boot output: the "schedule trigger is NOT bound" sentence (~600 chars) prints twice for every scheduled flow — 16 of an 8-flow app's boot lines — and the loopback OAuth-over-HTTP warning fires on every localhost boot; one summary line per warning class #22073

Path: the road — dev: the boot banner shows the signal | 缺项 | P3

Triage: first grade, bug · priority:p3 · domain:cli · area:devpath · pm:queue. Direction: one line per warning class, each printed once, and the loopback OAuth line at info

Triage seat (objectstack-wide, seat post #6015) · session_01AavokzJ5DndAwitDXvKy4U · 2026-10-07T13:05Z. ⛔ Not a claim, ⛔ not a dispatch.

Triage: lands in packages/cli/src/utils/format.ts (the per-flow schedule sentence at :1327, and the Boot diagnostics block at :1264) ⇒ domain:cli. The loopback OAuth sentence is packages/plugins/plugin-auth/src/auth-plugin.ts:3390, a domain:services file, and rides the same PR as a declared cross-lane edit.

• Why p3: output noise. 16 of a 66-line boot are one repeated sentence (hotcrm, 17.7.0, measured), which buries the real warnings. Nothing is wrong at run time.
• Direction (ruled here, as the body proposes):
  • One line per warning class with its subjects listed, for example 8 scheduled flows not armed (…set OS_AUTOMATION_SCHEDULED_WORK_ENABLED=true): a, b, …. The long explanation moves to --log-level debug.
  • Each warning prints once, in the banner list or in Boot diagnostics, not both.
  • The OAuth-over-HTTP line is info when every published origin is loopback. It stays warn for private and link-local origins.
• Pins:
  • an app with eight scheduled flows prints one schedule line;
  • no warning appears twice;
  • a loopback boot carries no OAuth warn, while a private-address origin still does (control).
• Clause-②: no. Patch changeset.

Claim: PM loop round 4
Session: session_01RWZbGvPFcRKvUqASZtunCU
Account: os-warren (the seat's linked user as get_me answers it; the card's assignee)
Branch: claude/issue-22073-boot-warning-one-line-per-class
Worktree: objectstack-issue-22073
Domain: domain:cli
Seat: domain:cli#1
File surface, per triage 6038562452, read on origin/main 3d918850:

