@@ -430,13 +430,14 @@ def main(argv: Optional[Sequence[str]] = None) -> int:
                 findings,
                 meta_commit=args.meta_commit,
                 repo=args.sticky_issue_repo,
+                gh_token=gh_token,
             )
         except RuntimeError as exc:
             print(f"error: sticky-issue upsert failed: {exc}", file=sys.stderr)
             return 2
         sys.stdout.write(
             f"Sticky issue: {action}"
-            + (f" — {url}" if url else "")
+            + (f" - {url}" if url else "")
             + "\n"
         )
 
@@ -472,7 +473,7 @@ def _apply_fixes_live(
 
     Fixable = ``version-signal`` error findings (missing or malformed
     signal, or MAJOR.MINOR/patch drift). Pragma-skipped and tool_newer
-    findings are left alone — those require human review.
+    findings are left alone; those require human review.
     """
     fm = scripts_dir / "add_frontmatter.py"
     cm = scripts_dir / "add_comment_marker.py"
 
@@ -21,6 +21,7 @@
 from __future__ import annotations
 
 import json
+import os
 import subprocess
 import sys
 from datetime import datetime, timezone
@@ -39,23 +40,65 @@
 IssueAction = Literal["created", "updated", "reopened", "closed", "no_op"]
 
 
-# Runner type: takes a list of args, returns (rc, stdout, stderr).
-GhRunner = Callable[[Sequence[str]], "tuple[int, str, str]"]
+# GitHub rejects issue bodies over 65,536 characters. Leave headroom for
+# the truncation notice.
+MAX_BODY_CHARS = 60_000
+GH_TIMEOUT_SECONDS = 120
+
+# Runner type: takes a list of args plus an optional ``stdin`` keyword
+# (used for ``--body-file -``), returns (rc, stdout, stderr).
+GhRunner = Callable[..., "tuple[int, str, str]"]
+
+
+def make_gh_runner(gh_token: str | None = None) -> GhRunner:
+    """Build the default subprocess runner. When *gh_token* is given it is
+    exported as ``GH_TOKEN`` for every ``gh`` call, so the token the caller
+    supplied is the one used for writes (not whatever ambient login or
+    ``GITHUB_TOKEN`` happens to exist)."""
+    env = {**os.environ}
+    if gh_token:
+        env["GH_TOKEN"] = gh_token
+
+    def _run(args: Sequence[str], stdin: str | None = None) -> "tuple[int, str, str]":
+        try:
+            result = subprocess.run(
+                ["gh", *args],
+                input=stdin,
+                capture_output=True,
+                text=True,
+                env=env,
+                timeout=GH_TIMEOUT_SECONDS,
+            )
+        except subprocess.TimeoutExpired:
+            return 124, "", f"gh {' '.join(args[:2])} timed out after {GH_TIMEOUT_SECONDS}s"
+        return result.returncode, result.stdout, result.stderr
+
+    return _run
 
 
-def _default_gh_runner(args: Sequence[str]) -> "tuple[int, str, str]":
-    """Default subprocess runner: invokes ``gh`` with the given args."""
-    result = subprocess.run(
-        ["gh", *args],
-        capture_output=True,
-        text=True,
-    )
-    return result.returncode, result.stdout, result.stderr
+def _default_gh_runner(args: Sequence[str], stdin: str | None = None) -> "tuple[int, str, str]":
+    """Default runner using the ambient ``gh`` authentication."""
+    return make_gh_runner()(args, stdin=stdin)
+
+
+def _truncate_body(body: str) -> str:
+    if len(body) <= MAX_BODY_CHARS:
+        return body
+    notice = "\n".join([
+        "",
+        "",
+        "---",
+        "",
+        "_Report truncated to fit GitHub's issue size limit. "
+        "The full report is in the drift-check workflow run summary._",
+        "",
+    ])
+    return body[: MAX_BODY_CHARS - len(notice)] + notice
 
 
 def _has_blocking_findings(findings: Iterable[Finding]) -> bool:
     """Anything that should make the sticky issue exist (open). ``info`` is
-    intentionally excluded — info findings do not justify a sticky issue."""
+    intentionally excluded; info findings do not justify a sticky issue."""
     return any(f.severity in ("error", "warn") for f in findings)
 
 
@@ -95,23 +138,28 @@ def _find_sticky_issue(
     repo: str,
     runner: GhRunner,
 ) -> Optional[dict]:
-    """Search by marker. Returns the first matching issue (open OR
-    closed), or None.
+    """Search by marker. Returns the first issue (open OR closed) whose
+    body actually contains the marker, or None.
 
