omp-conductor 0.7.1 → 0.9.0

package/src/orchestrator-tick.ts

@@ -70,6 +70,7 @@ import {
 import {
   DEFAULT_REPORT_SCOPE,
   DENIED_RELEASE_GRANTS,
+  type DispatchSummary,
   type FrictionSignal,
   type ReportScope,
   type ResolvedGrants,
@@ -132,6 +133,13 @@ const RETRY_OWNERSHIP_MS = 60_000;
 export const STALL_MARKER_FILE = ".conductor-stalled";
 export const STALL_TICKS = 2;
 
+/** A turn older than this has its remaining tool calls refused (#189). */
+const DEFAULT_TICK_BUDGET_SECONDS = 600;
+/** Grace before a queued operator message preempts the turn's tool calls. */
+const PENDING_MESSAGE_GRACE_MS = 60_000;
+/** Routable candidates below which the queue digest tells the orchestrator to groom (#181). */
+const DEFAULT_GROOM_BELOW = 4;
+
 /**
  * Written by herdr-conductor `recover.sh` *before* `agent start`, so a resumed
  * fleet can reconcile orphans without waiting a full `intervalSeconds`. Cleared
@@ -244,6 +252,8 @@ interface TickApi {
    */
   getActiveTools(): string[];
   on(event: "session_start", handler: (event: { type: "session_start" }, ctx: TickContext) => void): void;
+  on(event: "turn_start", handler: (event: { type: "turn_start" }, ctx: TickContext) => void): void;
+  on(event: "turn_end", handler: (event: { type: "turn_end" }, ctx: TickContext) => void): void;
   /**
    * `deliverAs: "followUp"` + `triggerTurn: true`, verified against
    * `AgentSession.sendCustomMessage` rather than assumed:
@@ -276,6 +286,13 @@ export interface TickConfig {
   armedFile?: string;
   accessFile?: string;
   message?: string;
+  /**
+   * Seconds a turn may run before the tick guard refuses its remaining tool
+   * calls (#189). Optional; defaults to {@link DEFAULT_TICK_BUDGET_SECONDS} (10
+   * minutes, at or below a normal tick interval so a runaway turn is caught
+   * before the next tick).
+   */
+  budgetSeconds?: number;
   /**
    * The herdr agent name this fleet's orchestrator pane is registered under, and
    * the whole of {@link resolveTickOwnership}'s identity test under herdr.
@@ -353,6 +370,32 @@ export function recoveryDigestLine(recovered: readonly RunRecord[]): string | un
   return `Auto-recovered since last tick: ${recovered.length} (${named}${rest}) — already handled, do not re-triage these.`;
 }
 
+/**
+ * One line telling the orchestrator the routable queue is running dry (#181),
+ * or `undefined` when healthy — no dispatch recorded yet, or the routable count
+ * is at/above the grooming trigger.
+ */
+export function queueDigestLine(
+  summary: DispatchSummary | undefined,
+  queueLabel: string,
+  labelPrefix: string,
+  groomBelow: number,
+): string | undefined {
+  if (summary === undefined) return undefined;
+  if (summary.ready === 0) {
+    return `Queue: empty — nothing carries "${queueLabel}". Groom the backlog (Duty 2): promote or file the next issues, or say in this tick's report why there is nothing to do.`;
+  }
+  if (summary.routed === 0) {
+    return `Queue: ${summary.ready} ready but 0 routable — each needs exactly one "${labelPrefix}<repo>" label before dispatch can ever see it.`;
+  }
+  if (summary.routed >= groomBelow) return undefined;
+  let line = `Queue: running low — ${summary.routed} routable candidate(s), below the grooming trigger of ${groomBelow}.`;
+  if (summary.admitted === 0 && summary.holds.length > 0) {
+    line += ` All held: ${summary.holds.map((h) => `${h.reason} ${h.count}`).join(", ")}.`;
+  }
+  return line;
+}
+
 export const TICK_SCOPE_CONSTRAINTS: { readonly [K in ReportScope]: string } = {
   material: "Report material events per your brief.",
   escalations:
@@ -614,6 +657,15 @@ export function readTickConfig(cwd: string): TickConfigResult {
     intervalSeconds = interval;
   }
 
