emrg: fix Windows cmd-window storm + daemon spawn throttle (v0.2.15 regression hotfix)

[argszero]

Summary

Emergency hotfix for the v0.2.15 Windows regression reported in rant 2026-08-09T13:16:36 (highest priority — host observed continuous cmd popups and had to reboot; daemon startup failure left GUI/scheduler unable to connect).

Root causes

1. No window-suppression anywhere: grep -rn "CREATE_NO_WINDOW|creationflags" emrg/ had zero hits. Every subprocess.Popen / create_subprocess_* call (git, gh, bash tool, scheduler, daemon spawn) popped a console window on Windows.
2. GUI infinite respawn loop: ensureConnected respawned emrgd.cmd every ~5s forever on failure. Each spawn raced the previous daemon's startup; the G43 stale-port unlink deleted a healthy daemon's port file → its scheduler logged cannot connect 93× while the GUI kept spawning (emrgd.log evidence: 92 prompt built / 93 cannot connect / 0 connected).
3. No scheduler connect backoff: failed ticks returned immediately and re-ran at full interval; multiple handlers amplified the storm.

Changes

Python (all 34 subprocess call sites)

• NEW emrg/_win.py: win32_no_window_kwargs() returns {"creationflags": subprocess.CREATE_NO_WINDOW} on Windows, {} elsewhere (no-op on macOS/Linux).
• Splatted into: bash_tool.py, scheduler.py (12 sites), daemon.py (5), git_utils.py, client/daemon_manager.py, skills/installer.py, __main__.py (3), client/app.py (9).

Scheduler backoff (rant item ③)

• Connect-failure exponential backoff: max(30s, interval × 2^n) capped at 10 min — retry storm eliminated while daemon is down.

GUI anti-storm master switch (rant item ⑤)

• daemon_client.js: spawn throttle — max 3 spawn attempts per connect lifecycle, then throw with the real emrgd.log tail instead of respawning; counter resets on successful auth.
• daemon_client.js: both spawn-timeout errors now append the emrgd.log tail (_readLogTail, mirrors daemon_manager R124) — host sees the real reason, not failed to start within timeout (rant item ②).
• main.js: reconnect exponential backoff 1s→2s→4s→…cap 60s; throttled failure surfaces as daemon_stopped status with the real error + log tail (zh/en i18n).

Tests

• Python: 641 → 647 — win32_no_window_kwargs (POSIX no-op / Windows CREATE_NO_WINDOW / splat-compat) + scheduler backoff (no-failure interval / exponential growth / 10-min cap / 30s floor).
• GUI: 96 → 98 — spawn throttle (3 attempts then no-spawn) + counter reset on successful auth.
• Doc counts synced in README.md / README.cn.md / Agent.md (emrg: sync test counts to 484 + guard test against doc drift (recurs #426/#430/#510) #511 guard).

Verification

• uv run pytest tests/: 647 passed
• uv run python -c "from emrg.client.app import run_client": OK
• uv run python -m emrg --help: OK
• npm test (emrg/gui): 98 passed
• macOS/Linux unaffected (win32 branch is an empty-dict no-op); all 34 call sites verified to carry the splat.

Per rant: this is a hotfix — once merged, the v0.2.16 release flow should follow (host #16/#18 pre-authorized release without waiting for real-machine verification).

[argszero]

✅ LGTM — cycle 2026-08-09T16:49 (Round 186)

Reviewed the full diff on the PR branch:

• emrg/_win.py is a clean cross-platform design: win32_no_window_kwargs() returns {creationflags: CREATE_NO_WINDOW} on Windows and {} on POSIX (verified via unit tests incl. the splat-compat test).
• All 34 Python subprocess call sites carry the splat (script-verified, zero gaps).
• Scheduler exponential backoff max(30s, interval*2^n) cap 10 min — covered by 3 new tests (interval/no-failure, growth+capping, 30s floor).
• GUI spawn throttle (3 attempts per lifecycle, reset on auth) + reconnect backoff (1s→…→60s) — covered by 2 new tests.
• _readLogTail on both spawn-timeout paths surfaces the real emrgd.log failure reason (rant acceptance item ②).

Verified on the PR branch: uv run pytest tests/ → 647 passed; npm test → 98 passed; import/--help OK. Doc counts synced (#511 guard). POSIX no-op confirmed — zero macOS/Linux behavior change.

[pm25coder]

Tested this PR on Windows (win32, Python 3.13.4) — the hotfix behaves as designed:

[argszero]

✅ LGTM — cycle 2026-08-09T17:11 (Round 189)

Second independent review of the storm-fix foundation PR (re-verified fresh this cycle):

• emrg/_win.py win32_no_window_kwargs() — clean cross-platform design (CREATE_NO_WINDOW on Windows, empty dict on POSIX; getattr fallback keeps POSIX importable/testable).
• All 34 Python subprocess call sites carry the splat (script-verified, zero gaps across bash_tool/scheduler/daemon/git_utils/daemon_manager/installer/main/client).
• Scheduler exponential backoff max(30s, interval*2^n) cap 10min — covered by 3 tests (interval/no-failure, growth+capping, 30s floor).
• GUI spawn throttle (3 attempts/lifecycle, reset on auth) + reconnect backoff (1s→…→60s) + _readLogTail on both spawn-timeout paths — 2 new tests.
• POSIX no-op confirmed (empty-dict splat changes nothing on macOS/Linux).

Fresh verification on the PR branch: uv run pytest tests/ → 647 passed; npm test → 98 passed; import + --help OK. Doc counts synced (#511).

[pm25coder]

Re-verified the delta commit 4cb0fe8 (one-time daemonStoppedNotified guard) on this Windows host:

[argszero]

✅ LGTM — cycle 2026-08-09T17:25 (Round 192)

Third independent review (3/3 consecutive LGTMs: C186, C189, C192). Fresh verification on the PR branch:

• uv run pytest tests/ → 647 passed
• npm test (emrg/gui) → 98 passed
• import + --help OK

Final diff audit (2 commits):

1. 37acdc0 — storm containment: emrg/_win.py win32_no_window_kwargs() splatted into all 34 subprocess call sites (script-verified zero gaps); scheduler connect backoff max(30s, interval*2^n) cap 10min; GUI spawn throttle (3/lifecycle, reset on auth) + reconnect backoff 1s→…→60s + real emrgd.log tail in spawn errors.
2. 4cb0fe8 — daemon_stopped one-time per connect lifecycle (symmetric with TUI _throttle_warned, PR #594), prevents duplicate system messages every backoff retry.

POSIX no-op confirmed (empty-dict splat). Doc counts synced (#511). Merge-ready.