omp-conductor 0.8.0 → 0.9.0

package/src/diff-flags.ts

@@ -435,6 +435,14 @@ function evidence(text: string): string {
 export interface SettlementAudit {
   /** The worker's final report, verbatim. */
   report: string;
+  /** Earlier attempts' reports for the same issue, oldest first. Their
+   *  `changed:` disclosures are pooled as coverage so a file disclosed in a
+   *  prior attempt is never flagged as undisclosed in the final one, while the
+   *  reverse (unmatched-claim) direction reads only the current report — a file
+   *  claimed in attempt 1 and reverted by attempt 3 must not come back as a new
+   *  finding (#199). Absent means this is the only attempt, or older rows never
+   *  stored a report. */
+  priorReports?: readonly string[];
   /** The dispatching issue's title and body — the attribution source. */
   issueText: string;
   diff: PrDiff;
@@ -457,8 +465,13 @@ export function analyseSettlement(audit: SettlementAudit): SettlementFlag[] {
 function reconcileChanged(audit: SettlementAudit, flags: SettlementFlag[]): void {
   const touched = audit.diff.files.filter((f) => DERIVED_FILE[basename(f.path)] !== true);
   const claims = claimedPaths(audit.report);
+  const priorClaims = claimedPaths((audit.priorReports ?? []).join("\n"));
+  // Coverage pools the current report with every prior attempt's disclosures:
+  // a file the final report no longer names was disclosed while the work was
+  // still in flight, so it must not be flagged undisclosed (#199).
+  const coverage = [...new Set([...claims, ...priorClaims])];
 
-  if (claims.length === 0) {
+  if (claims.length === 0 && priorClaims.length === 0) {
     // The degenerate case of the same check: with no usable `changed:` line
     // every file is undisclosed, and saying so once beats saying it per file.
     // Reporting it at all is what stops the check being defeated by writing
@@ -476,8 +489,8 @@ function reconcileChanged(audit: SettlementAudit, flags: SettlementFlag[]): void
   }
 
   for (const file of touched) {
-    if (claims.some((claim) => covers(claim, file.path))) continue;
-    if (file.previousPath !== undefined && claims.some((claim) => covers(claim, file.previousPath ?? ""))) {
+    if (coverage.some((claim) => covers(claim, file.path))) continue;
+    if (file.previousPath !== undefined && coverage.some((claim) => covers(claim, file.previousPath ?? ""))) {
       continue;
     }
     flags.push({
@@ -491,6 +504,10 @@ function reconcileChanged(audit: SettlementAudit, flags: SettlementFlag[]): void
   // file it edited and then reverted, or one it renamed away from. Worth
   // surfacing because a `changed:` line that describes a different PR is the
   // signature of a report written from memory rather than from `git diff`.
+  //
+  // It iterates only the CURRENT report's claims (#199). A file claimed in
+  // attempt 1 and reverted by attempt 3 was true then and false now; pooling
+  // priors into this loop would turn every honest revert into a fresh finding.
   for (const claim of claims) {
     if (audit.diff.files.some((f) => covers(claim, f.path) || covers(claim, f.previousPath ?? ""))) {
       continue;
@@ -661,18 +678,30 @@ const HEADING = "settlement audit";
  * that could not be read in full — then the absence of flags is not evidence of
  * anything, and saying so is the honest report.
  */
+/** Appended to the heading when a multi-attempt audit pooled prior disclosures,
+ *  so a reader is told the coverage is wider than this one report (#199). */
+function pooledHeading(attempts: number | undefined): string {
+  return attempts !== undefined && attempts > 1
+    ? ` — disclosures pooled across ${attempts} attempt(s)`
+    : "";
+}
+
 export function formatSettlementFlags(
   flags: readonly SettlementFlag[],
-  diff: { truncated: boolean } = { truncated: false },
+  diff: { truncated: boolean; attempts?: number } = { truncated: false },
 ): string[] {
   if (flags.length === 0) {
     return diff.truncated
-      ? [`${HEADING}: no flags, but the PR diff was too large to read in full — this is not a clean bill`]
+      ? [
+          `${HEADING}: no flags, but the PR diff was too large to read in full` +
+            `${pooledHeading(diff.attempts)} — this is not a clean bill`,
+        ]
       : [];
   }
   const lines = [
     `${HEADING}: ${flags.length} advisory flag(s) — the run's state is unchanged by them` +
-      (diff.truncated ? ", and the PR diff was too large to read in full" : ""),
+      (diff.truncated ? ", and the PR diff was too large to read in full" : "") +
+      pooledHeading(diff.attempts),
   ];
   for (const flag of flags.slice(0, RENDERED_FLAGS)) {
     lines.push(

