diff --git a/.github/workflows/agent-performance-analyzer.lock.yml b/.github/workflows/agent-performance-analyzer.lock.yml
index a9b1f5f13e..9f22b2e449 100644
--- a/.github/workflows/agent-performance-analyzer.lock.yml
+++ b/.github/workflows/agent-performance-analyzer.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/reporting.md
 #
-# frontmatter-hash: 1a5add07403c04ac323f0d46e5732df0c9dedd3c5145b72ddda43dae416bc324
+# frontmatter-hash: f7ba17ae6c234dae7ffe7727c4e022446952056ce100a70cdf4c88b4512bb629
 
 name: "Agent Performance Analyzer - Meta-Orchestrator"
 "on":
@@ -200,7 +200,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"add_comment":{"max":10},"create_discussion":{"expires":168,"max":2},"create_issue":{"group":true,"max":5},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"add_comment":{"max":10},"create_discussion":{"expires":168,"max":2},"create_issue":{"expires":48,"group":true,"max":5},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1346,7 +1346,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":10},\"create_discussion\":{\"expires\":168,\"max\":2},\"create_issue\":{\"group\":true,\"labels\":[\"cookie\"],\"max\":5},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":10},\"create_discussion\":{\"expires\":168,\"max\":2},\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"cookie\"],\"max\":5},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/agent-performance-analyzer.md b/.github/workflows/agent-performance-analyzer.md
index 7253c910ba..0b17b15b2b 100644
--- a/.github/workflows/agent-performance-analyzer.md
+++ b/.github/workflows/agent-performance-analyzer.md
@@ -20,6 +20,7 @@ imports:
   - shared/reporting.md
 safe-outputs:
   create-issue:
+    expires: 2d
     max: 5
     group: true
     labels: [cookie]
diff --git a/.github/workflows/breaking-change-checker.lock.yml b/.github/workflows/breaking-change-checker.lock.yml
index ae764156fd..dff9ca5543 100644
--- a/.github/workflows/breaking-change-checker.lock.yml
+++ b/.github/workflows/breaking-change-checker.lock.yml
@@ -21,7 +21,7 @@
 #
 # Daily analysis of recent commits and merged PRs for breaking CLI changes
 #
-# frontmatter-hash: 48e53a7b6315f300b5409f783832db28db6a0b995575c8d9f27d750ff13b158e
+# frontmatter-hash: f55c34ad2905204258a41f1406b66d9067e1e02342ba09f3367f31c40f89a34f
 
 name: "Breaking Change Checker"
 "on":
diff --git a/.github/workflows/breaking-change-checker.md b/.github/workflows/breaking-change-checker.md
index 02e328381f..d9e5e5754d 100644
--- a/.github/workflows/breaking-change-checker.md
+++ b/.github/workflows/breaking-change-checker.md
@@ -21,6 +21,7 @@ tools:
   edit:
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[breaking-change] "
     labels: [breaking-change, automated-analysis, cookie]
     assignees: copilot
diff --git a/.github/workflows/ci-doctor.lock.yml b/.github/workflows/ci-doctor.lock.yml
index 2da290204f..d76c95218a 100644
--- a/.github/workflows/ci-doctor.lock.yml
+++ b/.github/workflows/ci-doctor.lock.yml
@@ -23,7 +23,7 @@
 #
 # Source: githubnext/agentics/workflows/ci-doctor.md@ea350161ad5dcc9624cf510f134c6a9e39a6f94d
 #
-# frontmatter-hash: cc92e5f42dcb7786c09439144562e538662820b59d2e49d8b23c79e75fce6037
+# frontmatter-hash: f430896914b2e4529a1543146065fc41191053493ec76f5f47c3ee9591b72221
 #
 # Effective stop-time: 2026-02-09 04:24:18
 
@@ -185,7 +185,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"add_comment":{"max":1},"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"add_comment":{"max":1},"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1134,7 +1134,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"create_issue\":{\"labels\":[\"cookie\"],\"max\":1,\"title_prefix\":\"[CI Failure Doctor] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"create_issue\":{\"expires\":48,\"labels\":[\"cookie\"],\"max\":1,\"title_prefix\":\"[CI Failure Doctor] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/ci-doctor.md b/.github/workflows/ci-doctor.md
index 2ac7b979b2..240f66b0e1 100644
--- a/.github/workflows/ci-doctor.md
+++ b/.github/workflows/ci-doctor.md
@@ -28,6 +28,7 @@ engine:
 
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[CI Failure Doctor] "
     labels: [cookie]
   add-comment:
diff --git a/.github/workflows/cli-consistency-checker.lock.yml b/.github/workflows/cli-consistency-checker.lock.yml
index b09997e6c3..28b97284ba 100644
--- a/.github/workflows/cli-consistency-checker.lock.yml
+++ b/.github/workflows/cli-consistency-checker.lock.yml
@@ -21,7 +21,7 @@
 #
 # Inspects the gh-aw CLI to identify inconsistencies, typos, bugs, or documentation gaps by running commands and analyzing output
 #
-# frontmatter-hash: 57da17ad6864cfab7198de57987a7d0f72d037aaff6f6abb01d632c64bf041dc
+# frontmatter-hash: d13dbdc2a7d699f7c0926196340c1111e4f173de0d5661b2878a388bc1bd5fef
 
 name: "CLI Consistency Checker"
 "on":
@@ -159,7 +159,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"group":true,"max":6},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"group":true,"max":6},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1006,7 +1006,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"group\":true,\"labels\":[\"automation\",\"cli\",\"documentation\",\"cookie\"],\"max\":6,\"title_prefix\":\"[cli-consistency] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"automation\",\"cli\",\"documentation\",\"cookie\"],\"max\":6,\"title_prefix\":\"[cli-consistency] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/cli-consistency-checker.md b/.github/workflows/cli-consistency-checker.md
index 3fadd40f6a..b534c0e0ac 100644
--- a/.github/workflows/cli-consistency-checker.md
+++ b/.github/workflows/cli-consistency-checker.md
@@ -19,6 +19,7 @@ tools:
     - "*"
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[cli-consistency] "
     labels: [automation, cli, documentation, cookie]
     max: 6  # 1 parent + 5 sub-issues
diff --git a/.github/workflows/cli-version-checker.lock.yml b/.github/workflows/cli-version-checker.lock.yml
index 88ec1eee3d..a553128294 100644
--- a/.github/workflows/cli-version-checker.lock.yml
+++ b/.github/workflows/cli-version-checker.lock.yml
@@ -26,7 +26,7 @@
 #     - shared/jqschema.md
 #     - shared/reporting.md
 #
-# frontmatter-hash: 566b1fb2f0515a1fce4d67a7c858dc2a10a56930aa5015ff5e6b5bad93c8bf18
+# frontmatter-hash: c10bdb1d1632b03e5ad28c2aec32d85ded7eb1d5db7bda95b899c207b80b8fe3
 
