@empire-builder-kit/nx 1.0.0-rc.2 → 1.0.0-rc.21

package/src/executors/infrastructure-plan/infrastructure-plan.js

@@ -1,13 +1,32 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_SST_DIFF_JSON_BYTES = void 0;
+exports.collectInfrastructureBuildArtifacts = collectInfrastructureBuildArtifacts;
+exports.infrastructureConfigurationMetadataDigest = infrastructureConfigurationMetadataDigest;
+exports.matchesExpectedAssumedRoleArn = matchesExpectedAssumedRoleArn;
+exports.localProductionConfirmation = localProductionConfirmation;
+exports.revalidateLocalUnlockCallerAuthority = revalidateLocalUnlockCallerAuthority;
+exports.parseRefreshPreviewJson = parseRefreshPreviewJson;
 exports.extractPrivateImportIdentifierDigests = extractPrivateImportIdentifierDigests;
 exports.approvalCandidateSourceCommit = approvalCandidateSourceCommit;
 exports.createCandidateBoundSstChildEnvironment = createCandidateBoundSstChildEnvironment;
+exports.normalizeDesiredSstDiffV4_17_1 = normalizeDesiredSstDiffV4_17_1;
 exports.assessPulumiRefreshPreview = assessPulumiRefreshPreview;
+exports.requiresIamMutationAnalysis = requiresIamMutationAnalysis;
 exports.standardRemoveProbeForResource = standardRemoveProbeForResource;
 exports.probeStandardRemoveResource = probeStandardRemoveResource;
 exports.observeInfrastructureState = observeInfrastructureState;
+exports.actionRisk = actionRisk;
 exports.validateGovernanceEvidence = validateGovernanceEvidence;
+exports.createLocalPlanApprovalRecord = createLocalPlanApprovalRecord;
+exports.hasUnreviewableLocalPlanBlock = hasUnreviewableLocalPlanBlock;
+exports.createLocalRefreshGovernanceReview = createLocalRefreshGovernanceReview;
+exports.createLocalDeployGovernanceReview = createLocalDeployGovernanceReview;
+exports.authorizeRetainedLocalInfrastructurePlan = authorizeRetainedLocalInfrastructurePlan;
+exports.requiresGovernanceValidation = requiresGovernanceValidation;
+exports.isLocalPlanReviewPending = isLocalPlanReviewPending;
+exports.observeLocalMutationStateIdentity = observeLocalMutationStateIdentity;
+exports.retainLocalRefreshStateBackup = retainLocalRefreshStateBackup;
 exports.runInfrastructurePlanExecutor = runInfrastructurePlanExecutor;
 exports.revalidateInfrastructureMutationAuthorization = revalidateInfrastructureMutationAuthorization;
 exports.recordInfrastructureMutationConvergence = recordInfrastructureMutationConvergence;
@@ -21,8 +40,16 @@ const node_os_1 = require("node:os");
 const devkit_1 = require("@nx/devkit");
 const canonical_json_1 = require("@empire-builder-kit/runtime/canonical-json");
 const index_js_1 = require("../../infrastructure-change/index.js");
+const local_capability_js_1 = require("../../infrastructure-change/local-capability.js");
+const private_state_js_1 = require("../../local-dev/private-state.js");
 const index_js_2 = require("../../repository-policy/index.js");
+const source_authority_js_1 = require("../../release/source-authority.js");
 const run_sst_command_js_1 = require("../sst-lifecycle/run-sst-command.js");
+function isCanonicalDeploymentStage(value) {
+    return (value === 'development' || value === 'staging' || value === 'production');
+}
+const refreshPreviewDiagnosticsByObservation = new WeakMap();
+const refreshMutationPlanMaterialByObservation = new WeakMap();
 function repositoryInfrastructureApprovalMode(context, stage) {
     return stage === 'production'
         ? (0, index_js_2.readRepositoryOperatingPolicy)(context.root).productionApproval.mode
@@ -47,6 +74,99 @@ function projectEvidence(context, projects) {
 const SHA256 = /^[a-f0-9]{64}$/;
 const SOURCE_COMMIT = /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/;
 const MAX_JSON_BYTES = 5 * 1024 * 1024;
+exports.MAX_SST_DIFF_JSON_BYTES = 64 * 1024 * 1024;
+const MAX_BUILD_ARTIFACTS = 512;
+const MAX_BUILD_ARTIFACT_BYTES = 256 * 1024 * 1024;
+const MAX_BUILD_ARTIFACT_TOTAL_BYTES = 4 * 1024 * 1024 * 1024;
+function sameBuildArtifactIdentity(left, right) {
+    return (left.dev === right.dev &&
+        left.ino === right.ino &&
+        left.mode === right.mode &&
+        left.nlink === right.nlink &&
+        left.size === right.size &&
+        left.mtimeMs === right.mtimeMs &&
+        left.ctimeMs === right.ctimeMs);
+}
+/** @internal */
+function collectInfrastructureBuildArtifacts(projectRoot) {
+    const artifactsRoot = (0, node_path_1.join)(projectRoot, '.sst', 'artifacts');
+    const entries = [];
+    let totalBytes = 0;
+    if ((0, node_fs_1.existsSync)(artifactsRoot)) {
+        const rootIdentity = (0, node_fs_1.lstatSync)(artifactsRoot);
+        if (!rootIdentity.isDirectory() || rootIdentity.isSymbolicLink()) {
+            throw new Error('The SST artifact root must be one real directory.');
+        }
+        const children = (0, node_fs_1.readdirSync)(artifactsRoot, { withFileTypes: true }).sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.name, right.name));
+        if (children.length > 4_096) {
+            throw new Error('The SST artifact root exceeds its directory bound.');
+        }
+        for (const child of children) {
+            if (!child.isDirectory())
+                continue;
+            const artifactPath = (0, node_path_1.join)(artifactsRoot, child.name, 'code.zip');
+            if (!(0, node_fs_1.existsSync)(artifactPath))
+                continue;
+            if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/u.test(child.name)) {
+                throw new Error('An SST artifact directory name is invalid.');
+            }
+            if (entries.length === MAX_BUILD_ARTIFACTS) {
+                throw new Error('The SST build artifact count exceeds its bound.');
+            }
+            const lexical = (0, node_fs_1.lstatSync)(artifactPath);
+            if (!lexical.isFile() ||
+                lexical.isSymbolicLink() ||
+                lexical.nlink !== 1) {
+                throw new Error(`SST build artifact ${child.name} has an invalid identity.`);
+            }
+            const descriptor = (0, node_fs_1.openSync)(artifactPath, 'r');
+            try {
+                const before = (0, node_fs_1.fstatSync)(descriptor);
+                if (!before.isFile() ||
+                    before.nlink !== 1 ||
+                    lexical.dev !== before.dev ||
+                    lexical.ino !== before.ino ||
+                    lexical.mode !== before.mode ||
+                    lexical.size !== before.size ||
+                    before.size < 1 ||
+                    before.size > MAX_BUILD_ARTIFACT_BYTES) {
+                    throw new Error(`SST build artifact ${child.name} has an invalid identity.`);
+                }
+                const bytes = (0, node_fs_1.readFileSync)(descriptor);
+                const after = (0, node_fs_1.fstatSync)(descriptor);
+                if (bytes.byteLength !== before.size ||
+                    !sameBuildArtifactIdentity(before, after)) {
+                    throw new Error(`SST build artifact ${child.name} changed while reading.`);
+                }
+                totalBytes += bytes.byteLength;
+                if (totalBytes > MAX_BUILD_ARTIFACT_TOTAL_BYTES) {
+                    throw new Error('The SST build artifact bytes exceed their aggregate bound.');
+                }
+                entries.push({
+                    digest: (0, node_crypto_1.createHash)('sha256').update(bytes).digest('hex'),
+                    path: `.sst/artifacts/${child.name}/code.zip`,
+                    size: bytes.byteLength,
+                });
+            }
+            finally {
+                (0, node_fs_1.closeSync)(descriptor);
+            }
+        }
+    }
+    const unsigned = {
+        entries,
+        kind: 'ebk-infrastructure-build-artifacts',
+        schemaVersion: 1,
+    };
+    return { ...unsigned, digest: digest(canonicalJson(unsigned)) };
+}
+/** @internal */
+function infrastructureConfigurationMetadataDigest(input) {
+    if (!SHA256.test(input.buildArtifactDigest)) {
+        throw new Error('The infrastructure build artifact digest is invalid.');
+    }
+    return digest(canonicalJson(input));
+}
 const STANDARD_REMOVE_CLOUD_CONTROL_TYPES = {
     'aws:acm/certificate:Certificate': 'AWS::CertificateManager::Certificate',
     'aws:apigatewayv2/api:Api': 'AWS::ApiGatewayV2::Api',
@@ -106,6 +226,9 @@ const STANDARD_REMOVE_CLOUD_CONTROL_TYPES = {
     'aws:sfn/stateMachine:StateMachine': 'AWS::StepFunctions::StateMachine',
     'aws:sns/topic:Topic': 'AWS::SNS::Topic',
     'aws:sqs/queue:Queue': 'AWS::SQS::Queue',
+    'aws:wafv2/ipSet:IpSet': 'AWS::WAFv2::IPSet',
+    'aws:wafv2/webAcl:WebAcl': 'AWS::WAFv2::WebACL',
+    'aws:wafv2/webAclLoggingConfiguration:WebAclLoggingConfiguration': 'AWS::WAFv2::LoggingConfiguration',
 };
 function digest(value) {
     return (0, node_crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
@@ -117,6 +240,66 @@ function requiredEnvironment(environment, name, pattern) {
     }
     return value;
 }
+function expectedDeploymentAccount(environment, invocation) {
+    const retained = requiredEnvironment(invocation.environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/);
+    const ambient = environment.AWS_EXPECTED_ACCOUNT_ID?.trim();
+    if (ambient !== undefined && ambient !== '' && ambient !== retained) {
+        throw new Error('Ambient AWS_EXPECTED_ACCOUNT_ID does not match committed deployment topology.');
+    }
+    return retained;
+}
+function matchesExpectedAssumedRoleArn(account, callerArn, expectedRoleArn) {
+    const expected = /^arn:([^:]+):iam::(\d{12}):role\/(.+)$/.exec(expectedRoleArn);
+    const observed = /^arn:([^:]+):sts::(\d{12}):assumed-role\/(.+)\/([^/]+)$/.exec(callerArn);
+    const expectedRoleName = expected?.[3]?.split('/').at(-1);
+    return Boolean(expected &&
+        observed &&
+        expectedRoleName &&
+        expected[1] === observed[1] &&
+        expected[2] === account &&
+        observed[2] === account &&
+        expectedRoleName === observed[3]);
+}
+function localProductionConfirmation(input) {
+    if (!['deploy', 'refresh', 'remove'].includes(input.action) ||
+        !/^\d{12}$/.test(input.accountId) ||
+        !/^[a-z]{2}(?:-gov)?-[a-z]+(?:-[a-z]+)*-\d$/.test(input.region) ||
+        !SOURCE_COMMIT.test(input.sourceCommit)) {
+        throw new Error('Local production confirmation requires one exact action, account, Region, and source commit.');
+    }
+    return [
+        input.action,
+        'production',
+        input.accountId,
+        input.region,
+        input.sourceCommit,
+    ].join(':');
+}
+function revalidateLocalUnlockCallerAuthority(input) {
+    const environment = input.environment ?? process.env;
+    const expectedAccount = expectedDeploymentAccount(environment, input.invocation);
+    const expectedRoleArn = input.invocation.environment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN?.trim();
+    if (!expectedRoleArn) {
+        throw new Error('Local unlock requires one exact expected temporary assumed role.');
+    }
+    const caller = record(runJsonCommand(input.spawn ??
+        node_child_process_1.spawnSync, 'aws', [
+        'sts',
+        'get-caller-identity',
+        '--output',
+        'json',
+        ...(input.profile ? ['--profile', input.profile] : []),
+    ], {
+        cwd: input.invocation.cwd,
+        env: (0, run_sst_command_js_1.createSstChildEnvironment)(environment, input.invocation.environment),
+        label: 'Local unlock AWS caller identity',
+    }), 'Local unlock AWS caller identity');
+    const callerArn = typeof caller['Arn'] === 'string' ? caller['Arn'] : '';
+    if (caller['Account'] !== expectedAccount ||
+        !matchesExpectedAssumedRoleArn(expectedAccount, callerArn, expectedRoleArn)) {
+        throw new Error('Local unlock AWS caller does not match the committed account and exact temporary assumed role.');
+    }
+}
 function parseJson(value, label) {
     if (Buffer.byteLength(value, 'utf8') > MAX_JSON_BYTES) {
         throw new Error(`${label} exceeds the 5 MiB metadata limit.`);
@@ -128,6 +311,17 @@ function parseJson(value, label) {
         throw new Error(`${label} is not valid JSON.`);
     }
 }
+function parseRefreshPreviewJson(value) {
+    if (Buffer.byteLength(value, 'utf8') > exports.MAX_SST_DIFF_JSON_BYTES) {
+        throw new Error('SST refresh preview exceeds the 64 MiB metadata limit.');
+    }
+    try {
+        return JSON.parse(value);
+    }
+    catch {
+        throw new Error('SST refresh preview is not valid JSON.');
+    }
+}
 function record(value, label) {
     if (typeof value !== 'object' || value === null || Array.isArray(value)) {
         throw new Error(`${label} must be one JSON object.`);
@@ -184,6 +378,56 @@ function stringArray(value, label) {
     }
     return [...new Set(value)].sort();
 }
+function adoptedImports(value) {
+    if (!Array.isArray(value) || value.length > 64) {
+        throw new Error('policy.adoptedImports must be one bounded array.');
+    }
+    const imports = value.map((entry, index) => {
+        const candidate = record(entry, `policy.adoptedImports[${String(index)}]`);
+        requireExactKeys(candidate, [
+            'authority',
+            'logicalId',
+            'privateIdentifierTemplate',
+            'recoveryRunbookRef',
+            'removalBehavior',
+            'resourceType',
+        ], `policy.adoptedImports[${String(index)}]`);
+        const logicalId = candidate['logicalId'];
+        const privateIdentifierTemplate = candidate['privateIdentifierTemplate'];
+        const recoveryRunbookRef = candidate['recoveryRunbookRef'];
+        const resourceType = candidate['resourceType'];
+        if (candidate['authority'] !== 'workload-role-account-baseline' ||
+            candidate['removalBehavior'] !== 'retain' ||
+            typeof logicalId !== 'string' ||
+            !/^[A-Za-z][A-Za-z0-9._-]{0,255}$/.test(logicalId) ||
+            typeof resourceType !== 'string' ||
+            !/^[A-Za-z0-9][A-Za-z0-9:._/-]{0,255}$/.test(resourceType) ||
+            typeof privateIdentifierTemplate !== 'string' ||
+            privateIdentifierTemplate.length > 512 ||
+            privateIdentifierTemplate.split('{stage}').length !== 2 ||
+            /[{}]/.test(privateIdentifierTemplate.replace('{stage}', '')) ||
+            typeof recoveryRunbookRef !== 'string' ||
+            recoveryRunbookRef.length > 256 ||
+            recoveryRunbookRef.startsWith('/') ||
+            recoveryRunbookRef.split('/').some((part) => !part || part === '..')) {
+            throw new Error(`policy.adoptedImports[${String(index)}] must bind one exact retained workload-role import and recovery runbook.`);
+        }
+        return {
+            authority: 'workload-role-account-baseline',
+            logicalId,
+            privateIdentifierTemplate,
+            recoveryRunbookRef,
+            removalBehavior: 'retain',
+            resourceType,
+        };
+    });
+    const keys = imports.map(({ logicalId, resourceType }) => `${logicalId}\u0000${resourceType}`);
+    if (new Set(keys).size !== keys.length) {
+        throw new Error('policy.adoptedImports contains a duplicate resource.');
+    }
+    return imports.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType));
+}
 function readJsonFile(path, label) {
     return parseJson((0, node_fs_1.readFileSync)(path, 'utf8'), label);
 }
@@ -224,7 +468,9 @@ function readDescriptor(path, project) {
     }
     return {
         policy: {
+            adoptedImports: adoptedImports(policy.adoptedImports),
             additiveLowRiskTypes: stringArray(policy.additiveLowRiskTypes, 'policy.additiveLowRiskTypes'),
+            additiveReviewedTypes: stringArray(policy.additiveReviewedTypes, 'policy.additiveReviewedTypes'),
             costOrQuotaTypes: stringArray(policy.costOrQuotaTypes, 'policy.costOrQuotaTypes'),
             statefulTypes: stringArray(policy.statefulTypes, 'policy.statefulTypes'),
         },
@@ -242,7 +488,7 @@ function readOptionalArray(environment, name) {
     }
     return value;
 }
-function planAuthorityPolicyDigest(environment) {
+function planAuthorityPolicyDigest(environment, invocation) {
     const parseArray = (name) => {
         const raw = requiredEnvironment(environment, name);
         if (Buffer.byteLength(raw, 'utf8') > 128 * 1024) {
@@ -253,6 +499,38 @@ function planAuthorityPolicyDigest(environment) {
             return value;
         throw new Error(`${name} must contain one non-empty exact JSON array.`);
     };
+    if (environment.EBK_LOCAL_DEPLOYMENT_MODE !== undefined) {
+        if (environment.EBK_LOCAL_DEPLOYMENT_MODE !== 'federated' ||
+            environment.GITHUB_ACTIONS === 'true') {
+            throw new Error('Local infrastructure plan authority requires an admitted federated profile outside GitHub Actions.');
+        }
+        for (const name of [
+            'AWS_PLAN_GENERATED_OBJECT_ARNS_JSON',
+            'AWS_PLAN_GENERATED_PARAMETER_ARNS_JSON',
+            'AWS_PLAN_GENERATED_SECRET_ARNS_JSON',
+            'AWS_PLAN_PROVIDER_REFRESH_POLICY_JSON',
+            'AWS_PLAN_STATE_KMS_KEY_ARN',
+        ]) {
+            if (environment[name] !== undefined) {
+                throw new Error(`Local infrastructure plan authority rejects protected-only input ${name}.`);
+            }
+        }
+        const region = requiredEnvironment(environment, 'AWS_REGION', /^[a-z]{2}(?:-gov)?-[a-z]+-\d$/);
+        const roleArn = requiredEnvironment(environment, 'AWS_PLAN_ROLE_ARN', /^arn:aws:iam::\d{12}:role\/[A-Za-z0-9+=,.@_/-]{1,512}$/);
+        if (invocation.environment.AWS_REGION !== region ||
+            invocation.environment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN !== roleArn) {
+            throw new Error('Local plan authority differs from the exact lifecycle Region or assumed role.');
+        }
+        return digest(canonicalJson({
+            account: requiredEnvironment(environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/),
+            applications: parseArray('AWS_PLAN_SST_APPS_JSON'),
+            mode: 'local-federated',
+            region,
+            roleArn,
+            sourceTree: requiredEnvironment(environment, 'EBK_LOCAL_SOURCE_TREE', /^[a-f0-9]{40}$/),
+            stateBucketArn: requiredEnvironment(environment, 'AWS_PLAN_STATE_BUCKET_ARN', /^arn:aws:s3:::[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$/),
+        }));
+    }
     const providerPolicy = parseArray('AWS_PLAN_PROVIDER_REFRESH_POLICY_JSON');
     if (providerPolicy.some((statement) => typeof statement !== 'object' ||
         statement === null ||
@@ -297,24 +575,70 @@ function releaseCandidateBinding(input) {
     }
     return { digest: digest(raw), path };
 }
+function localSourceCandidateBinding(input) {
+    const policy = (0, index_js_2.readRepositoryOperatingPolicy)(input.context.root);
+    const stage = requiredEnvironment(input.environment, 'EBK_STAGE');
+    if (input.environment.EBK_LOCAL_DEPLOYMENT_MODE !== 'federated' ||
+        input.environment.GITHUB_ACTIONS === 'true' ||
+        !['development', 'staging', 'production'].includes(stage) ||
+        (0, index_js_2.requiresGithubDeployment)(policy.deploymentProfile, stage)) {
