@intentius/chant-lexicon-azure 0.39.0 → 0.41.0

package/dist/integrity.json

@@ -1,7 +1,7 @@
 {
   "algorithm": "sha256",
   "artifacts": {
-    "manifest.json": "4891e582720db1641de863bc9b7a6defc9eb96996d49586fa3bda27b51f75076",
+    "manifest.json": "7a3fb1cb00d88162dfce29698e3f3ce481d64c21d5103ae2c471b92d9470b371",
     "meta.json": "051fb4ee43f7de48a36f1abc59c8ff5207c3b75aa28f13db6440b9f5b0337605",
     "types/index.d.ts": "617a6de433bd92a126170a7f5ae903d6d7aa83fbb0b57169d3450b5a13e72e0d",
     "rules/hardcoded-location.ts": "a9b1d1cec93f2ca9c5206641f53fc9621cefcfd2c00b3ab89c194b30a75fa949",
@@ -33,5 +33,5 @@
     "skills/chant-azure-patterns.md": "1a3bacfac612826b77332d2692a59195638db9f1b5e8ea2eda7579621d25f603",
     "skills/chant-azure-aks.md": "2d4e0098c1a22b54ffadd410564d9df0f3a04cb4eb7c6261f20ae33106e7aca8"
   },
-  "composite": "07dea253252664686f6944b8ae25fc4d8d8511bcc26f77ade3eb188128ea04b4"
+  "composite": "579545b4d3b7b8be7eae56689bbdcd3f4289c3580805f527b5aa93a6882e8023"
 }

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "azure",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "chantVersion": ">=0.1.0",
   "namespace": "Azure",
   "intrinsics": [

