session-orchestrator 3.17.0 → 3.19.0

package/scripts/lib/skill-evolution/idempotency.mjs

@@ -12,7 +12,18 @@
  * full via tmp-file + atomic rename. It is NEVER appended to with `>>` semantics,
  * because supersession reconciliation must mutate existing lines (set
  * `superseded_by`) — an append would leave stale duplicates and corrupt the
- * supersession graph.
+ * supersession graph. The store is OWNED by this module: nothing else — no
+ * report, no analysis run, no agent — may append to it; a read-side shape guard
+ * ({@link isRepairCandidateShape}) drops any record that is not a
+ * RepairCandidate, COUNTS the drop, and WARNs on stderr.
+ *
+ * The warning lives in {@link readStore} — the ONE seam every public function
+ * reads through — rather than in each caller's return shape, because only
+ * `mergeCandidates` has a result object with room for a count: `markProcessed`
+ * returns `{ok, reason}` and `isProcessed` returns a boolean, yet both rewrite
+ * or gate on a store whose foreign lines the rewrite DELETES. Those two run far
+ * more often than a merge, so a count reported only by `mergeCandidates` would
+ * leave the most-travelled deletion path silent.
  *
  * Three responsibilities:
  *   1. Persistence — `loadCandidates` (read) + atomic full rewrite (internal).
@@ -63,12 +74,90 @@ function resolveStorePath(repoRoot, storePath) {
   return rel;
 }
 
+/**
+ * Minimal shape guard for a persisted store line. A record is accepted only when
+ * it carries the three fields THIS store's own consumers read:
+ *   - `id`          — THE idempotency key (`mergeCandidates` byId index,
+ *                     `markProcessed`, `isProcessed` all look records up by it).
+ *   - `source`      — one half of the supersession key (`mergeCandidates`
+ *                     compares `rec.source === cand.source`).
+ *   - `target_path` — the other half of the supersession key.
+ *
+ * Deliberately NOT a full schema check, and NOT a copy of the reconcile store's
+ * guard: the two record types share only 5 fields, and the reconcile guard keys
+ * on `learning_key`, which a {@link RepairCandidate} does not have at all —
+ * applying it here would reject 100% of legitimate repair candidates. The fields
+ * above were chosen by what consumers actually READ, not by the typedef: a grep
+ * of `scripts/lib/skill-evolution/` (2026-07-31) found ZERO consumer reads of
+ * `created_at` — only the producer `candidate-intake.mjs` sets it — so requiring
+ * it would be schema validation, not a load-bearing check. The store is a
+ * mutable work-queue whose records may gain fields across schema versions, so
+ * over-strict validation would silently drop legitimate future records.
+ *
+ * What it DOES reject is a record no writer in this repo produces — the concrete
+ * incident class being a hand-written report artefact landing in the sibling
+ * reconcile store using `candidate_id` / `generated_at` / `status:"candidate"`
+ * (2026-07-31, GitLab #955; this store is the near-twin that kept the old
+ * permissive `typeof parsed === 'object'` check).
+ * @param {unknown} rec
+ * @returns {boolean}
+ */
+function isRepairCandidateShape(rec) {
+  if (!rec || typeof rec !== 'object' || Array.isArray(rec)) return false;
+  const r = /** @type {Record<string, unknown>} */ (rec);
+  if (typeof r.id !== 'string' || r.id.length === 0) return false;
+  if (typeof r.source !== 'string' || r.source.length === 0) return false;
+  if (typeof r.target_path !== 'string' || r.target_path.length === 0) return false;
+  return true;
+}
+
+/**
+ * Per-store memo of the skip count already WARNed about, keyed by resolved
+ * absolute store path. Without it a caller that reads the same store in a loop
+ * (the engine calls {@link isProcessed} once per candidate) would emit one
+ * identical line per read. A read that comes back CLEAN clears the entry, so a
+ * store contaminated again later warns again instead of being muted forever.
+ * @type {Map<string, number>}
+ */
+const warnedSkips = new Map();
+
+/**
+ * Emit ONE stderr WARN per (store, skip-count) transition. Called from every
+ * {@link readStore} exit — including the ENOENT path, whose `skipped: 0` clears
+ * the memo. Never throws: a stderr write failure must not break a store read.
+ * @param {string} absPath
+ * @param {number} skipped
+ * @returns {void}
+ */
+function warnOnSkipped(absPath, skipped) {
+  if (skipped <= 0) {
+    warnedSkips.delete(absPath);
+    return;
+  }
+  if (warnedSkips.get(absPath) === skipped) return;
+  warnedSkips.set(absPath, skipped);
+  try {
+    process.stderr.write(
+      `WARN repair-candidate store: ${skipped} unreadable record(s) skipped in ${absPath} — ` +
+        'not RepairCandidate shape (need id/source/target_path) or unparseable JSON. ' +
+        'The next full rewrite (mergeCandidates/markProcessed) DELETES them from disk.\n',
+    );
+  } catch {
+    // stderr unavailable (closed pipe) — the count is still returned to callers.
+  }
+}
+
 /**
  * Read + defensively parse the store's JSONL lines into RepairCandidate records.
- * Malformed lines (bad JSON, non-object) are skipped silently. A missing file
- * yields `[]`. Never throws.
+ * Malformed lines (bad JSON) and shape-foreign records (see
+ * {@link isRepairCandidateShape}) are skipped — and COUNTED, because every
+ * writer in this module rewrites the store in FULL, so a skipped line is dropped
+ * from disk on the next merge or stamp; a silent drop would be unattributable
+ * data loss. Every skip is ALSO reported on stderr via {@link warnOnSkipped},
+ * which is what covers the three callers whose return contract has no room for
+ * the count. A missing file yields `{ records: [], skipped: 0 }`. Never throws.
  * @param {string} absPath
- * @returns {RepairCandidate[]}
+ * @returns {{ records: RepairCandidate[], skipped: number }}
  */
 function readStore(absPath) {
   let raw;
@@ -76,11 +165,13 @@ function readStore(absPath) {
     raw = readFileSync(absPath, 'utf8');
   } catch {
     // ENOENT or any read error → empty store.
-    return [];
+    warnOnSkipped(absPath, 0);
+    return { records: [], skipped: 0 };
   }
 
