omp-conductor 0.7.1 → 0.9.0

package/src/tracker/github.ts

@@ -34,17 +34,6 @@ import type {
   Tracker,
 } from "../types.ts";
 
-/** The subset of `gh issue list --json` output this adapter reads. Fields the
- *  API can return as null are typed as such so the mapping has to handle it. */
-interface GhIssue {
-  number: number;
-  title: string | null;
-  body: string | null;
-  labels: { name: string }[] | null;
-  url: string;
-  updatedAt: string;
-}
-
 /**
  * Pull requests that would close an issue, with the one field that decides it.
  *
@@ -172,24 +161,27 @@ async function gh(argv: string[], stdin?: string): Promise<string> {
 
 /**
  * True when a label edit failed only because the requested end state already
- * holds. Adding a label is idempotent server-side, but removing one that is not
- * present is a 404, and a concurrent daemon restart can easily race into both.
+ * holds. Adding a label is idempotent server-side — `gh api -X POST
+ * .../labels` answers 200 for an already-present label — but removing one that
+ * is not present is a 404, and a concurrent daemon restart can easily race into
+ * both.
  *
- * The quoted form is gh's own, and it is why the two operations are classified
- * separately: `gh issue edit --remove-label x` on a label the *repository* does
- * not define exits 1 with `'x' not found` (2.97.0), which for a removal is the
- * end state already holding — a label nobody defined cannot be on an issue —
- * while for an add it is a genuine failure. Removing a label the repo defines
- * but the issue does not carry is already a silent success, so this path is
- * reached only by the undefined-label case, most often a state label an
- * operator declined to create at setup.
+ * The quoted forms are gh's own: `gh issue edit --remove-label x` on a label
+ * the *repository* does not define exits 1 with `'x' not found` (2.97.0), and
+ * `gh api -X DELETE .../labels/x` on an absent label fails with the API's
+ * `Label does not exist` / `HTTP 404`. For a removal both are the end state
+ * already holding — a label nobody defined cannot be on an issue — while for
+ * an add they are a genuine failure. Removing a label the repo defines but the
+ * issue does not carry is already a silent success, so this path is reached
+ * only by the undefined-label case, most often a state label an operator
+ * declined to create at setup.
  */
 function isLabelNoop(err: unknown, op: "add" | "remove"): boolean {
   if (!(err instanceof GhError)) return false;
   const stderr = err.stderr;
   return op === "add"
     ? /already (?:has|had|exists|applied|added)|label .* already/i.test(stderr)
-    : /label does not exist|not labeled|does not have (?:that|the|this) label|label .* not found|not found on (?:this )?issue|'[^']+' not found/i.test(
+    : /label does not exist|not labeled|does not have (?:that|the|this) label|label .* not found|not found on (?:this )?issue|'[^']+' not found|HTTP 404|Not Found/i.test(
         stderr,
       );
 }
@@ -234,6 +226,22 @@ export function firstOpenCloser(raw: string): OpenCloser | undefined {
  */
 const PR_URL = /^https?:\/\/[^\s/]+\/[^\s/]+\/[^\s/]+\/pull\/\d+\/?$/;
 
+/**
+ * Split a pull request URL into the owner, repo and number the REST API path
+ * spelling needs. The same shape {@link PR_URL} guards, with the parts
+ * captured; undefined for anything that guard would reject, so callers can use
+ * the two interchangeably.
+ */
+export function prUrlParts(
+  url: string,
+): { owner: string; repo: string; number: number } | undefined {
+  const match = /^https?:\/\/[^\s/]+\/([^\s/]+)\/([^\s/]+)\/pull\/(\d+)\/?$/.exec(url);
+  if (match === null || match[1] === undefined || match[2] === undefined || match[3] === undefined) {
+    return undefined;
+  }
+  return { owner: match[1], repo: match[2], number: Number.parseInt(match[3], 10) };
+}
+
 /**
  * How much of a pull request's diff the settlement audit will hold in memory.
  *
@@ -372,6 +380,29 @@ export function issueStateFrom(raw: string): IssueState | undefined {
   }
 }
 
