session-flow/running-retro observer on Windows: visible console window at analysis spawn; ledger mojibake (UTF-8 as cp1252)

[kyle-sexton]

Summary

Two Windows-specific defects in the session-flow running-retro detached observer (v0.17.3), observed on Windows 11 / Python 3.14:

1. Analysis subprocess flashes a visible console window

arm_observer.py's spawn_detached correctly sets DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW for the observer process itself — but the observer's own analysis spawn (the headless claude -p run at end-of-session) does not: a console window titled "Claude" popped up on the operator's desktop at analysis time and vanished on completion. For a feature whose selling point is "zero-footprint background observation," a surprise terminal window mid-desktop is a real UX defect — the operator's first question was whether something malicious had run.

Fix: apply the same creationflags (at minimum CREATE_NO_WINDOW) to the analysis subprocess.

2. Ledger written with mojibake (UTF-8 mis-decoded as cp1252)

The autonomous checkpoint ledger contains · for ·, – for –, â€" etc. throughout — classic UTF-8-bytes-read-as-cp1252. On Windows, Python subprocess/file IO defaults to the ANSI code page unless encoding="utf-8" is explicit; somewhere in the observer's analysis-output capture or ledger write, that default is in play. (Separately observed in the same session: a subprocess.run(text=True) without explicit encoding crashed with UnicodeDecodeError: 'charmap' codec on UTF-8 API output — the same class of defect; worth an audit of every subprocess/open call in the plugin's scripts for explicit UTF-8.)

Fix: explicit encoding="utf-8" (or errors="replace") on every text-mode subprocess capture and file write; consider PYTHONUTF8=1 for spawned children.

---

Filed by an AI agent during an attended session (operator-directed). Related: #1468 (arm launcher NameError, same component), and the idle-detection issue filed alongside this one.

[kyle-sexton]

This was generated by AI during triage.

Triage

State: raw → verified → briefed → autonomous-eligible (delegable)

Scope note: same as the sibling issues from this session — opened with priority: medium set directly rather than the repo's raw marker (priority: needs-triage), so the issue-triage-label floor workflow never fired. Treated as raw intake (no type/status/role/work-class present).

Verified (source inspection of plugins/session-flow/skills/running-retro/scripts/observer.py, _run_analysis, confirmed by reading the code, not reproduction):

• Console window (part 1): the analysis subprocess is started with a plain subprocess.run(cmd, input=prompt, capture_output=True, text=True, env=env, timeout=self.analysis_timeout_secs) — no creationflags at all. That's a real asymmetry with the observer's own spawn: arm_observer.py's spawn_detached explicitly sets DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP | CREATE_NO_WINDOW (0x00000008 | 0x00000200 | 0x08000000) on Windows for the observer process, but that flag set was never carried to the analysis subprocess spawned later from inside the (already windowless) observer. Confirms the report's fix direction.
• Mojibake (part 2): the same subprocess.run call passes text=True with no explicit encoding=. Python decodes subprocess stdout/stderr using the platform's default text encoding when none is given, which on Windows is the ANSI/cp1252 code page, not UTF-8 — while claude -p --output-format json writes UTF-8. This is the exact mechanism the report describes; I'm treating the empirical mojibake evidence plus the absent explicit encoding= as sufficient without re-reproducing it. Everywhere else in this file (_write_status, _append_ledger's ledger.write_text, self.log) already passes encoding="utf-8" explicitly — this one call site is the outlier.

Considered splitting (per the routing question posed): both halves are the same root shape (a missing kwarg on the identical subprocess.run call in _run_analysis), same type (Bug), same work-class (mechanical — deterministic, trivially reversible, no design decision), and neither meets the priority-escalation bar (blocks other work / imminent deadline), so both stay priority: medium. No divergence in work-class or priority → not split. Filing two items for two sibling kwargs on one call site would just double PR/review overhead for what is fixable as one small diff.

Classification: Bug, priority: medium (kept as filed), work-class: mechanical, autonomous-eligible (agent-ready) — delegable, no open decision.

Agent Brief

Type: Bug
Summary: the running-retro observer's headless analysis subprocess (claude -p, fired on idle-detect) flashes a visible console window on Windows and has its captured output mis-decoded, corrupting the ledger with mojibake.

Current behavior:

• On Windows, when the observer's post-idle analysis subprocess is launched, a console window becomes briefly visible on the desktop for the duration of the run, even though the observer process itself is fully detached and windowless.
• The analysis subprocess's captured stdout is decoded with the platform default text encoding rather than UTF-8. Since the claude -p child writes UTF-8, non-ASCII characters (typographic punctuation such as ·, –, —) are mis-decoded, and the corrupted text is what gets appended to the durable running-retro ledger.

Desired behavior:

• The analysis subprocess spawns with no visible window on Windows, consistent with the observer's own "zero-footprint background observation" design.
• The analysis subprocess's captured output is decoded as UTF-8 regardless of platform default code page, so ledger entries never contain mojibake.

Key interfaces:

• The subprocess invocation that fires the headless post-idle analysis run and captures its text output for the ledger append.

Acceptance criteria:

• On Windows, arming the observer and letting an idle-triggered analysis run fire produces no visible console window.
• Analysis output containing non-ASCII characters (e.g. em dash, middle dot) round-trips correctly into the ledger — no cp1252-as-UTF-8 mojibake sequences (·, –, â€", etc.) appear in the written checkpoint section.
• Behavior on non-Windows platforms is unchanged.

Out of scope:

• The issue also flags, as a separate follow-on: "worth an audit of every subprocess/open call in the plugin's scripts for explicit UTF-8." That is a broader sweep across the plugin, a different (larger, non-mechanical) scope than this two-line fix — not part of this item. File separately if pursued.
• Any change to --idle-seconds end-detection behavior (tracked separately in session-flow/running-retro observer: mtime-idle end detection fires mid-session (default 900s), analyzes a partial transcript, never resumes #1471).
• Any change to the analyzer's inference quality (tracked separately in session-flow/running-retro analyzer: stenographer bias — accurate on self-declared findings, 0/2 on independent inference; structural claims asserted not computed #1473).

Related: #1468 (arm launcher NameError, same component, PR #1474 open — that PR's fix is to arm_observer.py's spawn, a different call site than this one).

[kyle-sexton]

[kyle-sexton]

This was generated by AI during work-loop execution.

Opened PR #1481 (fix/1472-observer-console-window-mojibake), implementing both fixes from the triage brief on the same subprocess.run call in _run_analysis (plugins/session-flow/skills/running-retro/scripts/observer.py):

1. creationflags=CREATE_NO_WINDOW on Windows only — suppresses the visible console window during the headless analysis run.
2. encoding="utf-8" unconditionally — fixes the cp1252-as-UTF-8 mojibake in the ledger.

Added test_analysis_subprocess_utf8_and_windowless_on_windows to test_observer.py, asserting both kwargs via a faked subprocess.run; ran on a real Windows box, so the creationflags branch executed for real, not just mocked. Full suite: 24/24 passing. Version bumped to 0.17.4 with a CHANGELOG entry.

One acceptance-criterion item not exercised by an automated test (noted in the PR's Test plan): a live end-to-end idle-triggered analysis run producing a visually confirmed windowless spawn on Windows — the deterministic creationflags assertion covers the mechanism, not a live visual observation.