@intentius/chant 0.54.3 → 0.55.0

package/dist/cli/commands/migrate.d.ts

@@ -46,6 +46,17 @@ interface ValidatorResult {
  * Exported for testability.
  */
 export declare function tryValidateExternal(yamlText: string): ValidatorResult;
+/**
+ * Format the migration report as Markdown, mirroring the output format
+ * prescribed by the upstream gitlab-org/ci-cd/github-actions-to-gitlab-ci
+ * skill: overview, classification, diagnostic table, aggregated manual
+ * setup steps, suggested GitLab improvements, caveats.
+ *
+ * The same data backs the SARIF report (via formatSarif); this is the
+ * human-readable surface. Exported so downstream migrate consumers can render
+ * the same report without reimplementing it (#2066).
+ */
+export declare function formatMarkdownSummary(provenance: Array<Record<string, unknown>>, diagnostics: Array<Record<string, unknown>>, sourceContent?: string): string;
 export declare function printMigrateResult(result: MigrateCliResult): void;
 export {};
 //# sourceMappingURL=migrate.d.ts.map

package/dist/cli/commands/migrate.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsJpF;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,OAAO,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AASD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAUrE;AA6OD,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAajE"}
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/migrate.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,aAAa,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,oCAAoC;IACpC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,6BAA6B;IAC7B,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC5C,4DAA4D;IAC5D,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,uCAAuC;IACvC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,wBAAsB,cAAc,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAsJpF;AAED,UAAU,eAAe;IACvB,GAAG,EAAE,OAAO,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;CAChB;AASD;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,CAUrE;AAqBD;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC1C,WAAW,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAC3C,aAAa,CAAC,EAAE,MAAM,GACrB,MAAM,CAkER;AAyID,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,gBAAgB,GAAG,IAAI,CAajE"}