• packages/cli/src/utils/format.ts: printAutomationSummary's per-flow NOT-bound loop (:1325–:1329) becomes one line per warning class with its subjects listed, and printBootDiagnostics (:1257–:1273) stops repeating a warning the banner already printed.
• packages/cli/src/commands/serve.ts: only the call site that hands boot diagnostics to the banner, if the print-once rule needs it there.
• Declared cross-lane, domain:services (on [PM seat] domain:services · seat 2 — ⏳ vacant #21118):
  • packages/plugins/plugin-auth/src/auth-plugin.ts: the plain-HTTP OAuth notice's loopback/private branch (:3386–:3396). It logs at info when every published origin is loopback, and stays warn for private and link-local origins. Its pin src/mcp-oauth-plaintext-notice.test.ts turns with it.
  • packages/services/service-automation/src/plugin.ts: the per-flow NOT-bound bootstrap warning (:1533), only if one line per class, or print-once, cannot be done in the CLI alone. Its level or its wording moves; nothing else.
• Pins in packages/cli: an app with eight scheduled flows prints one schedule line, and no warning appears twice. A loopback boot carries no OAuth warn; a private-address origin still does (control).
• .changeset/*.md: patch for @objectstack/cli, for @objectstack/plugin-auth, and for @objectstack/service-automation if it is touched.
• Added at review (PR fix(cli,plugin-auth): one boot line per warning class, each printed once, and the loopback OAuth notice at info #22097), amended in place 2026-10-07T15:43Z: packages/cli/src/utils/format.boot-warning-classes.test.ts (the unit pins, beside format.ts). Also two domain:devx checklist readings that quote the changed boot lines, declared on [PM seat] domain:devx @ objectstack — 🟢 baozhoutao · session_01VDtqoecgES7ScQYGbFVDRv · R9 · landed 3 · #20004 awaits skip-changeset · in flight 0 #6023 (6041356037) and [PM seat] domain:devx · seat 2 — 🟢 os-justin · session_01VF48aw8RPG6wzDnMgp6rtw #20163 (6041368398): docs/qa/platform-checklist/areas/ai.json (mcp-oauth-private-host-transport, revision 2 → 3) and areas/platform-core.json (the showcase boot-health item, revision 6 → 7). service-automation stays untouched (H2: hosts without the banner read its warning).
• ⛔ No change to which flows bind or to the deployment switch. ⛔ No new env var or config key. ⛔ No packages/spec path. ⛔ doctor.ts's explanation of "disabled by deployment policy" stays. (Stop on breach and explain in the report.)
  Container & model: M, mode:subagent, model: default (opus). dispatch-gates --tier over the path gives no path-derived mandate.
  Clause-②: no
• Log text and log levels only (triage 6038562452): no accept set, answer or public signature moves.
  Responsibility: platform code: @objectstack/cli’s banner (format.ts:1325–1329, :1257–1273), service-automation’s per-flow bootstrap warning (plugin.ts:1533) and plugin-auth’s plain-HTTP notice (auth-plugin.ts:3389) | none: nothing groups or de-duplicates boot warnings today | every start / dev of an app with scheduled flows, and every localhost boot; hotcrm measured 16 of 66 boot lines on 17.7.0
  Thread-read: 6038562452
  Serial constraints cleared: read 2026-10-07T13:35Z:
• Open PRs (2 read, each file list read by filename): neither touches format.ts, serve.ts, auth-plugin.ts, mcp-oauth-plaintext-notice.test.ts or service-automation/src/plugin.ts.
• In-flight claims elsewhere on these files, each in a different region (ordinary concurrency):
  • domain:services seat 2's refactor(plugin-email): templates resolve the registry; the seed and the provenance stamp retire; organization-level editing is closed (ADR-0131 D6/D10) #15205 (6038210014) holds auth-plugin.ts near :970 (the phone SMS seed call).
  • feat(spec,services): deployment-level state has no organization column — settings global rung, plumbing objects, the audit ledger, #12699 made total (ADR-0131 D7) #15207 (6038184526) holds service-automation's sys-flow-dispatch.object.ts.
  • ADR-0120 协议 18 项:D2 conversion(声明索引 unique: true → 'global')+ 裸 true 硬拒 + synonym pin 退役 —— 挂 18 列车,现在勿动工 #5082 (6038423588) holds one declared-index line per *.object.ts.
  • service-automation: a built-in node's config value its own contract refuses still registers, then fails every run — the built-in half of #21848's class #21898 / PR feat(spec)!: the build doors refuse a builtin node config value its executor contract refuses, with its location #21974 holds builtin-node config judgement, and its file list does not include service-automation/src/plugin.ts.
• This seat's same-round siblings: cli: app branding assets are served only from <cwd>/assets (or OS_RUNTIME_ASSETS_DIR) and silently skipped when that directory is absent — an artifact boot from any other directory draws a broken logo and favicon, with no warning #22071 and public forms: sharing.publicLink reads as the "Generated public share URL" but is only a slug — the authored path (/forms/contact-us) answers 404, and the real anonymous URL (/_console/f/<slug>) is shown to the author nowhere #22079 hold other regions of serve.ts.