   /** @type {RepairCandidate[]} */
   const records = [];
+  let skipped = 0;
   for (const line of raw.split('\n')) {
     const trimmed = line.trim();
     if (trimmed.length === 0) continue;
@@ -88,13 +179,17 @@ function readStore(absPath) {
     try {
       parsed = JSON.parse(trimmed);
     } catch {
+      skipped += 1;
       continue; // skip malformed line
     }
-    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {
+    if (isRepairCandidateShape(parsed)) {
       records.push(/** @type {RepairCandidate} */ (parsed));
+    } else {
+      skipped += 1;
     }
   }
-  return records;
+  warnOnSkipped(absPath, skipped);
+  return { records, skipped };
 }
 
 /**
@@ -127,8 +222,15 @@ function writeStore(absPath, records) {
 
 /**
  * Load every RepairCandidate currently persisted in the store. Reads JSONL,
- * skips malformed lines, returns `[]` for a missing file. Does NOT create the
- * runtime dir (mkdir -p happens only on write). Never throws.
+ * skips malformed lines AND shape-foreign records (missing `id` / `source` /
+ * `target_path`), returns `[]` for a missing file. Does NOT create the runtime
+ * dir (mkdir -p happens only on write). Never throws.
+ *
+ * Read-only: the skipped lines are still on disk after this call. The count is
+ * not in the return value — this function's plain-array contract is unchanged —
+ * but it is never silent: {@link readStore} WARNs it on stderr, and a caller
+ * that needs the number programmatically gets it from {@link mergeCandidates}
+ * as `dropped_on_read`.
  * @param {Object} params
  * @param {string} [params.repoRoot] - repo root; relative `storePath` is resolved against it.
  * @param {string} [params.storePath] - store path (relative ⇒ joined to repoRoot). Defaults to {@link DEFAULT_STORE_PATH}.
@@ -136,7 +238,7 @@ function writeStore(absPath, records) {
  */
 export function loadCandidates({ repoRoot, storePath } = {}) {
   const absPath = resolveStorePath(repoRoot, storePath);
-  return readStore(absPath);
+  return readStore(absPath).records;
 }
 
