omp-conductor 0.20.0 → 0.20.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "omp-conductor",
-  "version": "0.20.0",
+  "version": "0.20.1",
   "type": "module",
   "license": "MIT",
   "description": "A 24/7 dispatcher that takes ready GitHub issues to green, mergeable PRs using omp coding sessions, with tiered escalation first to an orchestrator session and then to a human.",

package/src/admission.ts

@@ -270,7 +270,9 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  *   optional bold/heading markers) whose rest carries the paths as
  *   backtick-delimited spans (the brief form), with a bare
  *   comma/space-separated fallback that keeps tokens that look like relative
- *   paths.
+ *   paths. The paths are the *leading* backticked run: a comma/space-separated
+ *   list at the line's start, and any backticked path later on the line is
+ *   prose, not a write target (#1073).
  * - The write-lane section (#825): a markdown heading "Exact write lane" (or
  *   "Write lane" / "write-lane") whose immediately following bullet items
  *   carry the paths — the package-floor decomposition format, where a groomed
@@ -278,7 +280,9 @@ function planUsageEscalation(project: string, plan: PlanUsageStatus): Escalation
  *   the contiguous bullet run under that heading is read: a following
  *   paragraph (like a "Read only:" caveat) or a later section ends it, so
  *   read-only entry points, proof commands and acceptance bullets elsewhere in
- *   the issue are never captured.
+ *   the issue are never captured. Each bullet contributes its leading
+ *   backticked path run alone — a filename named in a bullet's prose (say, to
+ *   note that it does not exist) is prose, never a lane entry (#1073).
  *
  * Inline wins when both are present — the machine-shaped sentence has held
  * since #555, and the mediated label echo shows exactly which declaration
@@ -295,20 +299,59 @@ export function laneDeclaration(text: string): LaneDeclaration | undefined {
   return inlineLaneDeclaration(text) ?? sectionLaneDeclaration(text);
 }
 
+/** One declared surface's paths (#1073). The canonical spelling is a leading
+ *  run of backticked paths — a comma/space-separated list at the surface's
+ *  start. A backticked path later in the same surface is prose, not part of
+ *  the lane: a parenthetical like "(there is no `settle-pass.test.ts`)" is a
+ *  sentence for the reader, and reading it as a write target makes a correct
+ *  issue permanently refuse. A surface with no leading backticked path keeps
+ *  the fallback: every backticked pathlike token, else bare
+ *  comma/space-separated pathlike tokens (the unbackticked spelling). */
+function writeLanePaths(text: string): string[] {
+  const fromRun = leadingBacktickedRun(text).filter(isPathLike);
+  if (fromRun.length > 0) return fromRun;
+  const backticked = [...text.matchAll(/`([^`]+)`/g)]
+    .map((m) => m[1]!.trim())
+    .filter(isPathLike);
+  return backticked.length > 0
+    ? [...new Set(backticked)]
+    : [...new Set(text.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike))];
+}
+
+/** The leading backticked run of a surface (or bullet): consecutive
+ *  backtick-delimited tokens separated by commas or whitespace, starting at
+ *  the first character. A run is a *list*; the first non-backtick,
+ *  non-separator character ends it, so "`a.ts`, `b.ts`" yields both while
+ *  "`a.ts` — see `b.ts`" yields only `a.ts`. Empty when the surface does not
+ *  open with a backtick. */
+function leadingBacktickedRun(text: string): string[] {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith("`")) return [];
+  const run: string[] = [];
+  let pos = 0;
+  while (true) {
+    if (trimmed[pos] !== "`") break;
+    const close = trimmed.indexOf("`", pos + 1);
+    if (close < 0) break;
+    const token = trimmed.slice(pos + 1, close).trim();
+    if (token === "") break;
+    run.push(token);
+    pos = close + 1;
+    const sep = /^[,\s]+/.exec(trimmed.slice(pos));
+    if (sep === null) break;
+    pos += sep[0].length;
+  }
+  return run;
+}
+
 /** The inline `File lane:`/`File-lane=` sentence grammar (see {@link laneDeclaration}). */
 function inlineLaneDeclaration(text: string): LaneDeclaration | undefined {
   const match = text.match(
-    /^\s*(?:[#>*-]\s*)*file[- ]lane\s*[:=]\s*([^\n]*)$/im,
+    /^\s*(?:[#>*-]\s*)*file[- ]lane\s*[:=]\s*(?:(?:\*\*|\*|__|_)\s*)?([^\n]*)$/im,
   );
   if (match === null) return undefined;
   const rest = match[1] ?? "";
-  const backticked = [...rest.matchAll(/`([^`]+)`/g)]
-    .map((m) => m[1]!.trim())
-    .filter(isPathLike);
-  const files =
-    backticked.length > 0
-      ? [...new Set(backticked)]
-      : [...new Set(rest.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike))];
+  const files = writeLanePaths(rest);
   if (files.length === 0) return undefined;
   return { files, source: match[0].trim() };
 }
@@ -351,10 +394,11 @@ function sectionLaneDeclaration(text: string): LaneDeclaration | undefined {
     const marker = line.match(/^[ \t]*(?:[-*+]|\d+[.)])[ \t]+(?:\[[ xX]\][ \t]+)?/);
     if (marker === null) break;
     const rest = line.slice(marker[0].length);
-    const backticked = [...rest.matchAll(/`([^`]+)`/g)]
-      .map((m) => m[1]!.trim())
-      .filter(isPathLike);
-    files.push(...(backticked.length > 0 ? backticked : rest.split(/[,\s]+/).map((s) => s.trim()).filter(isPathLike)));
+    // One bullet contributes its leading backticked path run — what it
+    // declares it writes, not every backticked token its prose mentions.
+    // A bullet without a leading backticked path keeps the fallback
+    // (bare pathlike tokens), so unbackticked lanes are unaffected.
+    files.push(...writeLanePaths(rest));
     bullets.push(line.trim());
   }
   if (files.length === 0) return undefined;