package/src/fleet.ts

@@ -1076,11 +1076,37 @@ function formatProjectBody(s: StatusSnapshot): string {
     // fleet (#110).
     `  plan usage         ${planUsageLine(s.planUsage)}`,
     // The tracker's API budget, when the renderer could read it. Absent on a
-    // broken `gh`: one missing row, never a broken report (#188).
+    // broken `gh`: one missing row, never a broken report (#188). Next to it,
+    // the refusals the tracker actually observed, so a budget that looks
+    // healthy next to every call being refused is still visible (#198).
     ...(s.github === undefined
       ? []
       : [
-          `  github             graphql ${s.github.graphql.remaining}/${s.github.graphql.limit}, core ${s.github.core.remaining}/${s.github.core.limit} (graphql resets ${Math.max(0, Math.round((s.github.graphql.reset * 1000 - Date.now()) / 60_000))}m)`,
+          `  github             graphql ${s.github.graphql.remaining}/${s.github.graphql.limit}, core ${s.github.core.remaining}/${s.github.core.limit} (graphql resets ${Math.max(0, Math.round((s.github.graphql.reset * 1000 - Date.now()) / 60_000))}m)` +
+            (s.ghRefusals === undefined || s.ghRefusals.count === 0
+              ? ""
+              : ` — ${s.ghRefusals.count} refusal(s) in last 5m (last ${new Date(s.ghRefusals.latestAt ?? Date.now()).toISOString().slice(11, 19)}Z)`),
+        ]),
+    // The daemon's own observed github traffic today (#198): a separate row
+    // from the polled budget above, so one missing `status` read never hides
+    // the other. `onCall` counts every spawn including ones that end 304, so
+    // `daemon` is spawns and `daemon-304` is the unbilled subset — billed ≈
+    // difference, and the polled budget row stays the authority (#203).
+    `  github calls       daemon ${s.ghCallsToday?.find((c) => c.source === "daemon")?.calls ?? 0} today` +
+      ((s.ghCallsToday?.find((c) => c.source === "daemon-304")?.calls ?? 0) === 0
+        ? ""
+        : ` (${s.ghCallsToday!.find((c) => c.source === "daemon-304")!.calls} free 304s)`),
+    // Label-projection ops the tracker has not applied yet (#201): GitHub is
+    // behind what the store decided, and the operator can see the lag instead
+    // of discovering it as a stale label or a missing one.
+    ...(s.labelOps === undefined
+      ? []
+      : [
+          `  labels             projection ${s.labelOps.pending} pending (oldest ${
+            s.labelOps.oldestAgeMs >= 60_000
+              ? `${Math.round(s.labelOps.oldestAgeMs / 60_000)}m`
+              : `${Math.max(1, Math.round(s.labelOps.oldestAgeMs / 1000))}s`
+          })`,
         ]),
     `  new worker turns   ${s.caps.workerMaxTurns}`,
     `  worker wall clock  ${Math.round(s.caps.workerWallClockMs / 60_000)}m`,

