diff --git a/pkg/capabilities/actions/vault/messages.pb.go b/pkg/capabilities/actions/vault/messages.pb.go
index 6b045cd96c..6bce231821 100644
--- a/pkg/capabilities/actions/vault/messages.pb.go
+++ b/pkg/capabilities/actions/vault/messages.pb.go
@@ -80,6 +80,52 @@ func (RequestType) EnumDescriptor() ([]byte, []int) {
 	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{0}
 }
 
+type PendingQueueStallSignal int32
+
+const (
+	PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_CONTINUE PendingQueueStallSignal = 0
+	PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_STALLED  PendingQueueStallSignal = 1
+)
+
+// Enum value maps for PendingQueueStallSignal.
+var (
+	PendingQueueStallSignal_name = map[int32]string{
+		0: "PENDING_QUEUE_STALL_SIGNAL_CONTINUE",
+		1: "PENDING_QUEUE_STALL_SIGNAL_STALLED",
+	}
+	PendingQueueStallSignal_value = map[string]int32{
+		"PENDING_QUEUE_STALL_SIGNAL_CONTINUE": 0,
+		"PENDING_QUEUE_STALL_SIGNAL_STALLED":  1,
+	}
+)
+
+func (x PendingQueueStallSignal) Enum() *PendingQueueStallSignal {
+	p := new(PendingQueueStallSignal)
+	*p = x
+	return p
+}
+
+func (x PendingQueueStallSignal) String() string {
+	return protoimpl.X.EnumStringOf(x.Descriptor(), protoreflect.EnumNumber(x))
+}
+
+func (PendingQueueStallSignal) Descriptor() protoreflect.EnumDescriptor {
+	return file_capabilities_actions_vault_messages_proto_enumTypes[1].Descriptor()
+}
+
+func (PendingQueueStallSignal) Type() protoreflect.EnumType {
+	return &file_capabilities_actions_vault_messages_proto_enumTypes[1]
+}
+
+func (x PendingQueueStallSignal) Number() protoreflect.EnumNumber {
+	return protoreflect.EnumNumber(x)
+}
+
+// Deprecated: Use PendingQueueStallSignal.Descriptor instead.
+func (PendingQueueStallSignal) EnumDescriptor() ([]byte, []int) {
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{1}
+}
+
 type ReportFormat int32
 
 const (
@@ -113,11 +159,11 @@ func (x ReportFormat) String() string {
 }
 
 func (ReportFormat) Descriptor() protoreflect.EnumDescriptor {
-	return file_capabilities_actions_vault_messages_proto_enumTypes[1].Descriptor()
+	return file_capabilities_actions_vault_messages_proto_enumTypes[2].Descriptor()
 }
 
 func (ReportFormat) Type() protoreflect.EnumType {
-	return &file_capabilities_actions_vault_messages_proto_enumTypes[1]
+	return &file_capabilities_actions_vault_messages_proto_enumTypes[2]
 }
 
 func (x ReportFormat) Number() protoreflect.EnumNumber {
@@ -126,7 +172,7 @@ func (x ReportFormat) Number() protoreflect.EnumNumber {
 
 // Deprecated: Use ReportFormat.Descriptor instead.
 func (ReportFormat) EnumDescriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{1}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{2}
 }
 
 type SecretIdentifier struct {
@@ -1303,6 +1349,52 @@ func (x *ListSecretIdentifiersResponse) GetRequestId() string {
 	return ""
 }
 
+// ObservationError is an item-level Err(E) contribution for a pending queue request.
+// When set on Observation, the observation is an error contribution for that request id.
+type ObservationError struct {
+	state         protoimpl.MessageState `protogen:"open.v1"`
+	Message       string                 `protobuf:"bytes,1,opt,name=message,proto3" json:"message,omitempty"`
+	unknownFields protoimpl.UnknownFields
+	sizeCache     protoimpl.SizeCache
+}
+
+func (x *ObservationError) Reset() {
+	*x = ObservationError{}
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[19]
+	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+	ms.StoreMessageInfo(mi)
+}
+
+func (x *ObservationError) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*ObservationError) ProtoMessage() {}
+
+func (x *ObservationError) ProtoReflect() protoreflect.Message {
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[19]
+	if x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use ObservationError.ProtoReflect.Descriptor instead.
+func (*ObservationError) Descriptor() ([]byte, []int) {
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{19}
+}
+
+func (x *ObservationError) GetMessage() string {
+	if x != nil {
+		return x.Message
+	}
+	return ""
+}
+
 type Observation struct {
 	state       protoimpl.MessageState `protogen:"open.v1"`
 	Id          string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
@@ -1323,13 +1415,14 @@ type Observation struct {
 	//	*Observation_DeleteSecretsResponse
 	//	*Observation_ListSecretIdentifiersResponse
 	Response      isObservation_Response `protobuf_oneof:"response"`
+	Error         *ObservationError      `protobuf:"bytes,13,opt,name=error,proto3" json:"error,omitempty"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
 
 func (x *Observation) Reset() {
 	*x = Observation{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[19]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1341,7 +1434,7 @@ func (x *Observation) String() string {
 func (*Observation) ProtoMessage() {}
 
 func (x *Observation) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[19]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1354,7 +1447,7 @@ func (x *Observation) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Observation.ProtoReflect.Descriptor instead.
 func (*Observation) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{19}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{20}
 }
 
 func (x *Observation) GetId() string {
@@ -1475,6 +1568,13 @@ func (x *Observation) GetListSecretIdentifiersResponse() *ListSecretIdentifiersR
 	return nil
 }
 
