diff --git a/docs/concepts/ooda-stuck-label-self-heal.md b/docs/concepts/ooda-stuck-label-self-heal.md
new file mode 100644
index 000000000..3a416e2cb
--- /dev/null
+++ b/docs/concepts/ooda-stuck-label-self-heal.md
@@ -0,0 +1,192 @@
+---
+title: The `ooda-stuck` escalation self-heals the missing label instead of failing silently
+description: Why a blocked OODA goal can always be escalated to the operator through the GitHub-issue channel — even when the `ooda-stuck` label does not exist in the target repo. The three breaker/safeguard filers now idempotently ensure the label (create-if-missing) before filing, and gracefully degrade to filing the issue WITHOUT the label (with a structured WARN) when the label cannot be created, so `gh issue create` never exits non-zero on an unknown label and the escalation always succeeds. Preserves one-issue-per-stall idempotency; additive and non-breaking (issue #4474).
+last_updated: 2026-07-22
+review_schedule: as-needed
+owner: simard
+doc_type: concept
+status: implemented
+related:
+  - ../reference/ooda-stuck-label-self-heal-api.md
+  - ../reference/no-progress-breaker-api.md
+  - ../reference/no-progress-root-cause-resolution-api.md
+  - ./no-progress-root-cause-resolution.md
+  - ./blocked-goal-escalation-backoff.md
+  - ./steerable-ooda-daemon.md
+  - ../howto/diagnose-a-no-progress-block.md
+  - ../reference/goal-labels.md
+  - ../../src/stewardship/gh_client.rs
+  - ../../src/ooda_loop/no_progress.rs
+  - ../../src/ooda_actions/advance_goal/spawn.rs
+---
+
+# The `ooda-stuck` escalation self-heals the missing label
+
+> **Status: implemented (issue #4474).** The three sites that file an
+> `ooda-stuck` tracking issue — the no-progress breaker production filer, the
+> brain-failure deterministic safeguard, and the engineer-lifecycle
+> open-tracking-issue path — now route their label handling through a single
+> shared helper,
+> [`ensure_label`](https://github.com/rysweet/Simard/blob/main/src/stewardship/gh_client.rs),
+> in `src/stewardship/gh_client.rs`. The helper idempotently creates the label
+> if it is missing and, when it cannot, tells the caller to file the issue
+> **without** the label rather than let `gh` fail. Primary sources:
+> [`src/stewardship/gh_client.rs`](https://github.com/rysweet/Simard/blob/main/src/stewardship/gh_client.rs)
+> (`ensure_label`, `LabelDisposition`, `LabelEnsureExecutor`),
+> [`src/ooda_loop/no_progress.rs`](https://github.com/rysweet/Simard/blob/main/src/ooda_loop/no_progress.rs)
+> (`GhIssueFiler`), and
+> [`src/ooda_actions/advance_goal/spawn.rs`](https://github.com/rysweet/Simard/blob/main/src/ooda_actions/advance_goal/spawn.rs)
+> (the deterministic safeguard and open-tracking-issue sites). API details:
+> [`ooda-stuck` label self-heal reference](../reference/ooda-stuck-label-self-heal-api.md).
+
+## The defect this fixes
+
+When the OODA no-progress breaker fires for a goal it cannot un-stick, its last
+resort is to escalate to a human by filing a GitHub tracking issue. Every filer
+tagged that issue with the `ooda-stuck` label:
+
+```bash
+gh issue create --title "…" --body "…" --label ooda-stuck
+```
+
+But the `ooda-stuck` label **did not exist** in `rysweet/Simard`. `gh issue
+create` treats an unknown `--label` as a hard error and exits non-zero:
+
+```
+could not add label: ooda-stuck not found
+```
+
+Because the filer only ever checked the exit status, a non-zero exit meant the
+issue was **never created** — the escalation silently failed. The breaker had
+already marked the goal `Blocked` with its sentinel, but no issue reached the
+operator, and the goal stayed parked with no visible escalation artifact.
+
+The journal signature (`simard::ooda`, `ERROR`) recorded the fingerprint:
+
+```
+no-progress breaker: gh issue create failed (goal still Blocked)
+  stderr=could not add label: ooda-stuck not found
+```
+
+This recurred every ~45 minutes as the breaker re-fired across OODA cycles
+2430 / 2433 / 2436 / 2439 (five occurrences, 15:47 → 21:10). The blocked-goal
+escalation channel through GitHub issues was, in practice, dead.
+
+Three call sites shared the defect, each with its own subtlety:
+
+| Site | File | Prior behaviour |
+| --- | --- | --- |
+| No-progress breaker production filer | `src/ooda_loop/no_progress.rs` (`GhIssueFiler::file_issue`, ~line 116) | `--label ooda-stuck` → non-zero exit → `ERROR` log, returned `None`, goal stayed `Blocked` with no linked issue. |
+| Brain-failure deterministic safeguard | `src/ooda_actions/advance_goal/spawn.rs` (~lines 378–379) | `--label ooda-stuck` → non-zero exit → `ERROR` log; the safeguard-`Blocked` mark survived but no issue was filed. |
+| Engineer-lifecycle open-tracking-issue | `src/ooda_actions/advance_goal/spawn.rs` (~lines 935–936) | `--label ooda-stuck` **and** used `.status()`, which drops captured streams — a non-zero exit produced **no** log at all (a second, latent silent-failure bug). |
+
+## The fix: ensure-or-degrade, never fail on a missing label
+
+The fix is a single, shared label-handling seam that both **self-heals** the
+missing label and **fail-safe degrades** when it cannot — so the escalation
+issue is filed either way.
+
+### 1. Ensure the label idempotently (create-if-missing)
+
+Before filing, each site calls `ensure_label("ooda-stuck")`. The helper runs:
+
+```bash
+gh label create ooda-stuck
+```
+
+> **Design decision — repo scoping (ambient, not `-R`).** `ensure_label` uses
+> the same ambient repository context (current working directory) as the
+> sibling `gh issue create` call at each site — it deliberately does **not**
+> pass `-R <repo>`. This is both simpler and *more correct*: the original
+> failure signature was `could not add label: ooda-stuck not found`, which
+> proves `gh issue create` had already resolved the repo from the ambient cwd
+> and failed *only* on the label. Creating the label in that same ambient repo
+> guarantees the label and the issue always target the identical repository. An
+> earlier draft of the design passed an explicit `-R <repo>` slug to
+> `gh label create`; that was rejected because (a) none of the three call sites
+> has a validated `owner/repo` slug in scope — the deterministic safeguard runs
+> *before* `goal_repo_slug` is resolved, and neither `apply_lifecycle_decision`
+> nor `GhIssueFiler` receives a repo — and (b) resolving a slug independently
+> risks creating the label in a *different* repo than `gh issue create` targets.
+> Keeping both commands ambient sidesteps both problems and keeps the change
+> additive (no repo threading, no trait/struct signature change).
+
+- **Exit 0** → the label now exists → attach it.
+- **"already exists"** (case-insensitive stderr match) → the label was already
+  there → attach it. This is what makes the call idempotent: a label created on
+  the first stall is simply re-observed on the next, never re-created, never an
+  error.
+
+This is the create-if-missing self-heal: the first time any goal stalls in a
+repo without the label, Simard creates the label once and every subsequent
+escalation reuses it.
+
+### 2. Degrade gracefully when the label can't be created
+
+A token that can *file issues* may not have permission to *create labels*
+(label creation needs repo-write). If `gh label create` fails for any
+reason other than "already exists" — an authorization error, a spawn failure —
+the helper does **not** propagate an error and does **not** abort the
+escalation. It returns a `LabelDisposition::Omit { reason }`, and the caller
+files the issue **without** the `--label` argument:
+
+```bash
+gh issue create --title "…" --body "…"   # no --label; escalation still succeeds
+```
+
+The degradation is always surfaced with a structured `tracing::warn` on the
+site's own target (`simard::ooda` or `simard::ooda_brain`), carrying the reason.
+This honours the **no-silent-fallback** rule: the issue is still filed, but the
+operator can see in the logs that the label was omitted and why.
