emrg: red-line guard — tests never run the real auto-upgrade chain (rant 2026-08-21T10:35:57)

[argszero]

Summary

A long-running pytest session (PID 72994, 21h) was really executing the auto-upgrade chain in the background: real GitHub releases API requests, real ~/.emrg/install/version.txt reads, and real emrg-upgrade session writes (downgrade prompt, delay=1440, target=v0.2.57) every 5 minutes — continuing across daemon restarts and even after emrg stop stopped all real processes (writes at 10:23:12 / 10:28:15 / 10:33:17 after the 10:22:56 stop).

Root cause: EmrgServer.serve() unconditionally starts the 5-minute _upgrade_tick_loop, which builds UpgradeManager(load_update_config(), …) with enabled=True by default. Any test booting a real server over a long session lets the tick run the real chain.

Changes

• tests/conftest.py — new autouse _guard_upgrade_hermeticity fixture (mirrors the existing _guard_stop_daemon_hermeticity red-line pattern):
  1. httpx.AsyncClient in emrg.server.upgrade raises AssertionError on instantiation (module-local — the global httpx module is untouched).
  2. upgrade.VERSION_FILE is redirected to a per-test tmp path — the real ~/.emrg/install/version.txt is never read/written.
  3. EmrgServer._get_or_create_session for SESSION_ID (emrg-upgrade) raises — no real upgrade session may be created/written.
• tests/test_ws_e2e.py — _boot_server forces the upgrade manager disabled (patches emrg.config.load_update_config → UpdateConfig(enabled=False)) so booted test servers' tick loop is a no-op; restored in cleanup. Covers test_daemon_manager_e2e (reuses _boot_server).
• tests/test_upgrade.py — the daemon session-runner test now isolates the session factory (_get_or_create_session); new test_upgrade_chain_hermeticity_guards proves the guards are active by default.
• MANIFESTO.md — 第四条附则三 codifies the permanent red line (same status as the stop_daemon red line, host 2026-08-21 10:35).
• Agent.md — documented test count 985 → 986.

Verification

• uv run pytest tests/ → 985 passed + 1 skipped (986 collected) (was 984+1)
• uv run python -c "from emrg.client.app import run_client" → OK
• uv run python -m emrg --help → OK

[argszero]

✅ LGTM — cycle

Fresh review of the upgrade-chain red-line guard:

• conftest autouse _guard_upgrade_hermeticity blocks all three side-effect endpoints: upgrade-module httpx.AsyncClient raises (module-local, global httpx untouched), VERSION_FILE redirected to per-test tmp, EmrgServer._get_or_create_session for 'emrg-upgrade' raises.
• _boot_server forces the upgrade manager disabled via emrg.config.load_update_config patch (restored in cleanup) — booted test servers' 5-min tick loop becomes a no-op.
• test_upgrade session-runner test isolates the session factory; new guard-verification test proves guards active by default.
• MANIFESTO 附则三 codifies the permanent red line; Agent.md count synced.

Verified locally: pytest 985 passed + 1 skipped (986 collected), import + CLI OK; CI test + test-windows both PASS.

[argszero]

✅ LGTM — cycle

Re-review (head 316455f unchanged since the 1st LGTM, MERGEABLE/CLEAN):

• Negative-state verification: test_upgrade_chain_hermeticity_guards confirms the autouse fixture raises on a real upgrade-module httpx.AsyncClient and redirects VERSION_FILE away from the real install path.
• Full local suite: pytest 985 passed + 1 skipped (986 collected), import + CLI OK.
• CI test + test-windows both PASS on the same head.

2/3 consecutive LGTMs.

[argszero]

✅ LGTM — cycle

3rd consecutive LGTM (cycles 1193, 1194, 1195). Fresh verification on head 316455f (unchanged):

• pytest 985 passed + 1 skipped (986 collected) on the PR branch
• import + CLI OK
• CI test + test-windows both PASS
• MERGEABLE/CLEAN

3/3 consecutive LGTMs — merging.