+func (x *Observation) GetError() *ObservationError {
+	if x != nil {
+		return x.Error
+	}
+	return nil
+}
+
 type isObservation_Request interface {
 	isObservation_Request()
 }
@@ -1544,17 +1644,18 @@ func (*Observation_DeleteSecretsResponse) isObservation_Response() {}
 func (*Observation_ListSecretIdentifiersResponse) isObservation_Response() {}
 
 type Observations struct {
-	state             protoimpl.MessageState `protogen:"open.v1"`
-	Observations      []*Observation         `protobuf:"bytes,1,rep,name=observations,proto3" json:"observations,omitempty"`
-	PendingQueueItems [][]byte               `protobuf:"bytes,2,rep,name=pending_queue_items,json=pendingQueueItems,proto3" json:"pending_queue_items,omitempty"`
-	SortNonce         []byte                 `protobuf:"bytes,3,opt,name=sortNonce,proto3" json:"sortNonce,omitempty"`
-	unknownFields     protoimpl.UnknownFields
-	sizeCache         protoimpl.SizeCache
+	state                   protoimpl.MessageState  `protogen:"open.v1"`
+	Observations            []*Observation          `protobuf:"bytes,1,rep,name=observations,proto3" json:"observations,omitempty"`
+	PendingQueueItems       [][]byte                `protobuf:"bytes,2,rep,name=pending_queue_items,json=pendingQueueItems,proto3" json:"pending_queue_items,omitempty"`
+	SortNonce               []byte                  `protobuf:"bytes,3,opt,name=sortNonce,proto3" json:"sortNonce,omitempty"`
+	PendingQueueStallSignal PendingQueueStallSignal `protobuf:"varint,4,opt,name=pending_queue_stall_signal,json=pendingQueueStallSignal,proto3,enum=vault.PendingQueueStallSignal" json:"pending_queue_stall_signal,omitempty"`
+	unknownFields           protoimpl.UnknownFields
+	sizeCache               protoimpl.SizeCache
 }
 
 func (x *Observations) Reset() {
 	*x = Observations{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1566,7 +1667,7 @@ func (x *Observations) String() string {
 func (*Observations) ProtoMessage() {}
 
 func (x *Observations) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[20]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1579,7 +1680,7 @@ func (x *Observations) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Observations.ProtoReflect.Descriptor instead.
 func (*Observations) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{20}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{21}
 }
 
 func (x *Observations) GetObservations() []*Observation {
@@ -1603,6 +1704,13 @@ func (x *Observations) GetSortNonce() []byte {
 	return nil
 }
 
+func (x *Observations) GetPendingQueueStallSignal() PendingQueueStallSignal {
+	if x != nil {
+		return x.PendingQueueStallSignal
+	}
+	return PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_CONTINUE
+}
+
 type Outcome struct {
 	state       protoimpl.MessageState `protogen:"open.v1"`
 	Id          string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
@@ -1629,7 +1737,7 @@ type Outcome struct {
 
 func (x *Outcome) Reset() {
 	*x = Outcome{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1641,7 +1749,7 @@ func (x *Outcome) String() string {
 func (*Outcome) ProtoMessage() {}
 
 func (x *Outcome) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[21]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1654,7 +1762,7 @@ func (x *Outcome) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Outcome.ProtoReflect.Descriptor instead.
 func (*Outcome) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{21}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{22}
 }
 
 func (x *Outcome) GetId() string {
@@ -1852,7 +1960,7 @@ type Outcomes struct {
 
 func (x *Outcomes) Reset() {
 	*x = Outcomes{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1864,7 +1972,7 @@ func (x *Outcomes) String() string {
 func (*Outcomes) ProtoMessage() {}
 
 func (x *Outcomes) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[22]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1877,7 +1985,7 @@ func (x *Outcomes) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use Outcomes.ProtoReflect.Descriptor instead.
 func (*Outcomes) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{22}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{23}
 }
 
 func (x *Outcomes) GetOutcomes() []*Outcome {
@@ -1898,7 +2006,7 @@ type ReportInfo struct {
 
 func (x *ReportInfo) Reset() {
 	*x = ReportInfo{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1910,7 +2018,7 @@ func (x *ReportInfo) String() string {
 func (*ReportInfo) ProtoMessage() {}
 
 func (x *ReportInfo) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[23]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1923,7 +2031,7 @@ func (x *ReportInfo) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportInfo.ProtoReflect.Descriptor instead.
 func (*ReportInfo) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{23}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{24}
 }
 
 func (x *ReportInfo) GetId() string {
@@ -1958,7 +2066,7 @@ type StoredSecret struct {
 
 func (x *StoredSecret) Reset() {
 	*x = StoredSecret{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -1970,7 +2078,7 @@ func (x *StoredSecret) String() string {
 func (*StoredSecret) ProtoMessage() {}
 
 func (x *StoredSecret) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[24]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1983,7 +2091,7 @@ func (x *StoredSecret) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StoredSecret.ProtoReflect.Descriptor instead.
 func (*StoredSecret) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{24}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{25}
 }
 
 func (x *StoredSecret) GetEncryptedSecret() []byte {
@@ -2004,7 +2112,7 @@ type StoredMetadata struct {
 
 func (x *StoredMetadata) Reset() {
 	*x = StoredMetadata{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2016,7 +2124,7 @@ func (x *StoredMetadata) String() string {
 func (*StoredMetadata) ProtoMessage() {}
 
 func (x *StoredMetadata) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[25]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2029,7 +2137,7 @@ func (x *StoredMetadata) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StoredMetadata.ProtoReflect.Descriptor instead.
 func (*StoredMetadata) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{25}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{26}
 }
 
 func (x *StoredMetadata) GetSecretIdentifiers() []*SecretIdentifier {
@@ -2050,7 +2158,7 @@ type StoredPendingQueueIndex struct {
 
 func (x *StoredPendingQueueIndex) Reset() {
 	*x = StoredPendingQueueIndex{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2062,7 +2170,7 @@ func (x *StoredPendingQueueIndex) String() string {
 func (*StoredPendingQueueIndex) ProtoMessage() {}
 
 func (x *StoredPendingQueueIndex) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[26]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2075,7 +2183,7 @@ func (x *StoredPendingQueueIndex) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StoredPendingQueueIndex.ProtoReflect.Descriptor instead.
 func (*StoredPendingQueueIndex) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{26}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{27}
 }
 
 func (x *StoredPendingQueueIndex) GetLength() int64 {
@@ -2097,7 +2205,7 @@ type StoredPendingQueueItem struct {
 