package/dist/op/activities/az-apply.d.ts

@@ -1,3 +1,4 @@
+import { type ApplyResult } from "@intentius/chant/apply";
 /** One ARM resource from a `deploymentTemplate.json` `resources[]`. */
 export interface ArmResource {
     type: string;
@@ -82,10 +83,34 @@ export declare function azApply(args: AzApplyArgs, signal?: AbortSignal, http?:
         name: string;
         deleted: boolean;
     }>;
+    /** Owned, undeclared resources the prune could not delete (#1457). Empty when
+     * `prune` is off, and empty on a clean prune. */
+    notPrunable: AzNotPrunable[];
 }>;
-/** The ownership tag azApply stamps on every resource it applies. */
+/**
+ * The ownership tags azApply stamps on every resource it applies.
+ *
+ * Stamps the declared channel's key. The legacy key goes on too, so a resource
+ * applied by this chant is still recognised by an older one mid-rollout; it is
+ * transitional and can be dropped once no deployed estate predates #1446.
+ *
+ * Only the managed-by marker, not stack/env: this applier has no
+ * {@link OwnershipMarker} to hand — the serializer stamps those from project
+ * config. Same shape the fly serializer uses when no ownership context is set.
+ */
 export declare function chantOwnershipTags(): Record<string, string>;
-/** Whether a resource's tags mark it chant-owned. */
+/**
+ * Whether a resource's tags mark it chant-owned.
+ *
+ * Resolves through core's `hasOwnershipMarker` against the lexicon's declared
+ * channel (#1446), so this predicate and the serializer's stamp can no longer
+ * drift — the arrangement the fly lexicon already had.
+ *
+ * The legacy key is accepted as well, and the union is deliberate: it is
+ * strictly more than this predicate recognised before, so nothing that was
+ * prunable stops being prunable, and resources the serializer marked become
+ * prunable for the first time.
+ */
 export declare function isChantOwned(tags: Record<string, string> | null | undefined): boolean;
 /** One resource from the ARM resource-group listing. */
 export interface ArmListItem {
@@ -103,17 +128,78 @@ export declare function deleteArmResource(type: string, name: string, apiVersion
     deleted: boolean;
 }>;
 /**
- * Owned-only prune: for each resource type present in the template, delete the
- * chant-owned live resources of that type whose (evaluated) name is not in the
- * template. Scoped to templated types — like the GCP applier — so a type chant
- * isn't managing this run is left alone, and the type's `apiVersion` is taken
- * from the template. Foreign (non-chant) resources are never touched.
+ * Normalize an azApply/azDelete result into core's apply envelope (#1446).
+ *
+ * The lexicon keeps its own shape — ARM `type`, per-resource applied/pruned —
+ * and this projects it onto the shared tri-state so a caller can read any
+ * applier's result the same way.
  */
-export declare function pruneArmOrphans(desired: ArmResource[], ctx: ArmEvalCtx, http?: AzHttp, signal?: AbortSignal): Promise<Array<{
+export declare function toApplyResult(result: {
+    applied?: Array<{
+        type: string;
+        name: string;
+    }>;
+    pruned?: Array<{
+        type: string;
+        name: string;
+        deleted: boolean;
+    }>;
+    deleted?: Array<{
+        type: string;
+        name: string;
+        deleted: boolean;
+    }>;
+    notPrunable?: AzNotPrunable[];
+}): ApplyResult;
+/** A chant-owned live resource an owned-only prune could not delete, and why (#1457). */
+export interface AzNotPrunable {
     type: string;
     name: string;
-    deleted: boolean;
-}>>;
+    /**
+     * `no-api-version` — the resource is owned and undeclared, but its type is
+     * absent from the current template, which is the only place an `apiVersion`
+     * comes from. `deleteArmResource` cannot build a URL without one.
+     */
+    reason: "no-api-version";
+}
+/**
+ * Owned-only prune: for each resource type present in the template, delete the
+ * chant-owned live resources of that type whose (evaluated) name is not in the
+ * template. Foreign (non-chant) resources are never touched.
+ *
+ * ## The type-left-the-template hole (#1457)
+ *
+ * `byType` is keyed off the resources the template CURRENTLY declares, and the
+ * `!entry` guard skipped any live resource of a type the template no longer
+ * mentions — before `isChantOwned` was ever consulted.
+ *
+ * So: declare one storage account, apply, then delete it from source. The
+ * template now has zero resources of that type, `byType` has no entry, and the
+ * live account is skipped. It is owned, it is undeclared, and prune would never
+ * touch it — on that run or any future one. **Prune the last resource of a type
+ * and you created a permanent orphan.** Prune one of several and it works,
+ * which is why it survived testing.
+ *
+ * The guard cannot simply be removed: `deleteArmResource` needs an
+ * `apiVersion`, and the template is the only source of one — ARM's
+ * resource-group listing does not return it per resource. So the skip stays,
+ * and is now REPORTED rather than silent: a permanent invisible orphan becomes
+ * a permanent visible one, which is the difference between a bug and a known
+ * limitation. Resolving it properly wants a per-type apiVersion source (the
+ * provider metadata endpoint, or a lexicon-side map).
+ *
+ * This matters more since #1448, which routed `ApplyOp`'s `arm` target through
+ * `azApply` — before that, the composite reached `--mode Complete` and never
+ * came here at all.
+ */
+export declare function pruneArmOrphans(desired: ArmResource[], ctx: ArmEvalCtx, http?: AzHttp, signal?: AbortSignal): Promise<{
+    pruned: Array<{
+        type: string;
+        name: string;
+        deleted: boolean;
+    }>;
+    notPrunable: AzNotPrunable[];
+}>;
 /**
  * The inverse of {@link azApply} — read a built ARM template and delete the
  * resources it declares, in reverse dependency order (a referrer goes before the

