fix(harness): ensure_ollama never raises on start/probe failure (stage server)

harness/tests/test_ollama_ensure.py

@@ -114,3 +114,27 @@ def test_custom_start_cmd_used():
         sleep=lambda s: None,
     )
     assert started[0] == ["docker", "start", "ollama"]
+
+
+def test_start_failure_is_server_error():
+    r = ensure_ollama(
+        _cfg(), timeout=5, no_start=False,
+        probe=lambda url: False,
+        installed_models=lambda url: set(),
+        start=lambda cmd: (_ for _ in ()).throw(FileNotFoundError("ollama: not found")),
+        warm=lambda cfg: None,
+        sleep=lambda s: None,
+    )
+    assert r["ok"] is False and r["stage"] == "server"
+    assert "avvio" in r["error"].lower() or "not found" in r["error"].lower()
+
+
+def test_initial_probe_exception_is_server_error():
+    r = ensure_ollama(
+        _cfg(), timeout=5, no_start=False,
+        probe=lambda url: (_ for _ in ()).throw(RuntimeError("boom")),
+        installed_models=lambda url: set(),
+        start=lambda cmd: None,
+        warm=lambda cfg: None,
+    )
+    assert r["ok"] is False and r["stage"] == "server"

harness/tht/cli/ollama_cmd.py

@@ -72,19 +72,31 @@ def ensure_ollama(
     start_cmd = emb.start_cmd if emb.start_cmd is not None else [emb.bin, "serve"]
 
     server_state = "up"
-    if not probe(base_url):
+    try:
+        reachable = probe(base_url)
+    except Exception as e:  # noqa: BLE001 - a probe failure is a hard server-stage error
+        return {"ok": False, "stage": "server",
+                "error": f"probe di Ollama fallito su {base_url}: {e}"}
+    if not reachable:
         if no_start or start_cmd == []:
             return {"ok": False, "stage": "server",
                     "error": f"Ollama non raggiungibile su {base_url} e avvio disabilitato"}
-        start(start_cmd)
+        try:
+            start(start_cmd)
+        except Exception as e:  # noqa: BLE001 - failing to launch is a hard server-stage error
+            return {"ok": False, "stage": "server",
+                    "error": f"avvio di Ollama fallito ({start_cmd}): {e}"}
         server_state = "started"
         deadline = clock() + timeout
         up = False
         while clock() < deadline:
             sleep(1.0)
-            if probe(base_url):
-                up = True
-                break
+            try:
+                if probe(base_url):
+                    up = True
+                    break
+            except Exception:  # noqa: BLE001 - transient during startup; keep polling
+                continue
         if not up:
             return {"ok": False, "stage": "server",
                     "error": f"Ollama non raggiungibile su {base_url} entro {timeout}s"}