[argszero]

Summary

A long-running pytest session (PID 72994, 21h) was really executing the auto-upgrade chain in the background: real GitHub releases API requests, real ~/.emrg/install/version.txt reads, and real emrg-upgrade session writes (downgrade prompt, delay=1440, target=v0.2.57) every 5 minutes — continuing across daemon restarts and even after emrg stop stopped all real processes (writes at 10:23:12 / 10:28:15 / 10:33:17 after the 10:22:56 stop).

Root cause: EmrgServer.serve() unconditionally starts the 5-minute _upgrade_tick_loop, which builds UpgradeManager(load_update_config(), …) with enabled=True by default. Any test booting a real server over a long session lets the tick run the real chain.

Changes

• tests/conftest.py — new autouse _guard_upgrade_hermeticity fixture (mirrors the existing _guard_stop_daemon_hermeticity red-line pattern):
  1. httpx.AsyncClient in emrg.server.upgrade raises AssertionError on instantiation (module-local — the global httpx module is untouched).
  2. upgrade.VERSION_FILE is redirected to a per-test tmp path — the real ~/.emrg/install/version.txt is never read/written.
  3. EmrgServer._get_or_create_session for SESSION_ID (emrg-upgrade) raises — no real upgrade session may be created/written.
• tests/test_ws_e2e.py — _boot_server forces the upgrade manager disabled (patches emrg.config.load_update_config → UpdateConfig(enabled=False)) so booted test servers' tick loop is a no-op; restored in cleanup. Covers test_daemon_manager_e2e (reuses _boot_server).
• tests/test_upgrade.py — the daemon session-runner test now isolates the session factory (_get_or_create_session); new test_upgrade_chain_hermeticity_guards proves the guards are active by default.
• MANIFESTO.md — 第四条附则三 codifies the permanent red line (same status as the stop_daemon red line, host 2026-08-21 10:35).
• Agent.md — documented test count 985 → 986.

Verification

• uv run pytest tests/ → 985 passed + 1 skipped (986 collected) (was 984+1)
• uv run python -c "from emrg.client.app import run_client" → OK
• uv run python -m emrg --help → OK

[argszero]

✅ LGTM — cycle

Fresh review of the upgrade-chain red-line guard:

• conftest autouse _guard_upgrade_hermeticity blocks all three side-effect endpoints: upgrade-module httpx.AsyncClient raises (module-local, global httpx untouched), VERSION_FILE redirected to per-test tmp, EmrgServer._get_or_create_session for 'emrg-upgrade' raises.
• _boot_server forces the upgrade manager disabled via emrg.config.load_update_config patch (restored in cleanup) — booted test servers' 5-min tick loop becomes a no-op.
• test_upgrade session-runner test isolates the session factory; new guard-verification test proves guards active by default.
• MANIFESTO 附则三 codifies the permanent red line; Agent.md count synced.

Verified locally: pytest 985 passed + 1 skipped (986 collected), import + CLI OK; CI test + test-windows both PASS.

[argszero]

✅ LGTM — cycle

Re-review (head 316455f unchanged since the 1st LGTM, MERGEABLE/CLEAN):

• Negative-state verification: test_upgrade_chain_hermeticity_guards confirms the autouse fixture raises on a real upgrade-module httpx.AsyncClient and redirects VERSION_FILE away from the real install path.
• Full local suite: pytest 985 passed + 1 skipped (986 collected), import + CLI OK.
• CI test + test-windows both PASS on the same head.

2/3 consecutive LGTMs.

[argszero]

✅ LGTM — cycle

3rd consecutive LGTM (cycles 1193, 1194, 1195). Fresh verification on head 316455f (unchanged):

• pytest 985 passed + 1 skipped (986 collected) on the PR branch
• import + CLI OK
• CI test + test-windows both PASS
• MERGEABLE/CLEAN

3/3 consecutive LGTMs — merging.