+  // Tolerant like the other optional fields: an integer >= the minimum is the
+  // turn budget in seconds, anything else degrades to absent (the shipped
+  // default) rather than invalidating the config.
+  const budgetRaw = raw["budgetSeconds"];
+  const budgetSeconds =
+    typeof budgetRaw === "number" && Number.isInteger(budgetRaw) && budgetRaw >= MIN_INTERVAL_SECONDS
+      ? budgetRaw
+      : undefined;
+
   // Relative paths resolve against the session cwd, so the files can sit beside
   // the config that names them (`state/armed`) without hard-coding a deploy path.
   const armedFile = optionalPath(raw["armedFile"], "armedFile", cwd, problems);
@@ -646,6 +698,7 @@ export function readTickConfig(cwd: string): TickConfigResult {
     path,
     config: {
       intervalSeconds,
+      ...(budgetSeconds === undefined ? {} : { budgetSeconds }),
       ...(armedFile === undefined ? {} : { armedFile }),
       ...(accessFile === undefined ? {} : { accessFile }),
       ...(message === undefined ? {} : { message }),
@@ -1012,6 +1065,41 @@ export function tickDecision(input: {
   return { send: true, reason: "armed, nothing pending" };
 }
 
+/**
+ * The tick guard's decision, extracted pure from {@link armTickGuard} so it can
+ * be pinned without a fake host: whether a turn's remaining tool calls should be
+ * refused. Budget first, then a queued operator message; otherwise nothing is
+ * blocked (#189).
+ */
+export function tickGuardDecision(input: {
+  turnStartedAt: number | undefined;
+  now: number;
+  budgetMs: number;
+  hasPending: boolean;
+}): { block: true; reason: string } | undefined {
+  if (input.turnStartedAt === undefined) return undefined;
+  const elapsed = input.now - input.turnStartedAt;
+  if (elapsed > input.budgetMs) {
+    return {
+      block: true,
+      reason:
+        `Blocked: this turn has run ${Math.round(elapsed / 1000)}s, past the ${Math.round(input.budgetMs / 1000)}s tick budget (#189). ` +
+        `Finish the turn NOW with a short report. Park anything you were waiting on as a watch — ` +
+        `omp-conductor decision open --question "..." --resolves-when pr-checks-green:<url> | pr-mergeable:<url> | pr-merged:<url> | rate-limit-reset:github — ` +
+        `or hand it to a subagent; the daemon flags met conditions in your next tick digest.`,
+    };
+  }
+  if (input.hasPending && elapsed > PENDING_MESSAGE_GRACE_MS) {
+    return {
+      block: true,
+      reason:
+        `Blocked: an operator message is queued behind this turn (#189). End the turn now and answer it — the person is waiting. ` +
+        `Park any wait as a decision watch (--resolves-when) instead of polling.`,
+    };
+  }
+  return undefined;
+}
+
 /**
  * Whether the Telegram bridge can still reach a person: a bot token, enabled,
  * with exactly one paired owner.
@@ -1269,6 +1357,22 @@ function tick(pi: TickApi, ctx: TickContext, config: TickConfig, session: TickSe
           frictionStore.recoveredSince(scope.projectName, now - 2 * config.intervalSeconds * 1_000),
         );
         if (recovered !== undefined) content = `${content}\n${recovered}`;
+        // The dispatch pass already persists the numbers that answer "is the
+        // queue running dry", so this reads the store rather than asking the
+        // tracker (#181). A failed config read skips the line rather than
+        // wedging the tick.
+        try {
+          const project = findProject(loadConfig());
+          const queue = queueDigestLine(
+            frictionStore.latestDispatch(scope.projectName),
+            project.queueLabel,
+            project.routing.labelPrefix,
+            project.groomBelow ?? DEFAULT_GROOM_BELOW,
+          );
+          if (queue !== undefined) content = `${content}\n${queue}`;
+        } catch {
+          // unreadable config: no queue digest this tick
+        }
       } catch (err) {
         frictionStore?.close();
         frictionStore = undefined;
@@ -1409,6 +1513,43 @@ function armTickHeartbeat(pi: TickApi, ctx: TickContext, config: TickConfig, ses
   tick(pi, ctx, config, session);
 }
 
