@deftai/directive-core 0.96.0 → 0.98.0

package/dist/triage/bootstrap/gitignore.d.ts

@@ -8,7 +8,7 @@ export declare function gitignoreTriageCacheEntries(projectRoot: string): readon
 export declare function gitattributesTriageCacheGlob(projectRoot: string): string;
 export declare const GITATTRIBUTES_EVAL_RULE = "vbrief/.triage-cache/*.jsonl  merge=union";
 export declare const FORBIDDEN_BLANKET_EVAL_LINES: readonly string[];
-export declare const EVAL_README_BODY = "# `vbrief/.triage-cache/` \u2014 triage working-set files\n\nThis directory holds JSON-lines logs and scratch files that Deft triage and\nslicing workflows emit. Deft configures your repo's `.gitignore` and\n`.gitattributes` so some files stay local while team-shared records can be\ncommitted.\n\n## What lives here\n\n| File | Committed? | Notes |\n| --- | --- | --- |\n| `slices.jsonl` | Yes | Team-shared cohort records from slicing skills. New teammates use prior cohort outputs to spot orphans and avoid re-slicing the same scope. |\n| `candidates.jsonl` | No | Your local triage accept / defer / reject stream. Re-create on a fresh clone with `deft triage:bootstrap`. |\n| `summary-history.jsonl` | No | Local history of `deft triage:summary` output; not required for day-to-day work. |\n| `scope-lifecycle.jsonl` | No | Local audit trail for scope demotions (`deft scope:demote`). Each operator's stream stays on their machine. |\n| `decompositions/` | No | Draft story-decomposition scratch. Produced child story xBRIEFs live in lifecycle folders via `deft scope:decompose`. |\n| `doctor-state.json` | No | Per-clone throttle state for `deft doctor` re-probe timing. |\n\nPaths listed as \"No\" above are added to `.gitignore` during bootstrap; anything\nnot listed remains committable by default. The selective ignore entries live in\nthe repo-root `.gitignore` (`vbrief/.triage-cache/candidates.jsonl`,\n`vbrief/.triage-cache/summary-history.jsonl`, `vbrief/.triage-cache/scope-lifecycle.jsonl`,\n`vbrief/.triage-cache/decompositions/`, and `vbrief/.triage-cache/doctor-state.json`).\n\n## Fresh clone\n\nIf `candidates.jsonl` is missing, run:\n\n```\ndeft triage:bootstrap\n```\n\nBootstrap rebuilds the local candidates log without altering committed\n`slices.jsonl`.\n\n## Merge behavior for `*.jsonl`\n\nThe repo-root `.gitattributes` may declare:\n\n```\nvbrief/.triage-cache/*.jsonl  merge=union\n```\n\nThe `union` merge driver concatenates both sides' appended lines on auto-merge,\nso parallel append-only edits to the same JSON-lines file rebase without manual\nconflict surgery. It does not dedupe semantically similar records \u2014 downstream\nreaders should tolerate duplicate-looking entries.\n\n## See also\n\n- `.gitignore` \u2014 selective ignore rules for operator-private files\n- `.gitattributes` \u2014 merge driver for committed JSON-lines logs\n";
+export declare const EVAL_README_BODY = "# `vbrief/.triage-cache/` \u2014 triage working-set files\n\nThis directory holds JSON-lines logs and scratch files that Deft triage and\nslicing workflows emit. Deft configures your repo's `.gitignore` and\n`.gitattributes` so some files stay local while team-shared records can be\ncommitted.\n\n## What lives here\n\n| File | Committed? | Notes |\n| --- | --- | --- |\n| `slices.jsonl` | Yes | Team-shared cohort records from slicing skills. New teammates use prior cohort outputs to spot orphans and avoid re-slicing the same scope. |\n| `candidates.jsonl` | No | Your local triage accept / defer / reject stream. Re-create on a fresh clone with `deft triage:bootstrap`. |\n| `summary-history.jsonl` | No | Local history of `deft triage:summary` output; not required for day-to-day work. |\n| `scope-lifecycle.jsonl` | No | Local audit trail for scope demotions (`deft scope:demote`). Each operator's stream stays on their machine. |\n| `decompositions/` | No | Draft story-decomposition scratch. Produced child story xBRIEFs live in lifecycle folders via `deft scope:decompose`. |\n| `doctor-state.json` | No | Per-clone throttle state for `deft doctor` re-probe timing. |\n| `staleness-tickler-state.json` | No | Per-clone upgrade-tickler throttle state. |\n| `release-availability-state.json` | No | Per-clone release-availability probe throttle state. |\n\nPaths listed as \"No\" above are added to `.gitignore` during bootstrap; anything\nnot listed remains committable by default. The selective ignore entries live in\nthe repo-root `.gitignore` (`vbrief/.triage-cache/candidates.jsonl`,\n`vbrief/.triage-cache/summary-history.jsonl`, `vbrief/.triage-cache/scope-lifecycle.jsonl`,\n`vbrief/.triage-cache/decompositions/`, `vbrief/.triage-cache/doctor-state.json`,\n`vbrief/.triage-cache/staleness-tickler-state.json`, and\n`vbrief/.triage-cache/release-availability-state.json`).\n\n## Fresh clone\n\nIf `candidates.jsonl` is missing, run:\n\n```\ndeft triage:bootstrap\n```\n\nBootstrap rebuilds the local candidates log without altering committed\n`slices.jsonl`.\n\n## Merge behavior for `*.jsonl`\n\nThe repo-root `.gitattributes` may declare:\n\n```\nvbrief/.triage-cache/*.jsonl  merge=union\n```\n\nThe `union` merge driver concatenates both sides' appended lines on auto-merge,\nso parallel append-only edits to the same JSON-lines file rebase without manual\nconflict surgery. It does not dedupe semantically similar records \u2014 downstream\nreaders should tolerate duplicate-looking entries.\n\n## See also\n\n- `.gitignore` \u2014 selective ignore rules for operator-private files\n- `.gitattributes` \u2014 merge driver for committed JSON-lines logs\n";
 /** Layout-aware triage-cache README body for the active lifecycle tree (#2344 / #2349). */
 export declare function generateTriageCacheReadmeBody(projectRoot: string): string;
 /** Strip an inline `# ...` comment from a gitignore line. */