package/src/label-projection.ts

@@ -0,0 +1,93 @@
+/**
+ * The label projection outbox (#201).
+ *
+ * The dispatcher used to write GitHub labels directly, which made the label —
+ * not the store — the crash guard against double dispatch, and let one refused
+ * label write strand an issue (`#184`, `#198`). Dispatch state is now
+ * store-authoritative; every decided label change is an outbox row that this
+ * module projects onto the tracker with retry.
+ *
+ * Both the daemon tick and the `unblock` CLI path drain through the same
+ * `projectLabels` so a 403 no longer takes either down: the op defers with
+ * backoff and the daemon retries it. Per-issue ops apply in id order, which is
+ * what makes a swap atomic — `add` lands before the paired `remove` exactly as
+ * enqueued.
+ */
+
+import { GhRateLimitError, isRateLimitRefusal } from "./tracker/github.ts";
+import type { ProjectConfig, Store, Tracker } from "./types.ts";
+
+/** Retry backoff for one failed label op: 30s doubling, capped at 15m (#201). */
+export function labelOpBackoffMs(attempts: number): number {
+  return Math.min(30_000 * 2 ** attempts, 15 * 60_000);
+}
+
+function errText(e: unknown): string {
+  return e instanceof Error ? e.message : String(e);
+}
+
+/**
+ * Drain as many due label ops as the tracker will take, in id order.
+ *
+ * A failed op defers with backoff and holds the rest of its issue for the next
+ * pass: a later op for the same issue must not land while an earlier one could
+ * not (that is the atomicity `#184` needed — add-queue-label must not beat
+ * remove-blocked when they were enqueued in that order). Other issues continue.
+ *
+ * Returns what happened so `unblock` can say "queued, the daemon retries"
+ * instead of pretending a deferred op was applied.
+ */
+export async function projectLabels(
+  store: Store,
+  tracker: Tracker,
+  project: ProjectConfig,
+): Promise<{ applied: number; deferred: number }> {
+  let applied = 0;
+  let deferred = 0;
+  // `pendingLabelOps` returns at most the oldest owed row per issue (it
+  // excludes any row that still has an earlier pending sibling), so a swap's
+  // second op can never land before its first — per-issue atomicity enforced
+  // across calls and processes, not just one pass. Re-querying lets a healthy
+  // chain drain fully in this one call (unblock clears every state label in
+  // one go), while a failing op defers its issue and parks the rest until it
+  // settles.
+  for (;;) {
+    const due = store.pendingLabelOps(project.name, Date.now());
+    if (due.length === 0) break;
+    let progressed = false;
+    for (const op of due) {
+      try {
+        if (op.op === "add") await tracker.addLabel(op.issue, op.label);
+        else await tracker.removeLabel(op.issue, op.label);
+        store.settleLabelOp(op.id);
+        applied += 1;
+        progressed = true;
+      } catch (err) {
+        // A rate-limit refusal defers WITHOUT counting an attempt: a shared
+        // outage (all of GitHub refusing) is not this op's fault, so it must
+        // not burn the op's backoff escalation (#208). The circuit breaker's
+        // fast-fail (`GhRateLimitError`) is the most common shape — its stderr
+        // says "circuit breaker open", which `isRateLimitRefusal`'s body regex
+        // does not match — so classify it by type first and honour its
+        // `retryAtMs`. Every other failure counts and doubles the next wait.
+        if (err instanceof GhRateLimitError) {
+          store.deferLabelOp(op.id, errText(err), err.retryAtMs, false);
+        } else {
+          const rateLimited = isRateLimitRefusal(err);
+          store.deferLabelOp(
+            op.id,
+            errText(err),
+            Date.now() + labelOpBackoffMs(op.attempts + 1),
+            !rateLimited,
+          );
+        }
+        deferred += 1;
+      }
+    }
+    // Every remaining op in this pass was deferred (parked behind its backoff),
+    // so re-querying would only re-select the same deferred rows; nothing more
+    // is applicable until a backoff elapses.
+    if (!progressed) break;
+  }
+  return { applied, deferred };
+}

package/src/routing.ts

@@ -55,6 +55,26 @@ export function isEligible(issue: ReadyIssue, p: ProjectConfig): boolean {
   return !labels.has(inProgress) && !labels.has(blocked) && !labels.has(failed);
 }
 
+/**
+ * The label set an issue *effectively* carries once the projection outbox is
+ * accounted for (#201). Pending ops apply in enqueue order — the same order
+ * the projector will apply them — so an issue with a pending queue-label
+ * removal drops out of eligibility immediately, and a pending state-label
+ * removal stops a stale GitHub label from blocking redispatch while the
+ * tracker is still catching up. Pure: the physical label set is untouched.
+ */
+export function effectiveLabels(
+  labels: readonly string[],
+  pending: readonly { op: "add" | "remove"; label: string }[],
+): string[] {
+  const set = new Set(labels);
+  for (const op of pending) {
+    if (op.op === "add") set.add(op.label);
+    else set.delete(op.label);
+  }
+  return [...set];
+}
+
 /**
  * Partition eligible issues into dispatchable and needs-a-human.
  *