 func (x *StoredPendingQueueItem) Reset() {
 	*x = StoredPendingQueueItem{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2109,7 +2217,7 @@ func (x *StoredPendingQueueItem) String() string {
 func (*StoredPendingQueueItem) ProtoMessage() {}
 
 func (x *StoredPendingQueueItem) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[27]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2122,7 +2230,7 @@ func (x *StoredPendingQueueItem) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use StoredPendingQueueItem.ProtoReflect.Descriptor instead.
 func (*StoredPendingQueueItem) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{27}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{28}
 }
 
 func (x *StoredPendingQueueItem) GetItem() *anypb.Any {
@@ -2152,7 +2260,7 @@ type PendingQueueBlobItems struct {
 
 func (x *PendingQueueBlobItems) Reset() {
 	*x = PendingQueueBlobItems{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2164,7 +2272,7 @@ func (x *PendingQueueBlobItems) String() string {
 func (*PendingQueueBlobItems) ProtoMessage() {}
 
 func (x *PendingQueueBlobItems) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[28]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2177,7 +2285,7 @@ func (x *PendingQueueBlobItems) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use PendingQueueBlobItems.ProtoReflect.Descriptor instead.
 func (*PendingQueueBlobItems) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{28}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{29}
 }
 
 func (x *PendingQueueBlobItems) GetItems() []*anypb.Any {
@@ -2228,7 +2336,7 @@ type ReportingPluginConfig struct {
 
 func (x *ReportingPluginConfig) Reset() {
 	*x = ReportingPluginConfig{}
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[30]
 	ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 	ms.StoreMessageInfo(mi)
 }
@@ -2240,7 +2348,7 @@ func (x *ReportingPluginConfig) String() string {
 func (*ReportingPluginConfig) ProtoMessage() {}
 
 func (x *ReportingPluginConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[29]
+	mi := &file_capabilities_actions_vault_messages_proto_msgTypes[30]
 	if x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -2253,7 +2361,7 @@ func (x *ReportingPluginConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use ReportingPluginConfig.ProtoReflect.Descriptor instead.
 func (*ReportingPluginConfig) Descriptor() ([]byte, []int) {
-	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{29}
+	return file_capabilities_actions_vault_messages_proto_rawDescGZIP(), []int{30}
 }
 
 func (x *ReportingPluginConfig) GetBatchSize() int32 {
@@ -2463,7 +2571,9 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" +
 	"\asuccess\x18\x02 \x01(\bR\asuccess\x12\x14\n" +
 	"\x05error\x18\x03 \x01(\tR\x05error\x12\x1d\n" +
 	"\n" +
-	"request_id\x18\x04 \x01(\tR\trequestId\"\xec\a\n" +
+	"request_id\x18\x04 \x01(\tR\trequestId\",\n" +
+	"\x10ObservationError\x12\x18\n" +
+	"\amessage\x18\x01 \x01(\tR\amessage\"\x9b\b\n" +
 	"\vObservation\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x125\n" +
 	"\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" +
@@ -2477,14 +2587,16 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" +
 	"\x17update_secrets_response\x18\n" +
 	" \x01(\v2\x1c.vault.UpdateSecretsResponseH\x01R\x15updateSecretsResponse\x12V\n" +
 	"\x17delete_secrets_response\x18\v \x01(\v2\x1c.vault.DeleteSecretsResponseH\x01R\x15deleteSecretsResponse\x12o\n" +
-	" list_secret_identifiers_response\x18\f \x01(\v2$.vault.ListSecretIdentifiersResponseH\x01R\x1dlistSecretIdentifiersResponseB\t\n" +
+	" list_secret_identifiers_response\x18\f \x01(\v2$.vault.ListSecretIdentifiersResponseH\x01R\x1dlistSecretIdentifiersResponse\x12-\n" +
+	"\x05error\x18\r \x01(\v2\x17.vault.ObservationErrorR\x05errorB\t\n" +
 	"\arequestB\n" +
 	"\n" +
-	"\bresponse\"\x94\x01\n" +
+	"\bresponse\"\xf1\x01\n" +
 	"\fObservations\x126\n" +
 	"\fobservations\x18\x01 \x03(\v2\x12.vault.ObservationR\fobservations\x12.\n" +
 	"\x13pending_queue_items\x18\x02 \x03(\fR\x11pendingQueueItems\x12\x1c\n" +
-	"\tsortNonce\x18\x03 \x01(\fR\tsortNonce\"\xe8\a\n" +
+	"\tsortNonce\x18\x03 \x01(\fR\tsortNonce\x12[\n" +
+	"\x1apending_queue_stall_signal\x18\x04 \x01(\x0e2\x1e.vault.PendingQueueStallSignalR\x17pendingQueueStallSignal\"\xe8\a\n" +
 	"\aOutcome\x12\x0e\n" +
 	"\x02id\x18\x01 \x01(\tR\x02id\x125\n" +
 	"\frequest_type\x18\x02 \x01(\x0e2\x12.vault.RequestTypeR\vrequestType\x12S\n" +
@@ -2547,7 +2659,10 @@ const file_capabilities_actions_vault_messages_proto_rawDesc = "" +
 	"\x0eCREATE_SECRETS\x10\x02\x12\x12\n" +
 	"\x0eUPDATE_SECRETS\x10\x03\x12\x12\n" +
 	"\x0eDELETE_SECRETS\x10\x04\x12\x1b\n" +
-	"\x17LIST_SECRET_IDENTIFIERS\x10\x05*]\n" +
+	"\x17LIST_SECRET_IDENTIFIERS\x10\x05*j\n" +
+	"\x17PendingQueueStallSignal\x12'\n" +
+	"#PENDING_QUEUE_STALL_SIGNAL_CONTINUE\x10\x00\x12&\n" +
+	"\"PENDING_QUEUE_STALL_SIGNAL_STALLED\x10\x01*]\n" +
 	"\fReportFormat\x12\x19\n" +
 	"\x15REPORT_FORMAT_UNKNOWN\x10\x00\x12\x16\n" +
 	"\x12REPORT_FORMAT_JSON\x10\x01\x12\x1a\n" +
@@ -2565,95 +2680,99 @@ func file_capabilities_actions_vault_messages_proto_rawDescGZIP() []byte {
 	return file_capabilities_actions_vault_messages_proto_rawDescData
 }
 
