@@ -0,0 +1,20 @@
+---
+'@objectstack/runtime': patch
+'@objectstack/cli': patch
+---
+
+fix(cli,runtime): the ownership refusal `os start` prints names the auth secret the ceremony needs
+
+Clause-②: yes (widening)
+Metadata-protocol: none
+
+On a database 17.x or an 18.0 pre-release created, `os start` refuses to boot and names the ownership ceremony. When the operator had set no auth secret, `os start` was serving with the one it generated and keeps in `<home>/auth-secret`, and that secret is not in the operator's shell. Run exactly as printed, the ceremony composed no security plugin: it wrote the plan and stopped the apply at its `authored-conversion` step, and nothing said which secret was missing. The refusal now names both commands with that secret exported from its file, by path:
+
+```sh
+OS_AUTH_SECRET="$(cat /srv/app/.objectstack/auth-secret)" os migrate organization-ownership --out PLAN
+OS_AUTH_SECRET="$(cat /srv/app/.objectstack/auth-secret)" os migrate organization-ownership --apply --plan-file PLAN --backup-taken
+```
+
+A boot whose secret the operator gave (`OS_AUTH_SECRET` in the environment, or `--auth-secret`) names the bare commands, as before: run them with that secret in `OS_AUTH_SECRET`. `os dev` keeps its `--dev` spelling. `OrganizationOwnershipBootGuardOptions` gains the optional `authSecretFile`, the file a production boot read its secret from.
+
+If an apply already stopped this way, it resumes from its checkpoint: re-run it with `OS_AUTH_SECRET="$(cat <home>/auth-secret)"`.
@@ -1839,6 +1839,15 @@ os migrate organization-ownership --apply --plan-file plan.json --backup-taken
 os migrate organization-ownership --dev …                    # boot as `os serve --dev` does
 ```
 
+- **Run it with the auth secret the deployment serves with.** The ceremony
+  composes the security plugin only when an auth secret resolves
+  (`OS_AUTH_SECRET`), as `os serve` does; without it the apply can stop at its
+  `authored-conversion` step. A deployment `os start` serves with the secret
+  it generated keeps that secret in `<home>/auth-secret`, and its refusal names
+  both commands with it exported:
+  `OS_AUTH_SECRET="$(cat <home>/auth-secret)" os migrate organization-ownership …`.
+  `--dev` composes the plugin as a development boot does.
+
 - **The plan writes nothing.** Per table it lists the fate (column dropped,
   mirror rows deleted, owner attributed, rows reported), the row counts, and the
   rows whose owner cannot be derived. It refuses to plan a table it cannot read.
 
@@ -12,6 +12,7 @@ import { provisionTelemetryDatasource, standaloneTelemetryPrimary } from '../uti
 import { isHostConfig, shouldBootWithLibrary } from '../utils/plugin-detection.js';
 import { registerInstalledPlugins } from '../utils/installed-plugins-boot.js';
 import { readInternalArtifactPath, readInternalConfigOutputPath } from '../utils/internal-artifact-channel.js';
+import { readAuthSecretFileChannel } from '../utils/internal-auth-secret-channel.js';
 import { compileForDevBoot, devCompilesAtBoot } from '../utils/dev-compile-at-boot.js';
 import { makeDirectorySync } from '../utils/make-directory.js';
 // The precedence's last rung — whether the cwd config takes part — decided by
@@ -4194,8 +4195,13 @@ export default class Serve extends Command {
         const { OrganizationOwnershipBootGuardPlugin } = await import('@objectstack/runtime');
         // A development boot's refusal names the ceremony with `--dev`, so the
         // ceremony boots the way this one did (its secret, .env* files and
-        // `telemetry` sibling).
-        await kernel.use(new OrganizationOwnershipBootGuardPlugin({ dev: isDev }));
+        // `telemetry` sibling). A boot `os start` supervises with the secret it
+        // persisted in its home names that file, so the ceremony runs with the
+        // secret this server composes its security plugin with.
+        await kernel.use(new OrganizationOwnershipBootGuardPlugin({
+          dev: isDev,
+          authSecretFile: readAuthSecretFileChannel(process.env),
+        }));
         trackPlugin('OrganizationOwnershipBootGuard');
       }
 
 
@@ -23,6 +23,7 @@ import {
 } from '../utils/artifact-precedence.js';
 import { ServeRestartCoordinator } from '../utils/dev-restart.js';
 import { readEnvWithDeprecation } from '@objectstack/types';
+import { writeAuthSecretFileChannel } from '../utils/internal-auth-secret-channel.js';
 // The ONE port contract, shared with `dev` and with the `serve` child this
 // command spawns (#12673). ⛔ Nothing about ports is declared in this file —
 // no range, no reader, no wording; a second copy of the bound is exactly what
@@ -312,9 +313,15 @@ export default class Start extends Command {
     // return 404 and breaks the Console's login flow.
     // Quick-start should "just work" without the user having to
     // export AUTH_SECRET.