package/src/store.ts

@@ -26,6 +26,7 @@ import type {
   FrictionKind,
   FrictionObservation,
   FrictionSignal,
+  LabelOp,
   MergeLock,
   ReportDeliveryState,
   ReportDraft,
@@ -111,6 +112,7 @@ const UPDATABLE_COLUMNS: Record<string, true> = {
   endedAt: true,
   lastError: true,
   settlementFlags: true,
+  report: true,
   failureClass: true,
   recoveryAction: true,
   recoveredAt: true,
@@ -142,6 +144,7 @@ interface RunRow {
   endedAt: number | null;
   lastError: string | null;
   settlementFlags: string | null;
+  report: string | null;
   failureClass: string | null;
   recoveryAction: string | null;
   recoveredAt: number | null;
@@ -163,6 +166,35 @@ interface FrictionSurfaceRow {
   at: number;
 }
 
+/** The `label_ops` table exactly as SQLite hands it back (#201). */
+interface LabelOpRow {
+  id: number;
+  project: string;
+  issue: number;
+  op: "add" | "remove";
+  label: string;
+  createdAt: number;
+  attempts: number;
+  nextAttemptAt: number;
+  lastError: string | null;
+}
+
+/** NULL columns become absent properties, matching the other row converters. */
+function toLabelOp(row: LabelOpRow): LabelOp {
+  const op: LabelOp = {
+    id: row.id,
+    project: row.project,
+    issue: row.issue,
+    op: row.op,
+    label: row.label,
+    createdAt: row.createdAt,
+    attempts: row.attempts,
+    nextAttemptAt: row.nextAttemptAt,
+  };
+  if (row.lastError !== null) op.lastError = row.lastError;
+  return op;
+}
+
 /** The `reports` table exactly as SQLite hands it back. */
 interface ReportRow {
   id: string;
@@ -229,6 +261,7 @@ CREATE TABLE IF NOT EXISTS runs (
   endedAt     INTEGER,
   lastError   TEXT,
   settlementFlags TEXT,
+  report      TEXT,
   failureClass TEXT,
   recoveryAction TEXT,
   recoveredAt INTEGER
@@ -360,6 +393,46 @@ CREATE TABLE IF NOT EXISTS decisions (
   resolution     TEXT
 );
 CREATE INDEX IF NOT EXISTS decisions_project_state ON decisions (project, state);
+
+-- GitHub rate-limit refusals the tracker observed (#198). Written by the
+-- daemon's tracker hook, not polled, so status can show what GitHub actually
+-- refused next to the polled budget that might still look healthy. Only one
+-- column: a refusal carries no id or dedupe key — rows are pruned by age
+-- (24h) in the same write that inserts, kept long enough for status's 5m
+-- window and for an operator who wants to see the last day of refusals.
+CREATE TABLE IF NOT EXISTS gh_refusals (
+  at INTEGER NOT NULL
+);
+CREATE INDEX IF NOT EXISTS gh_refusals_at ON gh_refusals (at);
+
+-- The daemon's tracked gh call count, per UTC day and call source (#198).
+-- The single funnel in tracker/github.ts counts every spawn; the day/source
+-- pair is the partition, so today's column and today's row survive a restart.
+CREATE TABLE IF NOT EXISTS gh_calls (
+  day    TEXT    NOT NULL,
+  source TEXT    NOT NULL,
+  calls  INTEGER NOT NULL,
+  PRIMARY KEY (day, source)
+);
+-- The label projection outbox (#201). Every decided GitHub label change the
+-- dispatcher made is a row here until the tracker has applied it; the daemon
+-- retries with backoff, and eligibility reads pendingLabelOpsFor so a label
+-- GitHub refuses to move cannot strand the issue the daemon already decided
+-- to move on. The queue-label add and the state-label remove of one swap are
+-- two rows, applied strictly in id order, which is what makes a swap atomic:
+-- the remove cannot land before the add it was enqueued after.
+CREATE TABLE IF NOT EXISTS label_ops (
+  id            INTEGER PRIMARY KEY AUTOINCREMENT,
+  project       TEXT    NOT NULL,
+  issue         INTEGER NOT NULL,
+  op            TEXT    NOT NULL CHECK (op IN ('add', 'remove')),
+  label         TEXT    NOT NULL,
+  createdAt     INTEGER NOT NULL,
+  attempts      INTEGER NOT NULL DEFAULT 0,
+  nextAttemptAt INTEGER NOT NULL DEFAULT 0,
+  lastError     TEXT
+);
+CREATE INDEX IF NOT EXISTS label_ops_project_next ON label_ops (project, nextAttemptAt);
 `;
 