package/dist/triage/bootstrap/gitignore.js

@@ -20,6 +20,9 @@ export const GITIGNORE_EVAL_ENTRIES = [
     "xbrief/.triage-cache/scope-lifecycle.jsonl",
     "xbrief/.triage-cache/decompositions/",
     "xbrief/.triage-cache/doctor-state.json",
+    // Per-clone session state (#3146); selective only — hybrid policy preserved.
+    "xbrief/.triage-cache/staleness-tickler-state.json",
+    "xbrief/.triage-cache/release-availability-state.json",
 ];
 /** Layout-aware gitignore lines for triage working-set files (#1703). */
 export function gitignoreTriageCacheEntries(projectRoot) {
@@ -30,6 +33,9 @@ export function gitignoreTriageCacheEntries(projectRoot) {
         triageCacheRelPath(projectRoot, "scope-lifecycle.jsonl"),
         decomp.endsWith("/") ? decomp : `${decomp}/`,
         triageCacheRelPath(projectRoot, "doctor-state.json"),
+        // Per-clone session state (#3146); selective only — hybrid policy preserved.
+        triageCacheRelPath(projectRoot, "staleness-tickler-state.json"),
+        triageCacheRelPath(projectRoot, "release-availability-state.json"),
     ];
 }
 export function gitattributesTriageCacheGlob(projectRoot) {
@@ -76,6 +82,10 @@ const EVAL_ENTRIES_RATIONALE = "\n# vbrief/.triage-cache/ tracking governance (#
     "#                               throttle state gating the 24h/4h\n" +
     "#                               re-probe window; #1308 / #1464). Local\n" +
     "#                               to each clone; never committed.\n" +
+    "#   - staleness-tickler-state.json -> gitignored (per-clone upgrade\n" +
+    "#                               tickler throttle; #2488 / #3146).\n" +
+    "#   - release-availability-state.json -> gitignored (per-clone npm\n" +
+    "#                               release-availability throttle; #1692 / #3146).\n" +
     "#   - slices.jsonl           -> TRACKED (team-shared cohort records\n" +
     "#                               produced by slicing skills; see\n" +
     "#                               #1132 / D13).\n" +
@@ -104,12 +114,16 @@ committed.
 | \`scope-lifecycle.jsonl\` | No | Local audit trail for scope demotions (\`deft scope:demote\`). Each operator's stream stays on their machine. |
 | \`decompositions/\` | No | Draft story-decomposition scratch. Produced child story xBRIEFs live in lifecycle folders via \`deft scope:decompose\`. |
 | \`doctor-state.json\` | No | Per-clone throttle state for \`deft doctor\` re-probe timing. |
+| \`staleness-tickler-state.json\` | No | Per-clone upgrade-tickler throttle state. |
+| \`release-availability-state.json\` | No | Per-clone release-availability probe throttle state. |
 
 Paths listed as "No" above are added to \`.gitignore\` during bootstrap; anything
 not listed remains committable by default. The selective ignore entries live in
 the repo-root \`.gitignore\` (\`vbrief/.triage-cache/candidates.jsonl\`,
 \`vbrief/.triage-cache/summary-history.jsonl\`, \`vbrief/.triage-cache/scope-lifecycle.jsonl\`,
-\`vbrief/.triage-cache/decompositions/\`, and \`vbrief/.triage-cache/doctor-state.json\`).
+\`vbrief/.triage-cache/decompositions/\`, \`vbrief/.triage-cache/doctor-state.json\`,
+\`vbrief/.triage-cache/staleness-tickler-state.json\`, and
+\`vbrief/.triage-cache/release-availability-state.json\`).
 