+        throw new Error('Local source candidates require a stage admitted by the committed deployment profile.');
+    }
+    const expectedTree = requiredEnvironment(input.environment, 'EBK_LOCAL_SOURCE_TREE', /^[a-f0-9]{40}$/);
+    const status = input.spawn('git', ['status', '--porcelain=v1', '--untracked-files=all'], {
+        cwd: input.context.root,
+        encoding: 'utf8',
+        env: input.environment,
+        maxBuffer: MAX_JSON_BYTES,
+        shell: false,
+    });
+    const tree = input.spawn('git', ['rev-parse', 'HEAD^{tree}'], {
+        cwd: input.context.root,
+        encoding: 'utf8',
+        env: input.environment,
+        maxBuffer: MAX_JSON_BYTES,
+        shell: false,
+    });
+    if (status.status !== 0 ||
+        status.stdout !== '' ||
+        status.stderr !== '' ||
+        tree.status !== 0 ||
+        tree.stdout.trim() !== expectedTree) {
+        throw new Error('Local source candidate differs from the exact clean Git tree.');
+    }
+    const materialSourceTree = input.materialSourceTree ?? expectedTree;
+    if (!SOURCE_COMMIT.test(materialSourceTree)) {
+        throw new Error('Local source candidate material tree must be one exact Git object ID.');
+    }
+    return {
+        digest: digest(canonicalJson({
+            kind: 'ebk-local-source-candidate',
+            project: input.project,
+            schemaVersion: 1,
+            sourceCommit: input.sourceCommit,
+            sourceTree: materialSourceTree,
+        })),
+    };
+}
 /** @internal */
 function approvalCandidateSourceCommit(context, options, environment) {
     const project = context.projectName;
-    const selectedSource = environment['EBK_RELEASE_SOURCE_COMMIT']?.trim();
-    if (selectedSource !== undefined && !SOURCE_COMMIT.test(selectedSource)) {
+    const workflowSelectedSource = environment['EBK_RELEASE_SOURCE_COMMIT']?.trim();
+    if (workflowSelectedSource !== undefined &&
+        !SOURCE_COMMIT.test(workflowSelectedSource)) {
         throw new Error('EBK_RELEASE_SOURCE_COMMIT must be one exact Git object ID when set.');
     }
     if (!project)
-        return selectedSource;
+        return workflowSelectedSource;
     const approvalPath = relativeFile(context.root, options.approvalPath ?? 'operations/infrastructure-approval.json');
     if (!(0, node_fs_1.existsSync)(approvalPath))
-        return selectedSource;
+        return workflowSelectedSource;
     let batch;
     try {
         batch = record(readJsonFile(approvalPath, 'Infrastructure approval candidate binding'), 'Infrastructure approval candidate binding');
     }
     catch {
-        return selectedSource;
+        return workflowSelectedSource;
     }
     const action = options.action ?? 'deploy';
     const stage = options.stage?.trim();
@@ -323,7 +647,7 @@ function approvalCandidateSourceCommit(context, options, environment) {
         batch['action'] !== action ||
         stage === undefined ||
         batch['stage'] !== stage) {
-        return selectedSource;
+        return workflowSelectedSource;
     }
     let approvedSource;
     try {
@@ -333,16 +657,40 @@ function approvalCandidateSourceCommit(context, options, environment) {
         approvedSource = planned['sourceCommit'];
     }
     catch {
-        return selectedSource;
+        return workflowSelectedSource;
     }
     if (typeof approvedSource !== 'string' ||
         !SOURCE_COMMIT.test(approvedSource)) {
-        return selectedSource;
+        return workflowSelectedSource;
     }
-    if (selectedSource === undefined) {
+    const localAuthority = environment['EBK_LOCAL_DEPLOYMENT_MODE'] === 'federated';
+    const localSelectedSource = localAuthority
+        ? environment['EBK_SOURCE_COMMIT']?.trim()
+        : undefined;
+    if (localSelectedSource !== undefined &&
+        !SOURCE_COMMIT.test(localSelectedSource)) {
+        throw new Error('EBK_SOURCE_COMMIT must be one exact Git object ID for local approval resume.');
+    }
+    if (localAuthority && localSelectedSource === undefined) {
+        throw new Error('Local approval-resume infrastructure planning requires the exact clean local source.');
+    }
+    if (!localAuthority && workflowSelectedSource === undefined) {
         throw new Error('Approval-resume infrastructure planning requires a workflow-selected release source.');
     }
-    if (selectedSource !== undefined && selectedSource !== approvedSource) {
+    if (localAuthority) {
+        try {
+            (0, source_authority_js_1.validateReviewedReleaseCheckout)({
+                deploymentSourceCommit: localSelectedSource,
+                releaseSourceCommit: approvedSource,
+                repositoryRoot: context.root,
+                reviewedSourceCommit: localSelectedSource,
+            });
+        }
+        catch {
+            throw new Error('Infrastructure approval candidate is not the exact clean local approval-only descendant.');
+        }
+    }
+    else if (workflowSelectedSource !== approvedSource) {
         throw new Error('Infrastructure approval candidate differs from the workflow-selected release source.');
     }
     return approvedSource;
@@ -352,10 +700,23 @@ function createCandidateBoundSstChildEnvironment(environment, invocationEnvironm
     if (!SOURCE_COMMIT.test(candidateSourceCommit)) {
         throw new Error('Infrastructure lifecycle candidate must be one exact Git object ID.');
     }
-    return {
+    const childEnvironment = {
         ...(0, run_sst_command_js_1.createSstChildEnvironment)(environment, invocationEnvironment),
         EBK_RELEASE_SOURCE_COMMIT: candidateSourceCommit,
     };
+    // These values authorize the retained plan after SST has produced it. They
+    // are not desired infrastructure inputs and must never enter SST's program
+    // environment, where components such as Nextjs can persist the ambient
+    // process environment in a command resource. Keeping them outside the SST
+    // child makes the unapproved and approved previews materially identical.
+    for (const name of [
+        'EBK_LOCAL_PLAN_APPROVER_ARN',
+        'EBK_LOCAL_PLAN_MATERIAL_DIGEST',
+        'EBK_LOCAL_PLAN_SUMMARY_DIGEST',
+    ]) {
+        delete childEnvironment[name];
+    }
+    return childEnvironment;
 }
 function frameworkAndBlueprintVersions(workspaceRoot, projectRoot) {
     const workspacePackage = record(readJsonFile((0, node_path_1.join)(workspaceRoot, 'package.json'), 'Workspace package'), 'Workspace package');
@@ -461,15 +822,26 @@ function defaultSpawn(executable, args, options) {
 function canonicalJson(value) {
     return (0, canonical_json_1.canonicalJson)(value, { omitUndefinedObjectValues: true });
 }
-function stateResources(value) {
+function stateExport(value) {
     const root = record(value, 'SST state export');
+    const sstCheckpoint = typeof root['latest'] === 'object' && root['latest'] !== null;
     const deployment = typeof root['deployment'] === 'object' && root['deployment'] !== null
         ? record(root['deployment'], 'SST state deployment')
-        : root;
+        : sstCheckpoint
+            ? record(root['latest'], 'SST state checkpoint')
+            : root;
     if (!Array.isArray(deployment['resources'])) {
         throw new Error('SST state export does not contain a Pulumi deployment resource list.');
     }
-    return deployment['resources'].map((resource, index) => record(resource, `SST state resource ${index}`));
+    if (sstCheckpoint &&
+        (typeof root['stack'] !== 'string' ||
+            !/^[^/]+\/[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?\/(development|staging|production)$/.test(root['stack']))) {
+        throw new Error('SST state checkpoint stack identity is malformed.');
+    }
+    return {
+        resources: deployment['resources'].map((resource, index) => record(resource, `SST state resource ${index}`)),
+        ...(sstCheckpoint ? { sstStack: root['stack'] } : {}),
+    };
 }
 function stringRecord(value) {
     if (typeof value !== 'object' ||
@@ -619,7 +991,21 @@ function removePhysicalSelector(resource) {
     return undefined;
 }
 function expectedTags(resource) {
-    for (const material of [resource.inputs, resource.outputs]) {
+    // The AWS provider records the complete effective tag authority in tagsAll.
+    // Resource-local tags omit provider default tags, so comparing those bytes to
+    // AWS's complete observed tag set would permanently classify every
+    // default-tagged resource as drifted.
+    const materialAuthority = resource.external === true
+        ? [resource.outputs, resource.inputs]
+        : [resource.inputs, resource.outputs];
+    for (const material of materialAuthority) {
+        if (typeof material !== 'object' || material === null)
+            continue;
+        const tags = stringRecord(material['tagsAll']);
+        if (tags)
+            return tags;
+    }
+    for (const material of materialAuthority) {
         if (typeof material !== 'object' || material === null)
             continue;
         const tags = stringRecord(material['tags']);
@@ -647,8 +1033,473 @@ const PULUMI_REFRESH_PREVIEW_VERSION = '3.215.0';
 const REFRESH_PREVIEW_PROPERTY_OVERLAYS = {
     'aws:secretsmanager/secretVersion:SecretVersion': ['inputs.secretString'],
 };
+function observeSecretsManagerVersion(input) {
+    const urn = typeof input.resource.urn === 'string' ? input.resource.urn : 'unknown';
+    const inputs = record(input.resource.inputs, `${urn} inputs`);
+    const outputs = record(input.resource.outputs, `${urn} outputs`);
+    const secretId = outputs['secretId'];
+    const versionId = outputs['versionId'];
+    const expectedStages = outputs['versionStages'];
+    const resourceId = input.resource.id;
+    const expectedArn = new RegExp(`^arn:(?:aws|aws-us-gov|aws-cn):secretsmanager:${input.region}:${input.account}:secret:[^\\s]+$`);
+    if (typeof secretId !== 'string' ||
+        secretId.length > 2_048 ||
+        hasControlCharacters(secretId) ||
+        !expectedArn.test(secretId) ||
+        typeof versionId !== 'string' ||
+        versionId.length > 256 ||
+        hasControlCharacters(versionId) ||
+        inputs['secretId'] !== secretId ||
+        resourceId !== `${secretId}|${versionId}` ||
+        !Array.isArray(expectedStages) ||
+        expectedStages.length === 0 ||
+        expectedStages.length > 20 ||
+        expectedStages.some((stage) => typeof stage !== 'string' ||
+            stage.length === 0 ||
+            stage.length > 256 ||
+            hasControlCharacters(stage)) ||
+        new Set(expectedStages).size !== expectedStages.length) {
+        throw new Error('Secrets Manager version state does not expose one exact account-, Region-, and stage-bound identity.');
+    }
+    const normalizedExpectedStages = [...expectedStages].sort(deterministic_order_js_1.compareUtf16);
+    const listed = record(runJsonCommand(input.spawn, 'aws', [
+        'secretsmanager',
+        'list-secret-version-ids',
+        '--secret-id',
+        secretId,
+        '--include-deprecated',
+        '--max-results',
+        '100',
+        '--output',
+        'json',
+    ], {
+        cwd: input.invocation.cwd,
+        env: input.childEnvironment,
+        label: 'AWS Secrets Manager version-stage observation',
+    }), 'AWS Secrets Manager version-stage observation');
+    if (listed['NextToken'] !== undefined) {
+        throw new Error('AWS Secrets Manager version-stage observation exceeds its bounded inventory.');
+    }
+    const versions = listed['Versions'];
+    if (!Array.isArray(versions) || versions.length > 100) {
+        throw new Error('AWS Secrets Manager version-stage observation is malformed or unbounded.');
+    }
+    const observed = new Map();
+    for (const [index, value] of versions.entries()) {
+        const version = record(value, `AWS Secrets Manager version-stage observation Versions[${String(index)}]`);
+        const observedVersionId = version['VersionId'];
+        const observedStages = version['VersionStages'] ?? [];
+        if (typeof observedVersionId !== 'string' ||
+            observedVersionId.length === 0 ||
+            observedVersionId.length > 256 ||
+            hasControlCharacters(observedVersionId) ||
+            !Array.isArray(observedStages) ||
+            observedStages.length > 20 ||
+            observedStages.some((stage) => typeof stage !== 'string' ||
+                stage.length === 0 ||
+                stage.length > 256 ||
+                hasControlCharacters(stage)) ||
+            new Set(observedStages).size !== observedStages.length ||
+            observed.has(observedVersionId)) {
+            throw new Error('AWS Secrets Manager version-stage observation contains an ambiguous version identity.');
+        }
+        observed.set(observedVersionId, [...observedStages].sort(deterministic_order_js_1.compareUtf16));
+    }
+    const observedStages = observed.get(versionId);
+    return {
+        arnDigest: digest(secretId),
+        drifted: observedStages === undefined ||
+            canonicalJson(observedStages) !== canonicalJson(normalizedExpectedStages),
+        observedIdentityDigest: observedStages === undefined
+            ? null
+            : digest(canonicalJson({
+                secretId,
+                versionId,
+                versionStages: observedStages,
+            })),
+        urn,
+    };
+}
 function normalizedDiffMaterial(diff) {
-    return diff.resources.map((resource) => Object.fromEntries(Object.entries(resource).filter(([key]) => key !== 'sourceIndex')));
+    return (0, index_js_1.materialNormalizedSstDiffResources)(diff);
+}
+const REFRESH_STATE_PROVIDER_OPERATIONS = new Set([
+    'discard',
+    'discard-replaced',
+    'read',
+    'read-replacement',
+]);
+function withoutRefreshStateResources(diff) {
+    return {
+        ...diff,
+        resources: diff.resources.filter(({ providerOperation }) => !REFRESH_STATE_PROVIDER_OPERATIONS.has(providerOperation)),
+    };
+}
+const MAX_REFRESH_DIAGNOSTIC_RESOURCES = 512;
+const MAX_REFRESH_DIAGNOSTIC_PATHS_PER_RESOURCE = 128;
+const MAX_REFRESH_DIAGNOSTIC_DEPTH = 32;
+function isExactInertSameEntry(recordEntry) {
+    if (recordEntry['op'] !== 'same')
+        return false;
+    const urn = recordEntry['urn'];
+    const resourceType = recordEntry['type'];
+    const detailedDiff = recordEntry['detailedDiff'];
+    const diffs = recordEntry['diffs'];
+    const keys = recordEntry['keys'];
+    const hasOld = Object.prototype.hasOwnProperty.call(recordEntry, 'old');
+    const hasNew = Object.prototype.hasOwnProperty.call(recordEntry, 'new');
+    const isEmptyRecord = typeof detailedDiff === 'object' &&
+        detailedDiff !== null &&
+        !Array.isArray(detailedDiff) &&
+        Object.keys(detailedDiff).length === 0;
+    return (typeof urn === 'string' &&
+        urn.length > 0 &&
+        typeof resourceType === 'string' &&
+        resourceType.length > 0 &&
+        (detailedDiff === undefined || detailedDiff === null || isEmptyRecord) &&
+        (diffs === undefined || (Array.isArray(diffs) && diffs.length === 0)) &&
+        (keys === undefined || (Array.isArray(keys) && keys.length === 0)) &&
+        hasOld === hasNew &&
+        (!hasOld ||
+            canonicalJson(recordEntry['old']) === canonicalJson(recordEntry['new'])));
+}
+/** @internal */
+function normalizeDesiredSstDiffV4_17_1(input) {
+    let raw = input.stdout;
+    if (typeof raw === 'string') {
+        try {
+            raw = JSON.parse(raw);
+        }
+        catch {
+            return (0, index_js_1.normalizeSstDiffV4_17_1)(input);
+        }
+    }
+    const desired = Array.isArray(raw)
+        ? raw.filter((entry) => !(typeof entry === 'object' &&
+            entry !== null &&
+            !Array.isArray(entry) &&
+            isExactInertSameEntry(entry)))
+        : raw;
+    return (0, index_js_1.normalizeSstDiffV4_17_1)({ ...input, stdout: desired });
+}
+function jsonPointerSegment(value) {
+    return value.replace(/~/g, '~0').replace(/\//g, '~1');
+}
+function changedJsonPointerPaths(left, right) {
+    const paths = [];
+    const visit = (previous, current, path, depth) => {
+        if (paths.length >= MAX_REFRESH_DIAGNOSTIC_PATHS_PER_RESOURCE)
+            return;
+        if (previous === undefined || current === undefined) {
+            if (previous !== current)
+                paths.push(path || '/');
+            return;
+        }
+        if (canonicalJson(previous) === canonicalJson(current)) {
+            return;
+        }
+        const previousRecord = typeof previous === 'object' &&
+            previous !== null &&
+            !Array.isArray(previous)
+            ? previous
+            : undefined;
+        const currentRecord = typeof current === 'object' && current !== null && !Array.isArray(current)
+            ? current
+            : undefined;
+        if (depth >= MAX_REFRESH_DIAGNOSTIC_DEPTH ||
+            previousRecord === undefined ||
+            currentRecord === undefined) {
+            paths.push(path || '/');
+            return;
+        }
+        for (const key of [
+            ...new Set([
+                ...Object.keys(previousRecord),
+                ...Object.keys(currentRecord),
+            ]),
+        ].sort(deterministic_order_js_1.compareUtf16)) {
+            if (paths.length >= MAX_REFRESH_DIAGNOSTIC_PATHS_PER_RESOURCE)
+                break;
+            visit(previousRecord[key], currentRecord[key], `${path}/${jsonPointerSegment(key)}`, depth + 1);
+        }
+    };
+    visit(left, right, '', 0);
+    return paths;
+}
+const EXTERNAL_LOOKUP_NAME_TYPES = new Set([
+    'aws:cloudwatch/eventBus:EventBus',
+    'aws:ecs/cluster:Cluster',
+    'aws:iam/role:Role',
+]);
+const EXTERNAL_LOOKUP_TAG_NAME_TYPES = new Set([
+    'aws:ec2/eip:Eip',
+    'aws:ec2/instance:Instance',
+    'aws:ec2/internetGateway:InternetGateway',
+    'aws:ec2/natGateway:NatGateway',
+    'aws:ec2/routeTable:RouteTable',
+    'aws:ec2/securityGroup:SecurityGroup',
+    'aws:ec2/subnet:Subnet',
+    'aws:ec2/vpc:Vpc',
+]);
+function exactRecord(value) {
+    return typeof value === 'object' && value !== null && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function exactStringAt(value, ...path) {
+    let current = value;
+    for (const segment of path) {
+        const currentRecord = exactRecord(current);
+        if (!currentRecord)
+            return undefined;
+        current = currentRecord[segment];
+    }
+    return typeof current === 'string' && current.length > 0
+        ? current
+        : undefined;
+}
+function escapedRegularExpression(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+const SST_PRETTY_NAME_SUFFIX = /^[abcdefhkmnorstuvwxz]{8}$/u;
+function exactSstPhysicalName(maxLength, project, stack, logicalId, candidate) {
+    // Pinned SST 4.17.1's physicalName(max, name) reserves nine characters for
+    // `-<pretty suffix>`, strips non-alphanumeric logical-name characters, and
+    // selects one of name, stage+name, or app+stage+name before truncation. Long
+    // external IAM role reads therefore do not use the simple full prefix below.