-    const authSecret = flags['auth-secret']
-      ?? readEnvWithDeprecation('OS_AUTH_SECRET', ['AUTH_SECRET', 'BETTER_AUTH_SECRET'], { silent: true })
-      ?? readOrCreateAuthSecret(homeDir);
+    //
+    // Where the secret came from travels to the child too: a persisted secret
+    // is not in the operator's shell, so a command the child prints for them
+    // to run (the v18 ownership refusal) has to export it from its file
+    // (`utils/internal-auth-secret-channel.ts`).
+    const operatorAuthSecret = flags['auth-secret']
+      ?? readEnvWithDeprecation('OS_AUTH_SECRET', ['AUTH_SECRET', 'BETTER_AUTH_SECRET'], { silent: true });
+    const persistedAuthSecret = operatorAuthSecret === undefined ? readOrCreateAuthSecret(homeDir) : undefined;
+    const authSecret = persistedAuthSecret ? persistedAuthSecret.secret : operatorAuthSecret;
 
     // ── Banner ──────────────────────────────────────────────────────
     // `Config:` only when the cwd config takes part in this boot — the same
@@ -454,6 +461,7 @@ export default class Start extends Command {
       ...(flags['database-auth-token'] ? { OS_DATABASE_AUTH_TOKEN: flags['database-auth-token'] } : {}),
       AUTH_SECRET: authSecret,
     };
+    writeAuthSecretFileChannel(localEnv, persistedAuthSecret?.file);
     // NODE_ENV is only forced to production when the user has not set it.
     // Allows `NODE_ENV=development objectstack start` to work for debugging.
     //
@@ -601,21 +609,24 @@ function resolveHome(
  * Read the persisted AUTH_SECRET from `<home>/auth-secret`, or generate
  * one on first run and persist it so subsequent restarts keep existing
  * sessions valid. Mode 0o600 to keep the secret reasonably private.
+ * `file` is the path only when the file holds the returned secret: a
+ * generated one whose write failed lives in this process alone.
  */
-function readOrCreateAuthSecret(homeDir: string): string {
+function readOrCreateAuthSecret(homeDir: string): { secret: string; file?: string } {
   const secretPath = path.join(homeDir, 'auth-secret');
   try {
     const existing = fs.readFileSync(secretPath, 'utf8').trim();
-    if (existing.length >= 32) return existing;
+    if (existing.length >= 32) return { secret: existing, file: secretPath };
   } catch {
     // file missing or unreadable — fall through to generation
   }
   const secret = crypto.randomBytes(32).toString('hex');
   try {
     makeDirectorySync(homeDir);
     fs.writeFileSync(secretPath, secret + '\n', { mode: 0o600 });
+    return { secret, file: secretPath };
   } catch {
     // best-effort persist; secret is still returned for this process
   }
-  return secret;
+  return { secret };
 }
@@ -0,0 +1,41 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The CLI's INTERNAL parent-to-child channel for WHERE `os start` read the
+ * auth secret it hands its `serve` child.
+ *
+ * `os start` gives the child a secret on every boot: the operator's
+ * (`--auth-secret`, `$OS_AUTH_SECRET` and its legacy names) or, when the
+ * operator set none, the one it keeps in `<home>/auth-secret`, generated on
+ * the first run. The child sees the secret alone and cannot tell the two
+ * apart, yet a command the child prints for the operator to run in their own
+ * shell has to: the operator's secret is already in that shell, the persisted
+ * one is not. The v18 ownership refusal is that command — the ceremony
+ * composes the security plugin only with the secret the deployment serves
+ * with — so the child names the file to export it from
+ * (`OrganizationOwnershipBootGuardOptions.authSecretFile`).
+ *
+ * Same naming and ownership rule as `OS_INTERNAL_ARTIFACT_PATH`
+ * (`internal-artifact-channel.ts`): `INTERNAL` in the domain slot, a private
+ * call between two processes the CLI owns both ends of, deliberately not
+ * listed in `content/docs/deployment/environment-variables.mdx`. The parent
+ * OWNS the variable in the child env: it is set only when the secret came
+ * from the file and deleted otherwise, so an inherited copy never speaks for
+ * a secret the parent took from somewhere else.
+ */
+export const INTERNAL_AUTH_SECRET_FILE_ENV = 'OS_INTERNAL_AUTH_SECRET_FILE';
+
+/**
+ * Write the channel into a `serve` child's environment: the file when the
+ * secret the child is given came from it, otherwise no variable at all.
+ */
+export function writeAuthSecretFileChannel(env: NodeJS.ProcessEnv, file: string | undefined): void {
+  if (file) env[INTERNAL_AUTH_SECRET_FILE_ENV] = file;
+  else delete env[INTERNAL_AUTH_SECRET_FILE_ENV];
+}
+
+/** Read the channel in the `serve` child: the file, or `undefined` when the parent set none. */
+export function readAuthSecretFileChannel(env: NodeJS.ProcessEnv): string | undefined {
+  const file = env[INTERNAL_AUTH_SECRET_FILE_ENV];
+  return file ? file : undefined;
+}