@oss-scout/mcp 0.9.0 → 0.10.1

package/dist/mcp-server.bundle.cjs

@@ -3100,15 +3100,16 @@ var require_data = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js
+// ../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/utils.js
 var require_utils = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/utils.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/utils.js"(exports2, module2) {
     "use strict";
     var isUUID = RegExp.prototype.test.bind(/^[\da-f]{8}-[\da-f]{4}-[\da-f]{4}-[\da-f]{4}-[\da-f]{12}$/iu);
     var isIPv4 = RegExp.prototype.test.bind(/^(?:(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)\.){3}(?:25[0-5]|2[0-4]\d|1\d{2}|[1-9]\d|\d)$/u);
     var isHexPair = RegExp.prototype.test.bind(/^[\da-f]{2}$/iu);
     var isUnreserved = RegExp.prototype.test.bind(/^[\da-z\-._~]$/iu);
     var isPathCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/]$/iu);
+    var isQueryFragmentCharacter = RegExp.prototype.test.bind(/^[\da-z\-._~!$&'()*+,;=:@/?]$/iu);
     function stringArrayToHexStripped(input) {
       let acc = "";
       let code = 0;
@@ -3251,7 +3252,7 @@ var require_utils = __commonJS({
               continue;
             }
           } else if (input[0] === "/") {
-            if (input[1] === "." || input[1] === "/") {
+            if (input[1] === ".") {
               output.push("/");
               break;
             }
@@ -3333,10 +3334,30 @@ var require_utils = __commonJS({
       }
       return output;
     }
+    var BYTE_HEX = new Array(256);
+    {
+      const HEX_DIGITS = "0123456789ABCDEF";
+      for (let i = 0; i < 256; i++) {
+        BYTE_HEX[i] = "%" + HEX_DIGITS[i >> 4] + HEX_DIGITS[i & 15];
+      }
+    }
+    function isEscapeSafe(cp) {
+      return cp >= 48 && cp <= 57 || cp >= 65 && cp <= 90 || cp >= 97 && cp <= 122 || cp === 42 || cp === 43 || cp === 45 || cp === 46 || cp === 47 || cp === 64 || cp === 95;
+    }
+    function percentEncodeNonAscii(cp) {
+      if (cp < 2048) {
+        return BYTE_HEX[192 | cp >> 6] + BYTE_HEX[128 | cp & 63];
+      }
+      if (cp < 65536) {
+        return BYTE_HEX[224 | cp >> 12] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+      }
+      return BYTE_HEX[240 | cp >> 18] + BYTE_HEX[128 | cp >> 12 & 63] + BYTE_HEX[128 | cp >> 6 & 63] + BYTE_HEX[128 | cp & 63];
+    }
     function normalizePathEncoding(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        if (input[i] === "%" && i + 2 < input.length) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
           const hex3 = input.slice(i + 1, i + 3);
           if (isHexPair(hex3)) {
             const normalizedHex = hex3.toUpperCase();
@@ -3350,10 +3371,66 @@ var require_utils = __commonJS({
             continue;
           }
         }
-        if (isPathCharacter(input[i])) {
-          output += input[i];
+        if (isPathCharacter(ch)) {
+          output += ch;
+        } else {
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        }
+      }
+      return output;
+    }
+    function normalizeQueryFragmentEncoding(input) {
+      let output = "";
+      for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
+          const hex3 = input.slice(i + 1, i + 3);
+          if (isHexPair(hex3)) {
+            const normalizedHex = hex3.toUpperCase();
+            const decoded = String.fromCharCode(parseInt(normalizedHex, 16));
+            if (isUnreserved(decoded)) {
+              output += decoded;
+            } else {
+              output += "%" + normalizedHex;
+            }
+            i += 2;
+            continue;
+          }
+        }
+        if (isQueryFragmentCharacter(ch)) {
+          output += ch;
         } else {
-          output += escape(input[i]);
+          const code = input.charCodeAt(i);
+          if (code < 128) {
+            output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+          } else if (code < 55296 || code > 57343) {
+            output += percentEncodeNonAscii(code);
+          } else if (code <= 56319 && i + 1 < input.length) {
+            const low = input.charCodeAt(i + 1);
+            if (low >= 56320 && low <= 57343) {
+              output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+              i++;
+            } else {
+              output += percentEncodeNonAscii(65533);
+            }
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
         }
       }
       return output;
@@ -3361,7 +3438,8 @@ var require_utils = __commonJS({
     function escapePreservingEscapes(input) {
       let output = "";
       for (let i = 0; i < input.length; i++) {
-        if (input[i] === "%" && i + 2 < input.length) {
+        const ch = input[i];
+        if (ch === "%" && i + 2 < input.length) {
           const hex3 = input.slice(i + 1, i + 3);
           if (isHexPair(hex3)) {
             output += "%" + hex3.toUpperCase();
@@ -3369,7 +3447,22 @@ var require_utils = __commonJS({
             continue;
           }
         }
-        output += escape(input[i]);
+        const code = input.charCodeAt(i);
+        if (code < 128) {
+          output += isEscapeSafe(code) ? ch : BYTE_HEX[code];
+        } else if (code < 55296 || code > 57343) {
+          output += percentEncodeNonAscii(code);
+        } else if (code <= 56319 && i + 1 < input.length) {
+          const low = input.charCodeAt(i + 1);
+          if (low >= 56320 && low <= 57343) {
+            output += percentEncodeNonAscii(65536 + (code - 55296 << 10) + (low - 56320));
+            i++;
+          } else {
+            output += percentEncodeNonAscii(65533);
+          }
+        } else {
+          output += percentEncodeNonAscii(65533);
+        }
       }
       return output;
     }
@@ -3403,6 +3496,7 @@ var require_utils = __commonJS({
       reescapeHostDelimiters,
       normalizePercentEncoding,
       normalizePathEncoding,
+      normalizeQueryFragmentEncoding,
       escapePreservingEscapes,
       removeDotSegments,
       isIPv4,
@@ -3413,9 +3507,9 @@ var require_utils = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js
+// ../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/schemes.js
 var require_schemes = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/lib/schemes.js"(exports2, module2) {
     "use strict";
     var { isUUID } = require_utils();
     var URN_REG = /([\da-z][\d\-a-z]{0,31}):((?:[\w!$'()*+,\-.:;=@]|%[\da-f]{2})+)/iu;
@@ -3623,11 +3717,11 @@ var require_schemes = __commonJS({
   }
 });
 
-// ../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js
+// ../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/index.js
 var require_fast_uri = __commonJS({
-  "../../node_modules/.pnpm/fast-uri@3.1.2/node_modules/fast-uri/index.js"(exports2, module2) {
+  "../../node_modules/.pnpm/fast-uri@4.1.2/node_modules/fast-uri/index.js"(exports2, module2) {
     "use strict";
-    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
+    var { normalizeIPv6, removeDotSegments, recomposeAuthority, normalizePercentEncoding, normalizePathEncoding, normalizeQueryFragmentEncoding, escapePreservingEscapes, reescapeHostDelimiters, isIPv4, nonSimpleDomain } = require_utils();
     var { SCHEMES, getSchemeHandler } = require_schemes();
     function normalize(uri, options) {
       if (typeof uri === "string") {
@@ -3641,7 +3735,12 @@ var require_fast_uri = __commonJS({
     }
     function resolve(baseURI, relativeURI, options) {
       const schemelessOptions = options ? Object.assign({ scheme: "null" }, options) : { scheme: "null" };
-      const resolved = resolveComponent(parse4(baseURI, schemelessOptions), parse4(relativeURI, schemelessOptions), schemelessOptions, true);
+      const { parsed: baseParsed, malformedAuthorityOrPort: baseMalformed } = parseWithStatus(baseURI, schemelessOptions);
+      const { parsed: relativeParsed, malformedAuthorityOrPort: relativeMalformed } = parseWithStatus(relativeURI, schemelessOptions);
+      if (baseMalformed || relativeMalformed) {
+        throw new Error(baseParsed.error || relativeParsed.error || "URI is malformed.");
+      }
+      const resolved = resolveComponent(baseParsed, relativeParsed, schemelessOptions, true);
       schemelessOptions.skipEscape = true;
       return serialize(resolved, schemelessOptions);
     }
@@ -3766,6 +3865,8 @@ var require_fast_uri = __commonJS({
       return uriTokens.join("");
     }
     var URI_PARSE = /^(?:([^#/:?]+):)?(?:\/\/((?:([^#/?@]*)@)?(\[[^#/?\]]+\]|[^#/:?]*)(?::(\d*))?))?([^#?]*)(?:\?([^#]*))?(?:#((?:.|[\n\r])*))?/u;
+    var AUTHORITY_PREFIX = /^(?:[^#/:?]+:)?\/\/([^/?#]*)/;
+    var AUTHORITY_INTRODUCER_REGION = /^(?:[^#/:?]+:)?([/\\\t\n\r]*)/;
     function getParseError(parsed, matches) {
       if (matches[2] !== void 0 && parsed.path && parsed.path[0] !== "/") {
         return 'URI path must start with "/" when authority is present.';
@@ -3795,9 +3896,28 @@ var require_fast_uri = __commonJS({
           uri = "//" + uri;
         }
       }
+      const authorityMatch = uri.match(AUTHORITY_PREFIX);
+      if (authorityMatch !== null && authorityMatch[1].indexOf("\\") !== -1) {
+        parsed.error = "URI authority must not contain a literal backslash.";
+        malformedAuthorityOrPort = true;
+      }
+      const introducerMatch = uri.match(AUTHORITY_INTRODUCER_REGION);
+      if (introducerMatch !== null) {
+        const region = introducerMatch[1];
+        const normalizedRegion = region.replace(/[\t\n\r]/g, "");
+        if (normalizedRegion.length >= 2) {
+          if (normalizedRegion.slice(0, 2) !== "//") {
+            parsed.error = parsed.error || "URI authority must not contain a literal backslash.";
+            malformedAuthorityOrPort = true;
+          } else if (region.length !== normalizedRegion.length) {
+            parsed.error = parsed.error || "URI authority introducer must not contain whitespace.";
+            malformedAuthorityOrPort = true;
+          }
+        }
+      }
       const matches = uri.match(URI_PARSE);
       if (matches) {
-        parsed.scheme = matches[1];
+        parsed.scheme = matches[1] === void 0 ? void 0 : matches[1].toLowerCase();
         parsed.userinfo = matches[3];
         parsed.host = matches[4];
         parsed.port = parseInt(matches[5], 10);
@@ -3838,7 +3958,7 @@ var require_fast_uri = __commonJS({
         if (!options.unicodeSupport && (!schemeHandler || !schemeHandler.unicodeSupport)) {
           if (parsed.host && (options.domainHost || schemeHandler && schemeHandler.domainHost) && isIP === false && nonSimpleDomain(parsed.host)) {
             try {
-              parsed.host = URL.domainToASCII(parsed.host.toLowerCase());
+              parsed.host = new URL("http://" + parsed.host).hostname;
             } catch (e) {
               parsed.error = parsed.error || "Host's domain name can not be converted to ASCII: " + e;
             }
@@ -3856,12 +3976,11 @@ var require_fast_uri = __commonJS({
           if (parsed.path) {
             parsed.path = normalizePathEncoding(parsed.path);
           }
+          if (parsed.query) {
+            parsed.query = normalizeQueryFragmentEncoding(parsed.query);
+          }
           if (parsed.fragment) {
-            try {
-              parsed.fragment = encodeURI(decodeURIComponent(parsed.fragment));
-            } catch {
-              parsed.error = parsed.error || "URI malformed";
-            }
+            parsed.fragment = normalizeQueryFragmentEncoding(parsed.fragment);
           }
         }
         if (schemeHandler && schemeHandler.parse) {
@@ -7356,11 +7475,11 @@ var require_light = __commonJS({
           return this._onFailure(error48, eventInfo, clearGlobalState, run, free);
         }
         async _onFailure(error48, eventInfo, clearGlobalState, run, free) {
-          var retry, retryAfter;
+          var retry2, retryAfter;
           if (clearGlobalState()) {
-            retry = await this.Events.trigger("failed", error48, eventInfo);
-            if (retry != null) {
-              retryAfter = ~~retry;
+            retry2 = await this.Events.trigger("failed", error48, eventInfo);
+            if (retry2 != null) {
+              retryAfter = ~~retry2;
               this.Events.trigger("retry", `Retrying ${this.options.id} after ${retryAfter} ms`, eventInfo);
               this.retryCount++;
               return run(retryAfter);
@@ -7875,7 +7994,7 @@ var require_light = __commonJS({
       var Batcher_1 = Batcher;
       var require$$4$1 = () => console.log("You must import the full version of Bottleneck in order to use this feature.");
       var require$$8 = getCjsExportFromNamespace(version$2);
-      var Bottleneck, DEFAULT_PRIORITY$1, Events$4, Job$1, LocalDatastore$1, NUM_PRIORITIES$1, Queues$1, RedisDatastore$1, States$1, Sync$1, parser$5, splice = [].splice;
+      var Bottleneck2, DEFAULT_PRIORITY$1, Events$4, Job$1, LocalDatastore$1, NUM_PRIORITIES$1, Queues$1, RedisDatastore$1, States$1, Sync$1, parser$5, splice = [].splice;
       NUM_PRIORITIES$1 = 10;
       DEFAULT_PRIORITY$1 = 5;
       parser$5 = parser;
@@ -7886,8 +8005,8 @@ var require_light = __commonJS({
       Events$4 = Events_1;
       States$1 = States_1;
       Sync$1 = Sync_1;
-      Bottleneck = (function() {
-        class Bottleneck2 {
+      Bottleneck2 = (function() {
+        class Bottleneck3 {
           constructor(options = {}, ...invalid) {
             var storeInstanceOptions, storeOptions;
             this._addToQueue = this._addToQueue.bind(this);
@@ -7909,7 +8028,7 @@ var require_light = __commonJS({
                 storeInstanceOptions = parser$5.load(options, this.localStoreDefaults, {});
                 return new LocalDatastore$1(this, storeOptions, storeInstanceOptions);
               } else {
-                throw new Bottleneck2.prototype.BottleneckError(`Invalid datastore type: ${this.datastore}`);
+                throw new Bottleneck3.prototype.BottleneckError(`Invalid datastore type: ${this.datastore}`);
               }
             }).call(this);
             this._queues.on("leftzero", () => {
@@ -7923,7 +8042,7 @@ var require_light = __commonJS({
           }
           _validateOptions(options, invalid) {
             if (!(options != null && typeof options === "object" && invalid.length === 0)) {
-              throw new Bottleneck2.prototype.BottleneckError("Bottleneck v2 takes a single object argument. Refer to https://github.com/SGrondin/bottleneck#upgrading-to-v2 if you're upgrading from Bottleneck v1.");
+              throw new Bottleneck3.prototype.BottleneckError("Bottleneck v2 takes a single object argument. Refer to https://github.com/SGrondin/bottleneck#upgrading-to-v2 if you're upgrading from Bottleneck v1.");
             }
           }
           ready() {
@@ -8120,10 +8239,10 @@ var require_light = __commonJS({
               return waitForExecuting(1);
             });
             this._receive = function(job) {
-              return job._reject(new Bottleneck2.prototype.BottleneckError(options.enqueueErrorMessage));
+              return job._reject(new Bottleneck3.prototype.BottleneckError(options.enqueueErrorMessage));
             };
             this.stop = () => {
-              return this.Promise.reject(new Bottleneck2.prototype.BottleneckError("stop() has already been called"));
+              return this.Promise.reject(new Bottleneck3.prototype.BottleneckError("stop() has already been called"));
             };
             return done;
           }
@@ -8142,11 +8261,11 @@ var require_light = __commonJS({
               job.doDrop();
               return true;
             } else if (reachedHWM) {