 /**
@@ -157,15 +259,25 @@ export function loadCandidates({ repoRoot, storePath } = {}) {
  * The store is rewritten in full (read-all → merge → atomic tmp+rename), never
  * appended. Never throws; a write failure still returns counts with
  * `total` reflecting the in-memory final line count.
+ *
+ * `dropped_on_read` reports how many PERSISTED lines the read-side guard
+ * rejected (malformed JSON, or a record missing `id`/`source`/`target_path`).
+ * Because the store is rewritten in full, those lines are DROPPED from disk by
+ * this call — the count is what makes that loss attributable instead of silent.
+ * It is deliberately NOT named `skipped`: `skipped_processed` above already
+ * means "an INCOMING candidate was skipped because its id is already processed",
+ * a different population (incoming, not persisted) with a different cause
+ * (terminal verdict, not contamination). Confusing the two would read a
+ * contaminated store as a healthy idempotent no-op.
  * @param {Object} params
  * @param {RepairCandidate[]} params.candidates - newly minted candidates to merge.
  * @param {string} [params.repoRoot]
  * @param {string} [params.storePath]
- * @returns {{ written: number, superseded: number, skipped_processed: number, total: number }}
+ * @returns {{ written: number, superseded: number, skipped_processed: number, dropped_on_read: number, total: number }}
  */
 export function mergeCandidates({ candidates, repoRoot, storePath } = {}) {
   const absPath = resolveStorePath(repoRoot, storePath);
-  const store = readStore(absPath);
+  const { records: store, skipped: droppedOnRead } = readStore(absPath);
 
   // Index existing records by id for O(1) lookup.
   /** @type {Map<string, RepairCandidate>} */
@@ -219,6 +331,7 @@ export function mergeCandidates({ candidates, repoRoot, storePath } = {}) {
     written,
     superseded,
     skipped_processed: skippedProcessed,
+    dropped_on_read: droppedOnRead,
     total: store.length,
   };
 }
@@ -230,7 +343,11 @@ export function mergeCandidates({ candidates, repoRoot, storePath } = {}) {
  *   - id not found → `{ ok: false, reason: 'not-found' }`
  *   - already processed → `{ ok: true }` (idempotent no-op; store untouched)
  *   - filesystem write failure → `{ ok: false, reason: 'fs-error' }`
- * Never throws.
+ * Never throws. Like {@link mergeCandidates} this rewrites the store in full, so
+ * shape-foreign lines are DELETED from disk here too. This API's result shape
+ * has no room to report the count (it is `{ ok, reason }` by contract), so the
+ * deletion is surfaced by {@link readStore}'s stderr WARN instead — this is the
+ * most-travelled of the three rewrite paths, so it must not be the silent one.
  * @param {Object} params
  * @param {string} params.id - candidate id to stamp.
  * @param {string} [params.repoRoot]
@@ -244,7 +361,7 @@ export function markProcessed({ id, repoRoot, storePath, now } = {}) {
   }
 
   const absPath = resolveStorePath(repoRoot, storePath);
-  const store = readStore(absPath);
+  const { records: store } = readStore(absPath);
 
   const target = store.find((rec) => rec && rec.id === id);
   if (!target) return { ok: false, reason: 'not-found' };
@@ -263,7 +380,9 @@ export function markProcessed({ id, repoRoot, storePath, now } = {}) {
 
 /**
  * True iff a candidate with the given id exists in the store AND has been
- * processed (`processed_at !== null`). Never throws.
+ * processed (`processed_at !== null`). Read-only — it does not itself rewrite
+ * the store — but it reads through the same shape guard, so a contaminated
+ * store is reported here too via {@link readStore}'s stderr WARN. Never throws.
  * @param {Object} params
  * @param {string} params.id
  * @param {string} [params.repoRoot]
@@ -273,7 +392,7 @@ export function markProcessed({ id, repoRoot, storePath, now } = {}) {
 export function isProcessed({ id, repoRoot, storePath } = {}) {
   if (typeof id !== 'string' || id.length === 0) return false;
   const absPath = resolveStorePath(repoRoot, storePath);
-  const store = readStore(absPath);
+  const { records: store } = readStore(absPath);
   const rec = store.find((r) => r && r.id === id);
   return !!rec && rec.processed_at !== null && rec.processed_at !== undefined;
 }