+/**
+ * GitHub's REST pull-request shape (`{state, merged_at}`) mapped onto
+ * {@link PrState}. `merged_at` is what distinguishes a merged PR from a
+ * closed-unmerged one under REST — `state` alone answers "closed" for both, and
+ * a settle sweep that read only state would rewrite a merged row as
+ * closed-unmerged. Anything unrecognised is "could not tell", the same
+ * fail-closed answer {@link prStateFrom} gives.
+ */
+export function prStateFromRest(raw: string): PrState | undefined {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw) as unknown;
+  } catch {
+    return undefined;
+  }
+  if (parsed === null || typeof parsed !== "object") return undefined;
+  const row = parsed as { readonly [key: string]: unknown };
+  if (row["merged_at"] != null) return "merged";
+  if (row["state"] === "closed") return "closed";
+  if (row["state"] === "open") return "open";
+  return undefined;
+}
+
 /**
  * Parent number from a raw GraphQL response, or undefined when the issue has
  * no parent. Throws when the issue or claimed parent is malformed — admission
@@ -438,6 +469,26 @@ export function mergeableFrom(raw: string): "conflicting" | "clean" | "unknown"
   }
 }
 
+/**
+ * The REST mergeability spelling onto the same fail-open triple. `--jq
+ * .mergeable` prints the bare JSON token, so `"true"` and `"false"` are the
+ * only clean answers; `null` (printed verbatim by `--jq`) is GitHub still
+ * computing the merge, and everything else means the API changed under us.
+ */
+export function mergeableFromRest(raw: string): "conflicting" | "clean" | "unknown" {
+  switch (raw.trim()) {
+    case "true":
+      return "clean";
+    case "false":
+      return "conflicting";
+    default:
+      // `null` is GitHub still computing the merge on a PR pushed seconds ago.
+      // Reading it as clean would let a conflict recovery fire on a PR nobody
+      // has assessed yet — the same reasoning as `UNKNOWN` above.
+      return "unknown";
+  }
+}
+
 /**
  * Distinct workflow-run ids behind the non-success checks of a PR.
  *
@@ -459,7 +510,17 @@ export function failedRunIds(
   return ids;
 }
 
-/** Parse `[{number, state}]` from `gh issue list` or the sub-issues API. */
+/**
+ * Parse `[{number, state}]` from `gh issue list` or the sub-issues API.
+ *
+ * The REST issues endpoint mixes pull requests into the list, and the reconcile
+ * must never remove labels off a PR — so rows carrying a `pull_request` key are
+ * dropped before the caller sees them. This replaces the `--jq
+ * select(.pull_request == null)` projection listLabeled used to send: `-i`
+ * output (needed for conditional revalidation) cannot carry a jq projection,
+ * so the filter moved in-process where it also covers every future caller.
+ * `childrenOf` rows never carry the key, so the guard is a no-op there.
+ */
 export function labeledIssuesFrom(raw: string): { number: number; state: IssueState }[] {
   let parsed: unknown;
   try {
@@ -472,6 +533,7 @@ export function labeledIssuesFrom(raw: string): { number: number; state: IssueSt
   for (const entry of parsed) {
     if (entry === null || typeof entry !== "object") continue;
     const row = entry as { readonly [key: string]: unknown };
+    if (row["pull_request"] != null) continue;
     const number = row["number"];
     const rawState = row["state"];
     if (typeof number !== "number" || !Number.isInteger(number) || typeof rawState !== "string") continue;
@@ -483,50 +545,377 @@ export function labeledIssuesFrom(raw: string): { number: number; state: IssueSt
   return issues;
 }
 