+/**
+ * The mechanical guard against a turn that never ends (#189).
+ *
+ * The harness delivers `turn_start`/`turn_end`, so the guard times a turn from
+ * the first to the last tool-eligible phase and refuses further tool calls once
+ * it exceeds `budgetMs` — or once an operator message has been queued behind it
+ * for longer than {@link PENDING_MESSAGE_GRACE_MS}. Refusing every tool forces
+ * the model to end the turn with text; nothing else unblocks the queue. `yield`
+ * stays callable so a session that is also a task can still return.
+ */
+function armTickGuard(pi: TickApi, ctx: TickContext, budgetMs: number): void {
+  let turnStartedAt: number | undefined;
+  pi.on("turn_start", () => {
+    turnStartedAt = Date.now();
+  });
+  pi.on("turn_end", () => {
+    turnStartedAt = undefined;
+  });
+  (pi as TickApi & {
+    on(
+      event: "tool_call",
+      handler: (
+        event: { toolName: string; input: Record<string, unknown> },
+        ctx: unknown,
+      ) => { block: true; reason: string } | undefined,
+    ): void;
+  }).on("tool_call", (event) => {
+    if (event.toolName === "yield") return undefined;
+    return tickGuardDecision({
+      turnStartedAt,
+      now: Date.now(),
+      budgetMs,
+      hasPending: ctx.hasPendingMessages(),
+    });
+  });
+}
+
 export default function orchestratorTickExtension(pi: TickApi): void {
   // Scoped to this registration rather than the module, so a second
   // `session_start` can neither install a second heartbeat on the same session
@@ -1426,6 +1567,7 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     pendingSkips: 0,
   };
   let releaseGateArmed = false;
+  let guardArmed = false;
   // An activation file makes this a fleet directory before Herdr can prove
   // which pane owns it. The gate therefore starts closed and only honours a
   // configured grant after ownership is accepted.
@@ -1594,6 +1736,10 @@ export default function orchestratorTickExtension(pi: TickApi): void {
         if (next.note !== undefined) pi.logger.error(`[omp-conductor] tick ownership: ${next.note}`);
         releaseAuthorityAccepted = true;
         armTickHeartbeat(pi, ctx, config, session);
+        if (!guardArmed) {
+          guardArmed = true;
+          armTickGuard(pi, ctx, (config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS) * 1000);
+        }
         pi.logger.info(`[omp-conductor] orchestrator tick active: ownership resolved on retry`, { agentName });
       }, retryMs);
       decided = true;
@@ -1608,6 +1754,10 @@ export default function orchestratorTickExtension(pi: TickApi): void {
     if (ownership.note !== undefined) pi.logger.error(`[omp-conductor] tick ownership: ${ownership.note}`);
     releaseAuthorityAccepted = true;
     armTickHeartbeat(pi, ctx, config, session);
+    if (!guardArmed) {
+      guardArmed = true;
+      armTickGuard(pi, ctx, (config.budgetSeconds ?? DEFAULT_TICK_BUDGET_SECONDS) * 1000);
+    }
     decided = true;
     // Both gates are named at startup: "why is it not ticking?" is answered by
     // looking at the files this line lists, and an unset channel gate on a fleet

package/src/plugin.ts

@@ -1358,7 +1358,7 @@ export default function conductorPlugin(pi: PluginApi): void {
           }
 
           case "pause":
-            setPaused(true);
+            setPaused(true, { source: "pause", reason: "via /conductor pause" });
             ctx.ui.notify("Paused claiming only — ticks keep firing if armed. Prefer /conductor hold.", "info");
             break;
 

package/src/routing.ts

@@ -55,6 +55,26 @@ export function isEligible(issue: ReadyIssue, p: ProjectConfig): boolean {
   return !labels.has(inProgress) && !labels.has(blocked) && !labels.has(failed);
 }
 
+/**
+ * The label set an issue *effectively* carries once the projection outbox is
+ * accounted for (#201). Pending ops apply in enqueue order — the same order
+ * the projector will apply them — so an issue with a pending queue-label
+ * removal drops out of eligibility immediately, and a pending state-label
+ * removal stops a stale GitHub label from blocking redispatch while the
+ * tracker is still catching up. Pure: the physical label set is untouched.
+ */
+export function effectiveLabels(
+  labels: readonly string[],
+  pending: readonly { op: "add" | "remove"; label: string }[],
+): string[] {
+  const set = new Set(labels);
+  for (const op of pending) {
+    if (op.op === "add") set.add(op.label);
+    else set.delete(op.label);
+  }
+  return [...set];
+}
+
 /**
  * Partition eligible issues into dispatchable and needs-a-human.
  *

