@go-to-k/cdkd 0.286.3 → 0.287.0

package/dist/{deploy-engine--rkIGhow.js → deploy-engine-B377YKBI.js}

@@ -1,6 +1,6 @@
 import { _ as withStackName, d as applyDefaultNameForFallback, f as generateResourceName, h as looksLikeCdkdGeneratedName, m as getCurrentStackName, n as getLogger, p as generateResourceNameWithFallback, r as isStdoutReservedForPayload, s as getLiveRenderer } from "./logger-Dw-3y48G.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-D3md0Lde.js";
+import { t as getCdkdVersion } from "./version-Rs7TV7Gz.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -6085,6 +6085,49 @@ var FileAssetPublisher = class {
 	}
 };
 
+//#endregion
+//#region src/utils/regexp.ts
+/**
+* Escape a literal string for embedding in a RegExp.
+*
+* Lives here because the same four-line helper was spelled THREE times — in
+* `src/utils/ecr-uri.ts`, `src/cli/commands/gc.ts` and
+* `src/assets/asset-redirect.ts` — each interpolating a user-controlled name
+* (an AWS region, a bootstrap-marker asset bucket / container repo, an ECR host
+* label) into a pattern. Copies of a security-shaped helper are exactly the
+* shape that drifts: the escaped set is what stops a `.` in an interpolated
+* literal matching ANY character, and in `gc.ts` a widened match decides which
+* live assets are treated as referenced.
+*
+* The character set is the union every JS engine treats as special in a
+* non-`u` pattern. `-` is deliberately absent: it is only special INSIDE a
+* character class, and no caller embeds into one.
+*/
+function escapeRegExp$1(value) {
+	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+* Remove control characters from a value about to be PRINTED.
+*
+* Lives beside {@link escapeRegExp} for the reason that helper's own note
+* gives: this was spelled twice — in `src/cli/commands/diff-recursive.ts` and
+* in `src/deployment/outputs-export-alias.ts` — and copies of a
+* security-shaped helper drift. Both print the same class of string: a
+* resolved CloudFormation Output / `Export.Name`, which passed no CFn
+* validator, so it can carry ANSI escapes or bidi overrides straight into a
+* terminal or a CI log.
+*
+* C0 + DEL + C1 + the bidi marks and isolates. Apply on HUMAN-render paths
+* only: a `--json` payload is a machine interface where an export name is data
+* a consumer may match on, and mutating it there trades a correctness
+* regression for a display concern (see `stripDisplayOnlyChars`, which is the
+* narrower guard for an already-serialized payload and stays local to its
+* caller because its C0 exclusion is specific to that path).
+*/
+function stripControlChars(value) {
+	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
+}
+
 //#endregion
 //#region src/utils/docker-cmd.ts
 /**
@@ -6503,6 +6546,21 @@ const REDACTED_ARGV_VALUE = "***";
 * - `--opt` — `DockerVolumeConfiguration.DriverOpts`, which for the `local`
 *   driver carries mount options (`o=addr=…,username=…,password=…`).
 * - `--label` — `DockerVolumeConfiguration.Labels`, user-authored metadata.
+* - `--build-arg` — a `DockerImageAsset`'s `buildArgs`, forwarded by
+*   `src/assets/docker-build.ts` on BOTH the deploy-time ECR publish path and
+*   `cdkd local run-task`'s image build
+*   ([#2623](https://github.com/go-to-k/cdkd/issues/2623)). The value is
+*   frequently NOT a secret and IS diagnostic (a version pin, a base-image
+*   tag), which is why this one needed arguing rather than assuming — the
+*   argument that settles it is RECOVERABILITY, not likelihood. The build-arg
+*   values sit unredacted in `cdk.out/*.assets.json` on the operator's own
+*   disk, so a masked `--verbose` line costs one `jq` against a file they
+*   already have; the log line is the copy that travels into a CI archive and
+*   a pasted issue, where a build-time registry / package token
+*   (`NPM_TOKEN`, `GITHUB_TOKEN` — a common, if discouraged, use of
+*   `buildArgs`) is disclosed irreversibly. The KEY survives, so "which build
+*   arg" — the half of the diagnostic that identifies the failure — is
+*   unaffected.
 *
 * A flag NOT in this list keeps its value. For most of the argv that is
 * because the value is cdkd-authored or infrastructure-shaped — a container
@@ -6518,33 +6576,348 @@ const REDACTED_ARGV_VALUE = "***";
 * `Environment` / `Secrets` / `DriverOpts`. Revisit per flag if a real leak is
 * found through one; do not widen the set on suspicion, since every addition
 * trades away diagnostic text.
+*
+* Two `docker build` flags were considered WITH `--build-arg` and deliberately
+* left out, because both carry a LOCATOR rather than a value
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623)):
+*
+* - `--secret id=<id>,src=<path>` (or `,env=<NAME>`) — BuildKit resolves the
+*   material itself at build time and docker has NO inline-value syntax, so
+*   cdkd never holds the secret to leak. Masking would also blank the `id`,
+*   since the mask keys on the first `=` and `id` is what sits there — trading
+*   the whole diagnostic ("which secret, sourced from where") for a path.
+* - `--build-context <name>=<path|image-ref|git-url>` — a path or a ref, like
+*   the positional image. A URL form CAN embed a credential, but so can the
+*   image ref; masking one of the two would be a guarantee this set does not
+*   make, and neither is a documented place to put one.
+*
+* `--cache-from` / `--cache-to` were in that second bullet for one review
+* round and the security reviewer was right to refuse it: their value is a
+* comma-separated PARAM LIST, and BuildKit's cache backends take real
+* credentials inline there — s3's `access_key_id` / `secret_access_key` /
+* `session_token`, azblob's `secret_access_key`, gha's `token`. Those are not
+* locators, so they get their own structural mask keyed on the PARAM name:
+* {@link ARGV_PARAM_LIST_FLAGS} / {@link ARGV_PARAM_LIST_LOCATOR_PARAMS}.
 */
 const ARGV_VALUE_BEARING_FLAGS = /* @__PURE__ */ new Set([
 	"-e",
 	"--env",
 	"--opt",
-	"--label"
+	"--label",
+	"--build-arg"
+]);
+/**
+* `docker` argv flags whose NEXT token is a COMMA-SEPARATED `key=value` param
+* list rather than one `KEY=VALUE` pair ([#2623](https://github.com/go-to-k/cdkd/issues/2623)
+* security review).
+*
+* Only the params in {@link ARGV_PARAM_LIST_LOCATOR_PARAMS} survive, and the
+* rest of the list is masked — `type=s3,region=us-east-1,bucket=b` IS the
+* diagnostic ("which backend, where"), and blanking the whole value would
+* destroy it to hide one field.
+*/
+const ARGV_PARAM_LIST_FLAGS = /* @__PURE__ */ new Set(["--cache-from", "--cache-to"]);
+/**
+* Param names inside an {@link ARGV_PARAM_LIST_FLAGS} value that are LOCATORS
+* and therefore survive. **Everything else in the list is masked** — this is
+* an ALLOWLIST, and it is one deliberately.
+*
+* The first cut was a denylist of the credential params BuildKit's backends
+* spell (`secret_access_key`, `access_key_id`, `session_token`, `token`), and
+* both round-2 reviewers broke it the same way:
+* `DockerCacheOption.params` is an arbitrary user map that
+* `cacheOptionToFlag` joins with a bare `,` and no quoting, so a value
+* CONTAINING a comma (`token=aa,bb`, or BuildKit's own legal
+* `secret_access_key="ab,cd"`) split into a masked head and a bare tail that
+* printed verbatim — output that LOOKS redacted. Patching that one shape is
+* the enumerate-bad-shapes treadmill; inverting the test ends it, because a
+* CSV continuation fragment has no recognised param name and so masks by
+* construction.
+*
+* The trade is the right way round for a leak fix: a param missing from this
+* list costs one degraded diagnostic, a param missing from a denylist costs a
+* printed credential. The list covers every backend BuildKit ships —
+* `registry` (`ref`), `local` (`dest` / `src` / `digest` / `tag`), `s3`
+* (`region` / `bucket` / `name` / the prefixes / `use_path_style`), `azblob`
+* (`account_name` / `name` / `prefix`), `gha` (`scope` / `timeout`),
+* `inline` (none) — plus the shared export options, so the common case masks
+* nothing.
+*
+* The four URL-valued locators live in {@link ARGV_PARAM_LIST_URL_PARAMS}
+* instead: they survive only after their userinfo and query are stripped. An
+* earlier revision kept them HERE, whole, arguing the repo's locator policy;
+* that paragraph is gone rather than softened, because azblob makes it false.
+*
+* Matched case-INSENSITIVELY on the trimmed param name — the comparison is
+* over a user-supplied key and BuildKit's own option parsing is
+* case-insensitive, so a `Secret_Access_Key` spelling must not walk past.
+*/
+const ARGV_PARAM_LIST_LOCATOR_PARAMS = /* @__PURE__ */ new Set([
+	"type",
+	"mode",
+	"compression",
+	"compression-level",
+	"force-compression",
+	"ignore-error",
+	"image-manifest",
+	"oci-mediatypes",
+	"timeout",
+	"ref",
+	"dest",
+	"src",
+	"digest",
+	"tag",
+	"region",
+	"bucket",
+	"name",
+	"prefix",
+	"manifests_prefix",
+	"blobs_prefix",
+	"use_path_style",
+	"upload_parallelism",
+	"touch_refresh",
+	"account_name",
+	"scope"
 ]);
 /**
+* Locator params whose value is a URL, and which therefore survive only after
+* their USERINFO, QUERY and FRAGMENT are stripped — and only when the value
+* parses at all
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623) round-3 security
+* review).
+*
+* These were plain allowlist entries for one round, on the reasoning that a
+* credential-in-URL is an incidental hazard shared with `--build-context` and
+* the positional image ref. That reasoning does not survive contact with
+* azblob: BuildKit builds an UNAUTHENTICATED client from `account_url` when
+* `secret_access_key` is absent, so a SAS token in its query string is that
+* backend's SUPPORTED auth path, not an accident. With every other param now
+* fail-closed, leaving the whole URL was the one entry carrying credential
+* material by design.
+*
+* Scheme and host survive, which is what "which endpoint" needs — on the
+* ordinary path. FOUR things mask more than that, and every one of them also
+* masks each param after it in the same value, because they all set `masked`.
+* Three take the value WHOLE: no recognisable `//` authority; a host that is
+* really `user:password` with its `@` cut away; and a later param carrying
+* this URL's severed `@` (the caller's rule, since only it still holds the
+* parts). The fourth is milder in what it keeps, not in what it cascades — a
+* `@` in the PATH costs the host but keeps scheme and tail (`https://h/x@y`
+* -> `https://***@y`). Over-masking is the deliberate direction: see
+* {@link redactUrlLocator} for what each boundary rule leaked before this one.
