@deftai/directive-core 0.97.0 → 0.98.1

package/dist/scope-provenance/evaluate.js

@@ -203,9 +203,83 @@ function listActiveXbriefPaths(projectRoot) {
 }
 function remediationForExpansion() {
     return ("Renew human approval: re-record the approved-scope digest after operator review " +
-        "(`task scope:record-approved-scope` / write `.deft/approved-scope/<plan-id>.json` " +
-        "with humanApproval stamp). Editing the active xBRIEF alone does not authorize new " +
-        "paths (#3145). See content/docs/scope-provenance.md.");
+        "(`task scope:record-approved-scope -- <xbrief-path> --actor <you>` writes " +
+        "`.deft/approved-scope/<plan-id>.json` with a humanApproval stamp). Commit that " +
+        "approval on the merge base (or a prior PR) before expanding or activating the " +
+        "scoped xBRIEF in the implementation change set. Editing the active xBRIEF alone " +
+        "does not authorize new paths (#3145 / #3205). See content/docs/scope-provenance.md.");
+}
+/**
+ * Parse + lightly validate an approved-scope JSON blob (base-ref `git show` or disk).
+ * Returns null when schema fields required for authorization are missing/malformed.
+ */
+export function parseApprovedScopeRecordRaw(raw) {
+    try {
+        const data = JSON.parse(raw);
+        if (data === null || typeof data !== "object" || Array.isArray(data))
+            return null;
+        const rec = data;
+        if (rec.schemaVersion !== undefined && rec.schemaVersion !== 1)
+            return null;
+        if (typeof rec.planId !== "string" || rec.planId.trim().length === 0)
+            return null;
+        if (typeof rec.xbriefRelPath !== "string" || rec.xbriefRelPath.trim().length === 0) {
+            return null;
+        }
+        if (typeof rec.fileScopeDigest !== "string" || rec.fileScopeDigest.length === 0) {
+            return null;
+        }
+        if (!Array.isArray(rec.fileScope))
+            return null;
+        // Digest must match the recorded path list — never trust a forged digest alone (#3205 Greptile).
+        const scopePaths = rec.fileScope.filter((x) => typeof x === "string");
+        const expected = computeFileScopeDigest(scopePaths);
+        if (rec.fileScopeDigest !== expected)
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when the merge-base approved-scope record authorizes the current scope and
+ * the current disk record is semantically unchanged from that base authority (#3205).
+ *
+ * Authority comes from the approval record on the base, not from whether the active
+ * xBRIEF path existed on the base (pending→active is the normal first activation).
+ */
+export function baseApprovalAuthorizesCurrent(input) {
+    if (input.baseRef === null || input.baseRef === "")
+        return false;
+    const baseRaw = readRepoFileAtRef(input.projectRoot, input.baseRef, input.approvalRecordRel);
+    if (baseRaw === null)
+        return false;
+    const baseRec = parseApprovedScopeRecordRaw(baseRaw);
+    if (baseRec === null)
+        return false;
+    if (!isHumanApprovalStamp(baseRec.humanApproval))
+        return false;
+    if (baseRec.planId !== input.planId)
+        return false;
+    if (normalizeRepoRelPath(baseRec.xbriefRelPath) !== normalizeRepoRelPath(input.xbriefRelPath)) {
+        return false;
+    }
+    // Base record must authorize the *current* file_scope (digest match).
+    if (baseRec.fileScopeDigest !== input.currentDigest)
+        return false;
+    // Current on-disk/injected record must not diverge from base authority fields.
+    if (input.currentApproved.fileScopeDigest !== baseRec.fileScopeDigest)
+        return false;
+    if (input.currentApproved.planId !== baseRec.planId)
+        return false;
+    if (normalizeRepoRelPath(input.currentApproved.xbriefRelPath) !==
+        normalizeRepoRelPath(baseRec.xbriefRelPath)) {
+        return false;
+    }
+    if (!isHumanApprovalStamp(input.currentApproved.humanApproval))
+        return false;
+    return true;
 }
 function configError(message) {
     return { exitCode: 2, findings: [], message };
@@ -250,13 +324,42 @@ export function evaluateOneScopeProvenance(input) {
         isHumanApprovalStamp(input.approved.humanApproval)) {
         return null;
     }
+    // Matching digest without human origin: empty-scope body edits may soft-warn
+    // via the missing-digest path only when no usable approval; agent/malformed
+    // stamps must not authorize non-empty scopes (#3205).
+    if (input.approved.fileScopeDigest === currentDigest) {
+        if (currentScope.length === 0) {
+            return null;
+        }
+        if (!isHumanApprovalStamp(input.approved.humanApproval)) {
+            return {
+                xbriefRelPath: input.xbriefRelPath,
+                planId,
+                kind: "active-xbrief-modified-without-digest",
+                expandedPaths: currentScope,
+                detail: "active xBRIEF modified with a non-human (agent/missing) approved-scope stamp; " +
+                    "only humanApproval stamps authorize non-empty file_scope",
+                remediation: "Record a human-origin approval via `task scope:record-approved-scope -- " +
+                    "<xbrief-path> --actor <you>` (#3145 / #3205).",
+            };
+        }
+    }
     const expanded = scopeExpansion(input.approved.fileScope, currentScope);
     if (expanded.length === 0) {
-        // Scope shrink or identical after normalize — body edit without expansion is OK
-        if (input.approved.fileScopeDigest === currentDigest) {
-            return null;
+        // Scope shrink or digest noise without path expansion — OK for v1 when human-stamped.
+        // Non-empty current scope still requires human origin (agent shrink must not bypass #3205).
+        if (currentScope.length > 0 && !isHumanApprovalStamp(input.approved.humanApproval)) {
+            return {
+                xbriefRelPath: input.xbriefRelPath,
+                planId,
+                kind: "active-xbrief-modified-without-digest",
+                expandedPaths: currentScope,
