omp-conductor 0.20.1 → 0.20.3

package/src/daemon/tick.ts

@@ -22,7 +22,7 @@ import { admitCandidates, startOfToday, type AdmissionHold } from "../admission.
 import { dbBackupDirFor, findProject, loadConfig, resolveCaps, stateDir } from "../config.ts";
 import { evaluateDecisionConditions, probeNpmVersion, probeRateLimitReset } from "../decisions.ts";
 import { dbSnapshotDue, dbSnapshotMarkerKey, localDayKey } from "../digest-schedule.ts";
-import { runDoctor } from "../doctor.ts";
+import { reconcileOrphanedPause, runDoctor } from "../doctor.ts";
 import { fleetLayers, herdrPaneOmpStarts, resolveHerdrSession } from "../fleet.ts";
 import { projectLabels } from "../label-projection.ts";
 import { healthCheck } from "../lifecycle.ts";
@@ -42,13 +42,13 @@ import { writeAdmissionAck } from "./ack.ts";
 import { dispatchAdmissions, summarizeDispatch, summarizeHeldPass, type WorkerPool } from "./admission-pass.ts";
 import { NO_ISSUE, PACKAGE_SRC_DIR, UNROUTABLE_TEXT, type Deps } from "./deps.ts";
 import { handleIssue } from "./dispatch.ts";
-import { cancelDrain, consumeDrain } from "./drain.ts";
+import { consumeDrain, markDrained } from "./drain.ts";
 import { dispatchToSpecGrooming } from "./groom-pass.ts";
 import { INTEGRITY_SAMPLE, checkIntegrity, markPaged, packageManifest } from "./integrity.ts";
 import { reconcilePanes } from "./panes.ts";
 import { applyAdjudicationDispositions, dispatchReviewAdjudications, dispatchReviewRevisions } from "./review.ts";
 import { cleanupRetainedRuns, watchBaseHealth, watchMergedBase } from "./settle-pass.ts";
-import { wakeOrchestratorForMetConditions, watchOrchestrator } from "./supervision.ts";
+import { wakeOrchestratorForMetConditions, watchOrchestrator, watchWorkerProgress } from "./supervision.ts";
 
 /**
  * Record what this host has installed, once per dispatch pass (#919).
@@ -388,6 +388,16 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // failure happened. A pause silences claiming, not the operator's right to
   // know their supervising session stopped reading its queue.
   await watchOrchestrator(d);
+  // The worker-side sibling, and above the pause gate with it: a stalled run
+  // holds its slot on a parked fleet exactly as hard as on a busy one, and the
+  // #1086 incident was an upgrade drain blocked for 26 minutes by one silent
+  // session. Paused workers are skipped inside the pass — their silence is
+  // the pause working (#938) — so this gate costs nothing there.
+  try {
+    await watchWorkerProgress(d);
+  } catch (err) {
+    log(`worker-progress sweep failed: ${errText(err)}`);
+  }
   // The down incident is reconciled the same place and for the same reason: a
   // session that has actually died is as much the operator's concern as one
   // that is wedged, and restarting it is the daemon's restart either way. This
@@ -400,6 +410,20 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
     escalate: (event) => d.escalate(event),
     log,
   });
+  // The orphaned-pause watch rides the same above-the-pause-gate band (#1113):
+  // a sentinel whose writer has exited is exactly the condition a paused
+  // fleet cannot surface through its own gates below, and an `upgrade` pause
+  // can never be cleared by any future event. The notification ledger dedupes
+  // the page to once per sentinel instance; resuming stays a human decision.
+  try {
+    await reconcileOrphanedPause({
+      project: d.project.name,
+      escalate: (event) => d.escalate(event),
+      log,
+    });
+  } catch (err) {
+    log(`orphaned-pause watch failed: ${errText(err)}`);
+  }
 