package/src/arm-challenge.ts

@@ -5,9 +5,12 @@
  * orchestrator-workflow redesign).
  *
  * `armTicks` (fleet.ts) sends a short-lived `FLEET-…` code to the operator and
- * files the challenge here. Verification is a second, mechanical CLI step:
- * `omp-conductor arm --reply "<the operator's message>"` classifies the
- * message against these records and arms the projects the challenge named.
+ * files the challenge here. Verification classifies the operator's message
+ * against these records and arms the projects the challenge named — either
+ * mechanically in the orchestrator session, which owns the project topic the
+ * challenge is sent to (#1061), or through the CLI step
+ * `omp-conductor arm --reply "<the operator's message>"` from a console host
+ * whose DM the operator answered in.
  *
  * Nothing waits for the reply any more. The console session owns the operator
  * DM, and no tick extension runs there — so the in-session acknowledgement
@@ -498,3 +501,51 @@ export function observeArmChallenge(project: string | undefined): ArmChallengeSi
     ...(ack === undefined ? {} : { acknowledgedAt: ack.acknowledgedAt }),
   };
 }
+
+/** One expired, unsettled ceremony, with the key the notice clears it under. */
+export interface ExpiredArmChallenge {
+  /**
+   * The record's own state key — the project key or {@link FLEET_ARM_KEY} —
+   * passed straight back to {@link clearArmTransaction} after the notice, so
+   * the clear is addressed to the record that actually expired.
+   */
+  key: string;
+  /** The expired transaction's id. */
+  id: string;
+  /** The sighting, acknowledgement included when a reply was seen. */
+  sighting: ArmChallengeSighting;
+}
+
+/**
+ * Every pending challenge that is no longer a proof — the project's own record
+ * and the fleet-wide one, in the same consultation order as
+ * {@link resolveArmReply} — whose window has passed without being settled.
+ * An acknowledgement may already exist (the reply was seen but the settle
+ * never completed), which is still unsettled: the notice must name that
+ * reason, and {@link doctor} does the same. This is what lets the fleet
+ * session tell the operator a ceremony died instead of letting the record sit
+ * invisible until the next arm replaces it.
+ */
+export function expiredArmChallenges(
+  project: string | undefined,
+  now: number,
+): ExpiredArmChallenge[] {
+  const keys = projectKey(project) === FLEET_ARM_KEY ? [FLEET_ARM_KEY] : [projectKey(project), FLEET_ARM_KEY];
+  const expired: ExpiredArmChallenge[] = [];
+  for (const key of keys) {
+    const pending = readPendingFor(key);
+    if (pending === undefined || pending.expiresAt > now) continue;
+    const ack = readArmAcknowledgement(pending.id);
+    expired.push({
+      key,
+      id: pending.id,
+      sighting: {
+        id: pending.id,
+        ...(typeof pending.sentAt === "number" ? { sentAt: pending.sentAt } : {}),
+        ...(typeof pending.expiresAt === "number" ? { expiresAt: pending.expiresAt } : {}),
+        ...(ack === undefined ? {} : { acknowledgedAt: ack.acknowledgedAt }),
+      },
+    });
+  }
+  return expired;
+}