-export function makeTracker(p: ProjectConfig, runGh: typeof gh = gh): Tracker {
+/**
+ * Parse the REST `/repos/{owner}/{repo}/issues` array onto {@link ReadyIssue}.
+ *
+ * The endpoint returns pull requests as well as issues — every PR is an issue
+ * with a `pull_request` key — so that key is the filter that keeps a routed
+ * repo's PR backlog out of the ready queue (#188). The REST field spelling is
+ * snake_case (`html_url`, `updated_at`); nulls are tolerated the same way the
+ * mapping this replaces tolerated them, because the API answers null for any
+ * of these fields.
+ */
+export function readyIssuesFromRest(raw: string): ReadyIssue[] {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(raw) as unknown;
+  } catch {
+    return [];
+  }
+  if (!Array.isArray(parsed)) return [];
+  const issues: ReadyIssue[] = [];
+  for (const entry of parsed) {
+    if (entry === null || typeof entry !== "object") continue;
+    const row = entry as { readonly [key: string]: unknown };
+    // The endpoint mixes in pull requests; the queue must never claim one.
+    if (row["pull_request"] != null) continue;
+    const number = row["number"];
+    const title = row["title"];
+    const body = row["body"];
+    const labels = row["labels"];
+    const url = row["html_url"];
+    const updatedAt = row["updated_at"];
+    if (typeof number !== "number" || !Number.isInteger(number)) continue;
+    if (typeof url !== "string" || typeof updatedAt !== "string") continue;
+    const names: string[] = [];
+    if (Array.isArray(labels)) {
+      for (const label of labels) {
+        if (label === null || typeof label !== "object") continue;
+        const name = (label as { readonly name?: unknown }).name;
+        if (typeof name === "string") names.push(name);
+      }
+    }
+    issues.push({
+      number,
+      title: typeof title === "string" ? title : "",
+      body: typeof body === "string" ? body : "",
+      labels: names,
+      url,
+      updatedAt,
+    });
+  }
+  return issues;
+}
+
+/** One cached page per request URL: the ETag GitHub answered, the raw JSON
+ *  body it covered, and whether that page advertised a rel="next" successor.
+ *  Module-level default so every makeTracker() in the process (board probe,
+ *  tick, preview) shares it; keyed by exact URL, so repos, labels and page
+ *  numbers never collide. */
+export type RestListCache = Map<string, { etag: string; body: string; hasNext: boolean }>;
+const sharedRestListCache: RestListCache = new Map();
+
+/**
+ * Split a `gh api -i` answer into status, etag, rel="next" presence, body.
+ *
+ * `gh api -i` prints the status line and response headers, a blank line, then
+ * the body. A page's ETag is its identity for conditional revalidation, and
+ * the `Link` header is the only place the adapter can learn a successor page
+ * exists without parsing the body. Throws on a payload that is not an HTTP
+ * response at all — the caller must not guess what an unrecognisable answer
+ * means.
+ */
+export function splitApiInclude(raw: string): {
+  status: number;
+  etag?: string;
+  hasNext: boolean;
+  body: string;
+} {
+  const blank = /\r?\n\r?\n/.exec(raw);
+  const headerBlock = blank === null ? raw : raw.slice(0, blank.index);
+  const body = blank === null ? "" : raw.slice(blank.index + blank[0].length);
+  const [statusLine = ""] = headerBlock.split(/\r?\n/);
+  const statusMatch = /^HTTP\/[\d.]+ (\d{3})/.exec(statusLine);
+  if (statusMatch === null) {
+    throw new Error("unrecognised gh api -i response");
+  }
+  let etag: string | undefined;
+  let hasNext = false;
+  for (const line of headerBlock.split(/\r?\n/)) {
+    const colon = line.indexOf(":");
+    if (colon <= 0) continue;
+    const name = line.slice(0, colon).trim().toLowerCase();
+    const value = line.slice(colon + 1).trim();
+    if (name === "etag") etag = value;
+    else if (name === "link" && /rel="next"/.test(value)) hasNext = true;
+  }
+  return { status: Number(statusMatch[1]), etag, hasNext, body };
+}
+
+/**
+ * GET a REST list path page by page, revalidating each known page with
+ * If-None-Match. A 304 reuses that page's cached body and costs no primary
+ * rate-limit budget; a changed page answers 200 and replaces its cache entry.
+ * Every known page is requested on every pass, so a change on page N is
+ * detected even when earlier pages are unchanged. Follows rel="next" with no
+ * page cap when `paginate`; entries past the final page are pruned. Returns
+ * one raw JSON-array body per page.
+ */
+async function conditionalListPages(
+  runGh: typeof gh,
+  cache: RestListCache,
+  path: string,
+  paginate: boolean,
+  onNotModified?: () => void,
+): Promise<string[]> {
+  const bodies: string[] = [];
+  let n = 1;
+  for (;;) {
+    const url = n === 1 ? path : `${path}&page=${n}`;
+    const cached = cache.get(url);
+    const argv = ["api", "-i", ...(cached ? ["-H", `If-None-Match: ${cached.etag}`] : []), url];
+    let raw: string;
+    try {
+      raw = await runGh(argv);
+    } catch (err) {
+      if (!(err instanceof GhError) || !/^HTTP\/[\d.]+ 304\b/.test(err.stdout)) throw err;
+      // A 304 is gh's documented answer for an unchanged conditional request:
+      // exit 1, with the status line still on stdout. `cached` must exist —
+      // we only send If-None-Match when we hold an etag — so rethrow if not,
+      // fail-loud, never serve a page we did not cache.
+      if (cached === undefined) throw err;
+      bodies.push(cached.body);
+      onNotModified?.();
+      if (!paginate || !cached.hasNext) break;
+      n += 1;
+      continue;
+    }
+    const r = splitApiInclude(raw);
+    if (r.status === 304) {
+      // A future `gh` that exits 0 on a 304 would land here instead of the
+      // catch above; both arms answer identically. The cache entry keeps its
+      // stored etag — the 304's echo comes back strong-form, while the stored
+      // weak form keeps matching.
+      if (cached === undefined) {
+        throw new Error("a 304 answered a page never sent If-None-Match for");
+      }
+      bodies.push(cached.body);
+      onNotModified?.();
+      if (!paginate || !cached.hasNext) break;
+      n += 1;
+      continue;
+    }
+    if (r.etag !== undefined) cache.set(url, { etag: r.etag, body: r.body, hasNext: r.hasNext });
+    else cache.delete(url);
+    bodies.push(r.body);
+    if (!paginate || !r.hasNext) break;
+    n += 1;
+  }
+  // The list shrank: without this a later pass would revalidate pages that no