 ## Fresh clone
 

package/dist/triage/classify/label-mirror.d.ts

@@ -1,5 +1,5 @@
 /**
- * Tier-1 deterministic SCM label mirror (#1423 Wave 1 + Wave 2 bootstrap).
+ * Tier-1 deterministic SCM label mirror (#1423 Wave 1 + Wave 2 bootstrap + #3197 re-enrich).
  *
  * Classifies cached issues with the existing #1129 engine, then mirrors the
  * outcome as SCM labels (dry-run default, --apply to write). Never accepts into
@@ -9,6 +9,10 @@
  * + samples), batched rate-limit-aware apply. Bootstrap mass-triage entrypoint is
  * `triage:classify -- --mirror` with these filters (not triage:accept).
  *
+ * #3197 re-enrich: default keeps one-shot skip on idempotencyLabel; opt-in
+ * `--re-enrich` re-classifies already-stamped issues and plans **additive**
+ * label deltas only (v1; no removals / no full reconcile).
+ *
  * Intentionally does NOT import from ./index.js (SLizard P1 cycle). The classify
  * engine is injected via LabelMirrorEngine / mirrorLabels() wrapper in index.ts.
  */
@@ -98,6 +102,12 @@ export interface LabelMirrorItem {
     readonly add: readonly string[];
     readonly status: LabelMirrorStatus;
     readonly message?: string;
+    /**
+     * True when this row re-planned an issue that already carried the idempotency
+     * label under opt-in re-enrich mode (#3197). Distinguishes first-time stamp
+     * rows from re-enrich additive backfill in dry-run digests.
+     */
+    readonly re_enrich?: boolean;
 }
 /** Operator digest aggregates for bootstrap mass-triage (#3125 / #1423 Wave 2). */
 export interface LabelMirrorDigest {
@@ -116,6 +126,8 @@ export interface LabelMirrorFilters {
     readonly author: string | null;
     /** Resolved author logins for machine consumers. */
     readonly author_logins: readonly string[] | null;
+    /** Whether this run used opt-in re-enrich mode (#3197). */
+    readonly re_enrich: boolean;
 }
 export interface LabelMirrorOutcome {
     readonly project_root: string;
@@ -132,6 +144,16 @@ export interface LabelMirrorOutcome {
     /** Issues skipped by --author filter (#3129). */
     readonly skipped_author: number;
     readonly errors: number;
+    /**
+     * Planned rows that re-enriched already-stamped issues (subset of planned; #3197).
+     * Zero when re_enrich mode is off.
+     */
+    readonly re_enrich_planned: number;
+    /**
+     * Applied rows that re-enriched already-stamped issues (subset of applied; #3197).
+     * Zero when re_enrich mode is off.
+     */
+    readonly re_enrich_applied: number;
     readonly filters: LabelMirrorFilters;
     readonly digest: LabelMirrorDigest;
     readonly items: readonly LabelMirrorItem[];
@@ -169,6 +191,14 @@ export interface LabelMirrorOptions {
     readonly delayMs?: number;
     /** Injectable sleep for tests (receives ms). Default busy-wait when delayMs > 0. */
     readonly sleepMs?: LabelMirrorSleepFn;
+    /**
+     * Opt-in re-enrich mode (#3197): re-classify issues that already carry the
+     * idempotency label and plan **additive** label deltas only (no removals).
+     * Default false preserves one-shot `skipped_already_triaged` behavior.
+     * Still dry-run by default; pair with dryRun:false / CLI `--apply` to write.
+     * Never triage:accept / never xBRIEF writes.
+     */
+    readonly reEnrich?: boolean;
     /** Required: classify engine (provided by classify/index mirrorLabels wrapper). */
     readonly engine: LabelMirrorEngine;
 }