package/src/briefs/console.md

@@ -156,13 +156,18 @@ same turn — an approved answer is work to execute, not a proposal to re-open.
 
 ## Arm ceremony
 
-Ticks are gated on an operator-owned marker, and the console runs the ceremony
-that writes it. Two mechanical steps, and nothing waits anywhere:
+Ticks are gated on an operator-owned marker, and something real always owns
+the ceremony that writes it. Two mechanical halves, and nothing waits
+anywhere:
 
 1. `omp-conductor arm [--project {{PROJECT}}]` — records the challenge, sends it
-   to the operator, and returns immediately, naming the exact follow-up command.
-   It writes no marker.
-2. `omp-conductor arm --reply "<the operator's message, verbatim>" [--project
+   to the project topic (this fleet's own chat), and returns immediately,
+   naming the exact follow-up command. It writes no marker.
+2. A reply settles the ceremony. A reply sent in the project topic is consumed
+   mechanically by the orchestrator session itself — the challenge is sent to
+   the topic that session claims, so on a host with no console session the
+   ceremony still completes on its own. A reply sent here in the DM is yours:
+   `omp-conductor arm --reply "<the operator's message, verbatim>" [--project
    {{PROJECT}}]` — classifies that reply and, on a match, writes the marker for
    the targets the ceremony recorded.
 

package/src/commands/arm.ts

@@ -4,10 +4,11 @@
  * `arm` files a challenge, sends it, and returns immediately naming the
  * follow-up command. `arm --reply "<the operator's message>"` verifies that
  * message and writes the arm marker for exactly the projects the challenge
- * recorded. Nothing waits anywhere: the operator's reply lands in the console
- * session, which runs no tick extension, so the in-session acknowledgement wait
- * this replaces could never be satisfied (phase 1 of the orchestrator-workflow
- * redesign).
+ * recorded. Nothing waits anywhere: a reply sent to the project topic is
+ * consumed mechanically by the orchestrator pane itself (#1061), and this
+ * command remains the console's route for a reply that landed in the operator
+ * DM — the in-session acknowledgement wait this replaced could never be
+ * satisfied, because the console session runs no tick extension.
  *
  * Both halves print copy-pasteable commands, because the reader is usually an
  * agent in a console pane rather than a human at a prompt.
@@ -95,7 +96,8 @@ function challengeReceipt(sent: ArmChallengeSent): string {
   return (
     `CHALLENGE SENT — a code went to owner ${sent.owner}, valid for ${sent.validFor} ` +
     `(challenge ${sent.challengeId}).\n` +
-    `NOTHING IS ARMED YET. When the operator replies, run:\n` +
+    `NOTHING IS ARMED YET. A reply in the challenge's chat settles it automatically; ` +
+    `on a console host run:\n` +
     `  ${sent.followUp}\n` +
     `That reply will arm ${String(sent.targets.length)} project(s):\n` +
     sent.targets

package/src/daemon/groom-pass.ts

@@ -245,14 +245,23 @@ export async function handleToSpecGrooming(
     at: Date.now(),
   });
 