-              shifted = strategy === Bottleneck2.prototype.strategy.LEAK ? this._queues.shiftLastFrom(options.priority) : strategy === Bottleneck2.prototype.strategy.OVERFLOW_PRIORITY ? this._queues.shiftLastFrom(options.priority + 1) : strategy === Bottleneck2.prototype.strategy.OVERFLOW ? job : void 0;
+              shifted = strategy === Bottleneck3.prototype.strategy.LEAK ? this._queues.shiftLastFrom(options.priority) : strategy === Bottleneck3.prototype.strategy.OVERFLOW_PRIORITY ? this._queues.shiftLastFrom(options.priority + 1) : strategy === Bottleneck3.prototype.strategy.OVERFLOW ? job : void 0;
               if (shifted != null) {
                 shifted.doDrop();
               }
-              if (shifted == null || strategy === Bottleneck2.prototype.strategy.OVERFLOW) {
+              if (shifted == null || strategy === Bottleneck3.prototype.strategy.OVERFLOW) {
                 if (shifted == null) {
                   job.doDrop();
                 }
@@ -8160,7 +8279,7 @@ var require_light = __commonJS({
           }
           _receive(job) {
             if (this._states.jobStatus(job.options.id) != null) {
-              job._reject(new Bottleneck2.prototype.BottleneckError(`A job with the same id already exists (id=${job.options.id})`));
+              job._reject(new Bottleneck3.prototype.BottleneckError(`A job with the same id already exists (id=${job.options.id})`));
               return false;
             } else {
               job.doReceive();
@@ -8230,31 +8349,31 @@ var require_light = __commonJS({
             return this._store.__incrementReservoir__(incr);
           }
         }
-        Bottleneck2.default = Bottleneck2;
-        Bottleneck2.Events = Events$4;
-        Bottleneck2.version = Bottleneck2.prototype.version = require$$8.version;
-        Bottleneck2.strategy = Bottleneck2.prototype.strategy = {
+        Bottleneck3.default = Bottleneck3;
+        Bottleneck3.Events = Events$4;
+        Bottleneck3.version = Bottleneck3.prototype.version = require$$8.version;
+        Bottleneck3.strategy = Bottleneck3.prototype.strategy = {
           LEAK: 1,
           OVERFLOW: 2,
           OVERFLOW_PRIORITY: 4,
           BLOCK: 3
         };
-        Bottleneck2.BottleneckError = Bottleneck2.prototype.BottleneckError = BottleneckError_1;
-        Bottleneck2.Group = Bottleneck2.prototype.Group = Group_1;
-        Bottleneck2.RedisConnection = Bottleneck2.prototype.RedisConnection = require$$2;
-        Bottleneck2.IORedisConnection = Bottleneck2.prototype.IORedisConnection = require$$3;
-        Bottleneck2.Batcher = Bottleneck2.prototype.Batcher = Batcher_1;
-        Bottleneck2.prototype.jobDefaults = {
+        Bottleneck3.BottleneckError = Bottleneck3.prototype.BottleneckError = BottleneckError_1;
+        Bottleneck3.Group = Bottleneck3.prototype.Group = Group_1;
+        Bottleneck3.RedisConnection = Bottleneck3.prototype.RedisConnection = require$$2;
+        Bottleneck3.IORedisConnection = Bottleneck3.prototype.IORedisConnection = require$$3;
+        Bottleneck3.Batcher = Bottleneck3.prototype.Batcher = Batcher_1;
+        Bottleneck3.prototype.jobDefaults = {
           priority: DEFAULT_PRIORITY$1,
           weight: 1,
           expiration: null,
           id: "<no-id>"
         };
-        Bottleneck2.prototype.storeDefaults = {
+        Bottleneck3.prototype.storeDefaults = {
           maxConcurrent: null,
           minTime: 0,
           highWater: null,
-          strategy: Bottleneck2.prototype.strategy.LEAK,
+          strategy: Bottleneck3.prototype.strategy.LEAK,
           penalty: null,
           reservoir: null,
           reservoirRefreshInterval: null,
@@ -8263,12 +8382,12 @@ var require_light = __commonJS({
           reservoirIncreaseAmount: null,
           reservoirIncreaseMaximum: null
         };
-        Bottleneck2.prototype.localStoreDefaults = {
+        Bottleneck3.prototype.localStoreDefaults = {
           Promise,
           timeout: null,
           heartbeatInterval: 250
         };
-        Bottleneck2.prototype.redisStoreDefaults = {
+        Bottleneck3.prototype.redisStoreDefaults = {
           Promise,
           timeout: null,
           heartbeatInterval: 5e3,
@@ -8279,7 +8398,7 @@ var require_light = __commonJS({
           clearDatastore: false,
           connection: null
         };
-        Bottleneck2.prototype.instanceDefaults = {
+        Bottleneck3.prototype.instanceDefaults = {
           datastore: "local",
           connection: null,
           id: "<no-id>",
@@ -8287,14 +8406,14 @@ var require_light = __commonJS({
           trackDoneStatus: false,
           Promise
         };
-        Bottleneck2.prototype.stopDefaults = {
+        Bottleneck3.prototype.stopDefaults = {
           enqueueErrorMessage: "This limiter has been stopped and cannot accept new jobs.",
           dropWaitingJobs: true,
           dropErrorMessage: "This limiter has been stopped."
         };
-        return Bottleneck2;
+        return Bottleneck3;
       }).call(commonjsGlobal);
-      var Bottleneck_1 = Bottleneck;
+      var Bottleneck_1 = Bottleneck2;
       var lib = Bottleneck_1;
       return lib;
     }));
@@ -35311,30 +35430,30 @@ function routeMatcher(paths) {
 var regex = routeMatcher(triggers_notification_paths_default);
 var triggersNotification = regex.test.bind(regex);
 var groups = {};
-var createGroups = function(Bottleneck, common) {
-  groups.global = new Bottleneck.Group({
+var createGroups = function(Bottleneck2, common) {
+  groups.global = new Bottleneck2.Group({
     id: "octokit-global",
     maxConcurrent: 10,
     ...common
   });
-  groups.auth = new Bottleneck.Group({
+  groups.auth = new Bottleneck2.Group({
     id: "octokit-auth",
     maxConcurrent: 1,
     ...common
   });
-  groups.search = new Bottleneck.Group({
+  groups.search = new Bottleneck2.Group({
     id: "octokit-search",
     maxConcurrent: 1,
     minTime: 2e3,
     ...common
   });
-  groups.write = new Bottleneck.Group({
+  groups.write = new Bottleneck2.Group({
     id: "octokit-write",
     maxConcurrent: 1,
     minTime: 1e3,
     ...common
   });
-  groups.notifications = new Bottleneck.Group({
+  groups.notifications = new Bottleneck2.Group({
     id: "octokit-notifications",
     maxConcurrent: 1,
     minTime: 3e3,
@@ -35344,7 +35463,7 @@ var createGroups = function(Bottleneck, common) {
 function throttling(octokit, octokitOptions) {
   const {
     enabled = true,
-    Bottleneck = import_light.default,
+    Bottleneck: Bottleneck2 = import_light.default,
     id = "no-id",
     timeout = 1e3 * 60 * 2,
     // Redis TTL: 2 minutes
@@ -35358,7 +35477,7 @@ function throttling(octokit, octokitOptions) {
     common.connection = connection;
   }
   if (groups.global == null) {
-    createGroups(Bottleneck, common);
+    createGroups(Bottleneck2, common);
   }
   const state = Object.assign(
     {
@@ -35366,7 +35485,7 @@ function throttling(octokit, octokitOptions) {
       triggersNotification,
       fallbackSecondaryRateRetryAfter: 60,
       retryAfterBaseValue: 1e3,
-      retryLimiter: new Bottleneck(),
+      retryLimiter: new Bottleneck2(),
       id,
       ...groups
     },
@@ -35386,7 +35505,7 @@ function throttling(octokit, octokitOptions) {
     `);
   }
   const events = {};
-  const emitter = new Bottleneck.Events(events);
+  const emitter = new Bottleneck2.Events(events);
   events.on("secondary-limit", state.onSecondaryRateLimit);
   events.on("rate-limit", state.onRateLimit);
   events.on(
@@ -35449,6 +35568,80 @@ function throttling(octokit, octokitOptions) {
 throttling.VERSION = VERSION9;
 throttling.triggersNotification = triggersNotification;
 
+// ../../node_modules/.pnpm/@octokit+plugin-retry@8.1.0_@octokit+core@7.0.6/node_modules/@octokit/plugin-retry/dist-bundle/index.js
+var import_light2 = __toESM(require_light(), 1);
+var VERSION10 = "0.0.0-development";
+function isRequestError(error48) {
+  return error48.request !== void 0;
+}
+async function errorRequest(state, octokit, error48, options) {
+  if (!isRequestError(error48) || !error48?.request.request) {
+    throw error48;
+  }
+  if (error48.status >= 400 && !state.doNotRetry.includes(error48.status)) {
+    const retries = options.request.retries != null ? options.request.retries : state.retries;
+    const retryAfter = Math.pow((options.request.retryCount || 0) + 1, 2);
+    throw octokit.retry.retryRequest(error48, retries, retryAfter);
+  }
+  throw error48;
+}
+async function wrapRequest2(state, octokit, request2, options) {
+  const limiter = new import_light2.default();
+  limiter.on("failed", function(error48, info2) {
+    const maxRetries = ~~error48.request.request?.retries;
+    const after = ~~error48.request.request?.retryAfter;
+    options.request.retryCount = info2.retryCount + 1;
+    if (maxRetries > info2.retryCount) {
+      return after * state.retryAfterBaseValue;
+    }
+  });
+  return limiter.schedule(
+    requestWithGraphqlErrorHandling.bind(null, state, octokit, request2),
+    options
+  );
+}
+async function requestWithGraphqlErrorHandling(state, octokit, request2, options) {
+  const response = await request2(options);
+  if (response.data && response.data.errors && response.data.errors.length > 0 && /Something went wrong while executing your query/.test(
+    response.data.errors[0].message
+  )) {
+    const error48 = new RequestError(response.data.errors[0].message, 500, {
+      request: options,
+      response
+    });
+    return errorRequest(state, octokit, error48, options);
+  }
+  return response;
+}
+function retry(octokit, octokitOptions) {
+  const state = Object.assign(
+    {
+      enabled: true,
+      retryAfterBaseValue: 1e3,
+      doNotRetry: [400, 401, 403, 404, 410, 422, 451],
+      retries: 3
+    },
+    octokitOptions.retry
+  );
+  const retryPlugin = {
+    retry: {
+      retryRequest: (error48, retries, retryAfter) => {
+        error48.request.request = Object.assign({}, error48.request.request, {
+          retries,
+          retryAfter
+        });
+        return error48;
+      }
+    }
+  };
+  if (state.enabled) {
+    octokit.hook.error("request", errorRequest.bind(null, state, retryPlugin));
+    octokit.hook.wrap("request", wrapRequest2.bind(null, state, retryPlugin));
+  }
+  return retryPlugin;
+}
+retry.VERSION = VERSION10;
+
 // ../core/dist/core/logger.js
 var LEVEL_RANK = {
   silent: 0,
@@ -35484,7 +35677,7 @@ function warn(module2, message, ...args) {
 
 // ../core/dist/core/github.js
 var MODULE = "github";
-var ThrottledOctokit = Octokit2.plugin(throttling);
+var ThrottledOctokit = Octokit2.plugin(throttling, retry);
 var _octokit = null;
 var _currentToken = null;
 function formatResetTime(date5) {
@@ -35552,8 +35745,10 @@ var OssScoutError = class extends Error {
   }
 };
 var ValidationError = class extends OssScoutError {
-  constructor(message) {
+  strategiesUsed;
+  constructor(message, strategiesUsed) {
     super(message, "VALIDATION_ERROR");
+    this.strategiesUsed = strategiesUsed;
     this.name = "ValidationError";
   }
 };
@@ -35567,6 +35762,12 @@ function getHttpStatusCode(error48) {
   }
   return void 0;
 }
+function isAuthError(error48) {
+  const status = getHttpStatusCode(error48);
+  if (status === 401)
+    return true;
+  return status === 403 && !isRateLimitError(error48);
+}
 function isRateLimitError(error48) {
   const status = getHttpStatusCode(error48);
   if (status === 429)
@@ -35702,6 +35903,13 @@ var SearchBudgetTracker = class {
   totalCalls = 0;
   /** Calls made since the last known quota reset (external accounting). */
   callsSinceReset = 0;
+  /**
+   * Slots handed out by waitForBudget() but not yet recorded. Without this,
+   * concurrent callers (vetting runs 3 tasks) could all pass waitForBudget()
+   * on an effective budget of 1 before any recordCall() landed, overshooting
+   * the external quota into real 429s (#287).
+   */
+  reservedCalls = 0;
   /**
    * Initialize with pre-flight rate limit data from GitHub.
    */
@@ -35711,12 +35919,17 @@ var SearchBudgetTracker = class {
     this.callTimestamps = [];
     this.totalCalls = 0;
     this.callsSinceReset = 0;
+    this.reservedCalls = 0;
     debug(MODULE3, `Initialized: ${remaining} remaining, resets at ${new Date(this.resetAt).toLocaleTimeString()}`);
   }
   /**
-   * Record that a Search API call was just made.
+   * Record that a Search API call was just made. Releases the reservation
+   * taken by the preceding waitForBudget() (every call site pairs them, with
+   * recordCall in a finally).
    */
   recordCall() {
+    if (this.reservedCalls > 0)
+      this.reservedCalls--;
     this.callTimestamps.push(Date.now());
     this.totalCalls++;
     this.callsSinceReset++;
@@ -35763,8 +35976,8 @@ var SearchBudgetTracker = class {
    */
   getEffectiveBudget() {
     this.refreshExternalBudget();
-    const localBudget = EFFECTIVE_BUDGET - this.callTimestamps.length;
-    const externalBudget = this.knownRemaining - this.callsSinceReset;
+    const localBudget = EFFECTIVE_BUDGET - this.callTimestamps.length - this.reservedCalls;
+    const externalBudget = this.knownRemaining - this.callsSinceReset - this.reservedCalls;
     return Math.max(0, Math.min(localBudget, externalBudget));
   }
   /**
@@ -35775,7 +35988,9 @@ var SearchBudgetTracker = class {
     return this.getEffectiveBudget() >= n;
   }
   /**
-   * Wait if necessary to stay within the Search API rate limit.
+   * Wait if necessary to stay within the Search API rate limit, then reserve
+   * one call slot. The reservation is released by the paired recordCall(), so
+   * concurrent callers cannot all claim the same last remaining slot (#287).
    * If the sliding window is at capacity, sleeps until the oldest
    * call ages out of the window.
    */
@@ -35783,16 +35998,22 @@ var SearchBudgetTracker = class {
     while (true) {
       this.pruneOldTimestamps();
       if (this.getEffectiveBudget() > 0) {
+        this.reservedCalls++;
         return;
       }
       const oldestInWindow = this.callTimestamps[0];
       if (!oldestInWindow) {
+        if (this.reservedCalls > 0) {
+          await sleep(250);
+          continue;
+        }
         const untilReset = this.resetAt - Date.now();
         if (this.resetAt > 0 && untilReset > 0) {
           debug(MODULE3, `External quota exhausted, waiting ${untilReset}ms for reset`);
           await sleep(untilReset + 100);
           continue;
         }
+        this.reservedCalls++;
         return;
       }
       const waitUntil = oldestInWindow + SEARCH_WINDOW_MS;
@@ -35867,6 +36088,9 @@ var CONCRETE_STRATEGIES = [
 ];
 var RepoSignalsSchema = external_exports3.looseObject({
   hasActiveMaintainers: external_exports3.boolean(),
+  // Retained for backward compatibility but no longer affects the repo score
+  // (#167): nothing computes it, and hasActiveMaintainers is the live activity
+  // proxy. Kept so old persisted state and the search JSON output still parse.
   isResponsive: external_exports3.boolean(),
   hasHostileComments: external_exports3.boolean()
 });
@@ -36009,7 +36233,17 @@ var ScoutPreferencesSchema = external_exports3.looseObject({
   preferLanguages: external_exports3.array(external_exports3.string()).default([]),
   preferRepos: external_exports3.array(external_exports3.string()).default([]),
   diversityRatio: external_exports3.number().min(0).max(1).default(0),
-  broadPhaseDelayMs: external_exports3.number().min(0).max(3e5).default(9e4),
+  // Soft penalty (milder than the hard excludeRepos filter): candidates in
+  // these `owner/repo` slugs are pushed down the ranking but not removed (#168).
