@@ -89,7 +89,28 @@ describe('os dev MCP connect hint — origin (#16734)', () => {
    * child's banner (its own call site's expression, verbatim) and then the
    * parent's connect hint, both told the port the server ACTUALLY bound.
    */
-  const boot = (boundPort: number, name = 'hotcrm') => {
+  const boot = (boundPort: number, name = 'hotcrm', boundProtocol: 'http' | 'https' = 'http') => {
+    printServerReady({
+      ...bannerOpts,
+      externalBaseOrigin: resolveAuthBaseUrl(boundPort, boundProtocol).baseOrigin,
+    });
+    printMcpConnectHint({ boundPort, name, boundProtocol });
+    return lines.join('\n');
+  };
+
+  /**
+   * The same boot with the protocol argument WITHHELD from both printers — the
+   * expression this file carried before `--cert`/`--key` existed, character for
+   * character.
+   *
+   * ⭐ This is the ABLATION LEG for acceptance 2 (「无 flag 时逐字节等于今天」,
+   * #16804). The pins below drive it beside {@link boot}'s no-flag case and
+   * require the two to be byte-identical, so the claim "nothing changes without
+   * the flags" is measured rather than asserted: it would go red the day the
+   * derived protocol leaked into the default, and it cannot pass by both legs
+   * being broken in the same direction.
+   */
+  const bootWithoutProtocolArg = (boundPort: number, name = 'hotcrm') => {
     printServerReady({ ...bannerOpts, externalBaseOrigin: resolveAuthBaseUrl(boundPort).baseOrigin });
     printMcpConnectHint({ boundPort, name });
     return lines.join('\n');
@@ -203,10 +224,117 @@ describe('os dev MCP connect hint — origin (#16734)', () => {
     });
   });
 