-  // The scout's answer, unjudged, through the one validator. Its report stands
-  // in when it produced no answer at all, so the refusal names what went wrong
-  // (an unresolvable role, a harness that would not start) instead of recording
-  // an empty string nobody can diagnose.
+  // The scout's answer, unjudged, through the one validator (#1064). Only the
+  // structured payload is graded: a session that produced no payload at all is
+  // its own refusal class (`no-answer`), with the narration recorded as
+  // context, and a payload recovered from the text carries its `via` marker so
+  // the record says it did not come through the yield contract. `raw: ""`
+  // therefore means "no answer", and the pass never grades `result.report` as
+  // if it were one.
   const outcome = recordToSpecGrooming(d.store, {
     project: project.name,
     issue,
-    input: result.raw === "" ? result.report : result.raw,
+    input: result.raw,
+    via: result.via === "text" ? "text" : result.raw === "" ? undefined : "yield",
+    report: result.report,
+    repaired: result.repaired,
+    killedAtCeiling: result.killedAtCeiling,
+    maxTurns: TO_SPEC_MAX_TURNS,
+    turns: result.turns,
     launchedAt: batch.launchedAt,
   });
   const ran = result.model === undefined ? "" : ` by ${result.model}`;
@@ -261,9 +270,10 @@ export async function handleToSpecGrooming(
   // stores and what the stats lane renders.
   const cost =
     result.turns > 0 && result.spendUsd === 0 ? "unmetered" : `$${result.spendUsd.toFixed(2)}`;
+  const repairNote = result.repaired === true ? " (repaired)" : "";
   log(
     `#${issue} groomed ${outcome.record.verdict}(${outcome.record.reason})${ran} in batch ${batch.id} — ` +
-      `${result.turns} turn(s), ${cost}`,
+      `${result.turns} turn(s), ${cost}${repairNote}`,
   );
   if (outcome.kind !== "persisted" || outcome.record.verdict !== "promotable") return;
   await promoteGroomedVerdict(d, outcome.record);

package/src/daemon/runtime.ts

@@ -33,7 +33,7 @@ import { reconcileOrphanedRuns } from "../settlement.ts";
 import { dbPath, openStore, utcDay } from "../store.ts";
 import { checkTelegramFreshness } from "../telegram-freshness.ts";
 import { GraphqlBreaker, makeTracker } from "../tracker/github.ts";
-import { RELEASE_SHAPES, type ProjectConfig, type ResolvedGrants, type RunRecord } from "../types.ts";
+import { RELEASE_SHAPES, type Escalation, type ProjectConfig, type ResolvedGrants, type RunRecord } from "../types.ts";
 import { runCommand } from "../upgrade-verify.ts";
 import { inspectSurfaces } from "../upgrade.ts";
 import { sharedUsageSource } from "../usage.ts";
@@ -203,6 +203,54 @@ export async function runDispatchLoop(o: DispatchLoopOptions): Promise<void> {
   }
 }
 