+
+### 3. Stop swallowing exit codes at the open-tracking-issue site
+
+The engineer-lifecycle site (`spawn.rs` ~line 935) previously used `.status()`,
+which discards captured stdout/stderr and — combined with only logging the
+`Err(_)` spawn case — meant a non-zero `gh` exit produced no diagnostics at all.
+It now uses `.output()` and inspects the exit status, emitting a structured
+`warn` with the lossy-decoded, length-bounded (≤ 2 KiB) stderr on failure. This
+closes the latent second bug so that site can never silently fail again either.
+
+## What is preserved
+
+- **One issue per stall (idempotency).** The self-heal changes only *label*
+  handling. The dedup that guarantees a stalled goal is escalated exactly once —
+  the breaker-authored `[no-progress-tracking]` `WipRef` link and the
+  `already_tracked` check in the escalation path — is untouched. A re-stall
+  never spams duplicate `ooda-stuck` issues. See
+  [the no-progress breaker API](../reference/no-progress-breaker-api.md) and
+  [blocked-goal escalation backoff](./blocked-goal-escalation-backoff.md).
+- **Existing tracing targets and return contracts.** Each caller keeps its own
+  target (`simard::ooda` vs `simard::ooda_brain`) and return type
+  (`Option<FiledIssue>` vs unit). Only the label concern is centralised.
+- **The `eprintln!` operator line** at the deterministic-safeguard success path
+  (`spawn.rs` ~line 384) is unchanged; no new `print!`/`println!` is introduced.
+- **argv-only, no-shell invocation.** The label is a hardcoded constant (no
+  leading `-`) and no repo argument is added, so the new `gh label create`
+  subprocess call is as injection-safe as the existing ones — there is no
+  attacker-influenced argv value at all.
+
+## End-to-end effect
+
+A blocked goal is now **always** escalable through the GitHub-issue channel:
+
+1. Breaker fires, marks the goal `Blocked` with its sentinel.
+2. `ensure_label` creates `ooda-stuck` on the first stall (or observes it, or
+   degrades to no-label with a `WARN`).
+3. `gh issue create` succeeds — with the label when possible, without it when
+   not — and the operator receives the tracking issue.
+4. The filed issue is linked back to the goal as its
+   `[no-progress-tracking]` artifact, and the dedup guard prevents any duplicate
+   on a re-stall.
+
+The `could not add label: ooda-stuck not found` error class can no longer break
+escalation.
+
+## See also
+
+- [`ooda-stuck` label self-heal API reference](../reference/ooda-stuck-label-self-heal-api.md)
+- [No-progress breaker API reference](../reference/no-progress-breaker-api.md)
+- [Concept: the no-progress breaker explains WHY and self-resolves before escalating](./no-progress-root-cause-resolution.md)
+- [How to diagnose a no-progress block](../howto/diagnose-a-no-progress-block.md)
+- [Goal labels / tags API reference](../reference/goal-labels.md)
diff --git a/docs/howto/diagnose-a-no-progress-block.md b/docs/howto/diagnose-a-no-progress-block.md
index 27952547b..75b5a7af9 100644
--- a/docs/howto/diagnose-a-no-progress-block.md
+++ b/docs/howto/diagnose-a-no-progress-block.md
@@ -79,6 +79,15 @@ The matching escalation issue (label `ooda-stuck`) carries the same WHY plus the
 agentic narrative paragraph, if the [optional WHY
 recipe](../reference/ooda-no-progress-why-recipe.md) is enabled.
 
+> **The `ooda-stuck` label self-heals.** If the label is missing from the target
+> repo, the escalation no longer fails: the filers idempotently create it
+> (create-if-missing) or file the issue **without** the label (with a structured
+> `WARN`) rather than let `gh issue create` exit non-zero. So a stalled goal is
+> always escalable through the issue channel — an escalation issue **without** the
+> `ooda-stuck` label just means the label could not be created (check the `WARN`).
+> See [`ooda-stuck` label self-heal](../concepts/ooda-stuck-label-self-heal.md)
+> and its [API reference](../reference/ooda-stuck-label-self-heal-api.md).
+
 > If you see a block **without** a `why=` segment, it is either a legacy block
 > from before this upgrade or a block authored by a *different* path (operator
 > hold, scope, dependency, or the brain-failure safeguard). Those are out of
diff --git a/docs/index.md b/docs/index.md
index fbce969e7..35463aa44 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -57,6 +57,7 @@ Terminal sessions and repo-grounded engineer runs now bridge through one explici
 - [Concept: standing/perpetual goals are exempt from the no-progress hard-block](./concepts/perpetual-goal-no-progress-exemption.md) — why a bursty standing goal (the continuous self-research goal) must never be parked "needs human review" by the OODA no-progress safeguard; the runtime exemption plus the load-time self-heal that keep it continuous and self-sustaining without operator unblocking (#2589). See the [no-progress breaker API](./reference/no-progress-breaker-api.md) and the [unblock runbook](./howto/unblock-stuck-ooda-goals.md).
 - [Concept: the standing research goal never idles — an idle cycle is a fault](./concepts/research-goal-never-idle.md) — why Simard's standing cognition-research goal must produce a concrete NOVEL action **every** cycle (a new external source ingestion OR a new measurable experiment, dedup'd against recent directions) and why an idle cycle for THIS goal is a **fault** the daemon re-orients out of — not the benign perpetual-idle exemption other standing goals keep. Prompt-first (charter + never-idle directive), reinforced by a thin fail-closed breaker rail (`classify_standing_idle` → `research_idle_faults` → re-orient, never block) keyed on `is_standing_research_goal()` (#4399). See the [never-idle rail API](./reference/research-goal-never-idle-rail-api.md) and the [keep-the-research-goal-never-idle how-to](./howto/keep-the-research-goal-never-idle.md).
 - [Concept: the no-progress breaker explains WHY and self-resolves before escalating](./concepts/no-progress-root-cause-resolution.md) — why the safeguard no longer parks a goal with a bare "needs human review": it classifies the root cause of a stall (already-complete / obsolete / missing-precondition / upstream-dependency / unclear-criteria / genuinely-stuck), self-resolves the machine-fixable causes (auto-complete on live artifacts — the fix for the `kgpacks-rs` "already done" goals — clone a missing repo, defer behind an upstream, spawn one guided engineer), and escalates to a human only as a last resort with the concrete WHY + evidence attached. See the [root-cause resolution API](./reference/no-progress-root-cause-resolution-api.md), the [`ooda-no-progress-why` recipe](./reference/ooda-no-progress-why-recipe.md), and the [diagnose-a-no-progress-block runbook](./howto/diagnose-a-no-progress-block.md).
+- [Concept: the `ooda-stuck` escalation self-heals the missing label](./concepts/ooda-stuck-label-self-heal.md) — why a blocked OODA goal can always be escalated to the operator through the GitHub-issue channel even when the `ooda-stuck` label does not exist in the target repo: the three breaker/safeguard filers (no-progress production filer, brain-failure deterministic safeguard, engineer-lifecycle open-tracking-issue) now route their `--label ooda-stuck` handling through the shared `ensure_label` helper, which idempotently creates the label (create-if-missing) or degrades to filing the issue WITHOUT the label plus a structured `WARN` when it cannot — so `gh issue create` never exits non-zero on the unknown label and the escalation always succeeds, while one-issue-per-stall idempotency is preserved (#4474). See the [label self-heal API reference](./reference/ooda-stuck-label-self-heal-api.md) and the [diagnose-a-no-progress-block runbook](./howto/diagnose-a-no-progress-block.md).
 - [Concept: the terminal no-progress stall never parks a goal with empty evidence](./concepts/no-progress-terminal-investigation.md) — the issue #16 fix for the 12–13 of 20 live goals stamped `why=GENUINELY-STUCK evidence=[(none)]`: the terminal rung reuses the existing guided-engineer (independent recipe-runner) investigation rather than inventing a parallel path, escalates only WITH concrete evidence, and otherwise surfaces a fail-visible investigation gap (`SurfaceInvestigationFailure` → `investigation_errors`) instead of a bare block. Evidence-less `(none)` blocks are folded into the re-investigation population (`needs_reinvestigation`), and a per-signature overseer inflight guard (`inflight_investigations`) prevents duplicate concurrent investigations of the same `overseer-obs:goal:blocked:…` signature.