+    const mainLength = maxLength - 9;
+    const name = logicalId.replace(/[^a-zA-Z0-9]/gu, '');
+    if (mainLength <= 0 || name.length === 0 || candidate.length > maxLength) {
+        return false;
+    }
+    let expectedMain;
+    if (name.length + 1 >= mainLength) {
+        expectedMain = name.substring(0, mainLength);
+    }
+    else if (name.length + stack.length + 2 >= mainLength) {
+        expectedMain = `${stack.substring(0, mainLength - name.length - 1)}-${name}`;
+    }
+    else {
+        expectedMain = `${project.substring(0, mainLength - stack.length - name.length - 2)}-${stack}-${name}`;
+    }
+    return (candidate.length === expectedMain.length + 9 &&
+        candidate.startsWith(`${expectedMain}-`) &&
+        SST_PRETTY_NAME_SUFFIX.test(candidate.slice(-8)));
+}
+function exactOwnPropertyAbsent(value, ...path) {
+    const property = path.at(-1);
+    if (!property)
+        return false;
+    let current = value;
+    for (const segment of path.slice(0, -1)) {
+        const currentRecord = exactRecord(current);
+        if (!currentRecord)
+            return false;
+        current = currentRecord[segment];
+    }
+    const parent = exactRecord(current);
+    return Boolean(parent && !Object.prototype.hasOwnProperty.call(parent, property));
+}
+function exactExternalLookupNormalization(input) {
+    // Pulumi `Resource.get` records stack-local auto-names in input state even
+    // though the provider read is bound to a different exact physical ID. The
+    // provider hydrates that one input from the observed resource on every
+    // refresh, so treating it as owned-resource drift permanently wedges a
+    // consumer of pre-provisioned roles or Foundation discovery resources. This
+    // exception is intentionally limited to external resources, exact Pulumi
+    // auto-name shapes, one known input path, and an unchanged output/identity
+    // whose observed value corroborates the hydrated input.
+    const urn = input.entry['urn'];
+    const resourceType = input.entry['type'];
+    if (typeof urn !== 'string' ||
+        typeof resourceType !== 'string' ||
+        input.resource?.external !== true ||
+        input.resource.urn !== urn ||
+        input.resource.type !== resourceType) {
+        return undefined;
+    }
+    const urnParts = urn.split('::');
+    const stack = urnParts[0]?.replace(/^urn:pulumi:/u, '');
+    const project = urnParts[1];
+    const logicalId = urnParts[3];
+    if (urnParts.length !== 4 ||
+        !stack ||
+        !project ||
+        !logicalId ||
+        !/^[a-z0-9](?:[a-z0-9-]{0,62}[a-z0-9])?$/u.test(stack) ||
+        !/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/u.test(project) ||
+        !/^[A-Za-z0-9][A-Za-z0-9._-]{0,255}$/u.test(logicalId)) {
+        return undefined;
+    }
+    const oldValue = input.entry['old'];
+    const newValue = input.entry['new'];
+    const oldRecord = exactRecord(oldValue);
+    const newRecord = exactRecord(newValue);
+    const oldInputs = exactRecord(oldRecord?.['inputs']);
+    const oldOutputs = exactRecord(oldRecord?.['outputs']);
+    const retainedInputs = exactRecord(input.resource.inputs);
+    const retainedOutputs = exactRecord(input.resource.outputs);
+    if (!oldRecord ||
+        !newRecord ||
+        !oldInputs ||
+        !oldOutputs ||
+        !retainedInputs ||
+        !retainedOutputs ||
+        canonicalJson(oldInputs) !== canonicalJson(retainedInputs) ||
+        canonicalJson(oldOutputs) !== canonicalJson(retainedOutputs) ||
+        (oldRecord['id'] !== undefined && oldRecord['id'] !== input.resource.id) ||
+        (newRecord['id'] !== undefined &&
+            oldRecord['id'] !== undefined &&
+            newRecord['id'] !== oldRecord['id'])) {
+        return undefined;
+    }
+    const onlyPath = input.changedPropertyPaths.length === 1
+        ? input.changedPropertyPaths[0]
+        : undefined;
+    const expectedPrefix = `${project}-${stack}-${logicalId}`;
+    if (onlyPath === '/inputs/name' &&
+        EXTERNAL_LOOKUP_NAME_TYPES.has(resourceType)) {
+        const oldName = exactStringAt(oldRecord, 'inputs', 'name');
+        const newName = exactStringAt(newRecord, 'inputs', 'name');
+        const observedName = exactStringAt(newRecord, 'outputs', 'name');
+        const retainedObservedName = exactStringAt(input.resource.outputs, 'name');
+        if (oldName &&
+            newName &&
+            observedName &&
+            retainedObservedName === observedName &&
+            newName === observedName &&
+            oldName !== newName &&
+            (resourceType === 'aws:iam/role:Role'
+                ? exactSstPhysicalName(64, project, stack, logicalId, oldName)
+                : new RegExp(`^${escapedRegularExpression(expectedPrefix)}-[abcdefhkmnorstuvwxz]{8}$`, 'u').test(oldName))) {
+            return { changedPropertyPath: onlyPath, logicalId, resourceType };
+        }
+    }
+    if (onlyPath === '/inputs/tags/Name' &&
+        EXTERNAL_LOOKUP_TAG_NAME_TYPES.has(resourceType)) {
+        const oldName = exactStringAt(oldRecord, 'inputs', 'tags', 'Name');
+        const newName = exactStringAt(newRecord, 'inputs', 'tags', 'Name');
+        const observedName = exactStringAt(newRecord, 'outputs', 'tagsAll', 'Name') ??
+            exactStringAt(newRecord, 'outputs', 'tags', 'Name');
+        const retainedObservedName = exactStringAt(input.resource.outputs, 'tagsAll', 'Name') ??
+            exactStringAt(input.resource.outputs, 'tags', 'Name');
+        if (oldName === expectedPrefix &&
+            newName &&
+            observedName &&
+            retainedObservedName === observedName &&
+            newName === observedName &&
+            oldName !== newName) {
+            return { changedPropertyPath: onlyPath, logicalId, resourceType };
+        }
+        if (resourceType === 'aws:ec2/securityGroup:SecurityGroup' &&
+            oldName === expectedPrefix &&
+            exactOwnPropertyAbsent(newRecord, 'inputs', 'tags', 'Name') &&
+            exactOwnPropertyAbsent(newRecord, 'outputs', 'tags', 'Name') &&
+            exactOwnPropertyAbsent(newRecord, 'outputs', 'tagsAll', 'Name') &&
+            exactOwnPropertyAbsent(input.resource.outputs, 'tags', 'Name') &&
+            exactOwnPropertyAbsent(input.resource.outputs, 'tagsAll', 'Name')) {
+            return { changedPropertyPath: onlyPath, logicalId, resourceType };
+        }
+    }
+    return undefined;
+}
+const EXTERNAL_FRAMEWORK_TAG_OBSERVATION_PATHS = new Set([
+    '/inputs/name',
+    '/inputs/tags/Name',
+    '/outputs/tags/ebk:framework-version',
+    '/outputs/tagsAll/ebk:framework-version',
+]);
+function externalProviderReadLogicalId(resourceType, physicalId) {
+    // This is the secret-free identity projection used by
+    // infrastructure-change/normalize.ts for Pulumi provider reads. Keeping the
+    // correlation on that projection lets the refresh observer prove that an
+    // external-state observation is also present in the ordinary desired plan
+    // without retaining its physical ID.
+    return `external-${(0, node_crypto_1.createHash)('sha256')
+        .update(resourceType)
+        .update('\0')
+        .update(physicalId)
+        .digest('hex')
+        .slice(0, 24)}`;
+}
+function exactExternalFrameworkTagObservation(input) {
+    // A downstream stack records Resource.get state for Foundation resources.
+    // After Foundation advances its framework-version tag, Pulumi reports that
+    // external observation during Billing's refresh phase even though Billing's
+    // ordinary desired phase already classifies the same physical identity as a
+    // non-mutating provider read. Exclude only that exact metadata transition:
+    // retained external identity, one matching ordinary read, both framework
+    // tag projections changing together, and at most SST's already-bounded
+    // name hydration. Any other provider observation remains drift.
+    const urn = input.entry['urn'];
+    const resourceType = input.entry['type'];
+    if (typeof urn !== 'string' ||
+        typeof resourceType !== 'string' ||
+        input.resource?.external !== true ||
+        input.resource.urn !== urn ||
+        input.resource.type !== resourceType ||
+        input.changedPropertyPaths.length === 0 ||
+        input.changedPropertyPaths.length >=
+            MAX_REFRESH_DIAGNOSTIC_PATHS_PER_RESOURCE ||
+        input.changedPropertyPaths.some((path) => !EXTERNAL_FRAMEWORK_TAG_OBSERVATION_PATHS.has(path)) ||
+        !input.changedPropertyPaths.includes('/outputs/tags/ebk:framework-version') ||
+        !input.changedPropertyPaths.includes('/outputs/tagsAll/ebk:framework-version')) {
+        return undefined;
+    }
+    const inputPaths = input.changedPropertyPaths.filter((path) => path.startsWith('/inputs/'));
+    if (inputPaths.length > 1)
+        return undefined;
+    const oldRecord = exactRecord(input.entry['old']);
+    const newRecord = exactRecord(input.entry['new']);
+    const oldInputs = exactRecord(oldRecord?.['inputs']);
+    const oldOutputs = exactRecord(oldRecord?.['outputs']);
+    const retainedInputs = exactRecord(input.resource.inputs);
+    const retainedOutputs = exactRecord(input.resource.outputs);
+    const physicalId = input.resource.id;
+    if (!oldRecord ||
+        !newRecord ||
+        !oldInputs ||
+        !oldOutputs ||
+        !retainedInputs ||
+        !retainedOutputs ||
+        typeof physicalId !== 'string' ||
+        physicalId.length === 0 ||
+        canonicalJson(oldInputs) !== canonicalJson(retainedInputs) ||
+        canonicalJson(oldOutputs) !== canonicalJson(retainedOutputs) ||
+        (oldRecord['id'] !== undefined && oldRecord['id'] !== physicalId) ||
+        (newRecord['id'] !== undefined && newRecord['id'] !== physicalId)) {
+        return undefined;
+    }
+    const oldFrameworkVersion = exactStringAt(oldRecord, 'outputs', 'tagsAll', 'ebk:framework-version');
+    const oldFrameworkVersionTag = exactStringAt(oldRecord, 'outputs', 'tags', 'ebk:framework-version');
+    const newFrameworkVersion = exactStringAt(newRecord, 'outputs', 'tagsAll', 'ebk:framework-version');
+    const newFrameworkVersionTag = exactStringAt(newRecord, 'outputs', 'tags', 'ebk:framework-version');
+    if (!oldFrameworkVersion ||
+        oldFrameworkVersionTag !== oldFrameworkVersion ||
+        !newFrameworkVersion ||
+        newFrameworkVersionTag !== newFrameworkVersion ||
+        oldFrameworkVersion === newFrameworkVersion) {
+        return undefined;
+    }
+    if (inputPaths.length === 1 &&
+        !exactExternalLookupNormalization({
+            changedPropertyPaths: inputPaths,
+            entry: input.entry,
+            resource: input.resource,
+        })) {
+        return undefined;
+    }
+    const providerReadLogicalId = externalProviderReadLogicalId(resourceType, physicalId);
+    const providerReadKey = `${resourceType}\0${providerReadLogicalId}`;
+    if ((input.ordinaryProviderReadCounts.get(providerReadKey) ?? 0) < 1) {
+        return undefined;
+    }
+    return {
+        changedPropertyPaths: [...input.changedPropertyPaths],
+        logicalId: urn.split('::').at(-1) ?? '',
+        providerReadLogicalId,
+        resourceType,
+    };
 }
 function assessPulumiRefreshPreview(input) {
     const sstPath = input.invocation.args[0];
@@ -660,14 +1511,14 @@ function assessPulumiRefreshPreview(input) {
         env: {
             ...input.childEnvironment,
             PULUMI_OPTION_REFRESH: 'true',
-            PULUMI_OPTION_RUN_PROGRAM: 'true',
+            PULUMI_OPTION_RUN_PROGRAM: 'false',
         },
-        maxBuffer: 20 * 1024 * 1024,
+        maxBuffer: exports.MAX_SST_DIFF_JSON_BYTES,
         shell: false,
     });
     let raw;
     try {
-        raw = parseJson(result.stdout, 'SST refresh preview');
+        raw = parseRefreshPreviewJson(result.stdout);
     }
     catch {
         raw = null;
@@ -675,7 +1526,26 @@ function assessPulumiRefreshPreview(input) {
     const entries = Array.isArray(raw) ? raw : [];
     const refreshEntries = [];
     const desiredEntries = [];
-    let shapeComplete = Array.isArray(raw);
+    const diagnosticResources = [];
+    const externalFrameworkTagObservations = [];
+    const externalLookupNormalizations = [];
+    const ordinaryProviderReadCounts = new Map();
+    for (const resource of input.ordinaryDiff.resources) {
+        if (resource.operation !== 'read' ||
+            resource.providerOperation !== 'read' ||
+            resource.replacement ||
+            resource.changedProperties.length > 0) {
+            continue;
+        }
+        const key = `${resource.resourceType}\0${resource.logicalId}`;
+        ordinaryProviderReadCounts.set(key, (ordinaryProviderReadCounts.get(key) ?? 0) + 1);
+    }
+    const externalResources = (input.stateResources ?? []).filter((resource) => resource.external === true && typeof resource.urn === 'string');
+    const externalResourcesByUrn = new Map(externalResources.map((resource) => [resource.urn, resource]));
+    let shapeComplete = Array.isArray(raw) &&
+        externalResourcesByUrn.size === externalResources.length;
+    let inertSameCount = 0;
+    let rejectedSameCount = 0;
     const observedRefreshUrns = new Set();
     for (const entry of entries) {
         if (typeof entry !== 'object' || entry === null || Array.isArray(entry)) {
@@ -700,72 +1570,334 @@ function assessPulumiRefreshPreview(input) {
                 !Array.isArray(detailedDiff) &&
                 Object.keys(detailedDiff).length > 0;
             const hasDiffs = Array.isArray(diffs) && diffs.length > 0;
+            const changedPropertyPaths = [
+                ...(hasOld && hasNew
+                    ? changedJsonPointerPaths(recordEntry['old'], recordEntry['new'])
+                    : []),
+                ...(hasDetailedDiff
+                    ? Object.keys(detailedDiff).map((path) => `/providerDetailedDiff/${jsonPointerSegment(path)}`)
+                    : []),
+                ...(hasDiffs
+                    ? diffs
+                        .filter((path) => typeof path === 'string')
+                        .map((path) => `/providerDiffs/${jsonPointerSegment(path)}`)
+                    : []),
+            ];
+            const boundedChangedPropertyPaths = [...new Set(changedPropertyPaths)]
+                .sort(deterministic_order_js_1.compareUtf16)
+                .slice(0, MAX_REFRESH_DIAGNOSTIC_PATHS_PER_RESOURCE);
+            const externalLookupNormalization = !hasDetailedDiff && !hasDiffs
+                ? exactExternalLookupNormalization({
+                    changedPropertyPaths: [...new Set(changedPropertyPaths)].sort(deterministic_order_js_1.compareUtf16),
+                    entry: recordEntry,
+                    resource: typeof urn === 'string'
+                        ? externalResourcesByUrn.get(urn)
+                        : undefined,
+                })
+                : undefined;
+            const externalFrameworkTagObservation = input.action === 'deploy' && !hasDetailedDiff && !hasDiffs
+                ? exactExternalFrameworkTagObservation({
+                    changedPropertyPaths: [...new Set(changedPropertyPaths)].sort(deterministic_order_js_1.compareUtf16),
+                    entry: recordEntry,
+                    ordinaryProviderReadCounts,
+                    resource: typeof urn === 'string'
+                        ? externalResourcesByUrn.get(urn)
+                        : undefined,
+                })
+                : undefined;
             if (hasNew && recordEntry['new'] === null) {
                 refreshEntries.push({ ...recordEntry, op: 'delete' });
             }
+            else if (hasOld &&
+                hasNew &&
+                canonicalJson(recordEntry['old']) === canonicalJson(recordEntry['new'])) {
+                // The refresh old/new pair is Pulumi's recorded-versus-observed cloud
+                // authority. A refresh-preview event can also inherit detailedDiff and
+                // diffs metadata from the ordinary desired-source phase (for example,
+                // a candidate tag update). Identical canonical old/new material proves
+                // the provider read itself observed no change; desired changes remain
+                // independently bound by the preceding ordinary preview.