+*/
+const ARGV_PARAM_LIST_URL_PARAMS = /* @__PURE__ */ new Set([
+	"account_url",
+	"endpoint_url",
+	"url",
+	"url_v2"
+]);
+/**
+* A URL locator with its credential-bearing parts removed: `userinfo@`, and
+* everything from `?` or `#` on.
+*
+* Returns the input UNCHANGED when there was nothing to strip, which is the
+* signal the caller keys "was this masked?" on — so every other branch must
+* differ from its input. An unparseable or implausible value returns `***`
+* rather than itself: these four params are the only ones exempt from the
+* allowlist's mask-by-default rule, so this function is their whole
+* protection and it fails CLOSED.
+*/
+function redactUrlLocator(value) {
+	if (value === "") return value;
+	const authority = /^(?:[a-zA-Z][a-zA-Z0-9+.-]*:)?\/\//.exec(value);
+	if (authority === null) return REDACTED_ARGV_VALUE;
+	const prefix = authority[0];
+	let rest = value.slice(prefix.length);
+	const lastAt = rest.lastIndexOf("@");
+	if (lastAt >= 0) rest = `${REDACTED_ARGV_VALUE}${rest.slice(lastAt)}`;
+	else {
+		const host = rest.split(/[/?#]/)[0];
+		const ipv6 = /^\[[0-9A-Fa-f:.]+\]/.exec(host);
+		const bare = ipv6 ? host.slice(ipv6[0].length) : host;
+		if (/:(?!\d{1,5}$)/.test(bare)) return REDACTED_ARGV_VALUE;
+	}
+	for (const delimiter of ["?", "#"]) {
+		const at = rest.indexOf(delimiter);
+		if (at >= 0) rest = `${rest.slice(0, at)}${delimiter}${REDACTED_ARGV_VALUE}`;
+	}
+	return `${prefix}${rest}`;
+}
+/**
+* The masked rendering of `value` for `flag`, or `undefined` when this flag
+* carries nothing to mask.
+*
+* The single place every argv spelling converges — `--flag VALUE` (two
+* tokens), `--flag=VALUE` (one), and pflag's shorthand cluster in both forms,
+* which reach it through {@link maskAttachedShortFlag} and through
+* {@link trailingShortFlagOfCluster} in {@link redactDockerArgvValues}.
+*
+* The joined form is valid docker syntax for every long flag here, and it was
+* UNMASKED until the [#2623](https://github.com/go-to-k/cdkd/issues/2623)
+* review: harmless while every argv this repo builds emits two tokens, but
+* `src/assets/docker-build.ts`'s `executable` source mode renders a
+* USER-AUTHORED command line, and a wrapper script spelling
+* `--build-arg=NPM_TOKEN=…` leaked it verbatim into both the `--verbose` log
+* and a thrown error.
+*/
+function maskArgvFlagValue(flag, value) {
+	if (ARGV_VALUE_BEARING_FLAGS.has(flag)) {
+		const eqIdx = value.indexOf("=");
+		return eqIdx >= 0 ? `${value.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}` : void 0;
+	}
+	if (ARGV_PARAM_LIST_FLAGS.has(flag)) {
+		let masked = false;
+		const rawParts = value.split(",");
+		const parts = rawParts.map((part, index) => {
+			if (part === "") return part;
+			if (masked) return REDACTED_ARGV_VALUE;
+			const eqIdx = part.indexOf("=");
+			if (eqIdx < 0) {
+				if (index === 0) return part;
+				masked = true;
+				return REDACTED_ARGV_VALUE;
+			}
+			const name = part.substring(0, eqIdx);
+			const normalized = name.trim().toLowerCase();
+			if (ARGV_PARAM_LIST_URL_PARAMS.has(normalized)) {
+				if (rawParts.slice(index + 1).some((later) => later.includes("@"))) {
+					masked = true;
+					return `${name}=${REDACTED_ARGV_VALUE}`;
+				}
+				const rawUrl = part.substring(eqIdx + 1);
+				const safeUrl = redactUrlLocator(rawUrl);
+				if (safeUrl === rawUrl) return part;
+				masked = true;
+				return `${name}=${safeUrl}`;
+			}
+			if (ARGV_PARAM_LIST_LOCATOR_PARAMS.has(normalized)) return part;
+			masked = true;
+			return `${name}=${REDACTED_ARGV_VALUE}`;
+		});
+		return masked ? parts.join(",") : void 0;
+	}
+}
+/**
+* The masked rendering of an ATTACHED short-flag element (`-eKEY=VALUE`), or
+* `undefined` when this element is not one.
+*
+* pflag — which docker uses — accepts a short flag's value glued to it, so
+* `-eNPM_TOKEN=secret` is `-e NPM_TOKEN=secret`, and neither the two-token nor
+* the `--flag=VALUE` branch can see it ([#2623](https://github.com/go-to-k/cdkd/issues/2623)
+* round-2 security review). No argv this repo BUILDS uses the form, but
+* `src/assets/docker-build.ts`'s `executable` source mode hands a user's own
+* command line straight to `spawn`, which is the whole reason the joined form
+* is masked too.
+*
+* This OVER-MASKS relative to pflag, and the earlier claim that it "follows
+* docker's own parse" was wrong: pflag stops at the first cluster letter that
+* consumes a value, so it reads `-file=a=b` as `-f` taking `ile=a=b` while
+* this masks at the `e`. Every such divergence costs a diagnostic and hides
+* nothing that was not already a `KEY=VALUE` pair, so the direction is the
+* safe one — but it is a divergence, not parity.
+*/
+function maskAttachedShortFlag(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	let chosen;
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) {
+		if (flag.length !== 2 || !flag.startsWith("-") || flag[1] === "-") continue;
+		const at = arg.indexOf(flag[1], 1);
+		if (at < 0 || at === arg.length - 1) continue;
+		if (chosen === void 0 || at < chosen.at) chosen = {
+			at,
+			flag
+		};
+	}
+	if (chosen === void 0) return void 0;
+	const masked = maskArgvFlagValue(chosen.flag, arg.slice(chosen.at + 1));
+	return masked === void 0 ? void 0 : `${arg.slice(0, chosen.at + 1)}${masked}`;
+}
+/**
+* The value-bearing short flag a shorthand CLUSTER ENDS in, if any — the form
+* that takes its value from the NEXT argv element.
+*
+* pflag's `parseSingleShortArg` falls through to `value = args[0]` when the
+* cluster runs out, so `-itde K=v` is `-i -t -d -e K=v` with the value in a
+* separate token. {@link maskAttachedShortFlag} bails on a flag letter in last
+* position (there is nothing attached to mask) and the two-token branch looked
+* `-itde` up as a whole flag and missed, so this spelling printed verbatim
+* until [#2623](https://github.com/go-to-k/cdkd/issues/2623)'s round-4 review
+* measured it. Pass 2 cannot rescue it either: its alternation needs a
+* whitespace-preceded `-e`.
+*/
+function trailingShortFlagOfCluster(arg) {
+	if (arg.startsWith("--") || !arg.startsWith("-")) return void 0;
+	const last = arg[arg.length - 1];
+	for (const flag of ARGV_VALUE_BEARING_FLAGS) if (flag.length === 2 && flag.startsWith("-") && flag[1] !== "-" && flag[1] === last) return flag;
+}
+/**
 * Structural, whitespace-delimited form of {@link ARGV_VALUE_BEARING_FLAGS}
 * for scanning a STRING that embeds a space-joined argv. Keyed on the FLAG's
 * position — never on the secret's value, so an unrelated literal that merely
 * coincides with a value is left alone.
 *
+* Covers the SEPARATED and JOINED spellings of
+* {@link ARGV_VALUE_BEARING_FLAGS} only. Two gaps, recorded rather than
+* implied. pflag's shorthand cluster is not modelled here in EITHER form —
+* attached (`-eKEY=VALUE` / `-itdeKEY=VALUE`) or separated (`-itde KEY=VALUE`,
+* which this pass's alternation cannot see because it needs a
+* whitespace-preceded `-e`) — this pass has no argv to resolve
+* the cluster against, and a bare `-e` prefix scan over free text would fire
+* on any word starting with `-e`; {@link redactDockerArgvValues} and passes 1
+* / 1b handle it wherever an argv IS available, which is every composer. And
+* {@link ARGV_PARAM_LIST_FLAGS}
+* is deliberately absent: this pass runs with NO argv to key on, and picking a
+* param name out of a free-text comma list is where a structural match stops
+* being structural. The param mask therefore rides passes 1 and 1b, both of
+* which derive from {@link redactDockerArgvValues} and so have the real argv —
+* i.e. a cache credential is masked in every text composed through a composer,
+* and not in a bare text handed to {@link redactDockerArgvInText} with no
+* `args`. Recorded rather than implied.
+*
+* DERIVED from the Set rather than re-spelled beside it
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623)). Until then this was
+* a hand-written literal listing the same four flags, i.e. the shape where
+* adding a flag to one spelling and not the other masks it on the argv pass
+* and leaks it on the text pass — a divergence no behavioural test of either
+* one can see. Deriving is stronger than fencing the pair: there is nothing
+* left to diverge.
+*
 * What each piece actually buys, since one of them was mis-credited in review:
 * the `(^|\s)` lead is what stops `-e` matching inside `--env` (there is no
 * `m` flag, so `^` is start-of-INPUT), NOT the alternation order — reordering
 * the branches leaves every test green. The order is kept as belt and braces
-* only. The mandatory `\s+` after the flag IS load-bearing: it is what stops
-* `-easy` / `--environment` matching. The KEY is `[^\s=]*` rather than `+` so
-* an EMPTY key (`-e =value`) is masked too.
-*/
-const ARGV_VALUE_TOKEN_RE = /(^|\s)(--env|--label|--opt|-e)(\s+)([^\s=]*)=\S*/g;
+* only, which is why the derivation sorts longest-first. The separator group
+* IS load-bearing: `\s+` is what stops `-easy` / `--environment` matching, and
+* the `=` alternative is the joined `--build-arg=KEY=VALUE` spelling
+* {@link maskArgvFlagValue} handles on the argv side (the group can never be
+* empty, so `--build-argument=X=y` still cannot match). The KEY is `[^\s=]*`
+* rather than `+` so an EMPTY key (`-e =value`) is masked too.
+*
+* The alternation is asserted NON-EMPTY at construction. An empty
+* {@link ARGV_VALUE_BEARING_FLAGS} would collapse it to `(^|\s)()(\s+|=)…`,
+* which masks EVERY whitespace-preceded `k=v` in any docker text — a
+* fail-OPEN that destroys the diagnostic wholesale, and the one failure mode
+* deriving from the Set introduced.
+*/
+const ARGV_VALUE_TOKEN_RE = (() => {
+	const alternation = [...ARGV_VALUE_BEARING_FLAGS].sort((a, b) => b.length - a.length || a.localeCompare(b)).map(escapeRegExp$1).join("|");
+	if (alternation.length === 0 || [...ARGV_VALUE_BEARING_FLAGS].some((f) => f.trim() === "")) throw new Error("ARGV_VALUE_BEARING_FLAGS is empty or holds an empty flag: the token scan would match every k=v");
+	return new RegExp(`(^|\\s)(${alternation})(\\s+|=)([^\\s=]*)=\\S*`, "g");
+})();
 /**
 * Return a copy of `args` with the VALUE of every
-* {@link ARGV_VALUE_BEARING_FLAGS} pair replaced by `***`. The KEY survives —
-* "which variable" is the diagnostic, "what it was set to" is the disclosure.