+  // longer exist. `n` is the last page fetched; prune every successor key.
+  for (let k = n + 1; cache.has(`${path}&page=${k}`); k += 1) {
+    cache.delete(`${path}&page=${k}`);
+  }
+  return bodies;
+}
+
+/** The two GitHub API budgets this adapter spends: GraphQL for the
+ *  closers/parent/rollup reads, core for everything else. `reset` is the REST
+ *  spelling — epoch seconds. */
+export interface RateLimitStatus {
+  graphql: { remaining: number; limit: number; reset: number };
+  core: { remaining: number; limit: number; reset: number };
+}
+
+function rateLimitBucket(
+  raw: unknown,
+): { remaining: number; limit: number; reset: number } | undefined {
+  if (raw === null || typeof raw !== "object") return undefined;
+  const row = raw as { readonly [key: string]: unknown };
+  const remaining = row["remaining"];
+  const limit = row["limit"];
+  const reset = row["reset"];
+  if (typeof remaining !== "number" || typeof limit !== "number" || typeof reset !== "number") {
+    return undefined;
+  }
+  return { remaining, limit, reset };
+}
+
+/**
+ * Read the GitHub API rate-limit budget for `status` (the tracker layer's
+ * counterpart to the decision probe: the layers differ, so the two stay
+ * independent).
+ *
+ * Any failure — a revoked token, a flaky network, a payload shape this build
+ * does not recognise — answers undefined: a broken `gh` must cost one status
+ * row, never the whole report.
+ */
+export async function fetchRateLimit(
+  runGh: typeof gh = gh,
+): Promise<RateLimitStatus | undefined> {
+  try {
+    const parsed = JSON.parse(
+      await runGh(["api", "rate_limit", "--jq", "{graphql: .resources.graphql, core: .resources.core}"]),
+    ) as unknown;
+    if (parsed === null || typeof parsed !== "object") return undefined;
+    const row = parsed as { readonly [key: string]: unknown };
+    const graphql = rateLimitBucket(row["graphql"]);
+    const core = rateLimitBucket(row["core"]);
+    if (graphql === undefined || core === undefined) return undefined;
+    return { graphql, core };
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * True when a `gh` failure is GitHub refusing us at the rate-limit layer.
+ *
+ * Three distinct bodies arrive through the CLI and all mean "stop sending":
+ * the primary budget exhausted (`API rate limit exceeded`, or the 403 the REST
+ * layer reports as `HTTP 403 ... rate limit`), the secondary budget
+ * (`secondary rate limit`), and an abuse-control trip (`abuse detection`).
+ * gh's stderr carries none of the header values (`Retry-After`, `reset`) that
+ * would drive a precise backoff, so the cooldown is the tracker's fixed window
+ * below rather than a header-driven one.
+ */
+export function isRateLimitRefusal(err: unknown): boolean {
+  return (
+    err instanceof GhError &&
+    /API rate limit exceeded|secondary rate limit|abuse detection|HTTP 403.*rate limit/i.test(
+      err.stderr,
+    )
+  );
+}
+
+/**
+ * A rate-limit refusal rethrown by {@link makeTracker}. This is the one
+ * failure class the tracker names instead of swallowing: the circuit breaker
+ * throws it without spawning `gh`, and it is what a caller can distinguish
+ * from an ordinary transport fault.
+ */
+export class GhRateLimitError extends GhError {
+  /** Wall-clock millis after which a call may be attempted again. */
+  readonly retryAtMs: number;
+
+  constructor(argv: string[], code: number, stderr: string, retryAtMs: number, stdout = "") {
+    super(argv, code, stderr, stdout);
+    this.name = "GhRateLimitError";
+    this.retryAtMs = retryAtMs;
+    this.message = `${this.message} — GitHub rate limit; retry at ${new Date(retryAtMs).toISOString()}`;
+  }
+}
+
+/** How long a rate-limit refusal holds the circuit breaker open. */
+export const RATE_LIMIT_COOLDOWN_MS = 60_000;
+
+/** Instrumentation hooks the daemon binds the tracker to (#198). */
+export interface TrackerHooks {
+  /** Fired immediately before each `gh` spawn, so the daemon can count its own
+   *  API spend. Not fired for a breaker fast-fail, which spawns nothing. */
+  onCall?: () => void;
+  /** Fired once per observed refusal, with the wall-clock moment. */
+  onRefusal?: (at: number) => void;
+  /** Fired once per list page GitHub answered 304 for — a spawn that cost no
+   *  primary-rate-limit budget. Lets the daemon's call counter tell billed
+   *  reads from free revalidations (#203 on top of #198's counting). */
+  onNotModified?: () => void;
+}
+
+interface TrackerOpts {
+  /** Override {@link RATE_LIMIT_COOLDOWN_MS} (tests use a 0ms window). */
+  rateLimitCooldownMs?: number;
+  /** Conditional-request cache for REST list reads; defaults to the shared
+   *  module-level cache. Tests pass a fresh Map. */
+  listCache?: RestListCache;
+}
+
+export function makeTracker(
+  p: ProjectConfig,
+  injectedRunGh: typeof gh = gh,
+  hooks: TrackerHooks = {},
+  opts: TrackerOpts = {},
+): Tracker {
   const repo = p.tracker.repo;
+  const refuseForMs = opts.rateLimitCooldownMs ?? RATE_LIMIT_COOLDOWN_MS;
+  const cache = opts.listCache ?? sharedRestListCache;
+
+  // The single funnel around the injected `gh`. A caught refusal records the
+  // user-observed moment, opens the 60s breaker and rethrows named; while the
+  // breaker is open every call fails fast WITHOUT spawning gh — a burst under a
+  // persistent limit degrades the tick into holds (`open-pr-lookup-error` /
+  // `parent-lookup-error` fail closed per candidate and retry next tick)
+  // instead of an error storm or a stalled loop. No in-wrapper sleeps.
+  let refusedUntil = 0;
+  const runGh = async (argv: string[], stdin?: string): Promise<string> => {
+    const now = Date.now();
+    if (now < refusedUntil) {
+      throw new GhRateLimitError(
+        argv,
+        0,
+        "circuit breaker open (a prior GitHub rate-limit refusal holds the cooldown)",
+        refusedUntil,
+      );
+    }
+    hooks.onCall?.();
+    try {
+      return await injectedRunGh(argv, stdin);
+    } catch (err) {
+      if (isRateLimitRefusal(err)) {
+        const at = Date.now();
+        refusedUntil = at + refuseForMs;
+        hooks.onRefusal?.(at);
+        const cause = err instanceof GhError ? err : undefined;
+        throw new GhRateLimitError(
+          argv,
+          cause?.code ?? 1,
+          cause?.stderr ?? String(err),
+          refusedUntil,
+          cause?.stdout ?? "",
+        );
+      }
+      throw err;
+    }
+  };
 