 /**
@@ -435,6 +508,7 @@ function toRecord(row: RunRow): RunRecord {
     const flags = toSettlementFlags(row.settlementFlags);
     if (flags !== undefined) record.settlementFlags = flags;
   }
+  if (row.report !== null) record.report = row.report;
   if (row.failureClass !== null) record.failureClass = row.failureClass as FailureClass;
   if (row.recoveryAction !== null) record.recoveryAction = row.recoveryAction as RecoveryAction;
   if (row.recoveredAt !== null) record.recoveredAt = row.recoveredAt;
@@ -613,6 +687,12 @@ export function dbPath(): string {
   return join(stateDir(), "conductor.db");
 }
 
+/** The UTC calendar day (`YYYY-MM-DD`) a moment falls on — the partition key
+ *  for the daemon's observed github call counter (#198). */
+export function utcDay(now: number = Date.now()): string {
+  return new Date(now).toISOString().slice(0, 10);
+}
+
 /**
  * Open (creating if needed) the run store at `dbPath`; `:memory:` is honoured
  * for tests. Safe to call on a fresh path — the schema is applied on open, so
@@ -665,6 +745,13 @@ export function openStore(dbPath: string): Store {
   if (!columns.some((column) => column.name === "settlementFlags")) {
     db.exec("ALTER TABLE runs ADD COLUMN settlementFlags TEXT");
   }
+  // Rows written before the settlement report was persisted (#199) have no
+  // text to pool across attempts, so a continuation reads empty priors and
+  // audits exactly as it did before this release. No backfill: the bytes only
+  // ever existed in a worker's memory.
+  if (!columns.some((column) => column.name === "report")) {
+    db.exec("ALTER TABLE runs ADD COLUMN report TEXT");
+  }
   // Every row written before #132 is unclassified, and NULL is the honest
   // reading of that: the budget counters below deliberately still count an
   // unclassified terminal row exactly as this release's predecessor did, so an
@@ -772,8 +859,8 @@ export function openStore(dbPath: string): Store {
     `INSERT INTO runs (
        id, project, issue, repo, branch, worktree, state, attempt, turns,
        maxTurns, spendUsd, sessionFile, prUrl, headSha, salvageSha, salvageError,
-       salvageAckAt, startedAt, endedAt, lastError, settlementFlags
-     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+       salvageAckAt, startedAt, endedAt, lastError, settlementFlags, report
+     ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
   );
   const selectRun = db.query<RunRow, [string]>(`SELECT * FROM runs WHERE id = ?`);
   const selectActive = db.query<RunRow, SqlValue[]>(
@@ -886,6 +973,14 @@ export function openStore(dbPath: string): Store {
       ORDER BY startedAt DESC, rowid DESC
       LIMIT 1`,
   );
+  // Every attempt that settled with a report, in attempt order. NULLs are the
+  // rows written before #199, or one killed before the worker returned a
+  // report — skipping them makes a continuation read exactly today's priors.
+  const selectAttemptReports = db.query<{ attempt: number; report: string }, [string, number]>(
+    `SELECT attempt, report FROM runs
+      WHERE project = ? AND issue = ? AND report IS NOT NULL
+      ORDER BY attempt`,
+  );
   const countStartedSince = db.query<{ n: number }, [string, number]>(
     `SELECT COUNT(*) AS n FROM runs WHERE project = ? AND startedAt >= ?`,
   );
@@ -938,6 +1033,31 @@ export function openStore(dbPath: string): Store {
      ON CONFLICT(project, kind) DO UPDATE SET at = excluded.at`,
   );
 