package/src/setup.ts

@@ -1167,7 +1167,7 @@ export const AMEND_AREAS: {
       const spend =
         c.dailySpendUsd === null ? "no spend cap" : `$${c.dailySpendUsd}/day`;
       return (
-        `${c.maxConcurrentWorkers} workers, ${c.workerMaxTurns} turns, ` +
+        `${c.maxConcurrentWorkers} workers (${c.maxConcurrentWorkersPerRepo}/repo), ${c.workerMaxTurns} turns, ` +
         `${Math.round(c.workerWallClockMs / 60000)}m, ${spend}, ` +
         `${c.maxAttemptsPerIssue} failed attempt${c.maxAttemptsPerIssue === 1 ? "" : "s"}, ` +
         `${c.maxContinuationsPerIssue} continuation${c.maxContinuationsPerIssue === 1 ? "" : "s"}` +

package/src/store.ts

@@ -26,6 +26,7 @@ import type {
   FrictionKind,
   FrictionObservation,
   FrictionSignal,
+  LabelOp,
   MergeLock,
   ReportDeliveryState,
   ReportDraft,
@@ -111,6 +112,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   endedAt: true,
   lastError: true,
   settlementFlags: true,
+  report: true,
   failureClass: true,
   recoveryAction: true,
   recoveredAt: true,
@@ -142,6 +144,7 @@ interface RunRow {
   endedAt: number | null;
   lastError: string | null;
   settlementFlags: string | null;
+  report: string | null;
   failureClass: string | null;
   recoveryAction: string | null;
   recoveredAt: number | null;
@@ -163,6 +166,35 @@ interface FrictionSurfaceRow {
   at: number;
 }
 
+/** The `label_ops` table exactly as SQLite hands it back (#201). */
+interface LabelOpRow {
+  id: number;
+  project: string;
+  issue: number;
+  op: "add" | "remove";
+  label: string;
+  createdAt: number;
+  attempts: number;
+  nextAttemptAt: number;
+  lastError: string | null;
+}
+
+/** NULL columns become absent properties, matching the other row converters. */
+function toLabelOp(row: LabelOpRow): LabelOp {
+  const op: LabelOp = {
+    id: row.id,
+    project: row.project,
+    issue: row.issue,
+    op: row.op,
+    label: row.label,
+    createdAt: row.createdAt,
+    attempts: row.attempts,
+    nextAttemptAt: row.nextAttemptAt,
+  };
+  if (row.lastError !== null) op.lastError = row.lastError;
+  return op;
+}
+
 /** The `reports` table exactly as SQLite hands it back. */
 interface ReportRow {
   id: string;
@@ -229,6 +261,7 @@ CREATE TABLE IF NOT EXISTS runs (
   endedAt     INTEGER,
   lastError   TEXT,
   settlementFlags TEXT,
+  report      TEXT,
   failureClass TEXT,
   recoveryAction TEXT,
   recoveredAt INTEGER
@@ -360,6 +393,46 @@ CREATE TABLE IF NOT EXISTS decisions (
   resolution     TEXT
 );
 CREATE INDEX IF NOT EXISTS decisions_project_state ON decisions (project, state);
+
+-- GitHub rate-limit refusals the tracker observed (#198). Written by the
+-- daemon's tracker hook, not polled, so status can show what GitHub actually
+-- refused next to the polled budget that might still look healthy. Only one
+-- column: a refusal carries no id or dedupe key — rows are pruned by age
+-- (24h) in the same write that inserts, kept long enough for status's 5m
+-- window and for an operator who wants to see the last day of refusals.
+CREATE TABLE IF NOT EXISTS gh_refusals (
+  at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS gh_refusals_at ON gh_refusals (at);
+
+-- The daemon's tracked gh call count, per UTC day and call source (#198).
+-- The single funnel in tracker/github.ts counts every spawn; the day/source
+-- pair is the partition, so today's column and today's row survive a restart.
+CREATE TABLE IF NOT EXISTS gh_calls (
+  day    TEXT    NOT NULL,
+  source TEXT    NOT NULL,
+  calls  INTEGER NOT NULL,
+  PRIMARY KEY (day, source)
+);
+-- The label projection outbox (#201). Every decided GitHub label change the
+-- dispatcher made is a row here until the tracker has applied it; the daemon
+-- retries with backoff, and eligibility reads pendingLabelOpsFor so a label
+-- GitHub refuses to move cannot strand the issue the daemon already decided
+-- to move on. The queue-label add and the state-label remove of one swap are
+-- two rows, applied strictly in id order, which is what makes a swap atomic:
+-- the remove cannot land before the add it was enqueued after.
+CREATE TABLE IF NOT EXISTS label_ops (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  project       TEXT    NOT NULL,
+  issue         INTEGER NOT NULL,
+  op            TEXT    NOT NULL CHECK (op IN ('add', 'remove')),
+  label         TEXT    NOT NULL,
+  createdAt     INTEGER NOT NULL,
+  attempts      INTEGER NOT NULL DEFAULT 0,
+  nextAttemptAt INTEGER NOT NULL DEFAULT 0,
+  lastError     TEXT
+);
+CREATE INDEX IF NOT EXISTS label_ops_project_next ON label_ops (project, nextAttemptAt);
 `;
 
