test(cli): enter os migrate unmapped-columns in the one-shot family rosters

The absent-database roster (empty work on a missing table, the control
reads a retired column), the bootSchemaStack caller table, and the
--json stdout purity family. Re-exported beside account-issuer.

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016GiHYRmLSNWTfbX9gVQkpz

Author: claude

packages/cli/src/commands/migrate/data-commands.absent-database.integration.test.ts

@@ -58,6 +58,10 @@
  * (`--json` and human), a booted database holding one row of work for each
  * (the control: the door READS the table and reports the row), and the four
  * doors that already exited 0 on the absent database, which still do.
+ *
+ * [#21573] `os migrate unmapped-columns` joined the roster later, born with
+ * the same answer: it asks `tableAbsent` before the differ. Its control row is
+ * a retired field's column on `os21529_contact`, holding a value.
  */
 
 import { describe, it, expect, beforeAll, afterAll } from 'vitest';
@@ -418,6 +422,9 @@ await k('sys_secret').insert({
 await k('sys_file').insert({
   id: 'file_21552', key: 'attachments/os21552.txt', name: 'os21552.txt', size: 12, scope: 'attachments', status: 'committed',
 });
+// A retired field's column: in the table, in no metadata, holding a value.
+await k.raw('ALTER TABLE os21529_contact ADD COLUMN legacy_note text');
+await k('os21529_contact').insert({ id: 'con_21573', name: 'Ann', legacy_note: 'kept-21573' });
 await raw.disconnect();
 process.stderr.write('[fixture] seeded\\n');
 process.exit(0);
@@ -513,6 +520,19 @@ const DOORS: readonly Door[] = [
     tables: ['sys_file', 'sys_attachment'],
     work: (doc) => expect(doc).toMatchObject({ filesScanned: 1, stranded: 1 }),
   },
+  {
+    // Born after #21552 with the family's answer: it asks `tableAbsent` before
+    // the differ, so an absent table is empty work and is never read.
+    name: 'migrate unmapped-columns',
+    argv: ['migrate', 'unmapped-columns', '--object', 'os21529_contact'],
+    empty: (doc) => expect(doc).toMatchObject({ object: 'os21529_contact', columns: [], count: 0, records: [] }),
+    humanEmpty: /No unmapped column on os21529_contact/,
+    tables: ['os21529_contact'],
+    work: (doc) => {
+      expect(doc.columns).toEqual([{ column: 'legacy_note', actual: 'text' }]);
+      expect(doc.records).toContainEqual({ id: 'con_21573', values: { legacy_note: 'kept-21573' } });
+    },
+  },
 ];
 
 /** The four doors that already answered the absent database with exit 0: they must still. */

packages/cli/src/index.ts

@@ -35,6 +35,10 @@ export { default as MigrateRecordedByCommand } from './commands/migrate/recorded
 // `sys_account.issuer` is dropped and account identity re-keys onto
 // (provider_id, account_id).
 export { default as MigrateAccountIssuerCommand } from './commands/migrate/account-issuer.js';
+// #21573: the operator-only read of the columns `os migrate plan` reports as
+// `unmapped_column` for one object, keyed by record id, for a conversion run
+// before `os migrate apply --allow-destructive` drops them.
+export { default as MigrateUnmappedColumnsCommand } from './commands/migrate/unmapped-columns.js';
 
 // ─── Environments topic subcommands ─────────────────────────────────
 export { default as EnvironmentsListCommand } from './commands/environments/list.js';

packages/cli/src/utils/schema-migrate.one-shot-family.integration.test.ts

@@ -66,6 +66,7 @@ import MigratePlan from '../commands/migrate/plan.js';
 import MigrateRecordedBy from '../commands/migrate/recorded-by.js';
 import MigrateResume from '../commands/migrate/resume.js';
 import MigrateSummaryNulls from '../commands/migrate/summary-nulls.js';
+import MigrateUnmappedColumns from '../commands/migrate/unmapped-columns.js';
 import MigrateValueShapes from '../commands/migrate/value-shapes.js';
 import SecretOrphans from '../commands/secret/orphans.js';
 import SecretRewrap from '../commands/secret/rewrap.js';
@@ -211,6 +212,14 @@ const CALLERS: Record<string, Caller> = {
     noWrite: [{ label: 'migrate summary-nulls', argv: ['--database-url', '@DB@', '--json'] }],
     write: [{ label: 'migrate summary-nulls --apply', argv: ['--apply', '--yes', '--database-url', '@DB@', '--json'] }],
   },
+  'commands/migrate/unmapped-columns.ts': {
+    run: invoke(MigrateUnmappedColumns),
+    // `osf_lead` is declared by both releases; the next one adds a column,
+    // which is pending work and not an unmapped one, so the run reads nothing.
+    noWrite: [{ label: 'migrate unmapped-columns', argv: ['--object', 'osf_lead', '--database-url', '@DB@', '--json'] }],
+    write: [],
+    note: 'a read-only report: it has no writing mode, and dropping the columns is `os migrate apply --allow-destructive`',
+  },
   'commands/migrate/value-shapes.ts': {
     run: invoke(MigrateValueShapes),
     noWrite: [{ label: 'migrate value-shapes', argv: ['--database-url', '@DB@', '--json'] }],

packages/cli/test/json-stdout-purity.e2e.test.ts

@@ -104,6 +104,10 @@ const FAMILY: Record<string, string[]> = {
   'migrate recorded-by': [],
   'migrate resume': [],
   'migrate summary-nulls': [],
+  // One object per run, so it needs a name: the fixture's own `jp_ticket`,
+  // which the composed host config registers. No database file exists, so the
+  // face driven here is its empty-work answer for a table not there yet.
+  'migrate unmapped-columns': ['--object', 'jp_ticket'],
   'migrate value-shapes': [],
   // Report-only is its DEFAULT and the only form driven here: without
   // `--delete` it boots, reports and writes nothing, so the family gains a