 name: "CLI Version Checker"
 "on":
@@ -184,7 +184,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1265,7 +1265,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"automation\",\"dependencies\",\"cookie\"],\"max\":1,\"title_prefix\":\"[ca] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"automation\",\"dependencies\",\"cookie\"],\"max\":1,\"title_prefix\":\"[ca] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/cli-version-checker.md b/.github/workflows/cli-version-checker.md
index 25ea97095e..e4f3194f70 100644
--- a/.github/workflows/cli-version-checker.md
+++ b/.github/workflows/cli-version-checker.md
@@ -22,6 +22,7 @@ tools:
   edit:
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[ca] "
     labels: [automation, dependencies, cookie]
 timeout-minutes: 45
diff --git a/.github/workflows/daily-cli-performance.lock.yml b/.github/workflows/daily-cli-performance.lock.yml
index 550fcb2dc8..90f83dd13a 100644
--- a/.github/workflows/daily-cli-performance.lock.yml
+++ b/.github/workflows/daily-cli-performance.lock.yml
@@ -26,7 +26,7 @@
 #     - shared/go-make.md
 #     - shared/reporting.md
 #
-# frontmatter-hash: eb8004d0cd209c564390b9ab798b7663dedbf717bbe1c23343a676793df96a72
+# frontmatter-hash: 851d537dfa3f33b22c99d4acb7984284ad1f35b759da4ebd7b570794a2a81446
 
 name: "Daily CLI Performance Agent"
 "on":
@@ -173,7 +173,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"add_comment":{"max":5},"create_issue":{"group":true,"max":3},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"add_comment":{"max":5},"create_issue":{"expires":48,"group":true,"max":3},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1409,7 +1409,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":5},\"create_issue\":{\"group\":true,\"labels\":[\"performance\",\"automation\",\"cookie\"],\"max\":3,\"title_prefix\":\"[performance] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":5},\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"performance\",\"automation\",\"cookie\"],\"max\":3,\"title_prefix\":\"[performance] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/daily-cli-performance.md b/.github/workflows/daily-cli-performance.md
index 8a21d6553f..703935840c 100644
--- a/.github/workflows/daily-cli-performance.md
+++ b/.github/workflows/daily-cli-performance.md
@@ -21,6 +21,7 @@ tools:
     toolsets: [default, issues]
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[performance] "
     labels: [performance, automation, cookie]
     max: 3
diff --git a/.github/workflows/daily-file-diet.lock.yml b/.github/workflows/daily-file-diet.lock.yml
index edd3603744..9a9fb19601 100644
--- a/.github/workflows/daily-file-diet.lock.yml
+++ b/.github/workflows/daily-file-diet.lock.yml
@@ -26,7 +26,7 @@
 #     - shared/reporting.md
 #     - shared/safe-output-app.md
 #
-# frontmatter-hash: f185ec9666d67ff97e552d190ff847bafe95de163db66b0910f7e9ffbed70a46
+# frontmatter-hash: 3687bc9aff3f0f8510571312acbf7558c46448c763999e1ad64c675d3348b9e4
 
 name: "Daily File Diet"
 "on":
@@ -166,7 +166,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1202,7 +1202,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"refactoring\",\"code-health\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[file-diet] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"refactoring\",\"code-health\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[file-diet] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ steps.safe-outputs-app-token.outputs.token }}
           script: |
diff --git a/.github/workflows/daily-file-diet.md b/.github/workflows/daily-file-diet.md
index 5ed2c676a5..b573eaadfd 100644
--- a/.github/workflows/daily-file-diet.md
+++ b/.github/workflows/daily-file-diet.md
@@ -21,6 +21,7 @@ imports:
 
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[file-diet] "
     labels: [refactoring, code-health, automated-analysis, cookie]
     max: 1
diff --git a/.github/workflows/daily-multi-device-docs-tester.lock.yml b/.github/workflows/daily-multi-device-docs-tester.lock.yml
index e5313b142d..b34bc2f5ce 100644
--- a/.github/workflows/daily-multi-device-docs-tester.lock.yml
+++ b/.github/workflows/daily-multi-device-docs-tester.lock.yml
@@ -26,7 +26,7 @@
 #     - shared/docs-server-lifecycle.md
 #     - shared/reporting.md
 #
-# frontmatter-hash: f7fbac522d88e59d1f3c9fd09668c70e4a89cdd5b8c1c1f7bcccc8708797b5d7
+# frontmatter-hash: 40ea4735c0bedebd0fac0b6929973ec25d6077eccc43afc23b4cab261967f989
 
 name: "Multi-Device Docs Tester"
 "on":
@@ -175,7 +175,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1},"upload_asset":{"max":0}}
+          {"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1},"upload_asset":{"max":0}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1324,7 +1324,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"cookie\"],\"max\":1},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"cookie\"],\"max\":1},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/daily-multi-device-docs-tester.md b/.github/workflows/daily-multi-device-docs-tester.md
index 2ff66d3b0e..63ed78f14b 100644
--- a/.github/workflows/daily-multi-device-docs-tester.md
+++ b/.github/workflows/daily-multi-device-docs-tester.md
@@ -36,6 +36,7 @@ tools:
 safe-outputs:
   upload-asset:
   create-issue:
+    expires: 2d
     labels: [cookie]
 
 network:
diff --git a/.github/workflows/daily-safe-output-optimizer.lock.yml b/.github/workflows/daily-safe-output-optimizer.lock.yml
index dfc87a093b..d63bac2732 100644
--- a/.github/workflows/daily-safe-output-optimizer.lock.yml
+++ b/.github/workflows/daily-safe-output-optimizer.lock.yml
@@ -27,7 +27,7 @@
 #     - shared/mcp/gh-aw.md
 #     - shared/reporting.md
 #
-# frontmatter-hash: 617e4da0a2025636fb9763f1bc32541ccc1118df5bd8c94282e4c5558c5b3da8
+# frontmatter-hash: fbf02c0946bcdf53d62db66fc77e4fb40ffebd0e15f5de22b5a63ee89f1c6bb5
 
 name: "Daily Safe Output Tool Optimizer"
 "on":
@@ -208,7 +208,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1351,7 +1351,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"bug\",\"safe-outputs\",\"tool-improvement\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[safeoutputs] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"bug\",\"safe-outputs\",\"tool-improvement\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[safeoutputs] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/daily-safe-output-optimizer.md b/.github/workflows/daily-safe-output-optimizer.md
index fd8745b94b..3fdc00e010 100644
--- a/.github/workflows/daily-safe-output-optimizer.md
+++ b/.github/workflows/daily-safe-output-optimizer.md
@@ -25,6 +25,7 @@ steps:
 
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[safeoutputs] "
     labels: [bug, safe-outputs, tool-improvement, automated-analysis, cookie]
     max: 1
diff --git a/.github/workflows/daily-testify-uber-super-expert.lock.yml b/.github/workflows/daily-testify-uber-super-expert.lock.yml
index 48cf87372b..95f0dd8e58 100644
--- a/.github/workflows/daily-testify-uber-super-expert.lock.yml
+++ b/.github/workflows/daily-testify-uber-super-expert.lock.yml
@@ -26,7 +26,7 @@
 #     - shared/reporting.md
 #     - shared/safe-output-app.md
 #
-# frontmatter-hash: 61bc8f727e28a6808329ce299e8b6cef1b8ae117e3ca99d43c7fbc2bbaa421cb
+# frontmatter-hash: f62bba13fea7256953c409f42031d0f900900ff85aadc314601cc26d3f56dd2c
 
 name: "Daily Testify Uber Super Expert"
 "on":
@@ -176,7 +176,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1307,7 +1307,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"testing\",\"code-quality\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[testify-expert] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"testing\",\"code-quality\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[testify-expert] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ steps.safe-outputs-app-token.outputs.token }}
           script: |
diff --git a/.github/workflows/daily-testify-uber-super-expert.md b/.github/workflows/daily-testify-uber-super-expert.md
index 95b7e6f767..79c1f7f4aa 100644
--- a/.github/workflows/daily-testify-uber-super-expert.md
+++ b/.github/workflows/daily-testify-uber-super-expert.md
@@ -20,6 +20,7 @@ imports:
 
