diff --git a/docs/index.md b/docs/index.md
index fbce969e7..0111a0723 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -217,6 +217,7 @@ If you are changing architecture, start with the [architecture overview](./archi
 - [No-progress breaker API reference](./reference/no-progress-breaker-api.md) — the per-goal consecutive-no-action safeguard, its `[OODA-SAFEGUARD]` sentinel, the standing/perpetual runtime exemption, the `perpetual_idled` report field, and the load-time `heal_stale_no_progress_blocks` self-heal (#2589).
 - [Research-goal never-idle rail API reference](./reference/research-goal-never-idle-rail-api.md) — the #4399 never-idle rail on top of the breaker: the shared `classify_standing_idle` classifier consumed by both breaker sites, the `StandingIdle` split (benign-exempt vs research-fault), the fixed `ResearchIdleFault` vocabulary, the additive `NoProgressBreakerReport.research_idle_faults` field (excluded from `fired()`), the `roll_to_new_cycle` re-orient, and the revised never-idle directive contract (NEW source OR NEW experiment, dedup'd, local-experiment floor — no idle fallback). See the [concept](./concepts/research-goal-never-idle.md) and the [keep-the-research-goal-never-idle how-to](./howto/keep-the-research-goal-never-idle.md).
 - [wip-ref liveness reconcile API reference](./reference/wip-ref-liveness-reconcile-api.md) — the #4428 two-prong per-cycle reconcile (dead-session sweep + merged/closed-PR prune) that makes `has_live_in_flight_ref()` reflect true liveness before the never-idle breaker classifies, plus the [round-3 hardening reference](./reference/wip-ref-liveness-reconcile-hardening-api.md) that makes both prongs total: dead-ref prune for **every** goal regardless of assignment (FIX-1) and a merged-PR reconcile scoped to **each goal's own repo** instead of a hardcoded `rysweet/Simard` (FIX-2).
+- [Resilient tracking-issue label ensure (`ooda-stuck`) reference](./reference/ooda-tracking-issue-label-resilience.md) — the #4472 fix that makes every OODA tracking-issue creation robust to the missing `ooda-stuck` label: the pure `ensure_gh_label` helper and its `LabelEnsure` (`AlreadyExists` / `Created` / `Unavailable`) classification, the idempotent `gh label create` + graceful-degradation (`file-unlabeled`) contract shared by all three `gh issue create` sites (deterministic safeguard, `OpenTrackingIssue`, and the breaker's `GhIssueFiler`), and the structured tracing that turns the previously silent `could not add label: 'ooda-stuck' not found` escalation failure into a filed, operator-visible issue.
 - [No-progress root-cause resolution API reference](./reference/no-progress-root-cause-resolution-api.md) — the root-cause layer on the breaker: the `NoProgressClass` classification and its stable tokens, the `NoProgressWhy`/`Evidence` types, the optional `NoProgressWhyReasoner` agentic-enrichment trait, the extended `NoProgressResolution` ladder (auto-complete / heal / defer / one-shot guided-retry / escalate-with-WHY), the WHY-bearing block-reason contract, the additive `EvidenceSource::repo_present` and `dependency_goal_state` methods, and the fail-closed error table. See the [concept](./concepts/no-progress-root-cause-resolution.md) and the [diagnose runbook](./howto/diagnose-a-no-progress-block.md).
 - [The `ooda-no-progress-why` recipe reference](./reference/ooda-no-progress-why-recipe.md) — the optional agentic-enrichment recipe that turns the deterministic classification + evidence into a human-readable WHY narrative for the escalation: context variables, the single-string narrative output contract, the "enrichment never changes routing" invariant, hot-reload resolution order, and the NO-FALLBACK fail-closed contract.
 - [Durable OODA cycle counter API reference](./reference/durable-ooda-cycle-counter.md) — the brain-relative, monotonic cycle counter: the persisted `PersistentGoalState.cycle_count` field, the `commit_cycle` `max()` guard, the daemon startup seed, the one-time cycle-report backfill, the repointed `daemon_health.json` writes, and the single source of truth that keeps every `cycle=` log, cycle report, and dashboard "Cycle #N" counting the brain's total lived cognition instead of resetting to 1 on each restart. See the [concept](./concepts/brain-relative-ooda-cycle-counter.md) and the [inspect-and-verify how-to](./howto/inspect-the-ooda-cycle-counter.md).