package/dist/op/activities/az-apply.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAQA,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc/C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED,4EAA4E;AAC5E,wBAAsB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAgID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAenF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAqBzE;AAID,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ9G;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAAC,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CA8C9H;AAYD,qEAAqE;AACrE,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE3D;AAED,qDAAqD;AACrD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErF;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,MAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASlI;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAM3D;AAED;;;;;;GAMG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CAmBlE;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAsB/E"}
+{"version":3,"file":"az-apply.d.ts","sourceRoot":"","sources":["../../../src/op/activities/az-apply.ts"],"names":[],"mappings":"AAKA,OAAO,EAEL,KAAK,WAAW,EAGjB,MAAM,wBAAwB,CAAC;AAMhC,uEAAuE;AACvE,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,mFAAmF;AACnF,MAAM,MAAM,MAAM,GAAG,CACnB,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,MAAM,EACX,IAAI,CAAC,EAAE,OAAO,EACd,MAAM,CAAC,EAAE,WAAW,KACjB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAc/C;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,uFAAuF;AACvF,wBAAsB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAIhF;AAED,4EAA4E;AAC5E,wBAAsB,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAS/E;AAgID,2GAA2G;AAC3G,wBAAgB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAenF;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,WAAW,EAAE,GAAG,WAAW,EAAE,CAqBzE;AAID,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAG5F;AAED,4FAA4F;AAC5F,wBAAsB,eAAe,CAAC,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAQ9G;AAED,MAAM,WAAW,WAAW;IAC1B,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qCAAqC;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;GAOG;AACH,wBAAsB,OAAO,CAC3B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IACT,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE;qDACiD;IACjD,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CAgDD;AAgCD;;;;;;;;;;GAUG;AACH,wBAAgB,kBAAkB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAK3D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAGrF;AAED,wDAAwD;AACxD,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/B;AAED,0EAA0E;AAC1E,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,UAAU,EAAE,IAAI,GAAE,MAAoB,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CASlI;AAED,oGAAoG;AACpG,wBAAsB,iBAAiB,CACrC,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAM3D;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE;IACpC,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAChD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IACjE,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAClE,WAAW,CAAC,EAAE,aAAa,EAAE,CAAC;CAC/B,GAAG,WAAW,CAqBd;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,MAAM,EAAE,gBAAgB,CAAC;CAC1B;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,WAAW,EAAE,EACtB,GAAG,EAAE,UAAU,EACf,IAAI,GAAE,MAAoB,EAC1B,MAAM,CAAC,EAAE,WAAW,GACnB,OAAO,CAAC;IACT,MAAM,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAChE,WAAW,EAAE,aAAa,EAAE,CAAC;CAC9B,CAAC,CA+BD;AAED;;;;;GAKG;AACH,wBAAsB,QAAQ,CAC5B,IAAI,EAAE,WAAW,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,IAAI,GAAE,MAAoB,GACzB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAsB/E"}

package/dist/op/activities/index.d.ts

@@ -7,6 +7,6 @@ export { azGroupEnsure, azGroupDelete, azGroupEnsureCommand, azGroupDeleteComman
 export type { AzGroupEnsureArgs, AzGroupDeleteArgs } from "./azure.js";
 export { flociAzUp, flociAzDown, flociAzRunCommand, flociAzRmCommand, flociAzExistsCommand, flociAzHealthUrl, flociAzEndpoint, } from "./floci-az.js";
 export type { FlociAzUpArgs, FlociAzDownArgs } from "./floci-az.js";
-export { azApply, azDelete, pruneArmOrphans, deleteArmResource, listGroupResources, chantOwnershipTags, isChantOwned, evalArm, evalArmString, armResourceUrl, armResourceBody, armDependencies, orderArmResources, } from "./az-apply.js";
+export { azApply, azDelete, pruneArmOrphans, toApplyResult, deleteArmResource, listGroupResources, chantOwnershipTags, isChantOwned, evalArm, evalArmString, armResourceUrl, armResourceBody, armDependencies, orderArmResources, } from "./az-apply.js";
 export type { AzApplyArgs, ArmEvalCtx, ArmResource, ArmListItem, AzHttp } from "./az-apply.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/op/activities/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAIpE,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EACL,OAAO,EACP,QAAQ,EACR,eAAe,EACf,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/op/activities/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,aAAa,EAAE,aAAa,EAAE,oBAAoB,EAAE,oBAAoB,EAAE,MAAM,SAAS,CAAC;AACnG,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAIpE,OAAO,EACL,SAAS,EACT,WAAW,EACX,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,GAChB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEjE,OAAO,EACL,OAAO,EACP,QAAQ,EACR,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EAClB,YAAY,EACZ,OAAO,EACP,aAAa,EACb,cAAc,EACd,eAAe,EACf,eAAe,EACf,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant-lexicon-azure",
-  "version": "0.39.0",
+  "version": "0.41.0",
   "description": "Azure lexicon for chant — declarative IaC in TypeScript",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",
@@ -74,7 +74,7 @@
     "typescript": "^5.9.3"
   },
   "peerDependencies": {
-    "@intentius/chant": "^0.39.0",
+    "@intentius/chant": "^0.41.0",
     "typescript": "^5.9.3"
   }
 }

package/src/op/activities/az-apply.test.ts

@@ -1,4 +1,6 @@
 import { describe, test, expect } from "vitest";
+import { writeFileSync, unlinkSync } from "node:fs";
+import { describeApplyConformance } from "@intentius/chant-test-utils";
 import {
   evalArmString,
   evalArm,
@@ -9,6 +11,7 @@ import {
   azApply,
   azDelete,
   pruneArmOrphans,
+  toApplyResult,
   deleteArmResource,
   listGroupResources,
   chantOwnershipTags,
@@ -200,10 +203,30 @@ describe("azApply flow (#707)", () => {
 });
 