-*
+* {@link ARGV_VALUE_BEARING_FLAGS} pair replaced by `***`, and the credential
+* PARAMS of every {@link ARGV_PARAM_LIST_FLAGS} value replaced likewise. The
+* KEY survives — "which variable" is the diagnostic, "what it was set to" is
+* the disclosure.
+*
+* All FOUR argv spellings are handled: `--flag VALUE` (two tokens, what every
+* argv this repo builds emits), `--flag=VALUE`, and pflag's shorthand cluster
+* in both its forms — attached (`-itdeKEY=VALUE`) and separated
+* (`-itde KEY=VALUE`, where the cluster ends in the flag letter and pflag
+* takes the NEXT token). The last three are handled because a user's own
+* build script may spell them
+* ([#2623](https://github.com/go-to-k/cdkd/issues/2623)).
 * A value-less `-e KEY` (the form {@link partitionSensitiveEnv} emits for a
 * sensitive key) has nothing to mask and is returned unchanged. `args` is
 * never mutated: the redacted copy is for DISPLAY only, never for `spawn`.
@@ -6553,11 +6926,24 @@ function redactDockerArgvValues(args) {
 	const out = [];
 	for (let i = 0; i < args.length; i++) {
 		const cur = args[i];
+		const joinedEq = cur.indexOf("=");
+		if (joinedEq > 0) {
+			const maskedJoined = maskArgvFlagValue(cur.substring(0, joinedEq), cur.substring(joinedEq + 1));
+			if (maskedJoined !== void 0) {
+				out.push(`${cur.substring(0, joinedEq)}=${maskedJoined}`);
+				continue;
+			}
+		}
+		const maskedAttached = maskAttachedShortFlag(cur);
+		if (maskedAttached !== void 0) {
+			out.push(maskedAttached);
+			continue;
+		}
 		const next = args[i + 1];
-		if (ARGV_VALUE_BEARING_FLAGS.has(cur) && typeof next === "string") {
-			const eqIdx = next.indexOf("=");
-			if (eqIdx >= 0) {
-				out.push(cur, `${next.substring(0, eqIdx)}=${REDACTED_ARGV_VALUE}`);
+		if (typeof next === "string") {
+			const maskedNext = maskArgvFlagValue(ARGV_VALUE_BEARING_FLAGS.has(cur) ? cur : trailingShortFlagOfCluster(cur) ?? cur, next);
+			if (maskedNext !== void 0) {
+				out.push(cur, maskedNext);
 				i++;
 				continue;
 			}
@@ -6881,32 +7267,39 @@ async function buildDockerImage(asset, cdkOutDir, options) {
 		const [cmd, ...args] = source.executable;
 		if (!cmd) throw options.wrapError("asset source.executable[] is empty");
 		const cwd = source.directory ? `${cdkOutDir}/${source.directory}` : cdkOutDir;
-		logger.debug(`Building Docker image via executable: ${source.executable.join(" ")} (cwd=${cwd})`);
+		const shownExecutable = redactDockerArgvValues(source.executable).join(" ");
+		logger.debug(`Building Docker image via executable: ${shownExecutable} (cwd=${cwd})`);
 		let result;
 		try {
 			result = await spawnStreaming(cmd, args, { cwd });
 		} catch (err) {
-			const e = err;
-			throw options.wrapError(e.stderr || e.message || String(err));
+			throw options.wrapError(describeDockerFailure(err, args));
 		}
 		const tag = result.stdout.trim();
-		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${cmd} ${args.join(" ")}`);
+		if (!tag) throw options.wrapError(`docker build executable produced no output (expected the local image tag on stdout): ${shownExecutable}`);
 		return tag;
 	}
-	if (!source.directory) throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (got: ${JSON.stringify(source)})`);
+	if (!source.directory) {
+		const carriesAValue = (v) => {
+			if (v === void 0 || v === null || v === "") return false;
+			if (typeof v !== "object") return true;
+			return (Array.isArray(v) ? v.length : Object.keys(v).length) > 0;
+		};
+		const present = Object.keys(source).filter((k) => carriesAValue(source[k])).map((k) => displaySafe(k, { asciiOnly: true })).filter((k) => k !== "").sort().join(", ") || "<no fields set>";
+		throw options.wrapError(`DockerImageAssetSource must set either 'directory' or 'executable' (fields present: ${present})`);
+	}
 	if (!options.tag) throw options.wrapError("buildDockerImage(directory mode) requires options.tag");
 	const buildArgs = buildDockerBuildCommand(source, options.tag, options.platform);
 	const contextDir = `${cdkOutDir}/${source.directory}`;
 	buildArgs.push(".");
-	logger.debug(`${getDockerCmd()} ${buildArgs.join(" ")} (cwd=${contextDir})`);
+	logger.debug(`${getDockerCmd()} ${redactDockerArgvValues(buildArgs).join(" ")} (cwd=${contextDir})`);
 	try {
 		await runDockerStreaming(buildArgs, {
 			cwd: contextDir,
 			env: { BUILDX_NO_DEFAULT_ATTESTATIONS: "1" }
 		});
 	} catch (err) {
-		const e = err;
-		throw options.wrapError(e.stderr || e.message || String(err));
+		throw options.wrapError(describeDockerFailure(err, buildArgs));
 	}
 	return options.tag;
 }
@@ -7074,8 +7467,9 @@ var DockerAssetPublisher = class {
 	}
 	/**
 	* Build Docker image — delegates to the shared `buildDockerImage`
-	* helper so this code path stays in sync with `cdkd local invoke`'s
-	* container-Lambda build path. `--platform` is read from the asset
+	* helper so this code path stays in sync with `cdkd local run-task`'s
+	* `ContainerImage.fromAsset` build path (the other caller; `cdkd local
+	* invoke` moved to `cdk-local`'s own builder). `--platform` is read from the asset
 	* manifest's `source.platform` (when set); cdkd does not currently
 	* inject a publish-side override.
 	*
@@ -7159,33 +7553,33 @@ var DockerAssetPublisher = class {
 		const [username, password] = Buffer.from(authData.authorizationToken, "base64").toString().split(":");
 		if (!username || password === void 0) throw new AssetError("ECR authorization token has unexpected shape (missing username/password)");
 		const endpoint = authData.proxyEndpoint || `https://${accountId}.dkr.ecr.${region}.${ecrUrlSuffix(region)}`;
+		const loginArgs = [
+			"login",
+			"--username",
+			username,
+			"--password-stdin",
+			endpoint
+		];
 		try {
-			await runDockerStreaming([
-				"login",
-				"--username",
-				username,
-				"--password-stdin",
-				endpoint
-			], { input: password });
+			await runDockerStreaming(loginArgs, { input: password });
 			loggedInRegistries.add(registryKey);
 		} catch (err) {
-			const e = err;
-			throw new AssetError(`ECR login failed: ${formatDockerLoginError(e.stderr || e.message || String(err), endpoint)}`);
+			throw new AssetError(`ECR login failed: ${formatDockerLoginError(describeDockerFailure(err, loginArgs), endpoint)}`);
 		}
 	}
 	/**
 	* Tag Docker image
 	*/
 	async tagImage(source, target) {
+		const tagArgs = [
+			"tag",
+			source,
+			target
+		];
 		try {
-			await runDockerStreaming([
-				"tag",
-				source,
-				target
-			]);
+			await runDockerStreaming(tagArgs);
 		} catch (err) {
-			const e = err;
-			throw new AssetError(`Docker tag failed: ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new AssetError(`Docker tag failed: ${describeDockerFailure(err, tagArgs)}`);
 		}
 	}
 	/**
@@ -7195,11 +7589,11 @@ var DockerAssetPublisher = class {
 	*/
 	async pushImage(uri) {
 		this.logger.debug(`Pushing: ${uri}`);
+		const pushArgs = ["push", uri];
 		try {
-			await runDockerStreaming(["push", uri]);
+			await runDockerStreaming(pushArgs);
 		} catch (err) {
-			const e = err;
-			throw new AssetError(`Docker push failed: ${e.stderr?.trim() || e.message || String(err)}`);
+			throw new AssetError(`Docker push failed: ${describeDockerFailure(err, pushArgs)}`);
 		}
 	}
 	/**
@@ -7937,49 +8331,6 @@ var AssetModeResolver = class {
 	}
 };
 
-//#endregion
-//#region src/utils/regexp.ts
-/**
-* Escape a literal string for embedding in a RegExp.
-*
-* Lives here because the same four-line helper was spelled THREE times — in
-* `src/utils/ecr-uri.ts`, `src/cli/commands/gc.ts` and
-* `src/assets/asset-redirect.ts` — each interpolating a user-controlled name
-* (an AWS region, a bootstrap-marker asset bucket / container repo, an ECR host
-* label) into a pattern. Copies of a security-shaped helper are exactly the
-* shape that drifts: the escaped set is what stops a `.` in an interpolated
-* literal matching ANY character, and in `gc.ts` a widened match decides which
-* live assets are treated as referenced.
-*
-* The character set is the union every JS engine treats as special in a
-* non-`u` pattern. `-` is deliberately absent: it is only special INSIDE a
-* character class, and no caller embeds into one.
-*/
-function escapeRegExp$1(value) {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-}
-/**
-* Remove control characters from a value about to be PRINTED.
-*
-* Lives beside {@link escapeRegExp} for the reason that helper's own note
-* gives: this was spelled twice — in `src/cli/commands/diff-recursive.ts` and
-* in `src/deployment/outputs-export-alias.ts` — and copies of a
-* security-shaped helper drift. Both print the same class of string: a
-* resolved CloudFormation Output / `Export.Name`, which passed no CFn
-* validator, so it can carry ANSI escapes or bidi overrides straight into a
-* terminal or a CI log.
-*
-* C0 + DEL + C1 + the bidi marks and isolates. Apply on HUMAN-render paths
-* only: a `--json` payload is a machine interface where an export name is data
-* a consumer may match on, and mutating it there trades a correctness
-* regression for a display concern (see `stripDisplayOnlyChars`, which is the
-* narrower guard for an already-serialized payload and stays local to its
-* caller because its C0 exclusion is specific to that path).
-*/
-function stripControlChars(value) {
-	return value.replace(/[\u0000-\u001f\u007f-\u009f\u200e\u200f\u202a-\u202e\u2066-\u2069]/g, "");
-}
-
 //#endregion
 //#region src/assets/asset-redirect.ts
 /**
@@ -8861,6 +9212,16 @@ function formatRemaining(ms) {
 	if (minutes < 1) return "in under a minute";
 	return `in ~${minutes}m`;
 }
+/**
+* Quote a value for a pasteable shell command.