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[testify-expert] "
     labels: [testing, code-quality, automated-analysis, cookie]
     max: 1
diff --git a/.github/workflows/deep-report.lock.yml b/.github/workflows/deep-report.lock.yml
index edd633a3b0..0ea5350362 100644
--- a/.github/workflows/deep-report.lock.yml
+++ b/.github/workflows/deep-report.lock.yml
@@ -28,7 +28,7 @@
 #     - shared/reporting.md
 #     - shared/weekly-issues-data-fetch.md
 #
-# frontmatter-hash: 01184a6177c0410bccf9f7358f44cf5b2ce8d7f79a465bae35bde77748dfb14c
+# frontmatter-hash: 6ee2f9512eec75167c5dc8c792424c723a5147d846c02bb3da48daa173ac45a8
 
 name: "DeepReport - Intelligence Gathering Agent"
 "on":
@@ -218,7 +218,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_discussion":{"expires":168,"max":1},"create_issue":{"group":true,"max":3},"missing_data":{},"missing_tool":{},"noop":{"max":1},"upload_asset":{"max":0}}
+          {"create_discussion":{"expires":168,"max":1},"create_issue":{"expires":48,"group":true,"max":3},"missing_data":{},"missing_tool":{},"noop":{"max":1},"upload_asset":{"max":0}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1536,7 +1536,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"reports\",\"close_older_discussions\":true,\"expires\":168,\"max\":1},\"create_issue\":{\"group\":true,\"labels\":[\"automation\",\"improvement\",\"quick-win\",\"cookie\"],\"max\":3,\"title_prefix\":\"[deep-report] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"reports\",\"close_older_discussions\":true,\"expires\":168,\"max\":1},\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"automation\",\"improvement\",\"quick-win\",\"cookie\"],\"max\":3,\"title_prefix\":\"[deep-report] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/deep-report.md b/.github/workflows/deep-report.md
index 41a68798a2..a34d25610a 100644
--- a/.github/workflows/deep-report.md
+++ b/.github/workflows/deep-report.md
@@ -32,6 +32,7 @@ safe-outputs:
     max: 1
     close-older-discussions: true
   create-issue:
+    expires: 2d
     title-prefix: "[deep-report] "
     labels: [automation, improvement, quick-win, cookie]
     max: 3
diff --git a/.github/workflows/delight.lock.yml b/.github/workflows/delight.lock.yml
index 7038466f27..444c3341f0 100644
--- a/.github/workflows/delight.lock.yml
+++ b/.github/workflows/delight.lock.yml
@@ -26,7 +26,7 @@
 #     - shared/jqschema.md
 #     - shared/reporting.md
 #
-# frontmatter-hash: fa8371cc9ef060f418bf6e28344a19b6757321e96234ab411573709d51ad6d94
+# frontmatter-hash: fc8abbad9ca09608b279c36aacc406fac6b434ddd5d6dbf0a8e3b371b351ab2c
 
 name: "Delight"
 "on":
@@ -177,7 +177,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_discussion":{"expires":168,"max":1},"create_issue":{"group":true,"max":2},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_discussion":{"expires":168,"max":1},"create_issue":{"expires":48,"group":true,"max":2},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1362,7 +1362,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"audits\",\"close_older_discussions\":true,\"expires\":168,\"max\":1},\"create_issue\":{\"group\":true,\"labels\":[\"delight\",\"cookie\"],\"max\":2},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"audits\",\"close_older_discussions\":true,\"expires\":168,\"max\":1},\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"delight\",\"cookie\"],\"max\":2},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/delight.md b/.github/workflows/delight.md
index cbc128c27c..9e4fb3d061 100644
--- a/.github/workflows/delight.md
+++ b/.github/workflows/delight.md
@@ -27,6 +27,7 @@ safe-outputs:
     max: 1
     close-older-discussions: true
   create-issue:
+    expires: 2d
     labels: [delight, cookie]
     max: 2
     group: true
diff --git a/.github/workflows/dependabot-burner.lock.yml b/.github/workflows/dependabot-burner.lock.yml
index 68a8059f1b..96c3ccce9b 100644
--- a/.github/workflows/dependabot-burner.lock.yml
+++ b/.github/workflows/dependabot-burner.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/campaign.md
 #
-# frontmatter-hash: 655dfa6750abc34cbe9949b13307eaaf31a986ad38ecab6cb0255c2ab2df3158
+# frontmatter-hash: 38b0ad5430565f4152442d2397e3eb1d45abf9dbc7b123eee156dd25b2799037
 
 name: "Dependabot Burner"
 "on":
@@ -167,7 +167,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":5},"create_project_status_update":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1},"update_project":{"max":100}}
+          {"create_issue":{"expires":48,"max":5},"create_project_status_update":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1},"update_project":{"max":100}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -804,118 +804,37 @@ jobs:
           </system>
           PROMPT_EOF
           cat << 'PROMPT_EOF' >> "$GH_AW_PROMPT"
-          # Campaign Orchestrator Core Rules
+          # Campaign Orchestrator
           
-          These are generic orchestrator rules.
+          You are a campaign orchestrator that coordinates a single campaign by:
           
-          ## Operating Model
+          1. Discovering work items
+          2. Making decisions
+          3. Assigning/Dispatching work items
+          4. Generating a report
           
-          - The orchestrator coordinates a single campaign: discover state, decide deterministically, apply minimal writes, and report.
-          - Delegate repo/code changes (PRs, commits) to worker workflows unless the campaign explicitly grants direct repo authority.
-          - The GitHub Project board (when used) is the authoritative campaign state; do not invent state.
-          
-          ## Non-Negotiables
-          
-          - Separate **reads** and **writes**. Do all discovery first, then perform all writes.
-          - Be deterministic and idempotent: safe to re-run with the same inputs.
-          - Minimize API calls; enforce strict pagination budgets.
-          - Prefer incremental discovery over full rescans.
-          - If throttled (HTTP 429 / rate-limit 403), back off and end the run after reporting what remains.
-          
-          ## Budgets & Pacing
-          
-          - Enforce page and item budgets strictly; stop early and defer remaining work to the next run.
-          - Use stable ordering in discovery (e.g., `updatedAt` with a deterministic tiebreak like ID/number).
-          - Never “catch up” by expanding scope or blowing budgets.
-          
-          ## Repo-Memory Cursor & Metrics
-          
-          If this campaign uses repo-memory:
-          
-          - **Cursor file path**: `/tmp/gh-aw/repo-memory/campaigns/<campaign_id>/cursor.json`
-            - If it exists: read first and continue from its boundary.
-            - If it does not exist: create it by end of run.
-            - Always write the updated cursor back to the same path.
-          
-          - **Metrics snapshots path**: `/tmp/gh-aw/repo-memory/campaigns/<campaign_id>/metrics/*.json`
-            - Write **one new** append-only JSON snapshot per run (do not rewrite history).
-            - Use UTC date in the filename (example: `metrics/<YYYY-MM-DD>.json`).
+          - Use only allowlisted safe outputs.
+          - Do not interleave reads and writes.
           