-var file_capabilities_actions_vault_messages_proto_enumTypes = make([]protoimpl.EnumInfo, 2)
-var file_capabilities_actions_vault_messages_proto_msgTypes = make([]protoimpl.MessageInfo, 30)
+var file_capabilities_actions_vault_messages_proto_enumTypes = make([]protoimpl.EnumInfo, 3)
+var file_capabilities_actions_vault_messages_proto_msgTypes = make([]protoimpl.MessageInfo, 31)
 var file_capabilities_actions_vault_messages_proto_goTypes = []any{
 	(RequestType)(0),                      // 0: vault.RequestType
-	(ReportFormat)(0),                     // 1: vault.ReportFormat
-	(*SecretIdentifier)(nil),              // 2: vault.SecretIdentifier
-	(*SecretRequest)(nil),                 // 3: vault.SecretRequest
-	(*EncryptedShares)(nil),               // 4: vault.EncryptedShares
-	(*SecretData)(nil),                    // 5: vault.SecretData
-	(*SecretResponse)(nil),                // 6: vault.SecretResponse
-	(*GetSecretsRequest)(nil),             // 7: vault.GetSecretsRequest
-	(*GetSecretsResponse)(nil),            // 8: vault.GetSecretsResponse
-	(*EncryptedSecret)(nil),               // 9: vault.EncryptedSecret
-	(*CreateSecretsRequest)(nil),          // 10: vault.CreateSecretsRequest
-	(*CreateSecretResponse)(nil),          // 11: vault.CreateSecretResponse
-	(*CreateSecretsResponse)(nil),         // 12: vault.CreateSecretsResponse
-	(*UpdateSecretsRequest)(nil),          // 13: vault.UpdateSecretsRequest
-	(*UpdateSecretResponse)(nil),          // 14: vault.UpdateSecretResponse
-	(*UpdateSecretsResponse)(nil),         // 15: vault.UpdateSecretsResponse
-	(*DeleteSecretsRequest)(nil),          // 16: vault.DeleteSecretsRequest
-	(*DeleteSecretResponse)(nil),          // 17: vault.DeleteSecretResponse
-	(*DeleteSecretsResponse)(nil),         // 18: vault.DeleteSecretsResponse
-	(*ListSecretIdentifiersRequest)(nil),  // 19: vault.ListSecretIdentifiersRequest
-	(*ListSecretIdentifiersResponse)(nil), // 20: vault.ListSecretIdentifiersResponse
-	(*Observation)(nil),                   // 21: vault.Observation
-	(*Observations)(nil),                  // 22: vault.Observations
-	(*Outcome)(nil),                       // 23: vault.Outcome
-	(*Outcomes)(nil),                      // 24: vault.Outcomes
-	(*ReportInfo)(nil),                    // 25: vault.ReportInfo
-	(*StoredSecret)(nil),                  // 26: vault.StoredSecret
-	(*StoredMetadata)(nil),                // 27: vault.StoredMetadata
-	(*StoredPendingQueueIndex)(nil),       // 28: vault.StoredPendingQueueIndex
-	(*StoredPendingQueueItem)(nil),        // 29: vault.StoredPendingQueueItem
-	(*PendingQueueBlobItems)(nil),         // 30: vault.PendingQueueBlobItems
-	(*ReportingPluginConfig)(nil),         // 31: vault.ReportingPluginConfig
-	(*anypb.Any)(nil),                     // 32: google.protobuf.Any
+	(PendingQueueStallSignal)(0),          // 1: vault.PendingQueueStallSignal
+	(ReportFormat)(0),                     // 2: vault.ReportFormat
+	(*SecretIdentifier)(nil),              // 3: vault.SecretIdentifier
+	(*SecretRequest)(nil),                 // 4: vault.SecretRequest
+	(*EncryptedShares)(nil),               // 5: vault.EncryptedShares
+	(*SecretData)(nil),                    // 6: vault.SecretData
+	(*SecretResponse)(nil),                // 7: vault.SecretResponse
+	(*GetSecretsRequest)(nil),             // 8: vault.GetSecretsRequest
+	(*GetSecretsResponse)(nil),            // 9: vault.GetSecretsResponse
+	(*EncryptedSecret)(nil),               // 10: vault.EncryptedSecret
+	(*CreateSecretsRequest)(nil),          // 11: vault.CreateSecretsRequest
+	(*CreateSecretResponse)(nil),          // 12: vault.CreateSecretResponse
+	(*CreateSecretsResponse)(nil),         // 13: vault.CreateSecretsResponse
+	(*UpdateSecretsRequest)(nil),          // 14: vault.UpdateSecretsRequest
+	(*UpdateSecretResponse)(nil),          // 15: vault.UpdateSecretResponse
+	(*UpdateSecretsResponse)(nil),         // 16: vault.UpdateSecretsResponse
+	(*DeleteSecretsRequest)(nil),          // 17: vault.DeleteSecretsRequest
+	(*DeleteSecretResponse)(nil),          // 18: vault.DeleteSecretResponse
+	(*DeleteSecretsResponse)(nil),         // 19: vault.DeleteSecretsResponse
+	(*ListSecretIdentifiersRequest)(nil),  // 20: vault.ListSecretIdentifiersRequest
+	(*ListSecretIdentifiersResponse)(nil), // 21: vault.ListSecretIdentifiersResponse
+	(*ObservationError)(nil),              // 22: vault.ObservationError
+	(*Observation)(nil),                   // 23: vault.Observation
+	(*Observations)(nil),                  // 24: vault.Observations
+	(*Outcome)(nil),                       // 25: vault.Outcome
+	(*Outcomes)(nil),                      // 26: vault.Outcomes
+	(*ReportInfo)(nil),                    // 27: vault.ReportInfo
+	(*StoredSecret)(nil),                  // 28: vault.StoredSecret
+	(*StoredMetadata)(nil),                // 29: vault.StoredMetadata
+	(*StoredPendingQueueIndex)(nil),       // 30: vault.StoredPendingQueueIndex
+	(*StoredPendingQueueItem)(nil),        // 31: vault.StoredPendingQueueItem
+	(*PendingQueueBlobItems)(nil),         // 32: vault.PendingQueueBlobItems
+	(*ReportingPluginConfig)(nil),         // 33: vault.ReportingPluginConfig
+	(*anypb.Any)(nil),                     // 34: google.protobuf.Any
 }
 var file_capabilities_actions_vault_messages_proto_depIdxs = []int32{
-	2,  // 0: vault.SecretRequest.id:type_name -> vault.SecretIdentifier
-	4,  // 1: vault.SecretData.encrypted_decryption_key_shares:type_name -> vault.EncryptedShares
-	2,  // 2: vault.SecretResponse.id:type_name -> vault.SecretIdentifier
-	5,  // 3: vault.SecretResponse.data:type_name -> vault.SecretData
-	3,  // 4: vault.GetSecretsRequest.requests:type_name -> vault.SecretRequest
-	6,  // 5: vault.GetSecretsResponse.responses:type_name -> vault.SecretResponse
-	2,  // 6: vault.EncryptedSecret.id:type_name -> vault.SecretIdentifier
-	9,  // 7: vault.CreateSecretsRequest.encrypted_secrets:type_name -> vault.EncryptedSecret
-	2,  // 8: vault.CreateSecretResponse.id:type_name -> vault.SecretIdentifier
-	11, // 9: vault.CreateSecretsResponse.responses:type_name -> vault.CreateSecretResponse
-	9,  // 10: vault.UpdateSecretsRequest.encrypted_secrets:type_name -> vault.EncryptedSecret
-	2,  // 11: vault.UpdateSecretResponse.id:type_name -> vault.SecretIdentifier
-	14, // 12: vault.UpdateSecretsResponse.responses:type_name -> vault.UpdateSecretResponse
-	2,  // 13: vault.DeleteSecretsRequest.ids:type_name -> vault.SecretIdentifier
-	2,  // 14: vault.DeleteSecretResponse.id:type_name -> vault.SecretIdentifier
-	17, // 15: vault.DeleteSecretsResponse.responses:type_name -> vault.DeleteSecretResponse
-	2,  // 16: vault.ListSecretIdentifiersResponse.identifiers:type_name -> vault.SecretIdentifier
+	3,  // 0: vault.SecretRequest.id:type_name -> vault.SecretIdentifier
+	5,  // 1: vault.SecretData.encrypted_decryption_key_shares:type_name -> vault.EncryptedShares