+*
+* EXPORTED since issue [#2610]: `src/provisioning/replacement-protection-advice.ts`
+* prints `aws <service> ...` recovery commands naming a resource's physical id,
+* which is the same hazard one directory over. A second spelling of this
+* predicate is how the two would come to disagree about which values need
+* quoting -- the reason `display-safe.ts`'s header gives for not widening a
+* rule by hand. It is a pure function of its argument and imports nothing.
+*/
 function shellQuote(value) {
 	return /^[A-Za-z0-9._/@:+-]+$/.test(value) ? value : `'${value.replace(/'/g, `'\\''`)}'`;
 }
@@ -8880,6 +9241,18 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 	return parts.join(" ");
 }
 /**
+* What to say INSTEAD of a `cdkd force-unlock ...` line when
+* {@link buildForceUnlockCommand} suppresses.
+*
+* Exported since issue [#2610]: `lock-manager.ts`'s exhausted-retry arm needed
+* the same branch, and it was the THIRD place to spell it. The module header's
+* point applies to the suppression sentence as much as to the command -- a
+* banner ending in a bare `run: ` is the shape the review found, and copies are
+* how the next one drifts. Byte-identical to what `forceQuitRecoveryClause`
+* emitted before the extraction; its callers see no change.
+*/
+const UNREPRODUCIBLE_LOCK_CLAUSE = "Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+/**
 * The force-quit banner's recovery sentence.
 *
 * Exported so the two `destroy-runner.ts` banners do not each decide what to
@@ -8890,7 +9263,7 @@ function buildForceUnlockCommand(stackName, region, recovery) {
 */
 function forceQuitRecoveryClause(stackName, region, recovery) {
 	const command = buildForceUnlockCommand(stackName, region, recovery);
-	return command ? ` If the next run reports a lock, run: ${command}` : " Inspect the lock object directly: the name or region recorded for this stack cannot be reproduced safely on a command line, so any command shown here would address a different lock.";
+	return command ? ` If the next run reports a lock, run: ${command}` : ` ${UNREPRODUCIBLE_LOCK_CLAUSE}`;
 }
 /**
 * Build the contention message, reading the holder's identity best-effort.
@@ -10138,7 +10511,7 @@ var LockManager = class {
 				}
 				return false;
 			}
-			throw new LockError(`Failed to acquire lock for stack '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
+			throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}): ${displaySafe(error instanceof Error ? error.message : String(error))}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
@@ -10362,8 +10735,11 @@ var LockManager = class {
 	/**
 	* Force release a lock regardless of owner or expiry status
 	*
-	* This is intended for CLI usage (e.g., --force-unlock flag) when a lock
-	* is stuck and needs manual intervention.
+	* This is intended for CLI usage -- it is what the `cdkd force-unlock
+	* <stack>` SUBCOMMAND calls -- when a lock is stuck and needs manual
+	* intervention. There is no `--force-unlock` FLAG anywhere in `src/`; this
+	* comment said there was, and issue [#2610] site 14 records that the message
+	* `acquireLockWithRetry` used to raise had inherited the same mistake.
 	*
 	* Pass `region: undefined` to operate on a legacy
 	* `{prefix}/{stackName}/lock.json` file.
@@ -10706,7 +11082,7 @@ var LockManager = class {
 			if (lockInfo) {
 				const remainingMs = lockInfo.expiresAt - Date.now();
 				if (attempt < maxRetries) {
-					this.logger.info(`Stack '${stackName}' (${region}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
+					this.logger.info(`Stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) is locked by ${lockInfo.owner}${lockInfo.operation ? ` (operation: ${lockInfo.operation})` : ""}. Lock expires in ${this.formatDuration(remainingMs)}. Retrying in ${this.formatDuration(retryDelay)}... (attempt ${attempt + 1}/${maxRetries})`);
 					await new Promise((resolve) => setTimeout(resolve, retryDelay));
 					continue;
 				}
@@ -10714,7 +11090,9 @@ var LockManager = class {
 		}
 		const lockInfo = await this.getLockInfo(stackName, region);
 		const expiresIn = lockInfo ? this.formatDuration(lockInfo.expiresAt - Date.now()) : "unknown";
-		throw new LockError(`Failed to acquire lock for stack '${stackName}' (${region}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. Use --force-unlock to manually release the lock.` : "Lock exists but could not read lock info."));
+		const forceUnlockCommand = buildForceUnlockCommand(stackName, region);
+		const recovery = forceUnlockCommand ? `If you are certain no other process is active, run: ${forceUnlockCommand}` : `If you are certain no other process is active, ${UNREPRODUCIBLE_LOCK_CLAUSE.charAt(0).toLowerCase()}${UNREPRODUCIBLE_LOCK_CLAUSE.slice(1)}`;
+		throw new LockError(`Failed to acquire lock for stack '${displaySafe(stackName, { asciiOnly: true }) || "<unrenderable>"}' (${displaySafe(region, { asciiOnly: true }) || "<unrenderable>"}) after ${maxRetries + 1} attempts. ` + (lockInfo ? `Locked by: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expires in: ${expiresIn}. ` + recovery : `Lock exists but could not read lock info. ${recovery}`));
 	}
 };
 
@@ -10783,7 +11161,9 @@ function recordResolvedPair(secrets, expression, plaintext) {
 * evidence — so a literal `Output` embedding one of two same-plaintext
 * references would fall back to the value scan and persist the sibling's
 * expression. The engine's other entry-by-entry copy — an `Export.Name`'s
-* secrets into the pass map — deliberately does NOT call this: a name never
+* secrets into the pass map — deliberately does NOT call this (and `cdkd
+* scrub`'s name loop resolves through a VIEW whose pairs never reach the pass
+* map at all, issue #2531): a name never
 * positions a leaf, a value re-using the same token records its own pair at
 * the seam, and the only thing the merge could add is a CONFLICT (a
 * non-cacheable `{{resolve:ssm:X}}` whose value moved between the value pass
@@ -11468,7 +11848,7 @@ function storeAssociation(associations, key, expression, plaintext) {
 * matters: an AWS resource type string is fixed by AWS, and a typo in either
 * copy makes that copy's gate simply never fire (no-op), never fire wrongly.
 */
-const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
+const NESTED_STACK_RESOURCE_TYPE$2 = "AWS::CloudFormation::Stack";
 /**
 * What a PARENT stack's resolution proved about each `Parameters` entry of an
 * `AWS::CloudFormation::Stack` row it is about to provision, keyed by the
@@ -11575,7 +11955,7 @@ const nestedStackParameterExpressions = /* @__PURE__ */ new WeakMap();
 *    `secret-redaction-nested-parameter-source.test.ts`.
 */
 function recordNestedStackParameterExpressions(secrets, resourceType, resolvedProperties, sourceProperties, rules = TEMPLATE_DERIVED_RULES) {
-	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$1) return;
+	if (resourceType !== NESTED_STACK_RESOURCE_TYPE$2) return;
 	if (secrets.size === 0) return;
 	if (!isPlainObject$2(resolvedProperties) || !isPlainObject$2(sourceProperties)) return;
 	if (!Object.hasOwn(resolvedProperties, "Parameters")) return;
@@ -16753,9 +17133,28 @@ function secretsManagerSecretId(inner) {
 *  - A trailing `:<version>` / `:<label>` is part of the name AS SSM PARSES IT
 *    (`GetParameter` accepts `name:3` / `name:prod`), so stripping it would name
 *    a different thing in the refusal message than the one that would be read.
+*
+* A COLON-LESS body (`{{resolve:ssm}}` / `{{resolve:ssm-secure}}`) names no
+* parameter at all, and the empty string is what says so: the caller reads a
+* falsy name as `local`, which hands the reference on to the resolver's own
+* `PARAMETER_NAME is required` — thrown BEFORE any client is built, so no
+* `GetParameter` is ever issued for such a token. Without the guard
+* `indexOf(':')` is `-1` and `substring(0)` returns the SERVICE STRING as the
+* parameter name, so with a foreign producer region on record the same
+* malformed input drew the ambiguous-region refusal naming `'ssm-secure'` as
+* the secret. {@link secretsManagerSecretId} already answers `''` for its own
+* nameless body (a fixed-length `substring` past the end of the string), and a
+* sibling that answers something else is the kind of split a later reader has
+* to rediscover.
+*
+* The colon-less relaxation has a CONSUMER-VISIBLE consequence on a mixed
+* leaf, and it is recorded on {@link classifyReplaySecretRegion} rather than
+* here: this function produces a NAME, and the delta belongs beside the
+* VERDICT a reader arrives at it through.
 */
 function ssmParameterName(inner) {
-	return inner.substring(inner.indexOf(":") + 1);
+	const serviceEnd = inner.indexOf(":");
+	return serviceEnd < 0 ? "" : inner.substring(serviceEnd + 1);
 }
 /**
 * The region an ARN names, or `undefined` for anything that is not an ARN with
@@ -16893,6 +17292,101 @@ function producerRegionsFromState(state) {
 * A same-region ARN answers `local` even when a foreign producer region IS on
 * record: the expression settles the question itself, so the weaker evidence
 * never gets consulted.
+*
+* ---
+*
+* WHO CONSUMES THIS VERDICT, and what the issue #2501 colon-less fix changed
+* for them. Recorded here because a reader arrives at the blast radius through
+* the verdict, not through {@link ssmParameterName}, which merely produces a
+* name.
+*
+* Three LEAF PRE-PASSES consume it — `rollback-executor.ts`'s
+* `resolveLeafByRegion`, `cdkd drift`'s `resolveDriftLeafByRegion` and `cdkd
+* scrub`'s — and each refuses the WHOLE leaf as soon as ONE token classifies
+* `ambiguous`, before any token is fetched. There is a FOURTH consumer, and it
+* is not a pre-pass: `resolveDynamicReferences` classifies token-by-token
+* INSIDE its substitution loop, so it already fetches earlier tokens before
+* refusing a later one. That is why the pre-fetch refusal was never a designed
+* property of this verdict.
+*
+* Before the fix, a colon-less `{{resolve:ssm-secure}}` produced the SERVICE
+* STRING as its name, so with a foreign producer region on record it drew an
+* `ambiguous` verdict and the pre-pass refused the whole leaf: for
+* `local=<same-region ARN>;secure={{resolve:ssm-secure}}`, nothing was
+* resolved. It now answers `local`, so the leaf IS resolved — by the primary
+* resolver when every other token is `local`, or through the segment-rebuild
+* path when one is `named-region` — and the ARN sibling's plaintext is fetched
+* and cached before the degenerate token throws `PARAMETER_NAME is required`.
+* Pinned by `rollback-executor-cross-region-secret.test.ts`'s "the MIXED-leaf
+* delta the colon-less guard accepts", so the trade is visible rather than
+* argued.
+*
+* Accepted on three grounds, the third being a LIMIT rather than a
+* reassurance:
+*
+*  1. The lost refusal was an ACCIDENT of the mis-parse, not a designed
+*     protection: with no foreign producer region on record — the
+*     overwhelmingly common case — the colon-less token classified `local`
+*     before the fix too, so the same sibling was already fetched.