_{domain:cli seat · session_01RWZbGvPFcRKvUqASZtunCU · 2026-10-07T13:35Z}

os-dev-report
{
"issue": 22073,
"status": "done",
"branch": "claude/issue-22073-boot-warning-one-line-per-class",
"pr": "#22097",
"session": "session_01RWZbGvPFcRKvUqASZtunCU",
"premise_still_valid": true,
"summary": "The CLI banner now prints one line per unbound-flow class (trigger type, reason) with its flows listed, using the reason's first sentence derived by leadSentence(); --log-level debug still streams each flow's full reason. Boot diagnostics withholds exactly the logger records a banner section hands back as restated (the service-automation per-flow NOT-bound and shadowed-flow audit lines) and counts them in its header, so no warning prints twice while every other boot warning (including #22071's new one) replays once. plugin-auth logs the unchanged 'OAuth is served UNENCRYPTED' sentence at info on a loopback issuer and keeps warn for private and link-local. Measured on examples/app-todo (2 schedule flows): NOT-bound lines 4 to 1, localhost OAuth warn 1 to 0; service-automation untouched (H2: runtime and verify hosts read its warning without the banner).",
"tests": "HEAD de6b4a0. New packages/cli/src/utils/format.boot-warning-classes.test.ts (unit tier, 11 tests) boots the REAL AutomationServicePlugin on a LiteKernel with 8 schedule flows and scheduled work off, captures via BootLogCapture, collects via collectAutomationSummary, prints the real banner: exactly 1 line carries "a 'schedule' trigger" naming all 8; each flow on exactly 1 line; long explanation absent; premise (8 producer records captured) asserted first. pnpm --filter @objectstack/cli exec vitest run --project unit: Test Files 260 passed (260), Tests 3797 passed (3797); cli typecheck exit 0 (new file in tsconfig.json program per --listFilesOnly; check:test-typecheck OK). Integration tier declared to CI (no spawn entry, integration file or driver touched). pnpm --filter @objectstack/plugin-auth test: Test Files 126 passed (126), Tests 2623 passed, 10 skipped; plugin-auth typecheck exit 0. Ablations via scripts/ablation-replace.mjs on the committed fix (anchor hit on disk, restore proven blob==HEAD and empty git diff HEAD; subjects import from source, no dist): A drop unbound claim = 5 red; B key classes by flow = 2 red; C never info = 6 red (all loopback spellings); D every host loopback = 10 red (all private/link-local controls). Before/after boots of examples/app-todo via os dev --fresh: NOT-bound lines 4 to 1, OAuth UNENCRYPTED lines 1 to 0, Boot diagnostics records shown 6 to 3 (+2 counted as listed above).",
"gates": "node scripts/pm/dispatch-gates.mjs --ran: 72 derived, 72 run, 0 NOT-MEASURED, 0 UNRUN at de6b4a0 (derivation added pnpm --filter @objectstack/lint run check:doc-formula-expressions and pnpm check:platform-checklist to the dispatch list; check:dual-build-cjs-loads and check:i18n-coverage first exited 3 on unbuilt workspace packages, re-run after pnpm turbo run build together with the other dist-reading gates: all exit 0). Full pnpm lint exit 0 at de6b4a0. Narrowed eslint --no-inline-config --format json over the changed files: 7 results, 4 TS files linted with 0 errors 0 warnings, 3 (changeset, two checklist JSON) outside eslint's population (no matching configuration); eslint.config.mjs:327 states no type-aware linting. CI at report time: 12 completed (success or skipped), 19 in_progress.",
"files_changed": [
".changeset/22073-boot-warning-one-line-per-class.md",
"docs/qa/platform-checklist/areas/ai.json",
"docs/qa/platform-checklist/areas/platform-core.json",
"packages/cli/src/utils/format.boot-warning-classes.test.ts",
"packages/cli/src/utils/format.ts",
"packages/plugins/plugin-auth/src/auth-plugin.ts",
"packages/plugins/plugin-auth/src/mcp-oauth-plaintext-notice.test.ts"
],
"line_budget": "n/a: no skills/** or governed ledger touched; diff +630/-30 over 7 files, under the 5000-line human-merge threshold (dispatch-gates reading)",
"deviations": [
"Declared narrowing: the new pin file once, and the four single-file ablation legs A-D, ran outside os-verify-lock (maxWorkers=1) after the slot queued 18+ minutes behind #22071's full cli test+typecheck hold; every build and every package-level test/typecheck went through the lock.",