+                continue;
+            }
+            else if (externalLookupNormalization) {
+                if (externalLookupNormalizations.length >=
+                    MAX_REFRESH_DIAGNOSTIC_RESOURCES) {
+                    shapeComplete = false;
+                }
+                else {
+                    externalLookupNormalizations.push(externalLookupNormalization);
+                }
+                continue;
+            }
+            else if (externalFrameworkTagObservation) {
+                if (externalFrameworkTagObservations.length >=
+                    MAX_REFRESH_DIAGNOSTIC_RESOURCES) {
+                    shapeComplete = false;
+                }
+                else {
+                    externalFrameworkTagObservations.push(externalFrameworkTagObservation);
+                    const key = `${externalFrameworkTagObservation.resourceType}\0${externalFrameworkTagObservation.providerReadLogicalId}`;
+                    ordinaryProviderReadCounts.set(key, (ordinaryProviderReadCounts.get(key) ?? 1) - 1);
+                }
+                continue;
+            }
             else if (hasDetailedDiff ||
                 hasDiffs ||
                 (hasOld &&
                     hasNew &&
                     canonicalJson(recordEntry['old']) !==
                         canonicalJson(recordEntry['new']))) {
-                refreshEntries.push({ ...recordEntry, op: 'update' });
-            }
-            else if (hasOld &&
-                hasNew &&
-                canonicalJson(recordEntry['old']) === canonicalJson(recordEntry['new'])) {
-                // Refresh events with identical old/new material are provider reads,
-                // not drift. SST filters Pulumi "same" steps, so this is the explicit
-                // no-change refresh shape.
-                continue;
+                refreshEntries.push({
+                    ...recordEntry,
+                    detailedDiff: Object.fromEntries(boundedChangedPropertyPaths.map((path) => [
+                        path,
+                        {
+                            diffKind: 'update',
+                            inputDiff: path.startsWith('/inputs/'),
+                        },
+                    ])),
+                    op: 'update',
+                });
             }
             else {
                 shapeComplete = false;
             }
+            if (refreshEntries.length > diagnosticResources.length &&
+                diagnosticResources.length < MAX_REFRESH_DIAGNOSTIC_RESOURCES) {
+                diagnosticResources.push({
+                    changeBasis: [
+                        ...(hasDetailedDiff ? ['detailedDiff'] : []),
+                        ...(hasDiffs ? ['diffs'] : []),
+                        ...(hasOld &&
+                            hasNew &&
+                            canonicalJson(recordEntry['old']) !==
+                                canonicalJson(recordEntry['new'])
+                            ? ['old-new']
+                            : []),
+                    ],
+                    changedPropertyPaths: boundedChangedPropertyPaths,
+                    logicalId: typeof urn === 'string' ? (urn.split('::').at(-1) ?? '') : '',
+                    resourceType: typeof recordEntry['type'] === 'string'
+                        ? recordEntry['type']
+                        : 'unknown',
+                });
+            }
         }
-        else if (operation !== 'same') {
-            desiredEntries.push(entry);
+        else if (operation === 'same') {
+            const isExactNoChangeMarker = isExactInertSameEntry(recordEntry);
+            if (isExactNoChangeMarker)
+                inertSameCount += 1;
+            else {
+                rejectedSameCount += 1;
+                shapeComplete = false;
+            }
+            // Pinned Pulumi can emit an inert `same` step when the provider refresh
+            // observed no drift and the following desired preview has no changes.
+            // It carries no desired authority. Accept only the exact no-change shape
+            // above and omit it from both the drift and desired projections.
         }
         else {
-            shapeComplete = false;
+            desiredEntries.push(entry);
         }
     }
-    const drift = (0, index_js_1.normalizeSstDiffV4_17_1)({
-        exitCode: result.status ?? 1,
+    const candidateDrift = (0, index_js_1.normalizeSstDiffV4_17_1)({
+        exitCode: 0,
         stdout: refreshEntries,
         toolVersion: input.toolVersion,
     });
-    const desired = (0, index_js_1.normalizeSstDiffV4_17_1)({
-        exitCode: result.status ?? 1,
+    const candidatePostRefreshDesired = normalizeDesiredSstDiffV4_17_1({
+        exitCode: 0,
         stdout: desiredEntries,
         toolVersion: input.toolVersion,
     });
+    const knownDiagnosticOperations = new Set([
+        'create',
+        'create-replacement',
+        'delete',
+        'delete-replaced',
+        'discard',
+        'discard-replaced',
+        'import',
+        'import-replacement',
+        'read',
+        'read-replacement',
+        'remove-pending-replace',
+        'replace',
+        'update',
+    ]);
+    const postRefreshDesiredOperationCounts = {};
+    for (const entry of desiredEntries) {
+        const operation = typeof entry === 'object' &&
+            entry !== null &&
+            !Array.isArray(entry) &&
+            typeof entry['op'] === 'string' &&
+            knownDiagnosticOperations.has(entry['op'])
+            ? entry['op']
+            : 'unsupported';
+        postRefreshDesiredOperationCounts[operation] =
+            (postRefreshDesiredOperationCounts[operation] ?? 0) + 1;
+    }
+    const spawnErrorCode = result.error?.code;
+    const errorCode = typeof spawnErrorCode === 'string' &&
+        /^E[A-Z0-9_]{1,31}$/.test(spawnErrorCode)
+        ? spawnErrorCode
+        : null;
+    const command = {
+        errorCode,
+        signal: typeof result.signal === 'string' &&
+            /^SIG[A-Z0-9]{1,15}$/.test(result.signal)
+            ? result.signal
+            : null,
+        status: Number.isInteger(result.status) ? result.status : null,
+        stderrBytes: Buffer.byteLength(result.stderr ?? '', 'utf8'),
+        stdoutBytes: Buffer.byteLength(result.stdout ?? '', 'utf8'),
+    };
+    // SST/Pulumi emits no machine-readable completion marker for an exit-one
+    // preview. A well-formed prefix is therefore not mutation authority.
     const commandSucceeded = result.status === 0;
-    const desiredMatchesOrdinary = desired.complete &&
-        input.ordinaryDiff.complete &&
-        canonicalJson(normalizedDiffMaterial(desired)) ===
-            canonicalJson(normalizedDiffMaterial(input.ordinaryDiff));
+    const drift = commandSucceeded
+        ? candidateDrift
+        : (0, index_js_1.normalizeSstDiffV4_17_1)({
+            exitCode: result.status ?? -1,
+            stdout: refreshEntries,
+            toolVersion: input.toolVersion,
+        });
+    const postRefreshDesired = commandSucceeded
+        ? candidatePostRefreshDesired
+        : normalizeDesiredSstDiffV4_17_1({
+            exitCode: result.status ?? -1,
+            stdout: desiredEntries,
+            toolVersion: input.toolVersion,
+        });
+    const postRefreshDesiredFailureCounts = {};
+    for (const failure of postRefreshDesired.failures) {
+        postRefreshDesiredFailureCounts[failure.code] =
+            (postRefreshDesiredFailureCounts[failure.code] ?? 0) + 1;
+    }
+    const ordinaryDesired = withoutRefreshStateResources(input.ordinaryDiff);
+    const ordinaryDesiredMaterial = normalizedDiffMaterial(ordinaryDesired);
+    const refreshReconciliation = input.action === 'refresh';
+    const providerRefreshSeparated = (ordinaryDesired.complete || refreshReconciliation) &&
+        postRefreshDesired.complete;
     const complete = commandSucceeded &&
         shapeComplete &&
         drift.complete &&
-        desired.complete &&
+        (ordinaryDesired.complete || refreshReconciliation) &&
+        postRefreshDesired.complete &&
         input.toolVersion === index_js_1.SST_DIFF_TOOL_VERSION &&
         PULUMI_REFRESH_PREVIEW_VERSION === '3.215.0';
-    return {
-        commandSucceeded,
-        complete,
-        desiredMatchesOrdinary,
-        digest: digest(canonicalJson({
-            desired: normalizedDiffMaterial(desired),
-            desiredMatchesOrdinary,
+    const entryCounts = {
+        desired: desiredEntries.length,
+        externalFrameworkTagObserved: externalFrameworkTagObservations.length,
+        externalLookupNormalized: externalLookupNormalizations.length,
+        inertSame: inertSameCount,
+        refresh: observedRefreshUrns.size,
+        rejectedSame: rejectedSameCount,
+    };
+    const ordinaryDesiredDiagnostics = {
+        complete: ordinaryDesired.complete,
+        failureCounts: Object.fromEntries(ordinaryDesired.failures
+            .map(({ code }) => code)
+            .sort(deterministic_order_js_1.compareUtf16)
+            .reduce((counts, code) => {
+            counts.set(code, (counts.get(code) ?? 0) + 1);
+            return counts;
+        }, new Map())),
+        resourceCount: ordinaryDesired.resources.length,
+    };
+    const postRefreshDesiredDiagnostics = {
+        complete: postRefreshDesired.complete,
+        failureCounts: Object.fromEntries(Object.entries(postRefreshDesiredFailureCounts).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))),
+        operationCounts: Object.fromEntries(Object.entries(postRefreshDesiredOperationCounts).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right))),
+        resourceCount: postRefreshDesired.resources.length,
+    };
+    const sortedDiagnosticResources = diagnosticResources.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType));
+    const sortedExternalLookupNormalizations = externalLookupNormalizations.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType));
+    const sortedExternalFrameworkTagObservations = externalFrameworkTagObservations.sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType));
+    const observedRefreshInventory = [...observedRefreshUrns].sort();
+    const previewDigest = digest(canonicalJson(
+    // Refresh applies only the observed provider-state reconciliation. The
+    // following desired preview is a completeness/operation-shape guard and
+    // must be planned again before any deploy; binding its ephemeral build
+    // identifiers here would make an otherwise identical refresh unreviewable.
+    refreshReconciliation
+        ? {
+            action: input.action,
+            commandSucceeded,
+            complete,
+            desiredAuthority: 'refresh-reconciliation-plus-post-refresh-desired-validation',
             drift: normalizedDiffMaterial(drift),
+            entryCounts,
+            externalFrameworkTagObservations: sortedExternalFrameworkTagObservations,
+            externalLookupNormalizations: sortedExternalLookupNormalizations,
+            observedRefreshInventory,
+            ordinaryDesired: ordinaryDesiredDiagnostics,
+            postRefreshDesired: postRefreshDesiredDiagnostics,
+            providerRefreshSeparated,
             pulumiVersion: PULUMI_REFRESH_PREVIEW_VERSION,
+            resources: sortedDiagnosticResources,
             sstVersion: input.toolVersion,
-        })),
+        }
+        : {
+            action: input.action,
+            desired: ordinaryDesiredMaterial,
+            desiredAuthority: 'ordinary-preview-plus-separated-refresh-preview',
+            ordinaryDesiredComplete: ordinaryDesired.complete,
+            ordinaryDesiredFailures: ordinaryDesired.failures,
+            drift: normalizedDiffMaterial(drift),
+            externalFrameworkTagObservations: sortedExternalFrameworkTagObservations,
+            externalLookupNormalizations: sortedExternalLookupNormalizations,
+            // The ordinary preview above is the exact desired-source
+            // authority retained by the material infrastructure plan. The
+            // second program execution exists only to prove the provider
+            // refresh stayed separated and that the desired program still
+            // completed. Binding its full resource projection makes harmless
+            // build/linker scheduling differences create a new drift digest
+            // even when the ordinary material plan and provider observation
+            // are exact. Retain its bounded completeness and operation shape;
+            // never substitute it for the ordinary desired authority.
+            postRefreshDesired: postRefreshDesiredDiagnostics,
+            providerRefreshSeparated,
+            pulumiVersion: PULUMI_REFRESH_PREVIEW_VERSION,
+            sstVersion: input.toolVersion,
+        }));
+    const diagnostics = {
+        authorityMode: refreshReconciliation
+            ? 'refresh-reconciliation'
+            : 'ordinary-and-refresh-separated',
+        command,
+        commandSucceeded,
+        complete,
+        entryCounts,
+        providerRefreshSeparated,
+        ordinaryDesired: ordinaryDesiredDiagnostics,
+        postRefreshDesired: postRefreshDesiredDiagnostics,
+        digest: previewDigest,
+        kind: 'ebk-infrastructure-refresh-preview-diagnostics',
+        externalFrameworkTagObservations: sortedExternalFrameworkTagObservations,
+        externalLookupNormalizations: sortedExternalLookupNormalizations,
+        resources: sortedDiagnosticResources,
+        schemaVersion: 7,
+    };
+    return {
+        commandSucceeded,
+        complete,
+        diagnostics,
+        providerRefreshSeparated,
+        digest: previewDigest,
         drift,
-        observedRefreshUrns: [...observedRefreshUrns].sort(),
+        observedRefreshUrns: observedRefreshInventory,
+        rawDrift: JSON.stringify(refreshEntries),
+        stderr: result.stderr,
     };
 }
+/** @internal */
+function requiresIamMutationAnalysis(_action, resource) {
+    return (0, index_js_1.requiresIamPolicyAnalysis)(resource);
+}
 function costQuotaEvidence(input) {
     const quotaByType = {
         'aws:lambda/function:Function': {
@@ -869,8 +2001,10 @@ function iamPolicyDocuments(input) {
                 : undefined;
         if (!policyProperty)
             continue;
-        if (resource.operation === 'delete')
+        if (resource.operation === 'delete' ||
+            REFRESH_STATE_PROVIDER_OPERATIONS.has(resource.providerOperation)) {
             continue;
+        }
         const rawEntry = entries[resource.sourceIndex];
         if (typeof rawEntry !== 'object' ||
             rawEntry === null ||
@@ -1753,16 +2887,19 @@ function probeStandardRemoveResource(input) {
 function observeInfrastructureState(input) {
     const stage = requiredEnvironment(input.childEnvironment, 'EBK_CONSUMER_STAGE');
     const region = requiredEnvironment(input.childEnvironment, 'AWS_REGION');
-    const expectedAccount = requiredEnvironment(input.environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/);
+    const expectedAccount = expectedDeploymentAccount(input.environment, input.invocation);
     const caller = record(runJsonCommand(input.spawn, 'aws', ['sts', 'get-caller-identity', '--output', 'json'], {
         cwd: input.invocation.cwd,
         env: input.childEnvironment,
         label: 'AWS caller identity',
     }), 'AWS caller identity');
+    const callerArn = typeof caller['Arn'] === 'string' ? caller['Arn'] : '';
+    const expectedRoleArn = input.childEnvironment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN?.trim();
     if (caller['Account'] !== expectedAccount ||
-        typeof caller['Arn'] !== 'string' ||
-        !caller['Arn']) {
-        throw new Error('Read-only infrastructure observer does not match the expected AWS account.');
+        !callerArn ||
+        (expectedRoleArn &&
+            !matchesExpectedAssumedRoleArn(expectedAccount, callerArn, expectedRoleArn))) {
+        throw new Error('Read-only infrastructure observer does not match the expected AWS account and temporary assumed role.');
     }
     const stateLocation = exactSstStateLocation(input.environment);
     const stateKey = `app/${input.project}/${stage}.json`;
@@ -1794,7 +2931,10 @@ function observeInfrastructureState(input) {
             maxBuffer: 32 * 1024 * 1024,
         })
         : null;
-    const resources = stateExists ? stateResources(exported) : [];
+    const exportedState = stateExists
+        ? stateExport(exported)
+        : { resources: [] };
+    const resources = exportedState.resources;
     const stackIdentities = new Set();
     for (const resource of resources) {
         const urn = typeof resource.urn === 'string' ? resource.urn : '';
@@ -1808,6 +2948,10 @@ function observeInfrastructureState(input) {
     const stackIdentity = stateExists
         ? [...stackIdentities][0]
         : `${input.project}/${stage}`;
+    if (exportedState.sstStack &&
+        exportedState.sstStack.split('/').slice(1).join('/') !== stackIdentity) {
+        throw new Error('SST state checkpoint identity does not match its Pulumi resource inventory.');
+    }
     const [application, observedStage] = stackIdentity.split('/');
     if (!application || observedStage !== stage) {
         throw new Error('SST state export stack identity does not match the requested stage.');
@@ -1833,14 +2977,14 @@ function observeInfrastructureState(input) {
         urn: typeof resource.urn === 'string' ? resource.urn : 'unknown',
     }));
     const refreshPreview = assessPulumiRefreshPreview({
+        action: input.action,
         childEnvironment: input.childEnvironment,
         invocation: input.invocation,
         ordinaryDiff: input.ordinaryDiff,
         spawn: input.spawn,
+        stateResources: deployableResources,
         toolVersion: input.toolVersion,
     });
-    const refreshInventoryComplete = deployableResources.every((resource) => typeof resource.urn === 'string' &&
-        refreshPreview.observedRefreshUrns.includes(resource.urn));
     const structuralResources = deployableResources
         .map((resource) => ({
         dependencies: Array.isArray(resource.dependencies)
@@ -1862,9 +3006,15 @@ function observeInfrastructureState(input) {
         urn: typeof resource.urn === 'string' ? resource.urn : 'unknown',
     }))
         .filter((value) => value.arn !== undefined && value.tags !== undefined);
+    // Multiple Pulumi resources can deliberately project the same physical AWS
+    // resource (for example, a workload role and its registration component).
+    // The Resource Groups Tagging API rejects duplicate ResourceARNList values,
+    // while the evidence model must still compare the one observed tag set with
+    // every distinct Pulumi URN below.