+*  2. The sibling is fetched from the region its OWN verdict names, never a
+*     guessed one (a name-form sibling would itself be `ambiguous` and the
+*     pre-pass would still refuse), so nothing here weakens the issue #1957
+*     rule this module exists to enforce. Nothing fetched reaches a DURABLE
+*     sink — `state.json`, the rollback journal, the `deployments/` event
+*     store, a `--json` payload — and the reason is NOT "the op throws before
+*     any write", which is false for scrub (see 3: scrub swallows and keeps
+*     writing). It is that both places a fetched plaintext is retained are
+*     IN-PROCESS and neither is copied out: the resolver's own
+*     `cachedDynamicReferences` (instance-scoped since issue #1933, so it dies
+*     with the resolver) and `recordedSecretValues`, which every persist path
+*     consults as a redaction NEEDLE set — an entry there causes a value to be
+*     REPLACED BY its expression on the way out, never inserted.
+*
+*     ON THIS PATH one more needle can only redact more, which is why the
+*     direction is safe even though it fetches more — and the qualifier is
+*     load-bearing rather than hedging. It is NOT a general property of the
+*     needle machinery: `redactSecretsForState`'s own doc (see the
+*     `preferPositionDecisions` ordering note) records that a needle rewriting
+*     a FRAME ANCHOR can un-certify `unkeyedArrayPairsByAnchors`, refuse the
+*     array, and leave a sibling MIXED leaf in plaintext — "a regression of
+*     shipped redaction, in the GHSA disclosure direction". That is reachable
+*     with a NON-EMPTY map on a `STATE_SOURCED_READBACK_RULES` caller, e.g.
+*     `rollback-executor.ts`'s `redactRollbackRecord` ->
+*     `scrubResourceRecord`. It is not what fires here: the case this
+*     paragraph is about records FEWER needles, not more, so nothing new can
+*     rewrite an anchor.
+*  3. WHAT THE OP DOES NEXT IS NOT UNIFORM. The replay fails the op and `cdkd
+*     drift` reports the resource NOT compared — both loud. `cdkd scrub` is
+*     NOT: `isRegionAmbiguousRefusal` re-raises only a
+*     `DynamicReferenceRegionAmbiguousError`, and the resolver's replacement is
+*     a plain `Error`, so scrub swallows it to `debug` and the run reports
+*     clean. A LOUDNESS regression for that one command on this one input,
+*     bounded by the identical silent miss that already happens for the same
+*     leaf whenever no foreign producer region is on record.
+*
+*     Issue [#2692](https://github.com/go-to-k/cdkd/issues/2692) tracks it, and
+*     the remedy is NOT resolver-local. Two candidate fixes are wrong, each in
+*     its own way, and scrub has TWO predicates that must not be confused:
+*     `isRegionAmbiguousRefusal` decides RE-RAISE vs SWALLOW (its three call
+*     sites), while `isByDesignRefusal` — matching
+*     `CrossAccountSecretRefusalError` — decides FINDING vs REFUSE. They point
+*     in opposite directions, so a fix aimed at one must not be argued from
+*     the other's record.
+*
+*      - Throwing `IntrinsicResolutionRefusalError` and widening
+*        `isRegionAmbiguousRefusal` to match the BASE class would make every
+*        user-fixable refusal that class carries RE-RAISE and fail the whole
+*        stack — not the silent-downgrade hazard `isByDesignRefusal`'s doc
+*        records, but the opposite over-refusal, on a class with throw sites
+*        spread across the resolver.
+*      - Throwing the region-ambiguous SUBCLASS is wrong differently: scrub
+*        already re-raises it, but its message tells the user to spell the
+*        reference as a full ARN, which cannot fix a reference naming no
+*        parameter.
+*
+*     So #2692 needs a NEW sibling subclass AND a scrub-side predicate change,
+*     which makes it blocked on `src/cli/commands/scrub.ts` (held by PR
+*     #2562), not merely on the resolver's `integ-broad` cost.
 */
 function classifyReplaySecretRegion(expression, consumerRegion, importedProducerRegions) {
 	const inner = expression.startsWith("{{resolve:") ? expression.slice(10, -2) : void 0;
@@ -18586,7 +19080,7 @@ function carriesDynamicReference(value) {
 	return false;
 }
 /** The nested-stack resource type, whose `Outputs.<Name>` attributes are re-resolved (issue #2055). */
-const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
 /** Prefix `NestedStackProvider` records a child stack output under. */
 const NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX = "Outputs.";
 /**
@@ -19720,6 +20214,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		const conditions = {};
 		const templateConditions = context.template.Conditions;
 		if (!templateConditions || typeof templateConditions !== "object") return conditions;
+		const maskingContext = context.recordedSecretValues ? context : {
+			...context,
+			recordedSecretValues: /* @__PURE__ */ new Map()
+		};
 		const inProgress = /* @__PURE__ */ new Set();
 		const evaluateByName = async (name) => {
 			if (name in conditions) return conditions[name];
@@ -19733,7 +20231,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			inProgress.add(name);
 			try {
 				const result = await this.resolveValue(definition, {
-					...context,
+					...maskingContext,
 					conditionResolver: evaluateByName
 				});
 				const value = Boolean(result);
@@ -19747,7 +20245,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		for (const name of Object.keys(templateConditions)) try {
 			await evaluateByName(name);
 		} catch (error) {
-			this.logger.warn(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`);
+			this.logger.warn(this.maskSecretsForLog(`Failed to evaluate condition ${name}: ${error instanceof Error ? error.message : String(error)}, assuming false`, maskingContext));
 			conditions[name] = false;
 			inProgress.delete(name);
 		}
@@ -20077,7 +20575,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 					return this.noteAttributeSecrecy(logicalId, attributeName, nameServers, context);
 				}
 				this.logger.debug(`Resolved Fn::GetAtt from attributes: ${logicalId}.${attributeName} -> ${stringifyAttributeForLog(attributeName, flatValue)}`);
-				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
+				if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX) && carriesDynamicReference(flatValue)) return await this.reresolveCrossStackValue(flatValue, nestedStackChildRegionFromLocalArn(resource.physicalId), context, `nested stack ${logicalId} ${attributeName}`, crossStackSourceKey({ "Fn::GetAtt": getAtt }));
 				return this.noteAttributeSecrecy(logicalId, attributeName, flatValue, context);
 			}
 			if (attributeName.includes(".")) {
@@ -20094,7 +20592,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 			}
 		}
-		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
+		if (resource.resourceType === NESTED_STACK_RESOURCE_TYPE$1 && attributeName.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)) {
 			const declared = Object.keys(resource.attributes ?? {}).filter((k) => k.startsWith(NESTED_STACK_OUTPUT_ATTRIBUTE_PREFIX)).map((k) => k.slice(8)).sort();
 			throw markNonRetryable(new IntrinsicResolutionRefusalError(`Cannot resolve Fn::GetAtt [${logicalId}, ${attributeName}]: the nested stack '${logicalId}' declares no output named '${attributeName.slice(8)}'. Its outputs are ${declared.length > 0 ? declared.join(", ") : "(none)"}. Check the output name in the nested stack's template, and deploy the child stack again if you have just added it.`));
 		}
@@ -21849,10 +22347,10 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			* which caches nothing (issue #1933).
 			*/
 			let cacheable = true;
-			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner);
+			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context);
 			else if (service === "ssm") {
 				const decrypt = context?.skipDynamicReferences !== true;
-				const param = await this.resolveSSMReference(parts, decrypt);
+				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context);
 				if (param.type === "SecureString") this.pinSecretVerdict(fullMatch, true);
 				else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
 				else cacheable = false;
@@ -21862,12 +22360,12 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				}
 				resolved = param.value;
 			} else if (service === "ssm-secure") {
-				const param = await this.resolveSSMReference(parts, true, "ssm-secure");
+				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context);
 				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${fullMatch}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
 				isSecret = true;
 				resolved = param.value;
 			} else {
-				this.logger.warn(`Unsupported dynamic reference service: ${service}`);
+				this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${service}`, context));
 				continue;
 			}
 			if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
@@ -21898,7 +22396,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* runs when no mid-string ":SecretString:" delimiter is present, so the json-key / version
 	* forms are unaffected.)
 	*/
-	async resolveSecretsManagerReference(inner) {
+	async resolveSecretsManagerReference(inner, context) {
 		const afterService = inner.substring(15);
 		let secretId;
 		let jsonKey = "";
@@ -21927,14 +22425,14 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		} else secretId = afterService;
 		if (!versionStage) versionStage = "AWSCURRENT";
 		if (!secretId) throw new Error("Dynamic reference: secretsmanager SECRET_ID is required");
-		this.logger.debug(`Resolving dynamic reference: secretsmanager:${secretId}:SecretString:${jsonKey}:${versionStage}:${versionId}`);
+		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: secretsmanager:${secretId}:SecretString:${jsonKey}:${versionStage}:${versionId}`, context));
 		const client = this.clientsForRegion(this.explicitRegion).secretsManager;
 		const command = new GetSecretValueCommand({
 			SecretId: secretId,
 			...versionStage && versionStage !== "" && { VersionStage: versionStage },
 			...versionId && versionId !== "" && { VersionId: versionId }
 		});
-		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), `secretsmanager:${secretId}`)).SecretString;
+		const secretString = (await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`secretsmanager:${secretId}`, context))).SecretString;
 		if (!secretString) throw new Error(`Dynamic reference: secret '${secretId}' does not contain a SecretString value`);
 		if (jsonKey) try {
 			const keyValue = JSON.parse(secretString)[jsonKey];
@@ -22087,16 +22585,16 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 	* discard the value when `secure` is set — it is ciphertext, not the resolved
 	* reference.