-          ## Correlation & Status Mapping
+          ## Memory & Metrics
           
-          - Correlation must be explicit and stable (e.g., tracker-id plus labels); avoid fuzzy matching.
-          - Determine status only from explicit GitHub state:
-            - Open → active backlog state (e.g., `Todo`)
-            - Closed (issue/discussion) → `Done`
-            - Merged (PR) → `Done`
+          If the campaign uses repo-memory:
           
-          ## Execution Phases (Required Order)
+          **Cursor file path**: `/tmp/gh-aw/repo-memory/campaigns/<campaign_id>/cursor.json`
           
-          1. Read state (discovery) — NO WRITES
-          2. Decide (planning) — NO WRITES
-          3. Apply updates (write phase) — WRITES
-          4. Dispatch workers (optional)
-          5. Report
+          - If it exists: read first and continue from its boundary.
+          - If it does not exist: create it by end of run.
+          - Always write the updated cursor back to the same path.
           
-          ## Writes (Safe-Outputs Only)
+          **Metrics snapshots path**: `/tmp/gh-aw/repo-memory/campaigns/<campaign_id>/metrics/*.json`
           
-          - Use only allowlisted safe outputs.
-          - Keep writes deterministic and minimal.
-          - Do not interleave reads and writes.
+          - Write **one new** append-only JSON snapshot per run (do not rewrite history).
+          - Use UTC date in the filename (example: `metrics/<YYYY-MM-DD>.json`).
           
           ## Reporting
           
           Always report:
-          
-          - Discovered counts (by type)
-          - Processed counts (by action: add/status_update/backfill/noop/failed)
-          - Deferred counts (due to budgets)
           - Failures (with reasons)
-          - Whether cursor was advanced and where the next run should resume
-          
-          ## No-Work Default
-          
-          If discovery finds **no** work items to process:
-          
-          - If the campaign uses a GitHub Project, post exactly one `create_project_status_update` with status `INACTIVE`.
-          - Then call `noop` with a short message and end the run.
-          
-          ## Project Status Updates (Default)
-          
-          If the campaign uses a GitHub Project, post exactly **one** `create_project_status_update` per run.
-          
-          - `status`: use `INACTIVE` when no work was found; otherwise prefer `ON_TRACK` (or `AT_RISK` if partial failures).
-          - `start_date`: today (YYYY-MM-DD)
-          - `body`: include the discovery query, counts (found / updated / created), and next steps
-          
-          ## Authority
-          
-          - If any campaign instructions conflict with Project update instructions, Project update instructions win for project writes.
-          
-          ## Project Field Defaults (When Using GitHub Projects)
-          
-          If the campaign uses a GitHub Project to track state, use these as **defaults** for `update_project` writes.
-          
-          Notes:
-          - These are defaults. A specific workflow may override them.
-          - Only set fields that exist in the target Project schema; omit unknown fields.
-          
-          Defaults (recommended field keys):
-          
-          - `campaign_id`: derive from the workflow's **Campaign ID** in its Config section.
-          - `target_repo`: derive from the workflow's **Target repo** in its Config section.
-          - `worker_workflow`: set to the discovery source (e.g. the orchestrator/workflow name or the system that surfaced the item).
-          
-          Status defaults:
-          
-          - If the workflow is tracking **open** work items, set `status` to an active backlog state (commonly `"Todo"`).
-          - If tracking **completed** work items (merged PRs / closed issues), set `status` to a done state (commonly `"Done"`).
-          
-          Optional, best-effort fields (only if the Project has them):
-          
-          - `priority`: High/Medium/Low
-          - `size`: Small/Medium/Large
-          - `start_date`: YYYY-MM-DD
           
           
           PROMPT_EOF
@@ -1438,7 +1357,7 @@ jobs:
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_TEMPORARY_PROJECT_MAP: ${{ steps.process_project_safe_outputs.outputs.temporary_project_map }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"max\":5},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"max\":5},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/dependabot-go-checker.lock.yml b/.github/workflows/dependabot-go-checker.lock.yml
index 482fa1e438..cd9e4309e6 100644
--- a/.github/workflows/dependabot-go-checker.lock.yml
+++ b/.github/workflows/dependabot-go-checker.lock.yml
@@ -21,7 +21,7 @@
 #
 # Checks for Go module and NPM dependency updates and analyzes Dependabot PRs for compatibility and breaking changes
 #
-# frontmatter-hash: cebdc19bfeb70651e8ff1c03b97c56f81283e8afb415c2d0a12e4e1ba86ed923
+# frontmatter-hash: 228a8bf7c290a50446f102aaa6a9a3f13263f08af880b9406c5bd84bd23826a2
 
 name: "Dependabot Dependency Checker"
 "on":
@@ -160,7 +160,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"close_issue":{"max":20,"required_title_prefix":"[deps]"},"create_issue":{"group":true,"max":10},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"close_issue":{"max":20,"required_title_prefix":"[deps]"},"create_issue":{"expires":48,"group":true,"max":10},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1045,7 +1045,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"close_issue\":{\"max\":20,\"required_title_prefix\":\"[deps]\",\"target\":\"*\"},\"create_issue\":{\"group\":true,\"labels\":[\"dependencies\",\"go\",\"cookie\"],\"max\":10,\"title_prefix\":\"[deps]\"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"close_issue\":{\"max\":20,\"required_title_prefix\":\"[deps]\",\"target\":\"*\"},\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"dependencies\",\"go\",\"cookie\"],\"max\":10,\"title_prefix\":\"[deps]\"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/dependabot-go-checker.md b/.github/workflows/dependabot-go-checker.md
index 1d3e0c74e2..7362ddd9af 100644
--- a/.github/workflows/dependabot-go-checker.md
+++ b/.github/workflows/dependabot-go-checker.md
@@ -23,6 +23,7 @@ safe-outputs:
     target: "*"
     max: 20
   create-issue:
+    expires: 2d
     title-prefix: "[deps]"
     labels: [dependencies, go, cookie]
     max: 10
diff --git a/.github/workflows/duplicate-code-detector.lock.yml b/.github/workflows/duplicate-code-detector.lock.yml
index a150a34dff..ac34cfdabd 100644
--- a/.github/workflows/duplicate-code-detector.lock.yml
+++ b/.github/workflows/duplicate-code-detector.lock.yml
@@ -21,7 +21,7 @@
 #
 # Identifies duplicate code patterns across the codebase and suggests refactoring opportunities
 #
-# frontmatter-hash: 27c97c3c3fea363b4673a817130a7d1aebf40fa149eceef7e57209cbe4ba3bf4
+# frontmatter-hash: bf048778f57f454da56dcf5ca81fb57f1eeb98575e29f78d5434febd4535819a
 