 - [Concept: brain-relative OODA cycle counter](./concepts/brain-relative-ooda-cycle-counter.md) — why "Cycle #N" must count the **brain's total lived cognition** (a durable, monotonic number that continues across every daemon restart and deploy) instead of the current process's uptime, which reset the dashboard to "Cycle #1" on every deploy and erased the visible sense of accumulated thought — persisted in the same durable `goal_board.json` store as the goal board and the no-progress tracker. See the [durable cycle counter API](./reference/durable-ooda-cycle-counter.md) and the [inspect-and-verify how-to](./howto/inspect-the-ooda-cycle-counter.md).
 - [Concept: Overseer goal-board health](./concepts/overseer-goal-board-health.md) — the steward-side defense-in-depth complement to #2609: the acting Overseer now observes `Blocked` goals on the board, **self-heals** a false-parked perpetual goal (auto-unblock + reactivate, the exact `simard goal unblock`), and **escalates** any "needs human review" block to the operator on both channels — closing the silent-failure gap where a parked standing goal reached no human (#2616). See the [goal-board health API](./reference/overseer-goal-board-health-api.md) and the [configure-and-observe how-to](./howto/configure-overseer-goal-board-health.md).
@@ -218,6 +219,7 @@ If you are changing architecture, start with the [architecture overview](./archi
 - [Research-goal never-idle rail API reference](./reference/research-goal-never-idle-rail-api.md) — the #4399 never-idle rail on top of the breaker: the shared `classify_standing_idle` classifier consumed by both breaker sites, the `StandingIdle` split (benign-exempt vs research-fault), the fixed `ResearchIdleFault` vocabulary, the additive `NoProgressBreakerReport.research_idle_faults` field (excluded from `fired()`), the `roll_to_new_cycle` re-orient, and the revised never-idle directive contract (NEW source OR NEW experiment, dedup'd, local-experiment floor — no idle fallback). See the [concept](./concepts/research-goal-never-idle.md) and the [keep-the-research-goal-never-idle how-to](./howto/keep-the-research-goal-never-idle.md).
 - [wip-ref liveness reconcile API reference](./reference/wip-ref-liveness-reconcile-api.md) — the #4428 two-prong per-cycle reconcile (dead-session sweep + merged/closed-PR prune) that makes `has_live_in_flight_ref()` reflect true liveness before the never-idle breaker classifies, plus the [round-3 hardening reference](./reference/wip-ref-liveness-reconcile-hardening-api.md) that makes both prongs total: dead-ref prune for **every** goal regardless of assignment (FIX-1) and a merged-PR reconcile scoped to **each goal's own repo** instead of a hardcoded `rysweet/Simard` (FIX-2).
 - [No-progress root-cause resolution API reference](./reference/no-progress-root-cause-resolution-api.md) — the root-cause layer on the breaker: the `NoProgressClass` classification and its stable tokens, the `NoProgressWhy`/`Evidence` types, the optional `NoProgressWhyReasoner` agentic-enrichment trait, the extended `NoProgressResolution` ladder (auto-complete / heal / defer / one-shot guided-retry / escalate-with-WHY), the WHY-bearing block-reason contract, the additive `EvidenceSource::repo_present` and `dependency_goal_state` methods, and the fail-closed error table. See the [concept](./concepts/no-progress-root-cause-resolution.md) and the [diagnose runbook](./howto/diagnose-a-no-progress-block.md).
+- [`ooda-stuck` label self-heal API reference](./reference/ooda-stuck-label-self-heal-api.md) — the shared label helper the escalation filers use so a missing `ooda-stuck` label can never break `gh issue create`: the `ensure_label` free function, the `LabelDisposition` (`Attach` / `Omit { reason }`) contract, the `LabelEnsureExecutor` fn-pointer test seam (mirroring `CreateIssueExecutor`), the create-if-missing / already-exists idempotency, the fail-safe degrade-to-no-label path, and how the three call sites (`no_progress.rs` `GhIssueFiler`, the `spawn.rs` deterministic safeguard, and the `spawn.rs` open-tracking-issue site — which also switches `.status()` → `.output()` to stop swallowing exit codes) gate their `--label ooda-stuck` argument on the disposition (#4474). See the [concept](./concepts/ooda-stuck-label-self-heal.md).
 - [The `ooda-no-progress-why` recipe reference](./reference/ooda-no-progress-why-recipe.md) — the optional agentic-enrichment recipe that turns the deterministic classification + evidence into a human-readable WHY narrative for the escalation: context variables, the single-string narrative output contract, the "enrichment never changes routing" invariant, hot-reload resolution order, and the NO-FALLBACK fail-closed contract.
 - [Durable OODA cycle counter API reference](./reference/durable-ooda-cycle-counter.md) — the brain-relative, monotonic cycle counter: the persisted `PersistentGoalState.cycle_count` field, the `commit_cycle` `max()` guard, the daemon startup seed, the one-time cycle-report backfill, the repointed `daemon_health.json` writes, and the single source of truth that keeps every `cycle=` log, cycle report, and dashboard "Cycle #N" counting the brain's total lived cognition instead of resetting to 1 on each restart. See the [concept](./concepts/brain-relative-ooda-cycle-counter.md) and the [inspect-and-verify how-to](./howto/inspect-the-ooda-cycle-counter.md).
 - [Goal decomposition & the goal graph](./reference/goal-decomposition.md) — break a large goal into 2–6 bounded sub-goals and record parent↔child structure as typed, queryable edges in the cognitive-memory graph, with parent-progress roll-up and the `simard goal decompose` verb (#2405).
diff --git a/docs/reference/no-progress-breaker-api.md b/docs/reference/no-progress-breaker-api.md
index 3cacf870e..883bb7dd2 100644
--- a/docs/reference/no-progress-breaker-api.md
+++ b/docs/reference/no-progress-breaker-api.md
@@ -9,6 +9,8 @@ status: implemented
 related:
   - ../concepts/perpetual-goal-no-progress-exemption.md
   - ../concepts/no-progress-root-cause-resolution.md
+  - ../concepts/ooda-stuck-label-self-heal.md
+  - ../reference/ooda-stuck-label-self-heal-api.md
   - ../concepts/steerable-ooda-daemon.md
   - ../reference/no-progress-root-cause-resolution-api.md
   - ../reference/ooda-no-progress-why-recipe.md
diff --git a/docs/reference/ooda-stuck-label-self-heal-api.md b/docs/reference/ooda-stuck-label-self-heal-api.md
new file mode 100644
index 000000000..bbf2e6d5b
--- /dev/null
+++ b/docs/reference/ooda-stuck-label-self-heal-api.md
@@ -0,0 +1,239 @@
+---
+title: "`ooda-stuck` label self-heal API reference"
+description: Reference for the shared label self-heal used by the OODA no-progress breaker and brain-failure safeguard filers — the `ensure_label` free function, the `LabelDisposition` (Attach / Omit) contract, the `LabelEnsureExecutor` fn-pointer test seam, and how the three `gh issue create` call sites gate their `--label ooda-stuck` argument on the disposition so a missing label self-heals (create-if-missing) or degrades (file without label + WARN) instead of failing the escalation (issue #4474).
+last_updated: 2026-07-22
+review_schedule: as-needed
+owner: simard
+doc_type: reference
+status: implemented
+related:
+  - ../concepts/ooda-stuck-label-self-heal.md
+  - ./no-progress-breaker-api.md
+  - ./no-progress-root-cause-resolution-api.md
+  - ./goal-labels.md
+  - ./stewardship-api.md
+  - ../howto/diagnose-a-no-progress-block.md
+  - ../../src/stewardship/gh_client.rs
+  - ../../src/ooda_loop/no_progress.rs
+  - ../../src/ooda_actions/advance_goal/spawn.rs
+---
+
+# `ooda-stuck` label self-heal API reference
+
+> **Status: implemented (issue #4474).** The label self-heal helper lives in
+> [`src/stewardship/gh_client.rs`](https://github.com/rysweet/Simard/blob/main/src/stewardship/gh_client.rs).