+  // ── #16804 ─ a TLS listener, and the three surfaces that follow it ──────
+  describe('under --cert/--key the derived origin is https, and everything follows', () => {
+    it('acceptance 1: with OS_AUTH_URL UNSET, banner and hint both give https', () => {
+      // Every chain variable is deleted by `beforeEach`, so the only thing
+      // that can produce `https` here is the listener protocol reaching the
+      // resolver's built-in tail.
+      const output = boot(3000, 'hotcrm', 'https');
+
+      expect(output).toContain('MCP:       https://localhost:3000/api/v1/mcp');
+      expect(output).toContain('Endpoint  https://localhost:3000/api/v1/mcp');
+      expect(output).toContain('Skill     https://localhost:3000/api/v1/mcp/skill');
+      expect(output).toContain(
+        'Connect   claude mcp add --transport http hotcrm https://localhost:3000/api/v1/mcp',
+      );
+      // The plain-http address must not appear anywhere in a TLS boot's output:
+      // it is the one address a client on this port cannot reach.
+      expect(output).not.toContain('http://localhost:3000');
+      expect(mcpOrigins(output)).toEqual(['https://localhost:3000']);
+    });
+
+    it("follows dev's auto-shifted port under TLS too", () => {
+      expect(mcpOrigins(boot(3001, 'hotcrm', 'https'))).toEqual(['https://localhost:3001']);
+    });
+
+    it('acceptance 3: `OS_AUTH_URL` still WINS over the derived https origin', () => {
+      // The override direction that matters in practice: a developer
+      // terminating TLS locally but reached through a tunnel on another host.
+      process.env.OS_AUTH_URL = 'https://tunnel.example.com';
+      expect(mcpOrigins(boot(3000, 'hotcrm', 'https'))).toEqual(['https://tunnel.example.com']);
+    });
+
+    it('acceptance 3, the awkward direction: an http OS_AUTH_URL wins as well', () => {
+      // ⛔ Deliberately NOT "upgraded" to https. `OS_AUTH_URL` names where the
+      // deployment is REACHED — behind a TLS-terminating proxy that forwards
+      // plain http, or in a test harness, that is a deliberate statement about
+      // a different hop, and a default has no standing to overrule it.
+      process.env.OS_AUTH_URL = 'http://proxied.example.com';
+      expect(mcpOrigins(boot(3000, 'hotcrm', 'https'))).toEqual(['http://proxied.example.com']);
+    });
+
+    it('the rest of the configured chain keeps its precedence under TLS', () => {
+      process.env.OS_BASE_URL = 'https://base.example.com';
+      expect(mcpOrigins(boot(3000, 'hotcrm', 'https'))).toEqual(['https://base.example.com']);
+    });
+
+    it('an unusable value stays unusable — TLS does not manufacture an origin', () => {
+      process.env.OS_AUTH_URL = '';
+      const output = boot(3000, 'hotcrm', 'https');
+      expect(mcpOrigins(output)).toEqual([]);
+      expect(output).not.toContain('claude mcp add');
+      expect(output).not.toContain('https://localhost:3000');
+    });
+  });
+
+  // ── #16804 ─ acceptance 2, as an ABLATION rather than a claim ──────────
+  describe('without the flags the output is byte-for-byte what it was', () => {
+    it('the no-flag boot equals the boot that never passes a protocol at all', () => {
+      // Leg A: the call shape this file used before `--cert`/`--key` existed.
+      const before = bootWithoutProtocolArg(3000, 'my-app');
+      lines.length = 0;
+      // Leg B: the same boot through today's call shape, no flags given.
+      const after = boot(3000, 'my-app', 'http');
+
+      expect(after).toBe(before);
+      // And the byte the two legs are about: still plain http, on the bound port.
+      expect(mcpOrigins(after)).toEqual(['http://localhost:3000']);
+    });
+
+    it('the two legs also agree on an auto-shifted port and an ephemeral one', () => {
+      for (const port of [3001, 45064]) {
+        lines.length = 0;
+        const before = bootWithoutProtocolArg(port, 'my-app');
+        lines.length = 0;
+        expect(boot(port, 'my-app', 'http')).toBe(before);
+      }
+    });
+
+    it('and the legs DISCRIMINATE — the https leg differs from both', () => {
+      // Without this, two legs that both silently produced nothing would pass.
+      const plain = bootWithoutProtocolArg(3000, 'my-app');
+      lines.length = 0;
+      const tls = boot(3000, 'my-app', 'https');
+
+      expect(tls).not.toBe(plain);
+      expect(mcpOrigins(plain)).toEqual(['http://localhost:3000']);
+      expect(mcpOrigins(tls)).toEqual(['https://localhost:3000']);
+    });
+  });
+
   // ── What only the source can say ────────────────────────────────────────
   describe('the call site feeds the printer the bound port, and nothing else', () => {
     it('hands `printMcpConnectHint` the ACTUALLY BOUND port', () => {
-      expect(DEV_SOURCE).toContain('printMcpConnectHint({ boundPort: actual,');
+      expect(DEV_SOURCE).toContain('printMcpConnectHint({');
+      expect(DEV_SOURCE).toContain('boundPort: actual,');
+    });
+
+    it('hands it the protocol it FORWARDED, not one derived a second time (#16804)', () => {
+      // The parent's `boundProtocol` comes from the same `tlsIntent` that built
+      // the child's argv, so the scheme the hint prints and the scheme the
+      // child bound cannot part company. A second `resolveDevTlsIntent` call
+      // here would be a second reader, free to disagree.
+      expect(DEV_SOURCE).toContain('boundProtocol,');
+      expect(DEV_SOURCE).toContain('const boundProtocol: ListenerProtocol = listenerProtocol(tlsIntent);');
+      expect(DEV_SOURCE.match(/resolveDevTlsIntent\(/g) ?? []).toHaveLength(1);
+    });
+
+    it('forwards the cert/key PATHS to the serve child through the shared contract', () => {
+      expect(DEV_SOURCE).toContain('...devTlsChildArgs(tlsIntent),');
+      // ⛔ and never the bytes: one reader of the file, one owner of the refusal.
+      expect(DEV_SOURCE).not.toContain('readDevTlsMaterial');
+      expect(DEV_SOURCE).not.toContain('readFileSync(flags.cert');
     });
 
     it('builds no address out of the listening message any more', () => {
 
@@ -135,6 +135,71 @@ describe('resolveAuthBaseUrl — precedence (pre-existing behaviour, unchanged)'
   });
 });
 
