feat: probe Ollama runtime via lore status --full and richer hook warning

[attila]

Summary

lore status previously reported Ollama as healthy whenever the daemon answered and the model
manifest was on disk — even when the bundled runner subprocess was missing or unloadable. The
current Homebrew Ollama bottle reproduces this exact gap: status shows ✓✓✓ while hooks silently
degrade to FTS with an opaque one-line warning.

This adds:

• lore status --full — opt-in deeper check that probes Ollama with a real embed call against
  the configured model. Default lore status stays sub-second and shows a discoverability hint
  pointing at --full. Header lines print before the probe so the multi-second wait isn't a
  frozen terminal.
• lore init auto-probes — provisioning verifies inference end-to-end before declaring success.
• Upgraded hook FTS-fallback warning — names the failure class (inference error, timed out,
  transport error, HTTP <status>) and points at lore status --full for full diagnosis.
  Per-process rate limit prevents repeat warnings of the same class; suppressions leave a
  LORE_DEBUG=1 breadcrumb.
• MCP lore_status parity — exposes Ollama state (installed/running/model_available/model)
  in the metadata fence by default, with optional probe_runtime: true argument that runs the
  probe and returns the structured ProbeOutcome (state + short_reason + status_line). Agents
  now have first-class parity with lore status --full without shelling out and parsing stderr.

The probe returns a structured ProbeError (RunnerFailed / InferenceError / Timeout / Transport /
HttpStatus) and a single render_failure function centralises the variant→strings match so all
user-facing surfaces (status line, provision errors, provision actions, hook short-reason, MCP
metadata) stay synchronised when the enum gains a variant. ProbeError, ProbeOutcome, and
RenderedFailure carry #[non_exhaustive] so future variants aren't breaking changes for
downstream match consumers.

Discovered during implementation

• ureq 3.x http_status_as_error defaults to true. The plan asserted ureq 3 returned
  Ok(Response) for HTTP 5xx. Manual verification revealed the opposite — 5xx came back as
  Error::StatusCode(_) without the body, rendering "transport error — http status: 500" instead of
  Ollama's actual diagnostic. Reconfigured OllamaClient's agent with http_status_as_error(false)
  and made is_healthy / has_model / pull_model check response.status() explicitly to
  preserve their semantics. Sibling-path audit during code-review confirmed all five self.agent.*
  callsites are covered.
• Body truncation bumped 80 → 240 chars. The 80-char limit chopped Ollama's runner-not-found
  errors mid-path, exactly where the diagnostic value lives. 240 fits multiple full Homebrew Cellar
  paths on typical terminals while still bounding pathological multi-paragraph bodies.
• Body read uses from_utf8_lossy. Non-UTF8 sequences in a 5xx body would otherwise collapse
  the whole diagnostic to empty string. Lossy decode preserves what's decodable.
• Plan correction: lore init aborts on probe failure. An earlier plan draft claimed init
  continues to completion. The pre-existing cmd_init wrapper has always called
  process::exit(1) on any non-empty result.errors; letting init continue past a broken embedder
  would create a database with empty embeddings (silently broken vector search). Aborting forces
  the user to fix Ollama and re-run; the manifest is already on disk so the re-run is fast. Plan
  amended; code is right.

Code-review fixes applied

PR went through a multi-agent code review (10 reviewers). All four P1 findings addressed:

1. lore init aborts on probe failure — plan amended (code is right).
2. #[non_exhaustive] added to ProbeError, ProbeOutcome, RenderedFailure.
3. check_status signature break — not advertised as breaking; project isn't published to
   crates.io yet, no external consumers.
4. HTTP 200 empty-embeddings now wraps in ProbeError::InferenceError (was anyhow!), so the
   hook downcast classifies correctly. probe() also rejects {} bodies that prove nothing.

Plus all approved P2/P3 follow-ups: MCP parity, header-before-probe rendering, from_utf8_lossy,
13 new unit tests for extract_body_message / render_failure / ProbeError downcast,
keep_alive bumped 0→30s on --full for the "fix Ollama, re-run" loop, visible Skipped Runtime
line under --full, lore_debug! breadcrumb on rate-limit suppression.