diff --git a/docs/reference/ooda-tracking-issue-label-resilience.md b/docs/reference/ooda-tracking-issue-label-resilience.md
new file mode 100644
index 000000000..4af81deb0
--- /dev/null
+++ b/docs/reference/ooda-tracking-issue-label-resilience.md
@@ -0,0 +1,269 @@
+---
+title: "Reference: resilient tracking-issue label ensure (`ooda-stuck`)"
+description: >
+  The label-ensure prelude that makes every OODA tracking-issue creation robust
+  to a missing `ooda-stuck` label. Documents the pure `ensure_gh_label` helper
+  and its `LabelEnsure` classification, the idempotent `gh label create` +
+  graceful-degradation contract shared by the three `gh issue create` sites (the
+  deterministic brain-failure safeguard, the `OpenTrackingIssue` lifecycle path,
+  and the no-progress breaker's `GhIssueFiler`), and the structured tracing each
+  site emits. Fixes the recurring `could not add label: 'ooda-stuck' not found`
+  escalation failure (#4472).
+last_updated: 2026-07-22
+review_schedule: as-needed
+owner: simard
+doc_type: reference
+status: implemented
+related:
+  - ./no-progress-breaker-api.md
+  - ./no-progress-root-cause-resolution-api.md
+  - ../howto/diagnose-a-no-progress-block.md
+  - ../howto/unblock-stuck-ooda-goals.md
+  - ../concepts/steerable-ooda-daemon.md
+  - ../../src/ooda_actions/gh_label.rs
+  - ../../src/ooda_actions/advance_goal/spawn.rs
+  - ../../src/ooda_loop/no_progress.rs
+---
+
+# Reference: resilient tracking-issue label ensure (`ooda-stuck`)
+
+> **Status: implemented (issue #4472).** The pure helper lives at
+> [`src/ooda_actions/gh_label.rs`](https://github.com/rysweet/Simard/blob/main/src/ooda_actions/gh_label.rs).
+> It is called from the three sites that create the operator-facing tracking
+> issue for a stuck goal:
+> [`src/ooda_actions/advance_goal/spawn.rs`](https://github.com/rysweet/Simard/blob/main/src/ooda_actions/advance_goal/spawn.rs)
+> (the deterministic brain-failure safeguard **and** the
+> `EngineerLifecycleDecision::OpenTrackingIssue` path) and
+> [`src/ooda_loop/no_progress.rs`](https://github.com/rysweet/Simard/blob/main/src/ooda_loop/no_progress.rs)
+> (the no-progress breaker's `GhIssueFiler`).
+
+## The defect this fixes
+
+Before #4472, all three tracking-issue sites invoked
+`gh issue create … --label ooda-stuck` with the label name **hardcoded and
+unconditional**. The `ooda-stuck` label does not exist in `rysweet/Simard`, so
+`gh` exited non-zero on **every** escalation with:
+
+```
+could not add label: 'ooda-stuck' not found
+```
+
+The no-progress breaker recorded `escalated=1` internally while the GitHub issue
+was **never created** — a silent, broken escalation path. The recurring journal
+signature was:
+
+```
+no-progress breaker: gh issue create failed (goal still Blocked) stderr=could not add label: 'ooda-stuck' not found
+```
+
+observed 4× in a 6-hour window (cycles 2430 / 2433 / 2436 / 2439), hiding stuck
+goals such as `audit-simard-s-test-coverage` (`4d27c91a`) from the operator.
+
+The fix makes label attachment **best-effort**: the label is idempotently
+ensured before filing, and if it cannot be ensured the issue is filed **without**
+the label rather than not filed at all. Escalation is now visible to the operator
+in every case.
+
+## Design invariant
+
+> **The tracking issue MUST be filed. The label is a nicety, never a
+> precondition.** A missing, un-creatable, or auth-restricted label degrades the
+> issue to *unlabeled-but-filed*; it never turns escalation into a silent no-op.
+
+This is the same fail-**visible** (not fail-silent) posture as the rest of the
+no-progress breaker — see the
+[no-progress breaker API](./no-progress-breaker-api.md) and
+[steerable-daemon concept](../concepts/steerable-ooda-daemon.md).
+
+## `ensure_gh_label` — the pure helper
+
+```rust
+// src/ooda_actions/gh_label.rs
+
+/// The compile-time label name attached to every OODA tracking issue.
+/// Never a runtime-derived string — see "Security" below.
+pub(crate) const OODA_STUCK_LABEL: &str = "ooda-stuck";
+
+/// Outcome of an idempotent `gh label create ooda-stuck`.