-    The ``gh issue list --search`` matches the body, which is what we
-    want — title may be edited by humans, marker is structural."""
+    ``gh issue list --search`` is a tokenized full-text search, so it can
+    return near-misses; each candidate's body is checked for the exact
+    marker. Title is not used because humans may edit it; the marker is
+    structural."""
     rc, out, err = runner([
         "issue", "list",
         "--repo", repo,
         "--state", "all",
         "--search", STICKY_MARKER,
-        "--json", "number,state,title,url",
-        "--limit", "5",
+        "--json", "number,state,title,url,body",
+        "--limit", "20",
     ])
     if rc != 0:
         raise RuntimeError(f"gh issue list failed: {err.strip() or out.strip()}")
     items = json.loads(out or "[]")
-    return items[0] if items else None
+    for item in items:
+        if STICKY_MARKER in (item.get("body") or ""):
+            return item
+    return None
 
 
 def upsert_sticky_issue(
@@ -122,12 +170,14 @@ def upsert_sticky_issue(
     repo: str = "TMHSDigital/Developer-Tools-Directory",
     runner: GhRunner | None = None,
     now: datetime | None = None,
+    gh_token: str | None = None,
 ) -> "tuple[IssueAction, Optional[str]]":
     """Run the sticky-issue state machine.
 
     Returns ``(action, issue_url)``. ``issue_url`` is None for ``no_op``.
+    *gh_token*, when given, authenticates the default runner.
     """
-    runner = runner or _default_gh_runner
+    runner = runner or make_gh_runner(gh_token)
     findings = list(findings)
     snapshots = list(snapshots)
 
@@ -144,7 +194,7 @@ def upsert_sticky_issue(
             return "closed", existing["url"]
         return "no_op", existing["url"] if existing else None
 
-    body = _build_issue_body(snapshots, findings, meta_commit, now=now)
+    body = _truncate_body(_build_issue_body(snapshots, findings, meta_commit, now=now))
 
     if existing is None:
         url = _gh_create(repo, STICKY_TITLE, body, runner)
@@ -171,8 +221,8 @@ def _gh_create(repo: str, title: str, body: str, runner: GhRunner) -> str:
         "issue", "create",
         "--repo", repo,
         "--title", title,
-        "--body", body,
-    ])
+        "--body-file", "-",
+    ], stdin=body)
     if rc != 0:
         raise RuntimeError(f"gh issue create failed: {err.strip() or out.strip()}")
     # gh prints the issue URL on stdout.
@@ -183,8 +233,8 @@ def _gh_edit(repo: str, number: int, body: str, runner: GhRunner) -> None:
     rc, out, err = runner([
         "issue", "edit", str(number),
         "--repo", repo,
-        "--body", body,
-    ])
+        "--body-file", "-",
+    ], stdin=body)
     if rc != 0:
         raise RuntimeError(f"gh issue edit failed: {err.strip() or out.strip()}")
 
@@ -211,7 +261,7 @@ def _gh_comment(repo: str, number: int, body: str, runner: GhRunner) -> None:
     rc, out, err = runner([
         "issue", "comment", str(number),
         "--repo", repo,
-        "--body", body,
-    ])
+        "--body-file", "-",
+    ], stdin=body)
     if rc != 0:
         raise RuntimeError(f"gh issue comment failed: {err.strip() or out.strip()}")
@@ -55,10 +55,12 @@ def __init__(self, queue=None, handlers=None):
         self.queue = list(queue or [])
         self.handlers = handlers or {}
         self.calls = []
+        self.stdins = []
 