   // Beside the two orchestrator watches, and above the pause gate, for the same
   // reason they are: mining reads rows this store already holds and files intake
@@ -584,11 +608,16 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   // the same admission boundary — settlement above it, nothing claimed below —
   // but the intent is durable (it survives orchestrator loss) and bounded (the
   // record carries an absolute deadline, so a crash can never strand
-  // admission). Three shapes, three behaviours:
+  // admission). Reaching an empty active set SUCCEEDS the drain; it does not
+  // end it (#1078): the release window the drain exists to create opens at
+  // that moment and holds claims down until the deadline — exactly the quiet
+  // interval a tick-driven orchestrator needs to cut a release, which the old
+  // eight-second auto-clear destroyed before any tick could use it. Four
+  // shapes, four behaviours:
   //   - fresh drain with live runs → a held pass, exactly like a pause;
-  //   - fresh drain with nothing left to wait for → the drain is satisfied
-  //     and clears itself, so a completed drain never needs a second operator
-  //     action and this pass proceeds normally;
+  //   - fresh drain whose active set just reached zero → the opening is marked
+  //     on the record once and logged once, and this pass admits nothing;
+  //   - fresh drain already marked drained → the same held pass, silent;
   //   - malformed record → fails closed for THIS pass (it might be a fresh
   //     fence we cannot read), and the same consume removed it, so it can
   //     never become an unbounded permanent drain.
@@ -596,15 +625,17 @@ export async function tick(d: Deps, workers?: WorkerPool): Promise<void> {
   if (drain.kind === "active") {
     // Completion is the ACTIVE set, not the live-worker set: pushed-pending
     // and pushed-green PRs still make the `runs-settled` release gate fail, so
-    // a drain that cleared while one remained would admit work on top of a
-    // batch the releases still see as unfinished (#776 review #2).
-    if (d.store.activeRuns(d.project.name).length === 0) {
-      cancelDrain(d.project.name);
-      log("project drain completed: no active runs remain — drain cleared");
-    } else {
-      d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
-      return;
+    // a window declared open over a remaining run would admit work on top of
+    // a batch the releases still see as unfinished (#776 review #2).
+    if (d.store.activeRuns(d.project.name).length === 0 && drain.drain.drainedAt === undefined) {
+      markDrained(d.project.name);
+      log(
+        `project drain: fleet drained — release window open until ${drain.drain.expiresAt}` +
+          " (claims stay paused; admission resumes at the deadline or on drain cancel)",
+      );
     }
+    d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));
+    return;
   } else if (drain.kind === "error") {
     log(`project drain record invalid (${drain.problem}) — removed; this pass admits nothing`);
     d.store.recordDispatch(d.project.name, summarizeHeldPass(settled));

package/src/daemon/views.ts

@@ -23,6 +23,7 @@ import { availabilityState, type AvailabilityState } from "../availability.ts";
 import { configPath, findProject, loadConfig, resolveCaps, resolveReleaseGrants, resolveReview, stateDir } from "../config.ts";
 import { digestScheduleState, type DigestScheduleState } from "../digest-schedule.ts";
 import { SPEND_SAMPLE_ROWS, SPEND_SAMPLE_RUNS } from "../doctor.ts";
+import { EFFECTIVE_BUDGET_SAMPLE_RUNS, observeTurnBudget, type ObservedTurnBudget } from "../failure-class.ts";
 import type { CodeGraphHealth } from "../graph-health.ts";
 import { isPaused, pauseProvenance, setPaused } from "../pause.ts";
 import { branchName, route } from "../routing.ts";
@@ -189,6 +190,11 @@ export interface StatusSnapshot {
    */
   reporting?: ReportingSummary;
   caps: Caps;
+  /** #1063: the turn count the wall-clock ceiling actually buys at this
+   *  project's observed per-turn latency, with the sample it was derived
+   *  from. Absent when no qualifying completed run exists — never derived
+   *  from the configured constants, whose ratio is a constant. */
+  workerTurnBudgetObserved?: ObservedTurnBudget;
   /**
    * The effective per-shape release grants. On the snapshot rather than re-read
    * by each renderer because #122 began with a grant nobody had looked at in
@@ -552,6 +558,17 @@ export function statusSnapshotFromStore(
       const observed = store.installSurfaces();
       return observed === undefined ? {} : { installSurfaces: observed };
     })(),
+    // #1063, the same read-not-probe discipline as the spend judgement above:
+    // derived from completed-run rows on this read, never probed at render
+    // time. The renderer decides whether the figure is materially lower.
+    ...(() => {
+      const budget = observeTurnBudget(
+        store.recentLatencySamples(p.name, EFFECTIVE_BUDGET_SAMPLE_RUNS),
+        caps,
+        p.workerModel,
+      );
+      return budget === undefined ? {} : { workerTurnBudgetObserved: budget };
+    })(),
     ...(dispatch === undefined ? {} : { dispatch }),
     ...(planUsage === undefined ? {} : { planUsage }),
     // Written by the tracker's hooks rather than polled, so the renderer does