+  // Observed GitHub rate-limit refusals (#198). Insert + prune share one
+  // transaction so a burst never grows the table without bound.
+  const insertGhRefusal = db.query<unknown, [number]>(
+    `INSERT INTO gh_refusals (at) VALUES (?)`,
+  );
+  const pruneGhRefusals = db.query<unknown, [number]>(
+    `DELETE FROM gh_refusals WHERE at < ?`,
+  );
+  const selectGhRefusalsSince = db.query<{ n: number; latest: number | null }, [number]>(
+    `SELECT COUNT(*) AS n, MAX(at) AS latest FROM gh_refusals WHERE at >= ?`,
+  );
+  const recordGhRefusalTx = db.transaction((at: number): void => {
+    insertGhRefusal.run(at);
+    pruneGhRefusals.run(at - 24 * 60 * 60 * 1000);
+  });
+
+  // The daemon's tracked github call counts (#198): one UPSERT per spawn.
+  const bumpGhCall = db.query<unknown, [string, string]>(
+    `INSERT INTO gh_calls (day, source, calls) VALUES (?, ?, 1)
+     ON CONFLICT(day, source) DO UPDATE SET calls = calls + 1`,
+  );
+  const selectGhCalls = db.query<{ source: string; calls: number }, [string]>(
+    `SELECT source, calls FROM gh_calls WHERE day = ? ORDER BY source`,
+  );
+
   // The report outbox (#123). Every terminal transition names the attempt it is
   // settling, because a request can come back *after* the stale-`sending` sweep
   // has already reclaimed its row — and a late answer must not overwrite a
@@ -1071,6 +1191,72 @@ export function openStore(dbPath: string): Store {
     },
   );
 
+  // The label projection outbox (#201). A decided label change is a row until
+  // the tracker has applied it; the projector drains in id order, and one
+  // issue's ops are atomic as a run — a failed op parks the rest of its issue
+  // for the next pass rather than letting a later op land out of order.
+  const insertLabelOp = db.query<unknown, SqlValue[]>(
+    `INSERT INTO label_ops (project, issue, op, label, createdAt) VALUES (?, ?, ?, ?, ?)`,
+  );
+  const selectPendingLabelOps = db.query<LabelOpRow, [string, number]>(
+    `SELECT o.* FROM label_ops AS o
+      WHERE o.project = ? AND o.nextAttemptAt <= ?
+        AND NOT EXISTS (
+          SELECT 1 FROM label_ops AS e
+          WHERE e.project = o.project AND e.issue = o.issue AND e.id < o.id
+        )
+      ORDER BY o.id`,
+  );
+  const selectPendingLabelOpsFor = db.query<LabelOpRow, [string, number]>(
+    `SELECT * FROM label_ops WHERE project = ? AND issue = ? ORDER BY id`,
+  );
+  const selectOldestPendingLabelOp = db.query<LabelOpRow, [string]>(
+    `SELECT * FROM label_ops WHERE project = ? ORDER BY createdAt ASC, id ASC LIMIT 1`,
+  );
+  const countLabelOps = db.query<{ n: number }, [string]>(
+    `SELECT COUNT(*) AS n FROM label_ops WHERE project = ?`,
+  );
+  const deleteLabelOp = db.query<unknown, [number]>(`DELETE FROM label_ops WHERE id = ?`);
+  const bumpLabelOpAttempt = db.query<unknown, [string, number, number]>(
+    `UPDATE label_ops SET attempts = attempts + 1, lastError = ?, nextAttemptAt = ? WHERE id = ?`,
+  );
+  // Rate-limit refusals defer WITHOUT counting an attempt: a shared outage is
+  // not the op's fault, so it must not burn the backoff escalation (#208).
+  const parkLabelOp = db.query<unknown, [string, number, number]>(
+    `UPDATE label_ops SET lastError = ?, nextAttemptAt = ? WHERE id = ?`,
+  );
+  // Coalesce: if the LATEST pending op for the same project+issue+label is
+  // already the same operation, adding another is a duplicate that would sit
+  // parked behind the oldest pending one, growing unboundedly (a reconcile
+  // re-offering a removal the tracker keeps refusing). Only the latest matters:
+  // a `remove → add → remove` sequence must keep the final remove even though
+  // the first remove is still owed, because the add in between is a real
+  // transition the final remove answers. Opposite transitions are never
+  // coalesced. The check and insert share the transaction so they cannot race
+  // (#201).
+  const selectLatestLabelOp = db.query<{ op: "add" | "remove" }, [string, number, string]>(
+    `SELECT op FROM label_ops
+      WHERE project = ? AND issue = ? AND label = ?
+      ORDER BY id DESC LIMIT 1`,
+  );
+  const enqueueLabelOpsTx = db.transaction(
+    (
+      rows: readonly {
+        project: string;
+        issue: number;
+        op: "add" | "remove";
+        label: string;
+        createdAt: number;
+      }[],
+    ): void => {
+      for (const row of rows) {
+        const latest = selectLatestLabelOp.get(row.project, row.issue, row.label);
+        if (latest !== undefined && latest !== null && latest.op === row.op) continue;
+        insertLabelOp.run(toSql(row.project), row.issue, row.op, row.label, row.createdAt);
+      }
+    },
+  );
+
   const recordFriction = (project: string, observation: FrictionObservation): void => {
     if (
       !Number.isSafeInteger(observation.occurrences) ||
@@ -1108,6 +1294,12 @@ export function openStore(dbPath: string): Store {
     );
   };
 