 name: "Duplicate Code Detector"
 "on":
diff --git a/.github/workflows/duplicate-code-detector.md b/.github/workflows/duplicate-code-detector.md
index 6197cd5056..c485cf6f47 100644
--- a/.github/workflows/duplicate-code-detector.md
+++ b/.github/workflows/duplicate-code-detector.md
@@ -13,6 +13,7 @@ tools:
   serena: ["go"]
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[duplicate-code] "
     labels: [code-quality, automated-analysis, cookie]
     assignees: copilot
diff --git a/.github/workflows/go-pattern-detector.lock.yml b/.github/workflows/go-pattern-detector.lock.yml
index 7ef4af44a9..bf731d40b8 100644
--- a/.github/workflows/go-pattern-detector.lock.yml
+++ b/.github/workflows/go-pattern-detector.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/mcp/ast-grep.md
 #
-# frontmatter-hash: f7cea965ed1c11aca74a58978bcecc6051d5bad491b120e06015a3945748ca67
+# frontmatter-hash: d3bc341c0385764ae7f8c424d1b2f06f4663190a6747bc84dfb216320d8e9591
 
 name: "Go Pattern Detector"
 "on":
@@ -171,7 +171,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1152,7 +1152,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"code-quality\",\"ast-grep\",\"cookie\"],\"max\":1,\"title_prefix\":\"[ast-grep] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"code-quality\",\"ast-grep\",\"cookie\"],\"max\":1,\"title_prefix\":\"[ast-grep] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/go-pattern-detector.md b/.github/workflows/go-pattern-detector.md
index 6e2e1c430b..c2b30a4070 100644
--- a/.github/workflows/go-pattern-detector.md
+++ b/.github/workflows/go-pattern-detector.md
@@ -54,6 +54,7 @@ imports:
 
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[ast-grep] "
     labels: [code-quality, ast-grep, cookie]
     max: 1
diff --git a/.github/workflows/issue-arborist.lock.yml b/.github/workflows/issue-arborist.lock.yml
index ebb7f99510..9c7f0ef72f 100644
--- a/.github/workflows/issue-arborist.lock.yml
+++ b/.github/workflows/issue-arborist.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/jqschema.md
 #
-# frontmatter-hash: f65b8630d8da1e9da539ae7b1220033d52d9ed9eba8a1b37e8a842cb03a1f40d
+# frontmatter-hash: 2fbb2b30aa792184dec5c05292b9d2ffdca4324cafef26a4b70123866479c826
 
 name: "Issue Arborist"
 "on":
@@ -176,7 +176,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_discussion":{"expires":168,"max":1},"create_issue":{"group":true,"max":5},"link_sub_issue":{"max":50},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_discussion":{"expires":168,"max":1},"create_issue":{"expires":48,"group":true,"max":5},"link_sub_issue":{"max":50},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1203,7 +1203,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"Audits\",\"close_older_discussions\":true,\"expires\":168,\"max\":1,\"title_prefix\":\"[Issue Arborist] \"},\"create_issue\":{\"group\":true,\"max\":5,\"title_prefix\":\"[Parent] \"},\"link_sub_issue\":{\"max\":50},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"Audits\",\"close_older_discussions\":true,\"expires\":168,\"max\":1,\"title_prefix\":\"[Issue Arborist] \"},\"create_issue\":{\"expires\":48,\"group\":true,\"max\":5,\"title_prefix\":\"[Parent] \"},\"link_sub_issue\":{\"max\":50},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/issue-arborist.md b/.github/workflows/issue-arborist.md
index ee75ac5cb7..ecf0fefb5e 100644
--- a/.github/workflows/issue-arborist.md
+++ b/.github/workflows/issue-arborist.md
@@ -54,6 +54,7 @@ steps:
       cat /tmp/gh-aw/issues-data/issues-schema.json | jq .
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[Parent] "
     max: 5
     group: true
diff --git a/.github/workflows/plan.lock.yml b/.github/workflows/plan.lock.yml
index daa89d752a..785c0d94ec 100644
--- a/.github/workflows/plan.lock.yml
+++ b/.github/workflows/plan.lock.yml
@@ -21,7 +21,7 @@
 #
 # Generates project plans and task breakdowns when invoked with /plan command in issues or PRs
 #
-# frontmatter-hash: ab8a4fe978deccb568a6af2df6aa4ffca3282b1a37f6d107d44a9267b31b8048
+# frontmatter-hash: 345df14c463f1dddcf3c410e1382e182b37c6b9a6d66fda36b4c348d080352a9
 
 name: "Plan Command"
 "on":
@@ -193,7 +193,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"close_discussion":{"max":1,"required_category":"Ideas"},"create_issue":{"group":true,"max":5},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"close_discussion":{"max":1,"required_category":"Ideas"},"create_issue":{"expires":48,"group":true,"max":5},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1164,7 +1164,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"close_discussion\":{\"max\":1},\"create_issue\":{\"group\":true,\"labels\":[\"plan\",\"ai-generated\",\"cookie\"],\"max\":5,\"title_prefix\":\"[plan] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"close_discussion\":{\"max\":1},\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"plan\",\"ai-generated\",\"cookie\"],\"max\":5,\"title_prefix\":\"[plan] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/plan.md b/.github/workflows/plan.md
index 35b3d0a202..3a1d6d4d61 100644
--- a/.github/workflows/plan.md
+++ b/.github/workflows/plan.md
@@ -16,6 +16,7 @@ tools:
     toolsets: [default, discussions]
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[plan] "
     labels: [plan, ai-generated, cookie]
     max: 5  # Maximum 5 sub-issues per group
diff --git a/.github/workflows/poem-bot.lock.yml b/.github/workflows/poem-bot.lock.yml
index 9a68d2a37f..22e9aeae45 100644
--- a/.github/workflows/poem-bot.lock.yml
+++ b/.github/workflows/poem-bot.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/reporting.md
 #
-# frontmatter-hash: 1b150050f140b56fa819ecc5eeb13f7ab8aed4aa2a2cc9f77aa6586a75fe5b69
+# frontmatter-hash: 441709c7a5c96f7ca939f39fc66e7fbe1c791be696f9dce4cf12da067fb9bcdf
 