package/src/daemon.ts

@@ -34,7 +34,7 @@ export type {
 export { completionLastError, exhaustedSessionReason, verbDeps } from "./daemon/deps.ts";
 
 export type { CreateDrainOptions, DrainProblem, DrainRecord, DrainVerdict } from "./daemon/drain.ts";
-export { cancelDrain, consumeDrain, createDrain, drainPath, readDrain } from "./daemon/drain.ts";
+export { cancelDrain, consumeDrain, createDrain, drainPath, markDrained, readDrain } from "./daemon/drain.ts";
 
 export type { AdmissionAckRecord } from "./daemon/ack.ts";
 export { admissionAckPath, daemonGeneration, readAdmissionAck, wakeDaemon, writeAdmissionAck } from "./daemon/ack.ts";
@@ -52,6 +52,7 @@ export {
   wakeOrchestratorForBlockedRun,
   wakeOrchestratorForMetConditions,
   watchOrchestrator,
+  watchWorkerProgress,
 } from "./daemon/supervision.ts";
 
 export { reconcilePanes } from "./daemon/panes.ts";

package/src/decisions.ts

@@ -45,26 +45,35 @@ const NPM_SPEC = /^(@[^/@\s]+\/)?[^@\s]+@[^\s]+$/;
 const GREEN_CHECK_STATES: Record<string, true> = { success: true, neutral: true };
 
 /**
- * The run states a review revision may start from (#795) — the single
+ * The run states a review revision may start from (#795, #1101) — the single
  * definition shared by `conductor_pr_review` and the `pr-review-ready` watch,
  * so the verb's gate and the condition can never name different sets.
  *
  * A revision round resumes the exact run whose row owns the PR, so the
- * revisable states are exactly the terminal runs that pushed one: a settled
- * `pushed-green` row, or a `failed` / `killed` row — a run that capped or
- * failed *after* pushing a green PR. The PR is the durable artefact, the
- * exact-head green verification is the gate on "green at the reviewed SHA",
- * and a terminal row proves no worker is in flight, so findings are returned
+ * revisable states are exactly the terminal runs that own the named PR: a
+ * settled `pushed-green` row, a `failed` / `killed` row — a run that capped or
+ * failed *after* pushing a green PR — and, since #1101, a `stopped` row that
+ * pushed one. Ownership is not carried by the state alone: selection runs
+ * through `runsForProjectPr`, so only a row that itself recorded the reviewed
+ * PR can ever reach this gate. The PR is the durable artefact, the exact-head
+ * green verification is the gate on "green at the reviewed SHA", and a
+ * terminal row proves no worker is in flight, so findings are returned
  * without the close-PR → unblock → continuation dance.
  *
+ * A `stopped` row has no settle sweep keeping it honest (nothing transitions a
+ * stopped row when its PR merges or closes), so like `failed` / `killed` its
+ * rounds re-read PR-open and green-at-head decisively before the claim — the
+ * dispatch pass refuses to wake a worker against a dead or moved PR.
+ *
  * Closed on purpose: a live row (`running` / `claimed`) is already doing its
  * own work, a `pushed-pending` PR is not green yet, and a `blocked` /
- * `orphaned` / `stopped` / `merged` row is not work returned for revision.
+ * `orphaned` / `merged` row is not work returned for revision.
  */
 export const REVISABLE_RUN_STATES: Record<string, true> = {
   "pushed-green": true,
   failed: true,
   killed: true,
+  stopped: true,
 };
 