 describe("ownership helpers (#azure-prune)", () => {
-  test("chantOwnershipTags / isChantOwned", () => {
-    expect(chantOwnershipTags()).toEqual({ "managed-by": "chant" });
+  // #1446: the applier used a bare `managed-by` while the lexicon's declared
+  // channel (AZURE_TAG_OWNERSHIP_KEYS, what the serializer stamps and
+  // live-export filters on) is `chant-managed-by`. Both are ordinary ARM tag
+  // keys on the same surface, so nothing forced the difference — and it meant a
+  // resource carrying only the serializer's marker read as foreign here.
+  test("stamps the lexicon's declared channel, plus the legacy key", () => {
+    expect(chantOwnershipTags()).toEqual({
+      "chant-managed-by": "chant",
+      "managed-by": "chant",
+    });
+  });
+
+  test("recognises the declared channel — the marker the serializer stamps", () => {
+    expect(isChantOwned({ "chant-managed-by": "chant" })).toBe(true);
+  });
+
+  test("still recognises the legacy key, so nothing already deployed is orphaned", () => {
     expect(isChantOwned({ "managed-by": "chant" })).toBe(true);
+  });
+
+  test("a foreign or unmarked resource is still foreign", () => {
     expect(isChantOwned({ "managed-by": "someone-else" })).toBe(false);
+    expect(isChantOwned({ "chant-managed-by": "terraform" })).toBe(false);
+    expect(isChantOwned({})).toBe(false);
     expect(isChantOwned(undefined)).toBe(false);
   });
 });
@@ -263,10 +286,16 @@ describe("pruneArmOrphans (#azure-prune)", () => {
       if (method === "DELETE") deletes.push(url);
       return { status: 200, text: method === "GET" ? JSON.stringify(live) : "" };
     };
-    const pruned = await pruneArmOrphans(desired, ctx(), http);
+    const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
     expect(pruned).toEqual([{ type: "Microsoft.Storage/storageAccounts", name: "orphan1", deleted: true }]);
     expect(deletes).toHaveLength(1);
     expect(deletes[0]).toContain("/storageAccounts/orphan1?api-version=2023-01-01"); // apiVersion from the template
+    // #1457: "othertype" is chant-owned and undeclared, and its TYPE is absent
+    // from the template — so there is no apiVersion to delete it with. It used
+    // to be dropped by the `!entry` guard in silence; now it is reported.
+    expect(notPrunable).toEqual([
+      { type: "Microsoft.Web/sites", name: "othertype", reason: "no-api-version" },
+    ]);
   });
 
   // #1448 routes ApplyOp's `arm` target here, so this is now the delete scope for
@@ -285,9 +314,12 @@ describe("pruneArmOrphans (#azure-prune)", () => {
       if (method === "DELETE") deletes.push(url);
       return { status: 200, text: method === "GET" ? JSON.stringify(live) : "" };
     };
-    const pruned = await pruneArmOrphans(desired, ctx(), http);
+    const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
     expect(deletes).toEqual([]);
     expect(pruned).toEqual([]);
+    // Foreign resources are not chant's orphans, so they are not reported as
+    // ones chant failed to prune either — ownership is checked first.
+    expect(notPrunable).toEqual([]);
   });
 