package/dist/reconcile.d.ts

@@ -57,6 +57,14 @@ export interface ChangeSet {
     org: string;
     /** All proposed changes, in stable order. */
     entries: ChangeSetEntry[];
+    /**
+     * Live entries under management across the diffed collections (#2067).
+     * `diffCollection` returns each collection's live count so the diff layer
+     * can sum it here. Optional — when absent, guardrails that want a live
+     * denominator (see {@link removalDeltaCap}) fall back to the plan-relative
+     * one.
+     */
+    managedCount?: number;
 }
 /** Options controlling diff behaviour. */
 export interface DiffOptions {
@@ -105,8 +113,11 @@ export interface DiffCollectionParams<D, L> {
  * when `compareFields` reports differences, and ownership-gated deletes for
  * live-not-desired. This is the selective-by-omission + ownership-gated-delete
  * pattern shared by every keyed-collection diff.
+ *
+ * Returns the live entry count for this collection, so the diff layer can sum
+ * `ChangeSet.managedCount` across the collections it diffs (#2067).
  */
-export declare function diffCollection<D, L>(params: DiffCollectionParams<D, L>): void;
+export declare function diffCollection<D, L>(params: DiffCollectionParams<D, L>): number;
 /** Count entries per change kind. */
 export declare function summarizeChangeSet(cs: ChangeSet): Record<ChangeKind, number>;
 /** Human-readable plan summary for dry-run output. Pure. */
@@ -125,12 +136,30 @@ export type GuardrailResult = {
     ok: false;
     diagnostics: GuardrailDiagnostic[];
 };
-/** A guardrail check over a (rename-resolved) change set. Returns null when it passes. */
-export type GuardrailCheck = (resolved: ChangeSet) => GuardrailDiagnostic | null;
+/** Live context threaded to guardrail checks by `runGuardrailChecks` (#2067). */
+export interface GuardrailContext {
+    /** Live entries under management this cycle (see `ChangeSet.managedCount`). */
+    managedCount?: number;
+}
+/**
+ * A guardrail check over a (rename-resolved) change set. Returns null when it
+ * passes. `ctx` carries live context when the caller has it (#2067); a check
+ * written against the single-argument shape keeps working unchanged.
+ */
+export type GuardrailCheck = (resolved: ChangeSet, ctx?: GuardrailContext) => GuardrailDiagnostic | null;
 /** Config for `removalDeltaCap`. */
 export interface RemovalDeltaCapOptions {
     /** Max fraction of pre-existing entries that may be deleted. Must be in (0,1]. Default 0.25. */
     maxFraction?: number;
+    /**
+     * Live managed-entry denominator (#2067). When positive, deletes are divided
+     * by this count of live entries under management instead of the plan's
+     * non-create entries — a converged cycle deleting one stale entry out of
+     * many no longer reads as 1/1 = 100%. Defaults to `changeSet.managedCount`;
+     * when neither is present (or not positive) the cap keeps its plan-relative
+     * behavior.
+     */
+    managedTotal?: number;
 }
 /**
  * Resolve rename aliases. A create entry carrying a `previously` key matching a
@@ -144,6 +173,11 @@ export declare function resolveRenames(changeSet: ChangeSet): ChangeSet;
  * (deletes + updates; creates excluded so a flood of new entries can't dilute
  * the delete fraction). Guards against a typo wiping the config in one apply.
  *
+ * With a live denominator (`opts.managedTotal`, else `changeSet.managedCount`;
+ * #2067) deletes are measured against the live entries under management
+ * instead — so a converged cycle's plan of exactly one stale delete does not
+ * trip at 1/1 = 100%. Without one, behavior is plan-relative as before.
+ *
  * CONTRACT: pass a RENAME-RESOLVED change set (see {@link resolveRenames}).
  */
 export declare function removalDeltaCap(changeSet: ChangeSet, opts?: RemovalDeltaCapOptions): GuardrailDiagnostic | null;
@@ -151,8 +185,10 @@ export declare function removalDeltaCap(changeSet: ChangeSet, opts?: RemovalDelt
  * Run a set of guardrail checks against a change set. Resolves renames ONCE,
  * then runs every check on the resolved set, aggregating any diagnostics. The
  * caller composes provider-specific checks (e.g. an admin floor) as closures.
+ * `ctx` (optional, #2067) threads live context — e.g. the managed-live count —
+ * to every check; single-argument checks ignore it.
  */
-export declare function runGuardrailChecks(changeSet: ChangeSet, checks: GuardrailCheck[]): GuardrailResult;
+export declare function runGuardrailChecks(changeSet: ChangeSet, checks: GuardrailCheck[], ctx?: GuardrailContext): GuardrailResult;
 /** Controls how a cycle tracks its API usage against a shared request budget. */
 export interface RateBudget {
     /** Remaining request capacity for this run. */

