sync: auto-sync from HOWARD-HOME at 2026-07-07 13:55:03

Author: Howard Enos
Machine: HOWARD-HOME
Timestamp: 2026-07-07 13:55:03

.claude/memory/MEMORY.md

@@ -120,6 +120,7 @@
 - [Python on Windows — use py launcher](feedback_python_windows.md) — Windows Store python/python3 aliases disabled; always use py or jq on DESKTOP-0O8A1RL.
 - [Memory tooling may delete now — additive-only constraint dropped](feedback_memory_sync_destructive_ok.md) — As of 2026-06-02, memory-dream and sync-memory.sh are sanctioned to perform destructive ops (apply proposed merges/dedups, propagate repo deletions back to harness profile stores). Onboarding-phase safety net now fights deliberate consolidation (e.g. 2026-06-01's 39 deletions resurrected on the next sync). Script updates pending.
 - [Unsaved sessions are recoverable from transcripts](feedback_session_recovery.md) — Crashed/closed-before-save sessions live in `~/.claude/projects/<slug>/*.jsonl`; the detector auto-recovers orphans, `/recover <uuid>` does it manually. Ollama prose + Python verbatim. See `.claude/RECOVERY.md`.
+- [Scheduled tasks must not flash a console](feedback_scheduled_task_no_console_flash.md) — A task action running bash.exe/py.exe/python.exe with Hidden=False draws a console window every fire (the recurring "command prompt opening/closing"). Wrap bash via a wscript VBS (style 0), use pythonw.exe for python, always add `-Hidden`. Fixed installers: register-edr-watcher.ps1, register-orphan-detector.ps1.
 - [agy review is not read-only](feedback_agy_review_not_readonly.md) — agy review/review-files CAN write files + run npm despite docs claiming plan-mode; always git diff after and treat Gemini's output as a proposal to validate, not trusted/finished work.
 - [Don't present inferred topology as fact](feedback_no_inferred_topology_as_fact.md) — Private-IP overlap (172.16.x on both sides) is NOT proof of a site-to-site link; I fabricated a VWP<->office VPN. State observations vs inferences; a failed reachability test disproves a link, don't explain it away; test "can reach RMM" against the EXTERNAL endpoint, not internal 172.16.3.30.
 
@@ -223,4 +224,4 @@
 - [Backup targets never guessed](feedback_backup_targets_never_guessed.md) — billed-vs-running mismatches are billing questions for Mike/Winter; never infer/deploy backup targets
 - [Fire #dev-alerts for client/RMM work](feedback_fire_dev_alerts_for_client_work.md) — Howard+Mike watch #dev-alerts Discord for live visibility into what techs/sessions touch. Fire post-bot-alert.sh ([DEV]/[RMM]/[DEPLOY]/[GURURMM] prefix -> #dev-alerts) at the START of any RMM/Dev or active-client-machine action. No CLAUDE.md rule yet — this memory is the rule.
 - [M365 app: SharePoint needs CERT](reference_m365_app_sharepoint_rest_vs_graph.md) — SP app-only works via the CERT (get-token.sh <tenant> sharepoint); the secret gives "Unsupported app only token". Graph app-only uses the secret.
-- [EDR auto-isolates GuruRMM PowerShell](project_edr_rmm_autoisolation_fp.md) — Datto "Exfiltration Over HTTP" rule auto-isolates benign GuruRMM scripts fleet-wide (vwp-qbs 4h outage); watcher + narrow suppression deployed, policy fix pending Mike
+- [EDR auto-isolates GuruRMM PowerShell](project_edr_rmm_autoisolation_fp.md) — Datto "Exfiltration Over HTTP" rule auto-isolates benign GuruRMM scripts fleet-wide (vwp-qbs 4h outage); watcher + narrow suppression deployed, policy fix pending Mike

.claude/memory/feedback_scheduled_task_no_console_flash.md

@@ -0,0 +1,29 @@
+---
+name: feedback_scheduled_task_no_console_flash
+description: Windows scheduled tasks must launch console apps windowless (wscript VBS for bash, pythonw + -Hidden for python) or they flash a console window on the desktop every run
+metadata:
+  type: feedback
+---
+
+A Windows scheduled task whose action runs a **console-subsystem** program — `bash.exe`,
+`py.exe`, `python.exe`, `cmd.exe` — with `LogonType=Interactive` and `Settings.Hidden=False`
+draws a visible console window on the desktop **every time it fires**. On short repetition
+intervals (the EDR watcher fires every 10 min) this reads to the user as a command prompt
+"opening and closing" constantly. It is the single most reported harness annoyance and it
+keeps recurring because the *installer scripts* recreate the flashing task.
+
+**Why:** wscript.exe is a GUI-subsystem host and pythonw.exe is the windowless Python host;
+neither allocates a console. bash.exe / py.exe / python.exe do.
+
+**How to apply:** whenever you register (or find) a ClaudeTools scheduled task:
+- **bash target** -> point the action at `C:\Windows\System32\wscript.exe` with a one-line VBS
+  wrapper that does `CreateObject("WScript.Shell").Run "...bash.exe -lc ...", 0, False`
+  (window style `0` = hidden). Pattern files: `gps-rmm-progress-hidden.vbs`,
+  `edr-isolation-watch-hidden.vbs`.
+- **python target** -> use `pythonw.exe` (next to the active interpreter), never `py.exe`/`python.exe`.
+- **Always** add `-Hidden` to `New-ScheduledTaskSettingsSet` as belt-and-suspenders.
+- Verify: `Start-ScheduledTask`, then confirm no visible bash/wscript/conhost MainWindow.
+
+Fixed installers: `register-edr-watcher.ps1`, `register-orphan-detector.ps1`. The scheduled
+tasks themselves are per-machine (not in the repo) — re-run the fixed installer, or repoint
+the existing task's action, on every box that runs it. Related: [[feedback_session_recovery]].