package/dist/triage/classify/label-mirror.js

@@ -1,5 +1,5 @@
 /**
- * Tier-1 deterministic SCM label mirror (#1423 Wave 1 + Wave 2 bootstrap).
+ * Tier-1 deterministic SCM label mirror (#1423 Wave 1 + Wave 2 bootstrap + #3197 re-enrich).
  *
  * Classifies cached issues with the existing #1129 engine, then mirrors the
  * outcome as SCM labels (dry-run default, --apply to write). Never accepts into
@@ -9,6 +9,10 @@
  * + samples), batched rate-limit-aware apply. Bootstrap mass-triage entrypoint is
  * `triage:classify -- --mirror` with these filters (not triage:accept).
  *
+ * #3197 re-enrich: default keeps one-shot skip on idempotencyLabel; opt-in
+ * `--re-enrich` re-classifies already-stamped issues and plans **additive**
+ * label deltas only (v1; no removals / no full reconcile).
+ *
  * Intentionally does NOT import from ./index.js (SLizard P1 cycle). The classify
  * engine is injected via LabelMirrorEngine / mirrorLabels() wrapper in index.ts.
  */
@@ -399,6 +403,7 @@ export function mirrorLabels(projectRoot, options) {
         ? options.authorFilter
         : null;
     const sampleLimit = options.sampleLimit ?? DEFAULT_DIGEST_SAMPLE_LIMIT;
+    const reEnrich = options.reEnrich === true;
     const batchSize = options.batchSize !== undefined
         ? Math.max(1, Math.floor(options.batchSize))
         : DEFAULT_APPLY_BATCH_SIZE;
@@ -416,6 +421,7 @@ export function mirrorLabels(projectRoot, options) {
         repo: repoFilter,
         author: authorFilter !== null ? authorFilter.display : null,
         author_logins: authorFilter !== null ? authorFilter.allowLogins : null,
+        re_enrich: reEnrich,
     };
     const items = [];
     const outcomeBase = {
@@ -441,6 +447,8 @@ export function mirrorLabels(projectRoot, options) {
                 skipped_unreadable: 0,
                 skipped_closed: 0,
                 skipped_author: 0,
+                re_enrich_planned: 0,
+                re_enrich_applied: 0,
                 errors: 0,
                 digest: emptyDigest,
                 items: [
@@ -481,6 +489,8 @@ export function mirrorLabels(projectRoot, options) {
     let skippedUnreadable = 0;
     let skippedClosed = 0;
     let skippedAuthor = 0;
+    let reEnrichPlanned = 0;
+    let reEnrichApplied = 0;
     let errors = 0;
     let applyWritesSinceSleep = 0;
     for (const [repo, issueNumber] of pairs) {
@@ -573,7 +583,10 @@ export function mirrorLabels(projectRoot, options) {
         else {
             current = issueLabelNames(issue);
         }
-        if (current.includes(policy.idempotencyLabel)) {
+        // Default one-shot: already stamped → skip. Opt-in --re-enrich continues past
+        // the stamp and plans additive deltas only (#3197; never removals in v1).
+        const alreadyStamped = policy.idempotencyLabel.length > 0 && current.includes(policy.idempotencyLabel);
+        if (alreadyStamped && !reEnrich) {
             skippedAlready += 1;
             items.push({
                 repo,
@@ -590,6 +603,7 @@ export function mirrorLabels(projectRoot, options) {
             });
             continue;
         }
+        const isReEnrichRow = alreadyStamped && reEnrich;
         // Pass number set only when this exact repo+number is referenced from xBRIEF.
         const key = `${repo.toLowerCase()}\0${issueNumber}`;
         const vbriefReferenced = referencedKeys.has(key)
@@ -603,6 +617,26 @@ export function mirrorLabels(projectRoot, options) {
             now,
         });
         if (classification === null) {
+            // Re-enrich of a stamped issue with no current rule match: leave labels as-is
+            // (additive-only v1 never strips triaged / action chips). Count as unchanged.
+            if (isReEnrichRow) {
+                unchanged += 1;
+                items.push({
+                    repo,
+                    issue_number: issueNumber,
+                    state,
+                    action: null,
+                    reason: null,
+                    ruleKind: null,
+                    current: [...current].sort(),
+                    desired: [...current].sort(),
+                    add: [],
+                    status: "unchanged",
+                    re_enrich: true,
+                    message: `re-enrich: no classify match; left existing labels (incl. ${policy.idempotencyLabel})`,
+                });
+                continue;
+            }
             skippedNoMatch += 1;
             items.push({
                 repo,
@@ -620,7 +654,9 @@ export function mirrorLabels(projectRoot, options) {
         }
         const desired = desiredLabelsForClassification(classification.action, policy);
         const currentSet = new Set(current);
+        // Additive-only: never plan removals even under re-enrich (#3197 v1).
         const add = desired.filter((label) => !currentSet.has(label)).sort();
+        const reEnrichFlag = isReEnrichRow ? { re_enrich: true } : {};
         if (add.length === 0) {
             unchanged += 1;
             items.push({
@@ -634,11 +670,15 @@ export function mirrorLabels(projectRoot, options) {
                 desired,
                 add: [],
                 status: "unchanged",
+                ...reEnrichFlag,
             });
             continue;
         }
         if (dryRun) {
             planned += 1;
+            if (isReEnrichRow) {
+                reEnrichPlanned += 1;
+            }
             items.push({
                 repo,
                 issue_number: issueNumber,
@@ -650,6 +690,7 @@ export function mirrorLabels(projectRoot, options) {
                 desired,
                 add,
                 status: "planned",
+                ...reEnrichFlag,
             });
             continue;
         }
@@ -673,6 +714,7 @@ export function mirrorLabels(projectRoot, options) {
                 add,
                 status: "error",
                 message: mutateGate.reason ?? `refusing cross-repo mutation on ${repo}`,
+                ...reEnrichFlag,
             });
             continue;
         }
@@ -690,6 +732,7 @@ export function mirrorLabels(projectRoot, options) {
                 add,
                 status: "error",
                 message: "no LabelClient available for apply",
+                ...reEnrichFlag,
             });
             continue;
         }
@@ -700,8 +743,12 @@ export function mirrorLabels(projectRoot, options) {
                 sleepMs(delayMs);
             }
             applyWritesSinceSleep += 1;
+            // Additive-only: remove list is always empty (never strip labels; #3197).