package/dist/reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMxE,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAC;CAC3B;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAEzD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,GACd,WAAW,EAAE,CAUf;AAMD,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB,CAAC,CAAC,EAAE,CAAC;IACxC,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,0CAA0C;IAC1C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrB,mEAAmE;IACnE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC;IACtD,uEAAuE;IACvE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC;IACnD,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;IAC5D,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CA6C7E;AAMD,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAI5E;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAgCrD;AAaD,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,WAAW,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AAE/F,0FAA0F;AAC1F,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,KAAK,mBAAmB,GAAG,IAAI,CAAC;AAEjF,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAyC9D;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,IAAI,GAAE,sBAA2B,GAChC,mBAAmB,GAAG,IAAI,CAgB5B;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,eAAe,CAQlG;AAMD,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,gFAAgF;IAChF,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAA0B;CAI9C;AAmBD;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC9D,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/F,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACvE,KAAK,CACH,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,GAAG,cAAc,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC5E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC;IACvF,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,KAAK,eAAe,CAAC;IACpE,wCAAwC;IACxC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sDAAsD;IACtD,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,EAC1E,IAAI,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GACzD,OAAO,CAAC,eAAe,CAAC,CA6G1B"}
+{"version":3,"file":"reconcile.d.ts","sourceRoot":"","sources":["../src/reconcile.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,EAAoB,KAAK,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAMxE,mFAAmF;AACnF,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,KAAK,EAAE,OAAO,CAAC;CAChB;AAED,oDAAoD;AACpD,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAExD,wCAAwC;AACxC,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,UAAU,CAAC;IACjB,iFAAiF;IACjF,YAAY,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB;;;;OAIG;IACH,GAAG,EAAE,MAAM,CAAC;IACZ,6DAA6D;IAC7D,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,+DAA+D;IAC/D,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,wDAAwD;IACxD,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,SAAS;IACxB,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,0CAA0C;AAC1C,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,OAAO,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;IAEzD;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAMD,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAKzD;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CACxB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,IAAI,CAAC,EAAE,MAAM,EAAE,GACd,WAAW,EAAE,CAUf;AAMD,6CAA6C;AAC7C,MAAM,WAAW,oBAAoB,CAAC,CAAC,EAAE,CAAC;IACxC,gDAAgD;IAChD,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6CAA6C;IAC7C,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACxB,0CAA0C;IAC1C,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACrB,mEAAmE;IACnE,aAAa,EAAE,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,WAAW,EAAE,CAAC;IACtD,uEAAuE;IACvE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,OAAO,CAAC;IACnD,wEAAwE;IACxE,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC;IAC5D,IAAI,EAAE,WAAW,CAAC;IAClB,GAAG,EAAE,cAAc,EAAE,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,MAAM,CA+C/E;AAMD,qCAAqC;AACrC,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAI5E;AAED,4DAA4D;AAC5D,wBAAgB,eAAe,CAAC,EAAE,EAAE,SAAS,GAAG,MAAM,CAgCrD;AAaD,gEAAgE;AAChE,MAAM,WAAW,mBAAmB;IAClC,gDAAgD;IAChD,SAAS,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,MAAM,eAAe,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,WAAW,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAAC;AAE/F,iFAAiF;AACjF,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;GAIG;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,EAAE,gBAAgB,KAAK,mBAAmB,GAAG,IAAI,CAAC;AAEzG,oCAAoC;AACpC,MAAM,WAAW,sBAAsB;IACrC,gGAAgG;IAChG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,SAAS,EAAE,SAAS,GAAG,SAAS,CAyC9D;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,eAAe,CAC7B,SAAS,EAAE,SAAS,EACpB,IAAI,GAAE,sBAA2B,GAChC,mBAAmB,GAAG,IAAI,CAgC5B;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,cAAc,EAAE,EACxB,GAAG,CAAC,EAAE,gBAAgB,GACrB,eAAe,CAQjB;AAMD,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,+CAA+C;IAC/C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,gFAAgF;IAChF,GAAG,CAAC,CAAC,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,6EAA6E;AAC7E,qBAAa,oBAAqB,SAAQ,KAAK;gBACjC,OAAO,SAA0B;CAI9C;AAmBD;;;;;;;;;GASG;AACH,MAAM,WAAW,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC9D,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,SAAS,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;IAC/F,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;IACvE,KAAK,CACH,MAAM,EAAE,OAAO,EACf,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,UAAU,GACjB,OAAO,CAAC,IAAI,CAAC,CAAC;CAClB;AAED,oDAAoD;AACpD,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,IAAI,CAAC,EAAE,cAAc,CAAC;IACtB,uDAAuD;IACvD,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,UAAU,EAAE,eAAe,CAAC;IAC5B,OAAO,EAAE,cAAc,EAAE,CAAC;IAC1B,MAAM,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,cAAc,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,iFAAiF;AACjF,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,WAAW,GAAG,cAAc,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,6DAA6D;AAC7D,MAAM,WAAW,YAAY;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,KAAK,CAAC;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;CACrE;AAED,2DAA2D;AAC3D,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC;IAC1B,SAAS,EAAE,OAAO,CAAC;IACnB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,OAAO,EAAE,UAAU,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO;IAC5E,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,qDAAqD;IACrD,MAAM,EAAE,OAAO,CAAC;IAChB,gEAAgE;IAChE,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,CAAC;IAC3B,0EAA0E;IAC1E,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,KAAK,SAAS,CAAC;IACvF,yEAAyE;IACzE,UAAU,CAAC,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,KAAK,eAAe,CAAC;IACpE,wCAAwC;IACxC,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,sDAAsD;IACtD,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,kEAAkE;IAClE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAMD;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,EAC1E,IAAI,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,GACzD,OAAO,CAAC,eAAe,CAAC,CA6G1B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intentius/chant",
-  "version": "0.54.3",
+  "version": "0.55.0",
   "description": "Declarative infrastructure-as-code toolkit — TypeScript on Node.js",
   "license": "Apache-2.0",
   "homepage": "https://intentius.io/chant",