-    def __call__(self, args: Sequence[str]):
+    def __call__(self, args: Sequence[str], stdin=None):
         args = list(args)
         self.calls.append(args)
+        self.stdins.append(stdin)
         for key, handler in self.handlers.items():
             if args[: len(key)] == list(key):
                 return handler(args)
@@ -92,8 +94,8 @@ def test_create_when_no_existing_and_drift():
     create_args = runner.calls[1]
     assert create_args[0] == "issue"
     assert create_args[1] == "create"
-    body_idx = create_args.index("--body") + 1
-    body = create_args[body_idx]
+    assert create_args[create_args.index("--body-file") + 1] == "-"
+    body = runner.stdins[1]
     assert STICKY_MARKER in body
     assert "abc123" in body  # meta commit appears in body
     assert STICKY_TITLE in create_args
@@ -107,6 +109,7 @@ def test_update_when_existing_open_and_drift():
         "number": 7,
         "state": "OPEN",
         "title": STICKY_TITLE,
+        "body": STICKY_MARKER,
         "url": "https://github.com/.../issues/7",
     }])
     runner = _ScriptedRunner(queue=[
@@ -130,6 +133,7 @@ def test_reopen_when_existing_closed_and_drift():
         "number": 11,
         "state": "CLOSED",
         "title": STICKY_TITLE,
+        "body": STICKY_MARKER,
         "url": "https://github.com/.../issues/11",
     }])
     runner = _ScriptedRunner(queue=[
@@ -149,8 +153,8 @@ def test_reopen_when_existing_closed_and_drift():
     # Verify comment includes "re-detected"
     comment_calls = [c for c in runner.calls if c[:3] == ["issue", "comment", "11"]]
     assert len(comment_calls) == 1
-    body_idx = comment_calls[0].index("--body") + 1
-    assert "re-detected" in comment_calls[0][body_idx]
+    comment_idx = runner.calls.index(comment_calls[0])
+    assert "re-detected" in runner.stdins[comment_idx]
 
 
 # ------------------------------- close ------------------------------------
@@ -161,6 +165,7 @@ def test_close_when_existing_open_and_clean():
         "number": 9,
         "state": "OPEN",
         "title": STICKY_TITLE,
+        "body": STICKY_MARKER,
         "url": "https://github.com/.../issues/9",
     }])
     runner = _ScriptedRunner(queue=[
@@ -197,6 +202,7 @@ def test_no_op_when_clean_and_existing_closed():
         "number": 9,
         "state": "CLOSED",
         "title": STICKY_TITLE,
+        "body": STICKY_MARKER,
         "url": "https://github.com/.../issues/9",
     }])
     runner = _ScriptedRunner(queue=[(0, existing, "")])
@@ -253,8 +259,56 @@ def test_body_includes_marker_and_metadata():
         [_snap()], [_err()], meta_commit="cafef00d",
         runner=runner, now=fixed,
     )
-    body = runner.calls[1][runner.calls[1].index("--body") + 1]
+    body = runner.stdins[1]
     assert STICKY_MARKER in body
     assert "cafef00d" in body
     assert "2026-04-24T22:00:00+00:00" in body
     assert "1 errors, 0 warnings" in body
+
+
+# ------------------------------- lookup / auth / size ----------------------
+
+
+def test_search_hit_without_exact_marker_is_ignored():
+    near_miss = json.dumps([{
+        "number": 3,
+        "state": "OPEN",
+        "title": "Unrelated issue mentioning drift-check",
+        "body": "drift check sticky issue v1 discussion",
+        "url": "https://github.com/.../issues/3",
+    }])
+    runner = _ScriptedRunner(queue=[(0, near_miss, ""), (0, "https://x/issues/50", "")])
+    action, url = upsert_sticky_issue(
+        [_snap()], [_err()], meta_commit="abc", runner=runner,
+    )
+    assert action == "created"
+    assert runner.calls[1][:2] == ["issue", "create"]
+    assert "body" in runner.calls[0][runner.calls[0].index("--json") + 1]
+
+
+def test_oversized_body_is_truncated():
+    runner = _ScriptedRunner(queue=[(0, "[]", ""), (0, "u", "")])
+    many = [_err(msg="x" * 500) for _ in range(400)]
+    upsert_sticky_issue([_snap()], many, meta_commit="abc", runner=runner)
+    body = runner.stdins[1]
+    assert len(body) <= issue.MAX_BODY_CHARS
+    assert "truncated" in body
+
+
+def test_gh_token_is_exported_to_default_runner(monkeypatch):
+    seen = {}
+
+    class _Result:
+        returncode = 0
+        stdout = "[]"
+        stderr = ""
+
+    def fake_run(args, **kwargs):
+        seen["env"] = kwargs["env"]
+        seen["timeout"] = kwargs.get("timeout")
+        return _Result()
+
+    monkeypatch.setattr(issue.subprocess, "run", fake_run)
+    upsert_sticky_issue([_snap()], [], meta_commit="abc", gh_token="tok_123")
+    assert seen["env"]["GH_TOKEN"] == "tok_123"
+    assert seen["timeout"]