 	*/
-	async resolveSSMReference(parts, decrypt = true, service = "ssm") {
+	async resolveSSMReference(parts, decrypt = true, service = "ssm", context) {
 		const parameterName = parts.slice(1).join(":");
 		if (!parameterName) throw new Error(`Dynamic reference: ${service} PARAMETER_NAME is required`);
-		this.logger.debug(`Resolving dynamic reference: ${service}:${parameterName}`);
+		this.logger.debug(this.maskSecretsForLog(`Resolving dynamic reference: ${service}:${parameterName}`, context));
 		const client = this.clientsForRegion(this.explicitRegion).ssm;
 		const command = new GetParameterCommand({
 			Name: parameterName,
 			WithDecryption: decrypt
 		});
-		const response = await this.sendWithThrottleRetry(() => client.send(command), `${service}:${parameterName}`);
+		const response = await this.sendWithThrottleRetry(() => client.send(command), this.maskSecretsForLog(`${service}:${parameterName}`, context));
 		const paramValue = response.Parameter?.Value;
 		if (paramValue === void 0 || paramValue === null) throw new Error(`Dynamic reference: SSM parameter '${parameterName}' not found or has no value`);
 		const paramType = response.Parameter?.Type;
@@ -22104,7 +22602,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (secure && paramType !== "SecureString" && !this.warnedUnrecognizedSsmTypes.has(`${parameterName}\u0000${String(paramType)}`)) {
 			this.warnedUnrecognizedSsmTypes.add(`${parameterName}\u0000${String(paramType)}`);
 			const reported = paramType === void 0 ? "(absent)" : `'${String(paramType)}'`;
-			this.logger.warn(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`);
+			this.logger.warn(this.maskSecretsForLog(`SSM parameter '${parameterName}' reported an unrecognized Type ${reported} — treating its value as a secret, so cdkd will persist the {{resolve:${service}:...}} expression rather than the resolved value. Declare the parameter as String / StringList if it is public config.`, context));
 		}
 		return {
 			value: paramValue,
@@ -23057,9 +23555,14 @@ function describeJsonKeys(document) {
 *     `disableCcApiFallback` is not read on that path. The poisoned pre-guard
 *     state record the issue is about is precisely a record that already says
 *     `cc-api`, so it would still arrive here. Only adding the type to
-*     `STICKY_CC_MIGRATION_EXEMPT` would divert it -- and that set is reserved
-*     for types whose CC routing is BROKEN, which would then send the
-*     silent-drop property back down the dropping path on the next deploy.
+*     `STICKY_CC_MIGRATION_EXEMPT` would divert it. Since issue #2719 that
+*     table admits two modes, and NEITHER helps here: `'cc-broken'` is for
+*     types Cloud Control cannot manage, and `'sdk-coverage'` diverts a
+*     resource only when its property bags carry no actionable silent drop --
+*     which is the opposite of this case by construction. Were a type somehow
+*     admitted anyway, the divert would send the silent-drop property back
+*     down the dropping path on the next deploy; the property gate is what
+*     prevents it.
 *
 * So the confirmation belongs where the delete is actually issued. The set is
 * a set rather than an `if` because the hazard is not S3-specific in kind: any
@@ -23308,7 +23811,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-uaOnRUMe.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-D10GWdiA.js").then((n) => n.n);
 			return withIndeterminateGuard(await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -25493,7 +25996,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 					reuseClientCredentials: true,
 					tolerateNonStandardClient: true,
 					onRebuild: ({ bucketRegion, currentRegion }) => {
-						this.logger.debug(`Custom resource response bucket '${bucket}' is in '${bucketRegion}' (client was '${String(currentRegion)}'); building a region-corrected S3 client for response operations.`);
+						this.logger.debug(`Custom resource response bucket '${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}' is in '${displaySafe(bucketRegion, { asciiOnly: true }) || "<unrenderable>"}' (client was '${displaySafe(currentRegion, { asciiOnly: true }) || "<unrenderable>"}'); building a region-corrected S3 client for response operations.`);
 					}
 				});
 				if (generation !== this.responseClientGeneration) {
@@ -26170,7 +26673,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 			Key: responseKey
 		});
 		const presignedUrl = await getSignedUrl(this.s3Client, command, { expiresIn: 7200 });
-		this.logger.debug(`Generated pre-signed URL for response: s3://${this.responseBucket}/${responseKey}`);
+		this.logger.debug(`Generated pre-signed URL for response: s3://${displaySafe(this.responseBucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}`);
 		return presignedUrl;
 	}
 	/**
@@ -26274,7 +26777,7 @@ var CustomResourceProvider = class CustomResourceProvider {
 				Key: responseKey
 			}));
 		} catch (error) {
-			this.logger.debug(`Failed to delete custom-resource response object s3://${bucket}/${responseKey}; it remains as a current object. Underlying error: ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Failed to delete custom-resource response object s3://${displaySafe(bucket, { asciiOnly: true }) || "<unrenderable>"}/${displaySafe(responseKey)}; it remains as a current object. Underlying error: ${displaySafe(error instanceof Error ? error.message : String(error)) || "<unrenderable>"}`);
 		}
 		await purgeNoncurrentKeyVersions(this.s3Client, bucket, [responseKey], {
 			logger: this.logger,
@@ -28564,6 +29067,65 @@ function findActionableSilentDrops(resourceType, templateProperties, allowedKeys
 	if (drops.length === 0) return drops;
 	return drops.filter(({ property }) => !allowedKeys.has(`${resourceType}:${property}`));
 }
+/**
+* A 1-click pre-filled GitHub issue link requesting cdkd support for a
+* specific top-level property on a resource type. Surfaced in the pre-flight
+* error so a user hitting a silent drop lands directly in the "request
+* support" flow.
+*/
+function unsupportedPropertyIssueUrl(resourceType, property) {
+	return `https://github.com/go-to-k/cdkd/issues/new?title=${encodeURIComponent(`Support property ${resourceType}.${property}`)}&labels=resource-support`;
+}
+/**
+* Identify top-level template properties this type's committed CFn schema
+* snapshot does not know about at all — present in neither
+* `coverage.handled` nor `coverage.silentDrop` (issue
+* [#2718](https://github.com/go-to-k/cdkd/issues/2718)).
+*
+* The complement of {@link findSilentDropProperties}, which deliberately
+* PASSES these through: a property absent from the schema is indistinguishable
+* at deploy time from a user typo or an `addPropertyOverride` escape hatch, so
+* it cannot drive a routing decision. That tolerance is correct for routing
+* and wrong for silence — the routing table is built offline from
+* `tests/fixtures/cfn-schemas/*.json`, so every property AWS publishes AFTER
+* that snapshot lands here, and on the SDK route it reaches neither AWS nor an
+* error while the deploy reports success. That is the issue
+* [#614](https://github.com/go-to-k/cdkd/issues/614) failure class arriving
+* through the one input the #614 machinery cannot observe.
+*
+* **Why a warn built on this has no false-positive mode.** An SDK provider
+* writes only what it declares in `handledProperties`, so a top-level property
+* in neither set does not reach AWS under ANY of the three readings — a
+* post-snapshot AWS addition, a typo, or a deliberate `addPropertyOverride`.
+* "This value will not reach AWS" is true in all three, so the caller does not
+* have to guess intent, and at deploy time it could not: cdkd holds only the
+* template and the baked-in table. Firing on a typo is a feature rather than
+* noise — CloudFormation would have REJECTED that typo, so today's silence is
+* strictly the worst of the three behaviors.
+*
+* Deliberately NOT gated on the snapshot's age: the statement is true whatever
+* `generatedAt` says, and an age gate would trade the typo visibility away for
+* a wall-clock dependence.
+*
+* Returns `[]` for Tier 2 / Custom / unknown types (no coverage record — Cloud
+* Control forwards the full property map, so nothing is dropped) and sorts
+* alphabetically, mirroring {@link findSilentDropProperties}. The CALLER is
+* responsible for firing only when the resource actually resolves to the SDK
+* route; see `ProviderRegistry.reportSilentDropDecisions`.
+*/
+function findUnrecognizedProperties(resourceType, templateProperties) {
+	if (!templateProperties) return [];
+	const coverage = getPropertyCoverage(resourceType);
+	if (!coverage) return [];
+	const unrecognized = [];
+	for (const prop of Object.keys(templateProperties)) {
+		if (prop === "Ref" || prop.startsWith("Fn::")) continue;
+		if (coverage.handled.has(prop)) continue;
+		if (coverage.silentDrop.has(prop)) continue;
+		unrecognized.push(prop);
+	}
+	return unrecognized.sort((a, b) => a.localeCompare(b));
+}
 
 //#endregion
 //#region src/provisioning/mutually-exclusive-properties.ts
@@ -28673,56 +29235,39 @@ function buildMutuallyExclusiveMessage(logicalId, violation) {
 //#endregion
 //#region src/provisioning/provider-registry.ts
 /**
-* Provider registry for managing resource providers.
-*
-* Selection strategy for a fresh resource (see {@link getProviderFor}):
-* 1. Custom Resource (`Custom::*` / `AWS::CloudFormation::CustomResource`)
-*    → Custom Resource provider (recorded as `provisionedBy: 'sdk'`).
-* 2. Existing-state `provisionedBy: 'cc-api'` → Cloud Control (sticky).
-* 3. SDK Provider registered, no silent-drop properties (after the
-*    `--allow-unsupported-properties` override filter) → SDK Provider.
-* 4. SDK Provider registered, silent-drop properties present, NOT all
-*    in the allow set → Cloud Control (auto-route, info-logged). When the
-*    CC route is NOT viable — the type is `NON_PROVISIONABLE` (no CC
-*    handlers, e.g. AWS::FSx::FileSystem) or the provider sets
-*    `disableCcApiFallback` (e.g. NestedStackProvider) — throw the clear
-*    pre-flight error instead of failing opaquely at provisioning time.
-* 5. SDK Provider registered, silent-drop properties present, ALL in
-*    the allow set → SDK Provider (the user explicitly accepted the
-*    silent drop, warn-logged).
-* 6. No SDK Provider, Cloud Control supports the type → Cloud Control.
-* 7. `--allow-unsupported-types` escape hatch → Cloud Control optimistically.
-* 8. Otherwise → throw (no provider available).
-*
-* SDK-provider-less Tier 3 (`NON_PROVISIONABLE`) types are rejected earlier
-* by {@link validateResourceTypes}. A Tier 1 type that is ALSO
-* NON_PROVISIONABLE (SDK provider registered for a type Cloud Control cannot
-* manage — e.g. AWS::FSx::FileSystem, AWS::DLM::LifecyclePolicy) passes the
-* type check but has no viable CC auto-route; rule 4's viability guard turns
-* that case into a clear pre-flight error.
-*/
-/**
 * Types exempt from the sticky `provisionedBy: 'cc-api'` routing rule.
 *
-* The sticky rule exists to avoid physical-ID churn when an SDK provider is
-* backfilled for a type Cloud Control was already managing fine. These types
-* are different: their CLOUD CONTROL ROUTING IS BROKEN, so keeping existing
-* state pinned to cc-api would keep the bug alive for every pre-existing
-* resource. Only add a type here when BOTH hold:
-*
-* 1. the CC handler cannot correctly manage the resource (not a perf choice),
-* 2. the SDK provider uses the SAME physicalId the CC path stored, so the
-*    re-route is churn-free and the record flips to `provisionedBy: 'sdk'`
-*    transparently on its next state write.
-*
-* - AWS::Scheduler::Schedule (issue #961): a schedule in a custom
-*   ScheduleGroup is unaddressable via CC (the handlers resolve the bare-Name
-*   identifier against the DEFAULT group) — CC UPDATE fails NotFound and CC
-*   DELETE silently no-ops, orphaning a live schedule. Both paths stored the
-*   bare schedule name as physicalId, and the state properties carry
-*   GroupName, so the SDK provider addresses existing records correctly.
-*/
-const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Set(["AWS::Scheduler::Schedule"]);
+* The sticky rule (rule 2 in `getProviderFor`) exists to avoid physical-ID
+* churn when an SDK provider is backfilled for a type Cloud Control was
+* already managing fine. Both exemption modes are narrow escapes from it; see
+* `StickyExemptMode` for which applies when.