+/** What the daemon knows about its tier-1 orchestrator at diversion time. */
+export interface Tier1DiversionFacts {
+  /** The project's configured tier-1 transport is the external orchestrator
+   *  session: issue comments are the *configured* destination, not a
+   *  fallback. */
+  external: boolean;
+  /** Why the daemon-owned orchestrator session failed to start, when it did. */
+  startError?: string;
+  /** Whether the daemon-owned orchestrator session is alive right now
+   *  (`OrchestratorHandle.alive()` — event-driven, false once the session
+   *  exited). */
+  alive: boolean;
+  /** Whether the daemon-owned orchestrator session is mid-turn right now
+   *  (`OrchestratorHandle.busy()`). */
+  busy: boolean;
+}
+
+/**
+ * The one-line record of a tier-1 escalation that landed on the issue-comment
+ * fallback instead of the orchestrator injection (#1068).
+ *
+ * "while the orchestrator was down" is reserved for what it actually means —
+ * a session that failed to start or one that has exited. The #1062 shape was
+ * neither: the orchestrator was mid-tick, its session did not take the
+ * injection, and a reader of "diverted … while the orchestrator was down"
+ * went looking for a dead session that did not exist. When the session is
+ * alive the line says where the escalation was delivered and why it was not
+ * injected; when the project runs an external orchestrator the comments *are*
+ * the configured transport and the line says so instead of calling it a
+ * diversion.
+ */
+export function tier1DiversionLine(e: Escalation, facts: Tier1DiversionFacts): string {
+  const ref = escalationIssueRef(e.issue);
+  if (facts.external) {
+    return `orchestrator: tier-1 escalation on ${ref} posted as an issue comment (external orchestrator — the configured tier-1 transport)`;
+  }
+  if (facts.startError !== undefined || !facts.alive) {
+    return (
+      `orchestrator: tier-1 escalation on ${ref} diverted to issue comments while the orchestrator was down` +
+      (facts.startError !== undefined ? ` (start failed: ${facts.startError})` : " (session exited)")
+    );
+  }
+  return (
+    `orchestrator: tier-1 escalation on ${ref} posted as an issue comment — the orchestrator session ` +
+    `is alive but did not take the injection${facts.busy ? " (mid-turn)" : ""}`
+  );
+}
+
 export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
   // A `--once` tick is still a dispatcher: it settles rows, projects labels,
   // admits and launches workers, so it must hold the same exclusive daemon/
@@ -391,8 +439,12 @@ export async function runDaemon(o: DaemonOpts = {}): Promise<void> {
         // the outage diverted (#288).
         store.bumpOrchestratorDiverted(project.name, 1);
         projectLog(
-          `orchestrator: tier-1 escalation on ${escalationIssueRef(e.issue)} diverted to issue comments ` +
-            `while the orchestrator was down`,
+          tier1DiversionLine(e, {
+            external: project.escalation.orchestrator === "external",
+            startError: orchestratorStartError,
+            alive: orchestrator?.alive() ?? false,
+            busy: orchestrator?.busy() ?? false,
+          }),
         );
       },
     );

package/src/daemon/settle-pass.ts

@@ -16,6 +16,7 @@
  */
 import { infraLogSignature, infraSignatureVersion } from "../failure-class.ts";
 import { errText, log, safeEscalate } from "../log.ts";
+import { GhPrMissingError } from "../tracker/github.ts";
 import type { BaseHealth, RunRecord, SettlementFlag, WorkflowRun } from "../types.ts";
 import { cleanupRetainedWorktree, mirrorPathFor, type RetainedWorktreeCleanup } from "../worktree.ts";
 import { githubRepo, type Deps, type RetainedCleanupCursor } from "./deps.ts";
@@ -393,8 +394,24 @@ export async function cleanupRetainedRuns(
         terminal = issue === "closed";
       }
     } catch (err) {
-      log(`#${run.issue} retained cleanup deferred: tracker state failed (${errText(err)})`);
-      continue;
+      // The tracker throws exactly one classified error: `GhPrMissingError`,
+      // an individual REST 404 it corroborated with a same-repository
+      // pulls-list read, so the claimed PR definitively does not exist
+      // (#779). That is a fact, not "could not tell": retrying can never
+      // conjure the PR, so the missing PR is terminal and the retained row
+      // settles in this same pass like a closed one (#1065). The row's
+      // phantom URL is cleared with the settlement so a repeat pass neither
+      // asks GitHub about it again nor logs about it again. Everything else —
+      // a rate limit, a 5xx, a lost network — keeps the deferred retry below,
+      // unchanged.
+      if (err instanceof GhPrMissingError) {
+        store.updateRun(run.id, { prUrl: null });
+        log(`#${run.issue} retained cleanup settled: PR ${run.prUrl} does not exist`);
+        terminal = true;
+      } else {
+        log(`#${run.issue} retained cleanup deferred: tracker state failed (${errText(err)})`);
+        continue;
+      }
     }
     if (!terminal) continue;
 

package/src/daemon.ts

@@ -113,8 +113,8 @@ export { daemonHttpResponse, turnLimitResponse, workerControlResponse } from "./
 
 export { mineIntakeSignals, runDbSnapshotCadence, tick, upgradeVerifyDepsFor } from "./daemon/tick.ts";
 
-export type { DispatchLoopOptions, DispatchPace } from "./daemon/runtime.ts";
-export { createDispatchPace, orchestratorStandingOrders, runDaemon, runDispatchLoop } from "./daemon/runtime.ts";
+export type { DispatchLoopOptions, DispatchPace, Tier1DiversionFacts } from "./daemon/runtime.ts";
+export { createDispatchPace, orchestratorStandingOrders, runDaemon, runDispatchLoop, tier1DiversionLine } from "./daemon/runtime.ts";
 