[argszero]

Summary

A long-running pytest session (PID 72994, 21h) was really executing the auto-upgrade chain in the background: real GitHub releases API requests, real ~/.emrg/install/version.txt reads, and real emrg-upgrade session writes (downgrade prompt, delay=1440, target=v0.2.57) every 5 minutes — continuing across daemon restarts and even after emrg stop stopped all real processes (writes at 10:23:12 / 10:28:15 / 10:33:17 after the 10:22:56 stop).

Root cause: EmrgServer.serve() unconditionally starts the 5-minute _upgrade_tick_loop, which builds UpgradeManager(load_update_config(), …) with enabled=True by default. Any test booting a real server over a long session lets the tick run the real chain.

Changes

• tests/conftest.py — new autouse _guard_upgrade_hermeticity fixture (mirrors the existing _guard_stop_daemon_hermeticity red-line pattern):
  1. httpx.AsyncClient in emrg.server.upgrade raises AssertionError on instantiation (module-local — the global httpx module is untouched).
  2. upgrade.VERSION_FILE is redirected to a per-test tmp path — the real ~/.emrg/install/version.txt is never read/written.
  3. EmrgServer._get_or_create_session for SESSION_ID (emrg-upgrade) raises — no real upgrade session may be created/written.
• tests/test_ws_e2e.py — _boot_server forces the upgrade manager disabled (patches emrg.config.load_update_config → UpdateConfig(enabled=False)) so booted test servers' tick loop is a no-op; restored in cleanup. Covers test_daemon_manager_e2e (reuses _boot_server).
• tests/test_upgrade.py — the daemon session-runner test now isolates the session factory (_get_or_create_session); new test_upgrade_chain_hermeticity_guards proves the guards are active by default.
• MANIFESTO.md — 第四条附则三 codifies the permanent red line (same status as the stop_daemon red line, host 2026-08-21 10:35).
• Agent.md — documented test count 985 → 986.

Verification

• uv run pytest tests/ → 985 passed + 1 skipped (986 collected) (was 984+1)
• uv run python -c "from emrg.client.app import run_client" → OK
• uv run python -m emrg --help → OK

[argszero]

✅ LGTM — cycle

Fresh review of the upgrade-chain red-line guard:

• conftest autouse _guard_upgrade_hermeticity blocks all three side-effect endpoints: upgrade-module httpx.AsyncClient raises (module-local, global httpx untouched), VERSION_FILE redirected to per-test tmp, EmrgServer._get_or_create_session for 'emrg-upgrade' raises.
• _boot_server forces the upgrade manager disabled via emrg.config.load_update_config patch (restored in cleanup) — booted test servers' 5-min tick loop becomes a no-op.
• test_upgrade session-runner test isolates the session factory; new guard-verification test proves guards active by default.
• MANIFESTO 附则三 codifies the permanent red line; Agent.md count synced.

Verified locally: pytest 985 passed + 1 skipped (986 collected), import + CLI OK; CI test + test-windows both PASS.

[argszero]

✅ LGTM — cycle

Re-review (head 316455f unchanged since the 1st LGTM, MERGEABLE/CLEAN):

• Negative-state verification: test_upgrade_chain_hermeticity_guards confirms the autouse fixture raises on a real upgrade-module httpx.AsyncClient and redirects VERSION_FILE away from the real install path.
• Full local suite: pytest 985 passed + 1 skipped (986 collected), import + CLI OK.
• CI test + test-windows both PASS on the same head.

2/3 consecutive LGTMs.

[argszero]

✅ LGTM — cycle

3rd consecutive LGTM (cycles 1193, 1194, 1195). Fresh verification on head 316455f (unchanged):

• pytest 985 passed + 1 skipped (986 collected) on the PR branch
• import + CLI OK
• CI test + test-windows both PASS
• MERGEABLE/CLEAN

3/3 consecutive LGTMs — merging.