+#[derive(Debug)]
+pub(crate) enum LabelEnsure {
+    /// The label did not exist and was just created. Callers emit an
+    /// `info!`/`debug!` on this arm (a genuine, one-time repo mutation).
+    Created,
+    /// The label already existed. No mutation; no tracing warranted.
+    AlreadyExists,
+    /// The label could not be ensured (auth error, network error, `gh`
+    /// missing, unclassifiable stderr). Carries a human-readable reason for
+    /// the caller's `warn!`. Callers MUST fall back to filing without a label.
+    Unavailable(String),
+}
+
+/// Idempotently ensure the `ooda-stuck` label exists in the CWD's repo.
+///
+/// Runs `gh label create ooda-stuck` (argv-only, never `sh -c`). Treats an
+/// "already exists" stderr as success (`AlreadyExists`). Any other non-zero
+/// exit, or a spawn error, is classified `Unavailable(reason)`.
+///
+/// This function emits **no** tracing itself — it returns a classification so
+/// each call site can log with its own static `target:`. It never panics and
+/// never calls `unwrap`/`expect`.
+pub(crate) fn ensure_gh_label(label: &'static str) -> LabelEnsure { /* … */ }
+```
+
+### Classification rules
+
+`ensure_gh_label` shells out with argv only:
+
+```
+gh label create <label>
+```
+
+and classifies the result:
+
+| `gh` result | stderr contains | `LabelEnsure` |
+| --- | --- | --- |
+| exit 0 | — | `Created` |
+| exit ≠ 0 | `already exists` (case-insensitive substring) | `AlreadyExists` |
+| exit ≠ 0 | anything else (auth, not-found repo, rate-limit, …) | `Unavailable(<trimmed stderr>)` |
+| spawn error (`gh` not on `PATH`, etc.) | — | `Unavailable(<io error>)` |
+
+The "already exists" substring match is intentionally the **only** wording the
+helper treats as idempotent success. If a future `gh` release changes that
+phrasing, the helper degrades to `Unavailable` and the caller files the issue
+**unlabeled** — a fail-safe outcome, never a fail-silent one.
+
+The substring classifier is extracted into a tiny pure function so it can be
+unit-tested without spawning `gh` (see [Testing](#testing)).
+
+## Call-site contract (all three sites)
+
+Every site follows the same three-step prelude before `gh issue create`:
+
+1. **Ensure the label.** Call `ensure_gh_label(OODA_STUCK_LABEL)`.
+   - `AlreadyExists` → attach `--label ooda-stuck`. No tracing.
+   - `Created` → attach `--label ooda-stuck`. Emit a structured
+     `info!`/`debug!` on the site's existing `target:` noting the auto-create.
+   - `Unavailable(reason)` → **do not abort**. Emit a `tracing::warn!` with
+     `reason` on the site's existing `target:`, then drop `--label` for this
+     filing.
+2. **Build argv conditionally.** The `--label ooda-stuck` pair is appended to
+   the `gh issue create` argument vector **only** when the label was ensured;
+   otherwise the issue is created without it. (Implemented as a `Vec<&str>` so
+   the two trailing args are simply not pushed on the degraded path.)
+3. **File the issue**, preserving each site's existing result handling and every
+   pre-existing failure-branch trace verbatim.
+
+> The behaviour is **additive and non-breaking**: no function signature changes,
+> no new panics, and no new `print!`/`println!`/`eprintln!`. New code emits
+> structured tracing / OTel only. The pre-existing success `eprintln!` in the
+> deterministic safeguard is intentionally left untouched.
+
+### Site 1 — deterministic brain-failure safeguard
+
+`src/ooda_actions/advance_goal/spawn.rs` (`.output()` + `match`, target
+`simard::ooda_brain`). The success `eprintln!` (`DETERMINISTIC SAFEGUARD: … +
+tracking issue filed`) and both existing `error!` branches
+(`deterministic safeguard: gh issue create FAILED …`,
+`deterministic safeguard: gh process spawn FAILED …`) are preserved. The
+label-ensure prelude runs immediately before the `gh issue create` invocation.
+
+### Site 2 — `OpenTrackingIssue` engineer-lifecycle path
+
+`src/ooda_actions/advance_goal/spawn.rs`
+(`EngineerLifecycleDecision::OpenTrackingIssue`, `.status()` + `if let Err`,
+target `simard::ooda_brain`). The existing
+`open_tracking_issue: gh issue create failed` warn is preserved; the prelude and
+conditional `--label` are inserted ahead of it.