   // The caveat that was a comment on OWNERSHIP_TAG_KEY: floci-az drops resource
@@ -305,7 +337,7 @@ describe("pruneArmOrphans (#azure-prune)", () => {
       if (method === "DELETE") deletes.push(url);
       return { status: 200, text: method === "GET" ? JSON.stringify(live) : "" };
     };
-    expect(await pruneArmOrphans(desired, ctx(), http)).toEqual([]);
+    expect(await pruneArmOrphans(desired, ctx(), http)).toEqual({ pruned: [], notPrunable: [] });
     expect(deletes).toEqual([]);
   });
 });
@@ -369,3 +401,169 @@ describe("azDelete (#azure-prune)", () => {
     expect(deletes[1]).toContain("/serverfarms/plan1");
   });
 });
+
+/**
+ * #1457 — the permanent-orphan case, stated as its own scenario rather than a
+ * clause in another test.
+ *
+ * Prune the LAST resource of a type and the template stops mentioning that type
+ * at all. `byType` then has no entry, and the `!entry` guard skipped the live
+ * resource before ownership was ever checked. It is owned, undeclared, and was
+ * unreachable by prune forever. Prune one of SEVERAL and it works, which is why
+ * this survived testing.
+ */
+describe("pruneArmOrphans: a type that left the template (#1457)", () => {
+  const ctx = (): ArmEvalCtx => ({
+    subscriptionId: "sub",
+    resourceGroup: "rg",
+    location: "eastus",
+    deployed: new Map(),
+    http: async () => ({ status: 200, text: "" }),
+    base: "http://x",
+  });
+
+  const liveHttp = (value: unknown[], deletes: string[]): AzHttp => async (method, url) => {
+    if (method === "DELETE") deletes.push(url);
+    return { status: 200, text: method === "GET" ? JSON.stringify({ value }) : "" };
+  };
+
+  test("an owned orphan whose type is gone is reported, not silently skipped", async () => {
+    // The template now declares a DIFFERENT type entirely — the storage account
+    // was the last of its kind and has been removed from source.
+    const desired: ArmResource[] = [
+      { type: "Microsoft.Web/sites", apiVersion: "2022-03-01", name: "site" },
+    ];
+    const deletes: string[] = [];
+    const http = liveHttp(
+      [{ id: "/1", name: "leftover", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "chant" } }],
+      deletes,
+    );
+    const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
+    expect(pruned).toEqual([]);
+    expect(notPrunable).toEqual([
+      { type: "Microsoft.Storage/storageAccounts", name: "leftover", reason: "no-api-version" },
+    ]);
+    // Still not deleted — the apiVersion genuinely is not available. The fix is
+    // that it is now visible rather than that it is now deleted.
+    expect(deletes).toEqual([]);
+  });
+
+  test("pruning one of several of a type still works — the case that hid this", async () => {
+    const desired: ArmResource[] = [
+      { type: "Microsoft.Storage/storageAccounts", apiVersion: "2023-01-01", name: "keep" },
+    ];
+    const deletes: string[] = [];
+    const http = liveHttp(
+      [
+        { id: "/1", name: "keep", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "chant" } },
+        { id: "/2", name: "gone", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "chant" } },
+      ],
+      deletes,
+    );
+    const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
+    expect(pruned).toEqual([{ type: "Microsoft.Storage/storageAccounts", name: "gone", deleted: true }]);
+    expect(notPrunable).toEqual([]);
+    expect(deletes).toHaveLength(1);
+  });
+
+  test("a foreign resource of a departed type is not reported as chant's problem", async () => {
+    const desired: ArmResource[] = [
+      { type: "Microsoft.Web/sites", apiVersion: "2022-03-01", name: "site" },
+    ];
+    const deletes: string[] = [];
+    const http = liveHttp(
+      [{ id: "/1", name: "theirs", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "terraform" } }],
+      deletes,
+    );
+    const { pruned, notPrunable } = await pruneArmOrphans(desired, ctx(), http);
+    expect(pruned).toEqual([]);
+    expect(notPrunable).toEqual([]);
+    expect(deletes).toEqual([]);
+  });
+});
+
+/**
+ * The shared apply-contract suite (#1446), run against azure's own mocked
+ * transport. Assertion 4 — the owned-only prune, asserted on the transport — is
+ * the one that matters most here: it is what #1448 violated, and what the
+ * two-key split found in #1446 made unreliable even after #1448.
+ */
+describeApplyConformance({
+  lexicon: "azure",
+  scenarios: [
+    {
+      name: "a template of two resources",
+      plan: [
+        { kind: "Microsoft.Storage/storageAccounts", name: "one" },
+        { kind: "Microsoft.Storage/storageAccounts", name: "two" },
+      ],
+      run: async () => {
+        const path = `/tmp/chant-1446-az-${process.pid}.json`;
+        writeFileSync(
+          path,
+          JSON.stringify({
+            resources: [
+              { type: "Microsoft.Storage/storageAccounts", apiVersion: "2023-01-01", name: "one" },
+              { type: "Microsoft.Storage/storageAccounts", apiVersion: "2023-01-01", name: "two" },
+            ],
+          }),
+        );
+        try {
+          const http: AzHttp = async () => ({ status: 200, text: "{}" });
+          return toApplyResult(
+            await azApply({ templatePath: path, resourceGroup: "rg", endpoint: "http://x" }, undefined, http),
+          );
+        } finally {
+          unlinkSync(path);
+        }
+      },
+      expectApplied: [
+        "Microsoft.Storage/storageAccounts/one",
+        "Microsoft.Storage/storageAccounts/two",
+      ],
+    },
+  ],
+  pruneScenarios: [
+    {
+      name: "an owned orphan beside a foreign resource in the same group",
+      ownedOrphan: "orphan",
+      foreign: "foreign",
+      run: async () => {
+        const deletes: string[] = [];
+        const live = {
+          value: [
+            { id: "/1", name: "keep", type: "Microsoft.Storage/storageAccounts", tags: { "chant-managed-by": "chant" } },
+            { id: "/2", name: "orphan", type: "Microsoft.Storage/storageAccounts", tags: { "chant-managed-by": "chant" } },
+            { id: "/3", name: "foreign", type: "Microsoft.Storage/storageAccounts", tags: { "managed-by": "terraform" } },
+          ],
+        };
+        const path = `/tmp/chant-1446-az-prune-${process.pid}.json`;
+        writeFileSync(
+          path,
+          JSON.stringify({
+            resources: [{ type: "Microsoft.Storage/storageAccounts", apiVersion: "2023-01-01", name: "keep" }],
+          }),
+        );
+        try {
+          const http: AzHttp = async (method, url) => {
+            if (method === "DELETE") deletes.push(url);
+            return {
+              status: 200,
+              text: method === "GET" && url.includes("/resources?") ? JSON.stringify(live) : "{}",
+            };
+          };
+          const result = toApplyResult(
+            await azApply(
+              { templatePath: path, resourceGroup: "rg", endpoint: "http://x", prune: true },
+              undefined,
+              http,
+            ),
+          );
+          return { result, deletes };
+        } finally {
+          unlinkSync(path);
+        }
+      },
+    },
+  ],
+});