[argszero]

Summary

A long-running pytest session (PID 72994, 21h) was really executing the auto-upgrade chain in the background: real GitHub releases API requests, real ~/.emrg/install/version.txt reads, and real emrg-upgrade session writes (downgrade prompt, delay=1440, target=v0.2.57) every 5 minutes — continuing across daemon restarts and even after emrg stop stopped all real processes (writes at 10:23:12 / 10:28:15 / 10:33:17 after the 10:22:56 stop).

Root cause: EmrgServer.serve() unconditionally starts the 5-minute _upgrade_tick_loop, which builds UpgradeManager(load_update_config(), …) with enabled=True by default. Any test booting a real server over a long session lets the tick run the real chain.

Changes

• tests/conftest.py — new autouse _guard_upgrade_hermeticity fixture (mirrors the existing _guard_stop_daemon_hermeticity red-line pattern):
  1. httpx.AsyncClient in emrg.server.upgrade raises AssertionError on instantiation (module-local — the global httpx module is untouched).
  2. upgrade.VERSION_FILE is redirected to a per-test tmp path — the real ~/.emrg/install/version.txt is never read/written.
  3. EmrgServer._get_or_create_session for SESSION_ID (emrg-upgrade) raises — no real upgrade session may be created/written.
• tests/test_ws_e2e.py — _boot_server forces the upgrade manager disabled (patches emrg.config.load_update_config → UpdateConfig(enabled=False)) so booted test servers' tick loop is a no-op; restored in cleanup. Covers test_daemon_manager_e2e (reuses _boot_server).
• tests/test_upgrade.py — the daemon session-runner test now isolates the session factory (_get_or_create_session); new test_upgrade_chain_hermeticity_guards proves the guards are active by default.
• MANIFESTO.md — 第四条附则三 codifies the permanent red line (same status as the stop_daemon red line, host 2026-08-21 10:35).
• Agent.md — documented test count 985 → 986.

Verification

• uv run pytest tests/ → 985 passed + 1 skipped (986 collected) (was 984+1)
• uv run python -c "from emrg.client.app import run_client" → OK
• uv run python -m emrg --help → OK

[argszero]

✅ LGTM — cycle

Fresh review of the upgrade-chain red-line guard:

• conftest autouse _guard_upgrade_hermeticity blocks all three side-effect endpoints: upgrade-module httpx.AsyncClient raises (module-local, global httpx untouched), VERSION_FILE redirected to per-test tmp, EmrgServer._get_or_create_session for 'emrg-upgrade' raises.
• _boot_server forces the upgrade manager disabled via emrg.config.load_update_config patch (restored in cleanup) — booted test servers' 5-min tick loop becomes a no-op.
• test_upgrade session-runner test isolates the session factory; new guard-verification test proves guards active by default.
• MANIFESTO 附则三 codifies the permanent red line; Agent.md count synced.

Verified locally: pytest 985 passed + 1 skipped (986 collected), import + CLI OK; CI test + test-windows both PASS.

[argszero]

✅ LGTM — cycle

Re-review (head 316455f unchanged since the 1st LGTM, MERGEABLE/CLEAN):

• Negative-state verification: test_upgrade_chain_hermeticity_guards confirms the autouse fixture raises on a real upgrade-module httpx.AsyncClient and redirects VERSION_FILE away from the real install path.
• Full local suite: pytest 985 passed + 1 skipped (986 collected), import + CLI OK.
• CI test + test-windows both PASS on the same head.

2/3 consecutive LGTMs.

[argszero]

✅ LGTM — cycle

3rd consecutive LGTM (cycles 1193, 1194, 1195). Fresh verification on head 316455f (unchanged):

• pytest 985 passed + 1 skipped (986 collected) on the PR branch
• import + CLI OK
• CI test + test-windows both PASS
• MERGEABLE/CLEAN

3/3 consecutive LGTMs — merging.

