Constant DEFAULT_LOG_DIRECTIVES 

pub const DEFAULT_LOG_DIRECTIVES: &str = "info,\
    app.input=debug,\
    app.lifecycle=debug,\
    bridge.lifecycle=debug,\
    agent.env_git=debug,\
    forge_agent::env::config_watch=debug,\
    forge_server=debug,\
    agent.catalog_scan=debug,\
    forge_agent::userdata::catalog::scan=debug,\
    forge_workspace::output_tail=debug,\
    forge_workspace::idle_sweep=debug,\
    forge_workspace::work=debug,\
    forge_workspace::browser=debug,\
    forge_browser=debug,\
    forge_supervise=debug,\
    forge_workspace::mcp=debug,\
    forge_workspace::skills=debug,\
    forge_workspace::gotify=debug,\
    forge_agent::mcp=debug,\
    forge_workspace::dictate=debug,\
    forge_workspace::subagent_cards=debug,\
    forge_dictate=debug,\
    forge_connectors::slack::throttle=debug,\
    llama_cpp_2=error,\
    llama-cpp-2=error";

Default tracing filter. info baseline keeps signal-to-noise sensible; the targets at debug are the ones we actually stare at when triaging UI/event drops (input submission, the bridge connect path). agent.env_git is there for a second reason: a git probe missing refs/remotes/origin/HEAD is real and is not forge’s problem. At debug it stays readable without raising a warning that says forge is unwell. forge_workspace::output_tail is there for the same reason: a line in a command’s output file that cannot be decoded is the watched command’s own output rather than a problem with forge. (forge_server too: its session reads are one session’s own work.)

forge_dictate and forge_workspace::dictate are there for the same reason again: a take that reaches its capture cap, a normalizer that runs out of token budget and a take whose recognition failed are one session’s own work, not forge’s health. They were demoted out of WARN for it, so they are named here to stay readable.

forge_browser carries the browser service’s own records of a viewer attaching and of a controller role being let go. Each is that session’s own work rather than forge’s health, so they are debug; the refusal of one gesture lives on forge_server (its browser_input_refused), which the directive above already keeps readable.

The two llama targets are the dictation engine’s own log bridge, which reaches tracing through the llama-cpp-2 crate under both its hyphenated target and its module path. What it reports is the model loading itself, not forge, so it is not forge’s warning to raise.

forge_workspace::mcp and forge_agent::mcp carry the two halves of one record: the surface a spawn hands its child and the surface the CLI’s boot init frame says it received. The list is fixed once the child starts, so the pair is the only way a “tool not found” is traced to the side that actually lacked the name.

forge_connectors::slack::throttle carries the sweep’s per-pass throttle detail, which was demoted to debug once the warning moved to one per episode. A workspace Slack throttles is that workspace’s own rate limit rather than forge’s health, so the repeated numbers are debug; the dedicated target keeps the module’s per-sweep chatter out of the default filter while these stay readable.

forge_workspace::idle_sweep carries the injected sweep’s delivery record, which is a debug and would otherwise land nowhere: without the directive the subsystem reports nothing at all between a failure and its recovery.