+  const recordGhRefusal = (at: number): void => {
+    // Same guard as `recordFriction`: a bad clock must not corrupt the store.
+    if (!Number.isSafeInteger(at) || at < 0) return;
+    recordGhRefusalTx(at);
+  };
+
   return {
     createRun(r: Omit<RunRecord, "id">): RunRecord {
       const record: RunRecord = { ...r, id: crypto.randomUUID() };
@@ -1133,6 +1325,7 @@ export function openStore(dbPath: string): Store {
         toSql(record.endedAt),
         toSql(record.lastError),
         toSql(record.settlementFlags),
+        toSql(record.report),
       );
       return record;
     },
@@ -1200,6 +1393,10 @@ export function openStore(dbPath: string): Store {
       return row ? toRecord(row) : undefined;
     },
 
+    attemptReports(project: string, issue: number): { attempt: number; report: string }[] {
+      return selectAttemptReports.all(project, issue);
+    },
+
 
     runsStartedSince(project: string, sinceEpochMs: number): number {
       return countStartedSince.get(project, sinceEpochMs)?.n ?? 0;
@@ -1250,6 +1447,24 @@ export function openStore(dbPath: string): Store {
 
     recordFriction,
 
+    recordGhRefusal,
+
+    ghRefusalsSince(sinceMs: number): { count: number; latestAt?: number } {
+      const row = selectGhRefusalsSince.get(sinceMs);
+      if (row === null || row === undefined || row.n === 0 || row.latest === null) {
+        return { count: 0 };
+      }
+      return { count: row.n, latestAt: row.latest };
+    },
+
+    bumpGhCalls(day: string, source: string): void {
+      bumpGhCall.run(day, source);
+    },
+
+    ghCallsToday(day: string): { source: string; calls: number }[] {
+      return selectGhCalls.all(day);
+    },
+
     pendingFriction(
       project: string,
       sinceEpochMs: number,
@@ -1532,6 +1747,43 @@ export function openStore(dbPath: string): Store {
       return row === null ? undefined : { ...row };
     },
 
+    enqueueLabelOps(
+      project: string,
+      ops: readonly { issue: number; op: "add" | "remove"; label: string }[],
+    ): void {
+      if (ops.length === 0) return;
+      const now = Date.now();
+      enqueueLabelOpsTx(
+        ops.map((op) => ({ ...op, project, createdAt: now })),
+      );
+    },
+
+    pendingLabelOps(project: string, now: number): LabelOp[] {
+      return selectPendingLabelOps.all(project, now).map(toLabelOp);
+    },
+
+    pendingLabelOpsFor(project: string, issue: number): LabelOp[] {
+      return selectPendingLabelOpsFor.all(project, issue).map(toLabelOp);
+    },
+
+    settleLabelOp(id: number): void {
+      deleteLabelOp.run(id);
+    },
+
+    deferLabelOp(id: number, error: string, nextAttemptAt: number, countAttempt = true): void {
+      if (countAttempt) bumpLabelOpAttempt.run(error, nextAttemptAt, id);
+      else parkLabelOp.run(error, nextAttemptAt, id);
+    },
+
+    countPendingLabelOps(project: string): number {
+      return countLabelOps.get(project)?.n ?? 0;
+    },
+
+    oldestPendingLabelOpAt(project: string): number | undefined {
+      const row = selectOldestPendingLabelOp.get(project);
+      return row === null ? undefined : row.createdAt;
+    },
+
     close(): void {
       db.close(false);
     },