[argszero]

Summary

A long-running pytest session (PID 72994, 21h) was really executing the auto-upgrade chain in the background: real GitHub releases API requests, real ~/.emrg/install/version.txt reads, and real emrg-upgrade session writes (downgrade prompt, delay=1440, target=v0.2.57) every 5 minutes — continuing across daemon restarts and even after emrg stop stopped all real processes (writes at 10:23:12 / 10:28:15 / 10:33:17 after the 10:22:56 stop).

Root cause: EmrgServer.serve() unconditionally starts the 5-minute _upgrade_tick_loop, which builds UpgradeManager(load_update_config(), …) with enabled=True by default. Any test booting a real server over a long session lets the tick run the real chain.

Changes

• tests/conftest.py — new autouse _guard_upgrade_hermeticity fixture (mirrors the existing _guard_stop_daemon_hermeticity red-line pattern):
  1. httpx.AsyncClient in emrg.server.upgrade raises AssertionError on instantiation (module-local — the global httpx module is untouched).
  2. upgrade.VERSION_FILE is redirected to a per-test tmp path — the real ~/.emrg/install/version.txt is never read/written.
  3. EmrgServer._get_or_create_session for SESSION_ID (emrg-upgrade) raises — no real upgrade session may be created/written.
• tests/test_ws_e2e.py — _boot_server forces the upgrade manager disabled (patches emrg.config.load_update_config → UpdateConfig(enabled=False)) so booted test servers' tick loop is a no-op; restored in cleanup. Covers test_daemon_manager_e2e (reuses _boot_server).
• tests/test_upgrade.py — the daemon session-runner test now isolates the session factory (_get_or_create_session); new test_upgrade_chain_hermeticity_guards proves the guards are active by default.
• MANIFESTO.md — 第四条附则三 codifies the permanent red line (same status as the stop_daemon red line, host 2026-08-21 10:35).
• Agent.md — documented test count 985 → 986.

Verification

• uv run pytest tests/ → 985 passed + 1 skipped (986 collected) (was 984+1)
• uv run python -c "from emrg.client.app import run_client" → OK
• uv run python -m emrg --help → OK

[argszero]

✅ LGTM — cycle

Fresh review of the upgrade-chain red-line guard:

• conftest autouse _guard_upgrade_hermeticity blocks all three side-effect endpoints: upgrade-module httpx.AsyncClient raises (module-local, global httpx untouched), VERSION_FILE redirected to per-test tmp, EmrgServer._get_or_create_session for 'emrg-upgrade' raises.
• _boot_server forces the upgrade manager disabled via emrg.config.load_update_config patch (restored in cleanup) — booted test servers' 5-min tick loop becomes a no-op.
• test_upgrade session-runner test isolates the session factory; new guard-verification test proves guards active by default.
• MANIFESTO 附则三 codifies the permanent red line; Agent.md count synced.

Verified locally: pytest 985 passed + 1 skipped (986 collected), import + CLI OK; CI test + test-windows both PASS.

[argszero]

✅ LGTM — cycle

Re-review (head 316455f unchanged since the 1st LGTM, MERGEABLE/CLEAN):

• Negative-state verification: test_upgrade_chain_hermeticity_guards confirms the autouse fixture raises on a real upgrade-module httpx.AsyncClient and redirects VERSION_FILE away from the real install path.
• Full local suite: pytest 985 passed + 1 skipped (986 collected), import + CLI OK.
• CI test + test-windows both PASS on the same head.

2/3 consecutive LGTMs.

[argszero]

✅ LGTM — cycle

3rd consecutive LGTM (cycles 1193, 1194, 1195). Fresh verification on head 316455f (unchanged):

• pytest 985 passed + 1 skipped (986 collected) on the PR branch
• import + CLI OK
• CI test + test-windows both PASS
• MERGEABLE/CLEAN

3/3 consecutive LGTMs — merging.