+> The three consuming filers are the no-progress breaker's `GhIssueFiler` in
+> [`src/ooda_loop/no_progress.rs`](https://github.com/rysweet/Simard/blob/main/src/ooda_loop/no_progress.rs)
+> and the deterministic-safeguard + open-tracking-issue sites in
+> [`src/ooda_actions/advance_goal/spawn.rs`](https://github.com/rysweet/Simard/blob/main/src/ooda_actions/advance_goal/spawn.rs).
+> Narrative: [The `ooda-stuck` escalation self-heals the missing label](../concepts/ooda-stuck-label-self-heal.md).
+
+The escalation filers used to pass `--label ooda-stuck` unconditionally. If the
+label did not exist in the target repo, `gh issue create` exited non-zero
+(`could not add label: ooda-stuck not found`) and the issue was never filed —
+the escalation failed silently. This reference documents the additive helper
+that makes the label handling **ensure-or-degrade**, so the issue is always
+filed.
+
+## Overview
+
+```
+ensure_label(label) ──► LabelDisposition
+                         ├─ Attach            (label exists / was created)
+                         └─ Omit { reason }   (label un-ensurable — file without it)
+```
+
+Each caller invokes `ensure_label` before building its `gh issue create` argv,
+then conditionally appends `--label <label>` only when the disposition is
+`Attach`. On `Omit`, the caller files the issue without the label and emits a
+structured `tracing::warn` carrying the reason.
+
+## `LabelDisposition`
+
+```rust
+/// Outcome of ensuring a repo label exists before it is attached to an issue.
+///
+/// `ensure_label` never returns `Err`: escalation must always be able to file
+/// the issue, so an un-ensurable label degrades to `Omit` (file without the
+/// label) rather than aborting the caller.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum LabelDisposition {
+    /// The label exists (it was already present, or `ensure_label` created it).
+    /// Safe to pass `--label <label>` to `gh issue create`.
+    Attach,
+    /// The label could not be ensured (e.g. the token lacks label-create
+    /// permission, or `gh` could not be spawned). File the issue WITHOUT the
+    /// label and surface `reason` in a structured `warn`.
+    Omit { reason: String },
+}
+```
+
+`LabelDisposition` deliberately has no `Err` variant: the escalation is the
+important side effect, and losing a cosmetic label must never cost the issue.
+
+## `ensure_label`
+
+```rust
+/// Idempotently ensure `label` exists in the ambient repository, returning
+/// whether it is safe to attach to an issue.
+///
+/// Runs `gh label create <label>` in the current working directory — the same
+/// ambient repo context the sibling `gh issue create` call uses (no `-R`), so
+/// the label is guaranteed to be created in the repo the issue is filed to:
+/// * exit 0                          -> `Attach` (label created)
+/// * stderr matches "already exists" -> `Attach` (label was already present)
+/// * any other non-zero exit / spawn/wait failure -> `Omit { reason }`
+///
+/// Never returns `Err`; a failure to create the label degrades to `Omit` so the
+/// caller can still file the escalation issue without the label.
+pub(crate) fn ensure_label(label: &str) -> LabelDisposition;
+```
+
+> **Why no `repo` / `-R` argument.** The three consuming `gh issue create`
+> calls all rely on ambient (cwd) repo detection and pass no `-R`. The original
+> defect signature (`could not add label: ooda-stuck not found`) confirms the
+> repo *was* resolved and only the label attach failed — so `ensure_label`
+> mirrors that ambient context to keep the label and the issue in the same
+> repo. Passing an explicit slug was rejected: none of the three call sites has
+> a validated `owner/repo` in scope (the safeguard runs before
+> `goal_repo_slug` is resolved; `apply_lifecycle_decision` and `GhIssueFiler`
+> receive no repo), and an independently-resolved slug could diverge from the
+> repo `gh issue create` targets. This also keeps the change additive — no
+> repo threading and no `NoProgressIssueFiler` signature change.
+
+Idempotency comes from the "already exists" branch: the first stall in a repo
+creates the label; every later stall re-observes it and returns `Attach`
+without re-creating it. The stderr match is a **case-insensitive substring**
+test so it tolerates wording differences across `gh` versions.
+
+### Invocation and safety
+
+- Invoked via argv only — `gh`, `label`, `create`, `<label>` — with no shell
+  and no `format!`-constructed command line, structurally preventing command
+  injection.
+- `label` is the hardcoded constant `"ooda-stuck"` (no leading `-`), and **no
+  repo argument is passed**, so there is no attacker-influenceable argv value
+  and nothing that can be misread as an option flag.
+- Reuses ambient `gh` credentials. No tokens or secrets are introduced or
+  logged.
+- On an authorization failure there is **no** re-auth, privilege escalation, or
+  retry storm — it degrades once to `Omit`.
+
+## `LabelEnsureExecutor` — the test seam
+
+Mirroring the existing `CreateIssueExecutor` fn-pointer pattern in the same
+module, label creation is injected through a function pointer so unit tests can
+drive every outcome without spawning `gh`.
+
+```rust
+/// Injected subprocess runner for `gh label create`, so tests can simulate
+/// create / already-exists / unauthorized / spawn-failure without real `gh`.
+type LabelEnsureExecutor =
+    fn(&OsStr, &[&OsStr]) -> Result<Output, LabelEnsureExecutionError>;
+
+/// Internal failure of the label-create subprocess. Folded into
+/// `LabelDisposition::Omit { reason }` — never silently dropped.
+#[derive(Debug)]
+enum LabelEnsureExecutionError {
+    Spawn(io::Error),
+    Wait(io::Error),
+}
+
+/// Core logic behind `ensure_label`, parameterised on the executor for testing.
+fn ensure_label_with(
+    executable: &OsStr,
+    executor: LabelEnsureExecutor,
+    label: &str,
+) -> LabelDisposition;
+```
+
+`ensure_label` is the production wrapper that binds the real
+`gh label create` subprocess executor and calls `ensure_label_with`. (An
+`ensure_label_reason(...)` helper folds `LabelEnsureExecutionError` into the
+`Omit { reason }` string, mirroring the module's existing
+`create_issue_execution_reason`.)
+
+## The three consuming call sites
+
+All three route label handling through `ensure_label` and build their argv as a
+`Vec<&str>`, conditionally pushing `--label` / the label constant only on
+`Attach`.
+
+### 1. No-progress breaker production filer — `src/ooda_loop/no_progress.rs`
+
+`GhIssueFiler::file_issue` (the production
+[`NoProgressIssueFiler`](./no-progress-breaker-api.md)) gates on `ensure_label`
+before filing. On `Attach` it files with `--label ooda-stuck`; on `Omit` it
+files without the label and emits `tracing::warn` on target `simard::ooda`. Its
+return contract (`Option<FiledIssue>`), issue-number parsing, and
+"goal stays `Blocked` on failure" behaviour are unchanged. The filed issue is
+still linked back to the goal as its `[no-progress-tracking]` artifact.
+
+### 2. Brain-failure deterministic safeguard — `src/ooda_actions/advance_goal/spawn.rs` (~line 378)
+
+Same `ensure_label` gate and conditional label. This site already used
+`.output()`. The success-path operator `eprintln!` (~line 384) is preserved
+verbatim; the `Omit` degradation logs on target `simard::ooda_brain`.
+
+### 3. Engineer-lifecycle open-tracking-issue — `src/ooda_actions/advance_goal/spawn.rs` (~line 935)
+
+Same `ensure_label` gate and conditional label, **plus** the call is changed
+from `.status()` to `.output()`. The old `.status()` discarded captured streams
+and only logged the spawn-`Err` case, so a non-zero `gh` exit produced no
+diagnostics — a latent silent failure. Now the exit status is inspected and a
+structured `tracing::warn` (target `simard::ooda_brain`) carries the
+lossy-decoded stderr, **truncated to ≤ 2 KiB** to prevent log flooding.
+
+## Behaviour matrix
+
+| `gh label create` outcome | `ensure_label` returns | Filer argv | Log |
+| --- | --- | --- | --- |
+| Exit 0 (created) | `Attach` | `… --label ooda-stuck` | (issue-filed line, unchanged) |
+| Non-zero, stderr contains "already exists" | `Attach` | `… --label ooda-stuck` | (issue-filed line, unchanged) |
+| Non-zero, unauthorized / other | `Omit { reason }` | `…` (no `--label`) | `warn` with reason (per-site target) |
+| Spawn/wait failure | `Omit { reason }` | `…` (no `--label`) | `warn` with reason (per-site target) |
+
+In every row the escalation issue is filed. The only difference is whether it
+carries the `ooda-stuck` label.