+
+### Site 3 — no-progress breaker `GhIssueFiler`
+
+`src/ooda_loop/no_progress.rs` (`.output()` + `match`, target `simard::ooda`).
+This is the emitter of the recurring journal signature at the historical
+`no-progress breaker: gh issue create failed (goal still Blocked)` line. The
+success arm (which parses the created issue URL / number into `FiledIssue`) and
+both failure arms are preserved; the prelude and conditional `--label` are
+inserted ahead of the `gh issue create`.
+
+Because the prelude lives inside `GhIssueFiler::file_issue`, it inherits the
+caller's idempotence guard: `escalate_with_tracking_issue` only invokes
+`file_issue` when the goal is **not** already linked to a breaker tracking issue
+(`already_tracked == false`). A re-stall of an already-tracked goal therefore
+skips both the `gh issue create` **and** the `ensure_gh_label` subprocess. The
+extra `gh label create` runs only while the goal is **not yet
+tracked** — normally exactly once, because the first *successful* filing links
+the issue (`link_tracking_issue`) and suppresses every later attempt. If filing
+keeps failing (so no issue is ever linked), the prelude re-runs each escalate
+cycle until one succeeds — which is the intended fail-visible behaviour, not a
+cost regression. Sites 1 and 2 have no such pre-check, so their prelude runs on
+every safeguard/lifecycle invocation (still negligible — those paths are rare).
+
+## Tracing surface
+
+The label-ensure feature adds exactly two new structured events per site and
+changes none of the existing ones:
+
+| Event | Level | Target | When |
+| --- | --- | --- | --- |
+| label auto-created | `info!` (or `debug!`) | site's existing target | `ensure_gh_label` returned `Created` |
+| label unavailable, filing unlabeled | `warn!` | site's existing target | `ensure_gh_label` returned `Unavailable`; includes `reason` |
+
+There is **no** new event for `AlreadyExists` (the steady state) — it is silent
+by design to avoid per-cycle log noise.
+
+Example (degraded path, breaker site, `target: simard::ooda`):
+
+```
+WARN simard::ooda label=ooda-stuck reason="HTTP 403: Resource not accessible by integration" no-progress breaker: could not ensure label, filing tracking issue without it
+```
+
+Example (auto-create, breaker site):
+
+```
+INFO simard::ooda label=ooda-stuck no-progress breaker: created missing 'ooda-stuck' label
+```
+
+## Security
+
+- **Argv-only invocation.** Both `gh label create` and `gh issue create` are
+  built with `std::process::Command` and separate arguments — never `sh -c` or
+  string interpolation — so no goal title, body, or branch can inject a shell
+  command or an extra argument.
+- **Label is a compile-time constant.** `OODA_STUCK_LABEL` is a `&'static str`;
+  no runtime-derived string ever flows into the `--label` argument.
+- **Ambient auth reused, never handled.** The helper relies on `gh`'s existing
+  auth (`GH_TOKEN` / keyring). It never reads, logs, or passes tokens. The
+  degraded path uses identical credentials, repo, and scope — no elevation, no
+  retry loop.
+- **No silent swallow.** `Unavailable` is always surfaced via `warn!` with its
+  cause, so auth or label failures stay operator-visible. Raw `stderr` is
+  confined to `warn!`/`debug!`, never echoed at `info!`.
+- **Idempotency race is safe.** Concurrent `gh label create` calls converge
+  because "already exists" is treated as success — the operation is
+  non-destructive.
+
+## Testing
+
+- **Unit (hermetic).** An inline `#[cfg(test)]` test in `gh_label.rs` exercises
+  the pure stderr classifier: `already exists` → `AlreadyExists`; an auth
+  string → `Unavailable`; empty/other → `Unavailable`. No live `gh` is spawned.
+- **Regression (must stay green).**
+  - `src/ooda_loop/tests_no_progress_investigation.rs`
+  - `tests/gadugi/no-progress-tracking-issue-link.sh`
+  - `tests/gadugi/no-progress-tracking-issue-link.yaml`
+- **Gate.** `cargo build`, `cargo clippy -- -D warnings`, and the targeted tests
+  above are all clean; CI-green and merge-ready.
+
+## Out of scope
+
+Unchanged by this fix: escalation counting, the `Blocked` transition logic,
+manually creating the label in repo settings, issue title/body content, and any
+broader `eprintln!` → tracing convention rework.