[argszero]

Summary

A long-running pytest session (PID 72994, 21h) was really executing the auto-upgrade chain in the background: real GitHub releases API requests, real ~/.emrg/install/version.txt reads, and real emrg-upgrade session writes (downgrade prompt, delay=1440, target=v0.2.57) every 5 minutes — continuing across daemon restarts and even after emrg stop stopped all real processes (writes at 10:23:12 / 10:28:15 / 10:33:17 after the 10:22:56 stop).

Root cause: EmrgServer.serve() unconditionally starts the 5-minute _upgrade_tick_loop, which builds UpgradeManager(load_update_config(), …) with enabled=True by default. Any test booting a real server over a long session lets the tick run the real chain.

Changes

• tests/conftest.py — new autouse _guard_upgrade_hermeticity fixture (mirrors the existing _guard_stop_daemon_hermeticity red-line pattern):
  1. httpx.AsyncClient in emrg.server.upgrade raises AssertionError on instantiation (module-local — the global httpx module is untouched).
  2. upgrade.VERSION_FILE is redirected to a per-test tmp path — the real ~/.emrg/install/version.txt is never read/written.
  3. EmrgServer._get_or_create_session for SESSION_ID (emrg-upgrade) raises — no real upgrade session may be created/written.
• tests/test_ws_e2e.py — _boot_server forces the upgrade manager disabled (patches emrg.config.load_update_config → UpdateConfig(enabled=False)) so booted test servers' tick loop is a no-op; restored in cleanup. Covers test_daemon_manager_e2e (reuses _boot_server).
• tests/test_upgrade.py — the daemon session-runner test now isolates the session factory (_get_or_create_session); new test_upgrade_chain_hermeticity_guards proves the guards are active by default.
• MANIFESTO.md — 第四条附则三 codifies the permanent red line (same status as the stop_daemon red line, host 2026-08-21 10:35).
• Agent.md — documented test count 985 → 986.

Verification

• uv run pytest tests/ → 985 passed + 1 skipped (986 collected) (was 984+1)
• uv run python -c "from emrg.client.app import run_client" → OK
• uv run python -m emrg --help → OK

[argszero]

✅ LGTM — cycle

Fresh review of the upgrade-chain red-line guard:

• conftest autouse _guard_upgrade_hermeticity blocks all three side-effect endpoints: upgrade-module httpx.AsyncClient raises (module-local, global httpx untouched), VERSION_FILE redirected to per-test tmp, EmrgServer._get_or_create_session for 'emrg-upgrade' raises.
• _boot_server forces the upgrade manager disabled via emrg.config.load_update_config patch (restored in cleanup) — booted test servers' 5-min tick loop becomes a no-op.
• test_upgrade session-runner test isolates the session factory; new guard-verification test proves guards active by default.
• MANIFESTO 附则三 codifies the permanent red line; Agent.md count synced.

Verified locally: pytest 985 passed + 1 skipped (986 collected), import + CLI OK; CI test + test-windows both PASS.

[argszero]

✅ LGTM — cycle

Re-review (head 316455f unchanged since the 1st LGTM, MERGEABLE/CLEAN):

• Negative-state verification: test_upgrade_chain_hermeticity_guards confirms the autouse fixture raises on a real upgrade-module httpx.AsyncClient and redirects VERSION_FILE away from the real install path.
• Full local suite: pytest 985 passed + 1 skipped (986 collected), import + CLI OK.
• CI test + test-windows both PASS on the same head.

2/3 consecutive LGTMs.

[argszero]

✅ LGTM — cycle

3rd consecutive LGTM (cycles 1193, 1194, 1195). Fresh verification on head 316455f (unchanged):

• pytest 985 passed + 1 skipped (986 collected) on the PR branch
• import + CLI OK
• CI test + test-windows both PASS
• MERGEABLE/CLEAN

3/3 consecutive LGTMs — merging.