+  avoidRepos: external_exports3.array(external_exports3.string()).default([]),
+  // Soft boost for candidates whose issue labels match one of these types,
+  // case-insensitive (e.g. "bug", "good first issue") (#168).
+  boostIssueTypes: external_exports3.array(external_exports3.string()).default([]),
+  // Broad-phase cooldown. Now that the broad phase runs on GraphQL (points
+  // bucket, 5000/hr) rather than the REST Search bucket (30/min), the long
+  // secondary-rate-limit cooldown is no longer needed; defaults to 0 (no extra
+  // pause). Retained as a knob for hosts that still want to throttle the phase.
+  broadPhaseDelayMs: external_exports3.number().min(0).max(3e5).default(0),
   /**
    * Skip the expensive broad phase once this many candidates were found by
    * the cheaper phases. Clamped at runtime to maxResults - 1 so it stays
@@ -36072,7 +36306,20 @@ var ScoutStateSchema = external_exports3.looseObject({
   preferencesUpdatedAt: external_exports3.string().optional(),
   lastSearchAt: external_exports3.string().optional(),
   lastRunAt: external_exports3.string().default(() => (/* @__PURE__ */ new Date()).toISOString()),
-  gistId: external_exports3.string().optional()
+  gistId: external_exports3.string().optional(),
+  /**
+   * Diversity cursor for Phase 2's broad search (#249 follow-up). Without
+   * this, every run started the language-variant fan-out at index 0, so the
+   * broad phase only ever queried the first configured language before
+   * moving on. Not a rate-limit mechanism — purely rotates which language
+   * variant leads each run. `languageOffset` advances (no modulo; the
+   * consumer wraps at use time so a shrinking language list never needs
+   * clamping here).
+   */
+  searchRotation: external_exports3.looseObject({
+    languageOffset: external_exports3.number().int().min(0).default(0),
+    lastRotatedAt: external_exports3.string().optional()
+  }).default(() => ({ languageOffset: 0 }))
 });
 function parseScoutState(raw) {
   return ScoutStateSchema.parse(raw);
@@ -36725,16 +36972,18 @@ async function checkNoExistingPR(octokit, owner, repo, issueNumber) {
   }
 }
 var MERGED_PR_CACHE_TTL_MS = 15 * 60 * 1e3;
-async function checkUserMergedPRsInRepo(octokit, owner, repo) {
+function mergedPRsCacheKey(owner, repo) {
+  return versionedCacheKey(`merged-prs:${owner}/${repo}`);
+}
+async function checkUserMergedPRsInRepo(octokit, owner, repo, tracker = getSearchBudgetTracker()) {
   const cache = getHttpCache();
-  const cacheKey = versionedCacheKey(`merged-prs:${owner}/${repo}`);
+  const cacheKey = mergedPRsCacheKey(owner, repo);
   return withInflightDedup(cache, cacheKey, async () => {
     const cached2 = cache.getIfFresh(cacheKey, MERGED_PR_CACHE_TTL_MS);
     if (cached2 != null && typeof cached2 === "number") {
       return cached2;
     }
     try {
-      const tracker = getSearchBudgetTracker();
       await tracker.waitForBudget();
       try {
         const { data } = await octokit.search.issuesAndPullRequests({
@@ -36773,6 +37022,17 @@ async function checkNotClaimed(octokit, owner, repo, issueNumber, commentCount)
       });
       recentComments.push(...response.data);
     }
+    const lastFetched = recentComments.length % PER_PAGE;
+    if (recentComments.length > 0 && lastFetched === 0) {
+      const response = await octokit.issues.listComments({
+        owner,
+        repo,
+        issue_number: issueNumber,
+        per_page: PER_PAGE,
+        page: lastPage + 1
+      });
+      recentComments.push(...response.data);
+    }
     for (const comment of recentComments) {
       if (commentClaimsIssue(comment.body || "")) {
         return { passed: false };
@@ -36801,8 +37061,54 @@ function analyzeRequirements(body) {
   return indicators.filter(Boolean).length >= 2;
 }
 
+// ../core/dist/core/probe-repo-file.js
+var MODULE6 = "probe-repo-file";
+async function probeRepoFile(octokit, owner, repo, path5) {
+  try {
+    const data = await cachedRequest(getHttpCache(), `/repos/${owner}/${repo}/contents/${path5}`, (headers) => octokit.repos.getContent({ owner, repo, path: path5, headers }));
+    if (data && typeof data === "object" && "content" in data && typeof data.content === "string") {
+      return {
+        text: Buffer.from(data.content, "base64").toString("utf-8"),
+        transient: false
+      };
+    }
+    return { text: null, transient: false };
+  } catch (error48) {
+    const status = getHttpStatusCode(error48);
+    if (status === 404)
+      return { text: null, transient: false };
+    rethrowIfFatal(error48);
+    warn(MODULE6, `Unexpected error fetching ${path5} from ${owner}/${repo}: ${errorMessage(error48)}`);
+    return { text: null, transient: true };
+  }
+}
+
 // ../core/dist/core/repo-health.js
-var MODULE6 = "repo-health";
+var MODULE7 = "repo-health";
+var MERGE_WINDOW_DAYS = 90;
+async function fetchRepoMergeStats(octokit, owner, repo, tracker) {
+  const since = new Date(Date.now() - MERGE_WINDOW_DAYS * 24 * 60 * 60 * 1e3).toISOString().slice(0, 10);
+  const count = async (qualifiers) => {
+    await tracker.waitForBudget();
+    try {
+      const { data } = await octokit.search.issuesAndPullRequests({
+        q: `repo:${owner}/${repo} ${qualifiers} closed:>=${since}`,
+        per_page: 1
+        // only total_count is needed
+      });
+      return data.total_count;
+    } finally {
+      tracker.recordCall();
+    }
+  };
+  const merged = await count("is:pr is:merged");
+  const closedUnmerged = await count("is:pr is:unmerged is:closed");
+  const denom = merged + closedUnmerged;
+  return {
+    recentMergedPRCount: merged,
+    recentMergeRate: denom > 0 ? merged / denom : null
+  };
+}
 var guidelinesCache = /* @__PURE__ */ new Map();
 var CACHE_TTL_MS = 60 * 60 * 1e3;
 var HEALTH_CACHE_TTL_MS = 4 * 60 * 60 * 1e3;
@@ -36822,22 +37128,25 @@ function pruneCache() {
     }
   }
 }
-async function checkProjectHealth(octokit, owner, repo) {
+async function checkProjectHealth(octokit, owner, repo, tracker = getSearchBudgetTracker()) {
   const cache = getHttpCache();
-  const healthCacheKey = `health:${owner}/${repo}`;
+  const healthCacheKey = versionedCacheKey(`health:${owner}/${repo}`);
   try {
     return await cachedTimeBased(cache, healthCacheKey, HEALTH_CACHE_TTL_MS, async () => {
       const url2 = `/repos/${owner}/${repo}`;
       const repoData = await cachedRequest(cache, url2, (headers) => octokit.repos.get({ owner, repo, headers }));
-      const { data: commits } = await octokit.repos.listCommits({
+      const commitsUrl = `/repos/${owner}/${repo}/commits?per_page=1`;
+      const commits = await cachedRequest(cache, commitsUrl, (headers) => octokit.repos.listCommits({
         owner,
         repo,
-        per_page: 1
-      });
+        per_page: 1,
+        headers
+      }));
       const lastCommit = commits[0];
       const lastCommitAt = lastCommit?.commit?.author?.date || repoData.pushed_at;
       const daysSinceLastCommit = daysBetween(new Date(lastCommitAt));
       const ciStatus = "unknown";
+      const mergeStats = await fetchRepoMergeStats(octokit, owner, repo, tracker);
       return {
         repo: `${owner}/${repo}`,
         lastCommitAt,
@@ -36849,13 +37158,15 @@ async function checkProjectHealth(octokit, owner, repo) {
         isActive: daysSinceLastCommit < 30,
         stargazersCount: repoData.stargazers_count,
         forksCount: repoData.forks_count,
-        language: repoData.language
+        language: repoData.language,
+        recentMergedPRCount: mergeStats.recentMergedPRCount,
+        recentMergeRate: mergeStats.recentMergeRate
       };
     });
   } catch (error48) {
     rethrowIfFatal(error48);
     const errMsg = errorMessage(error48);
-    warn(MODULE6, `Error checking project health for ${owner}/${repo}: ${errMsg}`);
+    warn(MODULE7, `Error checking project health for ${owner}/${repo}: ${errMsg}`);
     return {
       repo: `${owner}/${repo}`,
       checkFailed: true,
@@ -36889,12 +37200,7 @@ async function fetchContributionGuidelinesUncached(octokit, owner, repo) {
     "docs/CONTRIBUTING.md",
     "contributing.md"
   ];
-  const results = await Promise.allSettled(filesToCheck.map((file2) => octokit.repos.getContent({ owner, repo, path: file2 }).then(({ data }) => {
-    if ("content" in data) {
-      return Buffer.from(data.content, "base64").toString("utf-8");
-    }
-    return null;
-  })));
+  const results = await Promise.allSettled(filesToCheck.map((file2) => probeRepoFile(octokit, owner, repo, file2)));
   for (const result of results) {
     if (result.status !== "rejected")
       continue;
@@ -36902,20 +37208,13 @@ async function fetchContributionGuidelinesUncached(octokit, owner, repo) {
       throw result.reason;
     }
   }
-  for (let i = 0; i < results.length; i++) {
-    const result = results[i];
-    if (result.status === "fulfilled" && result.value) {
-      const guidelines = parseContributionGuidelines(result.value);
+  for (const result of results) {
+    if (result.status === "fulfilled" && result.value.text) {
+      const guidelines = parseContributionGuidelines(result.value.text);
       guidelinesCache.set(cacheKey, { guidelines, fetchedAt: Date.now() });
       pruneCache();
       return guidelines;
     }
-    if (result.status === "rejected") {
-      const status = getHttpStatusCode(result.reason);
-      if (status !== 404) {
-        warn(MODULE6, `Unexpected error fetching ${filesToCheck[i]} from ${owner}/${repo}: ${errorMessage(result.reason)}`);
-      }
-    }
   }
   guidelinesCache.set(cacheKey, {
     guidelines: void 0,
@@ -36964,7 +37263,6 @@ function parseContributionGuidelines(content) {
 }
 
 // ../core/dist/core/anti-llm-policy.js
-var MODULE7 = "anti-llm-policy";
 var POLICY_SCAN_CACHE_TTL_MS = 60 * 60 * 1e3;
 var ANTI_LLM_KEYWORDS = [
   "no ai-generated",
@@ -37027,27 +37325,8 @@ var SOURCE_FILE_FAMILIES = [
     paths: ["README.md", "readme.md", "Readme.md"]
   }
 ];
-async function fetchFileText(octokit, owner, repo, path5) {
-  try {
-    const { data } = await octokit.repos.getContent({ owner, repo, path: path5 });
-    if ("content" in data && typeof data.content === "string") {
-      return {
-        text: Buffer.from(data.content, "base64").toString("utf-8"),
-        transient: false
-      };
-    }
-    return { text: null, transient: false };
-  } catch (error48) {
-    const status = getHttpStatusCode(error48);
-    if (status === 404)
-      return { text: null, transient: false };
-    rethrowIfFatal(error48);
-    warn(MODULE7, `Unexpected error fetching ${path5} from ${owner}/${repo}: ${errorMessage(error48)}`);
-    return { text: null, transient: true };
-  }
-}
 async function fetchFamilyText(octokit, owner, repo, paths) {
-  const results = await Promise.allSettled(paths.map((p) => fetchFileText(octokit, owner, repo, p)));
+  const results = await Promise.allSettled(paths.map((p) => probeRepoFile(octokit, owner, repo, p)));
   let hadTransientFailure = false;
   for (const result of results) {
     if (result.status === "fulfilled") {
@@ -37186,8 +37465,133 @@ ${selections.join("\n")}
   });
   return result;
 }
+var GH_NAME_PATTERN = /^[A-Za-z0-9_.-]+$/;
+var MERGED_PR_BATCH_SIZE = 15;
+async function prefetchMergedPRCounts(octokit, username, repos) {
+  if (repos.length === 0)
+    return;
+  if (!GH_NAME_PATTERN.test(username)) {
+    warn(MODULE8, `Skipping merged-PR prefetch: username failed validation (falling back to REST)`);
+    return;
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const valid = [];
+  for (const r of repos) {
+    const full = `${r.owner}/${r.repo}`;
+    if (seen.has(full))
+      continue;
+    seen.add(full);
+    if (!GH_NAME_PATTERN.test(r.owner) || !GH_NAME_PATTERN.test(r.repo)) {
+      warn(MODULE8, `Skipping merged-PR prefetch for "${full}": failed validation (falling back to REST)`);
+      continue;
+    }
+    valid.push(r);
+  }
+  if (valid.length === 0)
+    return;
+  const cache = getHttpCache();
+  const batches = [];
+  for (let i = 0; i < valid.length; i += MERGED_PR_BATCH_SIZE) {
+    batches.push(fetchMergedPRBatch(octokit, username, valid.slice(i, i + MERGED_PR_BATCH_SIZE), cache));
+  }
+  await Promise.all(batches);
+}
+async function fetchMergedPRBatch(octokit, username, repos, cache) {
+  const varDefs = [];
+  const selections = ["viewer { login }"];
+  const variables = {};
+  repos.forEach((r, i) => {
+    varDefs.push(`$q${i}: String!`);
+    variables[`q${i}`] = `is:pr is:merged author:${username} repo:${r.owner}/${r.repo}`;
+    selections.push(`r${i}: search(query: $q${i}, type: ISSUE, first: 1) { issueCount }`);
+  });
+  const query = `query batchMergedPRCounts(${varDefs.join(", ")}) {
+${selections.join("\n")}
+}`;
+  let data;
+  try {
+    data = await octokit.graphql(query, variables);
+  } catch (err) {
+    rethrowIfFatal(err);
+    const partial2 = err.data;
+    if (partial2) {
+      data = partial2;
+    } else {
+      warn(MODULE8, `Merged-PR prefetch batch failed, falling back to REST: ${errorMessage(err)}`);
+      return;
+    }
+  }
+  const viewerLogin = data?.viewer?.login;
+  if (!viewerLogin || viewerLogin.toLowerCase() !== username.toLowerCase()) {
+    if (viewerLogin) {
+      warn(MODULE8, `Merged-PR prefetch identity mismatch (configured username != authenticated login); leaving cache cold so REST @me answers`);
+    }
+    return;
+  }
+  repos.forEach((r, i) => {
+    const alias = data?.[`r${i}`];
+    const count = alias && "issueCount" in alias ? alias.issueCount : void 0;
+    if (typeof count !== "number")
+      return;
+    cache.set(mergedPRsCacheKey(r.owner, r.repo), "", count);
+  });
+}
+async function graphqlSearchIssues(octokit, query, first) {
+  const clampedFirst = Math.min(Math.max(Math.trunc(first) || 1, 1), 100);
+  const document = `query searchIssuesBroad($q: String!, $first: Int!) {
+    search(query: $q, type: ISSUE, first: $first) {
+      issueCount
+      nodes {
+        ... on Issue {
+          url
+          title
+          updatedAt
+          labels(first: 20) { nodes { name } }
+          repository { nameWithOwner }
+        }
+      }
+    }
+  }`;
+  let data;
+  try {
+    data = await octokit.graphql(document, {
+      q: query,
+      first: clampedFirst
+    });
+  } catch (err) {
+    rethrowIfFatal(err);
+    const partial2 = err.data;
+    if (partial2) {
+      data = partial2;
+    } else {
+      warn(MODULE8, `GraphQL broad search failed, falling back to REST: ${errorMessage(err)}`);
+      return null;
+    }
+  }
+  const search = data?.search;
+  if (!search)
+    return null;
+  const items = [];
+  for (const node of search.nodes ?? []) {
+    if (!node?.url)
+      continue;
+    const nameWithOwner = node.repository?.nameWithOwner;
+    if (!nameWithOwner)
+      continue;
+    items.push({
+      html_url: node.url,
+      // Same construction as the REST search adapter (search-phases.ts).
