fix(llm,cli): tell the truth about a missing ceiling and name unmerge (#440, #445)

[jasonssdev]

Closes #440.
Closes #445.

Two messages that misdescribed what actually happened.

#440 — "the configured ceiling (None)"

OllamaGenerationCapped interpolated max_generation_tokens unconditionally, so a client built without one raised "the configured max_generation_tokens ceiling (None)" — self-contradictory, since nothing was configured.

That branch is genuinely reachable, not theoretical: Ollama reports done_reason == "length" whenever generation stops for length reasons, including the model's own context window filling, not only when num_predict binds. The message now names the ceiling when there is one, and otherwise attributes the cut-off to the backend's own limit.

Also adds the two done_reason edge cases nothing pinned: an unexpected string, and a non-string.

#445 — naming the condition without naming the verb

contradictions reported a merged-content verdict and never mentioned unmerge. That matters more here than for an ordinary pair verdict: a pair has two nodes an operator can open, while a merged-content verdict has one, and the disagreeing second body lives in the ledger where no ordinary read surfaces it.

The report now prints the command with the two ids that verb takes. A pair verdict deliberately gets no such line — nothing was merged, and pointing at a reversal verb would be wrong.

Also promotes ## Merged content ( to okf.MERGED_CONTENT_HEADING_PREFIX, which was duplicated between the module that writes it and the module that finds it to cut a ledger snapshot back to the survivor's own content.

What the review caught, and why it was worth the cycle

The first review of this branch found a real defect in the fix itself: the next: openkos unmerge … hint could name an absorbed id belonging to a non-tail merge-ledger entry. Verified against the source rather than taken on the reviewer's word — _merged_body_candidates raises one candidate per merged_from entry, not only the newest, while plan_unmerge refuses any absorbed_id that is not the ledger tail. On a survivor with two unreversed merges, the older verdict's suggested command would have refused. The line now states that precondition instead of promising success.

Two more findings folded in the same commit: an assertion that only checked for the absence of two words (and so would have passed against any vaguer message) now pins the exact sentence; and a module-private alias that restated the public constant's own docstring was removed.

Verification

• uv run pytest -q → 4017 passed, 1 skipped. uv run mypy . → Success, 179 files. ruff check / ruff format clean and convergent.
• Both headline behaviors were driven RED→GREEN.
• Every test that passed on its first run was mutation-verified individually. Notably, one early mutation failed twenty tests at once and was discarded as proving nothing about which test is the guard, then redone surgically until only the intended guards failed. Changing the shared heading constant failed both its consumers — the writer-side layout test and the reader-side snapshot-cut test — confirming the promoted constant is genuinely wired into both.

Native review, and the same gate caveat as #498

Two lineages, both approved with receipts, both zero blockers:

• review-b5b91450ae735c18 — the main change (3ee11e8). High risk, canonical 4R. Three informational findings, all folded rather than deferred.
• review-782bc636462d2286 — the folded corrections (9672821). High risk, canonical 4R. Two SUGGESTIONs, both about one cosmetic item (below).

pre-pr denies this PR, deliberately and disclosed. It measures the whole branch against origin/main while each receipt binds only its own increment, so neither covers the union. Denial is receipt-binding / candidate-or-paths-mismatch, action explicit-maintainer-action. Every changed line was reviewed and approved; what is missing is a single receipt whose scope equals the union — a binding gap, not a coverage gap.

Known cosmetic item, recorded not fixed: the rendered hint carries a double space before its parenthetical (…apatheia-2 (LIFO-enforced: …)), and the test asserts its three parts as separate substrings so spacing drift is unpinned. The candidate was frozen when the lenses reported it; folding a double space would cost another full four-lens cycle, so it is disclosed here instead of silently changed.