             client.apply(repo, issueNumber, add, []);
             applied += 1;
+            if (isReEnrichRow) {
+                reEnrichApplied += 1;
+            }
             items.push({
                 repo,
                 issue_number: issueNumber,
@@ -713,6 +760,7 @@ export function mirrorLabels(projectRoot, options) {
                 desired,
                 add,
                 status: "applied",
+                ...reEnrichFlag,
             });
         }
         catch (exc) {
@@ -730,6 +778,7 @@ export function mirrorLabels(projectRoot, options) {
                 add,
                 status: "error",
                 message: formatMissingLabelHint(rawMsg, add),
+                ...reEnrichFlag,
             });
             // Partial failure: continue remaining issues (idempotent re-run skips applied).
         }
@@ -746,6 +795,8 @@ export function mirrorLabels(projectRoot, options) {
         skipped_unreadable: skippedUnreadable,
         skipped_closed: skippedClosed,
         skipped_author: skippedAuthor,
+        re_enrich_planned: reEnrichPlanned,
+        re_enrich_applied: reEnrichApplied,
         errors,
         digest,
         items,
@@ -763,16 +814,27 @@ function formatCountMap(map) {
 export function renderLabelMirrorReport(outcome) {
     const lines = [];
     const mode = outcome.dry_run ? "dry-run" : "apply";
-    lines.push(`triage:classify --mirror (${mode}) — bootstrap mass-triage (#1423 Wave 2)`);
+    const reEnrichOn = outcome.filters.re_enrich === true;
+    lines.push(reEnrichOn
+        ? `triage:classify --mirror --re-enrich (${mode}) — additive re-enrich (#3197 / #1423)`
+        : `triage:classify --mirror (${mode}) — bootstrap mass-triage (#1423 Wave 2)`);
     const stateFilter = outcome.filters.include_closed ? "all (include-closed)" : "open-only";
     const repoPart = outcome.filters.repo ?? "*";
     const authorPart = outcome.filters.author ?? "*";
-    lines.push(`filters: state=${stateFilter} repo=${repoPart} author=${authorPart}`);
+    const reEnrichPart = reEnrichOn ? "on (additive-only)" : "off";
+    lines.push(`filters: state=${stateFilter} repo=${repoPart} author=${authorPart} re_enrich=${reEnrichPart}`);
+    const firstTimePlanned = Math.max(0, outcome.planned - outcome.re_enrich_planned);
+    const firstTimeApplied = Math.max(0, outcome.applied - outcome.re_enrich_applied);
     lines.push(`scanned=${outcome.scanned} planned=${outcome.planned} applied=${outcome.applied} ` +
         `unchanged=${outcome.unchanged} already_triaged=${outcome.skipped_already_triaged} ` +
         `no_match=${outcome.skipped_no_match} closed_skipped=${outcome.skipped_closed} ` +
         `author_skipped=${outcome.skipped_author} ` +
         `unreadable=${outcome.skipped_unreadable} errors=${outcome.errors}`);
+    // Distinguish first-time stamp rows vs re-enrich additive backfill (#3197 / #3124 re-run vs re-enrich).
+    lines.push(`planned_kind: first_time=${firstTimePlanned} re_enrich=${outcome.re_enrich_planned}` +
+        (outcome.dry_run
+            ? ""
+            : ` | applied_kind: first_time=${firstTimeApplied} re_enrich=${outcome.re_enrich_applied}`));
     lines.push(`idempotencyLabel=${outcome.policy.idempotencyLabel} alwaysLabels=${JSON.stringify(outcome.policy.alwaysLabels)}`);
     if (!outcome.dry_run) {
         lines.push(`apply: batch_size=${outcome.batch_size ?? DEFAULT_APPLY_BATCH_SIZE} delay_ms=${outcome.delay_ms ?? DEFAULT_APPLY_DELAY_MS}`);
@@ -797,8 +859,9 @@ export function renderLabelMirrorReport(outcome) {
             const actionPart = item.action !== null ? ` action=${item.action}` : "";
             const rulePart = item.ruleKind !== null ? ` rule=${item.ruleKind}` : "";
             const statePart = item.state !== null ? ` state=${item.state}` : "";
+            const kindPart = item.re_enrich === true ? " kind=re-enrich" : " kind=first-time";
             const addPart = sanitizeReportFragment(item.add.join(", +"));
-            lines.push(`- ${item.repo}#${item.issue_number}:${statePart}${actionPart}${rulePart} +${addPart}`);
+            lines.push(`- ${item.repo}#${item.issue_number}:${statePart}${actionPart}${rulePart}${kindPart} +${addPart}`);
         }
         if (outcome.digest.sample_truncated) {
             const remaining = writeTotal - outcome.digest.samples.length;
@@ -817,6 +880,9 @@ export function renderLabelMirrorReport(outcome) {
     if (already.length > 0) {
         lines.push("");
         lines.push(`Skipped (already ${outcome.policy.idempotencyLabel}): ${already.length}`);
+        if (!reEnrichOn) {
+            lines.push("  Tip: after actionLabels / rule changes, use --mirror --re-enrich (dry-run) to plan additive chips on already-stamped issues (#3197; re-run vs re-enrich #3124).");
+        }
     }
     const noMatch = outcome.items.filter((i) => i.status === "skipped_no_match");
     if (noMatch.length > 0) {
@@ -833,7 +899,9 @@ export function renderLabelMirrorReport(outcome) {
     }
     if (outcome.dry_run && writeTotal > 0) {
         lines.push("");
-        lines.push("Dry-run — re-run with --mirror --apply to write these labels via SCM (batched; never triage:accept).");
+        lines.push(reEnrichOn
+            ? "Dry-run — re-run with --mirror --re-enrich --apply to write additive labels via SCM (batched; never triage:accept; never removals)."
+            : "Dry-run — re-run with --mirror --apply to write these labels via SCM (batched; never triage:accept).");
     }
     return `${lines.join("\n")}\n`;
 }
@@ -851,12 +919,15 @@ export function labelMirrorOutcomeToJson(outcome) {
         skipped_unreadable: outcome.skipped_unreadable,
         skipped_closed: outcome.skipped_closed,
         skipped_author: outcome.skipped_author,
+        re_enrich_planned: outcome.re_enrich_planned,
+        re_enrich_applied: outcome.re_enrich_applied,
         errors: outcome.errors,
         filters: {
             include_closed: outcome.filters.include_closed,
             repo: outcome.filters.repo,
             author: outcome.filters.author,
             author_logins: outcome.filters.author_logins,
+            re_enrich: outcome.filters.re_enrich,
         },
         digest: {
             by_state: { ...outcome.digest.by_state },
@@ -890,6 +961,7 @@ function itemToJson(i) {
         add: [...i.add],
         status: i.status,
         ...(i.message !== undefined ? { message: i.message } : {}),
+        ...(i.re_enrich === true ? { re_enrich: true } : {}),
     };
 }
 /** Validate triageLabelMirror on a plan object (vbrief_validate hook). */

