wr-risk-scorer bootstrap-catalog: ID allocation fails once R008+ exists; README hardcodes the suite name

[tompahoward]

Found while running /wr-risk-scorer:bootstrap-catalog (re-run) in an adopter project. Plugin wr-risk-scorer@windyroad 0.13.4 (commit d45a142), macOS, bash 3.2. Two problems in scripts/extract-risks-from-reports.sh.

1. ID allocation fails once R008+ exists. At line 216 LOCAL_MAX keeps the zero-padded id (e.g. 008); line 217 does NEXT_ID=$(( ${LOCAL_MAX:-0} + 1 )), and bash treats a leading-zero literal as octal, so 8/9 are invalid digits and it prints line 217: 008: value too great for base. Reproduce: have docs/risks/R008-*.active.md present and run the extractor. Effect: Phase 1 still appends source-evidence to existing slugs, but NEXT_ID is not computed, so the Phase 2 --derived-slugs path cannot allocate R009+. Suggested fix: force base-10, NEXT_ID=$(( 10#${LOCAL_MAX:-0} + 1 )).

2. The generated README hardcodes the suite name. Line 350 of the heredoc emits This directory is the persistent risk register for the Windy Road Agent Plugins suite. In an adopter project the generated docs/risks/README.md should name the adopter, not the suite, and it is overwritten on every run (so a manual correction does not survive). Suggested fix: derive the project name from the repo-root basename, or use project-neutral phrasing.

Both surfaced together in the same bootstrap run; happy to split into two issues if preferred.

[tompahoward]

Routing both defects you reported plus a third you surfaced:

1. Octal eval bug (scripts/extract-risks-from-reports.sh:217) — folded into existing P164 Phase 2 (Verifying → Known Error 2026-06-21).

Same root-cause class as P164's Phase 1 fix (six SKILL.md ticket-creator formulas, shipped 2026-05-11), but Phase 1's grep pattern (\$\(\(\s*\$\(echo) was too narrow and missed this simpler $(( ${VAR:-0} + 1 )) shape in script-surface formulas. Suggested fix 10#${LOCAL_MAX:-0} matches the canonical Phase 1 shape exactly. Phase 2 broadens the survey across packages/**/scripts/*.sh + scripts/*.sh and applies the same 10# fix.

Tracked: docs/problems/known-error/164-octal-eval-bug-in-next-id-formula-across-ticket-creator-skills-fires-when-ids-cross-099.md.

2. Hardcoded "Windy Road Agent Plugins suite" branding in adopter-generated docs/risks/README.md (heredoc line 350) — captured as new P374 (Open, Tier 1 inbound-reported).

Class: published-artefacts-reference-repo-internal-text. Same family as P151 / P153 / P219 / P317 (source-monorepo-only text leaking into adopter installs). Fix options ladder: (a) derive project name from git rev-parse --show-toplevel | xargs basename, (b) project-neutral phrasing (no substitution; likely simplest), (c) RISK_REGISTER_PROJECT_NAME env-var override.

Tracked: docs/problems/open/374-extract-risks-from-reports-hardcodes-windy-road-suite-name-in-adopter-readme.md.

3. Third defect surfaced by your report itself — captured as P373 (Open).

The inbound-discovery channel filter requires a [problem] title prefix and silently dropped this report from today's automated poll. Caught only on manual review. Filter is being widened (fix-options ladder: remove filter / broaden matcher / tier the filter).

Tracked: docs/problems/open/373-github-issues-upstream-channel-filter-discards-non-problem-prefixed-issues.md.

---

Splitting the two issues was fine for triage but ultimately they fold into separate local tickets (different root-cause classes — one bash arithmetic, one published-artefact prose), so the single-issue intake worked. Leaving this open until Phase 2 and P374 fixes ship; will update when each lands.