reward-risk's bestFitLabels label-exclusion regex diverges from the canonical matcher it claims to mirror

[JSONbored]

Context

packages/loopover-engine/src/reward-risk.ts's bestFitLabels (line 832-843) filters a repo's configured labelMultipliers keys to exclude "meta" labels before picking the best-fit label for a contributor-facing reward preview:

function bestFitLabels(repo: RepositoryRecord | null): string[] {
  const multipliers = repo?.registryConfig?.labelMultipliers ?? {};
  const labels = Object.entries(multipliers)
    // Exclude meta labels only at a keyword boundary (a real separator or end-of-string after the keyword),
    // not mid-word — mirroring the anchored `suspiciousConfiguredLabels` matcher in engine.ts. ...
    .filter(([label]) => !/^(status|source|contributor|verified|risk|codex)([:/-]|$)/i.test(label))
    .sort((left, right) => right[1] - left[1] || left[0].localeCompare(right[0]))
    .map(([label]) => label);
  return labels.slice(0, 1);
}

The comment explicitly claims this regex "mirror[s] the anchored suspiciousConfiguredLabels matcher in engine.ts." The actual canonical matcher, packages/loopover-engine/src/signals/engine.ts:1182, is:

const suspiciousConfiguredLabels = configuredLabels.filter((label) => /^(status|state|source|bot|codex|loopover|reward|score|miner|verified|risk)([:/-]|$)/i.test(label));

The two keyword sets diverge: bestFitLabels's regex is missing state|bot|loopover|reward|score|miner (present in the canonical list) and additionally includes contributor (not present in the canonical list at all). This is not cosmetic — bestFitLabels() feeds buildScorePreview's labels input (reward-risk.ts:281), which drives selectLabelMultiplier and ultimately the contributor-facing currentEstimatedScore/estimatedScoreIfClean reward preview. Two concrete consequences of the divergence:

• A repo configuring contributor:top-tier as its highest-multiplier label has that label silently excluded from bestFitLabels's result (understating the contributor's shown reward opportunity), even though engine.ts's own maintainer-facing "suspicious configured label" audit does NOT consider contributor:* suspicious at all — the two modules disagree about whether this is a meta/suspicious label.
• Conversely, a bot:internal-only-style label that engine.ts's audit DOES flag as suspicious is folded in full into bestFitLabels's contributor-facing score-preview candidate set, since bot isn't excluded by reward-risk.ts's narrower regex.

Requirements

• bestFitLabels's exclusion regex must match signals/engine.ts's canonical suspiciousConfiguredLabels keyword set exactly: status|state|source|bot|codex|loopover|reward|score|miner|verified|risk (no contributor).
• Do not hand-duplicate the keyword list a second time as a literal regex in reward-risk.ts — export the canonical matcher/keyword set (or a shared regex constant) from signals/engine.ts (or a common module both files can import from without introducing a circular dependency) and have bestFitLabels use it, so the two can't drift again the way this issue demonstrates they already have.
• If contributor genuinely needs to be excluded from bestFitLabels's candidate set for a real, documented reason distinct from engine.ts's suspicious-label audit, that must be a separate, explicitly-named exclusion — not silently folded into a "mirrors the canonical matcher" regex that doesn't actually mirror it. Default to matching the canonical set unless investigation turns up a real reason contributor needs separate handling; if so, note it in the PR description for maintainer review rather than guessing.

Deliverables

• bestFitLabels's label-exclusion logic sourced from (or kept byte-identical to) signals/engine.ts's canonical suspiciousConfiguredLabels keyword set, eliminating the independent hand-copied regex
• Regression test: a repo configured with a contributor:top-tier label multiplier has that label correctly available as a bestFitLabels candidate (not silently excluded)
• Regression test: a repo configured with a bot:internal-only/state:*/reward:*/score:*/miner:*/loopover:* label multiplier has that label correctly excluded from bestFitLabels, matching engine.ts's own suspicious-label classification

Test Coverage Requirements

This repo's Codecov patch gate is 99%+ hard (branch-counted) on every changed line/branch in src/**/packages/**. The regression tests above must reproduce the exact keyword-set divergence described (both directions: wrongly-excluded and wrongly-included labels) and assert both are fixed.

Expected Outcome

bestFitLabels's contributor-facing reward-preview candidate set agrees with signals/engine.ts's maintainer-facing suspicious-label audit about which configured labels are "meta" and should be excluded — no more silent under- or over-inclusion caused by the two modules' regexes having quietly diverged.

Links & Resources

packages/loopover-engine/src/reward-risk.ts:832-843 (bestFitLabels, the diverged regex), :281 (where its result feeds buildScorePreview). packages/loopover-engine/src/signals/engine.ts:1178-1182 (the canonical suspiciousConfiguredLabels matcher and its own boundary-anchoring comment, the correct set to mirror).

[linear-code]

JSO-5024