+    const taggedArns = [...new Set(tagged.map(({ arn }) => arn))].sort(deterministic_order_js_1.compareUtf16);
     const observedTags = new Map();
-    for (let index = 0; index < tagged.length; index += 100) {
-        const arns = tagged.slice(index, index + 100).map(({ arn }) => arn);
+    for (let index = 0; index < taggedArns.length; index += 100) {
+        const arns = taggedArns.slice(index, index + 100);
         const result = record(runJsonCommand(input.spawn, 'aws', [
             'resourcegroupstaggingapi',
             'get-resources',
@@ -1907,6 +3057,27 @@ function observeInfrastructureState(input) {
         typeof resource.urn === 'string' ? resource.urn : 'unknown',
         resource,
     ]));
+    const secretVersionObservations = new Map(deployableResources
+        .filter((resource) => resource.type === 'aws:secretsmanager/secretVersion:SecretVersion')
+        .map((resource) => {
+        const observation = observeSecretsManagerVersion({
+            account: expectedAccount,
+            childEnvironment: input.childEnvironment,
+            invocation: input.invocation,
+            region,
+            resource,
+            spawn: input.spawn,
+        });
+        return [observation.urn, observation];
+    }));
+    // A successful pinned Pulumi refresh preview reads the complete stack but
+    // emits refresh events only for recorded-versus-observed changes. Unchanged
+    // resources are intentionally absent from the JSON event stream; requiring
+    // one event per state resource would turn a clean read into partial coverage.
+    // Every emitted refresh event is still parsed fail-closed above. Pulumi's
+    // later desired-preview events are independently normalized but never used
+    // as drift authority; the preceding ordinary preview remains the sole
+    // desired-update authority.
     const coverage = structuralResources.map(({ type, urn }) => {
         const taggedResource = taggedByUrn.get(urn);
         const observed = taggedResource !== undefined && observedTags.has(taggedResource.arn);
@@ -1919,27 +3090,33 @@ function observeInfrastructureState(input) {
                 : []),
         ].filter((path) => materialProperties.includes(path));
         const refreshCoversResource = refreshPreview.complete &&
-            refreshPreview.desiredMatchesOrdinary &&
-            incompleteInventory.length === 0 &&
-            refreshPreview.observedRefreshUrns.includes(urn);
+            refreshPreview.providerRefreshSeparated &&
+            incompleteInventory.length === 0;
+        const secretVersionObservation = secretVersionObservations.get(urn);
         return {
             adapter: refreshCoversResource
-                ? 'sst-pulumi-refresh-preview'
+                ? secretVersionObservation
+                    ? 'sst-pulumi-refresh-preview+aws-secrets-manager-version-stages'
+                    : 'sst-pulumi-refresh-preview'
                 : taggedResource === undefined
                     ? 'none'
                     : 'aws-resource-groups-tagging-api',
-            arnDigest: taggedResource === undefined ? null : digest(taggedResource.arn),
+            arnDigest: secretVersionObservation?.arnDigest ??
+                (taggedResource === undefined ? null : digest(taggedResource.arn)),
             coveredProperties: refreshCoversResource
                 ? [
                     'existence',
-                    ...materialProperties.filter((path) => !overlayProperties.includes(path)),
+                    ...materialProperties.filter((path) => !overlayProperties.includes(path) ||
+                        secretVersionObservation !== undefined),
                 ]
                 : observed
                     ? ['existence', 'tags']
                     : [],
             type,
             unobservedMaterialProperties: refreshCoversResource
-                ? overlayProperties
+                ? secretVersionObservation
+                    ? []
+                    : overlayProperties
                 : materialProperties.length > 0
                     ? materialProperties
                     : ['service-native-configuration'],
@@ -1947,7 +3124,8 @@ function observeInfrastructureState(input) {
         };
     });
     const unsupported = coverage
-        .filter(({ coveredProperties, unobservedMaterialProperties }) => coveredProperties.length < 2 || unobservedMaterialProperties.length > 0)
+        .filter(({ coveredProperties, unobservedMaterialProperties }) => coveredProperties.length === 0 ||
+        unobservedMaterialProperties.length > 0)
         .map(({ adapter, coveredProperties, type, unobservedMaterialProperties, urn, }) => ({
         adapter,
         coveredProperties,
@@ -1956,8 +3134,7 @@ function observeInfrastructureState(input) {
         urn,
     }));
     if (!refreshPreview.complete ||
-        !refreshPreview.desiredMatchesOrdinary ||
-        !refreshInventoryComplete ||
+        !refreshPreview.providerRefreshSeparated ||
         incompleteInventory.length > 0) {
         unsupported.push({
             adapter: 'sst-pulumi-refresh-preview',
@@ -1965,10 +3142,9 @@ function observeInfrastructureState(input) {
             type: 'full-stack-refresh-preview',
             unobservedMaterialProperties: [
                 ...(!refreshPreview.complete ? ['preview.complete'] : []),
-                ...(!refreshPreview.desiredMatchesOrdinary
-                    ? ['preview.desired-plan-equivalence']
+                ...(!refreshPreview.providerRefreshSeparated
+                    ? ['preview.provider-refresh-separated']
                     : []),
-                ...(!refreshInventoryComplete ? ['preview.refresh-inventory'] : []),
                 ...(incompleteInventory.length > 0 ? ['state.custom-inventory'] : []),
             ],
             urn: 'full-stack',
@@ -1989,12 +3165,18 @@ function observeInfrastructureState(input) {
             stateKey: `app/${application}/${stage}.json`,
         })),
     };
+    const allDrifted = [
+        ...drifted,
+        ...[...secretVersionObservations.values()]
+            .filter((observation) => observation.drifted)
+            .map(({ arnDigest, urn }) => ({ arnDigest, urn })),
+    ].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.urn, right.urn));
     const driftStatus = !refreshPreview.commandSucceeded
         ? 'failed'
-        : refreshPreview.drift.resources.length > 0 || drifted.length > 0
-            ? 'drift-detected'
-            : unsupported.length > 0
-                ? 'partial-coverage'
+        : unsupported.length > 0
+            ? 'partial-coverage'
+            : refreshPreview.drift.resources.length > 0 || allDrifted.length > 0
+                ? 'drift-detected'
                 : 'no-drift';
     // The full export is canonicalized and hashed in memory. Only the digest is
     // retained, so changes to IDs, inputs, outputs, protection, or provider
@@ -2038,11 +3220,14 @@ function observeInfrastructureState(input) {
     })
         .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
         (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType));
-    return {
+    const observation = {
         callInventory: [
             'resourcegroupstaggingapi:GetResources',
             's3:GetObject',
             's3:ListBucket',
+            ...(secretVersionObservations.size > 0
+                ? ['secretsmanager:ListSecretVersionIds']
+                : []),
             'sst:DiffRefreshPreview',
             'ssm:GetParameter',
             'sts:GetCallerIdentity',
@@ -2051,19 +3236,28 @@ function observeInfrastructureState(input) {
             coverage,
             digest: digest(canonicalJson({
                 coverage,
-                drifted,
+                drifted: allDrifted,
                 incompleteInventory,
                 observerBinding,
                 refreshPreviewDigest: refreshPreview.digest,
                 refreshPreviewDrift: normalizedDiffMaterial(refreshPreview.drift),
                 refreshPreviewInventory: refreshPreview.observedRefreshUrns,
+                secretsManagerVersionIdentities: [
+                    ...secretVersionObservations.values(),
+                ]
+                    .map(({ arnDigest, observedIdentityDigest, urn }) => ({
+                    arnDigest,
+                    observedIdentityDigest,
+                    urn,
+                }))
+                    .sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.urn, right.urn)),
                 unsupported,
             })),
             expiresAt,
             generatedAt,
             status: driftStatus,
         },
-        observerArnDigest: digest(caller['Arn']),
+        observerArnDigest: digest(callerArn),
         resources: resourceInventory,
         state: {
             backend: stateExists
@@ -2077,6 +3271,13 @@ function observeInfrastructureState(input) {
             version: digest(canonicalJson({ lock: stateLock.digest, stateDigest })),
         },
     };
+    refreshPreviewDiagnosticsByObservation.set(observation, refreshPreview.diagnostics);
+    refreshMutationPlanMaterialByObservation.set(observation, {
+        diff: refreshPreview.drift,
+        stderr: refreshPreview.stderr,
+        stdout: refreshPreview.rawDrift,
+    });
+    return observation;
 }
 function writeGithubOutputs(environment, values) {
     const path = environment.GITHUB_OUTPUT?.trim();
@@ -2090,7 +3291,8 @@ function writePrivateEvidence(path, contents) {
     (0, node_fs_1.writeFileSync)(path, contents, { encoding: 'utf8', mode: 0o600 });
     (0, node_fs_1.chmodSync)(path, 0o600);
 }
-function actionRisk(risk, action) {
+/** @internal */
+function actionRisk(risk, action, options = {}) {
     if (action === 'deploy')
         return risk;
     const code = action === 'refresh'
@@ -2107,17 +3309,27 @@ function actionRisk(risk, action) {
     else {
         requiredApprovals.add('data-owner-and-recovery');
     }
+    const findings = action === 'refresh'
+        ? risk.findings.map((finding) => finding.disposition === 'block'
+            ? {
+                ...finding,
+                disposition: 'review',
+                message: 'Provider refresh records observed cloud state without mutating the cloud; the exact drift decision must review this finding and a later desired-state plan must still converge. ' +
+                    finding.message,
+            }
+            : finding)
+        : risk.findings;
     return {
-        aggregate: [
-            'unknown',
-            'protection-reduction',
-            'security-expansion',
-        ].includes(risk.aggregate)
-            ? risk.aggregate
-            : 'stateful-or-destructive',
+        aggregate: options.diffComplete === false
+            ? 'unknown'
+            : action === 'refresh'
+                ? 'stateful-or-destructive'
+                : ['unknown', 'protection-reduction', 'security-expansion'].includes(risk.aggregate)
+                    ? risk.aggregate
+                    : 'stateful-or-destructive',
         applyAllowed: false,
         findings: [
-            ...risk.findings,
+            ...findings,
             {
                 class: 'stateful-or-destructive',
                 code,
@@ -2128,17 +3340,62 @@ function actionRisk(risk, action) {
         requiredApprovals: [...requiredApprovals].sort(),
     };
 }
-function validateGovernanceEvidence(reviewed, plan, observedResources = [], importIdentifierDigests = {}) {
+function validateGovernanceEvidence(reviewed, plan, observedResources = [], importIdentifierDigests = {}, adoptedImportPolicy = []) {
     const imports = plan.diff.resources.filter(({ operation }) => operation === 'import');
-    const replacements = plan.diff.resources.filter(({ operation, replacement }) => operation === 'replace' || replacement);
-    const requiresGovernance = plan.action !== 'deploy' || imports.length > 0 || replacements.length > 0;
-    if (!requiresGovernance)
-        return {};
+    const adoptedByResource = new Map(adoptedImportPolicy.map((entry) => [
+        `${entry.logicalId}\u0000${entry.resourceType}`,
+        entry,
+    ]));
+    const governedImports = imports.filter((resource) => !adoptedByResource.has(infrastructureResourceKey(resource)));
+    const replacements = governedReplacementResources(plan);
+    const digests = {};
+    if (imports.length > 0) {
+        if (Object.keys(importIdentifierDigests).length !== imports.length) {
+            throw new Error('Infrastructure import private identity is ambiguous.');
+        }
+        const adoptedResources = imports.flatMap((resource) => {
+            const key = infrastructureResourceKey(resource);
+            const adopted = adoptedByResource.get(key);
+            if (!adopted)
+                return [];
+            const expectedIdentifierDigest = digest(adopted.privateIdentifierTemplate.replace('{stage}', plan.target.stage));
+            if (importIdentifierDigests[key] !== expectedIdentifierDigest) {
+                throw new Error(`Adopted infrastructure import ${resource.logicalId} does not match its exact stage-bound private identity.`);
+            }
+            return [
+                {
+                    authority: adopted.authority,
+                    logicalId: adopted.logicalId,
+                    privateIdentifierDigest: expectedIdentifierDigest,
+                    recoveryRunbookRef: adopted.recoveryRunbookRef,
+                    removalBehavior: adopted.removalBehavior,
+                    resourceType: adopted.resourceType,
+                },
+            ];
+        });
+        if (adoptedResources.length > 0) {
+            digests['adopted-import'] = digest(canonicalJson({
+                kind: 'ebk-adopted-infrastructure-import-authority',
+                materialDigest: plan.materialDigest,
+                project: plan.projects[0],
+                resources: adoptedResources,
+                schemaVersion: 1,
+                sourceCommit: plan.sourceCommit,
+                stage: plan.target.stage,
+                stateDigest: plan.state.digest,
+            }));
+        }
+    }
+    const requiresGovernance = plan.action !== 'deploy' ||
+        governedImports.length > 0 ||
+        replacements.length > 0;
+    if (!requiresGovernance) {
+        return Object.fromEntries(Object.entries(digests).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right)));
+    }
     if (!reviewed) {
         throw new Error('Governed infrastructure mutation evidence is absent from the exact approval record.');
     }
     const governance = record(reviewed.governance, 'Infrastructure approval governance evidence');
-    const digests = {};
     const common = (value, kind, label, extraKeys) => {
         requireExactKeys(value, [
             'kind',
@@ -2246,11 +3503,12 @@ function validateGovernanceEvidence(reviewed, plan, observedResources = [], impo
         }
         digests.removal = digest(canonicalJson(removal));
     }
-    if (imports.length > 0) {
+    if (governedImports.length > 0) {
         const importEvidence = record(governance['import'], 'Infrastructure import governance');
         common(importEvidence, 'ebk-infrastructure-import-governance', 'Infrastructure import governance', ['resources']);
         const resources = importEvidence['resources'];
-        if (!Array.isArray(resources) || resources.length !== imports.length) {
+        if (!Array.isArray(resources) ||
+            resources.length !== governedImports.length) {
             throw new Error('Infrastructure import governance must cover every exact imported resource.');
         }
         const byResource = new Map(resources.map((entry, index) => {
@@ -2269,7 +3527,7 @@ function validateGovernanceEvidence(reviewed, plan, observedResources = [], impo
                 value,
             ];
         }));
-        for (const resource of imports) {
+        for (const resource of governedImports) {
             const key = infrastructureResourceKey(resource);
             const evidence = byResource.get(key);
             if (!evidence ||
@@ -2282,20 +3540,20 @@ function validateGovernanceEvidence(reviewed, plan, observedResources = [], impo
                 throw new Error(`Infrastructure import ${resource.logicalId} lacks exact source-bound private identity, ownership, controller, and tested removal evidence.`);
             }
         }
-        if (byResource.size !== imports.length ||
-            Object.keys(importIdentifierDigests).length !== imports.length) {
+        if (byResource.size !== governedImports.length) {
             throw new Error('Infrastructure import governance is ambiguous.');
         }
         digests.import = digest(canonicalJson(importEvidence));
     }
     if (replacements.length > 0) {
+        const activeOperatorAcknowledgement = reviewed?.approval?.mode === 'operator-acknowledgement';
         const replacementEvidence = record(governance['replacement'], 'Infrastructure replacement governance');
         common(replacementEvidence, 'ebk-infrastructure-replacement-governance', 'Infrastructure replacement governance', ['resources']);
         const resources = replacementEvidence['resources'];
         if (!Array.isArray(resources) || resources.length !== replacements.length) {
             throw new Error('Infrastructure replacement governance must cover every exact replacement.');
         }
-        const byLogicalId = new Map(resources.map((entry, index) => {
+        const byResource = new Map(resources.map((entry, index) => {
             const value = record(entry, `Infrastructure replacement resource ${index}`);
             requireExactKeys(value, [
                 'dataCopyEvidenceRef',
@@ -2307,14 +3565,20 @@ function validateGovernanceEvidence(reviewed, plan, observedResources = [], impo
                 'rollbackLimit',
                 'strategy',
             ], `Infrastructure replacement resource ${index}`);
-            return [value['logicalId'], value];
+            return [
+                `${value['logicalId']}\u0000${value['resourceType']}`,
+                value,
+            ];
         }));
         for (const resource of replacements) {
-            const evidence = byLogicalId.get(resource.logicalId);
+            const evidence = byResource.get(`${resource.logicalId}\u0000${resource.resourceType}`);
             if (!evidence ||
                 evidence['resourceType'] !== resource.resourceType ||
                 evidence['strategy'] !== resource.replacementStrategy ||
-                evidence['nameCollisionCheck'] !== 'passed' ||
+                evidence['nameCollisionCheck'] !==
+                    (activeOperatorAcknowledgement
+                        ? 'not-independently-verified'
+                        : 'passed') ||
                 ![
                     'dataCopyEvidenceRef',
                     'dependencyCutoverRef',
@@ -2322,16 +3586,32 @@ function validateGovernanceEvidence(reviewed, plan, observedResources = [], impo
                     'rollbackLimit',
                 ].every((key) => typeof evidence[key] === 'string' &&
                     evidence[key].trim().length > 0)) {
-                throw new Error(`Infrastructure replacement ${resource.logicalId} lacks exact cutover, data, rollback, collision, or recovery evidence.`);
+                throw new Error(`Infrastructure replacement ${resource.logicalId} lacks exact cutover, data, rollback, honestly classified collision review, or recovery evidence.`);
             }
         }
-        if (byLogicalId.size !== replacements.length) {
+        if (byResource.size !== replacements.length) {
             throw new Error('Infrastructure replacement governance is ambiguous.');
         }
         digests.replacement = digest(canonicalJson(replacementEvidence));
     }
     return Object.fromEntries(Object.entries(digests).sort(([left], [right]) => (0, deterministic_order_js_1.compareUtf16)(left, right)));
 }
+function governedReplacementResources(plan) {
+    const replacements = new Map();
+    for (const resource of plan.diff.resources) {
+        if (resource.operation !== 'replace' && !resource.replacement)
+            continue;
+        const key = `${resource.logicalId}\u0000${resource.resourceType}`;
+        const retained = replacements.get(key);
+        if (retained &&
+            retained.replacementStrategy !== resource.replacementStrategy) {
+            throw new Error(`Infrastructure replacement ${resource.logicalId} has ambiguous provider strategies.`);
+        }
+        replacements.set(key, retained ?? resource);
+    }
+    return [...replacements.values()].sort((left, right) => (0, deterministic_order_js_1.compareUtf16)(left.logicalId, right.logicalId) ||
+        (0, deterministic_order_js_1.compareUtf16)(left.resourceType, right.resourceType));
+}
 function computeCurrentInfrastructurePlan(input) {
     const { action, context, dependencies, environment, invocation, options } = input;
     const project = context.projectName;
@@ -2357,17 +3637,66 @@ function computeCurrentInfrastructurePlan(input) {
     }));
     const spawn = dependencies.spawn ?? defaultSpawn;
     const sourceCommit = assertCheckedOutSourceCommit(dependencies.spawn, context.root, environment);
-    const repository = requiredEnvironment(environment, 'GITHUB_REPOSITORY');
     const candidateSourceCommit = input.candidateSourceCommit ?? sourceCommit;
-    const candidate = releaseCandidateBinding({
-        project,
-        repository,
-        sourceCommit: candidateSourceCommit,
-        workspaceRoot: context.root,
-    });
+    let materialEnvironment = environment;
+    let materialSourceTree;
+    if (environment.EBK_LOCAL_DEPLOYMENT_MODE === 'federated' &&
+        candidateSourceCommit !== sourceCommit) {
+        try {
+            (0, source_authority_js_1.validateReviewedReleaseCheckout)({
+                deploymentSourceCommit: sourceCommit,
+                releaseSourceCommit: candidateSourceCommit,
+                repositoryRoot: context.root,
+                reviewedSourceCommit: sourceCommit,
+            });
+        }
+        catch {
+            throw new Error('Local deployment cannot substitute a different release source commit.');
+        }
+        const releaseTree = spawn('git', ['rev-parse', `${candidateSourceCommit}^{tree}`], {
+            cwd: context.root,
+            encoding: 'utf8',
+            env: environment,
+            maxBuffer: MAX_JSON_BYTES,
+            shell: false,
+        });
+        materialSourceTree = releaseTree.stdout.trim();
+        if (releaseTree.status !== 0 ||
+            releaseTree.stderr !== '' ||
+            !SOURCE_COMMIT.test(materialSourceTree)) {
+            throw new Error('Local deployment cannot resolve the exact reviewed release source tree.');
+        }
+        materialEnvironment = {
+            ...environment,
+            EBK_LOCAL_SOURCE_TREE: materialSourceTree,
+        };
+    }
+    const repository = environment.EBK_LOCAL_DEPLOYMENT_MODE === 'federated'
+        ? `local-source/${requiredEnvironment(materialEnvironment, 'EBK_LOCAL_SOURCE_TREE', /^[a-f0-9]{40}$/)}`
+        : requiredEnvironment(environment, 'GITHUB_REPOSITORY');
+    const candidate = environment.EBK_LOCAL_DEPLOYMENT_MODE === 'federated'
+        ? localSourceCandidateBinding({
+            context,
+            environment,
+            ...(materialSourceTree === undefined ? {} : { materialSourceTree }),
+            project,
+            sourceCommit: candidateSourceCommit,
+            spawn,
+        })
+        : releaseCandidateBinding({
+            project,
+            repository,
+            sourceCommit: candidateSourceCommit,
+            workspaceRoot: context.root,
+        });
     const childEnvironment = {
         ...createCandidateBoundSstChildEnvironment(environment, invocation.environment, candidateSourceCommit),
-        EBK_CANDIDATE_IDENTITY: candidate.digest,
+        // Workload-role publication is one stage-wide boundary spanning the
+        // Foundation and every Slice. The reviewed source commit is the only
+        // candidate identity common to that complete project set; the
+        // project-specific sealed candidate digest remains independently bound in
+        // the material infrastructure plan below.