+*
+* Condition 2 -- physicalId parity -- is a hard requirement in BOTH modes and
+* is what makes a flip churn-free. It is also why this is a curated table
+* rather than a predicate: an automatic flip keyed on "the type has coverage"
+* would assert parity for types nobody measured.
+*/
+const STICKY_CC_MIGRATION_EXEMPT = /* @__PURE__ */ new Map([["AWS::Scheduler::Schedule", {
+	mode: "cc-broken",
+	physicalIdForm: "both layers store the bare schedule name; the state properties carry GroupName, so the SDK provider addresses existing records correctly",
+	issue: "https://github.com/go-to-k/cdkd/issues/961",
+	integFixture: "scheduler-custom-group"
+}], ["AWS::SNS::Topic", {
+	mode: "sdk-coverage",
+	physicalIdForm: "both layers store the topic ARN: the schema primaryIdentifier is TopicArn and SnsTopicProvider.create records the CreateTopic TopicArn",
+	issue: "https://github.com/go-to-k/cdkd/issues/2719",
+	integFixture: "cc-to-sdk-reroute"
+}]]);
+function wouldReturnToSdkProvider(input) {
+	const { resourceType, desiredProperties, previousProperties, allowedUnsupportedProperties = /* @__PURE__ */ new Set(), forceCcApi = false, exemptions = STICKY_CC_MIGRATION_EXEMPT } = input;
+	const exemption = exemptions.get(resourceType);
+	if (exemption === void 0) return false;
+	if (exemption.mode === "cc-broken") return true;
+	if (forceCcApi) return false;
+	if (desiredProperties === void 0) return false;
+	if (previousProperties === void 0) return false;
+	return [desiredProperties, previousProperties].every((bag) => findActionableSilentDrops(resourceType, bag, allowedUnsupportedProperties).length === 0);
+}
 var ProviderRegistry = class {
 	logger = getLogger().child("ProviderRegistry");
 	providers = /* @__PURE__ */ new Map();
@@ -28817,18 +29362,36 @@ var ProviderRegistry = class {
 				provisionedBy: "sdk"
 			};
 		}
-		if (provisionedBy === "cc-api" && !STICKY_CC_MIGRATION_EXEMPT.has(resourceType)) {
-			this.logger.debug(`Routing ${resourceType} via Cloud Control (state-recorded provisionedBy=cc-api)`);
-			return {
-				provider: this.cloudControlProvider,
-				provisionedBy: "cc-api"
-			};
+		let returningToSdk = false;
+		if (provisionedBy === "cc-api") {
+			if (!wouldReturnToSdkProvider({
+				resourceType,
+				desiredProperties: properties,
+				previousProperties: input.previousProperties,
+				allowedUnsupportedProperties: this.allowedUnsupportedProperties,
+				forceCcApi: input.forceCcApi === true
+			})) {
+				this.logger.debug(`Routing ${resourceType} via Cloud Control (state-recorded provisionedBy=cc-api)`);
+				return {
+					provider: this.cloudControlProvider,
+					provisionedBy: "cc-api"
+				};
+			}
+			returningToSdk = true;
 		}
 		const specificProvider = this.providers.get(resourceType);
 		if (specificProvider) {
 			const actionableDrops = findActionableSilentDrops(resourceType, properties, this.allowedUnsupportedProperties);
 			if (actionableDrops.length === 0) {
 				this.logger.debug(`Using specific SDK provider for ${resourceType}`);
+				if (returningToSdk) {
+					this.logger.debug(`${resourceType} is returning to its SDK provider from a state-recorded cc-api route; physical id is preserved`);
+					return {
+						provider: specificProvider,
+						provisionedBy: "sdk",
+						sdkMigration: true
+					};
+				}
 				return {
 					provider: specificProvider,
 					provisionedBy: "sdk"
@@ -29028,7 +29591,6 @@ var ProviderRegistry = class {
 	reportSilentDropDecisions(resources) {
 		for (const { logicalId, resourceType, properties, provisionedBy } of resources) {
 			const drops = findSilentDropProperties(resourceType, properties);
-			if (drops.length === 0) continue;
 			const overridden = [];
 			const autoRouted = [];
 			for (const { property } of drops) {
@@ -29047,9 +29609,71 @@ var ProviderRegistry = class {
 				const propList = overridden.join(", ");
 				this.logger.warn(`${logicalId} (${resourceType}): ${propList} will be silently dropped (--allow-unsupported-properties override accepted). Remove the override to route this resource via Cloud Control API instead.`);
 			}
+			this.reportUnrecognizedProperties(logicalId, resourceType, properties, {
+				provisionedBy,
+				autoRouted: autoRouted.length > 0
+			});
 		}
 	}
 	/**
+	* Warn about top-level template properties this type's committed CFn schema
+	* snapshot does not know about, on resources that resolve to the SDK route
+	* (issue [#2718](https://github.com/go-to-k/cdkd/issues/2718)).
+	*
+	* The gap this closes: {@link getProviderFor} decides SDK-vs-Cloud-Control
+	* from `property-coverage.generated.ts`, built offline from the schema
+	* fixtures, and there is no runtime `DescribeType` on that path. So a
+	* property AWS publishes AFTER the fixture snapshot produces no
+	* `silentDrop` entry, does not auto-route to Cloud Control, and is dropped
+	* with the deploy reporting success — the issue
+	* [#614](https://github.com/go-to-k/cdkd/issues/614) failure class reached
+	* through the one input the #614 machinery cannot observe. The scheduled
+	* fixture-refresh job is the FIX (the property enters the fixture and the
+	* existing auto-route handles it); this warn is what protects a user
+	* deploying BETWEEN refresh cycles.
+	*
+	* Fires only on the SDK route, which is where the drop actually happens.
+	* The two Cloud-Control routes both forward the full property map verbatim,
+	* so the property does reach AWS there and a warn would be false:
+	* - `provisionedBy: 'cc-api'` from existing state (sticky rule 2 of
+	*   {@link getProviderFor}), minus the `STICKY_CC_MIGRATION_EXEMPT` types
+	*   that deliberately re-route back to their SDK provider;
+	* - an actionable silent drop auto-routing this deploy (`autoRouted`).
+	*
+	* The route test MIRRORS `getProviderFor` rather than re-deriving it — the
+	* two answering differently is the only way this warn can be wrong about a
+	* resource, and it is not decidable from the message.
+	*
+	* **Known divergence, in the SAFE direction.** This runs on the template's
+	* RAW properties (`deploy-engine.ts` calls `validateResourceProperties`
+	* pre-flight) while `getProviderFor` runs on RESOLVED ones. So a silent-drop
+	* key present only behind an `Fn::If` that resolves to `AWS::NoValue` makes
+	* `autoRouted` true here and suppresses the warn, while the real route ends
+	* up on the SDK provider and does drop the unrecognized property. The result
+	* is a MISSING warn, never a false one — which is the right direction for an
+	* advisory line, and why this is documented rather than fixed by resolving
+	* twice. `getProviderFor` remains the authority on routing; nothing here
+	* changes a routing decision.
+	*
+	* Suppressed per `<Type>:<Prop>` by `--allow-unsupported-properties`, whose
+	* meaning ("accept the silent drop, stay on the SDK path") is exactly this
+	* case; deliberately no new flag. Warn rather than error because the drop
+	* may be intended, and deliberately NOT an auto-route: flipping to
+	* Cloud Control on an UNRECOGNIZED property would let a typo trigger the
+	* currently one-way `cc-api` state flip (issue
+	* [#2719](https://github.com/go-to-k/cdkd/issues/2719)), and CC would reject
+	* the unknown key anyway.
+	*/
+	reportUnrecognizedProperties(logicalId, resourceType, properties, route) {
+		if (route.provisionedBy === "cc-api" && !STICKY_CC_MIGRATION_EXEMPT.has(resourceType) || route.autoRouted) return;
+		const unrecognized = findUnrecognizedProperties(resourceType, properties).filter((property) => !this.allowedUnsupportedProperties.has(`${resourceType}:${property}`));
+		if (unrecognized.length === 0) return;
+		const propList = unrecognized.join(", ");
+		const overrideHint = unrecognized.map((p) => `${resourceType}:${p}`).join(",");
+		const one = unrecognized.length === 1;
+		this.logger.warn(`${logicalId} (${resourceType}): ${propList} ${one ? "is" : "are"} not in cdkd's CFn schema snapshot for this type, so ${one ? "it" : "they"} will NOT reach AWS — the deploy will still report success. Anything of these shapes looks the same here: a misspelled name (fix the spelling); a read-only attribute, which is not settable on any engine (remove it); or a property AWS published after cdkd's snapshot, which cdkd should be routing via Cloud Control — please report that one: ${unsupportedPropertyIssueUrl(resourceType, unrecognized[0])}${one ? "" : ` (link is for ${unrecognized[0]})`}. If the drop is intended — an addPropertyOverride escape hatch — silence this via --allow-unsupported-properties ${overrideHint}.`);
+	}
+	/**
 	* Pure-functional discovery of every resource whose template uses one or
 	* more silent-drop properties that are NOT in the
 	* `--allow-unsupported-properties` allow set — i.e. every resource that
@@ -29771,6 +30395,70 @@ function getCurrentResourceSecrets() {
 	return currentResourceSecretsStore.getStore();
 }
 
+//#endregion
+//#region src/deployment/type-change-guard.ts
+/**
+* The CFn type of a nested stack's row in its PARENT's template.
+*
+* Spelled locally rather than imported, matching
+* `src/deployment/recreate-targets.ts`: the only exported copy lives in
+* `src/cli/commands/retire-cfn-stack.ts`, and importing a CLI command module
+* from the deployment layer would invert the dependency direction.
+*/
+const NESTED_STACK_RESOURCE_TYPE = "AWS::CloudFormation::Stack";
+/**
+* Find every planned change whose recorded type and template type differ with
+* `AWS::CloudFormation::Stack` on one side.
+*
+* Reads exactly the two values the defect is made of: `change.resourceType`
+* (what `provisionResource` binds and routes BOTH replacement halves on) and
+* the state record's `resourceType` (the resource that actually exists). That
+* is deliberate — deriving the "desired" type from the template again would be
+* a second implementation of the diff's own Type-change rule (metadata skip,
+* condition pruning) which could drift away from the routing decision this
+* guards.
+*
+* `changeType` is not filtered on. A Type change surfaces as an `UPDATE`, but a
+* DELETE / NO_CHANGE row cannot diverge in the first place (the diff builds
+* both from the state record's own type), so filtering would only add a way for
+* a future change-shape to slip past.