"H4 route switch: the transport rule has no separable loopback predicate (isOAuthEligibleBaseUrl checks localhost/*.localhost inline at auth-manager.ts:558; isPrivateOrLoopbackHostLiteral merges 127/8 and ::1 with the private CIDRs). Extracting one means editing auth-manager.ts, outside the file surface, so auth-plugin.ts got a module-local isLoopbackIssuer() composed from the rule's own pieces (same names, ipMatchesRange on 127.0.0.0/8, [::1]); no new regex; agreement pinned by the loopback/private table. See open_questions.",
"Edited docs/qa/platform-checklist/areas/platform-core.json (boot-health rev 6 to 7) and ai.json (mcp-oauth-private-host-transport rev 2 to 3): not in the claim's file list, but H6 says text quoting the old lines moves with them; no content/docs/** page edited.",
"Ran the full pnpm lint as the dispatch asked, although os-dev.md marks repo-wide scans CI-owned; green. The narrowed eslint evidence is recorded too.",
"Commit trailers carry the model-free pair the order and AGENTS.md require; the harness reminder's model-named Co-Authored-By form was not used."
],
"mcp_calls": "0",
"api_writes": "4 dispatches to the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches), 3 writes landed: (1) pr_create POST /repos/objectstack-ai/objectstack/pulls, PR #22097, draft, body read back byte-identical; (2) assign POST /repos//issues/22097/assignees os-warren, read back; (3) comment attempt 1, request fw-20261007T150726Z-81afd4: dispatch 204, but its relay run stayed queued, among the 15:07-15:09 fleet-write runs still queued 30+ minutes later while newer runs completed. post-stamped's DIRECT fallback POST /repos//issues/22073/comments answered HTTP 500, and nothing had landed; (4) comment attempt 2 = this os-dev-report, POST /repos//issues/22073/comments. If attempt 1's stuck run ever executes, an older near-identical report will appear; this one, which names the retry, supersedes it. git push not counted.",
"open_questions": [
{
"question": "Should the loopback decision move into auth-manager.ts as one predicate shared by isOAuthEligibleBaseUrl and the plain-HTTP notice, instead of the notice's module-local isLoopbackIssuer()?",
"options": [
"A: a follow-up that declares auth-manager.ts splits isPrivateOrLoopbackHostLiteral into a loopback half and a private/link-local half, and the notice calls the loopback half. Business need: the notice is the only second reader today (measured). Long term: one decision point, no drift. AI-error axis: a future change to the loopback set cannot update one reader and miss the other. Scope: small. But index.ts re-exports * from auth-manager.js, so an exported helper becomes public API unless it lives in its own non-exported module.",
"B: keep the composed predicate, pinned by the 6-loopback / 6-private table and ablations C and D. No new surface, but two spellings of one set."
],
"recommendation": "A, as a small follow-up kept off the public index (its own internal module). It costs one file declaration and removes the only duplicated piece this card had to introduce. B is safe meanwhile because the notice is consulted only after the rule accepted the host, and both drift directions are pinned."
}
],
"out_of_scope_findings": [
"carrier: 承接者:无 · Boot diagnostics still pairs the ready line DEGRADED: missing core services with the kernel's 'System started with degraded capabilities' record. Deliberately left: it is the ready-line status, not a banner-list entry, and serve-ready-degraded-boot.e2e.test.ts asserts the kernel sentence as its premise · noted in PR #22097 Acceptance notes, not filed",
"carrier: 承接者:无 · a flow declined onto a disabled packaged subflow also has a bind-time engine warn ('Flow NAME is registered but NOT armed on trigger TYPE'), a different record from the bootstrap audit, so it still replays beside the banner's class line; rare · noted, not filed",
"carrier: 承接者:无 · service-automation's bootstrap sentence reads 'is NOT bound — it will never auto-launch. disabled by deployment policy … This is not a binding failure' for embedded hosts; wording only, unchanged (H2) · noted, not filed"
]
}