 /**
@@ -435,6 +508,7 @@ function toRecord(row: RunRow): RunRecord {
     const flags = toSettlementFlags(row.settlementFlags);
     if (flags !== undefined) record.settlementFlags = flags;
   }
+  if (row.report !== null) record.report = row.report;
   if (row.failureClass !== null) record.failureClass = row.failureClass as FailureClass;
   if (row.recoveryAction !== null) record.recoveryAction = row.recoveryAction as RecoveryAction;
   if (row.recoveredAt !== null) record.recoveredAt = row.recoveredAt;
@@ -613,6 +687,12 @@ export function dbPath(): string {
   return join(stateDir(), "conductor.db");
 }
 
+/** The UTC calendar day (`YYYY-MM-DD`) a moment falls on — the partition key
+ *  for the daemon's observed github call counter (#198). */
+export function utcDay(now: number = Date.now()): string {
+  return new Date(now).toISOString().slice(0, 10);
+}
+
 /**
  * Open (creating if needed) the run store at `dbPath`; `:memory:` is honoured
  * for tests. Safe to call on a fresh path — the schema is applied on open, so
@@ -665,6 +745,13 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "settlementFlags")) {
     db.exec("ALTER TABLE runs ADD COLUMN settlementFlags TEXT");
   }
+  // Rows written before the settlement report was persisted (#199) have no
+  // text to pool across attempts, so a continuation reads empty priors and
+  // audits exactly as it did before this release. No backfill: the bytes only
+  // ever existed in a worker's memory.
+  if (!columns.some((column) => column.name === "report")) {
+    db.exec("ALTER TABLE runs ADD COLUMN report TEXT");
+  }
   // Every row written before #132 is unclassified, and NULL is the honest
   // reading of that: the budget counters below deliberately still count an
   // unclassified terminal row exactly as this release's predecessor did, so an
@@ -772,8 +859,8 @@ export function openStore(dbPath: string): Store {
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
        maxTurns, spendUsd, sessionFile, prUrl, headSha, salvageSha, salvageError,
-       salvageAckAt, startedAt, endedAt, lastError, settlementFlags
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       salvageAckAt, startedAt, endedAt, lastError, settlementFlags, report
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
   const selectActive = db.query<RunRow, SqlValue[]>(
@@ -886,6 +973,14 @@ export function openStore(dbPath: string): Store {
       ORDER BY startedAt DESC, rowid DESC
       LIMIT 1`,
   );
+  // Every attempt that settled with a report, in attempt order. NULLs are the
+  // rows written before #199, or one killed before the worker returned a
+  // report — skipping them makes a continuation read exactly today's priors.
+  const selectAttemptReports = db.query<{ attempt: number; report: string }, [string, number]>(
+    `SELECT attempt, report FROM runs
+      WHERE project = ? AND issue = ? AND report IS NOT NULL
+      ORDER BY attempt`,
+  );
   const countStartedSince = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs WHERE project = ? AND startedAt >= ?`,
   );
@@ -938,6 +1033,31 @@ export function openStore(dbPath: string): Store {
      ON CONFLICT(project, kind) DO UPDATE SET at = excluded.at`,
   );
 
