feat(migrated): port --end-frame to the migrated host (#639)

CHANGELOG.md

@@ -7,6 +7,38 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- **`gflow video i2v --end-frame <local file>` now runs on `flow.google.com`.** Start+end
+  frame interpolation was the last i2v form the migrated composer refused: it exited 36
+  ("an end frame is not ported yet") on every account Flow has moved. Both frames are now
+  uploaded through the editor's own Upload entry and bound to the Start and End chips, and
+  the driver reads back two bound chips before it lets the app submit.
+
+  A bound end frame switches Flow to a different submit contract — rpc `nprQif`, an
+  interpolation model key, and both media ids in the body — which is why watching only the
+  classic submit rpcs made every start+end run time out *after* Flow had already accepted
+  the submit and billed it. The submit body is asserted before Flow acts on it, so a frame
+  that silently failed to bind is a refusal rather than a wrong generation you paid for.
+
+  The model key is **cohort-dependent** and matched by shape, not by literal:
+  `veo_3_1_interpolation_lite` and `omni_flash_i2v_8s_first_last` have both been captured
+  on live accounts (the second on 2026-09-17, see
+  `docs/superpowers/spikes/2026-09-17-migrated-end-frame-submit-contract.md`). Frames given
+  by media UUID or `@Name` are still not ported.
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639))
+
+### Fixed
+
+- **The migrated `--end-frame` lane rejected omni's interpolation key.** The start+end
+  submit validator pinned the model key to `veo_3_1_interpolation_lite`, so
+  `omni_flash_i2v_*_first_last` submits — what the second measured cohort actually sends —
+  were refused as wire-format errors before Flow could act on them. The check is now
+  key-shape based: a submit whose model key contains `interpolation` or `first_last`
+  counts as start+end interpolation for any model, and the submit observer accepts the
+  bare `batchexecute` reply (no `rpcids` param) that the interpolation rpc answers on.
+  ([#639](https://github.com/ffroliva/gflow-cli/issues/639))
+
 ## [0.77.1] — 2026-09-17
 
 ### Fixed

KNOWN_ISSUES.md

@@ -16,7 +16,7 @@ Living list of behaviour that's broken, surprising, or limited by design — alo
 
 ### Flow is migrating to `flow.google.com`; generation coverage is partial but includes images
 
-- **Status:** Open (partially resolved) · **Severity:** High for unported forms · **Affected:** on accounts the rollout has reached, `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i` now run on the migrated host. Image mode supports Nano Banana 2 / Pro, the four aspect ratios its radiogroup was enumerated with (16:9, 4:3, 1:1, 9:16), and count 1–4; `3:4` had no radio in that enumeration and is refused before submit rather than reported as selector drift. Image refs by UUID, `@Name` / `--reference-entity`, Agent instructions, Imagen 4, video end frames, video refs by UUID/name, scenes, extend, instructions and tools are not ported yet and fail before submit. **`character` is NOT in that list any more** — `character create` and `character list` work on the migrated host. Of the remainder, only the i2v-by-UUID case rests on a positive observation of absence (the Frames picker tiles carry no media id); `scenes`, `extend`, `instructions` and `tools` remain *unported by gflow*, never proven impossible on the host.
+- **Status:** Open (partially resolved) · **Severity:** High for unported forms · **Affected:** on accounts the rollout has reached, `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i` now run on the migrated host. Image mode supports Nano Banana 2 / Pro, the four aspect ratios its radiogroup was enumerated with (16:9, 4:3, 1:1, 9:16), and count 1–4; `3:4` had no radio in that enumeration and is refused before submit rather than reported as selector drift. Image refs by UUID, `@Name` / `--reference-entity`, Agent instructions, Imagen 4, video frame refs by UUID/name, scenes, extend, instructions and tools are not ported yet and fail before submit. **`character` is NOT in that list any more** — `character create` and `character list` work on the migrated host. Of the remainder, only the i2v-by-UUID case rests on a positive observation of absence (the Frames picker tiles carry no media id); `scenes`, `extend`, `instructions` and `tools` remain *unported by gflow*, never proven impossible on the host.
 - **Tracked:** [#639](https://github.com/ffroliva/gflow-cli/issues/639) · Reported 2026-09-02 against 0.59.0, 0.62.1, 0.63.0 and 0.65.0
 - **Confirmed live 2026-09-03 on a second, independent account** (`ffroliva`) — see [LIVE_VERIFICATION_v0.66.0](docs/LIVE_VERIFICATION_v0.66.0.md). A read-only probe of the migrated origin measured `i_total: 0`, reproducing the reporter's central measurement.
 - **`--reference-entity` was refused on `r2v` but not on `t2v`** ([#716](https://github.com/ffroliva/gflow-cli/issues/716), fixed in v0.71.0): the "not ported, exit 36" refusal above sat inside the r2v branch of the routing gate, so a `t2v` request carrying a character entity returned from that gate without its entities ever being inspected — and nothing downstream attaches one on this host. The generation was **submitted and billed** with the entity silently dropped, returning a plausible clip of the wrong person. The check is now mode-independent and ahead of every early return. If you ran `gflow video t2v @Name …` or `--reference-entity` on a moved account before this fix, the identity in those clips was never bound.
@@ -56,8 +56,8 @@ the clip). Two real clips were generated this way on 2026-09-05 — spike
 (`GFLOW_CLI_FLOW_HOST=auto`): flow.google.com is the **default** host for that
 command on every account — moved or not; `flow.google.com` forces it for
 everything, and `labs.google` switches the migrated composer off. Limits today: `--project` is required (project creation from the
-migrated editor is not ported), and `t2v`, `i2v` from a local `--initial-frame` (no end frame,
-no UUID/`@Name` frame — the migrated Frames picker exposes no media id in its DOM, so a frame is
+migrated editor is not ported), and `t2v`, `i2v` from local start (and end) frames (no UUID/`@Name` frame —
+the migrated Frames picker exposes no media id in its DOM, so a frame is
 found by the run-unique name gflow uploads it under, #792), and `r2v` from local `--ref` files
 (see the next paragraph), plus `image t2i` and local-file `image i2i` — unsupported
 forms still exit 36.