 /**
@@ -92,8 +101,10 @@ export const PR_LOOKUP_WINDOW_MS = 30 * 24 * 60 * 60_000;
  * `running`, and a watch keyed only to checks woke the orchestrator before
  * `conductor_pr_review` was actionable), `pushed-pending` checks are still
  * settling, `blocked` may resume, `orphaned` is reconciled back to live at
- * startup, and `merged` means the PR lifecycle is over. When every row is
- * `stopped`, the newest one answers and the predicate fails closed.
+ * startup, and `merged` means the PR lifecycle is over. When every row of the
+ * history is `stopped`, the newest one answers — and since #1101 it answers
+ * `ready` when it owns the named PR: stopping a worker that had already pushed
+ * must leave the PR reviewable rather than stranded.
  *
  * `no-owner` and `not-revisable` both fail closed: a review can never act, so
  * a watch must not wake, even when the checks are green.

package/src/diff-flags.ts

@@ -37,7 +37,7 @@
  * repository.
  */
 
-import type { FileLane, PrDiff, PrDiffFile, SettlementFlag } from "./types.ts";
+import type { FileLane, PrDiff, PrDiffFile, SettlementFlag, SettlementFlagKind } from "./types.ts";
 
 // ------------------------------------------------------------------ diff parse
 
@@ -657,21 +657,24 @@ export const UNREADABLE_TREE_FLAG: SettlementFlag = {
 
 /**
  * Whether a diff path counts as inside the declared lane: an explicitly
- * declared path, or the co-located test of one — `foo.ts` vouches for
- * `foo.test.ts`, which is the "obviously intended" case. Other test shapes
- * (`.spec.ts`, pytest's `test_` prefix) are not vouched for: the rule is the
- * shape the fleet actually uses, and a lane that wants a differently-shaped
- * sibling declares it. Deliberately one-directional: a lane that declares a
- * *test* file does not vouch for its source, because declaring the test alone
- * is a narrower promise and widening it silently is exactly what this flag
- * exists to name. A containing directory never vouches for its contents
- * either — the lane grammar names files, and a lane that means "everything
- * under `src/`" fails open exactly as an undeclared one would if it cannot
- * name them.
+ * declared path, the co-located test of one, or a descendant of a declared
+ * directory (#1091) — admission's grammar accepts a trailing-`/` entry
+ * ("everything under `src/`"), so settlement honours the same contract rather
+ * than narrowing it back to exact files. The co-located allowance is the
+ * "obviously intended" case: `foo.ts` vouches for `foo.test.ts`. Other test
+ * shapes (`.spec.ts`, pytest's `test_` prefix) are not vouched for: the rule
+ * is the shape the fleet actually uses, and a lane that wants a
+ * differently-shaped sibling declares it. Deliberately one-directional: a lane
+ * that declares a *test* file does not vouch for its source, because declaring
+ * the test alone is a narrower promise and widening it silently is exactly
+ * what this flag exists to name. The directory rule keeps its trailing-slash
+ * boundary explicit: the entry already carries the separator, so `foo/`
+ * covers `foo/bar.ts` at any depth and can never vouch for `foobar/x.ts`.
  */
 function withinLane(path: string, declared: readonly string[]): boolean {
   if (declared.includes(path)) return true;
   for (const d of declared) {
+    if (d.endsWith("/") && path.startsWith(d)) return true;
     if (coLocatedTest(d) === path) return true;
   }
   return false;
@@ -693,11 +696,22 @@ function coLocatedTest(declared: string): string | undefined {
  * The lane is the effective declaration admission resolved at dispatch —
  * `effectiveLane(body, comments)`, so a pre-dispatch comment beats an older
  * body declaration — and the flag uses that resolved snapshot, never a re-parse
- * of the body. The finding names every delivered file outside it, which is the
+ * of the body. Each finding names the delivered files outside it, which is the
  * part a reviewer is worst placed to notice: the diff's own file list is the
  * only surface that shows the escape, and reading PR file lists by hand is
  * exactly what nothing else in the loop does.
  *
+ * An escape splits into up to two findings because it is up to two different
+ * events (#1096): an undeclared production module is scope escaping into code,
+ * while an undeclared test file is usually coverage arriving beside the
+ * behaviour it pins — the #1064/#1080 shape, required work the declaration
+ * could not have named. Naming the class on each finding keeps the second
+ * readable as what it usually is without letting it disguise the first. The
+ * declared source's own `.test` twin is admitted by {@link withinLane}, so
+ * the obvious case raises nothing — and the rule stays one-directional, so a
+ * lane declaring only the test still names its source when the worker edits
+ * it.
+ *
  * Fail-open, like admission: an issue with no lane declaration has nothing to
  * escape, so no flag — a flag on every undeclared run would be noise within a
  * day, worse than no flag. Advisory like every other flag here: a widened lane
@@ -710,11 +724,23 @@ function detectLaneEscape(audit: SettlementAudit, flags: SettlementFlag[]): void
     .map((f) => f.path)
     .filter((path) => !withinLane(path, lane.files));
   if (outside.length === 0) return;
-  flags.push({
-    kind: "lane-escape",
-    file: "(lane)",
-    detail: `PR diff touches files outside the declared file lane: ${outside.join(", ")}`,
-  });
+  // Production first: the rarer, heavier event leads the report block.
+  const production = outside.filter((path) => !isTestPath(path));
+  const otherTests = outside.filter((path) => isTestPath(path));
+  if (production.length > 0) {
+    flags.push({
+      kind: "lane-escape",
+      file: "(lane)",
+      detail: `PR diff touches production files outside the declared file lane: ${production.join(", ")}`,
+    });
+  }
+  if (otherTests.length > 0) {
+    flags.push({
+      kind: "lane-escape",
+      file: "(lane)",
+      detail: `PR diff touches unrelated test files outside the declared file lane: ${otherTests.join(", ")}`,
+    });
+  }
 }
 