+
+## See also
+
+- [No-progress breaker API reference](./no-progress-breaker-api.md) — the
+  safeguard whose escalation this fix unblocks.
+- [No-progress root-cause resolution API reference](./no-progress-root-cause-resolution-api.md) —
+  the ladder that escalates to a human tracking issue as its last rung.
+- [Diagnose a no-progress block and read its WHY](../howto/diagnose-a-no-progress-block.md).
+- [Unblock stuck OODA goals](../howto/unblock-stuck-ooda-goals.md).
diff --git a/src/ooda_actions/advance_goal/spawn.rs b/src/ooda_actions/advance_goal/spawn.rs
index 300cdd7df..cac9b0ea7 100644
--- a/src/ooda_actions/advance_goal/spawn.rs
+++ b/src/ooda_actions/advance_goal/spawn.rs
@@ -367,19 +367,32 @@ pub fn dispatch_spawn_engineer(
                     }
                     // File tracking issue. Failure to file is logged but
                     // does NOT swallow the original brain failure.
-                    match std::process::Command::new("gh")
-                        .args([
-                            "issue",
-                            "create",
-                            "--title",
-                            &title,
-                            "--body",
-                            &body,
-                            "--label",
-                            "ooda-stuck",
-                        ])
-                        .output()
-                    {
+                    //
+                    // Issue #4472: `gh issue create --label ooda-stuck` used to
+                    // fail every time because the label did not exist in the
+                    // repo. Idempotently ensure it first, degrading to an
+                    // unlabeled-but-still-filed issue if it cannot be ensured.
+                    use crate::ooda_actions::gh_label::{
+                        LabelEnsure, OODA_STUCK_LABEL, ensure_gh_label,
+                    };
+                    let label = ensure_gh_label(OODA_STUCK_LABEL);
+                    match &label {
+                        LabelEnsure::Created => tracing::info!(
+                            target: "simard::ooda_brain",
+                            goal = %goal_id,
+                            label = OODA_STUCK_LABEL,
+                            "deterministic safeguard: auto-created missing tracking-issue label",
+                        ),
+                        LabelEnsure::AlreadyExists => {}
+                        LabelEnsure::Unavailable(reason) => tracing::warn!(
+                            target: "simard::ooda_brain",
+                            goal = %goal_id,
+                            reason = %reason,
+                            "deterministic safeguard: could not ensure tracking-issue label; filing issue WITHOUT label (degraded)",
+                        ),
+                    }
+                    let gh_args = label.issue_create_args(&title, &body);
+                    match std::process::Command::new("gh").args(&gh_args).output() {
                         Ok(out) if out.status.success() => {
                             eprintln!(
                                 "[simard] DETERMINISTIC SAFEGUARD: goal '{}' marked Blocked + tracking issue filed",
@@ -924,18 +937,28 @@ fn apply_lifecycle_decision(
     }
 
     if let EngineerLifecycleDecision::OpenTrackingIssue { title, body, .. } = &decision {
-        let result = std::process::Command::new("gh")
-            .args([
-                "issue",
-                "create",
-                "--title",
-                title,
-                "--body",
-                body,
-                "--label",
-                "ooda-stuck",
-            ])
-            .status();
+        // Issue #4472: ensure the `ooda-stuck` label exists before creating the
+        // issue, degrading to an unlabeled-but-still-filed issue if it cannot be
+        // ensured. Keeps the existing `.status()` + `warn!` failure branch.
+        use crate::ooda_actions::gh_label::{LabelEnsure, OODA_STUCK_LABEL, ensure_gh_label};
+        let label = ensure_gh_label(OODA_STUCK_LABEL);
+        match &label {
+            LabelEnsure::Created => tracing::info!(
+                target: "simard::ooda_brain",
+                goal = %goal_id,
+                label = OODA_STUCK_LABEL,
+                "open_tracking_issue: auto-created missing tracking-issue label",
+            ),
+            LabelEnsure::AlreadyExists => {}
+            LabelEnsure::Unavailable(reason) => tracing::warn!(
+                target: "simard::ooda_brain",
+                goal = %goal_id,
+                reason = %reason,
+                "open_tracking_issue: could not ensure tracking-issue label; filing issue WITHOUT label (degraded)",
+            ),
+        }
+        let gh_args = label.issue_create_args(title, body);
+        let result = std::process::Command::new("gh").args(&gh_args).status();
         if let Err(e) = result {
             tracing::warn!(
                 target: "simard::ooda_brain",
diff --git a/src/ooda_actions/gh_label.rs b/src/ooda_actions/gh_label.rs
new file mode 100644
index 000000000..fc4fc16e0
--- /dev/null
+++ b/src/ooda_actions/gh_label.rs
@@ -0,0 +1,239 @@
+//! Idempotent `gh label` ensurer for the OODA no-progress / brain-failure
+//! tracking-issue path.