+                detail: "active xBRIEF modified with a non-human approved-scope stamp (scope shrink/noise path); " +
+                    "only humanApproval stamps authorize non-empty file_scope",
+                remediation: "Record a human-origin approval via `task scope:record-approved-scope -- " +
+                    "<xbrief-path> --actor <you>` (#3145 / #3205).",
+            };
         }
-        // Digest mismatch without path expansion (reorder/noise) — still OK for v1
         return null;
     }
     // Expansion without renewed human approval = self-authorization
@@ -303,10 +406,18 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
             if (baseRef === undefined || baseRef === "" || baseRef === "HEAD") {
                 const resolved = resolveDefaultBaseRef(root);
                 if (resolved === null) {
-                    return configError("verify_scope_provenance: no merge-base ref found (origin/master|main, " +
-                        "DEFT_BASE_REF, or GITHUB_BASE_REF).\n" +
-                        "  Recovery: fetch the default branch or pass --base-ref <ref>. " +
-                        "Bare HEAD cannot see committed PR scope expansion (#3145).");
+                    // Greenfield / single-commit consumer trees often have no origin/* and no
+                    // default-branch ref yet. Fail closed only when the caller demanded an
+                    // explicit --base-ref; otherwise soft-skip (same posture as non-git trees)
+                    // so verify:scope-provenance does not brick `task check` on init (#3205 smoke).
+                    return {
+                        exitCode: 0,
+                        findings: [],
+                        message: "verify_scope_provenance: skipped -- no merge-base ref found " +
+                            "(origin/master|main, DEFT_BASE_REF, or GITHUB_BASE_REF). " +
+                            "Fetch the default branch or pass --base-ref <ref> before enforcing " +
+                            "PR scope expansion (#3145 / #3205).",
+                    };
                 }
                 baseRef = resolved;
             }
@@ -412,38 +523,36 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
                 return (n.includes("/approved-scope/") &&
                     (n.endsWith(`/${safe}.json`) || n.endsWith(`${safe}.json`)));
             });
-        // Ignored / untracked approved-scope files never appear in git changedSet.
-        // Concurrent rewrite attack: scope *expanded* vs base AND an untracked disk
-        // approval was rewritten to match the *new* digest. Body-only xBRIEF edits
-        // with a pre-existing matching approval must NOT fail (Greptile conf=2).
+        // Disk-only / concurrent-rewrite inference (#3205):
+        // Authority is the *approval record on the merge base*, not whether the
+        // active xBRIEF path existed there. pending→active leaves the active path
+        // absent on base; treating that as an approval rewrite is a false positive.
+        // Fail closed when base approval is missing, malformed, agent-stamped,
+        // path/plan/digest mismatched, or the current record diverged from base.
+        // Same-PR git changes still hard-fail via approvalInGitChange.
         let approvalDiskOnly = false;
         if (modified &&
             approved !== null &&
             renewed === null &&
             approvalRecordRel !== null &&
+            planId !== null &&
             !approvalInGitChange &&
             existsSync(join(root, approvalRecordRel)) &&
             isHumanApprovalStamp(approved.humanApproval)) {
             const currentDigest = computeFileScopeDigest(normalizeFileScope(extractFileScope(payload)));
             if (approved.fileScopeDigest === currentDigest) {
-                const baseRaw = discoveryBaseRef !== null ? readRepoFileAtRef(root, discoveryBaseRef, rel) : null;
-                if (baseRaw === null) {
-                    // New active xBRIEF with untracked matching approval → fail closed.
+                const baseAuthorizes = baseApprovalAuthorizesCurrent({
+                    projectRoot: root,
+                    baseRef: discoveryBaseRef,
+                    approvalRecordRel,
+                    planId,
+                    xbriefRelPath: rel,
+                    currentDigest,
+                    currentApproved: approved,
+                });
+                if (!baseAuthorizes) {
                     approvalDiskOnly = true;
                 }
-                else {
-                    try {
-                        const basePayload = JSON.parse(baseRaw);
-                        const baseDigest = computeFileScopeDigest(normalizeFileScope(extractFileScope(basePayload)));
-                        // Only concurrent-rewrite when file-scope actually grew/changed.
-                        if (baseDigest !== currentDigest) {
-                            approvalDiskOnly = true;
-                        }
-                    }
-                    catch {
-                        approvalDiskOnly = true;
-                    }
-                }
             }
         }
         const approvalRecordRewritten = approvalInGitChange || approvalDiskOnly;
@@ -463,8 +572,9 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
                 expandedPaths: currentScope,
                 detail: "approved-scope record rewritten in the same change set as the active xBRIEF; " +
                     "cannot self-authorize via concurrent approval rewrite",
-                remediation: "Record renewed human approval outside the implementation PR (or pass an " +
-                    "independent renewed stamp). Same-PR approval rewrites do not authorize expansion (#3145).",
+                remediation: "Commit human approval via `task scope:record-approved-scope` on the merge base " +
+                    "(or a prior PR), then activate/expand without rewriting the approval in this " +
+                    "change set. Same-PR approval rewrites do not authorize expansion (#3145 / #3205).",
             });
             continue;
         }