docs/CONFIGURATION.md

@@ -365,7 +365,7 @@ GFLOW_CLI_HISTORY_PROMPTS=redacted gflow image t2i "confidential brief"
 - `flow.google.com` — force the migrated composer for everything, including what it cannot serve yet (those requests then exit 36/11 instead of falling back).
 - `labs.google` — never use the migrated composer; where Flow serves `flow.google.com`, requests fail with exit 36 (kill switch).
 **Default:** `auto`
-**Scope today:** the migrated composer covers `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i`. Images support Nano Banana 2 / Pro, the four aspect ratios enumerated on that host (16:9, 4:3, 1:1, 9:16 — `3:4` was not present and is refused before submit) and count 1–4; the page owns the `ogiZ0b` reCAPTCHA + submit and the response already contains completed signed image URLs. An end frame, UUID/name references, character entities, Agent instructions, Imagen 4, scenes, extend, instructions and tools are not ported yet and fail before submit where Flow serves flow.google.com. MCP uses the same image service and queue payload, and inherits this setting from the server/daemon environment rather than per call.
+**Scope today:** the migrated composer covers `gflow video t2v`, local-file `video i2v` / `r2v`, `gflow image t2i`, and local-file `gflow image i2i`. Images support Nano Banana 2 / Pro, the four aspect ratios enumerated on that host (16:9, 4:3, 1:1, 9:16 — `3:4` was not present and is refused before submit) and count 1–4; the page owns the `ogiZ0b` reCAPTCHA + submit and the response already contains completed signed image URLs. Local-file start+end frames (`--initial-frame` + `--end-frame`) are ported (#639). Frames or references given by UUID/`@Name`, character entities, Agent instructions, Imagen 4, scenes, extend, instructions and tools are not ported yet and fail before submit where Flow serves flow.google.com. MCP uses the same image service and queue payload, and inherits this setting from the server/daemon environment rather than per call.
 
 ### `GFLOW_CLI_PREFER_CLASSIC` *(deprecated — use `GFLOW_CLI_UI_MODE=classic`)*
 

docs/INDEX.md

@@ -160,7 +160,7 @@ Slash commands for Claude Code, stored in `.claude/commands/gflow/`. All prefixe
 **"`gflow auth status` says verified but `gflow credits` returns 401 — which is lying?"** → neither. [MCP § 6.1 Which cohort is this account in?](MCP.md#61-first-question-which-cohort-is-this-account-in) — Google moves accounts onto `flow.google.com` in more than one step, and on some cohorts labs still authenticates while the `ya29` Bearer that aisandbox REST needs is gone. Both raise sites behind it now name that cause; on a migrated account SAPISID is usually fine and **re-running `gflow auth login` does not help** ([#795](https://github.com/ffroliva/gflow-cli/issues/795), [#791](https://github.com/ffroliva/gflow-cli/issues/791))
 