+      repository_url: `https://api.github.com/repos/${nameWithOwner}`,
+      updated_at: node.updatedAt ?? "",
+      title: node.title,
+      labels: node.labels?.nodes ?? []
+    });
+  }
+  return { total_count: search.issueCount ?? 0, items };
+}
 
 // ../core/dist/core/slm-triage.js
+var MODULE9 = "slm-triage";
 var DEFAULT_OLLAMA_HOST = "http://127.0.0.1:11434";
 var DEFAULT_TIMEOUT_MS = 15e3;
 var MAX_BODY_CHARS = 2e3;
@@ -37224,10 +37628,48 @@ function buildPrompt(input) {
     `Linked PR exists: ${linkedPRExists}`
   ].join("\n");
 }
+function isAllowedTriageHost(raw) {
+  let url2;
+  try {
+    url2 = new URL(raw);
+  } catch {
+    return false;
+  }
+  if (url2.protocol !== "http:" && url2.protocol !== "https:")
+    return false;
+  const host = url2.hostname.replace(/^\[|\]$/g, "").toLowerCase();
+  if (host === "localhost" || host === "::1")
+    return true;
+  const v4 = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+  if (v4) {
+    const a = Number(v4[1]);
+    const b = Number(v4[2]);
+    if (a === 127 || a === 10)
+      return true;
+    if (a === 192 && b === 168)
+      return true;
+    if (a === 172 && b >= 16 && b <= 31)
+      return true;
+    return false;
+  }
+  if (host.includes(":")) {
+    return host.startsWith("fc") || host.startsWith("fd") || host.startsWith("fe80");
+  }
+  return !host.includes(".") || host.endsWith(".local");
+}
+function assertValidTriageHost(value) {
+  if (value === "" || isAllowedTriageHost(value))
+    return;
+  throw new ValidationError(`slmTriageHost must be an http(s) URL pointing at localhost or a private/LAN address (got "${value}"). Example: http://192.168.1.20:11434`);
+}
 async function triageWithSLM(input, options) {
   if (!options.model)
     return null;
   const host = options.host ?? DEFAULT_OLLAMA_HOST;
+  if (!isAllowedTriageHost(host)) {
+    warn(MODULE9, `slmTriageHost "${host}" is not a local/private address; skipping SLM triage`);
+    return null;
+  }
   const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
   const fetchFn = options.fetchImpl ?? fetch;
   let response;
@@ -37299,15 +37741,23 @@ function isValidTriageShape(value) {
 }
 
 // ../core/dist/core/issue-vetting.js
-var MODULE9 = "issue-vetting";
+var MODULE10 = "issue-vetting";
 var MAX_CONCURRENT_VETTING = 3;
 var VETTING_CACHE_TTL_MS = 15 * 60 * 1e3;
+function repoAcceptsContributionsFromHealth(projectHealth) {
+  if (projectHealth.checkFailed || projectHealth.recentMergedPRCount == null) {
+    return null;
+  }
+  if (projectHealth.recentMergedPRCount > 0)
+    return true;
+  return projectHealth.recentMergeRate == null ? null : false;
+}
 function deriveRecommendation(input) {
   const notes = [];
   const reasonsToApprove = [];
   const reasonsToSkip = [];
   if (!input.noExistingPR)
-    notes.push(input.ownPR ? "Your PR is already in flight for this issue" : "Existing PR found for this issue");
+    notes.push(input.ownPR ? "Your PR is already in flight for this issue" : input.linkedPRMerged ? "A PR for this issue was already merged" : input.linkedPRClosed ? "A PR for this issue was closed without merging" : "Existing PR found for this issue");
   if (!input.notClaimed)
     notes.push("Issue appears to be claimed by someone");
   if (input.existingPRInconclusive) {
@@ -37325,14 +37775,28 @@ function deriveRecommendation(input) {
     notes.push("Issue requirements are unclear");
   if (!input.contributionGuidelinesFound)
     notes.push("No CONTRIBUTING.md found");
-  if (!input.noExistingPR)
-    reasonsToSkip.push(input.ownPR ? "You already have a PR in flight" : "Has existing PR");
+  if (input.repoAcceptsContributions === false)
+    notes.push("Repo has merged no PRs in the last 90 days");
+  else if (input.repoAcceptsContributions === null)
+    notes.push("Could not verify whether the repo merges PRs");
+  if (!input.noExistingPR) {
+    if (input.ownPR)
+      reasonsToSkip.push("You already have a PR in flight");
+    else if (input.linkedPRMerged)
+      reasonsToSkip.push("Linked PR already merged");
+    else if (input.linkedPRClosed)
+      reasonsToSkip.push("Linked PR closed without merge");
+    else
+      reasonsToSkip.push("Has existing PR");
+  }
   if (!input.notClaimed)
     reasonsToSkip.push("Already claimed");
   if (!input.projectIsActive && !input.projectCheckFailed)
     reasonsToSkip.push("Inactive project");
   if (!input.clearRequirements)
     reasonsToSkip.push("Unclear requirements");
+  if (input.repoAcceptsContributions === false)
+    reasonsToSkip.push("Repo has no recent merged PRs");
   if (input.noExistingPR)
     reasonsToApprove.push("No existing PR");
   if (input.notClaimed)
@@ -37358,16 +37822,18 @@ function deriveRecommendation(input) {
   let recommendation;
   if (input.issueClosed) {
     recommendation = "skip";
+  } else if (input.linkedPRMerged || input.linkedPRClosed) {
+    recommendation = "skip";
   } else if (input.ownPR) {
     recommendation = "skip";
-  } else if (input.passedAllChecks) {
+  } else if (input.passedAllChecks && input.repoAcceptsContributions !== false) {
     recommendation = "approve";
   } else if (reasonsToSkip.length > 2) {
     recommendation = "skip";
   } else {
     recommendation = "needs_review";
   }
-  const hasInconclusiveChecks = input.projectCheckFailed || input.existingPRInconclusive || input.claimInconclusive || input.mergedCountInconclusive;
+  const hasInconclusiveChecks = input.projectCheckFailed || input.existingPRInconclusive || input.claimInconclusive || input.mergedCountInconclusive || input.repoAcceptsContributions === null;
   if (recommendation === "approve" && hasInconclusiveChecks) {
     recommendation = "needs_review";
     notes.push("Recommendation downgraded: one or more checks were inconclusive");
@@ -37377,9 +37843,18 @@ function deriveRecommendation(input) {
 var IssueVetter = class {
   octokit;
   stateReader;
-  constructor(octokit, stateReader) {
+  budgetTracker;
+  /**
+   * @param octokit      - Authenticated Octokit instance
+   * @param stateReader  - Read-only scout state interface
+   * @param budgetTracker - Search budget tracker. Defaults to the shared
+   *   singleton so existing callers behave identically; inject a per-search
+   *   instance to isolate budget accounting in a long-lived concurrent host.
+   */
+  constructor(octokit, stateReader, budgetTracker = getSearchBudgetTracker()) {
     this.octokit = octokit;
     this.stateReader = stateReader;
+    this.budgetTracker = budgetTracker;
   }
   /**
    * Vet a specific issue — runs all checks and computes recommendation + viability score.
@@ -37396,7 +37871,7 @@ var IssueVetter = class {
     const cacheKey = versionedCacheKey(`vet:${issueUrl}${sigKey}`);
     const cached2 = cache.getIfFresh(cacheKey, VETTING_CACHE_TTL_MS);
     if (cached2 && typeof cached2 === "object" && "issue" in cached2 && "viabilityScore" in cached2) {
-      debug(MODULE9, `Vetting cache hit for ${issueUrl}`);
+      debug(MODULE10, `Vetting cache hit for ${issueUrl}`);
       return cached2;
     }
     const parsed = parseGitHubUrl(issueUrl);
@@ -37411,9 +37886,9 @@ var IssueVetter = class {
     const [existingPRCheck, claimCheck, projectHealth, contributionGuidelines, userMergedPRCount] = await Promise.all([
       checkNoExistingPR(this.octokit, owner, repo, number4),
       checkNotClaimed(this.octokit, owner, repo, number4, core.commentCount),
-      checkProjectHealth(this.octokit, owner, repo),
+      checkProjectHealth(this.octokit, owner, repo, this.budgetTracker),
       fetchContributionGuidelines(this.octokit, owner, repo),
-      hasMergedPRsInRepo ? Promise.resolve(0) : checkUserMergedPRsInRepo(this.octokit, owner, repo)
+      hasMergedPRsInRepo ? Promise.resolve(0) : checkUserMergedPRsInRepo(this.octokit, owner, repo, this.budgetTracker)
     ]);
     const antiLLMPolicy = await fetchAndScanAntiLLMPolicy(this.octokit, owner, repo, { contributingText: contributionGuidelines?.rawContent });
     const noExistingPR = existingPRCheck.passed;
@@ -37421,8 +37896,11 @@ var IssueVetter = class {
     const username = this.stateReader.getGitHubUsername?.() ?? "";
     const linkedPR = existingPRCheck.linkedPR;
     const ownPR = !noExistingPR && !!linkedPR && linkedPR.state === "open" && !linkedPR.merged && username !== "" && linkedPR.author.toLowerCase() === username.toLowerCase();
+    const linkedPRMerged = !!linkedPR && linkedPR.merged;
+    const linkedPRClosed = !!linkedPR && linkedPR.state === "closed" && !linkedPR.merged;
     const clearRequirements = analyzeRequirements(core.body);
     const projectActive = projectHealth.checkFailed ? true : projectHealth.isActive;
+    const repoAcceptsContributions = repoAcceptsContributionsFromHealth(projectHealth);
     const vettingResult = {
       passedAllChecks: noExistingPR && notClaimed && projectActive && clearRequirements,
       checks: {
@@ -37458,10 +37936,12 @@ var IssueVetter = class {
     }
     const matchesCategory = repoBelongsToCategory(repoFullName, this.stateReader.getProjectCategories());
     const issueClosed = core.state === "closed";
-    const hasInconclusiveChecks = projectHealth.checkFailed || !!existingPRCheck.inconclusive || !!claimCheck.inconclusive || mergedCountInconclusive;
+    const hasInconclusiveChecks = projectHealth.checkFailed || !!existingPRCheck.inconclusive || !!claimCheck.inconclusive || mergedCountInconclusive || repoAcceptsContributions === null;
     const { notes, reasonsToApprove, reasonsToSkip, recommendation } = deriveRecommendation({
       noExistingPR,
       ownPR,
+      linkedPRMerged,
+      linkedPRClosed,
       notClaimed,
       clearRequirements,
       contributionGuidelinesFound: !!contributionGuidelines,
@@ -37478,7 +37958,8 @@ var IssueVetter = class {
       orgHasMergedPRs,
       matchesCategory,
       issueClosed,
-      passedAllChecks: vettingResult.passedAllChecks
+      passedAllChecks: vettingResult.passedAllChecks,
+      repoAcceptsContributions
     });
     vettingResult.notes = notes;
     const repoQualityBonus = projectHealth.checkFailed ? 0 : calculateRepoQualityBonus(projectHealth.stargazersCount ?? 0, projectHealth.forksCount ?? 0);
@@ -37558,6 +38039,36 @@ var IssueVetter = class {
       updatedAt: ghIssue.updated_at
     };
   }
+  /**
+   * Batch-prefetch merged-PR counts for the repos in a vetting batch (#182),
+   * warming the cache `checkUserMergedPRsInRepo` reads so each per-repo Search
+   * API call becomes a cache hit.
+   *
+   * Two repos are intentionally excluded:
+   * - Repos already known to have the user's merged PRs
+   *   (`getReposWithMergedPRs`): `vetIssue` short-circuits those to a merged
+   *   count of 1 and never calls the Search API, so prefetching them is waste.
+   * - Everything, when the GitHub username is unknown: the GraphQL `author:`
+   *   filter needs a concrete login and the REST path falls back to `@me`.
