What

Reconfigure stdin/stdout/stderr to UTF-8 on Windows in two entry points, with a per-stream errors policy that matches what each one writes:

• mempalace/cli.py:main() -- the primary mempalace console_script
• mempalace/fact_checker.py:__main__ -- python -m mempalace.fact_checker --stdin

Per-stream policy:

• stdin -- surrogateescape: a malformed byte from a redirected file (or a misbehaving caller) becomes a lone surrogate the consumer's parser surfaces, instead of UnicodeDecodeError killing the read on the first bad byte.
• stdout -- replace: mempalace search and the fact_checker --stdin path both print verbatim drawer / fact text. A drawer that round-tripped a filename through surrogateescape can carry a lone surrogate; strict would UnicodeEncodeError mid-print and lose the rest of the result block. replace substitutes U+FFFD instead and the result still renders.
• stderr -- replace: same hazard for warning lines that quote user-supplied paths.

Why

On Windows, Python defaults stdio to the system ANSI codepage (cp1252/cp1251/cp950 depending on locale). That mojibakes non-ASCII content at the process boundary -- a hard bug to debug because verbatim drawer text gets corrupted in pipes, and arguments / interactive input read through input() come back garbled.

After auditing every stdio entry point on develop, three user-facing console_scripts / module invocations route non-ASCII content through sys.stdin / sys.stdout:

• mempalace/mcp_server.py:main() -- already fixed in fix: reconfigure MCP stdin/stdout to UTF-8 on Windows (fixes #363) #400
• mempalace/hooks_cli.py:run_hook() -- already fixed in Fix/windows hook stdio utf8 #1280
• mempalace/cli.py:main() and mempalace/fact_checker.py:__main__ -- this PR

After this PR all three of the package's user-facing stdio entry points reconfigure identically on Windows.

mempalace/cli.py:main()

The primary CLI dispatches to subcommands that print verbatim drawer text and wing/room names (mempalace search, mempalace status, mempalace wake-up) and read non-ASCII names via input() through interactive flows (mempalace init -> onboarding -> entity / room detectors).

Concrete failure modes:

• mempalace search "..." > out.txt -- piped stdout mojibakes drawer text containing Cyrillic / CJK
• mempalace ... < input.txt -- piped stdin mojibakes non-ASCII content before subcommand sees it
• Interactive flows on a non-Latin Windows console fall back to ANSI codepage when stdin is redirected (CI scripts, test harnesses)

The reconfigure cascades to every subcommand because sys.stdin / sys.stdout are the same module-global streams that cmd_init, cmd_search, cmd_status, cmd_hook, etc. inherit.

mempalace/fact_checker.py:__main__

fact_checker.py:325 calls sys.stdin.read() from the __main__ block when invoked as python -m mempalace.fact_checker --stdin. Same Windows codepage failure mode -- non-ASCII fact text comes back as mojibake before pattern parsing sees it. Low-traffic CLI utility, fixed for sweep consistency rather than in response to a user-filed bug.

How

Shared helper in mempalace/_stdio.py:

def reconfigure_stdio_utf8_on_windows(
    *,
    stdin_errors: str = "surrogateescape",
    stdout_errors: str = "strict",
    stderr_errors: str = "strict",
    on_failure: Callable[[str, BaseException], None] | None = None,
) -> None:
    ...

No-op off Windows. Each stream's reconfigure is wrapped in try/except so a replaced stream (Jupyter, test harness) routes through the on_failure callback (defaults to a WARNING: line on sys.stderr) and continues rather than crashing the entry point.

cli.py and fact_checker.py ship thin wrappers that pass the CLI policy (stdout_errors="replace", stderr_errors="replace"); the MCP-side reconfigure (#400) shares the same helper with its strict policy via the same module. The thin wrappers preserve the existing _reconfigure_stdio_utf8_on_windows() import surface so existing tests stay shape-compatible.

Tests

tests/test_cli.py:

• test_reconfigures_stdio_to_utf8_on_windows -- patches sys.platform = "win32" plus a ReconfigurableStringIO for each stream; asserts each received the right per-stream reconfigure(encoding="utf-8", errors=...) exactly once (stdin=surrogateescape, stdout/stderr=replace).
• test_reconfigure_stdio_is_noop_off_windows -- patches sys.platform = "linux"; asserts no reconfigure call.

tests/test_fact_checker.py::TestCLI:

• Same two tests against fact_checker._reconfigure_stdio_utf8_on_windows.

Local run: 83 passed (cli + fact_checker suites). ruff check . and ruff format --check . clean.

Out of scope

• Existing CLI / fact_checker detection logic is unchanged.
• No changes to imports, public API, or behavior off Windows.
• File I/O sites with open() / Path.read_text() lacking explicit encoding="utf-8" are a separate bug class (mojibake on file content, not stdio) and would warrant their own audit.
• Internal utility scripts invoked as python -m mempalace.<module> for development (dialect, diary_ingest, repair, spellcheck, etc.) are not in this sweep -- they are reached through mempalace ... subcommands which now reconfigure at cli.py:main() and inherit the UTF-8 streams.

Body updated 2026-05-03 to match landed code: 03643eb switched the errors policy from blanket strict to per-stream (stdin=surrogateescape, stdout/stderr=replace) so a redirected file with bad bytes does not crash the read and a drawer carrying a surrogate half from a filename round-trip does not crash mid-print; 285b3b4 extracted the loop into mempalace/_stdio.py so the CLI / fact_checker / mcp_server entry points share one helper instead of carrying duplicate copies.