package/dist/triage/help/registry-data.d.ts

@@ -169,12 +169,12 @@ export declare const registryData: {
         readonly "task triage:classify": {
             readonly name: "task triage:classify";
             readonly summary: "Inspect / validate auto-classification; bootstrap mass-triage label mirror";
-            readonly refs: "(D10 / #1129, #1423 Wave 1–2 / #3125, #3129)";
-            readonly description: "Inspect or validate the auto-classification rule set. --list renders effective rules (framework universal first, consumer overrides next). --validate exits non-zero on a malformed plan.policy.triageAutoClassify or triageLabelMirror. --mirror is the bootstrap mass-triage entrypoint (#3125): classifies the github-issue cache and mirrors outcomes as SCM labels. Open-only by default (opt-in --include-closed); optional --author LOGIN scopes plan/apply to matching author.login (AND with open-only; #3129); dry-run digest shows totals + by state/rule/action + samples and surfaces the author filter; --apply batches writes with rate-limit delay. Never calls triage:accept / never writes proposed/ xBRIEFs.";
-            readonly usage: "task triage:classify -- [--list | --validate | --mirror [--apply] [--include-closed] [--author LOGIN|@me] [--repo owner/name] [--batch-size N] [--delay-ms N] [--sample-limit N] [--json] [--allow-cross-repo]]";
-            readonly flags: readonly [readonly ["--list", "(default)", "Print effective rules + hold markers."], readonly ["--validate", "(off)", "Validate plan.policy.triageAutoClassify + triageLabelMirror."], readonly ["--mirror", "(off)", "Bootstrap mass-triage label mirror: classify cache → planned/applied labels (dry-run default, open-only)."], readonly ["--apply", "(off)", "With --mirror: write labels via SCM (batched; requires github SCM boundary)."], readonly ["--include-closed", "(off)", "With --mirror: include closed issues (default open-only avoids archive mass-stamp)."], readonly ["--author LOGIN|@me", "(none)", "With --mirror: only plan/apply issues whose cache author.login matches (exact; @me; comma allow-list) (#3129)."], readonly ["--author-mine", "(off)", "With --mirror: alias for --author @me (#3129)."], readonly ["--repo owner/name", "(all cached)", "Limit mirror to one repo."], readonly ["--batch-size N", "10", "With --mirror --apply: writes per batch before delay."], readonly ["--delay-ms N", "1000", "With --mirror --apply: ms sleep between batches (rate-limit)."], readonly ["--sample-limit N", "15", "With --mirror: max samples in human digest."], readonly ["--json", "(off)", "With --mirror: structured JSON outcome including digest aggregates."], readonly ["--allow-cross-repo", "(off)", "With --mirror --apply: allow non-project repos (#2601)."]];
-            readonly examples: readonly ["task triage:classify -- --list", "task triage:classify -- --validate", "task triage:classify -- --mirror", "task triage:classify -- --mirror --author @me --repo owner/name", "task triage:classify -- --mirror --repo owner/name --json", "task triage:classify -- --mirror --apply --repo owner/name --batch-size 10 --delay-ms 1000", "task triage:classify -- --mirror --include-closed --repo owner/name"];
-            readonly see_also: readonly ["task triage:bootstrap", "task triage:queue", "task vbrief:reconcile:labels", "#1119 / D10", "#1423", "#3125", "#3129"];
+            readonly refs: "(D10 / #1129, #1423 Wave 1–2 / #3125, #3129, #3197)";
+            readonly description: "Inspect or validate the auto-classification rule set. --list renders effective rules (framework universal first, consumer overrides next). --validate exits non-zero on a malformed plan.policy.triageAutoClassify or triageLabelMirror. --mirror is the bootstrap mass-triage entrypoint (#3125): classifies the github-issue cache and mirrors outcomes as SCM labels. Open-only by default (opt-in --include-closed); optional --author LOGIN scopes plan/apply to matching author.login (AND with open-only; #3129). Default re-run skips already-stamped (idempotency) issues; after policy/rule changes use --re-enrich to re-classify already-triaged issues and plan additive label deltas only (#3197; re-run vs re-enrich discovery #3124). Dry-run digest shows totals + by state/rule/action + samples, first-time vs re-enrich planned rows, and surfaces the author filter; --apply batches writes with rate-limit delay. Never calls triage:accept / never writes proposed/ xBRIEFs.";
+            readonly usage: "task triage:classify -- [--list | --validate | --mirror [--apply] [--re-enrich] [--include-closed] [--author LOGIN|@me] [--repo owner/name] [--batch-size N] [--delay-ms N] [--sample-limit N] [--json] [--allow-cross-repo]]";
+            readonly flags: readonly [readonly ["--list", "(default)", "Print effective rules + hold markers."], readonly ["--validate", "(off)", "Validate plan.policy.triageAutoClassify + triageLabelMirror."], readonly ["--mirror", "(off)", "Bootstrap mass-triage label mirror: classify cache → planned/applied labels (dry-run default, open-only)."], readonly ["--apply", "(off)", "With --mirror: write labels via SCM (batched; requires github SCM boundary)."], readonly ["--re-enrich", "(off)", "With --mirror: re-classify already-stamped issues; plan additive label deltas only (dry-run default; #3197 / #3124 re-run vs re-enrich)."], readonly ["--include-closed", "(off)", "With --mirror: include closed issues (default open-only avoids archive mass-stamp)."], readonly ["--author LOGIN|@me", "(none)", "With --mirror: only plan/apply issues whose cache author.login matches (exact; @me; comma allow-list) (#3129)."], readonly ["--author-mine", "(off)", "With --mirror: alias for --author @me (#3129)."], readonly ["--repo owner/name", "(all cached)", "Limit mirror to one repo."], readonly ["--batch-size N", "10", "With --mirror --apply: writes per batch before delay."], readonly ["--delay-ms N", "1000", "With --mirror --apply: ms sleep between batches (rate-limit)."], readonly ["--sample-limit N", "15", "With --mirror: max samples in human digest."], readonly ["--json", "(off)", "With --mirror: structured JSON outcome including digest aggregates."], readonly ["--allow-cross-repo", "(off)", "With --mirror --apply: allow non-project repos (#2601)."]];
+            readonly examples: readonly ["task triage:classify -- --list", "task triage:classify -- --validate", "task triage:classify -- --mirror", "task triage:classify -- --mirror --author @me --repo owner/name", "task triage:classify -- --mirror --repo owner/name --json", "task triage:classify -- --mirror --apply --repo owner/name --batch-size 10 --delay-ms 1000", "task triage:classify -- --mirror --re-enrich --repo owner/name", "task triage:classify -- --mirror --re-enrich --apply --repo owner/name", "task triage:classify -- --mirror --include-closed --repo owner/name"];
+            readonly see_also: readonly ["task triage:bootstrap", "task triage:queue", "task vbrief:reconcile:labels", "#1119 / D10", "#1423", "#3124", "#3125", "#3129", "#3197"];
             readonly placeholder: false;
         };
         readonly "task triage:bootstrap": {

