The tangled issues feature, again for GitHub, and the same shape: a view-time discovery module, a page of unit rows, importing through the ordinary goal composer, and `goal.source` as the on-protocol record of what a space took up. Nothing polls GitHub, nothing enters the fold, and the pointer stays out of every turn bundle. The one structural difference is that GitHub's API *is* the repository's copy of an issue, so the index-versus-authority rule collapses rather than weakens: there is no second copy to check the first against and no per-issue fan-out. The consequences are confined to what a pointer can promise — a login instead of a DID, no `cid` to pin, and a rename that breaks the join — and each is said out loud where it lands. - core: `GOAL_SOURCE_GITHUB_ISSUE`, `parseGitHubIssueUrl`/`isGitHubIssueUrl` (`parseGitHubPullUrl`'s strictness over `parseGitHubRepo`'s hosts), and the per-kind `source.uri` check beside the tangled one. Unknown kinds stay valid — the check is consistency, never an allowlist. - sidecar: `goal create --source-kind github-issue`, its URI checked through core's predicate so the two spellings cannot drift. - ui: `import-goal.ts` holds what both importers share (the seed, the ceilings, the warning) with a filer that is either a DID or a plain label; `github-issues.ts` mirrors `issues.ts`; `routes/p/[project]/github/` mirrors the tangled page, touching no transport at all. - The bundle-exclusion test now runs once per minted kind, so a forge added later inherits it rather than being incidentally covered. Verified against api.github.com: `access-control-allow-origin: *` and an exposed `x-ratelimit-remaining`, which is what makes an unauthenticated browser call legal and lets the rate-limit branch say something true. Co-Authored-By: claudebot.disnetdev.com (did:plc:n6ku5xddiuguwze3f356evla) <claudebot.disnetdev.com@noreply.radial>