[kireetivar]

Summary

Improve console output readability.
Implement the agreed warning routing and exception formatting changes in fcli core and Aviator.

Aviator warning
  -> progress writer -> LOG.warn
     -> file log: full exception trace, when enabled
     -> console: masked message and exception details, without stack frames
        -> original stdout/stderr: clear progress and write under one lock
        -> captured/suppressed output: leave terminal progress unchanged

• Route progress-writer warnings through LOG.warn, instead of printing and recording them separately at DEBUG.
• Use a progress-aware console appender for complete log events, including warnings and errors from worker threads.
• Keep original stdout and stderr coordinated, since both can share one terminal.
• Use UnsynchronizedAppenderBase and resolve terminal width before rendering to avoid lock-order deadlocks.
• Keep nested captures and suppressed output separate from physical progress.
• Borrow the captured execution context for worker warnings without closing command-owned resources.
• Respect an existing worker context and stderr redirect.
• Remove duplicate Aviator warning paths and warnings sent as progress updates.
• Add WARN: once. Preserve already-prefixed messages.
• Move unknown comment-symbol diagnostics and selected internal diagnostics to DEBUG.
• Document Log4j migration differences and native-image requirements.
• Keep existing ERROR logging paths; do not add error-specific progress-writer methods.
• Warn once with the original exception when discarding a corrupt session. Preserve required-lookup exceptions without duplicate logging.
• Warn on unknown DAST response types and unrecognized audit request IDs. Keep completed duplicates at DEBUG without changing pending work or capacity.

Acceptance criteria

Criterion	Coverage
Progress does not overlap warnings or errors	Coordinate complete console log events and ordinary output with progress rendering.
Warnings use a consistent format	Use one warning path and one WARN: prefix. Keep exception types, messages and causes visible.
Duplicate custom tag warnings appear once per command	Preserve existing consolidation and cover it with regression tests.
Audit warnings appear only when applicable	Keep unsupported comment-symbol diagnostics at DEBUG, without noisy default-console warnings.

Evidence

• Before: Worker warnings could share a line with progress. Clearing progress before writing still allowed a concurrent redraw.
  After: Coordinator, appender and wrapper regression tests cover complete writes, nested writers and concurrent warnings.
• Before: Lazy terminal-width initialization could log while another thread held the render lock.
  After: ProgressTerminalWidthLockOrderTest detects the unsafe order without hanging later tests.
• Before: A captured warning or nested captured write could clear unrelated terminal progress.
  After: ProgressCaptureIsolationTest covers collection, suppression, worker captures, shared-terminal streams and blocked captures.
• Before: Each worker warning created and closed a child execution context.
  After: Tests verify exact context reuse, open command-owned Unirest resources, clean worker stacks and existing worker-context precedence.
• Focused progress tests pass. FcliExecutionContextTest: 8 passed. ProgressCaptureIsolationTest: 4 passed.
• Six JVM module suites passed: 1,066 tests, with no failures or skipped tests.
  Modules: common-core, aviator-common, aviator, common-action, ai-assist and util.
• Windows native build passed using build-native.ps1 and GraalVM CE 21.0.2.
• Linux native build passed using WSL and CI-aligned static-musl flags.
  CI certificate distrust ran against an isolated GraalVM copy, without changing the global trust store.
• UPX was unavailable. Both binaries are uncompressed. Linux static linking was verified.
• OutputMaskingSpec and OutputMaskingRPCSpec passed on both binaries: 12 tests per platform, with no failures or skipped tests.
• Earlier native probes passed for version/help, warning routing, console masking, and the previous ERROR-level behavior.
  Those binaries predate file-only log-level filtering and the review follow-up; native tests were not repeated for these changes.
• Both debug/progress probes exited successfully, including invalid terminal-width initialization. No Logback initialization errors or hangs were reported.
• File logs contain warnings and DEBUG output. However, the early argument-log masking check failed; see the finding below.
• Native warning-with-throwable formatting was not tested. Unit coverage does not replace this native check.
• Live SSC/Aviator SAST and DAST audits have not been run.
• Review follow-up: 36 focused tests passed. After simplifying assertions, the 11 affected tests passed again.
  These overlap the earlier 36. Coverage includes session lookups, DAST anomalies, duplicates, and exhausted-retry reporting.

Open validation finding

Both native binaries write the synthetic action --secret value to the early argument log when --debug enables file logging.
Console masking checks pass. This finding concerns the file log, not console warning output.

Source inspection shows that FcliExecutionStrategy.logVersionAndArgs() runs before action-defined masks are registered.
The argument logger, action mask registration and file-log masking converter are unchanged from the branch base.
This points to an existing masking issue. A baseline native binary was not tested.
This PR does not change that separate registration order.

Blast Radius: CLI

Core logging and progress changes affect all fcli commands, including nested commands and RPC/MCP executions.

Observable changes:

• --log-level filters the file log only. Console warnings remain visible, including with --log-level=ERROR.
• Console exceptions show full type names, messages and cause details, without stack frames. Enabled file logs retain full traces.
• Routed warnings use the progress-writer logger name in the file log.
• Some Aviator diagnostics now require DEBUG.
• Worker stderr fallback applies masking. Console encoding is explicitly UTF-8.
• Original stdout/stderr share one rendering lock. A blocked original stream can delay progress and console logs.
  Captured and suppressed output does not take this lock.

Context propagation for unrelated direct LOG.* calls on worker threads remains outside this change.
Log4j requires separately tested exception patterns; its %ex{0} is not equivalent to Logback's pattern.

fix: `fcli`: Prevent console output from overlapping progress
fix: `fcli aviator`: Standardize warnings and reduce diagnostic noise