Harden apply guard and completed-org count

Author: RhysSullivan

scripts/migration/oneshot-service-split-cli.ts

@@ -214,6 +214,9 @@ const operationKeyPrefix = (integration: string): string =>
 
 const applyOrg = async (sql: SqlClient, org: OrgPlan): Promise<void> => {
   if (org.completed) return;
+  if (org.hardErrors.length > 0) {
+    throw new Error(`org ${org.tenant} has unresolved policy hard errors; apply is blocked`);
+  }
   await sql.begin(async (tx) => {
     const now = new Date();
     for (const row of org.integrations.filter((item) => item.action === "create")) {

scripts/migration/oneshot-service-split.ts

@@ -1063,7 +1063,7 @@ export const planMigration = (input: MigrationInput): MigrationPlan => {
   const activeOrgs = orgs.filter((org) => !org.completed && org.hardErrors.length === 0);
   const summary = {
     orgs: orgs.length,
-    completedOrgs: orgs.length - activeOrgs.length,
+    completedOrgs: orgs.filter((org) => org.completed).length,
     integrationsCreate: activeOrgs
       .flatMap((org) => org.integrations)
       .filter((row) => row.action === "create").length,