+	3,  // 2: vault.SecretResponse.id:type_name -> vault.SecretIdentifier
+	6,  // 3: vault.SecretResponse.data:type_name -> vault.SecretData
+	4,  // 4: vault.GetSecretsRequest.requests:type_name -> vault.SecretRequest
+	7,  // 5: vault.GetSecretsResponse.responses:type_name -> vault.SecretResponse
+	3,  // 6: vault.EncryptedSecret.id:type_name -> vault.SecretIdentifier
+	10, // 7: vault.CreateSecretsRequest.encrypted_secrets:type_name -> vault.EncryptedSecret
+	3,  // 8: vault.CreateSecretResponse.id:type_name -> vault.SecretIdentifier
+	12, // 9: vault.CreateSecretsResponse.responses:type_name -> vault.CreateSecretResponse
+	10, // 10: vault.UpdateSecretsRequest.encrypted_secrets:type_name -> vault.EncryptedSecret
+	3,  // 11: vault.UpdateSecretResponse.id:type_name -> vault.SecretIdentifier
+	15, // 12: vault.UpdateSecretsResponse.responses:type_name -> vault.UpdateSecretResponse
+	3,  // 13: vault.DeleteSecretsRequest.ids:type_name -> vault.SecretIdentifier
+	3,  // 14: vault.DeleteSecretResponse.id:type_name -> vault.SecretIdentifier
+	18, // 15: vault.DeleteSecretsResponse.responses:type_name -> vault.DeleteSecretResponse
+	3,  // 16: vault.ListSecretIdentifiersResponse.identifiers:type_name -> vault.SecretIdentifier
 	0,  // 17: vault.Observation.request_type:type_name -> vault.RequestType
-	10, // 18: vault.Observation.create_secrets_request:type_name -> vault.CreateSecretsRequest
-	7,  // 19: vault.Observation.get_secrets_request:type_name -> vault.GetSecretsRequest
-	13, // 20: vault.Observation.update_secrets_request:type_name -> vault.UpdateSecretsRequest
-	16, // 21: vault.Observation.delete_secrets_request:type_name -> vault.DeleteSecretsRequest
-	19, // 22: vault.Observation.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest
-	12, // 23: vault.Observation.create_secrets_response:type_name -> vault.CreateSecretsResponse
-	8,  // 24: vault.Observation.get_secrets_response:type_name -> vault.GetSecretsResponse
-	15, // 25: vault.Observation.update_secrets_response:type_name -> vault.UpdateSecretsResponse
-	18, // 26: vault.Observation.delete_secrets_response:type_name -> vault.DeleteSecretsResponse
-	20, // 27: vault.Observation.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse
-	21, // 28: vault.Observations.observations:type_name -> vault.Observation
-	0,  // 29: vault.Outcome.request_type:type_name -> vault.RequestType
-	10, // 30: vault.Outcome.create_secrets_request:type_name -> vault.CreateSecretsRequest
-	7,  // 31: vault.Outcome.get_secrets_request:type_name -> vault.GetSecretsRequest
-	13, // 32: vault.Outcome.update_secrets_request:type_name -> vault.UpdateSecretsRequest
-	16, // 33: vault.Outcome.delete_secrets_request:type_name -> vault.DeleteSecretsRequest
-	19, // 34: vault.Outcome.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest
-	12, // 35: vault.Outcome.create_secrets_response:type_name -> vault.CreateSecretsResponse
-	8,  // 36: vault.Outcome.get_secrets_response:type_name -> vault.GetSecretsResponse
-	15, // 37: vault.Outcome.update_secrets_response:type_name -> vault.UpdateSecretsResponse
-	18, // 38: vault.Outcome.delete_secrets_response:type_name -> vault.DeleteSecretsResponse
-	20, // 39: vault.Outcome.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse
-	23, // 40: vault.Outcomes.outcomes:type_name -> vault.Outcome
-	0,  // 41: vault.ReportInfo.request_type:type_name -> vault.RequestType
-	1,  // 42: vault.ReportInfo.format:type_name -> vault.ReportFormat
-	2,  // 43: vault.StoredMetadata.secret_identifiers:type_name -> vault.SecretIdentifier
-	32, // 44: vault.StoredPendingQueueItem.item:type_name -> google.protobuf.Any
-	32, // 45: vault.PendingQueueBlobItems.items:type_name -> google.protobuf.Any
-	46, // [46:46] is the sub-list for method output_type
-	46, // [46:46] is the sub-list for method input_type
-	46, // [46:46] is the sub-list for extension type_name
-	46, // [46:46] is the sub-list for extension extendee
-	0,  // [0:46] is the sub-list for field type_name
+	11, // 18: vault.Observation.create_secrets_request:type_name -> vault.CreateSecretsRequest
+	8,  // 19: vault.Observation.get_secrets_request:type_name -> vault.GetSecretsRequest
+	14, // 20: vault.Observation.update_secrets_request:type_name -> vault.UpdateSecretsRequest
+	17, // 21: vault.Observation.delete_secrets_request:type_name -> vault.DeleteSecretsRequest
+	20, // 22: vault.Observation.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest
+	13, // 23: vault.Observation.create_secrets_response:type_name -> vault.CreateSecretsResponse
+	9,  // 24: vault.Observation.get_secrets_response:type_name -> vault.GetSecretsResponse
+	16, // 25: vault.Observation.update_secrets_response:type_name -> vault.UpdateSecretsResponse
+	19, // 26: vault.Observation.delete_secrets_response:type_name -> vault.DeleteSecretsResponse
+	21, // 27: vault.Observation.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse
+	22, // 28: vault.Observation.error:type_name -> vault.ObservationError
+	23, // 29: vault.Observations.observations:type_name -> vault.Observation
+	1,  // 30: vault.Observations.pending_queue_stall_signal:type_name -> vault.PendingQueueStallSignal
+	0,  // 31: vault.Outcome.request_type:type_name -> vault.RequestType
+	11, // 32: vault.Outcome.create_secrets_request:type_name -> vault.CreateSecretsRequest
+	8,  // 33: vault.Outcome.get_secrets_request:type_name -> vault.GetSecretsRequest
+	14, // 34: vault.Outcome.update_secrets_request:type_name -> vault.UpdateSecretsRequest
+	17, // 35: vault.Outcome.delete_secrets_request:type_name -> vault.DeleteSecretsRequest
+	20, // 36: vault.Outcome.list_secret_identifiers_request:type_name -> vault.ListSecretIdentifiersRequest
+	13, // 37: vault.Outcome.create_secrets_response:type_name -> vault.CreateSecretsResponse
+	9,  // 38: vault.Outcome.get_secrets_response:type_name -> vault.GetSecretsResponse
+	16, // 39: vault.Outcome.update_secrets_response:type_name -> vault.UpdateSecretsResponse
+	19, // 40: vault.Outcome.delete_secrets_response:type_name -> vault.DeleteSecretsResponse
+	21, // 41: vault.Outcome.list_secret_identifiers_response:type_name -> vault.ListSecretIdentifiersResponse
+	25, // 42: vault.Outcomes.outcomes:type_name -> vault.Outcome
+	0,  // 43: vault.ReportInfo.request_type:type_name -> vault.RequestType
+	2,  // 44: vault.ReportInfo.format:type_name -> vault.ReportFormat
+	3,  // 45: vault.StoredMetadata.secret_identifiers:type_name -> vault.SecretIdentifier
+	34, // 46: vault.StoredPendingQueueItem.item:type_name -> google.protobuf.Any
+	34, // 47: vault.PendingQueueBlobItems.items:type_name -> google.protobuf.Any
+	48, // [48:48] is the sub-list for method output_type
+	48, // [48:48] is the sub-list for method input_type
+	48, // [48:48] is the sub-list for extension type_name
+	48, // [48:48] is the sub-list for extension extendee
+	0,  // [0:48] is the sub-list for field type_name
 }
 