[argszero]

Summary

A long-running pytest session (PID 72994, 21h) was really executing the auto-upgrade chain in the background: real GitHub releases API requests, real ~/.emrg/install/version.txt reads, and real emrg-upgrade session writes (downgrade prompt, delay=1440, target=v0.2.57) every 5 minutes — continuing across daemon restarts and even after emrg stop stopped all real processes (writes at 10:23:12 / 10:28:15 / 10:33:17 after the 10:22:56 stop).

Root cause: EmrgServer.serve() unconditionally starts the 5-minute _upgrade_tick_loop, which builds UpgradeManager(load_update_config(), …) with enabled=True by default. Any test booting a real server over a long session lets the tick run the real chain.

Changes

• tests/conftest.py — new autouse _guard_upgrade_hermeticity fixture (mirrors the existing _guard_stop_daemon_hermeticity red-line pattern):
  1. httpx.AsyncClient in emrg.server.upgrade raises AssertionError on instantiation (module-local — the global httpx module is untouched).
  2. upgrade.VERSION_FILE is redirected to a per-test tmp path — the real ~/.emrg/install/version.txt is never read/written.
  3. EmrgServer._get_or_create_session for SESSION_ID (emrg-upgrade) raises — no real upgrade session may be created/written.
• tests/test_ws_e2e.py — _boot_server forces the upgrade manager disabled (patches emrg.config.load_update_config → UpdateConfig(enabled=False)) so booted test servers' tick loop is a no-op; restored in cleanup. Covers test_daemon_manager_e2e (reuses _boot_server).
• tests/test_upgrade.py — the daemon session-runner test now isolates the session factory (_get_or_create_session); new test_upgrade_chain_hermeticity_guards proves the guards are active by default.
• MANIFESTO.md — 第四条附则三 codifies the permanent red line (same status as the stop_daemon red line, host 2026-08-21 10:35).
• Agent.md — documented test count 985 → 986.

Verification

• uv run pytest tests/ → 985 passed + 1 skipped (986 collected) (was 984+1)
• uv run python -c "from emrg.client.app import run_client" → OK
• uv run python -m emrg --help → OK

[argszero]

✅ LGTM — cycle

Fresh review of the upgrade-chain red-line guard:

• conftest autouse _guard_upgrade_hermeticity blocks all three side-effect endpoints: upgrade-module httpx.AsyncClient raises (module-local, global httpx untouched), VERSION_FILE redirected to per-test tmp, EmrgServer._get_or_create_session for 'emrg-upgrade' raises.
• _boot_server forces the upgrade manager disabled via emrg.config.load_update_config patch (restored in cleanup) — booted test servers' 5-min tick loop becomes a no-op.
• test_upgrade session-runner test isolates the session factory; new guard-verification test proves guards active by default.
• MANIFESTO 附则三 codifies the permanent red line; Agent.md count synced.

Verified locally: pytest 985 passed + 1 skipped (986 collected), import + CLI OK; CI test + test-windows both PASS.

[argszero]

✅ LGTM — cycle

Re-review (head 316455f unchanged since the 1st LGTM, MERGEABLE/CLEAN):

• Negative-state verification: test_upgrade_chain_hermeticity_guards confirms the autouse fixture raises on a real upgrade-module httpx.AsyncClient and redirects VERSION_FILE away from the real install path.
• Full local suite: pytest 985 passed + 1 skipped (986 collected), import + CLI OK.
• CI test + test-windows both PASS on the same head.

2/3 consecutive LGTMs.

[argszero]

✅ LGTM — cycle

3rd consecutive LGTM (cycles 1193, 1194, 1195). Fresh verification on head 316455f (unchanged):

• pytest 985 passed + 1 skipped (986 collected) on the PR branch
• import + CLI OK
• CI test + test-windows both PASS
• MERGEABLE/CLEAN

3/3 consecutive LGTMs — merging.