package/dist/scope-provenance/index.d.ts

@@ -2,5 +2,5 @@
  * scope-provenance package surface (#3145).
  */
 export { APPROVED_SCOPE_DIR, type ApprovedScopeRecord, approvedScopeDir, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
-export { evaluateOneScopeProvenance, evaluateScopeProvenance, resolveDefaultBaseRef, type ScopeProvenanceFinding, type ScopeProvenanceOptions, type ScopeProvenanceResult, type ScopeProvenanceViolationKind, } from "./evaluate.js";
+export { baseApprovalAuthorizesCurrent, evaluateOneScopeProvenance, evaluateScopeProvenance, parseApprovedScopeRecordRaw, resolveDefaultBaseRef, type ScopeProvenanceFinding, type ScopeProvenanceOptions, type ScopeProvenanceResult, type ScopeProvenanceViolationKind, } from "./evaluate.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/scope-provenance/index.js

@@ -2,5 +2,5 @@
  * scope-provenance package surface (#3145).
  */
 export { APPROVED_SCOPE_DIR, approvedScopeDir, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
-export { evaluateOneScopeProvenance, evaluateScopeProvenance, resolveDefaultBaseRef, } from "./evaluate.js";
+export { baseApprovalAuthorizesCurrent, evaluateOneScopeProvenance, evaluateScopeProvenance, parseApprovedScopeRecordRaw, resolveDefaultBaseRef, } from "./evaluate.js";
 //# sourceMappingURL=index.js.map

