Root cause: the 2026-09-28 controlled-projection hardening added the ErrUnboundControlledProject guard, and the server path got session project binding backfilled - but two paths missed: - CLI chat mode never called session.SetProjectID (only -project name) - coordinator handleAdvanceStage built StageRunRequest without ProjectID/UserID, so every stage-advance squad task was rejected Fixes: - handleChatMode gains projectID param (wired from -project-id flag); session binding follows the server convention - handleAdvanceStage passes parseDecimalID(UserCtx.Project/User.ID) - CLI chat tests get hermetic env (unreachable DB + ALLOW_IN_MEMORY) so local runs stop accidentally hitting the real dev DB on :5433 - stale test TestBindSessionProjectContext_KeepsExistingProjectID asserted the pre-fix 'switch does not propagate' bug; updated to assert switch propagation + bind no-overwrite Result: go test -short ./... = 75 packages, 0 failures (first time). Short tests promoted from report-only back into the required CI gate.