 function detectWeakening(audit: SettlementAudit, flags: SettlementFlag[]): void {
@@ -872,7 +898,7 @@ function scanHunks(
  * an extractor that reads any backtick span in the narrative as a claim would
  * flag every run within a day.
  *
- * Three tolerances make the matcher honest rather than decorative:
+ * Four tolerances make the matcher honest rather than decorative:
  *
  * - Claims are extracted only from a verified section — a `## Verified`-style
  *   heading or an inline `Verified:` label — never from the narrative. This is
@@ -889,6 +915,14 @@ function scanHunks(
  *   the worker *tried* and the guard stopped it (the honest #566/#570 shape,
  *   whose own words are "CI owns them"), which is not the same finding as a
  *   claim with no attempt at all.
+ * - Claims are positions before they are texts (#1102): a unit of the region
+ *   claims what it opens with — a bullet or bare line whose lead is the
+ *   backticked command, or a `**Verified:**` label declaring its whole row —
+ *   never a span quoted mid-sentence. The soft-wrapped prose that quoted
+ *   `issue is closed` inside #1097's Verified bullet is commentary whatever
+ *   words it quotes, and the structural rule says so without a runner
+ *   vocabulary that would silently stop auditing the first PR proved by
+ *   anything else.
  */
 
 /** The verified-section markers a claim must live under: a heading whose text
@@ -949,20 +983,96 @@ function claimedCommand(span: string): boolean {
   return EXECUTABLE_TOKEN.test(words[0] ?? "");
 }
 