package/src/cli/commands/migrate.ts

@@ -251,9 +251,10 @@ async function loadMigrationRules(targetLexicon: string): Promise<LintRule[]> {
  * setup steps, suggested GitLab improvements, caveats.
  *
  * The same data backs the SARIF report (via formatSarif); this is the
- * human-readable surface.
+ * human-readable surface. Exported so downstream migrate consumers can render
+ * the same report without reimplementing it (#2066).
  */
-function formatMarkdownSummary(
+export function formatMarkdownSummary(
   provenance: Array<Record<string, unknown>>,
   diagnostics: Array<Record<string, unknown>>,
   sourceContent?: string,

package/src/reconcile.test.ts

@@ -102,6 +102,23 @@ describe("diffCollection", () => {
     ]);
   });
 
+  test("returns the live entry count for managedCount accumulation (#2067)", () => {
+    const out: ChangeSetEntry[] = [];
+    const count = diffCollection<D, L>({
+      resourceType: "thing",
+      desired: new Map([["a", { name: "a", v: 1 }]]),
+      live: new Map([
+        ["a", { name: "a", v: 1 }],
+        ["b", { name: "b", v: 2 }],
+        ["c", { name: "c", v: 3 }],
+      ]),
+      compareFields: () => [],
+      opts: noOpts,
+      out,
+    });
+    expect(count).toBe(3);
+  });
+
   test("honours createAfter / updateAfter mappers", () => {
     const out: ChangeSetEntry[] = [];
     diffCollection<D, L>({
@@ -171,6 +188,18 @@ describe("resolveRenames", () => {
     const cs: ChangeSet = { org: "acme", entries: [{ kind: "delete", resourceType: "team", key: "old" }] };
     expect(resolveRenames(cs)).toBe(cs);
   });
+
+  test("preserves managedCount on the resolved set (#2067)", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCount: 7,
+      entries: [
+        { kind: "delete", resourceType: "team", key: "old", before: { slug: "old" } },
+        { kind: "create", resourceType: "team", key: "new", after: { previously: "old" } },
+      ],
+    };
+    expect(resolveRenames(cs).managedCount).toBe(7);
+  });
 });
 
 describe("removalDeltaCap", () => {
@@ -199,6 +228,64 @@ describe("removalDeltaCap", () => {
     };
     expect(removalDeltaCap(cs)).toBeNull(); // 1/4 = 25%, not > 25%
   });
+
+  // Live-denominator mode (#2067) — the warden reference cases.
+
+  test("one stale delete of 10 live managed entries passes at the default cap", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [{ kind: "delete", resourceType: "x", key: "stale" }],
+    };
+    // Plan-relative this is 1/1 = 100% and trips; against the live count it
+    // is 1/10 = 10% and passes — the routine converged-cycle cleanup.
+    expect(removalDeltaCap(cs)).not.toBeNull();
+    expect(removalDeltaCap(cs, { managedTotal: 10 })).toBeNull();
+  });
+
+  test("4 deletes of 10 live managed entries blocks, with the live-mode message", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: Array.from({ length: 4 }, (_, i) => ({
+        kind: "delete" as const,
+        resourceType: "x",
+        key: `k${i}`,
+      })),
+    };
+    const d = removalDeltaCap(cs, { managedTotal: 10 })!;
+    expect(d.guardrail).toBe("removalDeltaCap");
+    expect(d.message).toContain("4 of 10 live managed entries (40%)");
+  });
+
+  test("reads changeSet.managedCount when opts.managedTotal is absent", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      managedCount: 10,
+      entries: [{ kind: "delete", resourceType: "x", key: "stale" }],
+    };
+    expect(removalDeltaCap(cs)).toBeNull(); // 1/10 via the change set's own count
+    // An explicit managedTotal wins over the change set's count.
+    expect(removalDeltaCap({ ...cs, managedCount: 2 }, { managedTotal: 10 })).toBeNull();
+  });
+
+  test("without managed info the diagnostic deep-equals the plan-relative one", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [
+        { kind: "delete", resourceType: "x", key: "a" },
+        { kind: "delete", resourceType: "x", key: "b" },
+      ],
+    };
+    const expected = {
+      guardrail: "removalDeltaCap",
+      message:
+        "2 of 2 managed entries (100%) would be deleted, exceeding the 25% threshold. " +
+        "Check for typos in config or raise maxFraction to proceed.",
+    };
+    expect(removalDeltaCap(cs)).toEqual(expected);
+    // A zero live count means "no live info" — it never divides by zero and
+    // never loosens the cap; behavior stays exactly plan-relative.
+    expect(removalDeltaCap(cs, { managedTotal: 0 })).toEqual(expected);
+  });
 });
 