+  // Observed GitHub rate-limit refusals (#198). Insert + prune share one
+  // transaction so a burst never grows the table without bound.
+  const insertGhRefusal = db.query<unknown, [number]>(
+    `INSERT INTO gh_refusals (at) VALUES (?)`,
+  );
+  const pruneGhRefusals = db.query<unknown, [number]>(
+    `DELETE FROM gh_refusals WHERE at < ?`,
+  );
+  const selectGhRefusalsSince = db.query<{ n: number; latest: number | null }, [number]>(
+    `SELECT COUNT(*) AS n, MAX(at) AS latest FROM gh_refusals WHERE at >= ?`,
+  );
+  const recordGhRefusalTx = db.transaction((at: number): void => {
+    insertGhRefusal.run(at);
+    pruneGhRefusals.run(at - 24 * 60 * 60 * 1000);
+  });
+
+  // The daemon's tracked github call counts (#198): one UPSERT per spawn.
+  const bumpGhCall = db.query<unknown, [string, string]>(
+    `INSERT INTO gh_calls (day, source, calls) VALUES (?, ?, 1)
+     ON CONFLICT(day, source) DO UPDATE SET calls = calls + 1`,
+  );
+  const selectGhCalls = db.query<{ source: string; calls: number }, [string]>(
+    `SELECT source, calls FROM gh_calls WHERE day = ? ORDER BY source`,
+  );
+
   // The report outbox (#123). Every terminal transition names the attempt it is
   // settling, because a request can come back *after* the stale-`sending` sweep
   // has already reclaimed its row — and a late answer must not overwrite a
@@ -1071,6 +1191,72 @@ export function openStore(dbPath: string): Store {
     },
   );
 
+  // The label projection outbox (#201). A decided label change is a row until
+  // the tracker has applied it; the projector drains in id order, and one
+  // issue's ops are atomic as a run — a failed op parks the rest of its issue
+  // for the next pass rather than letting a later op land out of order.
+  const insertLabelOp = db.query<unknown, SqlValue[]>(
+    `INSERT INTO label_ops (project, issue, op, label, createdAt) VALUES (?, ?, ?, ?, ?)`,
+  );
+  const selectPendingLabelOps = db.query<LabelOpRow, [string, number]>(
+    `SELECT o.* FROM label_ops AS o
+      WHERE o.project = ? AND o.nextAttemptAt <= ?
+        AND NOT EXISTS (
+          SELECT 1 FROM label_ops AS e
+          WHERE e.project = o.project AND e.issue = o.issue AND e.id < o.id
+        )
+      ORDER BY o.id`,
+  );
+  const selectPendingLabelOpsFor = db.query<LabelOpRow, [string, number]>(
+    `SELECT * FROM label_ops WHERE project = ? AND issue = ? ORDER BY id`,
+  );
+  const selectOldestPendingLabelOp = db.query<LabelOpRow, [string]>(
+    `SELECT * FROM label_ops WHERE project = ? ORDER BY createdAt ASC, id ASC LIMIT 1`,
+  );
+  const countLabelOps = db.query<{ n: number }, [string]>(
+    `SELECT COUNT(*) AS n FROM label_ops WHERE project = ?`,
+  );
+  const deleteLabelOp = db.query<unknown, [number]>(`DELETE FROM label_ops WHERE id = ?`);
+  const bumpLabelOpAttempt = db.query<unknown, [string, number, number]>(
+    `UPDATE label_ops SET attempts = attempts + 1, lastError = ?, nextAttemptAt = ? WHERE id = ?`,
+  );
+  // Rate-limit refusals defer WITHOUT counting an attempt: a shared outage is
+  // not the op's fault, so it must not burn the backoff escalation (#208).
+  const parkLabelOp = db.query<unknown, [string, number, number]>(
+    `UPDATE label_ops SET lastError = ?, nextAttemptAt = ? WHERE id = ?`,
+  );
+  // Coalesce: if the LATEST pending op for the same project+issue+label is
+  // already the same operation, adding another is a duplicate that would sit
+  // parked behind the oldest pending one, growing unboundedly (a reconcile
+  // re-offering a removal the tracker keeps refusing). Only the latest matters:
+  // a `remove → add → remove` sequence must keep the final remove even though
+  // the first remove is still owed, because the add in between is a real
+  // transition the final remove answers. Opposite transitions are never
+  // coalesced. The check and insert share the transaction so they cannot race
+  // (#201).
+  const selectLatestLabelOp = db.query<{ op: "add" | "remove" }, [string, number, string]>(
+    `SELECT op FROM label_ops
+      WHERE project = ? AND issue = ? AND label = ?
+      ORDER BY id DESC LIMIT 1`,
+  );
+  const enqueueLabelOpsTx = db.transaction(
+    (
+      rows: readonly {
+        project: string;
+        issue: number;
+        op: "add" | "remove";
+        label: string;
+        createdAt: number;
+      }[],
+    ): void => {
+      for (const row of rows) {
+        const latest = selectLatestLabelOp.get(row.project, row.issue, row.label);
+        if (latest !== undefined && latest !== null && latest.op === row.op) continue;
+        insertLabelOp.run(toSql(row.project), row.issue, row.op, row.label, row.createdAt);
+      }
+    },
+  );
+
   const recordFriction = (project: string, observation: FrictionObservation): void => {
     if (
       !Number.isSafeInteger(observation.occurrences) ||
@@ -1108,6 +1294,12 @@ export function openStore(dbPath: string): Store {
     );
   };
 
