Approval-gated live guard for exactly one Snowflake failover group promotion. Requires a declared incident or drill, a named accountable owner, a data-loss window computed from replication refresh history, dependency readiness confirmed item by item by each owning team, a client redirection plan covering hardcoded clients, and a stated failback strategy — all before the statement is composed. Refuses on urgency alone. Runs as a custom role in the target account able to promote only the named group; never ACCOUNTADMIN.