 describe("runGuardrailChecks", () => {
@@ -221,6 +308,19 @@ describe("runGuardrailChecks", () => {
     const cs: ChangeSet = { org: "acme", entries: [{ kind: "create", resourceType: "x", key: "a" }] };
     expect(runGuardrailChecks(cs, [() => null])).toEqual({ ok: true });
   });
+
+  test("threads live context to checks that take it (#2067)", () => {
+    const cs: ChangeSet = {
+      org: "acme",
+      entries: [{ kind: "delete", resourceType: "x", key: "stale" }],
+    };
+    const check: GuardrailCheck = (resolved, ctx) =>
+      removalDeltaCap(resolved, { managedTotal: ctx?.managedCount });
+    // Without ctx the check falls back to plan-relative and trips (1/1).
+    expect(runGuardrailChecks(cs, [check]).ok).toBe(false);
+    // With the live count threaded through, 1/10 passes.
+    expect(runGuardrailChecks(cs, [check], { managedCount: 10 })).toEqual({ ok: true });
+  });
 });
 
 // ---------------------------------------------------------------------------

package/src/reconcile.ts

@@ -66,6 +66,14 @@ export interface ChangeSet {
   org: string;
   /** All proposed changes, in stable order. */
   entries: ChangeSetEntry[];
+  /**
+   * Live entries under management across the diffed collections (#2067).
+   * `diffCollection` returns each collection's live count so the diff layer
+   * can sum it here. Optional — when absent, guardrails that want a live
+   * denominator (see {@link removalDeltaCap}) fall back to the plan-relative
+   * one.
+   */
+  managedCount?: number;
 }
 
 /** Options controlling diff behaviour. */
@@ -147,8 +155,11 @@ export interface DiffCollectionParams<D, L> {
  * when `compareFields` reports differences, and ownership-gated deletes for
  * live-not-desired. This is the selective-by-omission + ownership-gated-delete
  * pattern shared by every keyed-collection diff.
+ *
+ * Returns the live entry count for this collection, so the diff layer can sum
+ * `ChangeSet.managedCount` across the collections it diffs (#2067).
  */
-export function diffCollection<D, L>(params: DiffCollectionParams<D, L>): void {
+export function diffCollection<D, L>(params: DiffCollectionParams<D, L>): number {
   const {
     resourceType,
     keyPrefix = "",
@@ -193,6 +204,8 @@ export function diffCollection<D, L>(params: DiffCollectionParams<D, L>): void {
       out.push({ kind: "delete", resourceType, key: entryKey, before: l });
     }
   }
+
+  return live.size;
 }
 
 // ---------------------------------------------------------------------------
@@ -263,13 +276,32 @@ export interface GuardrailDiagnostic {
 /** Aggregated guardrail result. */
 export type GuardrailResult = { ok: true } | { ok: false; diagnostics: GuardrailDiagnostic[] };
 
-/** A guardrail check over a (rename-resolved) change set. Returns null when it passes. */
-export type GuardrailCheck = (resolved: ChangeSet) => GuardrailDiagnostic | null;
+/** Live context threaded to guardrail checks by `runGuardrailChecks` (#2067). */
+export interface GuardrailContext {
+  /** Live entries under management this cycle (see `ChangeSet.managedCount`). */
+  managedCount?: number;
+}
+
+/**
+ * A guardrail check over a (rename-resolved) change set. Returns null when it
+ * passes. `ctx` carries live context when the caller has it (#2067); a check
+ * written against the single-argument shape keeps working unchanged.
+ */
+export type GuardrailCheck = (resolved: ChangeSet, ctx?: GuardrailContext) => GuardrailDiagnostic | null;
 