+        EBK_CANDIDATE_IDENTITY: candidateSourceCommit,
     };
     let backendBootstrapDigest = digest('dependency-supplied-observer');
     if (dependencies.observe === undefined) {
@@ -2377,7 +3706,7 @@ function computeCurrentInfrastructurePlan(input) {
         }
         const stage = requiredEnvironment(childEnvironment, 'EBK_CONSUMER_STAGE');
         backendBootstrapDigest = preflightSstBootstrap({
-            accountId: requiredEnvironment(environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/),
+            accountId: expectedDeploymentAccount(environment, invocation),
             childEnvironment,
             invocation,
             region: requiredEnvironment(childEnvironment, 'AWS_REGION'),
@@ -2415,29 +3744,53 @@ function computeCurrentInfrastructurePlan(input) {
         cwd: invocation.cwd,
         encoding: 'utf8',
         env: childEnvironment,
-        maxBuffer: 20 * 1024 * 1024,
+        maxBuffer: exports.MAX_SST_DIFF_JSON_BYTES,
         shell: false,
     });
-    const diff = (0, index_js_1.normalizeSstDiffV4_17_1)({
-        exitCode: diffResult.status ?? 1,
+    const diff = normalizeDesiredSstDiffV4_17_1({
+        errorCode: typeof diffResult.error?.code === 'string' ? diffResult.error.code : null,
+        exitCode: diffResult.status ?? -1,
+        signal: typeof diffResult.signal === 'string' ? diffResult.signal : null,
+        spawnError: diffResult.error != null,
+        stderr: diffResult.stderr,
         stdout: diffResult.stdout,
         toolVersion: version,
     });
-    const importIdentifierDigests = extractPrivateImportIdentifierDigests(diffResult.stdout, diff);
+    const now = (dependencies.now ?? (() => new Date()))();
+    const observation = (dependencies.observe ?? observeInfrastructureState)({
+        action,
+        backendBootstrapDigest,
+        childEnvironment,
+        environment,
+        invocation,
+        now,
+        ordinaryDiff: diff,
+        project,
+        sourceCommit: candidateSourceCommit,
+        spawn,
+        toolVersion: version,
+    });
+    const refreshMutationPlanMaterial = action === 'refresh'
+        ? refreshMutationPlanMaterialByObservation.get(observation)
+        : undefined;
+    const plannedDiff = refreshMutationPlanMaterial?.diff ?? diff;
+    const plannedDiffStderr = refreshMutationPlanMaterial?.stderr ?? diffResult.stderr;
+    const plannedDiffStdout = refreshMutationPlanMaterial?.stdout ?? diffResult.stdout;
+    const importIdentifierDigests = extractPrivateImportIdentifierDigests(plannedDiffStdout, plannedDiff);
     const iamValidations = iamPolicyDocuments({
-        accountId: requiredEnvironment(environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/),
+        accountId: expectedDeploymentAccount(environment, invocation),
         childEnvironment,
-        diff,
-        diffStdout: diffResult.stdout,
+        diff: plannedDiff,
+        diffStdout: plannedDiffStdout,
         invocation,
         region: requiredEnvironment(childEnvironment, 'AWS_REGION'),
         sourceCommit: candidateSourceCommit,
         spawn,
     });
     const boundedCostQuotaEvidence = costQuotaEvidence({
-        accountId: requiredEnvironment(environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/),
+        accountId: expectedDeploymentAccount(environment, invocation),
         childEnvironment,
-        diff,
+        diff: plannedDiff,
         invocation,
         policy: descriptor.policy,
         project,
@@ -2446,12 +3799,7 @@ function computeCurrentInfrastructurePlan(input) {
         spawn,
     });
     const policySignals = readOptionalArray(environment, 'EBK_INFRA_POLICY_SIGNALS_PATH');
-    const policyBearingIamResources = diff.resources.filter(({ operation, resourceType }) => operation !== 'delete' &&
-        [
-            'aws:iam/policy:Policy',
-            'aws:iam/role:Role',
-            'aws:iam/rolePolicy:RolePolicy',
-        ].includes(resourceType));
+    const policyBearingIamResources = plannedDiff.resources.filter((resource) => requiresIamMutationAnalysis(action, resource));
     if (policyBearingIamResources.some(({ logicalId }) => !iamValidations.some((validation) => validation.logicalId === logicalId &&
         validation.analyzer === 'aws-iam-access-analyzer-validate-policy' &&
         validation.status === 'complete'))) {
@@ -2462,45 +3810,35 @@ function computeCurrentInfrastructurePlan(input) {
         });
     }
     const risk = actionRisk((0, index_js_1.classifyInfrastructureRisk)({
-        diff,
+        diff: plannedDiff,
         iamValidations,
         policy: descriptor.policy,
         policySignals,
-    }), action);
-    const now = (dependencies.now ?? (() => new Date()))();
-    const observation = (dependencies.observe ?? observeInfrastructureState)({
-        backendBootstrapDigest,
-        childEnvironment,
-        environment,
-        invocation,
-        now,
-        ordinaryDiff: diff,
-        project,
-        sourceCommit,
-        spawn,
-        toolVersion: version,
-    });
+    }), action, { diffComplete: plannedDiff.complete });
     const drift = observation.drift;
     const state = observation.state;
     const expiresAt = new Date(Math.min(now.getTime() + 60 * 60_000, Date.parse(drift.expiresAt), Date.parse(state.expiresAt)));
-    const account = requiredEnvironment(environment, 'AWS_EXPECTED_ACCOUNT_ID', /^\d{12}$/);
+    const account = expectedDeploymentAccount(environment, invocation);
     const framework = frameworkVersion(context.root);
-    const planAuthorityDigest = planAuthorityPolicyDigest(environment);
+    const planAuthorityDigest = planAuthorityPolicyDigest(materialEnvironment, invocation);
+    const buildArtifacts = collectInfrastructureBuildArtifacts(root);
     return {
+        buildArtifacts,
         costQuotaEvidence: boundedCostQuotaEvidence,
         descriptor,
-        diffStderr: diffResult.stderr,
-        diffStdout: diffResult.stdout,
+        diffStderr: plannedDiffStderr,
+        diffStdout: plannedDiffStdout,
         iamValidations,
         importIdentifierDigests,
         observation,
         plan: (0, index_js_1.createInfrastructurePlan)({
             action,
-            configurationMetadataDigest: digest(canonicalJson({
+            configurationMetadataDigest: infrastructureConfigurationMetadataDigest({
+                buildArtifactDigest: buildArtifacts.digest,
                 configurationInputs,
                 releaseCandidateDigest: candidate.digest,
-            })),
-            diff,
+            }),
+            diff: plannedDiff,
             driftEvidenceDigest: drift.digest,
             driftEvidenceExpiresAt: drift.expiresAt,
             driftEvidenceGeneratedAt: drift.generatedAt,
@@ -2546,6 +3884,591 @@ function computeCurrentInfrastructurePlan(input) {
         toolVersion: version,
     };
 }
+/** @internal */
+function createLocalPlanApprovalRecord(input) {
+    const expectedMaterialDigest = input.environment['EBK_LOCAL_PLAN_MATERIAL_DIGEST']?.trim();
+    if (!expectedMaterialDigest)
+        return undefined;
+    const summaryDigest = input.environment['EBK_LOCAL_PLAN_SUMMARY_DIGEST']?.trim() ?? '';
+    const approverArn = input.environment['EBK_LOCAL_PLAN_APPROVER_ARN']?.trim() ?? '';
+    const sourceCommit = input.environment['EBK_SOURCE_COMMIT']?.trim() ?? '';
+    const policy = (0, index_js_2.readRepositoryOperatingPolicy)(input.context.root);
+    if (input.environment['GITHUB_ACTIONS'] === 'true' ||
+        input.environment['EBK_LOCAL_DEPLOYMENT_MODE'] !== 'federated' ||
+        (input.plan.action !== 'deploy' && input.plan.action !== 'refresh') ||
+        !isCanonicalDeploymentStage(input.plan.target.stage) ||
+        (0, index_js_2.requiresGithubDeployment)(policy.deploymentProfile, input.plan.target.stage) ||
+        expectedMaterialDigest !== input.plan.materialDigest ||
+        !SHA256.test(summaryDigest) ||
+        sourceCommit !== input.plan.sourceCommit ||
+        !/^arn:(aws|aws-us-gov|aws-cn):sts::\d{12}:assumed-role\/.+\/.+$/.test(approverArn) ||
+        input.plan.requiredApprovals.length === 0 ||
+        hasUnreviewableLocalPlanBlock(input.plan)) {
+        throw new Error('Local infrastructure plan approval does not match the exact federated actor, source, stage, and reviewed plan.');
+    }
+    const evidenceRef = `local-plan-summary:${summaryDigest}`;
+    return {
+        ...(input.plan.action === 'refresh' &&
+            input.plan.requiredApprovals.includes('point-of-no-return')
+            ? { acknowledgement: `refresh-state-adoption:${summaryDigest}` }
+            : {}),
+        approvedAt: input.now.toISOString(),
+        approver: `local-federated:${digest(approverArn)}`,
+        author: 'ebk-infrastructure-plan',
+        codeownerReviewed: false,
+        evidenceRefs: Object.fromEntries(input.plan.requiredApprovals.map((requirement) => [
+            requirement,
+            evidenceRef,
+        ])),
+        expiresAt: input.plan.expiresAt,
+        materialDigest: input.plan.materialDigest,
+        mode: 'operator-acknowledgement',
+        stage: input.plan.target.stage,
+    };
+}
+/** @internal */
+function hasUnreviewableLocalPlanBlock(plan) {
+    const blocks = plan.resourceFindings.filter(({ disposition }) => disposition === 'block');
+    if (blocks.length === 0)
+        return false;
+    return !(plan.action === 'refresh' &&
+        blocks.length === 1 &&
+        blocks[0]?.class === 'stateful-or-destructive' &&
+        blocks[0]?.code === 'protected-state-refresh' &&
+        blocks[0]?.resourceId === undefined);
+}
+/** @internal */
+function createLocalRefreshGovernanceReview(input) {
+    if (input.plan.action !== 'refresh')
+        return undefined;
+    const summaryDigest = input.environment['EBK_LOCAL_PLAN_SUMMARY_DIGEST']?.trim() ?? '';
+    const evidenceRef = `local-plan-summary:${summaryDigest}`;
+    const project = input.plan.projects[0];
+    if (!SHA256.test(summaryDigest) ||
+        input.plan.projects.length !== 1 ||
+        !project ||
+        input.approval.materialDigest !== input.plan.materialDigest ||
+        input.approval.mode !== 'operator-acknowledgement' ||
+        input.approval.evidenceRefs['deployment-review'] !== evidenceRef ||
+        !SHA256.test(input.plan.driftEvidenceDigest) ||
+        !SHA256.test(input.plan.state.digest)) {
+        throw new Error('Local refresh governance does not match the exact reviewed plan summary.');
+    }
+    return {
+        approval: input.approval,
+        governance: {
+            driftDecision: {
+                actor: input.approval.approver,
+                approvalRef: evidenceRef,
+                decision: 'adopt',
+                driftEvidenceDigest: input.plan.driftEvidenceDigest,
+                kind: 'ebk-infrastructure-drift-decision',
+                materialDigest: input.plan.materialDigest,
+                project,
+                reviewedSourceChangeRef: input.plan.sourceCommit,
+                runbookRef: 'docs/repository-operating-policy.md',
+                schemaVersion: 1,
+                sourceCommit: input.plan.sourceCommit,
+                stage: input.plan.target.stage,
+                stateDigest: input.plan.state.digest,
+            },
+        },
+        planned: input.plan,
+    };
+}
+/** @internal */
+function createLocalDeployGovernanceReview(input) {
+    if (input.plan.action !== 'deploy')
+        return undefined;
+    const replacements = governedReplacementResources(input.plan);
+    if (replacements.length === 0)
+        return undefined;
+    const summaryDigest = input.environment['EBK_LOCAL_PLAN_SUMMARY_DIGEST']?.trim() ?? '';
+    const evidenceRef = `local-plan-summary:${summaryDigest}`;
+    const project = input.plan.projects[0];
+    if (!SHA256.test(summaryDigest) ||
+        input.plan.projects.length !== 1 ||
+        !project ||
+        input.approval.materialDigest !== input.plan.materialDigest ||
+        input.approval.mode !== 'operator-acknowledgement' ||
+        input.approval.evidenceRefs['deployment-review'] !== evidenceRef ||
+        Object.values(input.approval.evidenceRefs).some((reference) => reference !== evidenceRef) ||
+        replacements.some(({ replacementStrategy }) => replacementStrategy !== 'create-before-delete') ||
+        !SHA256.test(input.plan.state.digest)) {
+        throw new Error('Local deploy governance does not match the exact reviewed plan summary and create-before-delete inventory.');
+    }
+    return {
+        approval: input.approval,
+        governance: {
+            replacement: {
+                kind: 'ebk-infrastructure-replacement-governance',
+                materialDigest: input.plan.materialDigest,
+                project,
+                resources: replacements.map((resource) => ({
+                    dataCopyEvidenceRef: evidenceRef,
+                    dependencyCutoverRef: evidenceRef,
+                    logicalId: resource.logicalId,
+                    nameCollisionCheck: 'not-independently-verified',
+                    recoveryRunbookRef: 'docs/repository-operating-policy.md',
+                    resourceType: resource.resourceType,
+                    rollbackLimit: 'before-dependent-cutover',
+                    strategy: resource.replacementStrategy,
+                })),
+                schemaVersion: 1,
+                sourceCommit: input.plan.sourceCommit,
+                stage: input.plan.target.stage,
+                stateDigest: input.plan.state.digest,
+            },
+        },
+        planned: input.plan,
+    };
+}
+/**
+ * Retains exact local approval for a plan that the stage-wide local executor
+ * has just recomputed and reviewed. This deliberately does not run SST again:
+ * the project mutation executor consumes one invocation-scoped capability and
+ * rechecks source, artifacts, credentials, policy, state identity, and lock
+ * immediately before spawn without claiming provider-preview replay.
+ *
+ * @internal
+ */
+function authorizeRetainedLocalInfrastructurePlan(input) {
+    if (input.plan.diff.resources.some(({ operation }) => operation === 'import')) {
+        throw new Error('Local retained-plan authorization cannot reconstruct private import identity evidence.');
+    }
+    const approval = createLocalPlanApprovalRecord(input) ??
+        (input.plan.requiredApprovals.length === 0
+            ? {
+                approvedAt: input.now.toISOString(),
+                approver: 'committed-standing-policy',
+                author: 'committed-standing-policy',
+                codeownerReviewed: true,
+                evidenceRefs: {},
+                expiresAt: input.plan.expiresAt,
+                materialDigest: input.plan.materialDigest,
+                mode: 'standing-policy',
+                stage: input.plan.target.stage,
+            }
+            : undefined);
+    if (!approval) {
+        throw new Error('Local retained-plan authorization requires current standing policy or an exact operator acknowledgement.');
+    }
+    const reviewedApproval = createLocalDeployGovernanceReview({
+        approval,
+        environment: input.environment,
+        plan: input.plan,
+    }) ??
