X_CURSOR_SECRET_DEV
Means
cursors are signed with the shipped development key
Typical cause
ULTIMATE_CURSOR_SECRET is unset — or set to the EMPTY string, which counts as unset and never as an empty HMAC key — outside development/test, so the signing key is the constant published in @ultimat3/core and a client can forge a page position. A process naming NO environment (ULTIMATE_ENV/NODE_ENV both unset) counts as production. Reported by x doctor as a warning, and thrown at boot by assertNoDevSecretsOutsideLocal()
Fix
openssl rand -hex 32 # put the output in this deploy's secret store as ULTIMATE_CURSOR_SECRET; this machine: ULTIMATE_ENV=development x env check