package/dist/session/coverage-check-resume-nudge.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Session-start skippable nudge for coverageDebt + checkResume (#3189).
+ *
+ * Why / what + Strict / Hatch-aware / Later (+ Discuss / Back for #1470).
+ * Later does not mark decided; re-nag next interactive mutation ritual.
+ * Headless / CI / non-TTY fail-open (no block).
+ */
+import { type HeadlessDetectionOptions } from "../product-signal/headless.js";
+/** Why block -- must appear in the nudge. */
+export declare const COVERAGE_CHECK_RESUME_NUDGE_WHY: string;
+/** What block -- bundled presets, not five micro-toggles. */
+export declare const COVERAGE_CHECK_RESUME_NUDGE_WHAT: string;
+export declare const COVERAGE_CHECK_RESUME_NUDGE_BODY: string;
+export interface CoverageCheckResumeNudgeEligibilityOptions extends HeadlessDetectionOptions {
+    readonly projectRoot: string;
+}
+/**
+ * True when an interactive mutation session-start ritual should surface the
+ * coverage/check-resume decision nudge (#3189).
+ */
+export declare function isCoverageCheckResumeNudgeEligible(options: CoverageCheckResumeNudgeEligibilityOptions): boolean;
+/** Format the full operator-facing nudge. */
+export declare function formatCoverageCheckResumeNudge(): string;
+/**
+ * Emit the nudge when eligible; headless / decided callers get an empty string.
+ * Never blocks -- session-start always continues.
+ *
+ * Design note (#3189): session-start is non-interactive for agent hosts (same
+ * class as product-signal D17). Choice dispatch is via CLI verbs named in the
+ * nudge body (`policy:coverage-check-resume-preset|later|dismiss`), not a
+ * blocking TTY menu inside session:start.
+ */
+export declare function maybeFormatCoverageCheckResumeNudge(options: CoverageCheckResumeNudgeEligibilityOptions): string;
+//# sourceMappingURL=coverage-check-resume-nudge.d.ts.map

package/dist/session/coverage-check-resume-nudge.js

@@ -0,0 +1,66 @@
+/**
+ * Session-start skippable nudge for coverageDebt + checkResume (#3189).
+ *
+ * Why / what + Strict / Hatch-aware / Later (+ Discuss / Back for #1470).
+ * Later does not mark decided; re-nag next interactive mutation ritual.
+ * Headless / CI / non-TTY fail-open (no block).
+ */
+import { isCoverageCheckResumeUndecided } from "../policy/coverage-check-resume-presets.js";
+import { policyColonInvocation } from "../policy/policy-invocation.js";
+import { isHeadlessSession } from "../product-signal/headless.js";
+/** Why block -- must appear in the nudge. */
+export const COVERAGE_CHECK_RESUME_NUDGE_WHY = "Why: Long checks often fail late on small gates, or barely miss coverage. " +
+    "The project can fail closed, warn, or hatch with a tracked debt issue on THIS repo. " +
+    "Local machines may resume a suite that already passed at the same commit; " +
+    "CI must not trust a laptop stamp.";
+/** What block -- bundled presets, not five micro-toggles. */
+export const COVERAGE_CHECK_RESUME_NUDGE_WHAT = "What we need: one bundled project decision (not USER.md personal prefs; not npm publish; " +
+    "not turning off required CI):\n" +
+    "  * Strict (recommended for most apps) -- coverageDebt.mode=off, checkResume.localStamp=off\n" +
+    "  * Hatch-aware -- coverageDebt.mode=hatch (autoFile=false by default), localStamp=on for DX\n" +
+    "  * Later -- skip this session; does NOT set status=decided; nag again next ritual\n" +
+    "  * Discuss -- talk through the trade-offs\n" +
+    "  * Back -- leave this prompt without choosing\n" +
+    "Apply path (writes PROJECT-DEFINITION):\n" +
+    "  Strict -> `" +
+    policyColonInvocation("coverage-check-resume-preset", " -- --preset strict") +
+    "`\n" +
+    "  Hatch-aware -> `" +
+    policyColonInvocation("coverage-check-resume-preset", " -- --preset hatch-aware") +
+    "`\n" +
+    "  Later -> `" +
+    policyColonInvocation("coverage-check-resume-later") +
+    "` (no PD write)\n" +
+    "  Dismiss-with-reason -> `" +
+    policyColonInvocation("coverage-check-resume-dismiss", ' -- --reason "…"') +
+    "`\n" +
+    "Stop nag only after Strict / Hatch-aware (status=decided) or dismiss-with-reason " +
+    `(visible via \`${policyColonInvocation("show", " --field=coverageDebt")}\` / doctor).`;
+export const COVERAGE_CHECK_RESUME_NUDGE_BODY = `${COVERAGE_CHECK_RESUME_NUDGE_WHY}\n\n${COVERAGE_CHECK_RESUME_NUDGE_WHAT}`;
+/**
+ * True when an interactive mutation session-start ritual should surface the
+ * coverage/check-resume decision nudge (#3189).
+ */
+export function isCoverageCheckResumeNudgeEligible(options) {
+    if (isHeadlessSession(options)) {
+        return false;
+    }
+    return isCoverageCheckResumeUndecided(options.projectRoot);
+}
+/** Format the full operator-facing nudge. */
+export function formatCoverageCheckResumeNudge() {
+    return `[deft policy] coverageDebt + checkResume undecided:\n${COVERAGE_CHECK_RESUME_NUDGE_BODY}\n`;
+}
+/**
+ * Emit the nudge when eligible; headless / decided callers get an empty string.
+ * Never blocks -- session-start always continues.
+ *
+ * Design note (#3189): session-start is non-interactive for agent hosts (same
+ * class as product-signal D17). Choice dispatch is via CLI verbs named in the
+ * nudge body (`policy:coverage-check-resume-preset|later|dismiss`), not a
+ * blocking TTY menu inside session:start.
+ */
+export function maybeFormatCoverageCheckResumeNudge(options) {
+    return isCoverageCheckResumeNudgeEligible(options) ? formatCoverageCheckResumeNudge() : "";
+}
+//# sourceMappingURL=coverage-check-resume-nudge.js.map