+
+## What is unchanged (compatibility)
+
+- **Escalation idempotency.** No change to the breaker's one-issue-per-stall
+  dedup (`escalate_with_tracking_issue` / `already_tracked` and the
+  `[no-progress-tracking]` `WipRef` link). `ensure_label` runs *before* the
+  dedup decision and does not affect it. See the
+  [no-progress breaker API](./no-progress-breaker-api.md).
+- **`FiledIssue` / `NoProgressIssueFiler` trait.** Unchanged.
+- **Per-site tracing targets and return types.** Unchanged — only the label
+  concern is shared.
+- **No new dependencies or binaries.** Only the already-required `gh` CLI is
+  used.
+- **Additive and non-breaking.** No public API signatures change; the helper and
+  enum are crate-internal (`pub(crate)`).
+
+## Testing
+
+`ensure_label` is unit-tested by injecting `LabelEnsureExecutor` fn pointers to
+simulate each path:
+
+| Test | Injected outcome | Expected disposition |
+| --- | --- | --- |
+| Create-if-missing | exit 0 | `Attach` |
+| Already-exists | non-zero, stderr `"label already exists"` | `Attach` |
+| Unauthorized | non-zero, permission stderr | `Omit` |
+| Spawn failure | `Err(io::Error)` | `Omit` |
+
+The consuming filers extend their existing `RecordingFiler` / spawn tests to
+cover the `Attach` (label attached) path, the `Omit` (label omitted, `warn`
+emitted) degrade path, that dedup is unaffected, and — for the
+open-tracking-issue site — that a non-zero exit is now captured and logged.
+
+A grep-verifiable invariant holds: no new `print!`/`println!` is introduced by
+the change; all new observability is structured `tracing` on existing targets.
+
+## See also
+
+- [Concept: the `ooda-stuck` escalation self-heals the missing label](../concepts/ooda-stuck-label-self-heal.md)
+- [No-progress breaker API reference](./no-progress-breaker-api.md)
+- [Goal labels / tags API reference](./goal-labels.md)
+- [How to diagnose a no-progress block](../howto/diagnose-a-no-progress-block.md)
diff --git a/src/ooda_actions/advance_goal/spawn.rs b/src/ooda_actions/advance_goal/spawn.rs
index 300cdd7df..548f5007e 100644
--- a/src/ooda_actions/advance_goal/spawn.rs
+++ b/src/ooda_actions/advance_goal/spawn.rs
@@ -1,6 +1,7 @@
 //! AdvanceGoal dispatch — routing, subordinate heartbeat, and session-based advancement.
 
 use std::path::Path;
+use std::process::Output;
 use std::sync::Mutex;
 use std::time::{SystemTime, UNIX_EPOCH};
 
@@ -14,12 +15,44 @@ use crate::ooda_brain::{
     gather_engineer_lifecycle_ctx, push_brain_judgment,
 };
 use crate::ooda_loop::{ActionOutcome, OodaState, PlannedAction};
+use crate::stewardship::gh_client::{LabelDisposition, OODA_STUCK_LABEL, ensure_label};
 
 use crate::ooda_actions::make_outcome;
 
 use super::admission;
 use super::resource_admission;
 
+/// Build the engineer-lifecycle tracking-issue `gh issue create` argv, attaching
+/// `--label ooda-stuck` only when the label was ensured
+/// ([`LabelDisposition::Attach`]). A degraded [`LabelDisposition::Omit`] drops
+/// it so the issue is still filed (issue #4474).
+fn ooda_stuck_issue_argv<'a>(
+    title: &'a str,
+    body: &'a str,
+    label: &LabelDisposition,
+) -> Vec<&'a str> {
+    let mut argv = vec!["issue", "create", "--title", title, "--body", body];
+    argv.extend(label.label_args(OODA_STUCK_LABEL));
+    argv
+}
+
+/// Inspect a completed `gh issue create` [`Output`], returning `Some(note)` with
+/// a bounded, lossy-decoded stderr when the process exited non-zero, or `None`
+/// on success. Replaces the prior `.status()` call at the `open_tracking_issue`
+/// site that silently swallowed a non-zero exit — e.g. the `ooda-stuck`
+/// label-not-found failure of issue #4474.
+fn tracking_issue_failure_note(output: &Output) -> Option<String> {
+    if output.status.success() {
+        return None;
+    }
+    let stderr = String::from_utf8_lossy(&output.stderr);
+    Some(format!(
+        "`gh issue create` exited {}: {}",
+        output.status,
+        truncate_for_log(stderr.trim())
+    ))
+}
+
 // ── Issue #1911: brain-failure auto-recovery marker ────────────────────────
 //
 // The deterministic safeguard in `dispatch_spawn_engineer` writes a
@@ -366,20 +399,21 @@ pub fn dispatch_spawn_engineer(
                         }
                     }
                     // File tracking issue. Failure to file is logged but
-                    // does NOT swallow the original brain failure.
-                    match std::process::Command::new("gh")
-                        .args([
-                            "issue",
-                            "create",
-                            "--title",
-                            &title,
-                            "--body",
-                            &body,
-                            "--label",
-                            "ooda-stuck",
-                        ])
-                        .output()
-                    {
+                    // does NOT swallow the original brain failure. Self-heal the
+                    // `ooda-stuck` label first; degrade to no label on failure
+                    // so the escalation still files (issue #4474).
+                    let disposition = ensure_label(OODA_STUCK_LABEL);
+                    if let LabelDisposition::Omit { reason } = &disposition {
+                        tracing::warn!(
+                            target: "simard::ooda_brain",
+                            goal = %goal_id,
+                            label = OODA_STUCK_LABEL,
+                            reason = %reason,
+                            "deterministic safeguard: label unensurable; filing tracking issue without it",
+                        );
+                    }
+                    let argv = ooda_stuck_issue_argv(&title, &body, &disposition);
+                    match std::process::Command::new("gh").args(&argv).output() {
                         Ok(out) if out.status.success() => {
                             eprintln!(
                                 "[simard] DETERMINISTIC SAFEGUARD: goal '{}' marked Blocked + tracking issue filed",
@@ -924,26 +958,41 @@ fn apply_lifecycle_decision(
     }
 
     if let EngineerLifecycleDecision::OpenTrackingIssue { title, body, .. } = &decision {
-        let result = std::process::Command::new("gh")
-            .args([
-                "issue",
-                "create",
-                "--title",
-                title,
-                "--body",
-                body,
-                "--label",
-                "ooda-stuck",
-            ])
-            .status();
-        if let Err(e) = result {
+        // Self-heal the `ooda-stuck` label before filing; degrade to no label
+        // on failure so the tracking issue is still opened (issue #4474).
+        let disposition = ensure_label(OODA_STUCK_LABEL);
+        if let LabelDisposition::Omit { reason } = &disposition {
             tracing::warn!(
                 target: "simard::ooda_brain",
                 goal = %goal_id,
-                error = %e,
-                "open_tracking_issue: gh issue create failed",
+                label = OODA_STUCK_LABEL,
+                reason = %reason,
+                "open_tracking_issue: label unensurable; filing tracking issue without it",
             );
         }
+        let argv = ooda_stuck_issue_argv(title, body, &disposition);
+        // `.output()` (not `.status()`) so a non-zero exit — e.g. the historic
+        // label-not-found failure — is captured and surfaced, never swallowed.
+        match std::process::Command::new("gh").args(&argv).output() {
+            Ok(out) => {
+                if let Some(note) = tracking_issue_failure_note(&out) {
+                    tracing::warn!(
+                        target: "simard::ooda_brain",
+                        goal = %goal_id,
+                        detail = %note,
+                        "open_tracking_issue: gh issue create failed",
+                    );
+                }
+            }
+            Err(e) => {
+                tracing::warn!(
+                    target: "simard::ooda_brain",
+                    goal = %goal_id,
+                    error = %e,
+                    "open_tracking_issue: gh issue create failed to spawn",
+                );
+            }
+        }
     }
 
     if let EngineerLifecycleDecision::ConsiderSelfUpdate { rationale } = &decision {
@@ -1368,4 +1417,94 @@ mod tests {
             "Simard (no identity) must never take the observe-only branch"
         );
     }
+
+    // ── ooda-stuck label self-heal + exit-capture (issue #4474) ────────────
+    //
+    // Both `gh issue create` sites in this module hardcoded `--label ooda-stuck`.