+        createLocalRefreshGovernanceReview({
+            approval,
+            environment: input.environment,
+            plan: input.plan,
+        });
+    const validation = (0, index_js_1.validateInfrastructurePlanForApply)({
+        approval,
+        now: input.now.toISOString(),
+        planned: input.plan,
+        recomputed: input.plan,
+        sourceChangesSincePlan: [],
+    });
+    if (!validation.allowed) {
+        throw new Error('Local retained-plan authorization did not admit the exact current plan.');
+    }
+    const governanceEvidenceDigests = validateGovernanceEvidence(reviewedApproval, input.plan);
+    const authorization = {
+        action: input.plan.action,
+        approval,
+        ...(Object.keys(governanceEvidenceDigests).length > 0
+            ? { governanceEvidenceDigests }
+            : {}),
+        kind: 'ebk-infrastructure-authorization',
+        ...(reviewedApproval?.governance !== undefined
+            ? { localGovernance: reviewedApproval.governance }
+            : {}),
+        plannedMaterialDigest: input.plan.materialDigest,
+        recomputedMaterialDigest: input.plan.materialDigest,
+        schemaVersion: 1,
+        sourceChangesSincePlan: [],
+        validation,
+    };
+    const root = projectRoot(input.context, {});
+    const evidenceDirectory = (0, node_path_1.join)(root, '.ebk', 'evidence');
+    (0, node_fs_1.mkdirSync)(evidenceDirectory, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(evidenceDirectory, 0o700);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan-authorization.json'), `${JSON.stringify(authorization, null, 2)}\n`);
+    return authorization;
+}
+/** @internal */
+function requiresGovernanceValidation(input) {
+    return (input.hasApproval ||
+        (input.adoptedImportCount > 0 && input.action !== 'refresh'));
+}
+/** @internal */
+function isLocalPlanReviewPending(input) {
+    const findingCodes = input.validation.findings.map(({ code }) => code).sort();
+    const hasExactPendingReviewFindings = findingCodes.length === 1 && findingCodes[0] === 'approval-missing';
+    if (input.environment['GITHUB_ACTIONS'] === 'true' ||
+        input.environment['EBK_LOCAL_DEPLOYMENT_MODE'] !== 'federated' ||
+        (input.plan.action !== 'deploy' && input.plan.action !== 'refresh') ||
+        input.plan.requiredApprovals.length === 0 ||
+        hasUnreviewableLocalPlanBlock(input.plan) ||
+        input.validation.allowed ||
+        !hasExactPendingReviewFindings) {
+        return false;
+    }
+    const policy = (0, index_js_2.readRepositoryOperatingPolicy)(input.context.root);
+    if (!isCanonicalDeploymentStage(input.plan.target.stage))
+        return false;
+    return !(0, index_js_2.requiresGithubDeployment)(policy.deploymentProfile, input.plan.target.stage);
+}
+function runLocalGitAuthorityCommand(input) {
+    const result = input.spawn('git', input.args, {
+        cwd: input.context.root,
+        encoding: 'utf8',
+        env: input.environment,
+        maxBuffer: MAX_JSON_BYTES,
+        shell: false,
+    });
+    if (result.status !== 0 || result.stderr !== '') {
+        throw new Error('Local mutation source identity could not be revalidated.');
+    }
+    return result.stdout.trim();
+}
+/** @internal */
+function observeLocalMutationStateIdentity(input) {
+    const stage = requiredEnvironment(input.childEnvironment, 'EBK_CONSUMER_STAGE');
+    const region = requiredEnvironment(input.childEnvironment, 'AWS_REGION');
+    const expectedAccount = expectedDeploymentAccount(input.environment, input.invocation);
+    const caller = record(runJsonCommand(input.spawn, 'aws', ['sts', 'get-caller-identity', '--output', 'json'], {
+        cwd: input.invocation.cwd,
+        env: input.childEnvironment,
+        label: 'Local mutation AWS caller identity',
+    }), 'Local mutation AWS caller identity');
+    const callerArn = typeof caller['Arn'] === 'string' ? caller['Arn'] : '';
+    const expectedRoleArn = input.childEnvironment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN?.trim();
+    if (caller['Account'] !== expectedAccount ||
+        !callerArn ||
+        !expectedRoleArn ||
+        !matchesExpectedAssumedRoleArn(expectedAccount, callerArn, expectedRoleArn)) {
+        throw new Error('Local mutation caller no longer matches the expected account and temporary assumed role.');
+    }
+    const stateLocation = exactSstStateLocation(input.environment);
+    const stateKey = `app/${input.project}/${stage}.json`;
+    const stateExists = exactS3KeyExists({
+        childEnvironment: input.childEnvironment,
+        invocation: input.invocation,
+        key: stateKey,
+        label: `Local mutation SST state identity ${stateKey}`,
+        spawn: input.spawn,
+        stateBucketName: stateLocation.bucketName,
+    });
+    const sstPath = input.invocation.args[0];
+    if (!sstPath)
+        throw new Error('Workspace SST path is missing.');
+    const exported = stateExists
+        ? runJsonCommand(input.spawn, input.invocation.executable, [
+            sstPath,
+            'state',
+            'export',
+            '--stage',
+            stage,
+            ...(input.invocation.args.includes('--profile')
+                ? input.invocation.args.slice(input.invocation.args.indexOf('--profile'), input.invocation.args.indexOf('--profile') + 2)
+                : []),
+        ], {
+            cwd: input.invocation.cwd,
+            env: input.childEnvironment,
+            label: 'Local mutation SST state export',
+            maxBuffer: 32 * 1024 * 1024,
+        })
+        : null;
+    const exportedState = stateExists
+        ? stateExport(exported)
+        : { resources: [] };
+    const stackIdentities = new Set();
+    for (const resource of exportedState.resources) {
+        const urn = typeof resource.urn === 'string' ? resource.urn : '';
+        const match = /^urn:pulumi:([^:]+)::([^:]+)::/.exec(urn);
+        if (match)
+            stackIdentities.add(`${match[2]}/${match[1]}`);
+    }
+    if (stateExists && stackIdentities.size !== 1) {
+        throw new Error('Local mutation SST state does not identify exactly one application and stack.');
+    }
+    const stack = stateExists
+        ? [...stackIdentities][0]
+        : `${input.project}/${stage}`;
+    if (exportedState.sstStack &&
+        exportedState.sstStack.split('/').slice(1).join('/') !== stack) {
+        throw new Error('Local mutation SST checkpoint identity does not match its resource inventory.');
+    }
+    const [application, observedStage] = stack.split('/');
+    if (application !== input.project ||
+        observedStage !== stage ||
+        !stateLocation.applications.includes(application)) {
+        throw new Error('Local mutation SST state is outside the exact project and stage authority.');
+    }
+    const stateLock = observeSstStateLock({
+        app: application,
+        childEnvironment: input.childEnvironment,
+        invocation: input.invocation,
+        spawn: input.spawn,
+        stage,
+        stateBucketName: stateLocation.bucketName,
+    });
+    const observerBinding = {
+        accountFingerprint: digest(expectedAccount),
+        backendBootstrapDigest: input.backendBootstrapDigest,
+        project: input.project,
+        region,
+        sourceCommit: input.sourceCommit,
+        stage,
+        stateLocationDigest: digest(canonicalJson({
+            bucketArn: stateLocation.bucketArn,
+            lockKey: stateLock.key,
+            stateKey,
+        })),
+    };
+    const stateDigest = digest(canonicalJson(stateExists
+        ? { exportedState: exported, observerBinding }
+        : { observerBinding, stateKey, status: 'absent' }));
+    const generatedAt = input.now.toISOString();
+    const expiresAt = new Date(input.now.getTime() + 60 * 60_000).toISOString();
+    return {
+        actorArn: callerArn,
+        exportedState: exported,
+        identity: {
+            backend: stateExists
+                ? 'sst-pulumi-state-export'
+                : 'sst-pulumi-state-absent',
+            digest: digest(canonicalJson({ lock: stateLock.digest, stateDigest })),
+            expiresAt,
+            locked: stateLock.locked,
+            observedAt: generatedAt,
+            stack,
+            version: digest(canonicalJson({ lock: stateLock.digest, stateDigest })),
+        },
+        resourceCount: exportedState.resources.length,
+    };
+}
+/** @internal */
+function retainLocalRefreshStateBackup(input) {
+    if (input.plan.action !== 'refresh' ||
+        input.observation.identity.backend !== 'sst-pulumi-state-export' ||
+        input.observation.exportedState === null) {
+        throw new Error('Local refresh requires an exportable current state recovery point.');
+    }
+    const evidenceDirectory = (0, node_path_1.join)(projectRoot(input.context, {}), '.ebk', 'evidence');
+    (0, node_fs_1.mkdirSync)(evidenceDirectory, { recursive: true, mode: 0o700 });
+    (0, node_fs_1.chmodSync)(evidenceDirectory, 0o700);
+    const backupContents = `${JSON.stringify(input.observation.exportedState, null, 2)}\n`;
+    const backupPath = (0, node_path_1.join)(evidenceDirectory, 'infrastructure-state-backup.private.json');
+    writePrivateEvidence(backupPath, backupContents);
+    (0, private_state_js_1.hardenPrivatePath)(backupPath, 'file');
+    (0, private_state_js_1.assertPrivatePath)(backupPath, 'file');
+    const retainedBackup = (0, node_fs_1.readFileSync)(backupPath, 'utf8');
+    const retainedBackupStat = (0, node_fs_1.lstatSync)(backupPath, { bigint: true });
+    if (!retainedBackupStat.isFile() ||
+        retainedBackupStat.nlink !== 1n ||
+        retainedBackup !== backupContents) {
+        throw new Error('Local refresh state recovery point could not be verified after write.');
+    }
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-state-backup.json'), `${JSON.stringify({
+        backupDigest: digest(backupContents),
+        capturedAt: input.now.toISOString(),
+        kind: 'ebk-infrastructure-state-backup',
+        project: input.project,
+        resourceCount: input.observation.resourceCount,
+        schemaVersion: 1,
+        sourceCommit: input.plan.sourceCommit,
+        stage: input.plan.target.stage,
+        stateDigest: input.observation.identity.digest,
+        stateVersion: input.observation.identity.version,
+    }, null, 2)}\n`);
+}
+function consumeLocalMutationCapability(input) {
+    const capabilityPath = input.environment.EBK_LOCAL_MUTATION_CAPABILITY_PATH?.trim() ?? '';
+    const nonce = input.environment.EBK_LOCAL_MUTATION_CAPABILITY_NONCE?.trim() ?? '';
+    if (!(0, node_path_1.isAbsolute)(capabilityPath) || !nonce) {
+        throw new Error('Local mutation requires one invocation-scoped capability path and nonce.');
+    }
+    const parent = (0, node_fs_1.realpathSync)((0, node_path_1.dirname)(capabilityPath));
+    const temporaryRoot = (0, node_fs_1.realpathSync)((0, node_os_1.tmpdir)());
+    const parentRelative = (0, node_path_1.relative)(temporaryRoot, parent);
+    const parentStat = (0, node_fs_1.lstatSync)(parent, { bigint: true });
+    let parentIsPrivate = true;
+    try {
+        (0, private_state_js_1.assertPrivatePath)(parent, 'directory');
+    }
+    catch {
+        parentIsPrivate = false;
+    }
+    if (parentRelative === '..' ||
+        parentRelative.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`) ||
+        (0, node_path_1.isAbsolute)(parentRelative) ||
+        !(0, node_path_1.basename)(parent).startsWith('ebk-local-mutation-') ||
+        !parentStat.isDirectory() ||
+        !parentIsPrivate) {
+        throw new Error('Local mutation capability directory is outside the private temporary authority boundary.');
+    }
+    let before;
+    try {
+        before = (0, node_fs_1.lstatSync)(capabilityPath, { bigint: true });
+    }
+    catch {
+        throw new Error('Local mutation capability is malformed, expired, replayed, or absent.');
+    }
+    const expectedUid = process.getuid?.();
+    let capabilityIsPrivate = true;
+    try {
+        (0, private_state_js_1.assertPrivatePath)(capabilityPath, 'file');
+    }
+    catch {
+        capabilityIsPrivate = false;
+    }
+    if (!before.isFile() ||
+        before.nlink !== 1n ||
+        before.size > 64n * 1024n ||
+        !capabilityIsPrivate ||
+        (expectedUid !== undefined && before.uid !== BigInt(expectedUid))) {
+        throw new Error('Local mutation capability is not one bounded private regular file.');
+    }
+    const contents = (0, node_fs_1.readFileSync)(capabilityPath, 'utf8');
+    const after = (0, node_fs_1.lstatSync)(capabilityPath, { bigint: true });
+    if (before.dev !== after.dev ||
+        before.ino !== after.ino ||
+        before.mode !== after.mode ||
+        before.nlink !== after.nlink ||
+        before.size !== after.size ||
+        before.mtimeNs !== after.mtimeNs ||
+        before.ctimeNs !== after.ctimeNs) {
+        throw new Error('Local mutation capability changed while it was read.');
+    }
+    const capability = record(parseJson(contents, 'Local mutation capability'), 'Local mutation capability');
+    (0, local_capability_js_1.validateLocalMutationCapability)({
+        authorizationContents: input.authorizationContents,
+        capability,
+        expectedAuthority: capability.authority,
+        nonce,
+        now: input.now,
+        planContents: input.planContents,
+    });
+    const spawn = input.dependencies.spawn ?? defaultSpawn;
+    const deploymentSourceCommit = assertCheckedOutSourceCommit(input.dependencies.spawn, input.context.root, input.environment);
+    const sourceStatus = runLocalGitAuthorityCommand({
+        args: ['status', '--porcelain=v1', '--untracked-files=all'],
+        context: input.context,
+        environment: input.environment,
+        spawn,
+    });
+    const deploymentSourceTree = runLocalGitAuthorityCommand({
+        args: ['rev-parse', 'HEAD^{tree}'],
+        context: input.context,
+        environment: input.environment,
+        spawn,
+    });
+    const releaseSourceTree = runLocalGitAuthorityCommand({
+        args: ['rev-parse', `${input.plan.sourceCommit}^{tree}`],
+        context: input.context,
+        environment: input.environment,
+        spawn,
+    });
+    if (sourceStatus !== '') {
+        throw new Error('Local mutation source tree changed after its current plan was acknowledged.');
+    }
+    if (deploymentSourceCommit !== input.plan.sourceCommit) {
+        (0, source_authority_js_1.validateReviewedReleaseCheckout)({
+            deploymentSourceCommit,
+            releaseSourceCommit: input.plan.sourceCommit,
+            repositoryRoot: input.context.root,
+            reviewedSourceCommit: deploymentSourceCommit,
+        });
+    }
+    const root = projectRoot(input.context, input.options);
+    const descriptorPath = relativeFile(root, input.options.descriptorPath ?? 'operations/infrastructure-change.json');
+    const descriptor = readDescriptor(descriptorPath, input.context.projectName ?? '');
+    const buildArtifacts = collectInfrastructureBuildArtifacts(root);
+    const retainedBuildArtifacts = record(readJsonFile((0, node_path_1.join)(root, '.ebk', 'evidence', 'infrastructure-build-artifacts.json'), 'Retained infrastructure build artifacts'), 'Retained infrastructure build artifacts');
+    if (retainedBuildArtifacts['digest'] !== buildArtifacts.digest) {
+        throw new Error('Local mutation build artifacts changed after the current plan was acknowledged.');
+    }
+    const policy = (0, index_js_2.readRepositoryOperatingPolicy)(input.context.root);
+    const expectedRoleArn = input.invocation.environment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN?.trim() ?? '';
+    if (digest(descriptor.raw) !== capability.authority.policyProfileDigest ||
+        frameworkVersion(input.context.root) !==
+            capability.authority.frameworkVersion ||
+        planAuthorityPolicyDigest(input.environment, input.invocation) !==
+            capability.authority.planAuthorityPolicyDigest) {
+        throw new Error('Local mutation source, policy, role, artifact, or environment authority changed after acknowledgement.');
+    }
+    const childEnvironment = createCandidateBoundSstChildEnvironment({
+        ...input.environment,
+        EBK_LOCAL_SOURCE_TREE: releaseSourceTree,
+    }, input.invocation.environment, input.plan.sourceCommit);
+    const stateLocation = exactSstStateLocation(input.environment);
+    const backendBootstrapDigest = preflightSstBootstrap({
+        accountId: expectedDeploymentAccount(input.environment, input.invocation),
+        childEnvironment,
+        invocation: input.invocation,
+        region: requiredEnvironment(childEnvironment, 'AWS_REGION'),
+        spawn,
+        stateBucketName: stateLocation.bucketName,
+    });
+    preflightSstBackendParameter({
+        childEnvironment,
+        expectedType: 'SecureString',
+        invocation: input.invocation,
+        name: `/sst/passphrase/${input.context.projectName}/${input.plan.target.stage}`,
+        spawn,
+    });
+    preflightProtectedSstSecrets({
+        application: input.context.projectName ?? '',
+        childEnvironment,
+        invocation: input.invocation,
+        spawn,
+        stage: input.plan.target.stage,
+        stateBucketName: stateLocation.bucketName,
+    });
+    const stateObservation = observeLocalMutationStateIdentity({
+        backendBootstrapDigest,
+        childEnvironment,
+        environment: input.environment,
+        invocation: input.invocation,
+        now: input.now,
+        project: input.context.projectName ?? '',
+        sourceCommit: input.plan.sourceCommit,
+        spawn,
+    });
+    const state = stateObservation.identity;
+    const expectedAuthority = (0, local_capability_js_1.localMutationAuthorityEnvelope)({
+        actorArn: stateObservation.actorArn,
+        deploymentProfile: policy.deploymentProfile,
+        deploymentSourceCommit,
+        deploymentSourceTree,
+        expectedRoleArn,
+        plan: input.plan,
+        project: input.context.projectName ?? '',
+        releaseSourceTree,
+    });
+    if ((0, local_capability_js_1.computeLocalMutationAuthorityDigest)(expectedAuthority) !==
+        capability.authorityDigest ||
+        state.locked !== false ||
+        state.backend !== capability.authority.state.backend ||
+        state.digest !== capability.authority.state.digest ||
+        state.stack !== capability.authority.state.stack ||
+        state.version !== capability.authority.state.version) {
+        throw new Error('Local mutation state identity or lock changed after the current plan was acknowledged.');
+    }
+    if (input.action === 'refresh') {
+        retainLocalRefreshStateBackup({
+            context: input.context,
+            now: input.now,
+            observation: stateObservation,
+            plan: input.plan,
+            project: input.context.projectName ?? '',
+        });
+    }
+    (0, node_fs_1.rmSync)(capabilityPath);
+}
 async function runInfrastructurePlanExecutor(options, context, environment = process.env, dependencies = {}) {
     const action = options.action ?? 'deploy';
     const root = projectRoot(context, options);
@@ -2572,7 +4495,27 @@ async function runInfrastructurePlanExecutor(options, context, environment = pro
     let approval;
     let reviewedApproval;
     let changes = [];
-    if (descriptor.standingPolicyRiskClasses.includes(plan.aggregateRisk) &&
+    const localApproval = createLocalPlanApprovalRecord({
+        context,
+        environment,
+        now,
+        plan,
+    });
+    if (localApproval) {
+        approval = localApproval;
+        reviewedApproval =
+            createLocalDeployGovernanceReview({
+                approval: localApproval,
+                environment,
+                plan,
+            }) ??