 name: "Poem Bot - A Creative Agentic Workflow"
 "on":
@@ -212,7 +212,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"add_comment":{"max":3,"target":"*"},"add_labels":{"allowed":["poetry","creative","automation","ai-generated","epic","haiku","sonnet","limerick"],"max":5},"create_agent_session":{"max":1},"create_discussion":{"expires":168,"max":2},"create_issue":{"group":true,"max":2},"create_missing_tool_issue":{"max":1,"title_prefix":"[missing tool]"},"create_pull_request":{},"create_pull_request_review_comment":{"max":2},"link_sub_issue":{"max":3},"missing_data":{},"missing_tool":{},"noop":{"max":1},"push_to_pull_request_branch":{"max":0},"update_issue":{"max":2},"upload_asset":{"max":0}}
+          {"add_comment":{"max":3,"target":"*"},"add_labels":{"allowed":["poetry","creative","automation","ai-generated","epic","haiku","sonnet","limerick"],"max":5},"create_agent_session":{"max":1},"create_discussion":{"expires":168,"max":2},"create_issue":{"expires":48,"group":true,"max":2},"create_missing_tool_issue":{"max":1,"title_prefix":"[missing tool]"},"create_pull_request":{},"create_pull_request_review_comment":{"max":2},"link_sub_issue":{"max":3},"missing_data":{},"missing_tool":{},"noop":{"max":1},"push_to_pull_request_branch":{"max":0},"update_issue":{"max":2},"upload_asset":{"max":0}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1820,7 +1820,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":3,\"target\":\"*\"},\"add_labels\":{\"allowed\":[\"poetry\",\"creative\",\"automation\",\"ai-generated\",\"epic\",\"haiku\",\"sonnet\",\"limerick\"],\"max\":5},\"close_pull_request\":{\"max\":2,\"required_labels\":[\"poetry\",\"automation\"],\"required_title_prefix\":\"[🎨 POETRY]\",\"target\":\"*\"},\"create_discussion\":{\"category\":\"General\",\"close_older_discussions\":true,\"expires\":168,\"labels\":[\"poetry\",\"automation\",\"ai-generated\"],\"max\":2,\"title_prefix\":\"[📜 POETRY] \"},\"create_issue\":{\"group\":true,\"labels\":[\"poetry\",\"automation\",\"ai-generated\"],\"max\":2,\"title_prefix\":\"[🎭 POEM-BOT] \"},\"create_pull_request\":{\"base_branch\":\"${{ github.ref_name }}\",\"max\":1,\"max_patch_size\":1024},\"create_pull_request_review_comment\":{\"max\":2,\"side\":\"RIGHT\"},\"link_sub_issue\":{\"max\":3,\"parent_required_labels\":[\"poetry\",\"epic\"],\"parent_title_prefix\":\"[🎭 POEM-BOT]\",\"sub_required_labels\":[\"poetry\"],\"sub_title_prefix\":\"[🎭 POEM-BOT]\"},\"missing_data\":{},\"missing_tool\":{},\"push_to_pull_request_branch\":{\"base_branch\":\"${{ github.ref_name }}\",\"if_no_changes\":\"warn\",\"max_patch_size\":1024},\"update_issue\":{\"allow_body\":true,\"allow_status\":true,\"allow_title\":true,\"max\":2,\"target\":\"*\"}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":3,\"target\":\"*\"},\"add_labels\":{\"allowed\":[\"poetry\",\"creative\",\"automation\",\"ai-generated\",\"epic\",\"haiku\",\"sonnet\",\"limerick\"],\"max\":5},\"close_pull_request\":{\"max\":2,\"required_labels\":[\"poetry\",\"automation\"],\"required_title_prefix\":\"[🎨 POETRY]\",\"target\":\"*\"},\"create_discussion\":{\"category\":\"General\",\"close_older_discussions\":true,\"expires\":168,\"labels\":[\"poetry\",\"automation\",\"ai-generated\"],\"max\":2,\"title_prefix\":\"[📜 POETRY] \"},\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"poetry\",\"automation\",\"ai-generated\"],\"max\":2,\"title_prefix\":\"[🎭 POEM-BOT] \"},\"create_pull_request\":{\"base_branch\":\"${{ github.ref_name }}\",\"max\":1,\"max_patch_size\":1024},\"create_pull_request_review_comment\":{\"max\":2,\"side\":\"RIGHT\"},\"link_sub_issue\":{\"max\":3,\"parent_required_labels\":[\"poetry\",\"epic\"],\"parent_title_prefix\":\"[🎭 POEM-BOT]\",\"sub_required_labels\":[\"poetry\"],\"sub_title_prefix\":\"[🎭 POEM-BOT]\"},\"missing_data\":{},\"missing_tool\":{},\"push_to_pull_request_branch\":{\"base_branch\":\"${{ github.ref_name }}\",\"if_no_changes\":\"warn\",\"max_patch_size\":1024},\"update_issue\":{\"allow_body\":true,\"allow_status\":true,\"allow_title\":true,\"max\":2,\"target\":\"*\"}}"
           GH_AW_SAFE_OUTPUTS_STAGED: "true"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
diff --git a/.github/workflows/poem-bot.md b/.github/workflows/poem-bot.md
index 6c1e4f8803..10fab22562 100644
--- a/.github/workflows/poem-bot.md
+++ b/.github/workflows/poem-bot.md
@@ -58,6 +58,7 @@ safe-outputs:
   
   # Issue creation with custom prefix and labels
   create-issue:
+    expires: 2d
     title-prefix: "[🎭 POEM-BOT] "
     labels: [poetry, automation, ai-generated]
     max: 2
diff --git a/.github/workflows/secret-scanning-triage.lock.yml b/.github/workflows/secret-scanning-triage.lock.yml
index 1d26b1f1bc..7e9126e31f 100644
--- a/.github/workflows/secret-scanning-triage.lock.yml
+++ b/.github/workflows/secret-scanning-triage.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/reporting.md
 #
-# frontmatter-hash: 4110caa003f31633c85832b45d906ce09f79bc6917ab55dd5a39c09e9e5e1216
+# frontmatter-hash: c0b97e25ddcde5d23be82ae00b411b7c7cf2766d7bd7cb00d4d8a3fc8476b41f
 
 name: "Secret Scanning Triage"
 "on":
@@ -181,7 +181,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"add_labels":{"allowed":["agentic-campaign","z_campaign_security-alert-burndown"],"max":3},"create_issue":{"max":1},"create_pull_request":{},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"add_labels":{"allowed":["agentic-campaign","z_campaign_security-alert-burndown"],"max":3},"create_issue":{"expires":48,"max":1},"create_pull_request":{},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1352,7 +1352,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_labels\":{\"allowed\":[\"agentic-campaign\",\"z_campaign_security-alert-burndown\"]},\"create_issue\":{\"labels\":[\"security\",\"secret-scanning\",\"triage\",\"agentic-campaign\",\"z_campaign_security-alert-burndown\"],\"max\":1,\"title_prefix\":\"[secret-triage] \"},\"create_pull_request\":{\"base_branch\":\"${{ github.ref_name }}\",\"labels\":[\"security\",\"secret-scanning\",\"automated-fix\",\"agentic-campaign\",\"z_campaign_security-alert-burndown\"],\"max\":1,\"max_patch_size\":1024,\"title_prefix\":\"[secret-removal] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_labels\":{\"allowed\":[\"agentic-campaign\",\"z_campaign_security-alert-burndown\"]},\"create_issue\":{\"expires\":48,\"labels\":[\"security\",\"secret-scanning\",\"triage\",\"agentic-campaign\",\"z_campaign_security-alert-burndown\"],\"max\":1,\"title_prefix\":\"[secret-triage] \"},\"create_pull_request\":{\"base_branch\":\"${{ github.ref_name }}\",\"labels\":[\"security\",\"secret-scanning\",\"automated-fix\",\"agentic-campaign\",\"z_campaign_security-alert-burndown\"],\"max\":1,\"max_patch_size\":1024,\"title_prefix\":\"[secret-removal] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/secret-scanning-triage.md b/.github/workflows/secret-scanning-triage.md
index f30fafab71..8dbb759f74 100644
--- a/.github/workflows/secret-scanning-triage.md
+++ b/.github/workflows/secret-scanning-triage.md
@@ -29,6 +29,7 @@ safe-outputs:
       - agentic-campaign
       - z_campaign_security-alert-burndown
   create-issue:
+    expires: 2d
     title-prefix: "[secret-triage] "
     labels: [security, secret-scanning, triage, agentic-campaign, z_campaign_security-alert-burndown]
     max: 1
diff --git a/.github/workflows/security-alert-burndown.lock.yml b/.github/workflows/security-alert-burndown.lock.yml
index 9a9cd2f1c8..3a17134c5e 100644
--- a/.github/workflows/security-alert-burndown.lock.yml
+++ b/.github/workflows/security-alert-burndown.lock.yml
@@ -21,7 +21,7 @@
 #
 # Discovers security work items (Dependabot PRs, code scanning alerts, secret scanning alerts)
 #
-# frontmatter-hash: 118e80cc165fd809a46925da7e24c409354fb62474ffab5289a2351fdc0d7e83
+# frontmatter-hash: eb077c13d4d8e97733256f4b5716186f5944164341d75203eb1ac6c1bda70a70
 