package/scripts/lib/skill-evolution/mr-opener.mjs

@@ -30,6 +30,9 @@
  *   - opts.vcsDetect  — ({ config, projectRoot }) => { bin } VCS detector
  *   - opts.createMr   — async (loop, draftOpts) => { created, mrUrl } MR opener
  *   - opts.log        — (level, msg) => void diagnostic logger
+ *   - opts.resolveRepoSpecFn — optional passthrough to the createMr seam's own
+ *     -R/--repo host-pinning resolver (#872); undefined lets createMr fall
+ *     back to its own real-resolveRepoSpec default.
  */
 
 import { execFile as execFileCb, spawnSync } from 'node:child_process';
@@ -468,6 +471,11 @@ export async function openRepairMr(
   }
 
   // Delegate MR creation to the mr-draft seam (collision check + draft create).
+  // repoRoot is passed through so maybeCreateDraftMR's -R/--repo host-pinning
+  // resolution (#872) resolves against THIS repo, not process.cwd() (which
+  // may differ inside a dispatched agent/worktree context); resolveRepoSpecFn
+  // is an optional passthrough seam for tests — undefined here simply means
+  // maybeCreateDraftMR falls back to its own real-resolveRepoSpec default.
   let mrResult;
   try {
     mrResult = await createMr(
@@ -480,7 +488,7 @@ export async function openRepairMr(
         parentRunId: `repair/${candidate.id}`,
         worktreePath: candidate.target_path ?? '(unknown)',
       },
-      { execFile: opts.execFile, log },
+      { execFile: opts.execFile, log, repoRoot, resolveRepoSpecFn: opts.resolveRepoSpecFn },
     );
   } catch (err) {
     const msg = err instanceof MrDraftError ? err.message : String(err?.message ?? err);

package/scripts/lib/spiral-carryover.mjs

@@ -23,10 +23,21 @@
  *
  * This module intentionally does NOT reuse `scripts/lib/vault-backfill/glab.mjs`
  * — that helper is vault-specific and wider in scope than needed here.
+ *
+ * Host pinning (#839): every `glab`/`gh` spawn below (the dedup lookup AND the
+ * `issue create` write) is pinned to the resolved repo via `-R <spec>`. A bare
+ * spawn falls back to the ambient `GITLAB_HOST`/`GH_HOST`, which can silently
+ * resolve to the WRONG GitLab instance on a multi-host machine — for a WRITE
+ * path (`issue create`) that means either filing into the wrong project, or
+ * failing open and defeating `findExistingLabeledIssue`'s dedup (which itself
+ * fails open to `{exists:false}` on any CLI error), risking double-filed
+ * issues. See `scripts/lib/vcs-repo-spec.mjs` for the full rationale.
  */
 
 import { execFileSync } from 'node:child_process';
 import { digestSha256Short } from './crypto-digest-utils.mjs';
+import { chargeIssueBudget, formatBlockReason } from './issue-budget.mjs';
+import { resolveRepoSpec } from './vcs-repo-spec.mjs';
 
 /**
  * Compute a stable 8-char sha256 hash of a task description.
@@ -51,13 +62,57 @@ function truncate(s, max) {
   return `${str.slice(0, Math.max(0, max - 1))}…`;
 }
 