+                createLocalRefreshGovernanceReview({
+                    approval: localApproval,
+                    environment,
+                    plan,
+                });
+    }
+    else if (descriptor.standingPolicyRiskClasses.includes(plan.aggregateRisk) &&
         plan.requiredApprovals.length === 0) {
         approval = {
             approvedAt: now.toISOString(),
@@ -2628,8 +4571,12 @@ async function runInfrastructurePlanExecutor(options, context, environment = pro
         recomputed: plan,
         sourceChangesSincePlan: changes,
     });
-    const governanceEvidenceDigests = approval
-        ? validateGovernanceEvidence(reviewedApproval, planned, current.observation.resources, current.importIdentifierDigests)
+    const governanceEvidenceDigests = requiresGovernanceValidation({
+        action: planned.action,
+        adoptedImportCount: descriptor.policy.adoptedImports.length,
+        hasApproval: approval !== undefined,
+    })
+        ? validateGovernanceEvidence(reviewedApproval, planned, current.observation.resources, current.importIdentifierDigests, descriptor.policy.adoptedImports)
         : {};
     const authorization = {
         action,
@@ -2638,6 +4585,9 @@ async function runInfrastructurePlanExecutor(options, context, environment = pro
             ? { governanceEvidenceDigests }
             : {}),
         kind: 'ebk-infrastructure-authorization',
+        ...(localApproval && reviewedApproval?.governance !== undefined
+            ? { localGovernance: reviewedApproval.governance }
+            : {}),
         plannedMaterialDigest: planned.materialDigest,
         recomputedMaterialDigest: plan.materialDigest,
         schemaVersion: 1,
@@ -2647,9 +4597,14 @@ async function runInfrastructurePlanExecutor(options, context, environment = pro
     const evidenceDirectory = (0, node_path_1.join)(root, '.ebk', 'evidence');
     (0, node_fs_1.mkdirSync)(evidenceDirectory, { recursive: true, mode: 0o700 });
     (0, node_fs_1.chmodSync)(evidenceDirectory, 0o700);
+    const refreshPreviewDiagnostics = refreshPreviewDiagnosticsByObservation.get(current.observation);
+    if (refreshPreviewDiagnostics) {
+        writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-drift-diagnostics.json'), `${JSON.stringify(refreshPreviewDiagnostics, null, 2)}\n`);
+    }
     writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.raw.json'), current.diffStdout);
     writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.private-stderr.txt'), current.diffStderr);
     writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.json'), `${JSON.stringify(plan, null, 2)}\n`);
+    writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-build-artifacts.json'), `${JSON.stringify(current.buildArtifacts, null, 2)}\n`);
     writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan-authorization.json'), `${JSON.stringify(authorization, null, 2)}\n`);
     writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-observer-authority.json'), `${JSON.stringify({
         kind: 'ebk-infrastructure-observer-authority',
@@ -2686,15 +4641,32 @@ async function runInfrastructurePlanExecutor(options, context, environment = pro
     const waitsForEnvironmentReviewer = approvalMode === 'environment-reviewer' &&
         plan.target.stage === 'production' &&
         (0, index_js_1.isEnvironmentReviewerPendingAuthorization)(authorization);
-    return { success: validation.allowed || waitsForEnvironmentReviewer };
+    const waitsForLocalPlanReview = isLocalPlanReviewPending({
+        context,
+        environment,
+        plan,
+        validation,
+    });
+    return {
+        success: validation.allowed ||
+            waitsForEnvironmentReviewer ||
+            waitsForLocalPlanReview,
+    };
 }
 async function revalidateInfrastructureMutationAuthorization(action, options, context, invocation, environment = process.env, dependencies = {}) {
     const root = projectRoot(context, options);
     const evidenceDirectory = (0, node_path_1.join)(root, '.ebk', 'evidence');
-    const retainedPlan = record(readJsonFile((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.json'), 'Retained infrastructure plan'), 'Retained infrastructure plan');
+    const retainedPlanContents = (0, node_fs_1.readFileSync)((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan.json'), 'utf8');
+    const retainedPlan = record(parseJson(retainedPlanContents, 'Retained infrastructure plan'), 'Retained infrastructure plan');
     const authorizationRaw = (0, node_fs_1.readFileSync)((0, node_path_1.join)(evidenceDirectory, 'infrastructure-plan-authorization.json'), 'utf8');
     const retainedAuthorization = record(parseJson(authorizationRaw, 'Retained infrastructure authorization'), 'Retained infrastructure authorization');
     const stage = invocation.environment.EBK_CONSUMER_STAGE;
+    const operatingPolicy = (0, index_js_2.readRepositoryOperatingPolicy)(context.root);
+    const localGovernedAuthority = (stage === 'development' ||
+        stage === 'staging' ||
+        stage === 'production') &&
+        !(0, index_js_2.requiresGithubDeployment)(operatingPolicy.deploymentProfile, stage) &&
+        environment.GITHUB_ACTIONS !== 'true';
     const approvalMode = repositoryInfrastructureApprovalMode(context, stage);
     const reviewedSummaryDigest = environment.EBK_ENVIRONMENT_REVIEWED_PLAN_DIGEST?.trim();
     if (reviewedSummaryDigest && approvalMode !== 'environment-reviewer') {
@@ -2740,10 +4712,77 @@ async function revalidateInfrastructureMutationAuthorization(action, options, co
         !retainedPlan.projects.includes(context.projectName ?? '')) {
         throw new Error(`Protected ${action} requires the exact retained plan and plan-clean authorization for the current project and stage.`);
     }
+    if (localGovernedAuthority && stage === 'production') {
+        const expectedAccount = expectedDeploymentAccount(environment, invocation);
+        const expectedConfirmation = localProductionConfirmation({
+            action,
+            accountId: expectedAccount,
+            region: retainedPlan.target.region,
+            sourceCommit: retainedPlan.sourceCommit,
+        });
+        if (options.localProductionConfirmation !== expectedConfirmation) {
+            throw new Error(`Local production mutation requires --localProductionConfirmation=${expectedConfirmation}.`);
+        }
+    }
     const planOptions = {
         ...options,
         action,
     };
+    if (localGovernedAuthority && (action === 'deploy' || action === 'refresh')) {
+        const now = (dependencies.now ?? (() => new Date()))();
+        (dependencies.localCapability ?? consumeLocalMutationCapability)({
+            action,
+            authorizationContents: authorizationRaw,
+            context,
+            dependencies,
+            environment,
+            invocation,
+            now,
+            options: planOptions,
+            plan: retainedPlan,
+            planContents: retainedPlanContents,
+        });
+        const reviewedApproval = retainedAuthorization.approval &&
+            retainedAuthorization.localGovernance !== undefined
+            ? {
+                approval: retainedAuthorization.approval,
+                governance: retainedAuthorization.localGovernance,
+                planned: retainedPlan,
+            }
+            : undefined;
+        const governanceEvidenceDigests = validateGovernanceEvidence(reviewedApproval, retainedPlan);
+        if (canonicalJson(governanceEvidenceDigests) !==
+            canonicalJson(retainedAuthorization.governanceEvidenceDigests ?? {})) {
+            throw new Error('Local governed mutation evidence changed after operator acknowledgement.');
+        }
+        const verifiedAt = now.toISOString();
+        const binding = {
+            action,
+            kind: 'ebk-infrastructure-mutation-binding',
+            localAuthority: {
+                confirmationDigest: stage === 'production'
+                    ? digest(options.localProductionConfirmation ?? '')
+                    : null,
+                expectedRoleArn: invocation.environment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN,
+                mode: 'local-invocation-capability',
+            },
+            recomputedMaterialDigest: retainedPlan.materialDigest,
+            retainedAuthorizationDigest: digest(authorizationRaw),
+            retainedMaterialDigest: retainedPlan.materialDigest,
+            schemaVersion: 1,
+            sourceCommit: retainedPlan.sourceCommit,
+            stage: retainedPlan.target.stage,
+            ...(Object.keys(governanceEvidenceDigests).length > 0
+                ? { governanceEvidenceDigests }
+                : {}),
+            validation: retainedAuthorization.validation,
+            verifiedAt,
+        };
+        (0, node_fs_1.mkdirSync)(evidenceDirectory, { recursive: true, mode: 0o700 });
+        (0, node_fs_1.chmodSync)(evidenceDirectory, 0o700);
+        writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-mutation-binding.json'), `${JSON.stringify(binding, null, 2)}\n`);
+        return;
+    }
     const candidateSourceCommit = approvalCandidateSourceCommit(context, planOptions, environment) ??
         retainedPlan.sourceCommit;
     const recomputedCurrent = computeCurrentInfrastructurePlan({
@@ -2758,18 +4797,34 @@ async function revalidateInfrastructureMutationAuthorization(action, options, co
     const recomputed = recomputedCurrent.plan;
     let reviewedApproval;
     const approvalRecordPath = retainedAuthorization.approval?.recordPath;
+    if (retainedAuthorization.localGovernance !== undefined &&
+        (!localGovernedAuthority ||
+            (action !== 'deploy' && action !== 'refresh') ||
+            approvalRecordPath !== undefined)) {
+        throw new Error('Local infrastructure governance is invalid outside one exact local refresh authorization.');
+    }
     if (approvalRecordPath) {
         const batch = record(readJsonFile(relativeFile(context.root, approvalRecordPath), 'Retained infrastructure approval governance'), 'Retained infrastructure approval governance');
         reviewedApproval = batch.projects[context.projectName ?? ''];
     }
-    const governanceEvidenceDigests = validateGovernanceEvidence(reviewedApproval, reviewedApproval?.planned ?? retainedPlan, recomputedCurrent.observation.resources, recomputedCurrent.importIdentifierDigests);
+    else if (localGovernedAuthority &&
+        retainedAuthorization.approval &&
+        retainedAuthorization.localGovernance !== undefined) {
+        reviewedApproval = {
+            approval: retainedAuthorization.approval,
+            governance: retainedAuthorization.localGovernance,
+            planned: retainedPlan,
+        };
+    }
+    const governanceEvidenceDigests = validateGovernanceEvidence(reviewedApproval, reviewedApproval?.planned ?? retainedPlan, recomputedCurrent.observation.resources, recomputedCurrent.importIdentifierDigests, recomputedCurrent.descriptor.policy.adoptedImports);
     if (canonicalJson(governanceEvidenceDigests) !==
         canonicalJson(retainedAuthorization.governanceEvidenceDigests ?? {})) {
         throw new Error('Governed infrastructure mutation evidence changed after plan authorization.');
     }
     const changes = sourceChanges(dependencies.spawn, context.root, environment, retainedPlan.sourceCommit);
     const now = (dependencies.now ?? (() => new Date()))().toISOString();
-    const validationPlan = retainedAuthorization.approval?.mode === 'human-record'
+    const validationPlan = retainedAuthorization.approval?.mode === 'human-record' ||
+        retainedAuthorization.approval?.mode === 'operator-acknowledgement'
         ? {
             ...retainedPlan,
             // The retained authorization already proved the reviewer acted after
@@ -2778,15 +4833,28 @@ async function revalidateInfrastructureMutationAuthorization(action, options, co
             generatedAt: retainedAuthorization.approval.approvedAt,
         }
         : retainedPlan;
-    const validation = (0, index_js_1.validateInfrastructurePlanForApply)({
-        ...(retainedAuthorization.approval
-            ? { approval: retainedAuthorization.approval }
-            : {}),
-        now,
-        planned: validationPlan,
-        recomputed,
-        sourceChangesSincePlan: changes,
-    });
+    const protectedSourceAuthority = environment.GITHUB_ACTIONS === 'true' &&
+        (action === 'deploy' || action === 'refresh');
+    const validation = protectedSourceAuthority
+        ? (0, index_js_1.validateInfrastructurePlanForProtectedApply)({
+            ...(retainedAuthorization.approval
+                ? { approval: retainedAuthorization.approval }
+                : {}),
+            ...(environmentAdmission ? { environmentReviewerApproved: true } : {}),
+            now,
+            planned: validationPlan,
+            recomputed,
+            sourceChangesSincePlan: changes,
+        })
+        : (0, index_js_1.validateInfrastructurePlanForApply)({
+            ...(retainedAuthorization.approval
+                ? { approval: retainedAuthorization.approval }
+                : {}),
+            now,
+            planned: validationPlan,
+            recomputed,
+            sourceChangesSincePlan: changes,
+        });
     const environmentReviewerAllowed = environmentAdmission !== undefined &&
         (0, index_js_1.isEnvironmentReviewerPendingAuthorization)({
             ...retainedAuthorization,
@@ -2797,6 +4865,17 @@ async function revalidateInfrastructureMutationAuthorization(action, options, co
     const binding = {
         action,
         kind: 'ebk-infrastructure-mutation-binding',
+        ...(localGovernedAuthority
+            ? {
+                localAuthority: {
+                    confirmationDigest: stage === 'production'
+                        ? digest(options.localProductionConfirmation ?? '')
+                        : null,
+                    expectedRoleArn: invocation.environment.EBK_EXPECTED_DEPLOYMENT_ROLE_ARN,
+                    mode: 'local-federated',
+                },
+            }
+            : {}),
         recomputedMaterialDigest: recomputed.materialDigest,
         retainedAuthorizationDigest: digest(authorizationRaw),
         retainedMaterialDigest: retainedPlan.materialDigest,
@@ -2904,6 +4983,7 @@ async function recordInfrastructureMutationConvergence(action, options, context,
     };
     let result;
     let converged = false;
+    let refreshStateChangedAfterNonzeroExit = false;
     try {
         const planOptions = {
             ...options,
@@ -3063,6 +5143,25 @@ async function recordInfrastructureMutationConvergence(action, options, context,
         }
         else {
             const postPlanEmpty = current.plan.diff.complete && current.plan.diff.resources.length === 0;
+            refreshStateChangedAfterNonzeroExit =
+                action === 'refresh' &&
+                    !applySucceeded &&
+                    retainedPlan.state.backend === current.plan.state.backend &&
+                    retainedPlan.state.stack === current.plan.state.stack &&
+                    retainedPlan.state.digest !== current.plan.state.digest &&
+                    retainedPlan.state.version !== current.plan.state.version &&
+                    current.plan.state.locked === false &&
+                    current.plan.diff.complete &&
+                    current.plan.diff.failures.length === 0 &&
+                    (current.plan.driftStatus === 'no-drift' ||
+                        current.plan.driftStatus === 'drift-detected');
+            const mutationCompleted = applySucceeded;
+            const refreshHandoffRetained = action === 'refresh' &&
+                mutationCompleted &&
+                current.plan.diff.complete &&
+                current.plan.diff.failures.length === 0 &&
+                (current.plan.driftStatus === 'no-drift' ||
+                    current.plan.driftStatus === 'drift-detected');
             const requiredCheckIds = action === 'deploy'
                 ? ['deployed-smoke', 'alarm-health', 'data-integrity']
                 : [];
@@ -3072,7 +5171,7 @@ async function recordInfrastructureMutationConvergence(action, options, context,
                     // resource in the authorized plan. The empty recomputed post-plan
                     // cannot prove that no provider mutation occurred.
                     changedResourceCount: retainedPlan.diff.resources.length,
-                    status: applySucceeded ? 'succeeded' : 'failed',
+                    status: mutationCompleted ? 'succeeded' : 'failed',
                 },
                 checks: [],
                 cleanupDebt: [],
@@ -3089,6 +5188,14 @@ async function recordInfrastructureMutationConvergence(action, options, context,
                 action,
                 ...evidenceBinding,
                 ...convergence,
+                ...(refreshHandoffRetained && !convergence.converged
+                    ? {
+                        findings: [
+                            'Refresh completed with an exact remaining desired-state plan; run a new governed deployment plan before applying it.',
+                        ],
+                        outcome: 'refresh-complete-replan-required',
+                    }
+                    : {}),
                 kind: 'ebk-infrastructure-convergence',
                 postPlan: current.plan.diff,
                 postApplyDrift: {
@@ -3103,6 +5210,19 @@ async function recordInfrastructureMutationConvergence(action, options, context,
                         driftBasis: postPlanEmpty && current.plan.driftStatus === 'no-drift'
                             ? 'live-observer-no-drift-and-empty-source-state-plan'
                             : 'live-observer-not-converged',
+                        processOutcome: refreshStateChangedAfterNonzeroExit
+                            ? {
+                                childExit: 'nonzero',
+                                disposition: 'state-changed-recovery-required',
+                                postStateDigest: current.plan.state.digest,
+                                retainedStateDigest: retainedPlan.state.digest,
+                            }
+                            : {
+                                childExit: applySucceeded ? 'zero' : 'nonzero',
+                                disposition: applySucceeded
+                                    ? 'completed'
+                                    : 'not-reconciled',
+                            },
                     }
                     : {}),
                 schemaVersion: 1,
@@ -3123,14 +5243,17 @@ async function recordInfrastructureMutationConvergence(action, options, context,
     (0, node_fs_1.mkdirSync)(evidenceDirectory, { recursive: true, mode: 0o700 });
     (0, node_fs_1.chmodSync)(evidenceDirectory, 0o700);
     writePrivateEvidence((0, node_path_1.join)(evidenceDirectory, 'infrastructure-convergence.json'), `${JSON.stringify(result, null, 2)}\n`);
-    // A successful deploy intentionally hands off nonterminal
-    // apply-complete-unverified evidence to deployed smoke. The lifecycle
-    // command succeeded, but no caller may treat this return value as terminal
-    // convergence; only finalizeInfrastructureMutationConvergence can write it.
+    // Successful deploy and refresh commands may intentionally retain
+    // nonterminal handoffs. Deploy waits for deployed smoke; refresh may leave
+    // an exact desired-state plan that must be separately reviewed and applied.
+    // Neither handoff is terminal convergence.
     return (converged ||
         (action === 'deploy' &&
             applySucceeded &&
-            result['outcome'] === 'apply-complete-unverified'));
+            result['outcome'] === 'apply-complete-unverified') ||
+        (action === 'refresh' &&
+            applySucceeded &&
+            result['outcome'] === 'refresh-complete-replan-required'));
 }
 async function finalizeInfrastructureMutationConvergence(options, context, environment = process.env, dependencies = {}) {
     const root = projectRoot(context, options);