 // ------------------------------------------------------------------- pause
 // The sentinel itself lives in `pause.ts` (#938): this module imports

package/src/diff-flags.ts

@@ -438,20 +438,125 @@ const ASSERTION =
   /^(?:await\s+)?(?:expect|assert|assert_[a-z_]+|assertEquals?|assertTrue|assertFalse|assertThat|assertRaises|assertRaisesRegex|self\.assert[A-Za-z]*|should|chai\.|t\.(?:Error|Fatal)f?|require\.[A-Z][A-Za-z]*|Expect)\s*[.(]/;
 
 /**
- * A named timeout and its value. Only a *raised* one is a finding — a brand-new
- * timeout on a new test is not a weakening — so the value is compared against
- * the same key on the pre-image side and silence is the answer whenever the key
- * appears on only one side.
+ * A named timeout and its value, but only on the test runner's own timeout
+ * surface ({@link onRunnerSurface}) — a matching key handed to the code under
+ * test is a domain parameter, not a runner deadline (#1062). Only a *raised*
+ * one is a finding — a brand-new timeout on a new test is not a weakening — so
+ * the value is compared against the same key on the pre-image side and silence
+ * is the answer whenever the key appears on only one side.
  */
 const TIMEOUT =
-  /\b(timeout|timeoutMs|timeout_ms|timeoutSeconds|deadline|maxDuration|wallClock(?:Ms)?|setTimeout|jest\.setTimeout|retries)\b\s*[:=(]\s*(\d[\d_]*)/gi;
+  /\b(timeout|timeoutMs|timeout_ms|timeoutSeconds|deadline|maxDuration|wallClock(?:Ms)?|setTimeout|jest\.setTimeout|retries)\b\s*([:=(])\s*(\d[\d_]*)/gi;
+
+/** Identifiers that name the test runner itself when a timeout-shaped key is
+ *  called on or passed to them. `t` is the test context (vitest, node:test, a
+ *  Go `*testing.T` helper); `pytest` names the Python runner module. */
+const RUNNER_BINDINGS: Record<string, true> = {
+  test: true,
+  it: true,
+  describe: true,
+  context: true,
+  suite: true,
+  bench: true,
+  jest: true,
+  t: true,
+  pytest: true,
+};
+
+/**
+ * Whether a {@link TIMEOUT} match sits on the runner's own timeout surface of
+ * its line, as opposed to an argument handed to the code under test.
+ *
+ * The audit sees hunks, not files, so the judgement is structural on the
+ * changed line alone, and anything it cannot vouch for stays silent: a flag is
+ * advisory, and a false positive costs the trust in every flag after it
+ * (measured: #614/#896 read a raised `timeoutMs` passed to `arm(...)` — the
+ * challenge window of the code under test — as a weakened test).
+ *
+ * Two positions qualify, both on the runner's own call:
+ *
+ * - the key is called on the runner — `jest.setTimeout(...)`,
+ *   `t.timeout(...)`, `test.setTimeout(...)`, `pytest.mark.timeout(...)` —
+ *   the dotted receiver before the key starts with a runner binding;
+ * - the key is a property of an object literal that is a direct argument of a
+ *   runner call — the trailing per-test configuration: `test("x", fn, {
+ *   timeout: 45_000 })`, `test.use({ retries: 3 })`,
+ *   `describe.configure({ retries: 3 })`.
+ *
+ * Everything else is the code under test: `await arm({ timeoutMs: 60_000 })`,
+ * `const opts = { timeout: 45000 }`, `server.setTimeout(30_000)`. A shape
+ * whose decisive frame is on another line — `}, { timeout: 45000 });` after a
+ * multi-line `test(` — cannot be vouched for from the line alone and also
+ * stays silent.
+ */
+function onRunnerSurface(code: string, match: RegExpMatchArray): boolean {
+  const key = match[1]?.toLowerCase() ?? "";
+  if (RUNNER_BINDINGS[key.split(".")[0] ?? ""] === true) return true;
+
+  const before = code.slice(0, match.index);
+  // The dotted receiver the key is called on: `t.timeout(5000)` reads `t.`,
+  // `pytest.mark.timeout(500)` reads `pytest.mark.`. No receiver — a bare
+  // `timeout: 5000` property — falls through to the config-object rule.
+  let at = before.length - 1;
+  while (at >= 0 && /[A-Za-z0-9_$.]/.test(before[at] ?? "")) at--;
+  const receiver = before.slice(at + 1).replace(/\.$/, "").split(".")[0];
+  if (RUNNER_BINDINGS[receiver ?? ""] === true) return true;
+
+  // A property key (`key: value`) needs the object around it to be the
+  // runner's own configuration; a `key = value` assignment or a bare
+  // `key(5000)` call on the line is never that.
+  if (match[2] !== ":") return false;
+  return inRunnerConfigObject(before);
+}
+
+type RunnerFrame = { kind: "call"; base: string | undefined } | { kind: "obj" };
+
+/** Whether the key sits in an object literal that is a direct argument of a
+ *  call on a runner binding — the trailing per-test configuration:
+ *  `test("x", fn, { timeout: 45_000 })`, `test.use({ retries: 3 })`,
+ *  `describe.configure({ retries: 3 })`. The frames are walked over the line
+ *  prefix only, with strings already stripped by {@link splitCode}, so the
+ *  object's nesting inside the call — a direct argument versus a property of
+ *  a nested object or of the callback's own body — decides the verdict. */
+function inRunnerConfigObject(before: string): boolean {
+  const frames: RunnerFrame[] = [];
+  for (let at = 0; at < before.length; at++) {
+    const ch = before[at];
+    if (ch === "(") {
+      // The dotted name the call was opened on, if any: `test.use(` reads
+      // `test.use`. No name — an arrow's parameter list, or a call on a
+      // previous call's result — means the object below it is not a runner
+      // surface.
+      let end = at;
+      while (end > 0 && /[A-Za-z0-9_$.]/.test(before[end - 1] ?? "")) end--;
+      const chain = before.slice(end, at);
+      frames.push({
+        kind: "call",
+        base: chain.length > 0 && !chain.endsWith(".") ? chain : undefined,
+      });
+      continue;
+    }
+    if (ch === "{" || ch === "[") {
+      frames.push({ kind: "obj" });
+      continue;
+    }
+    if (ch === ")" || ch === "}" || ch === "]") frames.pop();
+  }
+  const object = frames.at(-1);
+  if (object?.kind !== "obj") return false;
+  const enclosing = frames.at(-2);
+  if (enclosing?.kind !== "call") return false;
+  const firstSegment = enclosing.base?.split(".")[0];
+  return firstSegment !== undefined && RUNNER_BINDINGS[firstSegment] === true;
+}
 