+/**
+ * True when the argv describes an issue-CREATE call (not a list/search).
+ * The dedup lookups in this module also go through `runCli`, and those must
+ * never be charged against the issue budget.
+ *
+ * @param {string} cmd
+ * @param {string[]} args
+ * @returns {boolean}
+ */
+function isIssueCreateArgv(cmd, args) {
+  if (cmd !== 'gh' && cmd !== 'glab') return false;
+  if (!Array.isArray(args) || args.length < 2) return false;
+  return args[0] === 'issue' && (args[1] === 'create' || args[1] === 'new');
+}
+
 /**
  * Run a CLI command and return { ok, stdout, stderr }. Never throws.
+ *
+ * ISSUE-BUDGET GATE (both Node producers funnel through here): before shelling
+ * out to an issue-create call, the same `chargeIssueBudget` decision the
+ * `pre-bash-issue-budget` hook applies is evaluated here — otherwise the
+ * programmatic path would be a hole straight through the shell-level cap.
+ *
+ * In practice BOTH current callers are exempt by class (`createSpiralCarryoverIssue`
+ * emits `[Carryover] [SPIRAL|FAILED] …`, `createBrokenWindowIssue` emits the
+ * `broken-window` label), so this gate is a no-op for them by design — that is
+ * exactly the session-end promise at SKILL.md:319 / :1113 being preserved. It
+ * bites for any FUTURE non-exempt producer added to this module.
+ *
  * @param {string} cmd
  * @param {string[]} args
- * @returns {{ ok: boolean, stdout: string, stderr: string }}
+ * @returns {{ ok: boolean, stdout: string, stderr: string, budgetBlocked?: boolean }}
  */
 function runCli(cmd, args) {
+  if (isIssueCreateArgv(cmd, args)) {
+    try {
+      const repoRoot = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+      const titleIdx = args.indexOf('--title');
+      const verdict = chargeIssueBudget({
+        repoRoot,
+        sessionId: process.env.CLAUDE_SESSION_ID || null,
+        command: [cmd, ...args].join(' '),
+        title: titleIdx >= 0 ? (args[titleIdx + 1] ?? null) : null,
+      });
+      if (verdict.decision === 'block') {
+        return { ok: false, stdout: '', stderr: formatBlockReason(verdict), budgetBlocked: true };
+      }
+    } catch {
+      // Fail open — a budget-bookkeeping failure must never lose a carryover.
+    }
+  }
   try {
     const stdout = execFileSync(cmd, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });
     return { ok: true, stdout: String(stdout ?? ''), stderr: '' };
@@ -96,18 +151,33 @@ function parseIssueCreateOutput(stdout) {
  * Returns `{ exists: false }` on any CLI failure — caller treats this as
  * "probably no duplicate" and proceeds with creation (fail-open).
  *
- * @param {{ taskHash: string, label: string, vcs?: 'gitlab' | 'github' }} opts
+ * @param {{
+ *   taskHash: string,
+ *   label: string,
+ *   vcs?: 'gitlab' | 'github',
+ *   repoRoot?: string,
+ *   resolveRepoSpecFn?: (opts: { repoRoot: string, vcs: 'gitlab' | 'github' }) => string | undefined
+ * }} opts
  * @returns {Promise<{ exists: boolean, issueId?: number, issueUrl?: string }>}
  */
-async function findExistingLabeledIssue({ taskHash, label, vcs = 'gitlab' } = {}) {
+async function findExistingLabeledIssue({
+  taskHash,
+  label,
+  vcs = 'gitlab',
+  repoRoot = process.cwd(),
+  resolveRepoSpecFn = resolveRepoSpec,
+} = {}) {
   if (!taskHash || typeof taskHash !== 'string') {
     return { exists: false };
   }
 
+  const vcsResolved = vcs === 'github' ? 'github' : 'gitlab';
+  const spec = resolveRepoSpecFn({ repoRoot, vcs: vcsResolved });
+
   try {
-    if (vcs === 'github') {
+    if (vcsResolved === 'github') {
       // gh: list open issues carrying the label; body match is done locally.
-      const res = runCli('gh', [
+      const args = [
         'issue',
         'list',
         '--label',
@@ -118,7 +188,9 @@ async function findExistingLabeledIssue({ taskHash, label, vcs = 'gitlab' } = {}
         '100',
         '--json',
         'number,url,body',
-      ]);
+      ];
+      if (spec) args.push('-R', spec);
+      const res = runCli('gh', args);
       if (!res.ok) return { exists: false };
       let arr;
       try {
@@ -136,16 +208,9 @@ async function findExistingLabeledIssue({ taskHash, label, vcs = 'gitlab' } = {}
     }
 
