emrg: auto-upgrade refactor — agent-driven local equivalent install replaces installer download

[argszero]

Summary

Rant 2026-08-20T12:33:59 (host design finalized point-by-point): the automatic
upgrade mechanism is rebuilt — no installer download anymore. The program
only triggers; the agent performs a local equivalent install from the
evolution repo clone.

Changes

1. New emrg/server/upgrade.py — UpgradeManager (all program-side logic):
   • 5-minute tick (hard-coded, not configurable)
   • GitHub releases query (per_page=30), delay-filter (published_at ≤ now − delay_minutes), newest eligible tag wins
   • Compares against ~/.emrg/install/version.txt; triggers an agent session (emrg-upgrade) when a newer eligible tag exists
   • In-flight re-entry guard only (no state files, no success judgment, no retry logic — the agent does all of that; a failed upgrade re-triggers naturally next tick)
   • parse_version / is_newer migrated from the deleted update_check.py
2. New emrg/server/prompts/upgrade_prompt.j2 — agent install instructions: clone/fetch → checkout tag → read source to understand the installer logic → equivalent install (source/lib/version.txt/bin/GUI as needed) → backup/rollback → do NOT restart the daemon (host restarts manually) → MANIFESTO red-line compliance (no stop/restart paths).
3. emrg/config.py — UpdateConfig rewritten to enabled / delay_minutes (old check / ttl_hours / auto_download removed).
4. emrg/server/daemon.py — old update-check loop / auto-download / ws update_check + update_check_prompted handlers removed; registers the 5-minute upgrade tick; provides the public _run_upgrade_session runner (reuses session queueing semantics, headless — no client connection needed).
5. Deleted emrg/update_check.py + tests/test_update_check.py (whole old mechanism).
6. TUI + GUI cleanup — update-check prompts, install-button UI, related IPC (emrg:updateCheck / updateInstall / updateCheckPrompted), update_downloaded broadcast handling and i18n keys removed.
7. Tests — new tests/test_upgrade.py (13 tests): delay filter takes newest eligible tag, local==target no-trigger, enabled=false skip, network failure silent, in-flight guard, config defaults/loading, daemon session-runner integration, and a residual-reference scan (no update_check / ttl_hours / auto_download left).

Verification

• pytest: 957 passed + 1 skipped (958 collected; Agent.md doc count synced)
• import check: OK
• CLI emrg --help: OK
• GUI: 246/253 (7 known daemon-spawn integration failures by design, emrg: daemon single-instance via fixed-port bind exclusivity (rant 2026-08-19T08:05:21) #861 — not a regression; 7 obsolete update tests removed)

[argszero]

✅ LGTM — cycle (20260820-143019)

Reviewed the full diff on head bc73e7f:

• emrg/server/upgrade.py — UpgradeManager logic matches the rant design: 5-min hard-coded tick, GitHub releases query, delay filter picks the newest eligible tag, in-flight re-entry guard, silent skips for disabled / local==target / network failure, prompt rendered from template.
• emrg/server/daemon.py — _update_check_loop fully replaced by _upgrade_tick_loop; first tick delayed one interval (no GitHub API at daemon startup); _run_upgrade_session reuses TaskRequest + session queueing; shutdown cleanup updated.
• emrg/config.py — UpdateConfig check/ttl_hours/auto_download removed → enabled/delay_minutes (host decision A: minutes granularity).
• emrg/server/prompts/upgrade_prompt.j2 — prepare clone → understand installer logic → equivalent install → backup/rollback → do-not-restart-daemon (consistent with the MANIFESTO server-integrity principle) → safety boundaries.
• GUI + TUI cleanup — updateCheck/updateCheckPrompted/updateInstall IPC, about-update UI, dialogs, i18n keys and smoke tests all removed consistently; TUI startup update_check prompt removed.
• tests — tests/test_upgrade.py 13 tests cover parse_version (incl. prerelease suffix), delay filter, local==target no-trigger, config-disabled, network-failure silence, in-flight guard, daemon session runner and residual-reference check; test_daemon.py updated (shutdown test now asserts upgrade-tick loop).
• Deleted emrg/update_check.py + tests/test_update_check.py — no residual references (guard test exempts emrg/skills/installer.py's unrelated run_update_check_once).

Net −825 lines. Local: test_upgrade.py + test_daemon.py 102 passed, tree clean. CI: run 32338995031 — test PASS (1m35s) + test-windows PASS (53s); mergeState CLEAN.

[argszero]

✅ LGTM — cycle (20260820-143548) — fresh per-cycle re-review

Re-verified head bc73e7f (unchanged since LGTM #1): same 17-file diff (715+/1540−), core upgrade.py logic confirmed — releases list per_page=30 (delay filtering needs every published_at), parse_version terminates on first non-digit piece (prerelease never newer), 5-min hard-coded tick, in-flight re-entry guard, silent skips, template-driven agent session. CI run 32338995031: test PASS (1m35s) + test-windows PASS (53s); mergeState CLEAN. 2/3 LGTMs.

[argszero]

✅ LGTM — cycle (20260820-150026) — fresh per-cycle re-review

Re-verified head bc73e7f (unchanged since LGTMs #1/#2): 17-file diff (715+/1540−), core upgrade.py confirmed — host-design boundaries verbatim (no installer download, agent-driven local equivalent install, program only triggers via releases API → delay-filter → version compare → template-driven agent session, in-flight re-entry guard only), parse_version terminates on prerelease suffix. CI run 32338995031: test PASS + test-windows PASS; mergeState CLEAN. 3/3 LGTMs.