   // Named rather than returned inline, so `rerunFailedChecks` can reuse
   // `checkConclusions` instead of re-implementing the same `gh` call.
   const tracker: Tracker = {
     async listReady(): Promise<ReadyIssue[]> {
-      const raw = await runGh([
-        "issue",
-        "list",
-        "--repo",
-        repo,
-        "--state",
-        "open",
-        "--label",
-        p.queueLabel,
-        // ponytail: one page is the cap. A queue deeper than 100 ready issues
-        // truncates silently; upgrade path is `--paginate` via the API, but a
-        // backlog that size is a staffing problem before it is a paging one.
-        "--limit",
-        "100",
-        "--json",
-        "number,title,body,labels,url,updatedAt",
-      ]);
+      // REST, not `issue list --json`: the ready-queue read is a hot-path poll
+      // on every dispatch pass, and GraphQL budget is the scarce one (#188).
+      // Paginated rather than one page of 100 — now that an idle revalidation
+      // costs an unconditional-200's worth of nothing, truncating a deep queue
+      // to save calls saves nothing that matters; the cap was the call count,
+      // and the conditional path changed what a call costs.
+      const pages = await conditionalListPages(
+        runGh,
+        cache,
+        `repos/${repo}/issues?state=open&labels=${encodeURIComponent(p.queueLabel)}&per_page=100`,
+        /* paginate */ true,
+        hooks.onNotModified,
+      );
 