     // Default: gitlab via glab.
-    const res = runCli('glab', [
-      'issue',
-      'list',
-      '--label',
-      label,
-      '--per-page',
-      '100',
-      '--output',
-      'json',
-    ]);
+    const args = ['issue', 'list', '--label', label, '--per-page', '100', '--output', 'json'];
+    if (spec) args.push('-R', spec);
+    const res = runCli('glab', args);
     if (!res.ok) return { exists: false };
     let arr;
     try {
@@ -173,22 +238,42 @@ async function findExistingLabeledIssue({ taskHash, label, vcs = 'gitlab' } = {}
  * Check whether a carryover issue already exists for this task.
  * Thin wrapper over `findExistingLabeledIssue` with the `type:carryover` label.
  *
- * @param {{ taskHash: string, vcs?: 'gitlab' | 'github' }} opts
+ * @param {{
+ *   taskHash: string,
+ *   vcs?: 'gitlab' | 'github',
+ *   repoRoot?: string,
+ *   resolveRepoSpecFn?: (opts: { repoRoot: string, vcs: 'gitlab' | 'github' }) => string | undefined
+ * }} opts
  * @returns {Promise<{ exists: boolean, issueId?: number, issueUrl?: string }>}
  */
-export async function findExistingCarryover({ taskHash, vcs = 'gitlab' } = {}) {
-  return findExistingLabeledIssue({ taskHash, label: 'type:carryover', vcs });
+export async function findExistingCarryover({
+  taskHash,
+  vcs = 'gitlab',
+  repoRoot = process.cwd(),
+  resolveRepoSpecFn = resolveRepoSpec,
+} = {}) {
+  return findExistingLabeledIssue({ taskHash, label: 'type:carryover', vcs, repoRoot, resolveRepoSpecFn });
 }
 
 /**
  * Check whether a broken-window closure issue already exists for this task.
  * Thin wrapper over `findExistingLabeledIssue` with the `broken-window` label.
  *
- * @param {{ taskHash: string, vcs?: 'gitlab' | 'github' }} opts
+ * @param {{
+ *   taskHash: string,
+ *   vcs?: 'gitlab' | 'github',
+ *   repoRoot?: string,
+ *   resolveRepoSpecFn?: (opts: { repoRoot: string, vcs: 'gitlab' | 'github' }) => string | undefined
+ * }} opts
  * @returns {Promise<{ exists: boolean, issueId?: number, issueUrl?: string }>}
  */
-export async function findExistingBrokenWindow({ taskHash, vcs = 'gitlab' } = {}) {
-  return findExistingLabeledIssue({ taskHash, label: 'broken-window', vcs });
+export async function findExistingBrokenWindow({
+  taskHash,
+  vcs = 'gitlab',
+  repoRoot = process.cwd(),
+  resolveRepoSpecFn = resolveRepoSpec,
+} = {}) {
+  return findExistingLabeledIssue({ taskHash, label: 'broken-window', vcs, repoRoot, resolveRepoSpecFn });
 }
 
 /**
@@ -245,7 +330,9 @@ function buildCarryoverBody({ taskDescription, kind, context, taskHash }) {
  *   kind: 'SPIRAL' | 'FAILED',
  *   context: string,
  *   priority?: 'high' | 'medium',
- *   vcs?: 'gitlab' | 'github'
+ *   vcs?: 'gitlab' | 'github',
+ *   repoRoot?: string,
+ *   resolveRepoSpecFn?: (opts: { repoRoot: string, vcs: 'gitlab' | 'github' }) => string | undefined
  * }} opts
  * @returns {Promise<{
  *   created: boolean,
@@ -261,6 +348,8 @@ export async function createSpiralCarryoverIssue({
   context,
   priority = 'high',
   vcs = 'gitlab',
+  repoRoot = process.cwd(),
+  resolveRepoSpecFn = resolveRepoSpec,
 } = {}) {
   try {
     if (kind !== 'SPIRAL' && kind !== 'FAILED') {
@@ -272,10 +361,19 @@ export async function createSpiralCarryoverIssue({
     }
     const vcsResolved = vcs === 'github' ? 'github' : 'gitlab';
 
+    // Resolve the -R/--repo host-pinning spec ONCE (#839); reuse the same
+    // resolved value for the dedup lookup below instead of re-resolving.
+    const spec = resolveRepoSpecFn({ repoRoot, vcs: vcsResolved });
+
     const taskHash = computeTaskHash(taskDescription);
 