+//!
+//! Three sites file an operator-facing tracking issue with
+//! `gh issue create --label ooda-stuck`:
+//!
+//! * the deterministic brain-failure safeguard
+//!   ([`crate::ooda_actions::advance_goal::spawn`], the `.output()` + `match`
+//!   site),
+//! * the `EngineerLifecycleDecision::OpenTrackingIssue` path (same file, the
+//!   `.status()` + `if let Err` site), and
+//! * the no-progress breaker filer
+//!   ([`crate::ooda_loop::no_progress::GhIssueFiler`]).
+//!
+//! Every one hard-coded `--label ooda-stuck`, but that label does not exist in
+//! the repo, so `gh` exits non-zero *every* time with
+//! `could not add label: 'ooda-stuck' not found`. The breaker still records
+//! `escalated=1` internally while the GitHub issue is never created — a silent
+//! broken escalation path that hides stuck goals from the operator.
+//!
+//! This module makes tracking-issue creation robust to the missing label:
+//! before creating the issue, each site idempotently ensures the label exists
+//! (`gh label create ooda-stuck`, treating "already exists" as success). If the
+//! label cannot be ensured, the caller degrades gracefully by filing the issue
+//! *without* `--label` (visible, non-silent). The ensurer itself emits **no**
+//! tracing and never panics — it returns a [`LabelEnsure`] classification the
+//! caller logs with its own static tracing `target:`.
+//!
+//! Security: the label is the compile-time constant [`OODA_STUCK_LABEL`], never
+//! a runtime-derived string, and invocation is argv-only (`std::process::Command`
+//! with separate args) — never `sh -c` / string interpolation.
+
+/// The tracking-issue label. A fixed, compile-time `&'static str` — never a
+/// runtime-derived value — so no title/body/branch string can ever flow into
+/// the `--label` argument (argument-injection safe).
+pub(crate) const OODA_STUCK_LABEL: &str = "ooda-stuck";
+
+/// Outcome of idempotently ensuring the tracking-issue label exists.
+///
+/// The caller uses [`LabelEnsure::label_present`] to decide whether it may pass
+/// `--label` to `gh issue create`, and logs the outcome with its own static
+/// tracing `target:` (this type emits no tracing itself).
+#[derive(Debug)]
+pub(crate) enum LabelEnsure {
+    /// `gh label create` succeeded — the label was created by this call.
+    Created,
+    /// `gh label create` reported the label already exists — the idempotent
+    /// success path (treated as success, not failure).
+    AlreadyExists,
+    /// The label could not be ensured (auth failure, `gh` spawn error, unknown
+    /// non-zero exit). Carries an operator-legible, non-empty cause so the
+    /// caller can `warn!` it — failures are surfaced, never silently swallowed.
+    /// The caller degrades to filing the issue *without* `--label`.
+    Unavailable(String),
+}
+
+impl LabelEnsure {
+    /// True when the label is present (freshly created or pre-existing), so the
+    /// caller may safely include `--label`. False for [`LabelEnsure::Unavailable`],
+    /// signalling the degraded unlabeled-but-still-filed path.
+    fn label_present(&self) -> bool {
+        matches!(self, LabelEnsure::Created | LabelEnsure::AlreadyExists)
+    }
+
+    /// Build the `gh issue create` argv for a tracking issue, appending
+    /// `--label ooda-stuck` only when the label is present. In the degraded
+    /// ([`LabelEnsure::Unavailable`]) path the issue is still filed — just
+    /// without the label — so a stuck goal is never hidden from the operator.
+    ///
+    /// This is the single source of truth for the labeled/unlabeled decision
+    /// shared by all three tracking-issue filing sites (issue #4472 arose from
+    /// that decision being duplicated and fixed inconsistently across sites).
