Approval-gated live guard for exactly one Snowflake pipeline or ingestion change — one task, stream, dynamic table, or pipe operation, or one bounded backfill. Requires a freshness and count baseline, the last successful processing state, the offset or checkpoint position, a downstream consumer enumeration, and an explicit duplication-or-loss analysis before execution, plus a passing reconciliation afterwards. Refuses unbounded replays and replays into targets with no deduplication path. Runs as a custom role scoped to the single object; never ACCOUNTADMIN.