package/src/op/activities/az-apply.ts

@@ -1,6 +1,14 @@
 import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
 import { safeHeartbeat } from "@intentius/chant/op";
+import { hasOwnershipMarker, OWNERSHIP_MANAGED_BY_VALUE } from "@intentius/chant/ownership";
+import { AZURE_TAG_OWNERSHIP_KEYS } from "../../ownership";
+import {
+  applyResult,
+  type ApplyResult,
+  type AppliedResource,
+  type NotAttemptedResource,
+} from "@intentius/chant/apply";
 
 // The floci-az default local subscription (from its ARM management-plane mock).
 const DEFAULT_SUBSCRIPTION = "00000000-0000-0000-0000-000000000001";
@@ -296,7 +304,13 @@ export async function azApply(
   args: AzApplyArgs,
   signal?: AbortSignal,
   http: AzHttp = defaultHttp,
-): Promise<{ applied: Array<{ type: string; name: string }>; pruned: Array<{ type: string; name: string; deleted: boolean }> }> {
+): Promise<{
+  applied: Array<{ type: string; name: string }>;
+  pruned: Array<{ type: string; name: string; deleted: boolean }>;
+  /** Owned, undeclared resources the prune could not delete (#1457). Empty when
+   * `prune` is off, and empty on a clean prune. */
+  notPrunable: AzNotPrunable[];
+}> {
   const base = (args.endpoint ?? DEFAULT_ENDPOINT).replace(/\/$/, "");
   const ctx: ArmEvalCtx = {
     subscriptionId: args.subscriptionId ?? DEFAULT_SUBSCRIPTION,
@@ -340,8 +354,10 @@ export async function azApply(
     applied.push({ type: resource.type, name });
   }
 
-  const pruned = args.prune ? await pruneArmOrphans(resources, ctx, http, signal) : [];
-  return { applied, pruned };
+  const prune = args.prune
+    ? await pruneArmOrphans(resources, ctx, http, signal)
+    : { pruned: [], notPrunable: [] };
+  return { applied, pruned: prune.pruned, notPrunable: prune.notPrunable };
 }
 
 // ── Ownership + prune + delete ────────────────────────────────────────────────
@@ -351,17 +367,62 @@ export async function azApply(
 // touched. Real Azure persists resource tags; note that floci-az currently drops
 // them, so owned-only prune only takes effect against real Azure (the delete
 // mechanics themselves work against either — see azDelete).
-const OWNERSHIP_TAG_KEY = "managed-by";
-const OWNERSHIP_TAG_VALUE = "chant";
 