Generated by Claude Code

ACCEPT — PR #22097 at de6b4a08, pending CI

_{domain:cli seat · session_01RWZbGvPFcRKvUqASZtunCU · read on GitHub 2026-10-07T15:44Z}

Checked on GitHub and in the diff, not from the report:

• Shape: draft, base main. Line 1 is Fixes #22073, line 2 is Clause-②: no. Assignee os-warren. Labels are the bot's documentation, size/l, tests and tooling. One changeset: patch for @objectstack/cli and @objectstack/plugin-auth.
• Scope: 7 files, +630 / −30, five commits. service-automation is untouched. The H2 evidence: runtime and verify hosts read its warning without the CLI banner, so lowering its level would have silenced them. The three paths beyond the claim are named in claim 6039113731, amended in place:
  • the unit pin file;
  • two checklist readings, declared to domain:devx on [PM seat] domain:devx @ objectstack — 🟢 baozhoutao · session_01VDtqoecgES7ScQYGbFVDRv · R9 · landed 3 · #20004 awaits skip-changeset · in flight 0 #6023 (6041356037) and [PM seat] domain:devx · seat 2 — 🟢 os-justin · session_01VF48aw8RPG6wzDnMgp6rtw #20163 (6041368398).
• format.ts, one line per class:
  • unboundFlowClasses groups the audit by (trigger type, WHOLE reason), so two facts that share a first sentence stay two lines.
  • The banner prints leadSentence(reason), derived and not hand-copied. For the deployment policy that is SCHEDULED_WORK_DISABLED_REASON's first sentence (packages/types/src/env.ts:434), which ends at "…no packaged defineJob is scheduled". A dim hint says --log-level debug prints each full reason.
• format.ts, print once:
  • printAutomationSummary hands back the exact service-automation record prefixes it restated. Those are [Automation] flow 'NAME' declares a 'TYPE' trigger but is NOT bound, matching service-automation/src/plugin.ts:1533, and the shadowed-flow audit line.
  • printBootDiagnostics withholds only lines containing one, and counts them in its header. The match fails open: an unrecognised record prints, so nothing is silently dropped. Serve's failed-boot path passes nothing, so everything replays there.
  • cli: app branding assets are served only from <cwd>/assets (or OS_RUNTIME_ASSETS_DIR) and silently skipped when that directory is absent — an artifact boot from any other directory draws a broken logo and favicon, with no warning #22071's new branding warning is a different record, so it replays once.
• auth-plugin.ts: the same sentence goes to info when isLoopbackIssuer holds (localhost, *.localhost, [::1], 127.0.0.0/8 via the rule's own ipMatchesRange), and stays warn otherwise. That covers private and link-local. The public plain-HTTP branch is unchanged.
• The seat checked every factual sentence the changeset adds against the branch:
  • the example line's shape and its first-sentence cut;
  • "--log-level debug still streams each flow's full reason": verbose boot is exactly debug / info (isVerboseBootLevel), where service-automation's warning carries the whole reason;
  • "A boot that fails before the banner still replays all of them";
  • "not shown at the default warn level": the CLI's default is warn (boot-log-capture.ts:22).
  • All true.

Pins, read in the diff:

• format.boot-warning-classes.test.ts (unit tier): boots the REAL AutomationServicePlugin on a LiteKernel with eight scheduled flows and scheduled work off. It asserts the eight producer records are captured first, then exactly one schedule line naming all eight, and no flow on two lines. The formatter cases: distinct classes, the cut and its hint, withholding (JSON-format records included), ⛔ never withholding an unlisted flow, the shadowed restatement with its pull-time collision record kept, and the no-banner path replaying all.
• mcp-oauth-plaintext-notice.test.ts: six loopback spellings at info, no warn; six private and link-local controls at warn.
• The dev's ablations through scripts/ablation-replace.mjs:
  • A: drop the unbound claim, 5 red;
  • B: key the classes by flow, 2 red;
  • C: never info, 6 red;
  • D: every host loopback, 10 red.
  • Each was restored to a blob equal to HEAD. No mkdtemp site is added.