 name: "Security Alert Burndown"
 "on":
diff --git a/.github/workflows/security-alert-burndown.md b/.github/workflows/security-alert-burndown.md
index 47b1e73b20..74ab3db2bb 100644
--- a/.github/workflows/security-alert-burndown.md
+++ b/.github/workflows/security-alert-burndown.md
@@ -18,6 +18,7 @@ safe-outputs:
   update-project:
     max: 100
   create-issue:
+    expires: 2d
     max: 1
     title-prefix: "[campaign]"
     assignees: copilot
diff --git a/.github/workflows/security-compliance.lock.yml b/.github/workflows/security-compliance.lock.yml
index 56d6efee5e..e31796dfa8 100644
--- a/.github/workflows/security-compliance.lock.yml
+++ b/.github/workflows/security-compliance.lock.yml
@@ -21,7 +21,7 @@
 #
 # Fix critical vulnerabilities before audit deadline with full tracking and reporting
 #
-# frontmatter-hash: 43b89d03f7954f0e373a176735a41ad7f50978db4283319d36511dde71e067e9
+# frontmatter-hash: 314b05878ec7e997e4ae2f93a29daa3885c8dae8e4755174a590d3e5bf0acb87
 
 name: "Security Compliance Campaign"
 "on":
@@ -174,7 +174,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"group":true,"max":100},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"group":true,"max":100},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1115,7 +1115,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"group\":true,\"labels\":[\"security\",\"campaign-tracker\",\"cookie\"],\"max\":100},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"security\",\"campaign-tracker\",\"cookie\"],\"max\":100},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/security-compliance.md b/.github/workflows/security-compliance.md
index 4a5f855d8c..fa5a528621 100644
--- a/.github/workflows/security-compliance.md
+++ b/.github/workflows/security-compliance.md
@@ -27,6 +27,7 @@ engine: copilot
 
 safe-outputs:
   create-issue:
+    expires: 2d
     max: 100  # 1 epic + vulnerability tasks
     labels: [security, campaign-tracker, cookie]
     group: true
diff --git a/.github/workflows/semantic-function-refactor.lock.yml b/.github/workflows/semantic-function-refactor.lock.yml
index a2177d3aa6..bbcefcf7d9 100644
--- a/.github/workflows/semantic-function-refactor.lock.yml
+++ b/.github/workflows/semantic-function-refactor.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/reporting.md
 #
-# frontmatter-hash: 657a54818cbb14f7fd0f635646c21b9c076c12490dda99586032ecceb146558a
+# frontmatter-hash: a24e9636fcb0d104228c989565200a62be073fbea9d7a72c27c2da7ff0553cb8
 
 name: "Semantic Function Refactoring"
 "on":
@@ -169,7 +169,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"close_issue":{"max":10,"required_title_prefix":"[refactor] "},"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"close_issue":{"max":10,"required_title_prefix":"[refactor] "},"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1204,7 +1204,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"close_issue\":{\"max\":10,\"required_title_prefix\":\"[refactor] \",\"target\":\"*\"},\"create_issue\":{\"labels\":[\"refactoring\",\"code-quality\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[refactor] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"close_issue\":{\"max\":10,\"required_title_prefix\":\"[refactor] \",\"target\":\"*\"},\"create_issue\":{\"expires\":48,\"labels\":[\"refactoring\",\"code-quality\",\"automated-analysis\",\"cookie\"],\"max\":1,\"title_prefix\":\"[refactor] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/semantic-function-refactor.md b/.github/workflows/semantic-function-refactor.md
index 7c16e9c1fe..ebd73d0d1a 100644
--- a/.github/workflows/semantic-function-refactor.md
+++ b/.github/workflows/semantic-function-refactor.md
@@ -21,6 +21,7 @@ safe-outputs:
     target: "*"
     max: 10
   create-issue:
+    expires: 2d
     title-prefix: "[refactor] "
     labels: [refactoring, code-quality, automated-analysis, cookie]
     max: 1
diff --git a/.github/workflows/shared/campaign.md b/.github/workflows/shared/campaign.md
index aa7f53d46c..cb2f9f5e60 100644
--- a/.github/workflows/shared/campaign.md
+++ b/.github/workflows/shared/campaign.md
@@ -9,6 +9,7 @@ safe-outputs:
   create-project-status-update:
     max: 1
   create-issue:
+    expires: 2d
     max: 5
 ---
 # Campaign Orchestrator
diff --git a/.github/workflows/shared/sq.md b/.github/workflows/shared/sq.md
index 63e1832fa8..654a692240 100644
--- a/.github/workflows/shared/sq.md
+++ b/.github/workflows/shared/sq.md
@@ -73,6 +73,7 @@ permissions:
   contents: read
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[data-analysis] "
 ---
 
diff --git a/.github/workflows/stale-repo-identifier.lock.yml b/.github/workflows/stale-repo-identifier.lock.yml
index 920f1df35e..8bf3a052c5 100644
--- a/.github/workflows/stale-repo-identifier.lock.yml
+++ b/.github/workflows/stale-repo-identifier.lock.yml
@@ -27,7 +27,7 @@
 #     - shared/python-dataviz.md
 #     - shared/trending-charts-simple.md
 #
-# frontmatter-hash: c7a75a05643cb189a9498906fe079e4abc1d09ee6c075b1e98d19bc6c7216b26
+# frontmatter-hash: cfe7dc6f92032b146eee3b3d55efa4ceb70a2cf5f34db0a49eaca536ce43fff5
 
 name: "Stale Repository Identifier"
 "on":
@@ -235,7 +235,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"group":true,"max":10},"missing_data":{},"missing_tool":{},"noop":{"max":1},"upload_asset":{"max":0}}
+          {"create_issue":{"expires":48,"group":true,"max":10},"missing_data":{},"missing_tool":{},"noop":{"max":1},"upload_asset":{"max":0}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1517,7 +1517,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"group\":true,\"labels\":[\"stale-repository\",\"automated-analysis\",\"cookie\"],\"max\":10,\"title_prefix\":\"[Stale Repository] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"stale-repository\",\"automated-analysis\",\"cookie\"],\"max\":10,\"title_prefix\":\"[Stale Repository] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/stale-repo-identifier.md b/.github/workflows/stale-repo-identifier.md
index 5f51f85133..0e87bcc01b 100644
--- a/.github/workflows/stale-repo-identifier.md
+++ b/.github/workflows/stale-repo-identifier.md
@@ -33,6 +33,7 @@ network:
 
