatedAt - AUDIT_FRESHNESS_AT_NEAR_TOLERANCE_MS` (60 s), i.e. an audit at or after the content timestamp is fresh, and an audit older than a later content edit is stale. There is no competing `auditedAt`-vs-`updatedAt` comparison in `packages/shared/src/database.ts` (WL-0MUBVH7ZR009PP80).
 - The same tier is enforced in `packages/shared/src/database.ts` in `sortItemsByScore`/`computeScore` (batch audit `Map<id,AuditResult>` + tiered comparator) and in `selectBySortIndex` both when all `sortIndex` coincide (before effective-priority/age) and when they diverge (tier prefix before `sortIndex`), so `wl next --no-re-sort` and `wl next --json` preserve boosted order without requiring a prior `reSort`.
 - `src/commands/grouping.ts` Critical Group placement is unchanged by design.