+/**
+ * #16804 — the built-in default follows the LISTENER, and nothing else does.
+ *
+ * `os dev --cert … --key …` terminates TLS in the dev process, after which
+ * `http://localhost:<port>` is an address no client can reach. The tail is the
+ * one link in the chain nobody configured — it is this process describing its
+ * own socket — so it is the only link that moves.
+ */
+describe('resolveAuthBaseUrl — the listener protocol reaches the TAIL and stops there', () => {
+  it('derives https://localhost:<port> for a TLS listener with nothing else set', () => {
+    expect(resolveAuthBaseUrl(3000, 'https')).toEqual({
+      value: 'https://localhost:3000',
+      source: null,
+      baseOrigin: 'https://localhost:3000',
+    });
+  });
+
+  it('ABLATION: the omitted argument and an explicit `http` are the same call', () => {
+    // Acceptance 2 of the card — 「无 flag时逐字节等于今天」 — measured on the
+    // resolver rather than claimed. Driven for a plain port, dev's shifted
+    // port and an ephemeral one, because the tail interpolates the port.
+    for (const port of [3000, 3001, 45064]) {
+      expect(resolveAuthBaseUrl(port)).toEqual(resolveAuthBaseUrl(port, 'http'));
+      // …and the two legs DISCRIMINATE, so the equality above is a reading.
+      expect(resolveAuthBaseUrl(port)).not.toEqual(resolveAuthBaseUrl(port, 'https'));
+    }
+  });
+
+  it('⛔ a CONFIGURED value is never rewritten — OS_AUTH_URL wins under TLS', () => {
+    process.env.OS_AUTH_URL = 'https://tunnel.example.com';
+    const r = resolveAuthBaseUrl(3000, 'https');
+    expect(r.value).toBe('https://tunnel.example.com');
+    expect(r.source).toBe('OS_AUTH_URL');
+  });
+
+  it('⛔ including an http one — the scheme of a configured value is not upgraded', () => {
+    // The direction a "helpful" implementation gets wrong. `OS_AUTH_URL` names
+    // where the deployment is REACHED; behind a proxy that forwards plain http
+    // to this TLS listener, `http://…` is the operator's deliberate statement
+    // about a different hop, and a default has no standing to overrule it.
+    process.env.OS_AUTH_URL = 'http://proxied.example.com';
+    expect(resolveAuthBaseUrl(3000, 'https').value).toBe('http://proxied.example.com');
+    expect(resolveAuthBaseUrl(3000, 'https').baseOrigin).toBe('http://proxied.example.com');
+  });
+
+  it('⛔ nor the legacy name, nor OS_BASE_URL', () => {
+    process.env.BETTER_AUTH_URL = 'http://legacy.example.com';
+    expect(resolveAuthBaseUrl(3000, 'https').value).toBe('http://legacy.example.com');
+
+    delete process.env.BETTER_AUTH_URL;
+    process.env.OS_BASE_URL = 'http://base.example.com';
+    expect(resolveAuthBaseUrl(3000, 'https').value).toBe('http://base.example.com');
+  });
+
+  it('⛔ a set-but-empty value stays unusable — TLS manufactures no origin', () => {
+    // The tail is not reached at all here (`??` skips only unset values), so a
+    // TLS listener must not resurrect it. `baseOrigin: null` means the printers
+    // say nothing rather than guessing, and that is unchanged.
+    process.env.OS_AUTH_URL = '';
+    const r = resolveAuthBaseUrl(3000, 'https');
+    expect(r.value).toBe('');
+    expect(r.baseOrigin).toBeNull();
+  });
+});
+
 describe('resolveAuthBaseUrl — a usable base URL stays silent', () => {
   it.each([
     ['OS_AUTH_URL', 'https://app.example.com'],
 