 /** Config for `removalDeltaCap`. */
 export interface RemovalDeltaCapOptions {
   /** Max fraction of pre-existing entries that may be deleted. Must be in (0,1]. Default 0.25. */
   maxFraction?: number;
+  /**
+   * Live managed-entry denominator (#2067). When positive, deletes are divided
+   * by this count of live entries under management instead of the plan's
+   * non-create entries — a converged cycle deleting one stale entry out of
+   * many no longer reads as 1/1 = 100%. Defaults to `changeSet.managedCount`;
+   * when neither is present (or not positive) the cap keeps its plan-relative
+   * behavior.
+   */
+  managedTotal?: number;
 }
 
 /**
@@ -318,7 +350,7 @@ export function resolveRenames(changeSet: ChangeSet): ChangeSet {
       !(e.kind === "create" && resolvedCreates.has(e.key)),
   );
 
-  return { org: changeSet.org, entries: [...filteredEntries, ...syntheticUpdates] };
+  return { ...changeSet, entries: [...filteredEntries, ...syntheticUpdates] };
 }
 
 /**
@@ -326,6 +358,11 @@ export function resolveRenames(changeSet: ChangeSet): ChangeSet {
  * (deletes + updates; creates excluded so a flood of new entries can't dilute
  * the delete fraction). Guards against a typo wiping the config in one apply.
  *
+ * With a live denominator (`opts.managedTotal`, else `changeSet.managedCount`;
+ * #2067) deletes are measured against the live entries under management
+ * instead — so a converged cycle's plan of exactly one stale delete does not
+ * trip at 1/1 = 100%. Without one, behavior is plan-relative as before.
+ *
  * CONTRACT: pass a RENAME-RESOLVED change set (see {@link resolveRenames}).
  */
 export function removalDeltaCap(
@@ -333,9 +370,25 @@ export function removalDeltaCap(
   opts: RemovalDeltaCapOptions = {},
 ): GuardrailDiagnostic | null {
   const maxFraction = opts.maxFraction ?? 0.25;
+  const deletes = changeSet.entries.filter((e) => e.kind === "delete").length;
+
+  const managedTotal = opts.managedTotal ?? changeSet.managedCount;
+  if (managedTotal !== undefined && managedTotal > 0) {
+    const fraction = deletes / managedTotal;
+    if (fraction > maxFraction) {
+      return {
+        guardrail: "removalDeltaCap",
+        message:
+          `${deletes} of ${managedTotal} live managed entries (${Math.round(fraction * 100)}%) would be deleted, ` +
+          `exceeding the ${Math.round(maxFraction * 100)}% threshold. ` +
+          `Check for typos in config or raise maxFraction to proceed.`,
+      };
+    }
+    return null;
+  }
+
   const total = changeSet.entries.filter((e) => e.kind !== "create").length;
   if (total === 0) return null;
-  const deletes = changeSet.entries.filter((e) => e.kind === "delete").length;
   const fraction = deletes / total;
   if (fraction > maxFraction) {
     return {
@@ -353,12 +406,18 @@ export function removalDeltaCap(
  * Run a set of guardrail checks against a change set. Resolves renames ONCE,
  * then runs every check on the resolved set, aggregating any diagnostics. The
  * caller composes provider-specific checks (e.g. an admin floor) as closures.
+ * `ctx` (optional, #2067) threads live context — e.g. the managed-live count —
+ * to every check; single-argument checks ignore it.
  */
-export function runGuardrailChecks(changeSet: ChangeSet, checks: GuardrailCheck[]): GuardrailResult {
+export function runGuardrailChecks(
+  changeSet: ChangeSet,
+  checks: GuardrailCheck[],
+  ctx?: GuardrailContext,
+): GuardrailResult {
   const resolved = resolveRenames(changeSet);
   const diagnostics: GuardrailDiagnostic[] = [];
   for (const check of checks) {
-    const d = check(resolved);
+    const d = check(resolved, ctx);
     if (d) diagnostics.push(d);
   }
   return diagnostics.length > 0 ? { ok: false, diagnostics } : { ok: true };