package/dist/session/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./compact-ritual.js";
+export * from "./coverage-check-resume-nudge.js";
 export * from "./git.js";
 export * from "./json.js";
 export * from "./openclaw-soft-rebind-deposit.js";

package/dist/session/index.js

@@ -1,4 +1,5 @@
 export * from "./compact-ritual.js";
+export * from "./coverage-check-resume-nudge.js";
 export * from "./git.js";
 export * from "./json.js";
 export * from "./openclaw-soft-rebind-deposit.js";

package/dist/session/session-start.js

@@ -18,6 +18,7 @@ import { runDefaultMode } from "../triage/welcome/default-mode.js";
 import { resolveUserMdPath } from "../user-config/resolve-user-md.js";
 import { emitSessionValueReadback } from "../value/readback.js";
 import { verifyRequiredTools } from "../verify-env/verify-tools.js";
+import { maybeFormatCoverageCheckResumeNudge } from "./coverage-check-resume-nudge.js";
 import { defaultGitRunner, gitHead, gitIsAncestor, worktreePath } from "./git.js";
 import { emitSessionStartProcessCost } from "./process-cost.js";
 import { probeSessionReleaseAvailability, } from "./release-availability.js";
@@ -433,6 +434,16 @@ function runSessionRearm(projectRoot, options, instant, environment) {
     if (humanMergeLine !== null) {
         lines.push(humanMergeLine);
     }
+    // #3189: re-arm still surfaces undecided coverage/check-resume once per ritual.
+    try {
+        const coverageNudge = maybeFormatCoverageCheckResumeNudge({ projectRoot });
+        if (coverageNudge.length > 0) {
+            lines.push(coverageNudge.trimEnd());
+        }
+    }
+    catch {
+        // best-effort — re-arm must not abort
+    }
     const priorQuick = eligibility.state.quickSteps;
     const priorTriage = priorQuick.triage_welcome ?? ritualStep({ ok: true, ts: instant });
     const policyOk = policyResult.error === null || policyResult.source === "default-fail-closed";
@@ -863,6 +874,16 @@ export function runSessionStart(projectRoot, options = {}) {
     if (consentPrompt.length > 0) {
         lines.push(consentPrompt.trimEnd());
     }
+    // #3189: skippable coverageDebt/checkResume project-decision nudge (fail-open; never blocks).
+    try {
+        const coverageNudge = maybeFormatCoverageCheckResumeNudge({ projectRoot });
+        if (coverageNudge.length > 0) {
+            lines.push(coverageNudge.trimEnd());
+        }
+    }
+    catch {
+        // best-effort operator advisory — session start must not abort
+    }
     const writeStarted = performance.now();
     const coldSessionId = (options.newSessionId ?? randomUUID)();
     const payload = newRitualStatePayload({