-/** The ownership tag azApply stamps on every resource it applies. */
+/**
+ * The key this applier used before #1446, and still recognises.
+ *
+ * The lexicon declares its marker channel in `../../ownership.ts`
+ * (`chant-managed-by`) — the key the serializer stamps, the plugin registers as
+ * `ownershipChannel`, and `import/live-export.ts` filters on. This applier used
+ * a bare `managed-by` instead, so the two never agreed.
+ *
+ * That is not cosmetic. Both are ordinary ARM tag keys on the same surface, so
+ * nothing forced the difference — and it meant a resource carrying only the
+ * SERIALIZER's marker was invisible to this prune. Anything deployed by a path
+ * other than `azApply` reads as foreign and is never pruned, including
+ * everything `ApplyOp` deployed before #1448 routed it here from
+ * `az deployment --mode Complete`.
+ *
+ * (GCP has the same-looking split for a real reason: its serializer stamps a
+ * Config Connector object, where `app.kubernetes.io/managed-by` is a legal
+ * Kubernetes label, while `gcpApply` writes GCP REST labels, where it is not.
+ * Two surfaces, two key vocabularies. Azure has one surface.)
+ */
+const LEGACY_OWNERSHIP_TAG_KEY = "managed-by";
+
+/**
+ * The ownership tags azApply stamps on every resource it applies.
+ *
+ * Stamps the declared channel's key. The legacy key goes on too, so a resource
+ * applied by this chant is still recognised by an older one mid-rollout; it is
+ * transitional and can be dropped once no deployed estate predates #1446.
+ *
+ * Only the managed-by marker, not stack/env: this applier has no
+ * {@link OwnershipMarker} to hand — the serializer stamps those from project
+ * config. Same shape the fly serializer uses when no ownership context is set.
+ */
 export function chantOwnershipTags(): Record<string, string> {
-  return { [OWNERSHIP_TAG_KEY]: OWNERSHIP_TAG_VALUE };
+  return {
+    [AZURE_TAG_OWNERSHIP_KEYS.managedBy]: OWNERSHIP_MANAGED_BY_VALUE,
+    [LEGACY_OWNERSHIP_TAG_KEY]: OWNERSHIP_MANAGED_BY_VALUE,
+  };
 }
 
-/** Whether a resource's tags mark it chant-owned. */
+/**
+ * Whether a resource's tags mark it chant-owned.
+ *
+ * Resolves through core's `hasOwnershipMarker` against the lexicon's declared
+ * channel (#1446), so this predicate and the serializer's stamp can no longer
+ * drift — the arrangement the fly lexicon already had.
+ *
+ * The legacy key is accepted as well, and the union is deliberate: it is
+ * strictly more than this predicate recognised before, so nothing that was
+ * prunable stops being prunable, and resources the serializer marked become
+ * prunable for the first time.
+ */
 export function isChantOwned(tags: Record<string, string> | null | undefined): boolean {
-  return tags?.[OWNERSHIP_TAG_KEY] === OWNERSHIP_TAG_VALUE;
+  if (hasOwnershipMarker(tags ?? undefined, AZURE_TAG_OWNERSHIP_KEYS)) return true;
+  return tags?.[LEGACY_OWNERSHIP_TAG_KEY] === OWNERSHIP_MANAGED_BY_VALUE;
 }
 
 /** One resource from the ARM resource-group listing. */
@@ -400,19 +461,92 @@ export async function deleteArmResource(
   return { type, name, deleted: true };
 }
 