+/** A markdown list marker opening a line: `- item`, `* item`, `1. item`,
+ *  `2) item`. The required trailing whitespace is what keeps a bold
+ *  `**Verified:**` row or an italic `*span*` from reading as a bullet. */
+const LIST_MARKER = /^[ \t]*(?:[-*+]|\d+[.)])[ \t]+/;
+
+/** The inline verified label a claims row can open with — `**Verified:**`,
+ *  `Verification:`, `proof.` — mirroring the label branch of
+ *  {@link VERIFIED_MARKER}, so the very row that opens the region also parses
+ *  as claims-bearing. */
+const CLAIMS_ROW_LABEL = /^\s*(?:\*\*)?(?:Verif(?:ied|ication)|Proof)(?:\*\*)?\s*[:.]\s*/i;
+
+/** Every backticked span in `text`, trimmed. */
+function backtickSpans(text: string): string[] {
+  return [...text.matchAll(/`([^`\n]+)`/g)].map((match) => (match[1] ?? "").trim());
+}
+
+/** The one backticked span `text` opens with, when it opens with one. */
+function leadingBacktickSpan(text: string): string | undefined {
+  const match = /^`([^`\n]+)`/.exec(text);
+  const span = (match?.[1] ?? "").trim();
+  return span === "" ? undefined : span;
+}
+
+/**
+ * The logical line-units of the verified region. A heading or a list marker
+ * always opens a unit, a blank line ends one, and every other non-blank line
+ * is the markdown lazy continuation of the unit above it. That continuation
+ * rule is the foundation of the #1102 fix: a bullet soft-wrapped across
+ * physical lines stays ONE unit, so its wrapped second line — exactly where
+ * #1097's quoted log line sat — can never pose as a fresh claim-bearing line.
+ * The cost is deliberate and stated: bare claim lines stacked without markers
+ * or blank lines merge into one unit, and only their first extracts. This
+ * fleet writes claims as bullets, so the lost shape is the rarer one.
+ */
+function* claimUnits(region: string): Generator<string[]> {
+  let unit: string[] = [];
+  for (const line of region.split("\n")) {
+    if (/^#{1,6}\s/.test(line) || LIST_MARKER.test(line)) {
+      if (unit.length > 0) yield unit;
+      unit = [line];
+    } else if (line.trim() === "") {
+      if (unit.length > 0) yield unit;
+      unit = [];
+    } else {
+      unit.push(line);
+    }
+  }
+  if (unit.length > 0) yield unit;
+}
+
+/**
+ * The claim candidates one unit makes — a matter of position, not vocabulary
+ * (#1102). A unit claims what it OPENS with:
+ *
+ * - a verified-label row (`**Verified:** …`, the #749/#731 semicolon-joined
+ *   shape) declares every span it carries a claim — the label is what marks
+ *   the whole row as proof;
+ * - any other unit contributes only its leading span — `- \`cd omp && bun test …\`
+ *   — 42 pass, 0 fail.` or a bare `\`./scripts/deploy.sh\` — deployed.` line —
+ *   whose tail is commentary about the result.
+ *
+ * A span embedded after prose is neither: `…assert exactly one log line naming
+ * \`issue is closed\`` quotes the transcript's own output, and quotation is
+ * commentary whatever the quoted words spell.
+ */
+function unitClaimSpans(unit: string[]): string[] {
+  const lead = (unit[0] ?? "").replace(LIST_MARKER, "");
+  if (CLAIMS_ROW_LABEL.test(lead)) {
+    return backtickSpans([lead.replace(CLAIMS_ROW_LABEL, ""), ...unit.slice(1)].join("\n"));
+  }
+  const span = leadingBacktickSpan(lead);
+  return span === undefined ? [] : [span];
+}
+
 /**
  * The commands a PR body claims as proof, each deduplicated by its exact span.
- * Only spans inside the verified region count, and only command-shaped ones
- * — the two filters are what keep `## Verified`-island prose out of the audit.
+ * Extraction is structural twice over: only spans inside the verified region
+ * count ({@link claimRegion}), and only spans in a claim-bearing position
+ * within it ({@link unitClaimSpans}) — the two filters together are what keep
+ * `## Verified`-island prose out of the audit.
  */
 function claimedProofCommands(body: string): string[] {
-  const region = claimRegion(body);
   const claims: string[] = [];
   const seen = new Set<string>();
-  for (const match of region.matchAll(/`([^`\n]+)`/g)) {
-    const span = (match[1] ?? "").trim();
-    if (span === "" || seen.has(span) || !claimedCommand(span)) continue;
-    seen.add(span);
-    claims.push(span);
+  for (const unit of claimUnits(claimRegion(body))) {
+    for (const span of unitClaimSpans(unit)) {
+      if (seen.has(span) || !claimedCommand(span)) continue;
+      seen.add(span);
+      claims.push(span);
+    }
   }
   return claims;
 }
@@ -1229,6 +1339,21 @@ const RENDERED_FLAGS = 20;
 
 const HEADING = "settlement audit";
 