[argszero]

Summary

A long-running pytest session (PID 72994, 21h) was really executing the auto-upgrade chain in the background: real GitHub releases API requests, real ~/.emrg/install/version.txt reads, and real emrg-upgrade session writes (downgrade prompt, delay=1440, target=v0.2.57) every 5 minutes — continuing across daemon restarts and even after emrg stop stopped all real processes (writes at 10:23:12 / 10:28:15 / 10:33:17 after the 10:22:56 stop).

Root cause: EmrgServer.serve() unconditionally starts the 5-minute _upgrade_tick_loop, which builds UpgradeManager(load_update_config(), …) with enabled=True by default. Any test booting a real server over a long session lets the tick run the real chain.

Changes

• tests/conftest.py — new autouse _guard_upgrade_hermeticity fixture (mirrors the existing _guard_stop_daemon_hermeticity red-line pattern):
  1. httpx.AsyncClient in emrg.server.upgrade raises AssertionError on instantiation (module-local — the global httpx module is untouched).
  2. upgrade.VERSION_FILE is redirected to a per-test tmp path — the real ~/.emrg/install/version.txt is never read/written.
  3. EmrgServer._get_or_create_session for SESSION_ID (emrg-upgrade) raises — no real upgrade session may be created/written.
• tests/test_ws_e2e.py — _boot_server forces the upgrade manager disabled (patches emrg.config.load_update_config → UpdateConfig(enabled=False)) so booted test servers' tick loop is a no-op; restored in cleanup. Covers test_daemon_manager_e2e (reuses _boot_server).
• tests/test_upgrade.py — the daemon session-runner test now isolates the session factory (_get_or_create_session); new test_upgrade_chain_hermeticity_guards proves the guards are active by default.
• MANIFESTO.md — 第四条附则三 codifies the permanent red line (same status as the stop_daemon red line, host 2026-08-21 10:35).
• Agent.md — documented test count 985 → 986.

Verification

• uv run pytest tests/ → 985 passed + 1 skipped (986 collected) (was 984+1)
• uv run python -c "from emrg.client.app import run_client" → OK
• uv run python -m emrg --help → OK

[argszero]

✅ LGTM — cycle

Fresh review of the upgrade-chain red-line guard:

• conftest autouse _guard_upgrade_hermeticity blocks all three side-effect endpoints: upgrade-module httpx.AsyncClient raises (module-local, global httpx untouched), VERSION_FILE redirected to per-test tmp, EmrgServer._get_or_create_session for 'emrg-upgrade' raises.
• _boot_server forces the upgrade manager disabled via emrg.config.load_update_config patch (restored in cleanup) — booted test servers' 5-min tick loop becomes a no-op.
• test_upgrade session-runner test isolates the session factory; new guard-verification test proves guards active by default.
• MANIFESTO 附则三 codifies the permanent red line; Agent.md count synced.

Verified locally: pytest 985 passed + 1 skipped (986 collected), import + CLI OK; CI test + test-windows both PASS.

[argszero]

✅ LGTM — cycle

Re-review (head 316455f unchanged since the 1st LGTM, MERGEABLE/CLEAN):

• Negative-state verification: test_upgrade_chain_hermeticity_guards confirms the autouse fixture raises on a real upgrade-module httpx.AsyncClient and redirects VERSION_FILE away from the real install path.
• Full local suite: pytest 985 passed + 1 skipped (986 collected), import + CLI OK.
• CI test + test-windows both PASS on the same head.

2/3 consecutive LGTMs.

[argszero]

✅ LGTM — cycle

3rd consecutive LGTM (cycles 1193, 1194, 1195). Fresh verification on head 316455f (unchanged):

• pytest 985 passed + 1 skipped (986 collected) on the PR branch
• import + CLI OK
• CI test + test-windows both PASS
• MERGEABLE/CLEAN

3/3 consecutive LGTMs — merging.