package/dist/triage/classify/label-mirror.d.ts

@@ -1,5 +1,5 @@
 /**
- * Tier-1 deterministic SCM label mirror (#1423 Wave 1 + Wave 2 bootstrap).
+ * Tier-1 deterministic SCM label mirror (#1423 Wave 1 + Wave 2 bootstrap + #3197 re-enrich).
  *
  * Classifies cached issues with the existing #1129 engine, then mirrors the
  * outcome as SCM labels (dry-run default, --apply to write). Never accepts into
@@ -9,6 +9,10 @@
  * + samples), batched rate-limit-aware apply. Bootstrap mass-triage entrypoint is
  * `triage:classify -- --mirror` with these filters (not triage:accept).
  *
+ * #3197 re-enrich: default keeps one-shot skip on idempotencyLabel; opt-in
+ * `--re-enrich` re-classifies already-stamped issues and plans **additive**
+ * label deltas only (v1; no removals / no full reconcile).
+ *
  * Intentionally does NOT import from ./index.js (SLizard P1 cycle). The classify
  * engine is injected via LabelMirrorEngine / mirrorLabels() wrapper in index.ts.
  */
@@ -98,6 +102,12 @@ export interface LabelMirrorItem {
     readonly add: readonly string[];
     readonly status: LabelMirrorStatus;
     readonly message?: string;
+    /**
+     * True when this row re-planned an issue that already carried the idempotency
+     * label under opt-in re-enrich mode (#3197). Distinguishes first-time stamp
+     * rows from re-enrich additive backfill in dry-run digests.
+     */
+    readonly re_enrich?: boolean;
 }
 /** Operator digest aggregates for bootstrap mass-triage (#3125 / #1423 Wave 2). */
 export interface LabelMirrorDigest {
@@ -116,6 +126,8 @@ export interface LabelMirrorFilters {
     readonly author: string | null;
     /** Resolved author logins for machine consumers. */
     readonly author_logins: readonly string[] | null;
+    /** Whether this run used opt-in re-enrich mode (#3197). */
+    readonly re_enrich: boolean;
 }
 export interface LabelMirrorOutcome {
     readonly project_root: string;
@@ -132,6 +144,16 @@ export interface LabelMirrorOutcome {
     /** Issues skipped by --author filter (#3129). */
     readonly skipped_author: number;
     readonly errors: number;
+    /**
+     * Planned rows that re-enriched already-stamped issues (subset of planned; #3197).
+     * Zero when re_enrich mode is off.
+     */
+    readonly re_enrich_planned: number;
+    /**
+     * Applied rows that re-enriched already-stamped issues (subset of applied; #3197).
+     * Zero when re_enrich mode is off.
+     */
+    readonly re_enrich_applied: number;
     readonly filters: LabelMirrorFilters;
     readonly digest: LabelMirrorDigest;
     readonly items: readonly LabelMirrorItem[];
@@ -169,6 +191,14 @@ export interface LabelMirrorOptions {
     readonly delayMs?: number;
     /** Injectable sleep for tests (receives ms). Default busy-wait when delayMs > 0. */
     readonly sleepMs?: LabelMirrorSleepFn;
+    /**
+     * Opt-in re-enrich mode (#3197): re-classify issues that already carry the
+     * idempotency label and plan **additive** label deltas only (no removals).
+     * Default false preserves one-shot `skipped_already_triaged` behavior.
+     * Still dry-run by default; pair with dryRun:false / CLI `--apply` to write.
+     * Never triage:accept / never xBRIEF writes.
+     */
+    readonly reEnrich?: boolean;
     /** Required: classify engine (provided by classify/index mirrorLabels wrapper). */
     readonly engine: LabelMirrorEngine;
 }