 func init() { file_capabilities_actions_vault_messages_proto_init() }
@@ -2665,7 +2784,7 @@ func file_capabilities_actions_vault_messages_proto_init() {
 		(*SecretResponse_Data)(nil),
 		(*SecretResponse_Error)(nil),
 	}
-	file_capabilities_actions_vault_messages_proto_msgTypes[19].OneofWrappers = []any{
+	file_capabilities_actions_vault_messages_proto_msgTypes[20].OneofWrappers = []any{
 		(*Observation_CreateSecretsRequest)(nil),
 		(*Observation_GetSecretsRequest)(nil),
 		(*Observation_UpdateSecretsRequest)(nil),
@@ -2677,7 +2796,7 @@ func file_capabilities_actions_vault_messages_proto_init() {
 		(*Observation_DeleteSecretsResponse)(nil),
 		(*Observation_ListSecretIdentifiersResponse)(nil),
 	}
-	file_capabilities_actions_vault_messages_proto_msgTypes[21].OneofWrappers = []any{
+	file_capabilities_actions_vault_messages_proto_msgTypes[22].OneofWrappers = []any{
 		(*Outcome_CreateSecretsRequest)(nil),
 		(*Outcome_GetSecretsRequest)(nil),
 		(*Outcome_UpdateSecretsRequest)(nil),
@@ -2689,14 +2808,14 @@ func file_capabilities_actions_vault_messages_proto_init() {
 		(*Outcome_DeleteSecretsResponse)(nil),
 		(*Outcome_ListSecretIdentifiersResponse)(nil),
 	}
-	file_capabilities_actions_vault_messages_proto_msgTypes[29].OneofWrappers = []any{}
+	file_capabilities_actions_vault_messages_proto_msgTypes[30].OneofWrappers = []any{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: unsafe.Slice(unsafe.StringData(file_capabilities_actions_vault_messages_proto_rawDesc), len(file_capabilities_actions_vault_messages_proto_rawDesc)),
-			NumEnums:      2,
-			NumMessages:   30,
+			NumEnums:      3,
+			NumMessages:   31,
 			NumExtensions: 0,
 			NumServices:   0,
 		},
diff --git a/pkg/capabilities/actions/vault/messages.proto b/pkg/capabilities/actions/vault/messages.proto
index eea17f82c7..b83f487ee3 100644
--- a/pkg/capabilities/actions/vault/messages.proto
+++ b/pkg/capabilities/actions/vault/messages.proto
@@ -130,6 +130,12 @@ enum RequestType {
   LIST_SECRET_IDENTIFIERS = 5;
 }
 