+   */
+  async prefetchMergedPRCounts(issueRefs) {
+    const username = this.stateReader.getGitHubUsername?.() ?? "";
+    if (!username)
+      return;
+    const alreadyKnown = new Set(this.stateReader.getReposWithMergedPRs());
+    const seen = /* @__PURE__ */ new Set();
+    const repos = [];
+    for (const { owner, repo } of issueRefs) {
+      const full = `${owner}/${repo}`;
+      if (alreadyKnown.has(full) || seen.has(full))
+        continue;
+      seen.add(full);
+      repos.push({ owner, repo });
+    }
+    if (repos.length === 0)
+      return;
+    await prefetchMergedPRCounts(this.octokit, username, repos);
+  }
   /**
    * Vet multiple issues in parallel with concurrency limit
    */
@@ -37569,10 +38080,14 @@ var IssueVetter = class {
     let attemptedCount = 0;
     let firstAuthError = null;
     const uniqueUrls = [...new Set(urls)];
-    const prefetched = await prefetchIssueCores(this.octokit, uniqueUrls.flatMap((url2) => {
+    const issueRefs = uniqueUrls.flatMap((url2) => {
       const p = parseGitHubUrl(url2);
       return p && p.type === "issues" ? [{ owner: p.owner, repo: p.repo, number: p.number }] : [];
-    }));
+    });
+    const [prefetched] = await Promise.all([
+      prefetchIssueCores(this.octokit, issueRefs),
+      this.prefetchMergedPRCounts(issueRefs)
+    ]);
     const prefetchFor = (url2) => {
       const p = parseGitHubUrl(url2);
       return p && p.type === "issues" ? prefetched.get(issueCoreKey(p.owner, p.repo, p.number)) : void 0;
@@ -37592,7 +38107,7 @@ var IssueVetter = class {
           candidates.push(candidate);
         }
       }).catch((error48) => {
-        if (getHttpStatusCode(error48) === 401) {
+        if (isAuthError(error48)) {
           firstAuthError ??= error48;
           return;
         }
@@ -37600,7 +38115,7 @@ var IssueVetter = class {
         if (isRateLimitError(error48)) {
           rateLimitFailures++;
         }
-        warn(MODULE9, `Error vetting issue ${url2}:`, errorMessage(error48));
+        warn(MODULE10, `Error vetting issue ${url2}:`, errorMessage(error48));
       }).finally(() => pending.delete(url2));
       pending.set(url2, task);
       if (pending.size >= MAX_CONCURRENT_VETTING) {
@@ -37610,13 +38125,13 @@ var IssueVetter = class {
     await Promise.allSettled(pending.values());
     if (firstAuthError) {
       if (candidates.length > 0) {
-        warn(MODULE9, `Auth failed mid-batch after ${candidates.length} successful vet(s) \u2014 discarding partial results`);
+        warn(MODULE10, `Auth failed mid-batch after ${candidates.length} successful vet(s) \u2014 discarding partial results`);
       }
       throw firstAuthError;
     }
     const allFailed = failedVettingCount === attemptedCount && attemptedCount > 0;
     if (allFailed) {
-      warn(MODULE9, `All ${attemptedCount} issue(s) failed vetting. This may indicate a systemic issue (rate limit, auth, network).`);
+      warn(MODULE10, `All ${attemptedCount} issue(s) failed vetting. This may indicate a systemic issue (rate limit, auth, network).`);
     }
     return {
       candidates: candidates.slice(0, maxResults),
@@ -37627,14 +38142,22 @@ var IssueVetter = class {
 };
 
 // ../core/dist/core/search-phases.js
-var MODULE10 = "search-phases";
+var MODULE11 = "search-phases";
 var GITHUB_MAX_BOOLEAN_OPS = 5;
 var INTER_QUERY_DELAY_MS = 2e3;
+var GRAPHQL_INTER_QUERY_DELAY_MS = 500;
+var graphqlSearchQueryCount = 0;
+function getGraphQLSearchQueryCount() {
+  return graphqlSearchQueryCount;
+}
+function resetGraphQLSearchQueryCount() {
+  graphqlSearchQueryCount = 0;
+}
 function chunkLabels(labels, reservedOps = 0) {
   const maxPerChunk = GITHUB_MAX_BOOLEAN_OPS - reservedOps + 1;
   if (maxPerChunk < 1) {
     if (labels.length > 0) {
-      warn(MODULE10, `Label filtering disabled: ${reservedOps} repo/org ORs exceed GitHub's ${GITHUB_MAX_BOOLEAN_OPS} operator limit. All ${labels.length} label(s) dropped from query.`);
+      warn(MODULE11, `Label filtering disabled: ${reservedOps} repo/org ORs exceed GitHub's ${GITHUB_MAX_BOOLEAN_OPS} operator limit. All ${labels.length} label(s) dropped from query.`);
     }
     return [[]];
   }
@@ -37644,7 +38167,7 @@ function chunkLabels(labels, reservedOps = 0) {
   for (let i = 0; i < labels.length; i += maxPerChunk) {
     chunks.push(labels.slice(i, i + maxPerChunk));
   }
-  debug(MODULE10, `Split ${labels.length} labels into ${chunks.length} chunks (${reservedOps} ops reserved, max ${maxPerChunk} per chunk)`);
+  debug(MODULE11, `Split ${labels.length} labels into ${chunks.length} chunks (${reservedOps} ops reserved, max ${maxPerChunk} per chunk)`);
   return chunks;
 }
 function buildLabelQuery(labels) {
@@ -37676,15 +38199,14 @@ function interleaveArrays(arrays) {
   return result;
 }
 var SEARCH_CACHE_TTL_MS = 15 * 60 * 1e3;
-async function cachedSearchIssues(octokit, params) {
+async function cachedSearchIssues(octokit, params, tracker = getSearchBudgetTracker()) {
   const cacheKey = versionedCacheKey(`search:${params.q}:${params.sort}:${params.order}:${params.per_page}`);
   const cache = getHttpCache();
   const cached2 = cache.getIfFresh(cacheKey, SEARCH_CACHE_TTL_MS);
   if (cached2) {
-    debug(MODULE10, `Search cache hit for query`);
+    debug(MODULE11, `Search cache hit for query`);
     return cached2;
   }
-  const tracker = getSearchBudgetTracker();
   await tracker.waitForBudget();
   let data;
   try {
@@ -37696,10 +38218,32 @@ async function cachedSearchIssues(octokit, params) {
   if (data.items.length > 0) {
     cache.set(cacheKey, "", data);
   } else {
-    debug(MODULE10, `Skipping cache for empty search result (possible rate limit artifact)`);
+    debug(MODULE11, `Skipping cache for empty search result (possible rate limit artifact)`);
   }
   return data;
 }
+async function searchIssuesGraphQLFirst(octokit, params, tracker = getSearchBudgetTracker()) {
+  const cacheKey = versionedCacheKey(`gqlsearch:${params.q}:${params.sort}:${params.order}:${params.per_page}`);
+  const cache = getHttpCache();
+  const cached2 = cache.getIfFresh(cacheKey, SEARCH_CACHE_TTL_MS);
+  if (cached2) {
+    debug(MODULE11, `GraphQL search cache hit for query`);
+    return cached2;
+  }
+  const gqlQuery = `${params.q} sort:${params.sort}-${params.order}`;
+  const gql = await graphqlSearchIssues(octokit, gqlQuery, Math.min(params.per_page, 100));
+  if (gql) {
+    graphqlSearchQueryCount++;
+    if (gql.items.length > 0) {
+      cache.set(cacheKey, "", gql);
+    } else {
+      debug(MODULE11, `Skipping cache for empty GraphQL search result (possible transient artifact)`);
+    }
+    return gql;
+  }
+  warn(MODULE11, `GraphQL broad search unavailable; falling back to REST search API`);
+  return cachedSearchIssues(octokit, params, tracker);
+}
 async function fetchIssuesFromMaintainedRepos(octokit, repos, minStars, maxResults) {
   const items = [];
   for (const repoFullName of repos) {
@@ -37744,15 +38288,15 @@ async function fetchIssuesFromMaintainedRepos(octokit, repos, minStars, maxResul
       if (getHttpStatusCode(error48) === 401)
         throw error48;
       if (isRateLimitError(error48)) {
-        warn(MODULE10, `Rate limit hit fetching issues from ${repoFullName}:`, errorMessage(error48));
+        warn(MODULE11, `Rate limit hit fetching issues from ${repoFullName}:`, errorMessage(error48));
         break;
       }
-      warn(MODULE10, `Error fetching issues from ${repoFullName}:`, errorMessage(error48));
+      warn(MODULE11, `Error fetching issues from ${repoFullName}:`, errorMessage(error48));
     }
   }
   return items;
 }
-async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResults, priority, filterFn) {
+async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResults, priority, filterFn, perPage = 5) {
   const candidates = [];
   let failedRepos = 0;
   let rateLimitFailures = 0;
@@ -37774,7 +38318,7 @@ async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResu
           state: "open",
           sort: "created",
           direction: "desc",
-          per_page: 5,
+          per_page: perPage,
           ...label !== void 0 ? { labels: label } : {}
         });
         for (const issue2 of response.data) {
@@ -37809,30 +38353,30 @@ async function fetchIssuesFromKnownRepos(octokit, vetter, repos, labels, maxResu
       if (isRateLimitError(error48)) {
         rateLimitFailures++;
       }
-      warn(MODULE10, `Error fetching issues from ${repoFullName}:`, errorMessage(error48));
+      warn(MODULE11, `Error fetching issues from ${repoFullName}:`, errorMessage(error48));
     }
   }
   const allReposFailed = failedRepos === repos.length && repos.length > 0;
   const rateLimitHit = rateLimitFailures > 0;
   if (allReposFailed) {
-    warn(MODULE10, `All ${repos.length} repo(s) failed for ${priority} phase. This may indicate a systemic issue (rate limit, auth, network).`);
+    warn(MODULE11, `All ${repos.length} repo(s) failed for ${priority} phase. This may indicate a systemic issue (rate limit, auth, network).`);
   }
   return { candidates, allReposFailed, rateLimitHit };
 }
-async function searchWithChunkedLabels(octokit, labels, reservedOps, buildQuery, perPage) {
+async function searchWithChunkedLabels(octokit, labels, reservedOps, buildQuery, perPage, tracker = getSearchBudgetTracker()) {
   const labelChunks = chunkLabels(labels, reservedOps);
   const seenUrls = /* @__PURE__ */ new Set();
   const allItems = [];
   for (let i = 0; i < labelChunks.length; i++) {
     if (i > 0)
-      await sleep(INTER_QUERY_DELAY_MS);
+      await sleep(GRAPHQL_INTER_QUERY_DELAY_MS);
     const query = buildQuery(buildLabelQuery(labelChunks[i]));
-    const data = await cachedSearchIssues(octokit, {
+    const data = await searchIssuesGraphQLFirst(octokit, {
       q: query,
       sort: "created",
       order: "desc",
       per_page: perPage
-    });
+    }, tracker);
     for (const item of data.items) {
       if (!seenUrls.has(item.html_url)) {
         seenUrls.add(item.html_url);
@@ -37851,14 +38395,16 @@ function buildLanguageVariants(languages, isAnyLanguage, hasLabels) {
     return [languages.map((l) => `language:${l}`).join(" ")];
   return languages.map((l) => `language:${l}`);
 }
-async function searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, labels, buildBaseQuery, perPage) {
-  const langVariants = buildLanguageVariants(languages, isAnyLanguage, labels.length > 0);
+async function searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, labels, buildBaseQuery, perPage, tracker = getSearchBudgetTracker(), startOffset = 0) {
+  const variants = buildLanguageVariants(languages, isAnyLanguage, labels.length > 0);
+  const k = variants.length > 0 ? startOffset % variants.length : 0;
+  const langVariants = [...variants.slice(k), ...variants.slice(0, k)];
   const seenUrls = /* @__PURE__ */ new Set();
   const allItems = [];
   for (let i = 0; i < langVariants.length; i++) {
     if (i > 0)
-      await sleep(INTER_QUERY_DELAY_MS);
-    const items = await searchWithChunkedLabels(octokit, labels, 0, (labelQ) => `${buildBaseQuery(langVariants[i])} ${labelQ}`.replace(/  +/g, " ").trim(), perPage);
+      await sleep(GRAPHQL_INTER_QUERY_DELAY_MS);
+    const items = await searchWithChunkedLabels(octokit, labels, 0, (labelQ) => `${buildBaseQuery(langVariants[i])} ${labelQ}`.replace(/  +/g, " ").trim(), perPage, tracker);
     for (const item of items) {
       if (!seenUrls.has(item.html_url)) {
         seenUrls.add(item.html_url);
@@ -37872,7 +38418,7 @@ async function filterVetAndScore(vetter, items, filterIssues, excludedRepoSets,
   const spamRepos = detectLabelFarmingRepos(items);
   if (spamRepos.size > 0) {
     const spamCount = items.filter((i) => spamRepos.has(extractRepoFromUrl(i.repository_url) ?? "")).length;
-    debug(MODULE10, `[SPAM_FILTER] Filtered ${spamCount} issues from ${spamRepos.size} label-farming repos: ${[...spamRepos].join(", ")}`);
+    debug(MODULE11, `[SPAM_FILTER] Filtered ${spamCount} issues from ${spamRepos.size} label-farming repos: ${[...spamRepos].join(", ")}`);
   }
   const itemsToVet = filterIssues(items).filter((item) => {
     const repoFullName = extractRepoFromUrl(item.repository_url);
@@ -37883,7 +38429,7 @@ async function filterVetAndScore(vetter, items, filterIssues, excludedRepoSets,
     return excludedRepoSets.every((s) => !s.has(repoFullName));
   }).slice(0, remainingNeeded * 2);
   if (itemsToVet.length === 0) {
-    debug(MODULE10, `[${phaseLabel}] All ${items.length} items filtered before vetting`);
+    debug(MODULE11, `[${phaseLabel}] All ${items.length} items filtered before vetting`);
     return { candidates: [], allVetFailed: false, rateLimitHit: false };
   }
   const { candidates: results, allFailed: allVetFailed, rateLimitHit } = await vetter.vetIssuesParallel(itemsToVet.map((i) => i.html_url), remainingNeeded, "normal");
@@ -37895,7 +38441,7 @@ async function filterVetAndScore(vetter, items, filterIssues, excludedRepoSets,
   });
   const starFilteredCount = results.length - starFiltered.length;
   if (starFilteredCount > 0) {
-    debug(MODULE10, `[STAR_FILTER] Filtered ${starFilteredCount} ${phaseLabel} candidates below ${minStars} stars`);
+    debug(MODULE11, `[STAR_FILTER] Filtered ${starFilteredCount} ${phaseLabel} candidates below ${minStars} stars`);
   }
   return { candidates: starFiltered, allVetFailed, rateLimitHit };
 }
@@ -37903,18 +38449,27 @@ async function filterVetAndScore(vetter, items, filterIssues, excludedRepoSets,
 // ../core/dist/core/personalization.js
 var REPO_BOOST = 20;
 var LANGUAGE_BOOST = 10;
+var ISSUE_TYPE_BOOST = 10;
+var AVOID_PENALTY = 15;
 function boostScoreOf(candidate) {
   return candidate.personalization?.kind === "boosted" ? candidate.personalization.score : 0;
 }
-function annotateBoost(candidates, preferLanguages, preferRepos) {