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[Stale Repository] "
     labels: [stale-repository, automated-analysis, cookie]
     max: 10
diff --git a/.github/workflows/step-name-alignment.lock.yml b/.github/workflows/step-name-alignment.lock.yml
index 4e559eab0e..57b031d9d6 100644
--- a/.github/workflows/step-name-alignment.lock.yml
+++ b/.github/workflows/step-name-alignment.lock.yml
@@ -21,7 +21,7 @@
 #
 # Scans step names in .lock.yml files and aligns them with step intent and project glossary
 #
-# frontmatter-hash: 65f962e3354ea39f69d734c8e4c31e98d1ccdfb7f1383ec239cdcbadeee7a697
+# frontmatter-hash: 9c35dfecf19f2d4bd92bc1aae54faf598ea269d8e19246e22584c6cc16988f44
 
 name: "Step Name Alignment"
 "on":
@@ -176,7 +176,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1113,7 +1113,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"maintenance\",\"step-naming\",\"cookie\"],\"max\":1,\"title_prefix\":\"[step-names] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"maintenance\",\"step-naming\",\"cookie\"],\"max\":1,\"title_prefix\":\"[step-names] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/step-name-alignment.md b/.github/workflows/step-name-alignment.md
index 166caf3875..ddef67af83 100644
--- a/.github/workflows/step-name-alignment.md
+++ b/.github/workflows/step-name-alignment.md
@@ -22,6 +22,7 @@ network:
 
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[step-names] "
     labels: [maintenance, step-naming, cookie]
 
diff --git a/.github/workflows/super-linter.lock.yml b/.github/workflows/super-linter.lock.yml
index 8f847d1a13..53ac785acb 100644
--- a/.github/workflows/super-linter.lock.yml
+++ b/.github/workflows/super-linter.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/reporting.md
 #
-# frontmatter-hash: a970978fa32b6d3b04993533cbca485ce6bbd4efa7ee67873afacb12df17b99f
+# frontmatter-hash: 53bdcf5bfa526ed222aca60778b257254ab93a98ffe366bd11542ba9be577322
 
 name: "Super Linter Report"
 "on":
@@ -182,7 +182,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1114,7 +1114,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"automation\",\"code-quality\",\"cookie\"],\"max\":1,\"title_prefix\":\"[linter] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"automation\",\"code-quality\",\"cookie\"],\"max\":1,\"title_prefix\":\"[linter] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/super-linter.md b/.github/workflows/super-linter.md
index c5cd0536ed..f1f78e2b77 100644
--- a/.github/workflows/super-linter.md
+++ b/.github/workflows/super-linter.md
@@ -11,6 +11,7 @@ permissions:
   pull-requests: read
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[linter] "
     labels: [automation, code-quality, cookie]
 engine: copilot
diff --git a/.github/workflows/video-analyzer.lock.yml b/.github/workflows/video-analyzer.lock.yml
index 39d81378d3..44ac52cd2a 100644
--- a/.github/workflows/video-analyzer.lock.yml
+++ b/.github/workflows/video-analyzer.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/ffmpeg.md
 #
-# frontmatter-hash: 00d7a5fe7fb95b403b22b124aed38af01a8a745cb9ff355054a5be1e3ad7e45b
+# frontmatter-hash: fee2b44311535c77e49d272666d5d2d69fcaf30d52ca0d69653e05c00b049c3d
 
 name: "Video Analysis Agent"
 "on":
@@ -173,7 +173,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_issue":{"expires":48,"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1169,7 +1169,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"automation\",\"video-processing\",\"cookie\"],\"max\":1,\"title_prefix\":\"[video-analysis] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"expires\":48,\"labels\":[\"automation\",\"video-processing\",\"cookie\"],\"max\":1,\"title_prefix\":\"[video-analysis] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/video-analyzer.md b/.github/workflows/video-analyzer.md
index 0f7fc09dc5..c716a4da04 100644
--- a/.github/workflows/video-analyzer.md
+++ b/.github/workflows/video-analyzer.md
@@ -23,6 +23,7 @@ tools:
 
 safe-outputs:
   create-issue:
+    expires: 2d
     title-prefix: "[video-analysis] "
     labels: [automation, video-processing, cookie]
     max: 1
diff --git a/.github/workflows/workflow-skill-extractor.lock.yml b/.github/workflows/workflow-skill-extractor.lock.yml
index 493ec2111a..310215c575 100644
--- a/.github/workflows/workflow-skill-extractor.lock.yml
+++ b/.github/workflows/workflow-skill-extractor.lock.yml
@@ -25,7 +25,7 @@
 #   Imports:
 #     - shared/reporting.md
 #
-# frontmatter-hash: 75cca0833ee3c5e0f82794c25fb74422b9c7ac19d53e87c3bcd1d2973ac5181f
+# frontmatter-hash: 566fb48dcfc680908bf2585b9156585d0fd12ecec6fe1bbce834d746414dd893
 
 name: "Workflow Skill Extractor"
 "on":
@@ -164,7 +164,7 @@ jobs:
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
           cat > /opt/gh-aw/safeoutputs/config.json << 'EOF'
-          {"create_discussion":{"expires":168,"max":1},"create_issue":{"group":true,"max":3},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
+          {"create_discussion":{"expires":168,"max":1},"create_issue":{"expires":48,"group":true,"max":3},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
           EOF
           cat > /opt/gh-aw/safeoutputs/tools.json << 'EOF'
           [
@@ -1157,7 +1157,7 @@ jobs:
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"reports\",\"close_older_discussions\":true,\"expires\":168,\"max\":1},\"create_issue\":{\"group\":true,\"labels\":[\"refactoring\",\"shared-component\",\"improvement\",\"cookie\"],\"max\":3,\"title_prefix\":\"[refactoring] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_discussion\":{\"category\":\"reports\",\"close_older_discussions\":true,\"expires\":168,\"max\":1},\"create_issue\":{\"expires\":48,\"group\":true,\"labels\":[\"refactoring\",\"shared-component\",\"improvement\",\"cookie\"],\"max\":3,\"title_prefix\":\"[refactoring] \"},\"missing_data\":{},\"missing_tool\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
diff --git a/.github/workflows/workflow-skill-extractor.md b/.github/workflows/workflow-skill-extractor.md
index a809541138..fbcdd5426d 100644
--- a/.github/workflows/workflow-skill-extractor.md
+++ b/.github/workflows/workflow-skill-extractor.md
@@ -33,6 +33,7 @@ safe-outputs:
     max: 1
     close-older-discussions: true
   create-issue:
+    expires: 2d
     title-prefix: "[refactoring] "
     labels: [refactoring, shared-component, improvement, cookie]
     max: 3