+// ObservationError is an item-level Err(E) contribution for a pending queue request.
+// When set on Observation, the observation is an error contribution for that request id.
+message ObservationError {
+  string message = 1;
+}
+
 message Observation {
   string id = 1;
   RequestType request_type = 2;
@@ -149,12 +155,20 @@ message Observation {
     DeleteSecretsResponse delete_secrets_response = 11;
     ListSecretIdentifiersResponse list_secret_identifiers_response = 12;
   }
+
+  ObservationError error = 13;
+}
+
+enum PendingQueueStallSignal {
+  PENDING_QUEUE_STALL_SIGNAL_CONTINUE = 0;
+  PENDING_QUEUE_STALL_SIGNAL_STALLED = 1;
 }
 
 message Observations {
   repeated Observation observations = 1;
   repeated bytes pending_queue_items = 2;
   bytes sortNonce = 3;
+  PendingQueueStallSignal pending_queue_stall_signal = 4;
 }
 
 message Outcome {
diff --git a/pkg/capabilities/actions/vault/messages_test.go b/pkg/capabilities/actions/vault/messages_test.go
new file mode 100644
index 0000000000..78dd7e1c52
--- /dev/null
+++ b/pkg/capabilities/actions/vault/messages_test.go
@@ -0,0 +1,84 @@
+package vault
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+	"google.golang.org/protobuf/proto"
+)
+
+func TestObservationErrorField_SHAStableForOkObservations(t *testing.T) {
+	t.Parallel()
+
+	obs := &Observation{
+		Id:          "request-1",
+		RequestType: RequestType_DELETE_SECRETS,
+		Response: &Observation_DeleteSecretsResponse{
+			DeleteSecretsResponse: &DeleteSecretsResponse{
+				Responses: []*DeleteSecretResponse{{Success: false}},
+			},
+		},
+	}
+
+	before, err := proto.MarshalOptions{Deterministic: true}.Marshal(obs)
+	require.NoError(t, err)
+
+	roundTrip := &Observation{}
+	require.NoError(t, proto.Unmarshal(before, roundTrip))
+	require.Nil(t, roundTrip.GetError())
+
+	after, err := proto.MarshalOptions{Deterministic: true}.Marshal(roundTrip)
+	require.NoError(t, err)
+	require.Equal(t, before, after)
+}
+
+func TestObservationErrorField_RoundTrip(t *testing.T) {
+	t.Parallel()
+
+	obs := &Observation{
+		Id:          "request-1",
+		RequestType: RequestType_CREATE_SECRETS,
+		Error: &ObservationError{
+			Message: "request is not valid",
+		},
+	}
+
+	b, err := proto.MarshalOptions{Deterministic: true}.Marshal(obs)
+	require.NoError(t, err)
+
+	out := &Observation{}
+	require.NoError(t, proto.Unmarshal(b, out))
+	require.Equal(t, "request is not valid", out.GetError().GetMessage())
+	require.Nil(t, out.GetCreateSecretsResponse())
+}
+
+func TestPendingQueueStallSignal_DefaultIsWireStable(t *testing.T) {
+	t.Parallel()
+
+	obs := &Observations{SortNonce: make([]byte, 32)}
+	before, err := proto.MarshalOptions{Deterministic: true}.Marshal(obs)
+	require.NoError(t, err)
+
+	roundTrip := &Observations{}
+	require.NoError(t, proto.Unmarshal(before, roundTrip))
+	require.Equal(t, PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_CONTINUE, roundTrip.GetPendingQueueStallSignal())
+
+	after, err := proto.MarshalOptions{Deterministic: true}.Marshal(roundTrip)
+	require.NoError(t, err)
+	require.Equal(t, before, after)
+}
+
+func TestPendingQueueStallSignal_RoundTrip(t *testing.T) {
+	t.Parallel()
+
+	obs := &Observations{
+		SortNonce:               make([]byte, 32),
+		PendingQueueStallSignal: PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_STALLED,
+	}
+	b, err := proto.MarshalOptions{Deterministic: true}.Marshal(obs)
+	require.NoError(t, err)
+
+	out := &Observations{}
+	require.NoError(t, proto.Unmarshal(b, out))
+	require.Equal(t, PendingQueueStallSignal_PENDING_QUEUE_STALL_SIGNAL_STALLED, out.GetPendingQueueStallSignal())
+}
diff --git a/pkg/settings/cresettings/README.md b/pkg/settings/cresettings/README.md
index 880a8972c1..badcf8187c 100644
--- a/pkg/settings/cresettings/README.md
+++ b/pkg/settings/cresettings/README.md
@@ -49,6 +49,9 @@ flowchart
         VaultGetSecretsShareAggregationIncludesPublicKeys[/VaultGetSecretsShareAggregationIncludesPublicKeys\]:::gate
         VaultOwnerAddressCanonicalizationEnabled[/VaultOwnerAddressCanonicalizationEnabled\]:::gate
         VaultJSONOmitUnpopulatedEnabled[/VaultJSONOmitUnpopulatedEnabled\]:::gate
+        VaultGetSecretsRelaxedConsensusEnabled[/VaultGetSecretsRelaxedConsensusEnabled\]:::gate
+        VaultIncludeInvalidPendingItemsEnabled[/VaultIncludeInvalidPendingItemsEnabled\]:::gate
+        VaultPendingQueueStallThreshold{{VaultPendingQueueStallThreshold}}:::bound
         VaultSignedResponseRequestIDEnabled[/VaultSignedResponseRequestIDEnabled\]:::gate
     end
 