-      const text = raw.trim();
-      // `gh` prints nothing at all in some no-match paths; an empty queue is
-      // the normal steady state, not an error.
-      if (!text) return [];
-
-      const issues = JSON.parse(text) as GhIssue[];
-      return issues.map((issue) => ({
-        number: issue.number,
-        title: issue.title ?? "",
-        body: issue.body ?? "",
-        labels: (issue.labels ?? []).map((label) => label.name),
-        url: issue.url,
-        updatedAt: issue.updatedAt,
-      }));
+      // The REST endpoint always answers a JSON array — an empty queue is `[]`,
+      // not empty text — but an empty body still parses to no issues here, and
+      // the empty queue is the normal steady state, not an error.
+      return pages.flatMap(readyIssuesFromRest);
+    },
+
+    async listOpenIssues(): Promise<ReadyIssue[]> {
+      const pages = await conditionalListPages(
+        runGh,
+        cache,
+        `repos/${repo}/issues?state=open&per_page=100`,
+        /* paginate */ true,
+        hooks.onNotModified,
+      );
+      return pages.flatMap(readyIssuesFromRest);
     },
 
     async addLabel(issue: number, label: string): Promise<void> {
       try {
-        await runGh(["issue", "edit", String(issue), "--repo", repo, "--add-label", label]);
+        // REST POST is natively idempotent: re-adding a label the issue already
+        // carries answers 200 with the label, so the noop classification below
+        // is reachable only on a genuinely odd failure — kept for parity.
+        await runGh([
+          "api",
+          "-X",
+          "POST",
+          `repos/${repo}/issues/${issue}/labels`,
+          "-f",
+          `labels[]=${label}`,
+        ]);
       } catch (err) {
         if (!isLabelNoop(err, "add")) throw err;
       }
@@ -534,7 +923,12 @@ export function makeTracker(p: ProjectConfig, runGh: typeof gh = gh): Tracker {
 
     async removeLabel(issue: number, label: string): Promise<void> {
       try {
-        await runGh(["issue", "edit", String(issue), "--repo", repo, "--remove-label", label]);
+        await runGh([
+          "api",
+          "-X",
+          "DELETE",
+          `repos/${repo}/issues/${issue}/labels/${encodeURIComponent(label)}`,
+        ]);
       } catch (err) {
         if (!isLabelNoop(err, "remove")) throw err;
       }
@@ -602,8 +996,10 @@ export function makeTracker(p: ProjectConfig, runGh: typeof gh = gh): Tracker {
 