+  const recordGhRefusal = (at: number): void => {
+    // Same guard as `recordFriction`: a bad clock must not corrupt the store.
+    if (!Number.isSafeInteger(at) || at < 0) return;
+    recordGhRefusalTx(at);
+  };
+
   return {
     createRun(r: Omit<RunRecord, "id">): RunRecord {
       const record: RunRecord = { ...r, id: crypto.randomUUID() };
@@ -1133,6 +1325,7 @@ export function openStore(dbPath: string): Store {
         toSql(record.endedAt),
         toSql(record.lastError),
         toSql(record.settlementFlags),
+        toSql(record.report),
       );
       return record;
     },
@@ -1200,6 +1393,10 @@ export function openStore(dbPath: string): Store {
       return row ? toRecord(row) : undefined;
     },
 
+    attemptReports(project: string, issue: number): { attempt: number; report: string }[] {
+      return selectAttemptReports.all(project, issue);
+    },
+
 
     runsStartedSince(project: string, sinceEpochMs: number): number {
       return countStartedSince.get(project, sinceEpochMs)?.n ?? 0;
@@ -1250,6 +1447,24 @@ export function openStore(dbPath: string): Store {
 
     recordFriction,
 
+    recordGhRefusal,
+
+    ghRefusalsSince(sinceMs: number): { count: number; latestAt?: number } {
+      const row = selectGhRefusalsSince.get(sinceMs);
+      if (row === null || row === undefined || row.n === 0 || row.latest === null) {
+        return { count: 0 };
+      }
+      return { count: row.n, latestAt: row.latest };
+    },
+
+    bumpGhCalls(day: string, source: string): void {
+      bumpGhCall.run(day, source);
+    },
+
+    ghCallsToday(day: string): { source: string; calls: number }[] {
+      return selectGhCalls.all(day);
+    },
+
     pendingFriction(
       project: string,
       sinceEpochMs: number,
@@ -1532,6 +1747,43 @@ export function openStore(dbPath: string): Store {
       return row === null ? undefined : { ...row };
     },
 
+    enqueueLabelOps(
+      project: string,
+      ops: readonly { issue: number; op: "add" | "remove"; label: string }[],
+    ): void {
+      if (ops.length === 0) return;
+      const now = Date.now();
+      enqueueLabelOpsTx(
+        ops.map((op) => ({ ...op, project, createdAt: now })),
+      );
+    },
+
+    pendingLabelOps(project: string, now: number): LabelOp[] {
+      return selectPendingLabelOps.all(project, now).map(toLabelOp);
+    },
+
+    pendingLabelOpsFor(project: string, issue: number): LabelOp[] {
+      return selectPendingLabelOpsFor.all(project, issue).map(toLabelOp);
+    },
+
+    settleLabelOp(id: number): void {
+      deleteLabelOp.run(id);
+    },
+
+    deferLabelOp(id: number, error: string, nextAttemptAt: number, countAttempt = true): void {
+      if (countAttempt) bumpLabelOpAttempt.run(error, nextAttemptAt, id);
+      else parkLabelOp.run(error, nextAttemptAt, id);
+    },
+
+    countPendingLabelOps(project: string): number {
+      return countLabelOps.get(project)?.n ?? 0;
+    },
+
+    oldestPendingLabelOpAt(project: string): number | undefined {
+      const row = selectOldestPendingLabelOp.get(project);
+      return row === null ? undefined : row.createdAt;
+    },
+
     close(): void {
       db.close(false);
     },