 **"Which Flow UI arm does a run require, and why did it exit 2 or 28?"** → [CONFIGURATION § GFLOW_CLI_UI_MODE](CONFIGURATION.md#gflow_cli_ui_mode) (`auto` ≡ `classic` for **both** images and video — video since v0.57.0/#299, images since #595; unreachable classic aborts pre-submit with exit 28, $0; explicit `agentic` on video exits 2)
-**"Which Flow frontend does a run drive — labs.google or the migrated flow.google.com — and why did it exit 36 or 11?"** → [CONFIGURATION § GFLOW_CLI_FLOW_HOST](CONFIGURATION.md#gflow_cli_flow_host) (`auto` = flow.google.com for every request it can serve — `t2v`, `i2v` from a local `--initial-frame`, `r2v` from local `--ref` files, `image t2i`, and `image i2i` from local files, with `--project`, on moved and unmoved accounts; `flow.google.com` forces it; `labs.google` is the kill switch. On a moved account an end frame, a UUID/`@Name` frame, references by `@Name`/`--reference-entity` and everything except `t2v`/`i2v`/`r2v` exit 36, non-retryable, and a missing `--project` exits 11) · recon: [character surface + reCAPTCHA mint](superpowers/spikes/2026-09-06-migrated-character-surface-and-recaptcha.md), [migrated-host wire protocol](superpowers/spikes/2026-09-05-migrated-host-wire-protocol.md), [handoff mechanism](superpowers/spikes/2026-09-04-migrated-host-handoff-mechanism.md), [agent mode hides the settings trigger](superpowers/spikes/2026-09-08-migrated-composer-agent-mode-hides-settings.md), [frames attach (i2v)](superpowers/spikes/2026-09-05-migrated-frames-attach.md) · evidence: [LIVE_VERIFICATION_v0.67.0](LIVE_VERIFICATION_v0.67.0.md) (t2v), [LIVE_VERIFICATION_v0.69.0](LIVE_VERIFICATION_v0.69.0.md) (i2v from a local start frame, v0.69.0), [LIVE_VERIFICATION_v0.70.0](LIVE_VERIFICATION_v0.70.0.md) (r2v on the migrated host; character create verified there in #703)
+**"Which Flow frontend does a run drive — labs.google or the migrated flow.google.com — and why did it exit 36 or 11?"** → [CONFIGURATION § GFLOW_CLI_FLOW_HOST](CONFIGURATION.md#gflow_cli_flow_host) (`auto` = flow.google.com for every request it can serve — `t2v`, `i2v` from a local `--initial-frame`, `r2v` from local `--ref` files, `image t2i`, and `image i2i` from local files, with `--project`, on moved and unmoved accounts; `flow.google.com` forces it; `labs.google` is the kill switch. On an account served flow.google.com a UUID/`@Name` frame, references by `@Name`/`--reference-entity` and everything except `t2v`/`i2v` (local start, and local start+end since #639)/`r2v` exit 36, non-retryable, and a missing `--project` exits 11) · recon: [character surface + reCAPTCHA mint](superpowers/spikes/2026-09-06-migrated-character-surface-and-recaptcha.md), [migrated-host wire protocol](superpowers/spikes/2026-09-05-migrated-host-wire-protocol.md), [handoff mechanism](superpowers/spikes/2026-09-04-migrated-host-handoff-mechanism.md), [agent mode hides the settings trigger](superpowers/spikes/2026-09-08-migrated-composer-agent-mode-hides-settings.md), [frames attach (i2v)](superpowers/spikes/2026-09-05-migrated-frames-attach.md) · evidence: [LIVE_VERIFICATION_v0.67.0](LIVE_VERIFICATION_v0.67.0.md) (t2v), [LIVE_VERIFICATION_v0.69.0](LIVE_VERIFICATION_v0.69.0.md) (i2v from a local start frame, v0.69.0), [LIVE_VERIFICATION_v0.70.0](LIVE_VERIFICATION_v0.70.0.md) (r2v on the migrated host; character create verified there in #703)
 **"Will this get my Google account flagged or banned? What protects me?"** → [ACCOUNT_SAFETY.md](ACCOUNT_SAFETY.md) — the operational answer in one place: rate limit vs WAF block vs ban (they are different), what the tool does to stay unremarkable (headed real Chrome, ±25% interaction jitter, 0.5–1.5 s submission pacing, one project per run, isolated profiles, refuse-don't-retry), what it deliberately does **not** do (no proxies, no fingerprint spoofing, no headless unlock), the knobs, the [#241](https://github.com/ffroliva/gflow-cli/issues/241) field data on what actually triggers a 403, and what we cannot promise. Legal statement: [DISCLAIMER](../DISCLAIMER.md)
 
 **"I got a 403 / `PUBLIC_ERROR_UNUSUAL_ACTIVITY` — what now?"** → [ACCOUNT_SAFETY § When Google does push back](ACCOUNT_SAFETY.md#when-google-does-push-back) (stop, cool down 30–60 min, use real Chrome meanwhile, switch profile, widen jitter); cadence evidence in [DEBUGGING § WAF cadence](DEBUGGING.md#waf-cadence); full entry in [KNOWN_ISSUES](../KNOWN_ISSUES.md)