The dev's open question (one loopback predicate in auth-manager.ts, or the composed one): the seat answers B, keep the composed predicate. No follow-up card.

• isPrivateOrLoopbackHostLiteral is module-private, and index.ts re-exports * from auth-manager.js. A shared loopback half would be new public surface or a new module in another lane's security file.
• The composed predicate is built from the rule's own pieces with no new regex, and it is consulted only after the rule has accepted the host. So drift can only make the line louder, never quieter: a host the rule calls loopback that the notice does not would still warn, and a host the rule stops accepting never reaches it.
• Both sides are pinned (ablations C and D).

Evidence (the dev's, at de6b4a08):

• @objectstack/cli unit tier: 260 files, 3797 tests passed.
• @objectstack/plugin-auth: 126 files, 2623 tests passed and 10 skipped.
• Both typechecks exit 0.
• dispatch-gates --ran accounts for 72 of 72 derived families. pnpm lint exits 0.
• Before/after on examples/app-todo: NOT-bound lines 4 → 1, and localhost OAuth warn lines 1 → 0.

Out-of-scope notes (PR Acceptance notes): they are kept as is, with no carrier:

• the degraded-ready pair;
• a declined-subflow bind warning that still replays beside its class line;
• service-automation's embedded-host wording.

No contract review is owed: Clause-②: no. Log text and levels only, with no packages/spec path and no governed surface.

CI on de6b4a08, read 2026-10-07T15:40Z: 29 success · 3 skipped · 1 queued (Dogfood Regression Gate) · 0 red. That is an honest reading, ⛔ not green.

After green: the landing pre-checks, then the relay landing.

os-dev-report
{
"issue": 22073,
"status": "done",
"branch": "claude/issue-22073-boot-warning-one-line-per-class",
"pr": "#22097",
"session": "session_01RWZbGvPFcRKvUqASZtunCU",
"premise_still_valid": true,
"head": "d722b474",
"summary": "Round 2 (merge main, not a rework). Merged origin/main bafb58b (#22071's runtime-assets branding warning plus b04a529, a CI turbo-cache change) as 288e08c, with no conflict. Pushed as a fast-forward to d722b47, with no rebase and no force. The optional case was taken inside the existing pin file with no new fixture: the print-once leg's unrestated record now has the shape of #22071's real 'Branding asset not served: …' warning (describeUnservedBrandingAssets, console.ts), and the leg asserts it replays exactly once in Boot diagnostics beside the banner's class line. The rule withholds only '[Automation] flow …' records a banner section hands back, so the branding record is never matched. No PR body sentence became false, so the body was not edited.",
"tests": "At d722b47. format.boot-warning-classes.test.ts: 11 passed (11). pnpm --filter @objectstack/cli exec vitest run --project unit: Test Files 260 passed (260), Tests 3806 passed (3806). @objectstack/cli typecheck exit 0 (check:test-typecheck OK). pnpm --filter @objectstack/plugin-auth test: Test Files 126 passed (126), Tests 2623 passed, 10 skipped. plugin-auth typecheck exit 0. All ran under os-verify-lock after pnpm turbo run build (72/72). eslint --no-inline-config on the edited pin file: 0/0. No control bytes.",
"gates": "Re-derived at d722b47: change set 7 paths vs merge base bafb58b, the same 72 commands as round 1 (empty diff). dispatch-gates --ran: 72 derived, 72 run, 0 NOT-MEASURED, 0 UNRUN, all exit 0. CI on d722b47 at report time: Dogfood Regression Gate (1-3/3 plus rollup) completed success; Lint & Repo Gates, TypeScript Type Check, Build Core, Temporal Conformance and Governed Surface Queue Guard success; Test Core 2-6/6 success and 1/6 in_progress.",
"files_changed": [
"packages/cli/src/utils/format.boot-warning-classes.test.ts (fixture text and one assertion, round 2)",
"merge commit 288e08c (main's files only)"
],
"line_budget": "n/a",
"deviations": [],
"mcp_calls": "0",
"api_writes": "1: this os-dev-report comment, through the fleet-write relay (POST /repos/objectstack-ai/objectstack/dispatches, then POST /repos//issues/22073/comments). git push (fast-forward) not counted.",
"open_questions": [],
"out_of_scope_findings": []
}