+    pub(crate) fn issue_create_args<'a>(&self, title: &'a str, body: &'a str) -> Vec<&'a str> {
+        let mut args = vec!["issue", "create", "--title", title, "--body", body];
+        if self.label_present() {
+            args.push("--label");
+            args.push(OODA_STUCK_LABEL);
+        }
+        args
+    }
+}
+
+/// Idempotently ensure `label` exists via `gh label create`, classifying the
+/// result. Emits no tracing and never panics; returns a [`LabelEnsure`] the
+/// caller logs. Not unit-tested here (it shells out to `gh`); the pure
+/// classification it delegates to — [`classify_label_create`] — is.
+pub(crate) fn ensure_gh_label(label: &'static str) -> LabelEnsure {
+    match std::process::Command::new("gh")
+        .args(["label", "create", label])
+        .output()
+    {
+        Ok(out) => {
+            classify_label_create(out.status.success(), &String::from_utf8_lossy(&out.stderr))
+        }
+        Err(io_err) => {
+            LabelEnsure::Unavailable(format!("gh label create process spawn failed: {io_err}"))
+        }
+    }
+}
+
+/// Pure classification of a `gh label create` invocation from its exit-success
+/// flag and captured stderr. Extracted from [`ensure_gh_label`] so the decision
+/// logic is testable without spawning `gh`.
+///
+/// Contract:
+/// * `success == true` -> [`LabelEnsure::Created`].
+/// * failure whose stderr contains `"already exists"` (case-insensitive) ->
+///   [`LabelEnsure::AlreadyExists`] (idempotent success).
+/// * any other failure -> [`LabelEnsure::Unavailable`] carrying a **non-empty**
+///   reason that preserves the underlying cause (never a silent/empty
+///   degradation).
+fn classify_label_create(success: bool, stderr: &str) -> LabelEnsure {
+    if success {
+        return LabelEnsure::Created;
+    }
+    if stderr.to_ascii_lowercase().contains("already exists") {
+        return LabelEnsure::AlreadyExists;
+    }
+    let trimmed = stderr.trim();
+    let reason = if trimmed.is_empty() {
+        "gh label create failed with a non-zero exit and no stderr output".to_string()
+    } else {
+        trimmed.to_string()
+    };
+    LabelEnsure::Unavailable(reason)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::{LabelEnsure, OODA_STUCK_LABEL, classify_label_create};
+    #[test]
+    fn label_constant_is_the_compile_time_ooda_stuck_literal() {
+        // Security/DRY: the label is a fixed &'static str shared by all three
+        // sites, never a runtime-derived string.
+        assert_eq!(OODA_STUCK_LABEL, "ooda-stuck");
+    }
+
+    #[test]
+    fn successful_gh_label_create_is_classified_as_created() {
+        assert!(
+            matches!(classify_label_create(true, ""), LabelEnsure::Created),
+            "a zero-exit `gh label create` must classify as Created",
+        );
+    }
+
+    #[test]
+    fn already_exists_failure_is_treated_as_success() {
+        // `gh label create` exits non-zero when the label already exists; this
+        // is the idempotent success path that stops the recurring journal
+        // signature (`could not add label: 'ooda-stuck' not found`).
+        let stderr = "failed to create label: 'ooda-stuck' already exists";
+        assert!(
+            matches!(
+                classify_label_create(false, stderr),
+                LabelEnsure::AlreadyExists
+            ),
+            "an 'already exists' failure must be treated as success",
+        );
+    }
+
+    #[test]
+    fn already_exists_match_is_case_insensitive() {
+        // gh wording varies across versions; match the stable substring
+        // regardless of case so a capitalisation change never regresses us into
+        // the broken (silent) path.
+        let stderr = "GraphQL: Label already exists (createLabel)";
+        assert!(
+            matches!(
+                classify_label_create(false, stderr),
+                LabelEnsure::AlreadyExists
+            ),
+            "'already exists' matching must be case-insensitive",
+        );
+    }
+
+    #[test]
+    fn genuine_failure_is_unavailable_and_preserves_the_cause() {
+        // A real failure (e.g. auth) must NOT be silently swallowed — the
+        // operator-visible cause is preserved so the caller can warn! it before
+        // degrading to the unlabeled path.
+        let stderr = "HTTP 401: Bad credentials";
+        match classify_label_create(false, stderr) {
+            LabelEnsure::Unavailable(reason) => assert!(
+                reason.contains("Bad credentials"),
+                "the degraded-path reason must preserve the cause, got: {reason}",
+            ),
+            other => panic!("expected Unavailable for a genuine failure, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn failure_with_empty_stderr_still_yields_a_nonempty_reason() {
+        // No silent/empty degradation: even with no stderr, the reason must be a
+        // non-empty, operator-legible string.
