fix: what the second end-to-end run found

[vicenteliu]

The nine fixes from #201–#205 all changed behaviour on one path, and none of
them had been exercised since. #206 said the way to check them is the way they
were found: use it again. So it was used again — fresh OPSPILOT_HOME, the
README's own commands, hosted models.

Ten checks, ten passes. Three new defects, two fixed here.

Verified fixed (#201–#205)

check	evidence
embedders agree	init → ingest → serve starts clean with OPENAI_API_KEY set
dot-dir / ../ paths	.staging/corpus and ../corpus each 1 succeeded · 0 failed
hybrid on a sentence	ranks 1/2 2/1 3/4 4/3 — the FTS arm carries a chunk the vector side ranked 7th
Anthropic cost	Haiku 8022/711 → $0.011577; Sonnet 5 20860/1974 → $0.09219. Both exact against the table
OpenAI-compatible cost	OpenRouter → $0.000353808 from usage.cost
Memory proposal hint	fires on both turns, and the second proposes something the first did not
working_set_id	present in the list and the detail response
bundle round-trip	imported into an empty home; 2 entries restored with their original actors
distil --model	anthropic/claude-sonnet-5 crosses providers and drafts
model-list editor	no-op rewrite byte-identical; adding a model keeps 21/21 comments

Also confirmed along the way: an injected Memory constraint changed an answer,
report_conflict opened mcf_470af872 against a KB chunk, the distilled Skill
kept its dead ends and its blank stopping condition, and escalation wrote both
back-references.

Fixed here

An exhausted tool loop echoed its own preamble. Six kb_search rounds, 578
output tokens billed, 62 characters delivered — "Let me check the knowledge base
for any relevant procedures." — with seven citations attached. The cap now
bounds the tool rounds; one final round with no tools answers from what was
already retrieved. Live, same question, same forced condition: 73 chars → 1561
chars.

One sample directory fed two commands. examples/sample_data_en/kb/ was
built for kb load-dir; the README later pointed ingest at it. Result on the
repo's own data: 10 succeeded · 5 failed, plus five doc-meta.json sidecars
ingested as documents, two of which ranked top-five for a real question. Split
into kb/ (sources) and fixtures/ (frozen pairs). No product code, no README
change — the documented command simply works now.

Also here

kb/retrieval.py joins the behaviour gate's protected paths, closing the
decision #206 left open. Two stale behaviour counts corrected, including a
paste-me example in CI that would have recorded "4/4" for a six-case run.
ROADMAP stops describing #175 and the proposed-actions UI as open, and records
the run.

Left open, deliberately

• propose_actions is opt-in and nothing opts in. An escalated Session
  returns {"actions": []} on every fresh install. Whether the default should be
  dark is a decision, not a papercut.
• CLI and API disagree on who the local operator is — cli:<osuser> vs
  local-dev, so opspilot workingset status reports nothing open while the web
  UI has a set open for the same person. distil escapes it by taking an
  explicit id; status and close do not.

Verification

Full suite 1351 passed. pytest -m "not slow and not requires_ollama" — CI's
selection — 1349 passed. ruff, ruff format, mypy(154) clean. The one local
failure is test_providers_ollama.py::TestIntegration::test_chat_smoke, which
wants gemma4:e4b from a local Ollama that does not have it; CI deselects it.

behaviour-gate: 6 passed — memory injection 3/3, conflict reported 3/3, distillation keeps dead ends 3/3, proposals stay read-only 3/3, memory proposal 3/3, memory proposal restraint 3/3

Run twice, because chat_agent.py changed twice. The memory-proposal case scored
3/3 both times, against 2/3 when #205 landed — one session cannot tell an
improvement from sampling noise, so the votes are reported rather than claimed.

🤖 Generated with Claude Code