Generated by Claude Code

Landed: PR #22097 → 4935c66bc9, a single-parent queue squash

_{domain:cli seat · session_01RWZbGvPFcRKvUqASZtunCU · 2026-10-07T17:58Z}

• Landing shape:
  • git rev-list --parents -n 1 4935c66bc9 names one parent, c28f317ec6 (PR feat(core): one by-name read of the security catalog (ADR-0131 C2, stage S1) #22091).
  • 4935c66bc9 is an ancestor of origin/main; the pre-merge head d722b474 is not.
  • It entered the merge queue 2026-10-07T16:49:58Z and merged 2026-10-07T17:57:37Z on that first entry. The queue had rebuilt its build after 37655130539 lost its Dogfood Regression Gate aggregator, so the drafted re-queue receipt was not needed.
  • Fixes #22073 closed this card as completed.
• Content on origin/main:
  • packages/cli/src/utils/format.ts carries unboundFlowClasses, leadSentence and the restatedAbove print-once rule;
  • packages/plugins/plugin-auth/src/auth-plugin.ts carries isLoopbackIssuer;
  • .changeset/22073-boot-warning-one-line-per-class.md (patch, @objectstack/cli + @objectstack/plugin-auth) is present.
• Review of record: ACCEPT 6041419182, at de6b4a08. Round 2 was a merge of main after sibling cli: app branding assets are served only from <cwd>/assets (or OS_RUNTIME_ASSETS_DIR) and silently skipped when that directory is absent — an artifact boot from any other directory draws a broken logo and favicon, with no warning #22071 landed. It also gave a fresh CI after the old head's Dogfood Regression Gate job was orphaned by the 15:07–15:18Z Actions disruption. That round added one test-only commit: the print-once pin's unrestated record now takes cli: app branding assets are served only from <cwd>/assets (or OS_RUNTIME_ASSETS_DIR) and silently skipped when that directory is absent — an artifact boot from any other directory draws a broken logo and favicon, with no warning #22071's branding-warning shape. Clause-②: no; no contract review was owed.
• Delivered:
  • one boot line per unbound-flow class (trigger type and reason), with the reason's first sentence and the full text at --log-level debug;
  • Boot diagnostics withholds exactly the service-automation records the banner restated, and counts them in its header;
  • the plain-HTTP OAuth notice logs at info on a loopback issuer and stays warn on private and link-local ones.
  • Measured by the dev on examples/app-todo: NOT-bound lines 4 → 1, and localhost OAuth warn 1 → 0.
• Cross-lane, declared: domain:services on [PM seat] domain:services · seat 2 — ⏳ vacant #21118 (6039131423); domain:devx checklist readings on [PM seat] domain:devx @ objectstack — 🟢 baozhoutao · session_01VDtqoecgES7ScQYGbFVDRv · R9 · landed 3 · #20004 awaits skip-changeset · in flight 0 #6023 (6041356037) and [PM seat] domain:devx · seat 2 — 🟢 os-justin · session_01VF48aw8RPG6wzDnMgp6rtw #20163 (6041368398). service-automation is untouched.
• The seat's answer to the dev's open question: B, keep the composed loopback predicate, with no follow-up card. It is consulted only after the transport rule accepted the host, so drift can only make the line louder.
• Kept as Acceptance notes, no carrier:
  • the degraded-ready pair;
  • a declined-subflow bind warning that still replays beside its class line;
  • service-automation's embedded-host wording.