The transitional-scope restriction is unspecified but real: app passwords must not perform account-management actions (change handle, change email, delete/deactivate/migrate account). The spec documents the restriction in prose; enforcement shape varies.
Good differential-check candidate (authority: 'reference'): provision an app password, attempt an account-management action with it, compare target behavior to the oracle. tranquil-pds extends app passwords with granular scopes, so expect a profile entry there.
Done when: a differential check asserts app-password account-management rejection and matches against the reference oracle.