[sandgraal]

Ticket

M14-02 follow-up (#288, merged c8d6f68). The UI server's plan-run child saw a terminal on stdin on Windows; the Windows run on main at c8d6f68 was red for this case (https://github.com/sandgraal/wowlab/actions/runs/39206897102).

Acceptance — with proof

• The plan run's child has stdin closed and no terminal on every platform: UiServer._start now passes stdin=subprocess.PIPE and closes the writing end right after Popen (before the suspended Windows child is resumed), instead of DEVNULL, whose NUL device is a character device on Windows and reports isatty() True. test_ui_confirm.py::test_a_plan_run_never_carries_yes_and_runs_with_stdin_closed is kept as it was (tty False, stdin reads ""), with a comment on why; it passes locally.
• Windows: windows.yml run https://github.com/sandgraal/wowlab/actions/runs/39209908024 success on 2f553eb.
• ui suites plus lab/core/tests/review and tests/scripts/test_readme.py: 963 passed, 8 skipped. make lint clean.
• make ci green: it ran in full on the M14-02 branch before feat(ui): the confirm flow on snap gc and doctor --yes (M14-02) #288; CI on this PR is the confirmation.
• luadata.py, guard.py or another parser changed? No.
• New external-format parsing? No.
• New runtime dependency? None.
• User-facing surface: none visible; n/a (no wiki page affected).

Invariants (AGENTS.md)

• L1 reads never write: unchanged
• L2 one write gate: unchanged; no write site added
• L3 no Lua execution: n/a
• L4 lossless: n/a
• L5 game data keyed by build: n/a
• L6 no flavor, product, interface or build constants: none added
• L7 nothing ADR-0023 excludes: none touched
• L8 real fixtures: no parser change; the existing test is unchanged; no live calls

Judgment calls

Claims for reviewers to test:

• Before the fix, cli._interactive() would have counted doctor as interactive under the UI on Windows. This was latent because every UI run carries --json. The closed pipe gives the same guarantee (no terminal, EOF on read) on POSIX and Windows.
• The writing end is closed right after Popen and before the suspended Windows child is resumed, so the child can never observe an open pipe with a live writer.

Reviews

Reviewed by: code-reviewer (narrow) CLEAN, no findings: "stdin closed" is now true on Windows, subprocess rules hold, _watch uses reader threads and never communicate(); the test failed on #288's Windows run 39206897102 (head d73111e, DEVNULL) for both [snap gc] and [doctor] on tty is False and passes on run 39209908024 (6763 passed, 437 skipped).

security-reviewer (narrow) CLEAN, no findings: the close cannot block (writer closed before the child has written anything and before the suspended Windows child is resumed); no descriptor leak on success or Popen failure (probe 50+50 starts, fd count unchanged); timeout, tree kill, output cap, env scrub, sys.executable argv and shell=False untouched; uv run --frozen pytest -q lab/core/tests/test_ui*.py 379 passed, 1 skipped.

---

session: 284d1153-c891-4b84-8e47-150842fac4ba
🤖 Generated with Claude Code

[claude]

Claude encountered an error after 0s —— View job

---

I'll analyze this and get back to you.