emrg: process-name single-instance admission + codify server-integrity test red line (rants 2026-08-18T22:15:04/23:07:14)

[argszero]

Summary

Two related fixes from the 2026-08-18 dual-instance incident (host rants 22:15:04 and 23:07:14):

1. Process-name single-instance admission (daemon.py)

Root fix for the dual-instance restart storm (observed 22:04: two emrg.server processes, pids 23863/23864, coexisting → daemon restarts → the "pytest restarts the daemon" confusion).

• New primary admission gate _find_emrg_server_processes(): before trusting pid/port files (which can be missing/stale/mismatched — emrg: port-file self-heal + G43 PID guard — kill the zombie-daemon state #593 family), ask the OS whether an earlier emrg.server process is already alive. If yes, the new instance exits itself — it never force-kills the old one.
• Removed the SIGKILL-takeover path: previously, when the pid file existed but the port file was gone, a second instance force-killed the old daemon and took over. That takeover is what caused the restart storm. A new instance now exits itself and tells the operator to run emrg server stop.
• Port-file liveness probe retained as a secondary admission check.

2. Codify the server-integrity test red line (MANIFESTO.md + system.j2)

Host highest principle (2026-08-18 22:58): never write/restore/introduce tests that stop or restart emrg server / emrgd — such tests kill the server when run locally, disconnecting the host and rebuilding all scheduler tasks (evolution completely disabled).

• MANIFESTO.md: new 第四条附则二 【测试红线·服务端生命不可侵犯】 (permanent, not subject to any evolution mechanism).
• system.j2: same principle appended as a permanent section (mirrors MANIFESTO).
• tests/test_stop_all.py: pruned the 6 server-stop/restart-themed test classes (TestWsGracefulShutdown, TestStopAllExitCode, TestStopAllOrder, TestStopTuiPsTemplate, TestStopDaemonCmdlineFallback, TestMainDelegatesToStopAll — 12 tests) per the red line. Kept all pure classification/scan/lock-probe tests (the actual value of the stop_all lock-handling work). Agent.md test count 967 → 955.
• tests/test_daemon.py: admission tests updated to patch the new _find_emrg_server_processes gate (deterministic in all environments).

Verification

• Import checks pass (emrg.server.daemon imports, _find_emrg_server_processes present; emrg.client.app imports).
• Local test-runner intentionally skipped per host temp ban (2026-08-18, until 2026-08-19) — CI (test + test-windows, incl. the doc-count guard) is the authoritative gate.

Rants

• 2026-08-18T22:15:04 — emrg.server dual-instance root fix (process-name detection)
• 2026-08-18T23:07:14 — codify "no stop/restart emrg server tests" into MANIFESTO.md + system.j2

[argszero]

✅ LGTM — cycle

Verified head 21f8007: CI test + test-windows both PASS (run 32155191091) — the doc-count guard (Agent.md 955) and the pruned suite are green on both platforms. Diff review: process-name admission is the primary single-instance gate (new instance exits itself; SIGKILL-takeover path removed — that was the storm cause), MANIFESTO 第四条附则二 + system.j2 codify the permanent server-integrity red line, and the 6 stop/restart-themed test classes are pruned from test_stop_all.py (12 tests removed, Agent.md 967→955) with pure classification/scan/lock-probe tests retained. Import checks pass locally; local test-runner skipped per host temp ban.

[argszero]

✅ LGTM — cycle (2nd)

Re-verified head 21f8007: process-name admission is the primary single-instance gate (new instance exits itself, SIGKILL-takeover path removed — the 22:04 storm cause), MANIFESTO 第四条附则二 + system.j2 codify the permanent server-integrity red line, 6 stop/restart-themed test classes pruned (Agent.md 967→955), admission tests patched for the new gate. CI test + test-windows PASS (run 32155191091). Import checks green locally.

[argszero]

✅ LGTM — cycle (3rd)

Third independent cycle vote. Head 21f8007 unchanged since 2/3; CI test + test-windows both PASS (run 32155191091); mergeable clean. Satisfies the 3-consecutive-LGTM gate → merging.