Compounded learnings

Five durable learnings landed in docs/solutions/ so future sessions hit lookups instead of
research. All five include explicit "When to Apply" / "Skip when" guidance:

• best-practices/ureq-3-http-status-as-error-defaults-true-2026-06-04.md
  — ureq 3.x kept the status-as-error default; 5xx loses its body unless reconfigured.
• best-practices/bin-and-lib-are-separate-crates-for-non-exhaustive-2026-06-04.md
  — #[non_exhaustive] semantics across the lib/bin boundary in the same Cargo package.
• design-patterns/multi-surface-render-function-pattern-2026-06-04.md
  — one render(&Enum) -> Rendered function returning an N-field struct keeps every
  surface in sync when variants change.
• best-practices/http-error-body-extraction-and-char-boundary-safe-truncation-2026-06-04.md
  — four-layer body extraction (lossy decode → JSON error → first line → char-bounded
  truncation) with the multi-byte-codepoint safety property pinned by unit tests.
• conventions/expensive-cli-checks-go-behind-opt-in-flag-with-rescue-mechanisms-2026-06-04.md
  — the four-mechanism design that emerged from the default-on/opt-in product pivot:
  fast default + discoverability hint + push-side warning + install-time auto-probe.

Verification (currently-broken Homebrew Ollama bottle)

Before this PR: lore status shows ✓✓✓, hook prints
Warning: Ollama unreachable (...), falling back to text search.

After this PR:

$ lore status        # sub-second, hint surfaces deeper check
  Model:        ✓ nomic-embed-text
  Runtime:      —  (run 'lore status --full' to verify inference)

$ lore status --full # header prints first, then a brief wait, then result
  Model:        ✓ nomic-embed-text
  Verifying inference runtime (may take a few seconds)…
  Runtime:      ✗ inference failed — error starting llama-server: llama-server binary not found
                  (checked: /opt/homebrew/Cellar/ollama/0.30.4/libexec/lib/ollama/llama-server,
                  /opt/homebrew/Cellar/ollama/0.30.4/libexec/llama-server, ...)

$ echo '{"hook_event_name":"PreToolUse",...}' | lore hook
Warning: Ollama embed failed (inference error); falling back to text search. Run 'lore status --full' for details.
{ ... FTS-fallback results ... }

Once Ollama is repaired (e.g. brew reinstall ollama) these flip back to green automatically — no
code change needed.

Pre-existing failure flagged

hook_transcript_tail_toggle_populates_field_when_enabled fails on main independently of this
PR. It uses FakeEmbedder and tests trace-record transcript_tail logic — completely untouched by
these changes. Root cause is a macOS-only tempdir/symlink (/var → /private/var) interaction that
the test setup doesn't canonicalise; CI is Linux-only so it never bites there. Tracked separately
for follow-up.

Plan

docs/plans/2026-06-04-001-feat-ollama-runtime-probe-plan.md
— went through three rounds of doc-review (coherence, feasibility, adversarial) plus a product
pivot from default-on probing to opt-in via --full. Plan status completed, with the ureq-3.x,
truncation, and lore init corrections recorded under "Discovered during implementation".

Test plan

• cargo build --release
• cargo clippy --all-targets --features test-support -- -D warnings
• cargo test --features test-support --lib (792 passed, was 779 — 13 new unit tests added)
• just ci (fmt, clippy, test, deny, doc) — passes except the pre-existing macOS hook test
• Manual lore status against broken Homebrew Ollama (sub-second, hint shown)
• Manual lore status --full against broken Homebrew Ollama (header prints first, then ✗
  with Ollama's actual error body showing multiple full Cellar paths)
• Manual hook invocation against broken Homebrew Ollama (informative warning + FTS results)
• Run probe_succeeds_against_real_ollama integration test once Ollama is fixed (currently
  expected-fail against broken bottle, which is the natural acceptance test)
• Manual MCP lore_status call with probe_runtime: true against repaired Ollama (verify
  runtime: ok in metadata fence)