diff --git a/pkg/settings/cresettings/defaults.json b/pkg/settings/cresettings/defaults.json
index b8e3bc3d08..0a94f5f3bd 100644
--- a/pkg/settings/cresettings/defaults.json
+++ b/pkg/settings/cresettings/defaults.json
@@ -14,6 +14,9 @@
 	"VaultGetSecretsShareAggregationIncludesPublicKeys": "false",
 	"VaultOwnerAddressCanonicalizationEnabled": "false",
 	"VaultJSONOmitUnpopulatedEnabled": "false",
+	"VaultGetSecretsRelaxedConsensusEnabled": "false",
+	"VaultIncludeInvalidPendingItemsEnabled": "false",
+	"VaultPendingQueueStallThreshold": "0",
 	"VaultSignedResponseRequestIDEnabled": "false",
 	"GatewayHTTPGlobalRate": "500rps:500",
 	"GatewayHTTPPerNodeRate": "100rps:100",
diff --git a/pkg/settings/cresettings/defaults.toml b/pkg/settings/cresettings/defaults.toml
index 49eb4c4569..9697f67b3f 100644
--- a/pkg/settings/cresettings/defaults.toml
+++ b/pkg/settings/cresettings/defaults.toml
@@ -13,6 +13,9 @@ VaultOptimizationsEnabled = 'false'
 VaultGetSecretsShareAggregationIncludesPublicKeys = 'false'
 VaultOwnerAddressCanonicalizationEnabled = 'false'
 VaultJSONOmitUnpopulatedEnabled = 'false'
+VaultGetSecretsRelaxedConsensusEnabled = 'false'
+VaultIncludeInvalidPendingItemsEnabled = 'false'
+VaultPendingQueueStallThreshold = '0'
 VaultSignedResponseRequestIDEnabled = 'false'
 GatewayHTTPGlobalRate = '500rps:500'
 GatewayHTTPPerNodeRate = '100rps:100'
diff --git a/pkg/settings/cresettings/settings.go b/pkg/settings/cresettings/settings.go
index 8bef11f198..dd1196d937 100644
--- a/pkg/settings/cresettings/settings.go
+++ b/pkg/settings/cresettings/settings.go
@@ -68,6 +68,9 @@ var Default = Schema{
 	VaultGetSecretsShareAggregationIncludesPublicKeys: Bool(false),
 	VaultOwnerAddressCanonicalizationEnabled:          Bool(false),
 	VaultJSONOmitUnpopulatedEnabled:                   Bool(false),
+	VaultGetSecretsRelaxedConsensusEnabled:            Bool(false),
+	VaultIncludeInvalidPendingItemsEnabled:            Bool(false),
+	VaultPendingQueueStallThreshold:                   Int(0),
 	VaultSignedResponseRequestIDEnabled:               Bool(false),
 	GatewayHTTPGlobalRate:                             Rate(rate.Limit(500), 500),
 	GatewayHTTPPerNodeRate:                            Rate(rate.Limit(100), 100),
@@ -327,6 +330,9 @@ type Schema struct {
 	VaultGetSecretsShareAggregationIncludesPublicKeys Setting[bool]
 	VaultOwnerAddressCanonicalizationEnabled          Setting[bool]
 	VaultJSONOmitUnpopulatedEnabled                   Setting[bool]
+	VaultGetSecretsRelaxedConsensusEnabled            Setting[bool]
+	VaultIncludeInvalidPendingItemsEnabled            Setting[bool]
+	VaultPendingQueueStallThreshold                   Setting[int] `unit:"{observation}"`
 	VaultSignedResponseRequestIDEnabled               Setting[bool]
 	GatewayHTTPGlobalRate                             Setting[config.Rate]
 	GatewayHTTPPerNodeRate                            Setting[config.Rate]
diff --git a/pkg/settings/cresettings/settings_test.go b/pkg/settings/cresettings/settings_test.go
index 8865f0cbd0..83037b683f 100644
--- a/pkg/settings/cresettings/settings_test.go
+++ b/pkg/settings/cresettings/settings_test.go
@@ -138,6 +138,9 @@ func TestSchema_Unmarshal(t *testing.T) {
 	assert.False(t, cfg.VaultGetSecretsShareAggregationIncludesPublicKeys.DefaultValue)
 	assert.False(t, cfg.VaultOwnerAddressCanonicalizationEnabled.DefaultValue)
 	assert.False(t, cfg.VaultJSONOmitUnpopulatedEnabled.DefaultValue)
+	assert.False(t, cfg.VaultGetSecretsRelaxedConsensusEnabled.DefaultValue)
+	assert.False(t, cfg.VaultIncludeInvalidPendingItemsEnabled.DefaultValue)
+	assert.Equal(t, 0, cfg.VaultPendingQueueStallThreshold.DefaultValue)
 	assert.False(t, cfg.VaultSignedResponseRequestIDEnabled.DefaultValue)
 	assert.Equal(t, config.Rate{Limit: rate.Limit(20), Burst: 7}, cfg.GatewayConfidentialRelayGlobalRate.DefaultValue)
 	assert.Equal(t, config.Rate{Limit: rate.Limit(4), Burst: 2}, cfg.GatewayConfidentialRelayPerNodeRate.DefaultValue)