package/dist/triage/help/registry-data.js

@@ -278,9 +278,9 @@ export const registryData = {
         "task triage:classify": {
             name: "task triage:classify",
             summary: "Inspect / validate auto-classification; bootstrap mass-triage label mirror",
-            refs: "(D10 / #1129, #1423 Wave 1–2 / #3125, #3129)",
-            description: "Inspect or validate the auto-classification rule set. --list renders effective rules (framework universal first, consumer overrides next). --validate exits non-zero on a malformed plan.policy.triageAutoClassify or triageLabelMirror. --mirror is the bootstrap mass-triage entrypoint (#3125): classifies the github-issue cache and mirrors outcomes as SCM labels. Open-only by default (opt-in --include-closed); optional --author LOGIN scopes plan/apply to matching author.login (AND with open-only; #3129); dry-run digest shows totals + by state/rule/action + samples and surfaces the author filter; --apply batches writes with rate-limit delay. Never calls triage:accept / never writes proposed/ xBRIEFs.",
-            usage: "task triage:classify -- [--list | --validate | --mirror [--apply] [--include-closed] [--author LOGIN|@me] [--repo owner/name] [--batch-size N] [--delay-ms N] [--sample-limit N] [--json] [--allow-cross-repo]]",
+            refs: "(D10 / #1129, #1423 Wave 1–2 / #3125, #3129, #3197)",
+            description: "Inspect or validate the auto-classification rule set. --list renders effective rules (framework universal first, consumer overrides next). --validate exits non-zero on a malformed plan.policy.triageAutoClassify or triageLabelMirror. --mirror is the bootstrap mass-triage entrypoint (#3125): classifies the github-issue cache and mirrors outcomes as SCM labels. Open-only by default (opt-in --include-closed); optional --author LOGIN scopes plan/apply to matching author.login (AND with open-only; #3129). Default re-run skips already-stamped (idempotency) issues; after policy/rule changes use --re-enrich to re-classify already-triaged issues and plan additive label deltas only (#3197; re-run vs re-enrich discovery #3124). Dry-run digest shows totals + by state/rule/action + samples, first-time vs re-enrich planned rows, and surfaces the author filter; --apply batches writes with rate-limit delay. Never calls triage:accept / never writes proposed/ xBRIEFs.",
+            usage: "task triage:classify -- [--list | --validate | --mirror [--apply] [--re-enrich] [--include-closed] [--author LOGIN|@me] [--repo owner/name] [--batch-size N] [--delay-ms N] [--sample-limit N] [--json] [--allow-cross-repo]]",
             flags: [
                 ["--list", "(default)", "Print effective rules + hold markers."],
                 ["--validate", "(off)", "Validate plan.policy.triageAutoClassify + triageLabelMirror."],
@@ -294,6 +294,11 @@ export const registryData = {
                     "(off)",
                     "With --mirror: write labels via SCM (batched; requires github SCM boundary).",
                 ],
+                [
+                    "--re-enrich",
+                    "(off)",
+                    "With --mirror: re-classify already-stamped issues; plan additive label deltas only (dry-run default; #3197 / #3124 re-run vs re-enrich).",
+                ],
                 [
                     "--include-closed",
                     "(off)",
@@ -319,6 +324,8 @@ export const registryData = {
                 "task triage:classify -- --mirror --author @me --repo owner/name",
                 "task triage:classify -- --mirror --repo owner/name --json",
                 "task triage:classify -- --mirror --apply --repo owner/name --batch-size 10 --delay-ms 1000",
+                "task triage:classify -- --mirror --re-enrich --repo owner/name",
+                "task triage:classify -- --mirror --re-enrich --apply --repo owner/name",
                 "task triage:classify -- --mirror --include-closed --repo owner/name",
             ],
             see_also: [
@@ -327,8 +334,10 @@ export const registryData = {
                 "task vbrief:reconcile:labels",
                 "#1119 / D10",
                 "#1423",
+                "#3124",
                 "#3125",
                 "#3129",
+                "#3197",
             ],
             placeholder: false,
         },

