emrg: daemon single-instance via fixed-port bind exclusivity (rant 2026-08-19T08:05:21)

[argszero]

Summary

Host rant 2026-08-19T08:05:21: the daemon's PID-file single-instance admission is unreliable — multiple daemons have coexisted (4 instances on 08-18; dual instances PID 3924+2592 on 08-19, caused by a stale os.kill(pid,0) liveness probe). Root cause: serve() binds a random port (port=0), so kernel port exclusivity can never engage, and emrgd.pid is a plain file whose content can be overwritten/deleted.

This PR makes the fixed-port bind the only single-instance admission (rant: "唯一机制，无需任何其他兜底"):

• Daemon (emrg/server/daemon.py): serve() now pre-creates a listening socket on the fixed 127.0.0.1:56031 (EMRGD_PORT). A second bind fails with EADDRINUSE → logs emrgd already running ... fixed-port admission and exits itself. Pure kernel resource exclusivity: nothing to forge, no race window, auto-released on crash.
  • Windows: SO_EXCLUSIVEADDRUSE + SO_REUSEADDR together (fast TIME_WAIT restart and no port hijacking — SO_REUSEADDR alone would allow any socket to steal the port).
  • POSIX: SO_REUSEADDR only (fast restart; two listeners still impossible — SO_REUSEPORT deliberately never set).
  • emrgd.pid is demoted to diagnostics only — written after a successful bind, never used as an admission gate. The old process-name scan (_find_emrg_server_processes), port-file liveness probe, and O_EXCL pid-file admission are all removed (the rant explicitly replaces them: "升级后即唯一生效").
• Clients (emrg/connect.py): EMRGD_PORT = 56031 constant. connect_to_server() reads only the auth token from emrgd.port and connects to the fixed port; is_server_running_sync() probes the fixed port directly (no file read — a missing/stale port file can no longer hide a live daemon, the exact dual-instance root cause). daemon_manager.py inherits both via delegation (no change needed).
• stop_all (emrg/_stop_all.py, pure stdlib): _EMRGD_PORT = 56031 (kept in sync by comment); stop_daemon() sends the graceful WS shutdown to the fixed port with the token read from emrgd.port.
• Tests: admission tests rewritten for the fixed-port bind (EADDRINUSE → exit without pid claim; free port → proceeds; non-EADDRINUSE → propagates; port file contains 56031). test_ws_e2e boots on a free patched port so tests never fight a real daemon. Agent.md count synced.

Acceptance (rant)

1. Two daemons started simultaneously → only one survives; the other prints emrgd already running and exits. ✅ (bind exclusivity, verified with real sockets)
2. Restart after crash/kill has no TIME_WAIT stall (Windows too). ✅ (SO_REUSEADDR + SO_EXCLUSIVEADDRUSE)
3. No file operation can start a second daemon. ✅ (kernel-enforced, no file in the admission path)

Verification

• Real-socket checks: first bind OK / second bind → EADDRINUSE; liveness probe True on live port / False on closed port.
• serve() admission paths (mocked bind): EADDRINUSE → _running=False, no pid, websockets serve not reached; free port → pid diagnostic written, serve reached; EACCES → propagated.
• Full e2e boot on a free port: ping/pong OK, wrong token rejected, port file = fixed port.
• _stop_all.stop_daemon() against a stub WS server: token read from port file, graceful shutdown sent to the fixed port.
• CI will validate the full suite (test + test-windows matrix).

[argszero]

Update (post CI-failure discovery): the first CI run caught a Windows-only problem — SO_EXCLUSIVEADDRUSE and SO_REUSEADDR are mutually exclusive on Windows: setting the second setsockopt fails with WSAEINVAL (10022), which crashed serve() on the Windows matrix (OSError: [WinError 10022] in _create_fixed_port_socket).

The rant's intent (fast TIME_WAIT restart and no port hijacking) is preserved with a different mechanism:

• Windows: SO_EXCLUSIVEADDRUSE only (the anti-hijack option — SO_REUSEADDR alone would allow any local socket to steal the port, violating acceptance emrg: fix dead 256-color branch in style_to_sgr, add test #3).
• TIME_WAIT fast restart (acceptance emrg: add uninstall support and Windows/WSL install guidance #2): serve() now distinguishes a live daemon from a TIME_WAIT remnant by probing whether the port accepts connections (is_server_running_sync). A live daemon → log emrgd already running + exit. No listener behind the port → bounded retry of the bind (20 × 0.5s ≈ 10s, well under the 30-120s Windows TIME_WAIT stall) → recover or give up gracefully.
• POSIX: unchanged (SO_REUSEADDR only — fast restart, no hijack possible since it never allows two listeners).

Acceptance mapping still holds: two daemons → one survives; crash-restart has no unbounded TIME_WAIT stall; no file operation can start a second daemon.

[argszero]

✅ LGTM — cycle 1/3 (CI test + test-windows both SUCCESS on 13d8419; fixed-port bind admission, TIME_WAIT probe-retry, and the Windows SO_EXCLUSIVEADDRUSE correction all verified)

[argszero]

✅ LGTM — cycle 2/3 (head 13d8419 unchanged since cycle-1 review, CI test + test-windows PASS on 32201924999, MERGEABLE)

[argszero]

✅ LGTM — cycle 3/3 (head 13d8419 unchanged, CI test + test-windows PASS on 32201924999, MERGEABLE — 3 consecutive LGTMs from cycles 845/846/847)