+        match classify_label_create(false, "") {
+            LabelEnsure::Unavailable(reason) => assert!(
+                !reason.trim().is_empty(),
+                "an Unavailable classification must never carry an empty reason",
+            ),
+            other => panic!("expected Unavailable for a stderr-less failure, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn issue_create_args_include_label_when_present() {
+        // When the label is ensured, `--label ooda-stuck` is appended so the
+        // tracking issue is filed with its operator-facing label.
+        for ensured in [LabelEnsure::Created, LabelEnsure::AlreadyExists] {
+            let args = ensured.issue_create_args("t", "b");
+            assert_eq!(
+                args,
+                vec![
+                    "issue",
+                    "create",
+                    "--title",
+                    "t",
+                    "--body",
+                    "b",
+                    "--label",
+                    OODA_STUCK_LABEL
+                ],
+                "a present label must append `--label {OODA_STUCK_LABEL}`",
+            );
+        }
+    }
+
+    #[test]
+    fn issue_create_args_omit_label_but_still_file_when_unavailable() {
+        // Degraded path: the label could not be ensured, so the issue is filed
+        // WITHOUT `--label` — never silently dropped. This is the core fix for
+        // the silent broken-escalation bug (issue #4472).
+        let args = LabelEnsure::Unavailable("boom".to_string()).issue_create_args("t", "b");
+        assert_eq!(
+            args,
+            vec!["issue", "create", "--title", "t", "--body", "b"],
+            "an unavailable label must still file the issue, just without `--label`",
+        );
+    }
+}
diff --git a/src/ooda_actions/mod.rs b/src/ooda_actions/mod.rs
index 2239d3e34..2c5408506 100644
--- a/src/ooda_actions/mod.rs
+++ b/src/ooda_actions/mod.rs
@@ -10,6 +10,10 @@
 // (CLI bulk-unblock scoping) and from cross-module test modules.
 pub(crate) mod advance_goal;
 mod concurrent;
+// Idempotent `gh label` ensurer shared by the three tracking-issue filing
+// sites (issue #4472: the no-progress breaker could not file its operator-
+// facing tracking issue because `--label ooda-stuck` did not exist).
+pub(crate) mod gh_label;
 mod goal_session;
 mod session;
 mod simple_actions;
diff --git a/src/ooda_loop/no_progress.rs b/src/ooda_loop/no_progress.rs
index 3237ed5fe..5a8e3d609 100644
--- a/src/ooda_loop/no_progress.rs
+++ b/src/ooda_loop/no_progress.rs
@@ -104,19 +104,29 @@ pub(crate) struct GhIssueFiler;
 
 impl NoProgressIssueFiler for GhIssueFiler {
     fn file_issue(&self, title: &str, body: &str) -> Option<FiledIssue> {
-        match std::process::Command::new("gh")
-            .args([
-                "issue",
-                "create",
-                "--title",
-                title,
-                "--body",
-                body,
-                "--label",
-                "ooda-stuck",
-            ])
-            .output()
-        {
+        // Issue #4472: `gh issue create --label ooda-stuck` failed every cycle
+        // because the label did not exist in the repo, so the breaker recorded
+        // `escalated=1` while no issue was ever filed (silent broken escalation,
+        // journal signature `could not add label: 'ooda-stuck' not found`).
+        // Idempotently ensure the label first, degrading to an unlabeled-but-
+        // still-filed issue if it cannot be ensured.
+        use crate::ooda_actions::gh_label::{LabelEnsure, OODA_STUCK_LABEL, ensure_gh_label};
+        let label = ensure_gh_label(OODA_STUCK_LABEL);
+        match &label {
+            LabelEnsure::Created => tracing::info!(
+                target: "simard::ooda",
+                label = OODA_STUCK_LABEL,
+                "no-progress breaker: auto-created missing tracking-issue label",
+            ),
+            LabelEnsure::AlreadyExists => {}
+            LabelEnsure::Unavailable(reason) => tracing::warn!(
+                target: "simard::ooda",
+                reason = %reason,
+                "no-progress breaker: could not ensure tracking-issue label; filing issue WITHOUT label (degraded)",
+            ),
+        }
+        let gh_args = label.issue_create_args(title, body);
+        match std::process::Command::new("gh").args(&gh_args).output() {
             Ok(out) if out.status.success() => {
                 // `gh issue create` prints the created issue's URL on success,
                 // e.g. `https://github.com/rysweet/Simard/issues/4231`.