+    // When that label does not exist in the repo, `gh` exits non-zero. These
+    // tests pin two contract points of the fix:
+    //   1. The label is attached only when it was ensured; otherwise the issue
+    //      is still filed (degraded, no label) so the goal is escalated.
+    //   2. The `open_tracking_issue` site must inspect the process `Output`
+    //      (was `.status()`, which swallowed non-zero exits) and surface a
+    //      bounded failure note — never silently drop the failure.
+    mod ooda_stuck_label_self_heal {
+        use super::super::{ooda_stuck_issue_argv, tracking_issue_failure_note};
+        use crate::stewardship::gh_client::{LabelDisposition, OODA_STUCK_LABEL};
+        use std::os::unix::process::ExitStatusExt;
+        use std::process::{ExitStatus, Output};
+
+        #[test]
+        fn argv_carries_label_when_ensured() {
+            let argv = ooda_stuck_issue_argv("t", "b", &LabelDisposition::Attach);
+            assert!(
+                argv.windows(2).any(|w| w == ["--label", OODA_STUCK_LABEL]),
+                "an ensured label must be attached",
+            );
+        }
+
+        #[test]
+        fn argv_drops_label_when_degraded_but_still_files() {
+            let argv = ooda_stuck_issue_argv(
+                "t",
+                "b",
+                &LabelDisposition::Omit {
+                    reason: "no perms".into(),
+                },
+            );
+            assert!(!argv.contains(&"--label"));
+            assert_eq!(
+                &argv[..6],
+                &["issue", "create", "--title", "t", "--body", "b"],
+                "the issue must still be filed without the label",
+            );
+        }
+
+        #[test]
+        fn success_output_produces_no_failure_note() {
+            let out = Output {
+                status: ExitStatus::from_raw(0),
+                stdout: Vec::new(),
+                stderr: Vec::new(),
+            };
+            assert!(
+                tracking_issue_failure_note(&out).is_none(),
+                "a successful `gh issue create` must not emit a failure note",
+            );
+        }
+
+        #[test]
+        fn nonzero_exit_is_surfaced_not_swallowed() {
+            // Regression for the latent second bug: the site used `.status()` and
+            // only logged the spawn `Err`, silently swallowing a non-zero exit
+            // (e.g. the `ooda-stuck` label-not-found failure). `.output()` must
+            // capture stderr and surface it in the note.
+            let out = Output {
+                status: ExitStatus::from_raw(256),
+                stdout: Vec::new(),
+                stderr: b"could not add label: 'ooda-stuck' not found".to_vec(),
+            };
+            let note = tracking_issue_failure_note(&out)
+                .expect("a non-zero exit must produce a surfaced failure note");
+            assert!(
+                note.contains("ooda-stuck"),
+                "the note must include the gh stderr, got {note:?}",
+            );
+        }
+
+        #[test]
+        fn failure_note_is_bounded_for_huge_stderr() {
+            let out = Output {
+                status: ExitStatus::from_raw(256),
+                stdout: Vec::new(),
+                stderr: vec![b'x'; 100_000],
+            };
+            let note = tracking_issue_failure_note(&out).unwrap();
+            assert!(
+                note.len() <= 4096,
+                "the failure note must be bounded to prevent log flooding, was {}",
+                note.len(),
+            );
+        }
+    }
 }
diff --git a/src/ooda_loop/no_progress.rs b/src/ooda_loop/no_progress.rs
index 3237ed5fe..c141a2041 100644
--- a/src/ooda_loop/no_progress.rs
+++ b/src/ooda_loop/no_progress.rs
@@ -33,6 +33,7 @@ use crate::goal_curation::no_progress_why::{
 use crate::goal_curation::{ActiveGoal, GoalBoard, GoalProgress, WipRef};
 use crate::ooda_actions::outcome_made_no_progress;
 use crate::ooda_loop::{ActionOutcome, OodaState};
+use crate::stewardship::gh_client::{LabelDisposition, OODA_STUCK_LABEL, ensure_label};
 
 /// `WipRef.kind` marking a breaker-authored defer annotation (issue #16).
 const DEPENDENCY_WIP_KIND: &str = "dependency";
@@ -102,21 +103,33 @@ pub(crate) trait NoProgressIssueFiler {
 /// brain-failure safeguard in `ooda_actions::advance_goal::spawn`.
 pub(crate) struct GhIssueFiler;
 
+/// Build the `gh issue create` argv for a no-progress tracking issue, splicing
+/// the `--label ooda-stuck` fragment only when the label was ensured
+/// ([`LabelDisposition::Attach`]). A degraded [`LabelDisposition::Omit`] drops
+/// the label so the issue is *still filed* — the fix for issue #4474, where a
+/// missing `ooda-stuck` label made `gh` exit non-zero and silently aborted the
+/// escalation of a blocked goal.
+fn issue_create_argv<'a>(title: &'a str, body: &'a str, label: &LabelDisposition) -> Vec<&'a str> {
+    let mut argv = vec!["issue", "create", "--title", title, "--body", body];
+    argv.extend(label.label_args(OODA_STUCK_LABEL));
+    argv
+}
+
 impl NoProgressIssueFiler for GhIssueFiler {
     fn file_issue(&self, title: &str, body: &str) -> Option<FiledIssue> {
-        match std::process::Command::new("gh")
-            .args([
-                "issue",
-                "create",
-                "--title",
-                title,
-                "--body",
-                body,
-                "--label",
-                "ooda-stuck",
-            ])
-            .output()
-        {
+        // Self-heal the `ooda-stuck` label before filing; on failure, degrade
+        // to filing without the label so the blocked goal is still escalated.
+        let disposition = ensure_label(OODA_STUCK_LABEL);
+        if let LabelDisposition::Omit { reason } = &disposition {
+            tracing::warn!(
+                target: "simard::ooda",
+                label = OODA_STUCK_LABEL,
+                reason = %reason,
+                "no-progress breaker: label unensurable; filing tracking issue without it",
+            );
+        }
+        let argv = issue_create_argv(title, body, &disposition);
+        match std::process::Command::new("gh").args(&argv).output() {
             Ok(out) if out.status.success() => {
                 // `gh issue create` prints the created issue's URL on success,
                 // e.g. `https://github.com/rysweet/Simard/issues/4231`.
@@ -1834,3 +1847,53 @@ mod tests_tracking_issue_link {
         );
     }
 }
+
+/// Tests for the `ooda-stuck` label self-heal (issue #4474): the production
+/// filer must attach the label when it was ensured, and DROP the label while
+/// still filing the issue when the label could not be ensured — so a stuck
+/// goal is always escalated even when `ooda-stuck` is missing / uncreatable.
+#[cfg(test)]
+mod tests_label_self_heal {
+    use super::issue_create_argv;
+    use crate::stewardship::gh_client::{LabelDisposition, OODA_STUCK_LABEL};
+
+    #[test]
+    fn argv_attaches_ooda_stuck_label_when_ensured() {
+        let argv = issue_create_argv("stuck goal", "body", &LabelDisposition::Attach);
+        assert!(
+            argv.windows(2).any(|w| w == ["--label", OODA_STUCK_LABEL]),
+            "an ensured label must be attached so the tracking issue is tagged",
+        );
+        assert_eq!(
+            &argv[..6],
+            &["issue", "create", "--title", "stuck goal", "--body", "body"],
+        );
+    }
+
+    #[test]
+    fn argv_drops_label_but_still_files_when_label_unensurable() {
+        // The bug: an unknown `ooda-stuck` label made `gh` exit non-zero and the
+        // escalation silently failed. The degraded path must still file the
+        // issue — just without the label — so the blocked goal is escalated.