     // Dedup check first.
-    const existing = await findExistingCarryover({ taskHash, vcs: vcsResolved });
+    const existing = await findExistingCarryover({
+      taskHash,
+      vcs: vcsResolved,
+      repoRoot,
+      resolveRepoSpecFn: () => spec,
+    });
     if (existing.exists) {
       return {
         created: false,
@@ -288,7 +386,7 @@ export async function createSpiralCarryoverIssue({
     const truncatedDesc = truncate(String(taskDescription ?? '').trim() || '(untitled task)', 80);
     const title = `[Carryover] [${kind}] ${truncatedDesc}`;
     const body = buildCarryoverBody({ taskDescription, kind, context, taskHash });
-    const labels = `priority:${priority},status:ready,type:carryover`;
+    const labels = `priority::${priority},status:ready,type:carryover`;
 
     let cmd;
     let args;
@@ -299,6 +397,7 @@ export async function createSpiralCarryoverIssue({
       cmd = 'glab';
       args = ['issue', 'create', '--title', title, '--description', body, '--label', labels];
     }
+    if (spec) args.push('-R', spec);
 
     const res = runCli(cmd, args);
     if (!res.ok) {
@@ -403,13 +502,15 @@ function buildBrokenWindowBody({ item, taskHash, dueDate, vcs }) {
  *   5. Parse stdout for the issue URL and return `{ created: true, issueId, issueUrl, due }`.
  *
  * Never throws. On any CLI failure returns `{ created: false, skipped: 'error', error }`.
- * `repoRoot` is accepted for signature symmetry with the caller but currently
- * unused — `glab`/`gh` resolve the project from the invoking cwd.
+ * `repoRoot` defaults to `process.cwd()` and is used (#839) to resolve the
+ * `-R`/`--repo` host-pinning spec via `resolveRepoSpecFn` — previously accepted
+ * only for signature symmetry and left unused.
  *
  * @param {{
  *   item: { title?: string, source?: string, description?: string, sessionId?: string },
  *   dueDays?: number,
  *   repoRoot?: string,
+ *   resolveRepoSpecFn?: (opts: { repoRoot: string, vcs: 'gitlab' | 'github' }) => string | undefined,
  *   vcs?: 'gitlab' | 'github'
  * }} opts
  * @returns {Promise<{
@@ -424,7 +525,8 @@ function buildBrokenWindowBody({ item, taskHash, dueDate, vcs }) {
 export async function createBrokenWindowIssue({
   item,
   dueDays = 7,
-  repoRoot: _repoRoot,
+  repoRoot = process.cwd(),
+  resolveRepoSpecFn = resolveRepoSpec,
   vcs = 'gitlab',
 } = {}) {
   try {
@@ -437,11 +539,20 @@ export async function createBrokenWindowIssue({
 
     const dueDate = computeDueDate(dueDays);
 
+    // Resolve the -R/--repo host-pinning spec ONCE (#839); reuse the same
+    // resolved value for the dedup lookup below instead of re-resolving.
+    const spec = resolveRepoSpecFn({ repoRoot, vcs: vcsResolved });
+
     // Dedup key: (source, title) pair — two different sources with the same
     // title are genuinely distinct broken windows and each file separately.
     const taskHash = computeTaskHash(`${source}::${title}`);
 
-    const existing = await findExistingBrokenWindow({ taskHash, vcs: vcsResolved });
+    const existing = await findExistingBrokenWindow({
+      taskHash,
+      vcs: vcsResolved,
+      repoRoot,
+      resolveRepoSpecFn: () => spec,
+    });
     if (existing.exists) {
       return {
         created: false,
@@ -453,7 +564,7 @@ export async function createBrokenWindowIssue({
 
     const issueTitle = `[Broken-Window] ${truncate(title, 80)}`;
     const body = buildBrokenWindowBody({ item, taskHash, dueDate, vcs: vcsResolved });
-    const labels = 'broken-window,priority:high';
+    const labels = 'broken-window,priority::high';
 
     let cmd;
     let args;
@@ -475,6 +586,7 @@ export async function createBrokenWindowIssue({
         dueDate,
       ];
     }
+    if (spec) args.push('-R', spec);
 
     const res = runCli(cmd, args);
     if (!res.ok) {