+/**
+ * Normalize an azApply/azDelete result into core's apply envelope (#1446).
+ *
+ * The lexicon keeps its own shape — ARM `type`, per-resource applied/pruned —
+ * and this projects it onto the shared tri-state so a caller can read any
+ * applier's result the same way.
+ */
+export function toApplyResult(result: {
+  applied?: Array<{ type: string; name: string }>;
+  pruned?: Array<{ type: string; name: string; deleted: boolean }>;
+  deleted?: Array<{ type: string; name: string; deleted: boolean }>;
+  notPrunable?: AzNotPrunable[];
+}): ApplyResult {
+  const applied: AppliedResource[] = (result.applied ?? []).map((a) => ({
+    kind: a.type,
+    name: a.name,
+    // ARM PUT is a create-or-update with no distinguishing response, so this
+    // applier cannot tell the two apart. `updated` is the honest verdict for a
+    // call that converged without claiming which it did.
+    action: "updated",
+  }));
+  const notAttempted: NotAttemptedResource[] = (result.notPrunable ?? []).map((n) => ({
+    kind: n.type,
+    name: n.name,
+    reason: "not-prunable" as const,
+    detail: n.reason,
+  }));
+  const pruned = (result.pruned ?? result.deleted ?? []).map((p) => ({
+    kind: p.type,
+    name: p.name,
+    deleted: p.deleted,
+  }));
+  return applyResult(applied, pruned, notAttempted);
+}
+
+/** A chant-owned live resource an owned-only prune could not delete, and why (#1457). */
+export interface AzNotPrunable {
+  type: string;
+  name: string;
+  /**
+   * `no-api-version` — the resource is owned and undeclared, but its type is
+   * absent from the current template, which is the only place an `apiVersion`
+   * comes from. `deleteArmResource` cannot build a URL without one.
+   */
+  reason: "no-api-version";
+}
+
 /**
  * Owned-only prune: for each resource type present in the template, delete the
  * chant-owned live resources of that type whose (evaluated) name is not in the
- * template. Scoped to templated types — like the GCP applier — so a type chant
- * isn't managing this run is left alone, and the type's `apiVersion` is taken
- * from the template. Foreign (non-chant) resources are never touched.
+ * template. Foreign (non-chant) resources are never touched.
+ *
+ * ## The type-left-the-template hole (#1457)
+ *
+ * `byType` is keyed off the resources the template CURRENTLY declares, and the
+ * `!entry` guard skipped any live resource of a type the template no longer
+ * mentions — before `isChantOwned` was ever consulted.
+ *
+ * So: declare one storage account, apply, then delete it from source. The
+ * template now has zero resources of that type, `byType` has no entry, and the
+ * live account is skipped. It is owned, it is undeclared, and prune would never
+ * touch it — on that run or any future one. **Prune the last resource of a type
+ * and you created a permanent orphan.** Prune one of several and it works,
+ * which is why it survived testing.
+ *
+ * The guard cannot simply be removed: `deleteArmResource` needs an
+ * `apiVersion`, and the template is the only source of one — ARM's
+ * resource-group listing does not return it per resource. So the skip stays,
+ * and is now REPORTED rather than silent: a permanent invisible orphan becomes
+ * a permanent visible one, which is the difference between a bug and a known
+ * limitation. Resolving it properly wants a per-type apiVersion source (the
+ * provider metadata endpoint, or a lexicon-side map).
+ *
+ * This matters more since #1448, which routed `ApplyOp`'s `arm` target through
+ * `azApply` — before that, the composite reached `--mode Complete` and never
+ * came here at all.
  */
 export async function pruneArmOrphans(
   desired: ArmResource[],
   ctx: ArmEvalCtx,
   http: AzHttp = defaultHttp,
   signal?: AbortSignal,
-): Promise<Array<{ type: string; name: string; deleted: boolean }>> {
+): Promise<{
+  pruned: Array<{ type: string; name: string; deleted: boolean }>;
+  notPrunable: AzNotPrunable[];
+}> {
   const byType = new Map<string, { keep: Set<string>; apiVersion: string }>();
   for (const r of desired) {
     const name = String(await evalArmString(r.name, ctx));
@@ -422,15 +556,27 @@ export async function pruneArmOrphans(
   }
 
   const pruned: Array<{ type: string; name: string; deleted: boolean }> = [];
+  const notPrunable: AzNotPrunable[] = [];
   for (const item of await listGroupResources(ctx, http, signal)) {
+    // Ownership first, so a foreign resource never reaches the report either —
+    // it is not an orphan chant failed to prune, it is simply not chant's.
+    if (!isChantOwned(item.tags)) continue;
     const entry = byType.get(item.type);
-    if (!entry || !isChantOwned(item.tags) || entry.keep.has(item.name)) continue;
+    if (!entry) {
+      console.log(
+        `prune: ${item.type}/${item.name} is chant-owned and undeclared, but its type is absent ` +
+          `from the template so no apiVersion is available — not deleted`,
+      );
+      notPrunable.push({ type: item.type, name: item.name, reason: "no-api-version" });
+      continue;
+    }
+    if (entry.keep.has(item.name)) continue;
     safeHeartbeat({ step: "azPrune", type: item.type, name: item.name });
     const result = await deleteArmResource(item.type, item.name, entry.apiVersion, ctx, http, signal);
     console.log(`pruned: ${item.type}/${item.name} (${ctx.base})`);
     pruned.push(result);
   }
-  return pruned;
+  return { pruned, notPrunable };
 }
 
 /**

package/src/op/activities/index.ts

@@ -23,6 +23,7 @@ export {
   azApply,
   azDelete,
   pruneArmOrphans,
+  toApplyResult,
   deleteArmResource,
   listGroupResources,
   chantOwnershipTags,