 function timeouts(text: string): { key: string; value: number }[] {
   const found: { key: string; value: number }[] = [];
   for (const match of text.matchAll(TIMEOUT)) {
     const key = match[1]?.toLowerCase();
-    const raw = match[2]?.replaceAll("_", "");
+    const raw = match[3]?.replaceAll("_", "");
     if (key === undefined || raw === undefined) continue;
+    if (!onRunnerSurface(text, match)) continue;
     const value = Number(raw);
     if (Number.isSafeInteger(value)) found.push({ key, value });
   }

package/src/doctor.ts

@@ -1345,8 +1345,8 @@ function armAckProbe(probes: Probes, p: ProjectConfig): Finding {
   if (sighting.expiresAt !== undefined && now >= sighting.expiresAt) {
     return warnFinding(
       "arm-ack",
-      `[${p.name}] an arming challenge from ${window} expired without being settled — it is inert (replies past expiry are refused), but it lingers until this project's next arm replaces it`,
-      `no action needed; the next \`arm\` for this project settles it — re-run doctor afterwards to confirm`,
+      `[${p.name}] an arming challenge from ${window} expired without being settled — it is inert (replies past expiry are refused); the fleet session notifies the operator and clears it once its notice goes out, or the next arm replaces it`,
+      `the code is dead — no reply to it can arm. Re-run the ceremony: \`omp-conductor arm --project ${p.name}\``,
     );
   }
   if (sighting.acknowledgedAt !== undefined) {