-  const langSet = new Set((preferLanguages ?? []).map((l) => l.trim().toLowerCase()).filter(Boolean));
-  const repoSet = new Set((preferRepos ?? []).map((r) => r.trim().toLowerCase()).filter(Boolean));
-  if (langSet.size === 0 && repoSet.size === 0)
+function normalizeSet(values) {
+  return new Set((values ?? []).map((v) => v.trim().toLowerCase()).filter(Boolean));
+}
+function annotateBoost(candidates, bias = {}) {
+  const langSet = normalizeSet(bias.preferLanguages);
+  const repoSet = normalizeSet(bias.preferRepos);
+  const avoidSet = normalizeSet(bias.avoidRepos);
+  const typeSet = normalizeSet(bias.boostIssueTypes);
+  if (langSet.size === 0 && repoSet.size === 0 && avoidSet.size === 0 && typeSet.size === 0) {
     return candidates;
+  }
   return candidates.map((c) => {
     let score = 0;
     const reasons = [];
-    if (repoSet.size > 0 && repoSet.has(c.issue.repo.toLowerCase())) {
+    const repoLower = c.issue.repo.toLowerCase();
+    if (repoSet.size > 0 && repoSet.has(repoLower)) {
       score += REPO_BOOST;
       reasons.push(`repo affinity: ${c.issue.repo}`);
     }
@@ -37923,7 +38478,18 @@ function annotateBoost(candidates, preferLanguages, preferRepos) {
       score += LANGUAGE_BOOST;
       reasons.push(`language match: ${lang}`);
     }
-    if (score === 0)
+    if (typeSet.size > 0) {
+      const matched = c.issue.labels.find((l) => typeSet.has(l.toLowerCase()));
+      if (matched) {
+        score += ISSUE_TYPE_BOOST;
+        reasons.push(`issue type: ${matched}`);
+      }
+    }
+    if (avoidSet.size > 0 && avoidSet.has(repoLower)) {
+      score -= AVOID_PENALTY;
+      reasons.push(`avoided repo: ${c.issue.repo}`);
+    }
+    if (reasons.length === 0)
       return c;
     return { ...c, personalization: { kind: "boosted", score, reasons } };
   });
@@ -37951,7 +38517,7 @@ function applyDiversityRatio(candidates, maxResults, diversityRatio) {
       break;
     if (seen.has(c.issue.url))
       continue;
-    if (boostScoreOf(c) > 0)
+    if (boostScoreOf(c) !== 0)
       continue;
     picks.push({ ...c, personalization: { kind: "diversity" } });
     seen.add(c.issue.url);
@@ -37968,9 +38534,12 @@ function applyDiversityRatio(candidates, maxResults, diversityRatio) {
 }
 
 // ../core/dist/core/issue-discovery.js
-var MODULE11 = "issue-discovery";
+var MODULE12 = "issue-discovery";
 var LOW_BUDGET_THRESHOLD = 20;
 var CRITICAL_BUDGET_THRESHOLD = 10;
+var PHASE0_PER_PAGE = 30;
+var CONTRIBUTED_REPO_MAX_AGE_DAYS = 365;
+var PHASE0_MAX_SHARE = 0.5;
 function buildIssueFilter(config2) {
   return (items) => {
     return items.filter((item) => {
@@ -37992,6 +38561,8 @@ function buildIssueFilter(config2) {
       if (config2.skippedUrls.has(item.html_url))
         return false;
       const updatedAt = new Date(item.updated_at);
+      if (Number.isNaN(updatedAt.getTime()))
+        return false;
       const ageDays = daysBetween(updatedAt, config2.now);
       if (ageDays > config2.maxAgeDays)
         return false;
@@ -38002,9 +38573,9 @@ function buildIssueFilter(config2) {
   };
 }
 async function runPhase0(octokit, vetter, repos, maxResults, filterIssues) {
-  info(MODULE11, `Phase 0: Searching issues in ${repos.length} merged-PR repos (no label filter)...`);
-  const { candidates, allReposFailed, rateLimitHit } = await fetchIssuesFromKnownRepos(octokit, vetter, repos, [], maxResults, "merged_pr", filterIssues);
-  info(MODULE11, `Found ${candidates.length} candidates from merged-PR repos`);
+  info(MODULE12, `Phase 0: Searching issues in ${repos.length} merged-PR repos (no label filter, ${PHASE0_PER_PAGE}/repo)...`);
+  const { candidates, allReposFailed, rateLimitHit } = await fetchIssuesFromKnownRepos(octokit, vetter, repos, [], maxResults, "merged_pr", filterIssues, PHASE0_PER_PAGE);
+  info(MODULE12, `Found ${candidates.length} candidates from merged-PR repos`);
   return {
     candidates,
     error: allReposFailed ? "All merged-PR repo fetches failed" : null,
@@ -38012,26 +38583,26 @@ async function runPhase0(octokit, vetter, repos, maxResults, filterIssues) {
   };
 }
 async function runPhase1(octokit, vetter, repos, labels, maxResults, filterIssues) {
-  info(MODULE11, `Phase 1: Searching issues in ${repos.length} starred repos...`);
+  info(MODULE12, `Phase 1: Searching issues in ${repos.length} starred repos...`);
   const phase1Labels = labels.slice(0, 3);
   const reposToSearch = repos.slice(0, 10);
   const { candidates, allReposFailed, rateLimitHit } = await fetchIssuesFromKnownRepos(octokit, vetter, reposToSearch, phase1Labels, maxResults, "starred", filterIssues);
-  info(MODULE11, `Found ${candidates.length} candidates from starred repos`);
+  info(MODULE12, `Found ${candidates.length} candidates from starred repos`);
   return {
     candidates,
     error: allReposFailed ? "All starred repo fetches failed" : null,
     rateLimitHit
   };
 }
-async function runPhase2(octokit, vetter, scopes, labels, configLabels, languages, isAnyLanguage, maxResults, minStars, phase0RepoSet, starredRepoSet, existingCandidates, filterIssues) {
-  info(MODULE11, "Phase 2: General issue search...");
+async function runPhase2(octokit, vetter, scopes, labels, configLabels, languages, isAnyLanguage, maxResults, minStars, phase0RepoSet, starredRepoSet, existingCandidates, filterIssues, tracker, languageRotationOffset = 0) {
+  info(MODULE12, "Phase 2: General issue search...");
   const seenRepos = new Set(existingCandidates.map((c) => c.issue.repo));
   const tierLabelGroups = [];
   if (scopes && scopes.length > 1) {
     for (const scope of scopes) {
       const scopeLabels = SCOPE_LABELS[scope] ?? [];
       if (scopeLabels.length === 0) {
-        warn(MODULE11, `Scope "${scope}" has no labels, skipping tier`);
+        warn(MODULE12, `Scope "${scope}" has no labels, skipping tier`);
         continue;
       }
       tierLabelGroups.push({ tier: scope, tierLabels: scopeLabels });
@@ -38050,8 +38621,8 @@ async function runPhase2(octokit, vetter, scopes, labels, configLabels, language
   let rateLimitHit = false;
   for (const { tier, tierLabels } of tierLabelGroups) {
     try {
-      const allItems = await searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, tierLabels, (langQ) => `is:issue is:open ${langQ} no:assignee`.replace(/  +/g, " ").trim(), budgetPerTier * 3);
-      info(MODULE11, `Phase 2 [${tier}]: processing ${allItems.length} items...`);
+      const allItems = await searchAcrossLanguagesAndLabels(octokit, languages, isAnyLanguage, tierLabels, (langQ) => `is:issue is:open ${langQ} no:assignee`.replace(/  +/g, " ").trim(), budgetPerTier * 3, tracker, languageRotationOffset);
+      info(MODULE12, `Phase 2 [${tier}]: processing ${allItems.length} items...`);
       const { candidates: tierCandidates, allVetFailed, rateLimitHit: vetRateLimitHit } = await filterVetAndScore(vetter, allItems, filterIssues, [phase0RepoSet, starredRepoSet, seenRepos], budgetPerTier, minStars, `Phase 2 [${tier}]`);
       tierResults.push(tierCandidates);
       for (const c of tierCandidates)
@@ -38062,7 +38633,7 @@ async function runPhase2(octokit, vetter, scopes, labels, configLabels, language
       if (vetRateLimitHit) {
         rateLimitHit = true;
       }
-      info(MODULE11, `Found ${tierCandidates.length} candidates from ${tier} tier`);
+      info(MODULE12, `Found ${tierCandidates.length} candidates from ${tier} tier`);
     } catch (err) {
       if (getHttpStatusCode(err) === 401)
         throw err;
@@ -38071,13 +38642,13 @@ async function runPhase2(octokit, vetter, scopes, labels, configLabels, language
       if (isRateLimitError(err)) {
         rateLimitHit = true;
       }
-      warn(MODULE11, `Error in ${tier} tier search: ${errMsg}`);
+      warn(MODULE12, `Error in ${tier} tier search: ${errMsg}`);
       tierResults.push([]);
     }
   }
   const interleaved = interleaveArrays(tierResults);
   if (interleaved.length === 0 && error48) {
-    warn(MODULE11, `All ${tierLabelGroups.length} scope tiers failed in Phase 2: ${error48}`);
+    warn(MODULE12, `All ${tierLabelGroups.length} scope tiers failed in Phase 2: ${error48}`);
   }
   return {
     candidates: interleaved.slice(0, maxResults),
@@ -38085,18 +38656,18 @@ async function runPhase2(octokit, vetter, scopes, labels, configLabels, language
     rateLimitHit
   };
 }
-async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories, maxResults, phase0RepoSet, starredRepoSet, starredRepos, existingCandidates, filterIssues) {
-  info(MODULE11, "Phase 3: Searching actively maintained repos...");
+async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories, maxResults, phase0RepoSet, starredRepoSet, starredRepos, existingCandidates, filterIssues, tracker) {
+  info(MODULE12, "Phase 3: Searching actively maintained repos...");
   const seenRepos = new Set(existingCandidates.map((c) => c.issue.repo));
   const eligibleStarred = starredRepos.filter((r) => !phase0RepoSet.has(r) && !seenRepos.has(r));
   if (eligibleStarred.length > 0) {
-    info(MODULE11, `Phase 3: Checking ${eligibleStarred.length} starred repos via REST API...`);
+    info(MODULE12, `Phase 3: Checking ${eligibleStarred.length} starred repos via REST API...`);
     const restItems = await fetchIssuesFromMaintainedRepos(octokit, eligibleStarred.slice(0, 15), minStars, maxResults);
     if (restItems.length > 0) {
       try {
         const { candidates, allVetFailed, rateLimitHit: vetRateLimitHit } = await filterVetAndScore(vetter, restItems, filterIssues, [phase0RepoSet, seenRepos], maxResults, minStars, "Phase 3 (REST)");
         if (candidates.length > 0) {
-          info(MODULE11, `Found ${candidates.length} candidates from maintained-repo REST search`);
+          info(MODULE12, `Found ${candidates.length} candidates from maintained-repo REST search`);
           return {
             candidates,
             error: allVetFailed ? "all vetting failed" : null,
@@ -38106,11 +38677,11 @@ async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories
       } catch (error48) {
         if (getHttpStatusCode(error48) === 401)
           throw error48;
-        warn(MODULE11, `Phase 3 REST vetting failed, falling back to Search API:`, errorMessage(error48));
+        warn(MODULE12, `Phase 3 REST vetting failed, falling back to Search API:`, errorMessage(error48));
       }
     }
   }
-  info(MODULE11, "Phase 3: Falling back to Search API...");
+  info(MODULE12, "Phase 3: Falling back to Search API...");
   const thirtyDaysAgo = /* @__PURE__ */ new Date();
   thirtyDaysAgo.setDate(thirtyDaysAgo.getDate() - 30);
   const pushedSince = thirtyDaysAgo.toISOString().split("T")[0];
@@ -38118,15 +38689,15 @@ async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories
   const topicQuery = categoryTopics.length > 0 ? `topic:${categoryTopics[0]}` : "";
   const phase3Query = `is:issue is:open no:assignee ${langQuery} ${topicQuery} stars:>=${minStars} pushed:>=${pushedSince} archived:false`.replace(/  +/g, " ").trim();
   try {
-    const data = await cachedSearchIssues(octokit, {
+    const data = await searchIssuesGraphQLFirst(octokit, {
       q: phase3Query,
       sort: "updated",
       order: "desc",
       per_page: maxResults * 3
-    });
-    info(MODULE11, `Found ${data.total_count} issues in maintained-repo search, processing top ${data.items.length}...`);
+    }, tracker);
+    info(MODULE12, `Found ${data.total_count} issues in maintained-repo search, processing top ${data.items.length}...`);
     const { candidates, allVetFailed, rateLimitHit: vetRateLimitHit } = await filterVetAndScore(vetter, data.items, filterIssues, [phase0RepoSet, starredRepoSet, seenRepos], maxResults, minStars, "Phase 3");
-    info(MODULE11, `Found ${candidates.length} candidates from maintained-repo search`);
+    info(MODULE12, `Found ${candidates.length} candidates from maintained-repo search`);
     return {
       candidates,
       error: allVetFailed ? "all vetting failed" : null,
@@ -38136,7 +38707,7 @@ async function runPhase3(octokit, vetter, langQuery, minStars, projectCategories
     if (getHttpStatusCode(error48) === 401)
       throw error48;
     const errMsg = errorMessage(error48);
-    warn(MODULE11, `Error in maintained-repo search: ${errMsg}`);
+    warn(MODULE12, `Error in maintained-repo search: ${errMsg}`);
     return {
       candidates: [],
       error: errMsg,
@@ -38150,19 +38721,26 @@ var IssueDiscovery = class {
   octokit;
   githubToken;
   vetter;
+  budgetTracker;
   /** Set after searchIssues() runs if rate limits affected the search (low pre-flight quota or mid-search rate limit hits). */
   rateLimitWarning = null;
   /**
    * @param githubToken  - GitHub personal access token or token from `gh auth token`
    * @param preferences  - User's search preferences (languages, labels, scopes, etc.)
    * @param stateReader  - Read-only interface for accessing scout state (merged PRs, starred repos, etc.)
+   * @param budgetTracker - Search budget tracker. Defaults to the shared
+   *   singleton so existing callers behave identically. A long-lived host
+   *   serving concurrent searches can inject a per-search instance so one
+   *   search's init() no longer resets the budget state of another (the
+   *   shared-singleton concurrency hazard, #156).
    */
-  constructor(githubToken, preferences, stateReader) {
+  constructor(githubToken, preferences, stateReader, budgetTracker = getSearchBudgetTracker()) {
     this.preferences = preferences;
     this.stateReader = stateReader;
     this.githubToken = githubToken;
     this.octokit = getOctokit(githubToken);
-    this.vetter = new IssueVetter(this.octokit, this.stateReader);
+    this.budgetTracker = budgetTracker;
+    this.vetter = new IssueVetter(this.octokit, this.stateReader, this.budgetTracker);
   }
   /**
    * Get starred repos from the state reader.