package/dist/vbrief-activate/activate.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, unlinkSync, } from "node:fs";
 import { basename, dirname, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
+import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { utcNowIso } from "../scope/vbrief-json.js";
 import { pythonJsonPretty } from "../vbrief-build/json.js";
 import { ACTIVE_FOLDER, ELIGIBLE_STATUSES_FOR_FLIP, formatEligibleStatusList, SOURCE_FOLDERS, TARGET_STATUS, } from "./constants.js";
@@ -120,6 +121,22 @@ export function activate(vbriefPath, options = {}) {
                 `'${TARGET_STATUS}'.`,
         };
     }
+    // Resolve destination early so containment can refuse before any mutation.
+    // Parity with scope:activate / #2447: projectRoot is parent of the xbrief/ root.
+    const vbriefDir = dirname(dirname(vbriefPath));
+    const projectRoot = dirname(vbriefDir);
+    const activeDir = `${vbriefDir}/${ACTIVE_FOLDER}`;
+    try {
+        // #3147 / #2447: refuse when active/ (or a parent) is a symlink escaping the checkout.
+        // Run before mutating the source payload or unlinking pending so a refusal leaves state intact.
+        assertProjectionContained(projectRoot, activeDir);
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            return { exitCode: 1, message: err.message };
+        }
+        throw err;
+    }
     planObj.status = TARGET_STATUS;
     let info = payload.vBRIEFInfo;
     if (info === undefined) {
@@ -133,8 +150,6 @@ export function activate(vbriefPath, options = {}) {
         };
     }
     info.updated = utcNowIso(now);
-    const vbriefDir = dirname(dirname(vbriefPath));
-    const activeDir = `${vbriefDir}/${ACTIVE_FOLDER}`;
     try {
         mkdirSync(activeDir, { recursive: true });
     }
@@ -151,13 +166,14 @@ export function activate(vbriefPath, options = {}) {
                 "collision manually before re-running `task vbrief:activate`.",
         };
     }
-    const tmpBase = `${fileName}.tmp`;
     const tmp = `${dest}.tmp`;
     try {
-        // #2980 wave D: product write sink routes through containedWrite.
+        // #2980 wave D + #3147: product write sink routes through containedWrite with
+        // checkout root as containment root (not resolve(activeDir), which treats an
+        // escaping active/ realpath as "contained" relative to itself).
         containedWrite({
-            root: resolve(activeDir),
-            target: tmpBase,
+            root: resolve(projectRoot),
+            target: resolve(tmp),
             data: pythonJsonPretty(payload),
             mode: "create",
         });

package/dist/vbrief-validate/plan-hooks.d.ts

@@ -14,6 +14,10 @@ export declare function validateHostSlashCommandsOnPlan(plan: unknown, filepath:
 export declare function validateOpenClawProductCommandsOnPlan(plan: unknown, filepath: string): string[];
 /** vbrief_validate hook: validate ``plan.policy.stalenessTickler`` (#2489). */
 export declare function validateStalenessTicklerOnPlan(plan: unknown, filepath: string): string[];
+/** vbrief_validate hook: validate ``plan.policy.coverageDebt`` (#3189). */
+export declare function validateCoverageDebtOnPlan(plan: unknown, filepath: string): string[];
+/** vbrief_validate hook: validate ``plan.policy.checkResume`` (#3189). */
+export declare function validateCheckResumeOnPlan(plan: unknown, filepath: string): string[];
 /** Run all PROJECT-DEFINITION policy hooks (mirrors lazy-import block in Python). */
 export declare function runProjectDefinitionHooks(plan: unknown, filepath: string): string[];
 //# sourceMappingURL=plan-hooks.d.ts.map

package/dist/vbrief-validate/plan-hooks.js

@@ -1,3 +1,5 @@
+import { validateCheckResume } from "../policy/check-resume.js";
+import { validateCoverageDebt } from "../policy/coverage-debt.js";
 import { validateHostHooks } from "../policy/host-hooks.js";
 import { validateHostSlashCommands } from "../policy/host-slash-commands.js";
 import { readPlanPolicy } from "../policy/plan-extensions.js";
@@ -196,6 +198,51 @@ export function validateStalenessTicklerOnPlan(plan, filepath) {
     }
     return out;
 }
+/** vbrief_validate hook: validate ``plan.policy.coverageDebt`` (#3189). */
+export function validateCoverageDebtOnPlan(plan, filepath) {
+    if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
+        return [];
+    }
+    const policy = readPlanPolicy(plan);
+    if (typeof policy !== "object" || policy === null || Array.isArray(policy)) {
+        return [];
+    }
+    if (!("coverageDebt" in policy)) {
+        return [];
+    }
+    const raw = policy.coverageDebt;
+    // Explicit null is a typed key with invalid value — fail closed at validation time.
+    if (raw === null) {
+        return [`${filepath}: plan.policy.coverageDebt must be an object; got null (#3189)`];
+    }
+    const out = [];
+    for (const err of validateCoverageDebt(raw)) {
+        out.push(`${filepath}: ${err} (#3189)`);
+    }
+    return out;
+}
+/** vbrief_validate hook: validate ``plan.policy.checkResume`` (#3189). */
+export function validateCheckResumeOnPlan(plan, filepath) {
+    if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
+        return [];
+    }
+    const policy = readPlanPolicy(plan);
+    if (typeof policy !== "object" || policy === null || Array.isArray(policy)) {
+        return [];
+    }
+    if (!("checkResume" in policy)) {
+        return [];
+    }
+    const raw = policy.checkResume;
+    if (raw === null) {
+        return [`${filepath}: plan.policy.checkResume must be an object; got null (#3189)`];
+    }
+    const out = [];
+    for (const err of validateCheckResume(raw)) {
+        out.push(`${filepath}: ${err} (#3189)`);
+    }
+    return out;
+}
 /** Run all PROJECT-DEFINITION policy hooks (mirrors lazy-import block in Python). */
 export function runProjectDefinitionHooks(plan, filepath) {
     const errors = [];
@@ -266,6 +313,13 @@ export function runProjectDefinitionHooks(plan, filepath) {
     catch {
         /* hook must not break validation */
     }
+    try {
+        errors.push(...validateCoverageDebtOnPlan(plan, filepath));
+        errors.push(...validateCheckResumeOnPlan(plan, filepath));
+    }
+    catch {
+        /* hook must not break validation */
+    }
     return errors;
 }
 //# sourceMappingURL=plan-hooks.js.map