     async issueState(issue: number): Promise<IssueState | undefined> {
       try {
+        // REST answers lowercase `open`/`closed`; the shared parser expects the
+        // CLI's uppercase spelling, so the answer is normalised before it.
         return issueStateFrom(
-          await runGh(["issue", "view", String(issue), "--repo", repo, "--json", "state", "--jq", ".state"]),
+          (await runGh(["api", `repos/${repo}/issues/${issue}`, "--jq", ".state"])).trim().toUpperCase(),
         );
       } catch {
         return undefined;
@@ -611,14 +1007,21 @@ export function makeTracker(p: ProjectConfig, runGh: typeof gh = gh): Tracker {
     },
 
     async prState(url: string): Promise<PrState | undefined> {
-      // No `--repo`: a full URL is self-locating, and verified so on gh 2.97.0
-      // from a directory that is not a git repository at all — which is exactly
-      // where the daemon runs (its state directory), while the PR lives in one
-      // of the routed repos. Deriving `--repo` from the URL would only re-state
-      // what the URL already says.
+      // No `--repo`: the full URL names the repository, and the daemon runs
+      // from its own state directory rather than a checkout — so the REST path
+      // halves come out of the URL itself, never out of the current directory.
       if (!PR_URL.test(url)) return undefined;
+      const parts = prUrlParts(url);
+      if (parts === undefined) return undefined;
       try {
-        return prStateFrom(await runGh(["pr", "view", url, "--json", "state", "--jq", ".state"]));
+        return prStateFromRest(
+          await runGh([
+            "api",
+            `repos/${parts.owner}/${parts.repo}/pulls/${parts.number}`,
+            "--jq",
+            "{state, merged_at}",
+          ]),
+        );
       } catch {
         // Never throws, per the port's contract. A deleted PR, a revoked token
         // and a flaky network all mean "could not tell", and the caller's whole
@@ -713,8 +1116,17 @@ export function makeTracker(p: ProjectConfig, runGh: typeof gh = gh): Tracker {
 
     async mergeable(prUrl: string): Promise<"conflicting" | "clean" | "unknown"> {
       if (!PR_URL.test(prUrl)) return "unknown";
+      const parts = prUrlParts(prUrl);
+      if (parts === undefined) return "unknown";
       try {
-        return mergeableFrom(await runGh(["pr", "view", prUrl, "--json", "mergeable", "--jq", ".mergeable"]));
+        return mergeableFromRest(
+          await runGh([
+            "api",
+            `repos/${parts.owner}/${parts.repo}/pulls/${parts.number}`,
+            "--jq",
+            ".mergeable",
+          ]),
+        );
       } catch {
         return "unknown";
       }
@@ -735,22 +1147,19 @@ export function makeTracker(p: ProjectConfig, runGh: typeof gh = gh): Tracker {
 
     async listLabeled(label: string, limit = 50): Promise<{ number: number; state: IssueState }[]> {
       try {
-        return labeledIssuesFrom(
-          await runGh([
-            "issue",
-            "list",
-            "--repo",
-            repo,
-            "--label",
-            label,
-            "--state",
-            "all",
-            "--json",
-            "number,state",
-            "--limit",
-            String(limit),
-          ]),
+        // One page, deliberately: `limit` is the caller's work bound
+        // (RECONCILE_LIMIT), not a queue-depth cap, and the reconcile only
+        // ever acts on the page it reads. The conditional cache still makes a
+        // steady-state pass cost nothing even though the response is big.
+        const pages = await conditionalListPages(
+          runGh,
+          cache,
+          `repos/${repo}/issues?state=all&labels=${encodeURIComponent(label)}&per_page=${limit}`,
+          /* paginate */ false,
+          hooks.onNotModified,
         );
+        // paginate: false means exactly one body, always a JSON array.
+        return labeledIssuesFrom(pages[0] ?? "");
       } catch {
         // A reconcile that cannot list must remove no labels: an empty answer is
         // read as "no evidence", never as "nothing carries this label".