diff --git a/lib/services/phishing-detector.ts b/lib/services/phishing-detector.ts
index a732c2c..54349b5 100644
--- a/lib/services/phishing-detector.ts
+++ b/lib/services/phishing-detector.ts
@@ -188,7 +188,19 @@ export async function detectPhishingTicket(
     );
 
     if (existing.rowCount && existing.rowCount > 0 && existing.rows[0].content_hash === contentHash) {
-      return { flagged: true, skippedUnchanged: true };
+      // Content unchanged (D-04): skip full reprocessing (title/description/
+      // matched_patterns/content_hash rewriting would be a no-op anyway).
+      // But the evidence snapshot (notes, time entries, attachments) can
+      // still drift after the first detection — an analyst can add a note,
+      // log time, or attach a file without touching title/description. Refresh
+      // the evidence snapshot on every call regardless of the content-hash
+      // gate so later phases never read a stale snapshot.
+      const refreshedEvidence = await gatherTicketEvidence(ticket);
+      await postgresClient.query(
+        `UPDATE reports SET evidence = $1::jsonb, updated_at = NOW() WHERE ticket_id = $2`,
+        [JSON.stringify(refreshedEvidence), ticket.id]
+      );
+      return { flagged: true, reportId: existing.rows[0].id, skippedUnchanged: true };
     }
 
     const evidence = await gatherTicketEvidence(ticket);