@@ -38211,9 +38789,23 @@ var IssueDiscovery = class {
     const allCandidates = [];
     const phaseErrors = {};
     let rateLimitHitDuringSearch = false;
+    const applyInterPhaseDelay = async () => {
+      if (interPhaseDelay > 0) {
+        info(MODULE12, `Waiting ${(interPhaseDelay / 1e3).toFixed(0)}s between phases for rate limit management...`);
+        await sleep(interPhaseDelay);
+      }
+    };
+    const recordPhaseResult = (key, result) => {
+      allCandidates.push(...result.candidates);
+      phaseErrors[key] = result.error;
+      if (result.rateLimitHit)
+        rateLimitHitDuringSearch = true;
+    };
+    const viableCandidateCount = () => allCandidates.filter((c) => c.recommendation !== "skip").length;
     this.rateLimitWarning = null;
-    const tracker = getSearchBudgetTracker();
-    let searchBudget = LOW_BUDGET_THRESHOLD - 1;
+    resetGraphQLSearchQueryCount();
+    const tracker = this.budgetTracker;
+    let searchBudget = CRITICAL_BUDGET_THRESHOLD - 1;
     try {
       const rateLimit = await checkRateLimit(this.githubToken);
       searchBudget = rateLimit.remaining;
@@ -38221,22 +38813,22 @@ var IssueDiscovery = class {
       if (rateLimit.remaining < 5) {
         const resetTime = new Date(rateLimit.resetAt).toLocaleTimeString("en-US", { hour12: false });
         this.rateLimitWarning = `GitHub search API quota low (${rateLimit.remaining}/${rateLimit.limit} remaining, resets at ${resetTime}). Search may be slow.`;
-        warn(MODULE11, this.rateLimitWarning);
+        warn(MODULE12, this.rateLimitWarning);
       }
       if (searchBudget < CRITICAL_BUDGET_THRESHOLD) {
-        info(MODULE11, `Search budget critical (${searchBudget} remaining) \u2014 running only Phase 0`);
+        info(MODULE12, `Search budget critical (${searchBudget} remaining) \u2014 skipping the starred phase; broad/maintained still run on GraphQL (points bucket)`);
       } else if (searchBudget < LOW_BUDGET_THRESHOLD) {
-        info(MODULE11, `Search budget low (${searchBudget} remaining) \u2014 skipping heavy phases (2, 3)`);
+        info(MODULE12, `Search budget low (${searchBudget} remaining) \u2014 broad/maintained run on GraphQL (points bucket), unaffected by REST search quota`);
       }
     } catch (error48) {
       if (getHttpStatusCode(error48) === 401)
         throw error48;
       tracker.init(CRITICAL_BUDGET_THRESHOLD, new Date(Date.now() + 6e4).toISOString());
-      warn(MODULE11, "Could not check rate limit \u2014 using conservative budget, skipping heavy phases:", errorMessage(error48));
+      warn(MODULE12, "Could not check rate limit \u2014 using conservative budget, skipping the starred phase:", errorMessage(error48));
     }
     if (searchBudget <= 0) {
-      this.rateLimitWarning = "GitHub search API quota exhausted. Try again after the rate limit resets.";
-      return { candidates: [], strategiesUsed: [] };
+      this.rateLimitWarning = "GitHub search API quota exhausted \u2014 skipping the starred phase; other phases don't use it.";
+      warn(MODULE12, this.rateLimitWarning);
     }
     const mergedPRRepos = this.stateReader.getReposWithMergedPRs();
     const openPRRepos = this.stateReader.getReposWithOpenPRs();
@@ -38247,17 +38839,24 @@ var IssueDiscovery = class {
     const langQuery = isAnyLanguage ? "" : languages.map((l) => `language:${l}`).join(" ");
     const aiBlocklisted = new Set(config2.aiPolicyBlocklist.map((r) => r.toLowerCase()));
     if (aiBlocklisted.size > 0) {
-      debug(MODULE11, `[AI_POLICY_FILTER] Filtering issues from ${aiBlocklisted.size} blocklisted repo(s): ${[...aiBlocklisted].join(", ")}`);
+      debug(MODULE12, `[AI_POLICY_FILTER] Filtering issues from ${aiBlocklisted.size} blocklisted repo(s): ${[...aiBlocklisted].join(", ")}`);
     }
-    const filterIssues = buildIssueFilter({
+    const baseFilterConfig = {
       excludedRepos: new Set(config2.excludeRepos.map((r) => r.toLowerCase())),
       excludeOrgs: new Set((config2.excludeOrgs ?? []).map((o) => o.toLowerCase())),
       aiBlocklisted,
       lowScoringRepos,
       skippedUrls: options.skippedUrls ?? /* @__PURE__ */ new Set(),
-      maxAgeDays: config2.maxIssueAgeDays || 90,
       now: /* @__PURE__ */ new Date(),
       includeDocIssues: config2.includeDocIssues ?? true
+    };
+    const filterIssues = buildIssueFilter({
+      ...baseFilterConfig,
+      maxAgeDays: config2.maxIssueAgeDays || 90
+    });
+    const filterIssuesPhase0 = buildIssueFilter({
+      ...baseFilterConfig,
+      maxAgeDays: CONTRIBUTED_REPO_MAX_AGE_DAYS
     });
     const seenPhase0 = /* @__PURE__ */ new Set();
     const phase0Repos = [];
@@ -38270,31 +38869,24 @@ var IssueDiscovery = class {
         break;
     }
     const phase0RepoSet = new Set(phase0Repos);
+    const otherStrategiesCanRun = starredRepos.length > 0 && enabledStrategies.has("starred") || enabledStrategies.has("broad") || enabledStrategies.has("maintained");
     if (phase0Repos.length > 0 && enabledStrategies.has("merged")) {
-      const remaining = maxResults - allCandidates.length;
+      const phase0Cap = otherStrategiesCanRun ? Math.max(1, Math.ceil(maxResults * PHASE0_MAX_SHARE)) : maxResults;
+      const remaining = Math.min(maxResults - allCandidates.length, phase0Cap);
       if (remaining > 0) {
-        const result = await runPhase0(this.octokit, this.vetter, phase0Repos, remaining, filterIssues);
-        allCandidates.push(...result.candidates);
-        phaseErrors["0"] = result.error;
-        if (result.rateLimitHit)
-          rateLimitHitDuringSearch = true;
+        const result = await runPhase0(this.octokit, this.vetter, phase0Repos, remaining, filterIssuesPhase0);
+        recordPhaseResult("0", result);
       }
       strategiesUsed.push("merged");
     }
     if (allCandidates.length < maxResults && starredRepos.length > 0 && searchBudget >= CRITICAL_BUDGET_THRESHOLD && enabledStrategies.has("starred")) {
-      if (interPhaseDelay > 0) {
-        info(MODULE11, `Waiting ${(interPhaseDelay / 1e3).toFixed(0)}s between phases for rate limit management...`);
-        await sleep(interPhaseDelay);
-      }
+      await applyInterPhaseDelay();
       const reposToSearch = starredRepos.filter((r) => !phase0RepoSet.has(r));
       if (reposToSearch.length > 0) {
         const remaining = maxResults - allCandidates.length;
         if (remaining > 0) {
           const result = await runPhase1(this.octokit, this.vetter, reposToSearch, labels, remaining, filterIssues);
-          allCandidates.push(...result.candidates);
-          phaseErrors["1"] = result.error;
-          if (result.rateLimitHit)
-            rateLimitHitDuringSearch = true;
+          recordPhaseResult("1", result);
           strategiesUsed.push("starred");
         }
       }
@@ -38302,49 +38894,39 @@ var IssueDiscovery = class {
     const broadDelay = options.broadPhaseDelayMs ?? config2.broadPhaseDelayMs ?? 9e4;
     const configuredSkipThreshold = config2.skipBroadWhenSufficientResults ?? 8;
     const skipThreshold = configuredSkipThreshold > 0 ? Math.min(configuredSkipThreshold, maxResults - 1) : 0;
-    if (allCandidates.length < maxResults && searchBudget >= LOW_BUDGET_THRESHOLD && enabledStrategies.has("broad")) {
-      if (skipThreshold > 0 && allCandidates.length >= skipThreshold) {
-        info(MODULE11, `Skipping broad search: already found ${allCandidates.length} candidates (threshold: ${skipThreshold})`);
+    const viableBeforeBroad = viableCandidateCount();
+    if (viableBeforeBroad >= maxResults && enabledStrategies.has("broad")) {
+      info(MODULE12, `Skipping broad search: ${viableBeforeBroad} viable candidate(s) already meet maxResults (${maxResults})`);
+    } else if (enabledStrategies.has("broad")) {
+      const newRepoCandidateCount = allCandidates.filter((c) => c.recommendation !== "skip" && !phase0RepoSet.has(c.issue.repo) && !starredRepoSet.has(c.issue.repo)).length;
+      if (skipThreshold > 0 && newRepoCandidateCount >= skipThreshold) {
+        info(MODULE12, `Skipping broad search: already found ${newRepoCandidateCount} viable candidate(s) from new repos (threshold: ${skipThreshold})`);
       } else {
-        if (interPhaseDelay > 0) {
-          info(MODULE11, `Waiting ${(interPhaseDelay / 1e3).toFixed(0)}s between phases for rate limit management...`);
-          await sleep(interPhaseDelay);
-        }
+        await applyInterPhaseDelay();
         if (allCandidates.length > 0 && broadDelay > 0) {
-          info(MODULE11, `Waiting ${(broadDelay / 1e3).toFixed(0)}s for rate limit cooldown before broad search...`);
+          info(MODULE12, `Waiting ${(broadDelay / 1e3).toFixed(0)}s for rate limit cooldown before broad search...`);
           await sleep(broadDelay);
         } else if (allCandidates.length === 0) {
-          info(MODULE11, `Skipping broad phase delay: no results from previous phases, proceeding immediately`);
+          info(MODULE12, `Skipping broad phase delay: no results from previous phases, proceeding immediately`);
         }
-        const remaining = maxResults - allCandidates.length;
-        const result = await runPhase2(this.octokit, this.vetter, scopes, labels, config2.labels, languages, isAnyLanguage, remaining, minStars, phase0RepoSet, starredRepoSet, allCandidates, filterIssues);
-        allCandidates.push(...result.candidates);
-        phaseErrors["2"] = result.error;
-        if (result.rateLimitHit)
-          rateLimitHitDuringSearch = true;
+        const remaining = maxResults - viableBeforeBroad;
+        const result = await runPhase2(this.octokit, this.vetter, scopes, labels, config2.labels, languages, isAnyLanguage, remaining, minStars, phase0RepoSet, starredRepoSet, allCandidates, filterIssues, tracker, options.languageRotationOffset ?? 0);
+        recordPhaseResult("2", result);
         strategiesUsed.push("broad");
       }
     }
-    if (allCandidates.length < maxResults && searchBudget >= LOW_BUDGET_THRESHOLD && enabledStrategies.has("maintained")) {
-      if (interPhaseDelay > 0) {
-        info(MODULE11, `Waiting ${(interPhaseDelay / 1e3).toFixed(0)}s between phases for rate limit management...`);
-        await sleep(interPhaseDelay);
-      }
-      const remaining = maxResults - allCandidates.length;
-      const result = await runPhase3(this.octokit, this.vetter, langQuery, minStars, config2.projectCategories ?? [], remaining, phase0RepoSet, starredRepoSet, starredRepos, allCandidates, filterIssues);
-      allCandidates.push(...result.candidates);
-      phaseErrors["3"] = result.error;
-      if (result.rateLimitHit)
-        rateLimitHitDuringSearch = true;
+    const viableBeforeMaintained = viableCandidateCount();
+    if (viableBeforeMaintained >= maxResults && enabledStrategies.has("maintained")) {
+      info(MODULE12, `Skipping maintained search: ${viableBeforeMaintained} viable candidate(s) already meet maxResults (${maxResults})`);
+    } else if (enabledStrategies.has("maintained")) {
+      await applyInterPhaseDelay();
+      const remaining = maxResults - viableBeforeMaintained;
+      const result = await runPhase3(this.octokit, this.vetter, langQuery, minStars, config2.projectCategories ?? [], remaining, phase0RepoSet, starredRepoSet, starredRepos, allCandidates, filterIssues, tracker);
+      recordPhaseResult("3", result);
       strategiesUsed.push("maintained");
     }
-    const phasesSkippedForBudget = searchBudget < LOW_BUDGET_THRESHOLD;
-    let budgetNote = "";
-    if (searchBudget < CRITICAL_BUDGET_THRESHOLD) {
-      budgetNote = ` Most search phases were skipped due to critically low API quota (${searchBudget} remaining).`;
-    } else if (phasesSkippedForBudget) {
-      budgetNote = ` Some search phases were skipped due to low API quota (${searchBudget} remaining).`;
-    }
+    const phasesSkippedForBudget = searchBudget < CRITICAL_BUDGET_THRESHOLD;
+    const budgetNote = phasesSkippedForBudget ? ` The starred-repo phase was skipped due to critically low API quota (${searchBudget} remaining); broad and maintained phases still ran on GraphQL.` : "";
     if (allCandidates.length === 0) {
       const errorDetails = [
         phaseErrors["0"] ? `Phase 0 (merged-PR repos): ${phaseErrors["0"]}` : null,
@@ -38357,12 +38939,17 @@ var IssueDiscovery = class {
         this.rateLimitWarning = `Search returned no results due to GitHub API rate limits.${details}${budgetNote} Try again after the rate limit resets.`;
         return { candidates: [], strategiesUsed };
       }
-      throw new ValidationError(`No issue candidates found across all search phases.${details} Try adjusting your search criteria (languages, labels) or check your network connection.`);
+      throw new ValidationError(`No issue candidates found across all search phases.${details} Try adjusting your search criteria (languages, labels) or check your network connection.`, strategiesUsed);
     }
     if (rateLimitHitDuringSearch || phasesSkippedForBudget) {
       this.rateLimitWarning = `Search results may be incomplete: GitHub API rate limits were hit during search.${budgetNote} Found ${allCandidates.length} candidate${allCandidates.length === 1 ? "" : "s"} but some search phases were limited. Try again after the rate limit resets for complete results.`;
     }
-    const ranked = annotateBoost(allCandidates, options.preferLanguages, options.preferRepos);
+    const ranked = annotateBoost(allCandidates, {
+      preferLanguages: options.preferLanguages,
+      preferRepos: options.preferRepos,
+      avoidRepos: options.avoidRepos,
+      boostIssueTypes: options.boostIssueTypes
+    });
     ranked.sort((a, b) => {
       const priorityOrder = {
         merged_pr: 0,
@@ -38381,9 +38968,13 @@ var IssueDiscovery = class {
         return boostDiff;
       return b.viabilityScore - a.viabilityScore;
     });
-    const capped = applyPerRepoCap(ranked, 2);
+    const viableFirst = [
+      ...ranked.filter((c) => c.recommendation !== "skip"),
+      ...ranked.filter((c) => c.recommendation === "skip")
+    ];
+    const capped = applyPerRepoCap(viableFirst, 2);
     const finalPicks = applyDiversityRatio(capped, maxResults, options.diversityRatio ?? 0);
-    info(MODULE11, `Search complete: ${tracker.getTotalCalls()} Search API calls used, ${finalPicks.length} candidates returned`);
+    info(MODULE12, `Search complete: ${tracker.getTotalCalls()} REST Search API call(s) + ${getGraphQLSearchQueryCount()} GraphQL broad-search query/queries used, ${finalPicks.length} candidates returned`);
     return { candidates: finalPicks, strategiesUsed };
   }
   /**
@@ -38416,7 +39007,6 @@ var IssueDiscovery = class {
 };
 
 // ../core/dist/core/roadmap.js
-var MODULE12 = "roadmap";
 var CACHE_TTL_MS2 = 60 * 60 * 1e3;
 var ROADMAP_PATHS = [
   "ROADMAP.md",
@@ -38436,8 +39026,8 @@ function pruneCache2() {
 function parseRoadmapIssueRefs(content, owner, repo) {
   const refs = /* @__PURE__ */ new Set();
   const ownerRepoLower = `${owner}/${repo}`.toLowerCase();
-  const escape2 = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  const fullRefPattern = new RegExp(`\\b${escape2(owner)}/${escape2(repo)}#(\\d+)\\b`, "gi");
+  const escape = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+  const fullRefPattern = new RegExp(`\\b${escape(owner)}/${escape(repo)}#(\\d+)\\b`, "gi");
   for (const m of content.matchAll(fullRefPattern)) {
     const n = Number.parseInt(m[1], 10);
     if (n > 0)
@@ -38484,22 +39074,13 @@ async function fetchRoadmapIssueRefs(octokit, owner, repo) {
 var roadmapInflight = /* @__PURE__ */ new Map();
 async function fetchRoadmapIssueRefsUncached(octokit, owner, repo, cacheKey) {
   for (const path5 of ROADMAP_PATHS) {
-    try {
-      const { data } = await octokit.repos.getContent({ owner, repo, path: path5 });
-      if (!("content" in data))
-        continue;
-      const content = Buffer.from(data.content, "base64").toString("utf-8");
-      const refs = parseRoadmapIssueRefs(content, owner, repo);
-      roadmapCache.set(cacheKey, { refs, fetchedAt: Date.now() });
-      pruneCache2();
-      return refs;
-    } catch (err) {
-      rethrowIfFatal(err);
-      const status = getHttpStatusCode(err);
-      if (status === 404)
-        continue;
-      warn(MODULE12, `Unexpected error fetching ${path5} from ${owner}/${repo}: ${errorMessage(err)}`);
-    }
+    const { text } = await probeRepoFile(octokit, owner, repo, path5);
+    if (!text)
+      continue;
+    const refs = parseRoadmapIssueRefs(text, owner, repo);
+    roadmapCache.set(cacheKey, { refs, fetchedAt: Date.now() });
+    pruneCache2();
+    return refs;
   }
   const empty = /* @__PURE__ */ new Set();
   roadmapCache.set(cacheKey, { refs: empty, fetchedAt: Date.now() });
@@ -38830,8 +39411,12 @@ var GistStateStore = class {
     let toWrite = state;
     try {
       const remote = await this.fetchGistState(this.gistId);
-      if (remote) {
-        toWrite = mergeStates(state, remote);
+      if (remote.kind === "ok") {
+        toWrite = mergeStates(state, remote.state);
+      } else if (remote.kind === "invalid") {
+        this.writeCache(state);
+        warn(MODULE14, "Remote gist content failed validation \u2014 not overwriting it. Changes saved locally; gist sync skipped.");
+        return false;
       }
     } catch (err) {
       rethrowIfFatal(err);
@@ -38869,9 +39454,9 @@ var GistStateStore = class {
       debug(MODULE14, `Trying cached gist ID: ${cachedId}`);
       try {
         const fetched = await this.fetchGistState(cachedId);
-        if (fetched) {
+        if (fetched.kind === "ok") {
           this.gistId = cachedId;
-          const state = this.mergeCacheInto(fetched);
+          const state = this.mergeCacheInto(fetched.state);
           this.writeCache(state);
           return { gistId: cachedId, state, created: false };
         }
@@ -38888,8 +39473,8 @@ var GistStateStore = class {
       this.saveGistId(search.id);
       this.gistId = search.id;
       const fetched = await this.fetchGistState(search.id);
-      if (fetched) {
-        const state = this.mergeCacheInto(fetched);
+      if (fetched.kind === "ok") {
+        const state = this.mergeCacheInto(fetched.state);
         this.writeCache(state);
         return { gistId: search.id, state, created: false };
       }
@@ -38933,17 +39518,24 @@ var GistStateStore = class {
     };
   }
   // ── Gist API operations ──────────────────────────────────────────────
+  /**
+   * "missing" (no file/content) and "invalid" (content that fails parse or
+   * schema validation) are distinct outcomes: an invalid remote may be a
+   * corrupted-but-recoverable state or a newer state version written by a
+   * newer binary, so callers must not treat it as "nothing there" and
+   * overwrite it (#286).