+        let argv = issue_create_argv(
+            "stuck goal",
+            "body",
+            &LabelDisposition::Omit {
+                reason: "label create unauthorized".into(),
+            },
+        );
+        assert!(
+            !argv.contains(&"--label"),
+            "the degraded path must not pass --label",
+        );
+        assert!(
+            !argv.contains(&OODA_STUCK_LABEL),
+            "the degraded path must not reference the ooda-stuck label",
+        );
+        assert_eq!(
+            &argv[..6],
+            &["issue", "create", "--title", "stuck goal", "--body", "body"],
+            "the issue must still be filed so the blocked goal is escalated",
+        );
+    }
+}
diff --git a/src/stewardship/gh_client.rs b/src/stewardship/gh_client.rs
index 4431badb5..86d167414 100644
--- a/src/stewardship/gh_client.rs
+++ b/src/stewardship/gh_client.rs
@@ -153,6 +153,133 @@ fn create_issue_execution_reason(error: CreateIssueExecutionError) -> String {
     }
 }
 
+// ── Issue #4474: `ooda-stuck` label self-heal ──────────────────────────────
+//
+// The OODA no-progress breaker files a tracking issue via
+// `gh issue create --label ooda-stuck` when a goal is Blocked. When the
+// `ooda-stuck` label does not exist in the repo, `gh` exits non-zero and the
+// whole escalation silently fails — a blocked goal can never reach the
+// operator. The self-heal below idempotently ensures the label exists first
+// (`gh label create`), and — crucially — never fails: a label that cannot be
+// created (e.g. a token with issue-write but not label-write) DEGRADES to
+// filing the issue *without* the label, so the escalation always proceeds.
+
+/// The GitHub label the OODA no-progress breaker attaches to the tracking
+/// issues it files for stalled / Blocked goals. Filing historically failed when
+/// this label was absent from the repo; [`ensure_label`] self-heals it first.
+pub(crate) const OODA_STUCK_LABEL: &str = "ooda-stuck";
+
+/// Upper bound (bytes) on the `gh` stderr folded into a degrade reason or
+/// failure note, so a hostile or runaway stderr cannot flood the logs.
+pub(crate) const GH_STDERR_LOG_LIMIT: usize = 2048;
+
+/// Truncate `text` to at most [`GH_STDERR_LOG_LIMIT`] bytes (on a UTF-8 char
+/// boundary), appending a marker when truncated, so decoded `gh` stderr is
+/// safe to fold into a log field without flooding the journal.
+pub(crate) fn truncate_for_log(text: &str) -> String {
+    if text.len() <= GH_STDERR_LOG_LIMIT {
+        return text.to_string();
+    }
+    let mut end = GH_STDERR_LOG_LIMIT;
+    while end > 0 && !text.is_char_boundary(end) {
+        end -= 1;
+    }
+    format!("{}… (truncated)", &text[..end])
+}
+
+/// Whether the `ooda-stuck` label may be attached to a `gh issue create`.
+///
+/// Returned by [`ensure_label`]; it is *never* an error, so the escalation
+/// always proceeds — either with the label ([`Attach`](Self::Attach)) or,
+/// when the label could not be ensured, without it
+/// ([`Omit`](Self::Omit)) while surfacing the reason.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub(crate) enum LabelDisposition {
+    /// The label exists (created just now, or already present): safe to pass
+    /// `--label <name>`.
+    Attach,
+    /// The label could not be ensured; file the issue *without* it and surface
+    /// `reason`. Degraded, but the escalation still succeeds.
+    Omit { reason: String },
+}
+
+impl LabelDisposition {
+    /// The `--label <name>` argv fragment when the label is ensured; empty when
+    /// degraded — so a single argv builder can splice it unconditionally and
+    /// stay the one source of truth for label handling across all filer sites.
+    pub(crate) fn label_args<'a>(&self, label: &'a str) -> Vec<&'a str> {
+        match self {
+            LabelDisposition::Attach => vec!["--label", label],
+            LabelDisposition::Omit { .. } => Vec::new(),
+        }
+    }
+}
+
+/// Injectable executor for `gh label create`, mirroring [`CreateIssueExecutor`].
+/// Real code binds [`execute_ensure_label`]; tests inject subprocess outcomes.
+/// `.output()` collapses spawn+wait into a single `io::Error`, so — unlike the
+/// multi-stage [`CreateIssueExecutor`] — no dedicated error enum is warranted.
+type LabelEnsureExecutor = fn(&OsStr, &[&OsStr]) -> Result<Output, io::Error>;
+
+/// Core, executor-injected label self-heal: run `gh label create <label>` and
+/// map the outcome to a [`LabelDisposition`]. NEVER returns an error — a
+/// failure to create the label degrades to [`LabelDisposition::Omit`] so the
+/// caller still files the escalation issue. A non-zero exit whose stderr says
+/// the label already exists is the *idempotent success* path (case-insensitive,
+/// since the `gh`/GitHub wording is not a stable contract).
+fn ensure_label_with(
+    executable: &OsStr,
+    executor: LabelEnsureExecutor,
+    label: &str,
+) -> LabelDisposition {
+    let args = [OsStr::new("label"), OsStr::new("create"), OsStr::new(label)];
+    match executor(executable, &args) {
+        Ok(output) if output.status.success() => LabelDisposition::Attach,
+        Ok(output) => {
+            let stderr = String::from_utf8_lossy(&output.stderr);
+            if stderr.to_lowercase().contains("already exists") {
+                LabelDisposition::Attach
+            } else {
+                LabelDisposition::Omit {
+                    reason: format!(
+                        "`gh label create {label}` exited {}: {}",
+                        output.status,
+                        truncate_for_log(stderr.trim())
+                    ),
+                }
+            }
+        }
+        Err(error) => LabelDisposition::Omit {
+            reason: format!("failed to run `gh label create`: {error}"),
+        },
+    }
+}
+
+/// Real `gh label create` executor: spawn `gh`, capture stdout/stderr, no stdin
+/// (a label create carries no body). `.output()` folds spawn+wait errors.
+fn execute_ensure_label(executable: &OsStr, args: &[&OsStr]) -> Result<Output, io::Error> {
+    Command::new(executable)
+        .args(args)
+        .stdin(Stdio::null())
+        .stdout(Stdio::piped())
+        .stderr(Stdio::piped())
+        .output()
+}
+
+/// Idempotently ensure `label` exists in the ambient repo before a tracking
+/// issue is filed, self-healing the missing-label failure that broke OODA
+/// no-progress escalation (issue #4474). Never errors: an un-creatable label
+/// degrades to [`LabelDisposition::Omit`], letting the caller file the issue
+/// without the label so the blocked goal is still escalated.
+///
+/// Scoping is intentionally *ambient* (no `-R`): the label is created in the
+/// same repo context the sibling `gh issue create` runs in, so the two can
+/// never target different repos. See
+/// `docs/concepts/ooda-stuck-label-self-heal.md`.
+pub(crate) fn ensure_label(label: &str) -> LabelDisposition {
+    ensure_label_with(OsStr::new("gh"), execute_ensure_label, label)
+}
+
 /// How many of the newest open issues to scan directly — via the
 /// **strongly-consistent** `gh issue list` (no `--search`) — when the
 /// eventually-consistent search index has not yet surfaced a just-filed
@@ -618,4 +745,228 @@ exit 23
         assert!(!error.contains(body));
         assert!(!error.contains(title));
     }
+
+    // ── ooda-stuck label self-heal (issue #4474) ───────────────────────────
+    //
+    // The no-progress breaker escalation filed `gh issue create --label
+    // ooda-stuck`, but that label does not exist in rysweet/Simard, so `gh`
+    // exited non-zero and the escalation silently failed. These tests pin the
+    // contract of the fix: before filing, idempotently ensure the label exists
+    // (`gh label create`), and if it cannot be ensured, DEGRADE to filing
+    // without the label rather than failing — the escalation must always
+    // succeed. Mirrors the injectable `CreateIssueExecutor` fn-pointer seam.
+
+    use super::{LabelDisposition, ensure_label_with, execute_ensure_label};
+    use std::os::unix::process::ExitStatusExt;
+    use std::process::ExitStatus;
+
+    /// Retry the real `gh` executor on transient `ETXTBSY` ("text file busy").
