The WebMigrateOperation iterates over the operations produced by running 'describe' against the web subsystem, checking different operations and converting them. When it gets to a /subsystem=web/host=* op it processes that in its migrateVirtualHost method. But that method as part of its work checks all the other already migrated ops looking for path filters and the access log valve. If found it adds additional child resource add ops.

This is flawed because it assumes any add op for an access log valve or path filter will have already been created when migrateVirtualHost is run. That's not a valid assumption as there is nothing in the contract of the describe operation that guarantees such an order in its output. Work on WFCORE-2286 has revealed this.