+   */
   async fetchGistState(gistId) {
     const { data } = await this.octokit.gists.get({ gist_id: gistId });
     const file2 = data.files?.[GIST_FILENAME];
     if (!file2?.content)
-      return null;
+      return { kind: "missing" };
     try {
       const parsed = JSON.parse(file2.content);
-      return parseScoutState(parsed);
+      return { kind: "ok", state: parseScoutState(parsed) };
     } catch (err) {
       warn(MODULE14, `Gist content failed validation: ${errorMessage(err)}`);
-      return null;
+      return { kind: "invalid" };
     }
   }
   /**
@@ -39037,7 +39629,7 @@ function mergeTombstones(local, remote) {
   }
   return [...byUrl.values()].filter((t) => {
     const ts = new Date(t.removedAt).getTime();
-    return !Number.isFinite(ts) || ts >= cutoff;
+    return Number.isFinite(ts) && ts >= cutoff;
   });
 }
 function applyTombstones(items, tombstones, urlOf, touchedAtOf) {
@@ -39079,11 +39671,26 @@ function mergeStates(local, remote) {
     skippedIssues,
     lastSearchAt: pickFresherTimestamp(local.lastSearchAt, remote.lastSearchAt),
     lastRunAt: pickFresherTimestamp(local.lastRunAt, remote.lastRunAt) ?? (/* @__PURE__ */ new Date()).toISOString(),
-    gistId: remote.gistId ?? local.gistId
+    gistId: remote.gistId ?? local.gistId,
+    searchRotation: mergeSearchRotation(local.searchRotation, remote.searchRotation)
   };
 }
+function mergeSearchRotation(local, remote) {
+  const localRotation = local ?? { languageOffset: 0 };
+  const remoteRotation = remote ?? { languageOffset: 0 };
+  const localTs = localRotation.lastRotatedAt;
+  const remoteTs = remoteRotation.lastRotatedAt;
+  if (localTs && remoteTs) {
+    return localTs >= remoteTs ? localRotation : remoteRotation;
+  }
+  if (localTs)
+    return localRotation;
+  if (remoteTs)
+    return remoteRotation;
+  return remoteRotation.languageOffset >= localRotation.languageOffset ? remoteRotation : localRotation;
+}
 function mergeRepoScores(local, remote) {
-  const merged = { ...local };
+  const merged = Object.assign(/* @__PURE__ */ Object.create(null), local);
   for (const [repo, remoteScore] of Object.entries(remote)) {
     const localScore = merged[repo];
     if (!localScore) {
@@ -39303,23 +39910,50 @@ var OssScout = class {
     this.evictStaleCacheEntries();
     this.cullExpiredSkips();
     const skippedUrls = new Set((this.state.skippedIssues ?? []).map((s) => s.url));
+    if (options?.excludeRecentlySurfaced ?? true) {
+      const ttlDays = options?.recentlySurfacedTtlDays ?? 7;
+      const cutoff = Date.now() - ttlDays * 24 * 60 * 60 * 1e3;
+      for (const r of this.state.savedResults ?? []) {
+        const seen = Date.parse(r.lastSeenAt);
+        if (!Number.isNaN(seen) && seen >= cutoff)
+          skippedUrls.add(r.issueUrl);
+      }
+    }
     const discovery = new IssueDiscovery(this.githubToken, this.state.preferences, this);
     const prefs = this.state.preferences;
     const prefLangs = prefs.preferLanguages ?? [];
     const prefRepos = prefs.preferRepos ?? [];
     const preferLanguages = options?.preferLanguages ?? (prefLangs.length > 0 ? prefLangs : void 0);
     const preferRepos = options?.preferRepos ?? (prefRepos.length > 0 ? prefRepos : void 0);
+    const prefAvoid = prefs.avoidRepos ?? [];
+    const prefBoostTypes = prefs.boostIssueTypes ?? [];
+    const avoidRepos = options?.avoidRepos ?? (prefAvoid.length > 0 ? prefAvoid : void 0);
+    const boostIssueTypes = options?.boostIssueTypes ?? (prefBoostTypes.length > 0 ? prefBoostTypes : void 0);
     const diversityRatio = options?.diversityRatio ?? prefs.diversityRatio ?? 0;
-    const { candidates, strategiesUsed } = await discovery.searchIssues({
-      maxResults: options?.maxResults,
-      strategies: options?.strategies,
-      skippedUrls,
-      preferLanguages,
-      preferRepos,
-      diversityRatio,
-      interPhaseDelayMs: options?.interPhaseDelayMs,
-      broadPhaseDelayMs: options?.broadPhaseDelayMs
-    });
+    const rotation = this.state.searchRotation ?? { languageOffset: 0 };
+    let candidates;
+    let strategiesUsed;
+    try {
+      ({ candidates, strategiesUsed } = await discovery.searchIssues({
+        maxResults: options?.maxResults,
+        strategies: options?.strategies,
+        skippedUrls,
+        preferLanguages,
+        preferRepos,
+        avoidRepos,
+        boostIssueTypes,
+        diversityRatio,
+        interPhaseDelayMs: options?.interPhaseDelayMs,
+        broadPhaseDelayMs: options?.broadPhaseDelayMs,
+        languageRotationOffset: rotation.languageOffset
+      }));
+    } catch (err) {
+      if (err instanceof ValidationError) {
+        this.advanceRotationIfBroadRan(rotation, err.strategiesUsed ?? []);
+      }
+      throw err;
+    }
+    this.advanceRotationIfBroadRan(rotation, strategiesUsed);
     for (const c of candidates) {
       this.updateRepoSignalsFromHealth(c.projectHealth);
     }
@@ -39333,20 +39967,36 @@ var OssScout = class {
       strategiesUsed
     };
   }
+  /**
+   * Advance the language-rotation cursor when the broad phase actually ran.
+   * Called on both the success path and the zero-candidate ValidationError
+   * path — a broad phase that ran and found nothing must still rotate, or the
+   * same barren language slice would lead every subsequent run (#249
+   * follow-up). Skipped/gated broad phases don't burn a rotation slot.
+   */
+  advanceRotationIfBroadRan(rotation, strategiesUsed) {
+    if (!strategiesUsed.includes("broad"))
+      return;
+    this.state.searchRotation = {
+      ...rotation,
+      languageOffset: rotation.languageOffset + 1,
+      lastRotatedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this.dirty = true;
+  }
   /**
    * Populate the `hasActiveMaintainers` repo-score signal from a freshly
    * computed projectHealth (#167). It was initialized false and never set, so
    * calculateScore's +1 active-maintainers weight was inert; `isActive`
    * (recent commit activity) is a real, already-computed proxy.
    *
-   * `isResponsive` and `avgResponseDays` are deliberately NOT set here:
-   * `projectHealth.avgIssueResponseDays` is a hardcoded `0` placeholder
-   * (repo-health.ts), so deriving responsiveness from it would award +1 to
-   * every repo — a fake signal worse than the inert one. Real responsiveness
-   * needs an actual response-time measurement (extra API calls), deferred.
-   * `hasHostileComments` likewise stays a host-settable capability (it needs
-   * comment sentiment, out of scope). A failed health check is skipped so its
-   * neutral-default fields don't pollute the score.
+   * `isResponsive` and `avgResponseDays` are deliberately NOT set here, and
+   * `isResponsive` no longer carries a score weight at all (#167): real
+   * responsiveness needs an actual response-time measurement (extra API calls)
+   * that is out of scope, and `hasActiveMaintainers` already covers the
+   * activity proxy. `hasHostileComments` stays a host-settable capability (it
+   * needs comment sentiment, out of scope). A failed health check is skipped so
+   * its neutral-default fields don't pollute the score.
    */
   updateRepoSignalsFromHealth(health) {
     if (health.checkFailed)
@@ -39878,6 +40528,7 @@ var OssScout = class {
     }
     if (this.persistLocal) {
       try {
+        this.state = mergeStates(this.state, loadLocalState());
         saveLocalState(this.state);
       } catch {
         return false;
@@ -39903,16 +40554,21 @@ var OssScout = class {
     });
   }
   /**
-   * Calculate repo score (1-10) from observed data.
+   * Calculate repo score from observed data.
    * base 5, +1 per merged PR (max +3), -1 per closed-without-merge (max -3),
-   * +1 responsive, +1 active maintainers, -2 hostile comments, clamped 1-10
+   * +1 active maintainers, -2 hostile comments, clamped to [1, 10].
+   *
+   * `isResponsive` is intentionally NOT scored (#167): nothing in oss-scout
+   * ever computes it, so awarding +1 for it was dead weight that the
+   * now-computed `hasActiveMaintainers` signal already covers as the activity
+   * proxy. The field is retained on RepoSignals for backward compatibility but
+   * no longer affects the score. With the current signals the reachable range
+   * is [1, 9]; the upper clamp stays as defensive hygiene.
    */
   calculateScore(repoScore) {
     let score = 5;
     score += Math.min(repoScore.mergedPRCount, 3);
     score -= Math.min(repoScore.closedWithoutMergeCount, 3);
-    if (repoScore.signals.isResponsive)
-      score += 1;
     if (repoScore.signals.hasActiveMaintainers)
       score += 1;
     if (repoScore.signals.hasHostileComments)
@@ -39949,6 +40605,8 @@ var FIELD_CONFIGS = {
   preferLanguages: { type: "array" },
   preferRepos: { type: "array" },
   diversityRatio: { type: "float" },
+  avoidRepos: { type: "array" },
+  boostIssueTypes: { type: "array" },
   slmTriageModel: { type: "string" },
   slmTriageHost: { type: "string" },
   featuresAnchorThreshold: { type: "number" },
@@ -40007,6 +40665,8 @@ function applyPreferenceField(preferences, key, value) {
   const prefs = { ...preferences };
   switch (field.type) {
     case "string":
+      if (key === "slmTriageHost")
+        assertValidTriageHost(value);
       prefs[key] = value;
       break;
     case "boolean":
@@ -40067,6 +40727,10 @@ function validateUrl(url2) {
 
 // src/tools.ts
 var TOOL_TIMEOUT_MS = 3e5;
+var PERSIST_WARNING = "Checkpoint failed: changes were applied in memory but could not be persisted. They may be lost when the server restarts.";
+function withPersistWarning(payload, persisted) {
+  return persisted ? payload : { ...payload, persistWarning: PERSIST_WARNING };
+}
 function withTimeout(promise2, ms = TOOL_TIMEOUT_MS) {
   let timeoutId;
   const timer = new Promise((_, reject) => {
@@ -40082,7 +40746,7 @@ function registerTools(server, scout) {
     "search",
     "Search for open source issues matching your preferences",
     {
-      maxResults: external_exports3.number().optional().describe("Maximum number of results to return (default 10)"),
+      maxResults: external_exports3.number().int().min(1).max(50).optional().describe("Maximum number of results to return (1-50, default 10)"),
       strategies: external_exports3.string().optional().describe(
         "Comma-separated search strategies: merged, starred, broad, maintained, all"
       ),
@@ -40092,6 +40756,12 @@ function registerTools(server, scout) {
       preferRepos: external_exports3.array(external_exports3.string()).optional().describe(
         "Soft-boost ranking for candidates in one of these `owner/repo` slugs. Stronger weight than language match (#1244). Not a filter; only reorders."
       ),
+      avoidRepos: external_exports3.array(external_exports3.string()).optional().describe(
+        "Soft PENALTY (milder than excludeRepos) for candidates in one of these `owner/repo` slugs (#168). Pushes them down the ranking but does not remove them; a strong boost can still outweigh it."
+      ),
+      boostIssueTypes: external_exports3.array(external_exports3.string()).optional().describe(
+        'Soft-boost ranking for candidates whose issue labels match one of these types, case-insensitive (e.g. "bug", "good first issue") (#168). Not a filter; only reorders.'
+      ),
       diversityRatio: external_exports3.number().min(0).max(1).optional().describe(
         "Diversity counterweight (#1244): fraction of result slots reserved for candidates that matched NEITHER preference list. Counters echo-chamber bias when boosts accumulate over time. 0 disables, 1 reserves every slot for diversity. Default 0."
       )
@@ -40101,16 +40771,29 @@ function registerTools(server, scout) {
       strategies,
       preferLanguages,
       preferRepos,
+      avoidRepos,
+      boostIssueTypes,
       diversityRatio
     }) => {
       try {
-        const parsedStrategies = strategies ? strategies.split(",").map((s) => SearchStrategySchema.parse(s.trim())) : void 0;
+        const parsedStrategies = strategies ? strategies.split(",").map((s) => {
+          const trimmed = s.trim();
+          const parsed = SearchStrategySchema.safeParse(trimmed);
+          if (!parsed.success) {
+            throw new Error(
+              `Invalid strategy "${trimmed}". Valid strategies: ${SearchStrategySchema.options.join(", ")}`
+            );
+          }
+          return parsed.data;
+        }) : void 0;
         const result = await withTimeout(
           scout.search({
             maxResults: maxResults ?? 10,
             strategies: parsedStrategies,
             preferLanguages,
             preferRepos,
+            avoidRepos,
+            boostIssueTypes,
             diversityRatio,
             // No fixed inter-phase sleeps in the request/response MCP context;
             // the budget tracker still paces the GitHub calls (#143)
@@ -40119,9 +40802,18 @@ function registerTools(server, scout) {
           })
         );
         scout.saveResults(result.candidates);
-        await scout.checkpoint();
+        const persisted = await scout.checkpoint();
         return {
-          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                withPersistWarning(result, persisted),
+                null,
+                2
+              )
+            }
+          ]
         };
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -40136,7 +40828,7 @@ function registerTools(server, scout) {
     "scout-features",
     "Surface feature-scoped contribution opportunities in repos where you have 3+ merged PRs",
     {
-      maxResults: external_exports3.number().optional().describe("Maximum number of results to return (default 10)"),
+      maxResults: external_exports3.number().int().min(1).max(50).optional().describe("Maximum number of results to return (1-50, default 10)"),
       anchorThreshold: external_exports3.number().int().min(1).max(50).optional().describe("Anchor threshold override (default 3)"),
       splitRatio: external_exports3.number().min(0).max(1).optional().describe("Quick-wins/bigger-bets split ratio (default 0.6)")
     },
@@ -40150,9 +40842,18 @@ function registerTools(server, scout) {
           })
         );
         scout.saveResults([...result.quickWins, ...result.biggerBets]);
-        await scout.checkpoint();
+        const persisted = await scout.checkpoint();
         return {
-          content: [{ type: "text", text: JSON.stringify(result, null, 2) }]
+          content: [
+            {
+              type: "text",
+              text: JSON.stringify(
+                withPersistWarning(result, persisted),
+                null,
+                2
+              )
+            }
+          ]
         };
       } catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
@@ -40324,10 +41025,19 @@ function registerTools(server, scout) {
       scout.updatePreferences({
         [key]: validated[key]
       });
-      await scout.checkpoint();
+      const persisted = await scout.checkpoint();
       const updated = scout.getPreferences();
       return {
-        content: [{ type: "text", text: JSON.stringify(updated, null, 2) }]
+        content: [
+          {
+            type: "text",
+            text: JSON.stringify(
+              withPersistWarning(updated, persisted),
+              null,
+              2
+            )
+          }
+        ]
       };
     }
   );
@@ -40385,7 +41095,7 @@ function registerResources(server, scout) {
 // src/index.ts
 var SERVER_INFO = {
   name: "oss-scout-mcp",
-  version: "0.9.0"
+  version: "0.10.1"
   // x-release-please-version
 };
 function createServer(scout) {