+    ///
+    /// The real-executor tests write a throwaway `gh` script and immediately
+    /// exec it. Under parallel test execution a sibling thread's `fork()` (from
+    /// another `Command::spawn`) can momentarily keep this just-written script's
+    /// fd open, so the exec races with `ETXTBSY`. `ensure_label_with` maps that
+    /// `Err` to `Omit`, flaking assertions that expect `Attach`. This is a pure
+    /// test-harness artifact — a long-installed production `gh` is never
+    /// written-then-exec'd — so we absorb it here rather than complicate the
+    /// production executor.
+    fn execute_ensure_label_no_etxtbsy(
+        executable: &OsStr,
+        args: &[&OsStr],
+    ) -> Result<Output, io::Error> {
+        const ETXTBSY: i32 = 26;
+        for _ in 0..100 {
+            match execute_ensure_label(executable, args) {
+                Err(e) if e.raw_os_error() == Some(ETXTBSY) => {
+                    std::thread::sleep(std::time::Duration::from_millis(5));
+                }
+                result => return result,
+            }
+        }
+        execute_ensure_label(executable, args)
+    }
+
+    fn label_create_succeeds(_executable: &OsStr, _args: &[&OsStr]) -> Result<Output, io::Error> {
+        Ok(Output {
+            status: ExitStatus::from_raw(0),
+            stdout: Vec::new(),
+            stderr: Vec::new(),
+        })
+    }
+
+    fn label_already_exists(_executable: &OsStr, _args: &[&OsStr]) -> Result<Output, io::Error> {
+        // Mixed-case wording forces the idempotency match to be case-insensitive
+        // (the `gh`/GitHub message casing is not guaranteed stable).
+        Ok(Output {
+            status: ExitStatus::from_raw(256),
+            stdout: Vec::new(),
+            stderr: b"HTTP 422: Validation Failed. Label \"ooda-stuck\" Already EXISTS".to_vec(),
+        })
+    }
+
+    fn label_create_unauthorized(
+        _executable: &OsStr,
+        _args: &[&OsStr],
+    ) -> Result<Output, io::Error> {
+        Ok(Output {
+            status: ExitStatus::from_raw(256),
+            stdout: Vec::new(),
+            stderr: b"HTTP 403: Resource not accessible by integration".to_vec(),
+        })
+    }
+
+    fn label_spawn_fails(_executable: &OsStr, _args: &[&OsStr]) -> Result<Output, io::Error> {
+        Err(io::Error::new(io::ErrorKind::NotFound, "no gh binary"))
+    }
+
+    fn label_huge_stderr(_executable: &OsStr, _args: &[&OsStr]) -> Result<Output, io::Error> {
+        Ok(Output {
+            status: ExitStatus::from_raw(256),
+            stdout: Vec::new(),
+            stderr: vec![b'x'; 100_000],
+        })
+    }
+
+    #[test]
+    fn ooda_stuck_label_constant_is_ooda_stuck() {
+        assert_eq!(super::OODA_STUCK_LABEL, "ooda-stuck");
+    }
+
+    #[test]
+    fn ensure_label_attaches_when_create_succeeds() {
+        let disp = ensure_label_with(OsStr::new("gh"), label_create_succeeds, "ooda-stuck");
+        assert_eq!(disp, LabelDisposition::Attach);
+    }
+
+    #[test]
+    fn ensure_label_attaches_idempotently_when_label_already_exists() {
+        // A non-zero exit whose stderr says the label already exists is the
+        // idempotent success case — the label is present, so keep attaching it.
+        let disp = ensure_label_with(OsStr::new("gh"), label_already_exists, "ooda-stuck");
+        assert_eq!(
+            disp,
+            LabelDisposition::Attach,
+            "an `already exists` failure must be treated as Attach (case-insensitive)",
+        );
+    }
+
+    #[test]
+    fn ensure_label_omits_with_reason_when_unauthorized() {
+        // A token that can file issues may lack repo-write to create labels.
+        // The fail-safe path degrades to Omit so the escalation still proceeds.
+        let disp = ensure_label_with(OsStr::new("gh"), label_create_unauthorized, "ooda-stuck");
+        match disp {
+            LabelDisposition::Omit { reason } => assert!(
+                reason.contains("403") || reason.to_lowercase().contains("not accessible"),
+                "the degrade reason must surface the gh stderr, got {reason:?}",
+            ),
+            LabelDisposition::Attach => {
+                panic!("unauthorized label creation must degrade to Omit, never Attach")
+            }
+        }
+    }
+
+    #[test]
+    fn ensure_label_omits_when_spawn_fails_and_never_errs() {
+        // No silent fallback, no propagated error: a spawn failure becomes an
+        // observable Omit so the caller still files the issue without the label.
+        let disp = ensure_label_with(OsStr::new("gh"), label_spawn_fails, "ooda-stuck");
+        assert!(
+            matches!(disp, LabelDisposition::Omit { .. }),
+            "a spawn failure must degrade to Omit, not panic or Err",
+        );
+    }
+
+    #[test]
+    fn ensure_label_omit_reason_is_bounded_for_huge_stderr() {
+        // Truncate the degrade reason so a hostile/huge stderr cannot flood logs.
+        let disp = ensure_label_with(OsStr::new("gh"), label_huge_stderr, "ooda-stuck");
+        match disp {
+            LabelDisposition::Omit { reason } => assert!(
+                reason.len() <= 4096,
+                "omit reason must be bounded to prevent log flooding, was {}",
+                reason.len(),
+            ),
+            LabelDisposition::Attach => panic!("a hard failure must degrade to Omit"),
+        }
+    }
+
+    #[test]
+    fn label_args_present_on_attach_absent_on_omit() {
+        assert_eq!(
+            LabelDisposition::Attach.label_args("ooda-stuck"),
+            vec!["--label", "ooda-stuck"],
+        );
+        assert!(
+            LabelDisposition::Omit {
+                reason: "unauthorized".into(),
+            }
+            .label_args("ooda-stuck")
+            .is_empty(),
+        );
+    }
+
+    #[test]
+    fn ensure_label_runs_gh_label_create_argv_via_real_executor() {
+        // The real subprocess path must invoke `gh label create <label>` with no
+        // issue body, and map a clean exit to Attach.
+        let script = r#"
+dir=${0%/*}
+printf '%s\n' "$@" > "$dir/argv"
+exit 0
+"#;
+        let (dir, executable) = fake_gh(script);
+        let disp = ensure_label_with(
+            executable.as_os_str(),
+            execute_ensure_label_no_etxtbsy,
+            "ooda-stuck",
+        );
+        assert_eq!(disp, LabelDisposition::Attach);
+        let argv = fs::read_to_string(dir.path().join("argv")).unwrap();
+        assert!(argv.contains("label\ncreate\n"), "argv was: {argv:?}");
+        assert!(argv.contains("ooda-stuck"), "argv was: {argv:?}");
+        assert!(
+            !argv.contains("--body"),
+            "`gh label create` must not carry an issue body",
+        );
+    }
+
+    #[test]
+    fn ensure_label_treats_real_already_exists_stderr_as_attach() {
+        // End-to-end through the real executor: a non-zero exit whose stderr
+        // reports the label already exists is idempotent success.
+        let script = r#"
+printf '%s\n' 'label already exists' >&2
+exit 1
+"#;
+        let (_dir, executable) = fake_gh(script);
+        let disp = ensure_label_with(
+            executable.as_os_str(),
+            execute_ensure_label_no_etxtbsy,
+            "ooda-stuck",
+        );
+        assert_eq!(
+            disp,
+            LabelDisposition::Attach,
+            "`already exists` from the real subprocess path is idempotent success",
+        );
+    }
+
+    #[test]
+    fn ensure_label_degrades_when_real_executor_reports_other_failure() {
+        let script = r#"
+printf '%s\n' 'HTTP 403: Resource not accessible by integration' >&2
+exit 1
+"#;
+        let (_dir, executable) = fake_gh(script);
+        let disp = ensure_label_with(
+            executable.as_os_str(),
+            execute_ensure_label_no_etxtbsy,
+            "ooda-stuck",
+        );
+        assert!(
+            matches!(disp, LabelDisposition::Omit { .. }),
+            "a genuine failure from the real path must degrade to Omit",
+        );
+    }
 }