+/**
+ * The kinds that mean coverage got weaker — the quiet signals the audit
+ * exists to deliver, and the family mining.ts mines. Presentation keeps them
+ * ahead of everything else and lane escapes last (#1096): a check that fires
+ * on half of all merges gets skimmed, and a skimmed finding must not sit
+ * between the reviewer and these. Kept in step with `WEAKENING_KINDS` in
+ * mining.ts, which is the same four kinds spelled for mining.
+ */
+const TEST_INTEGRITY_KINDS: Partial<Record<SettlementFlagKind, true>> = {
+  "test-file-deleted": true,
+  "test-disabled": true,
+  "assertions-removed": true,
+  "test-timeout-raised": true,
+};
+
 /**
  * The flag block appended to a settlement report, or no lines at all.
  *
@@ -1253,7 +1378,17 @@ export function formatSettlementFlags(
     `${HEADING}: ${flags.length} advisory flag(s) — the run's state is unchanged by them` +
       (diff.truncated ? ", and the PR diff was too large to read in full" : ""),
   ];
-  for (const flag of flags.slice(0, RENDERED_FLAGS)) {
+  // Presentation order is structural, not incidental: test-integrity flags
+  // first, then everything else, lane escapes last (#1096). The analyser
+  // emits them in roughly this order already, but this surface also renders
+  // stored rows and post-settlement appends, whose order nobody chose.
+  const rank = (flag: SettlementFlag): number =>
+    TEST_INTEGRITY_KINDS[flag.kind] === true ? 0 : flag.kind === "lane-escape" ? 2 : 1;
+  const ordered = flags
+    .map((flag, index) => ({ flag, index }))
+    .sort((a, b) => rank(a.flag) - rank(b.flag) || a.index - b.index)
+    .map((entry) => entry.flag);
+  for (const flag of ordered.slice(0, RENDERED_FLAGS)) {
     if (flag.kind === "pr-adopted") {
       lines.push(`  ${flag.kind} — ${flag.detail}`);
       continue;
@@ -1270,10 +1405,30 @@ export function formatSettlementFlags(
 }
 
 /** The one-line form for `omp-conductor status`, where a flagged run has to be
- *  visible long after its escalation was delivered and deduplicated. */
+ *  visible long after its escalation was delivered and deduplicated. Lane
+ *  escapes are presented apart from the test-integrity family (#1096), so the
+ *  noisy check cannot bury the quiet one in one comma join. */
 export function settlementFlagSummary(flags: readonly SettlementFlag[] | undefined): string | undefined {
   if (flags === undefined || flags.length === 0) return undefined;
-  const kinds = [...new Set(flags.map((f) => f.kind))].join(", ");
+  const integrity = new Set<SettlementFlagKind>();
+  const lane = new Set<SettlementFlagKind>();
+  const rest = new Set<SettlementFlagKind>();
+  for (const { kind } of flags) {
+    if (TEST_INTEGRITY_KINDS[kind] === true) integrity.add(kind);
+    else if (kind === "lane-escape") lane.add(kind);
+    else rest.add(kind);
+  }
+  const segments: { label?: string; kinds: SettlementFlagKind[] }[] = [];
+  if (integrity.size > 0) segments.push({ label: "test-integrity", kinds: [...integrity] });
+  if (rest.size > 0) segments.push({ kinds: [...rest] });
+  if (lane.size > 0) segments.push({ label: "lane", kinds: [...lane] });
+  // One family alone reads exactly as before — a label with nothing to
+  // separate is furniture.
+  const parts = segments.map((segment) =>
+    segments.length > 1 && segment.label !== undefined
+      ? `${segment.label}: ${segment.kinds.join(", ")}`
+      : segment.kinds.join(", "),
+  );
   const loud = flags.some((f) => f.unattributed === true) ? ", some unattributed" : "";
-  return `${HEADING}: ${flags.length} flag(s) — ${kinds}${loud}`;
+  return `${HEADING}: ${flags.length} flag(s) — ${parts.join("; ")}${loud}`;
 }