@@ -333,7 +333,7 @@ describe('#13062 all THREE channels publish that one number', () => {
     expect(
       SERVE,
       'the banner no longer resolves its origin from `boundPort`',
-    ).toContain('externalBaseOrigin: resolveAuthBaseUrl(boundPort).baseOrigin');
+    ).toContain('externalBaseOrigin: resolveAuthBaseUrl(boundPort, boundProtocol).baseOrigin');
   });
 
   it('the ONE wiring site hands the seam the BOUND port, never the requested one', () => {
@@ -343,14 +343,63 @@ describe('#13062 all THREE channels publish that one number', () => {
     expect(
       SERVE,
       'the publish site no longer hands `publishBoundPort` the resolved bound port',
-    ).toContain('publishBoundPort(boundPort, runtimeBoundPortChannels(printBanner));');
+    ).toContain('publishBoundPort(boundPort, runtimeBoundPortChannels(printBanner), boundProtocol);');
     // Exactly two mentions in CODE: the declaration and that single call.
     expect(
       SERVE.match(/publishBoundPort\(/g) ?? [],
       'a second publish site can disagree with the first — that is the #13062 defect returning',
     ).toHaveLength(2);
   });
 
+  describe('#16804 — the published url names the scheme the socket SPEAKS', () => {
+    it('plain http when nothing asked for TLS — today\'s bytes, unchanged', () => {
+      const seen: Array<{ port: number; url: string }> = [];
+      publishBoundPort(45070, {
+        writeRuntimeState: (published) => { seen.push(published); },
+        announceListening: (message) => { seen.push({ port: message.port, url: message.url }); },
+        printBanner: () => { /* not under test here */ },
+      });
+      expect(seen).toEqual([
+        { port: 45070, url: 'http://localhost:45070' },
+        { port: 45070, url: 'http://localhost:45070' },
+      ]);
+    });
+
+    it('https on BOTH channels under a TLS listener — an ABLATION beside the leg above', () => {
+      // Both consumers of this url OPEN it: the runtime state file is what an
+      // external supervisor dials, the IPC message is what the `os dev` parent
+      // learns the server from. Under `--cert`/`--key` a hardcoded `http://`
+      // hands both an address that answers a TLS handshake error.
+      const seen: Array<{ port: number; url: string }> = [];
+      publishBoundPort(45071, {
+        writeRuntimeState: (published) => { seen.push(published); },
+        announceListening: (message) => { seen.push({ port: message.port, url: message.url }); },
+        printBanner: () => { /* not under test here */ },
+      }, 'https');
+      expect(seen).toEqual([
+        { port: 45071, url: 'https://localhost:45071' },
+        { port: 45071, url: 'https://localhost:45071' },
+      ]);
+    });
+
+    it('the default parameter IS the old behaviour — omitted and `http` agree', () => {
+      const capture = (protocol?: 'http' | 'https') => {
+        const out: string[] = [];
+        const channels = {
+          writeRuntimeState: (published: { port: number; url: string }) => { out.push(published.url); },
+          announceListening: (message: { url: string }) => { out.push(message.url); },
+          printBanner: () => { /* not under test here */ },
+        };
+        if (protocol === undefined) publishBoundPort(45072, channels);
+        else publishBoundPort(45072, channels, protocol);
+        return out;
+      };
+      expect(capture()).toEqual(capture('http'));
+      // …and the legs discriminate, so agreeing is a reading and not a vacuum.
+      expect(capture()).not.toEqual(capture('https'));
+    });
+  });
+
   it('⛔ and NONE of the three has drifted back onto the requested port', () => {
     // The card's own instruction: three outputs of one defect, and repairing
     // one leaves two lying in a place nobody thinks to look next time.
@@ -389,7 +438,13 @@ describe('#13062 all THREE channels publish that one number', () => {
       // The positive control for the negatives above: `port` has not been
       // globally renamed, so `not.toContain('port: Number(port)')` is a
       // measurement rather than a consequence of the variable disappearing.
-      expect(SERVE).toContain('new HonoServerPlugin({ port })');
+      //
+      // #16804 widened the construction literal to carry `tls` beside `port`;
+      // what this control needs is that `port` still reaches the transport
+      // under its own name, so it reads the construction site rather than one
+      // formatting of it.
+      expect(SERVE).toContain('new HonoServerPlugin({');
+      expect(SERVE.slice(SERVE.indexOf('new HonoServerPlugin({'))).toMatch(/^new HonoServerPlugin\(\{\s*\n\s*port,/);
       expect(SERVE).toContain('port = await getAvailablePort(requestedPort)');
     });
   });