Refuse to spawn an extraction pool that would spawn its own (#1637) - #3620

Summary

Fixes #1637. On Windows, a caller script with no if __name__ == "__main__": guard turns extract()'s parallel path into a fork bomb rather than a slow failure: every spawned worker re-executes the top-level module on import, and if that module calls extract() again at module scope (the common shape of a quick inline runner script), the worker opens its own ProcessPoolExecutor, whose own guard-less children do the same. A second reporter measured this directly — ~1,278 python.exe processes and ~28 GB consumed before the machine had to be power-cycled.

Root cause

_extract_parallel already caught BrokenProcessPool and fell back to sequential extraction, but only after the pool tried to run. ProcessPoolExecutor._adjust_process_count() respawns dying workers as they die, and on a guard-less caller every respawned worker dies the same way (re-importing __main__ triggers _check_not_importing_main) and — critically — re-executes the module-level extract() call, opening yet another pool. The pool keeps minting doomed processes faster than any per-future exception can propagate and stop it, so the reactive except BrokenProcessPool handler never gets a chance to run.

Fix

Two checks now run in _extract_parallel before a ProcessPoolExecutor is ever constructed:

1. Unconditional: refuse to open a pool when already running inside a multiprocessing child (multiprocessing.parent_process() is not None). A legitimate call to _extract_parallel only ever happens in the main process — a worker should only ever run _extract_single_file via the pool machinery — so this is always safe and breaks the specific recursive-spawn mechanism regardless of platform.
2. Windows only: pre-emptively decline the pool when the caller's own __main__ module's source lacks the __main__ guard text, instead of discovering the failure only after the pool has already started respawning. Scoped to sys.platform == "win32" (matching the existing Windows-specific worker cap already in this function) since macOS/Linux typically default to fork, where this class of guard-less-caller re-execution doesn't occur the same way, and scoping it avoids changing extraction behavior on non-Windows CI.

Both checks fall back to sequential extraction exactly like the existing BrokenProcessPool handler — correct output, just without the pool.

Test plan

• Added test_extract_parallel_declines_pool_inside_a_spawned_worker, test_extract_parallel_declines_pool_on_windows_when_caller_lacks_guard, and test_extract_parallel_still_spawns_pool_on_windows_when_caller_has_guard to tests/test_extract.py.
• Confirmed all pre-existing Windows-spawn fallback tests in the same file still pass unmodified.
• Full suite: python3 -m pytest -q — 5624 passed, 68 skipped, no regressions.
• python3 -m tools.skillgen --check — OK.

🤖 Generated with Claude Code