+*/
+function findNestedStackTypeChanges(input) {
+	const found = [];
+	for (const [logicalId, change] of input.changes) {
+		if (!Object.hasOwn(input.stateResources, logicalId)) continue;
+		const currentResource = input.stateResources[logicalId];
+		if (!currentResource) continue;
+		const currentType = currentResource.resourceType;
+		const desiredType = change.resourceType;
+		if (currentType === desiredType) continue;
+		const intoNested = desiredType === NESTED_STACK_RESOURCE_TYPE;
+		if (!intoNested && !(currentType === NESTED_STACK_RESOURCE_TYPE)) continue;
+		found.push({
+			logicalId,
+			currentType,
+			desiredType,
+			physicalId: currentResource.physicalId,
+			direction: intoNested ? "into-nested-stack" : "out-of-nested-stack"
+		});
+	}
+	return found;
+}
+/**
+* Render the refusal. Names the logical id, BOTH types, the resource the
+* mis-routed delete would be aimed at, and what to do instead.
+*
+* `stackName` is the stack being deployed, so the into-nested arm can print the
+* child stack name `NestedStackProvider.delete` would derive and destroy — the
+* one piece of the damage the user cannot read off their own template.
+*/
+function renderNestedStackTypeChangeRefusal(typeChanges, stackName) {
+	const rows = typeChanges.map((tc) => {
+		return `${`  - ${tc.logicalId}: Type changes from ${tc.currentType} to ${tc.desiredType} (the existing ${tc.currentType} is ${tc.physicalId}).`}\n${tc.direction === "into-nested-stack" ? `    Both halves of the replacement would route on the TEMPLATE's type, so the existing resource's delete would be dispatched at the ${NESTED_STACK_RESOURCE_TYPE} provider — which ignores the physical id it is handed and instead destroys the nested child stack "${stackName}~${tc.logicalId}" and every resource that child owns. Where no such child exists the delete is a no-op and ${tc.physicalId} is silently leaked instead.` : `    Both halves of the replacement would route on the TEMPLATE's type, so the existing nested stack's delete would be dispatched at the ${tc.desiredType} provider, which cannot delete a nested stack — the child stack "${stackName}~${tc.logicalId}" and every resource it owns would be left behind, untracked.`}`;
+	});
+	return `Refusing to deploy ${stackName}: ` + (typeChanges.length === 1 ? `a resource changes its Type ` : `${typeChanges.length} resources change their Type `) + `into or out of ${NESTED_STACK_RESOURCE_TYPE}, which cdkd cannot replace safely (issue #2668).\n${rows.join("\n")}\n  Deploy this as two changes instead: give the new resource a DIFFERENT logical id (in CDK, rename the construct) so the existing row is deleted through its own type's provider and the new one is created under its own — or remove the resource in one deploy and add its replacement in the next. There is no flag that overrides this refusal: the delete's TARGET would be wrong, not merely its consequences.`;
+}
+
 //#endregion
 //#region src/deployment/outputs-export-alias.ts
 /**
@@ -30094,6 +30782,218 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/dynamodb-warm-throughput.ts
+/**
+* The two DynamoDB `WarmThroughput` rules that `AWS::DynamoDB::Table` and
+* `AWS::DynamoDB::GlobalTable` both need, in ONE spelling.
+*
+* `WarmThroughput` is the same CloudFormation block on both types, and both
+* providers have to answer the same two questions about it before an
+* `UpdateTable` / `CreateTable` goes out:
+*
+*  1. **Is this block SENDABLE, and as what numbers?** CloudFormation is
+*     stringly typed, so `{ReadUnitsPerSecond: '12000'}` — or anything that
+*     came back from an `Fn::Sub` — arrives as a STRING and must not be
+*     forwarded verbatim into a numeric `Long` field.
+*  2. **Would sending it LOWER what AWS already reports?** Warm throughput
+*     only ever rises with a table's traffic and AWS REJECTS a call that
+*     lowers it (`decreasing WarmThroughput is not supported`, measured live
+*     us-east-1 2026-08-13 for issue #1768).
+*
+* **Provenance, stated precisely because it is easy to over-claim.** Exactly
+* ONE of these rules ever shipped: `AWS::DynamoDB::Table` got them in PR #1808
+* (issues #1760 / #1768), and the `AWS::DynamoDB::GlobalTable` side never
+* existed outside the change that created this file (issue #1857). So this is
+* the Table rule LIFTED — not two shipped rules reconciled, and no deployed
+* behaviour changed for either type when it moved here.
+*
+* What WAS compared is the lifted rule against the GlobalTable spelling
+* drafted alongside it, over the shapes both had to answer (a quoted numeric
+* string, a partially usable block, a mixed decrease/increase, an absent live
+* value, a zero, a negative, a non-numeric string, a whitespace string, an
+* explicit `undefined` / `null`, a boolean, an empty block, a scalar, an
+* array). {@link isWarmThroughputDecrease} agreed on every one; the coercion
+* agreed on all but a whitespace-only string, where a bare `Number('   ')` is
+* `0` rather than `NaN`. This module keeps the REFUSING answer for that shape,
+* since `'   '` is not a capacity anyone declared and a warm throughput of 0
+* is not a request AWS can honour. That is a DRAFT reconciled against a
+* shipped rule, which is worth less than two shipped rules agreeing — the
+* reason to read the probe list as a design note rather than as field
+* evidence.
+*
+* Living here rather than in either provider is the point. A decrease guard is
+* three clauses that all FAIL OPEN for different reasons, and two files
+* spelling it independently is two chances for a later "fix" to change one of
+* them — at which point the sibling type silently keeps the old answer, and
+* nothing in the tree says which is intended. Same class as
+* `emr-configuration.ts`, and the same reason.
+*
+* Deliberately NOT here: everything only ONE provider has. The `Table` side's
+* `isSendableWarmThroughput` / `isRefusedWarmThroughput` /
+* `declaresWarmThroughput` / `warmThroughputAlreadyMatches` are its drift-side
+* and already-matches gates, which `GlobalTable` has no counterpart to (issue
+* #1742 strips the per-index `WarmThroughput` from BOTH of its drift
+* comparison sides unconditionally, so drift never asks the question there);
+* the `GlobalTable` side's `warmThroughputDiagnostic` builds a
+* `ThroughputDiagnostic` that only that provider's collector understands.
+* Moving a helper with one caller here would buy nothing and cost a hop.
+*
+* Issues: #1760 / #1768 (Table, PR #1808), #1857 (GlobalTable).
+*/
+/**
+* The two `WarmThroughput` members, in the ONE order every message, every
+* comparison and every emitted block uses. A shared order is what makes two
+* blocks carrying the same numbers compare equal by `deepEqual` and serialize
+* to the same wire bytes regardless of the order the template wrote them in.
+*/
+const WARM_THROUGHPUT_MEMBERS = ["ReadUnitsPerSecond", "WriteUnitsPerSecond"];
+/**
+* A CloudFormation-borne numeric property, or `undefined` when the value is
+* not a usable number.
+*
+* Plain `Number()` coercion is NOT good enough and the tree learned it three
+* separate times: `Number(null)`, `Number('')`, `Number([])`, `Number(false)`
+* and `Number('   ')` are all **0**, not `NaN` — so a live `0` would compare
+* EQUAL to a desired `null` / `''` / `[]` / `false`, and a whitespace-only
+* string would be forwarded as a request for zero units.
+*
+* A YAML-borne numeric STRING is still accepted, because that is a real
+* template shape and `'12000'` genuinely means 12000.
+*
+* The accepted STRING set is `Number()`'s, which is WIDER than a decimal
+* integer: `'0x1e'`, `'0o36'`, `'1e3'`, `'30.5'` and `' 30 '` all coerce.
+* Whether CloudFormation accepts those for an `Integer`-typed property is
+* unmeasured, and issue [#2698](https://github.com/go-to-k/cdkd/issues/2698)
+* holds the live A/B that would settle it. It matters at the CALLERS that
+* FORWARD the result to AWS rather than merely compare it — narrowing this
+* shared helper would change the DynamoDB capacity readers too, so read that
+* issue before tightening anything here.
+*
+* EXPORTED, and not because warm throughput needs it exported. This exact rule
+* was hand-written three times — here, as `dynamodb-table-provider.ts`'s
+* `capacityNumber` (byte-identical), and as `dynamodb-globaltable-provider.ts`'s
+* `toFiniteNumber` (a different spelling of the same total function) — which is
+* precisely the divergence this module exists to stop: the next "fix" to one of
+* them would have left the other two answering differently, with nothing in the
+* tree saying which was intended. It reads `ReadCapacityUnits` /
+* `MaxReadRequestUnits` / `MinCapacity` as readily as it reads
+* `ReadUnitsPerSecond`; there is only ever one right answer for "is this
+* stringly-typed CFn value a number I can send?".
+*/
+function toFiniteNumber(value) {
+	if (typeof value === "number") return Number.isFinite(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== "") {
+		const n = Number(value);
+		return Number.isFinite(n) ? n : void 0;
+	}
+}
+/**
+* Coerce a CFn `WarmThroughput` block to the numeric shape the SDK's `Long`
+* fields accept, PER MEMBER.
+*
+* PER MEMBER, not whole-block, and that distinction is the point: a block
+* whose write half is an unresolved intrinsic still has a perfectly good read
+* half, and dropping both would silently discard a value the template really
+* did ask for. The dropped member is NAMED (`droppedMembers`) so the caller's
+* warning can say which half went missing instead of reporting the whole
+* property.
+*
+* A block with NO usable member yields `spec: undefined` — refused rather than
+* forwarded, because forwarding a malformed block surfaces as an opaque AWS
+* validation error naming neither cdkd nor the property. `droppedMembers` is
+* still populated in that case, so a REFUSAL message can name what it refused;
+* a block that is not an object at all (an unresolved `Fn::If`, a scalar, an
+* array) has no member to name and reports none, which is what lets a caller
+* word "one half went missing" differently from "the block is unusable".
+*
+* Pure: takes the raw bag, returns numbers, logs nothing. Each caller owns its
+* own message, so the wording stays consistent across that provider's send
+* sites without forcing one wording across both providers.
+*/
+function coerceWarmThroughput(raw) {
+	if (typeof raw !== "object" || raw === null || Array.isArray(raw)) return { droppedMembers: [] };
+	const bag = raw;
+	const spec = {};
+	const droppedMembers = [];
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (bag[member] === void 0) continue;
+		const coerced = toFiniteNumber(bag[member]);
+		if (coerced === void 0) {
+			droppedMembers.push(member);
+			continue;
+		}
+		spec[member] = coerced;
+	}
+	if (Object.keys(spec).length === 0) return { droppedMembers };
+	return {
+		spec,
+		droppedMembers
+	};
+}
+/**
+* Whether the COERCED desired `WarmThroughput` would LOWER what AWS already
+* reports.
+*
+* Measured live (us-east-1, 2026-08-13, issue #1768) against a table AWS
+* reports `{ReadUnitsPerSecond: 12000, WriteUnitsPerSecond: 4000}` for:
+*
+* ```
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000, WriteUnitsPerSecond: 2000}
+*   ValidationException: One or more parameter values were invalid: Requested
+*   ReadUnitsPerSecond for WarmThroughput for table is lower than current
+*   WarmThroughput, decreasing WarmThroughput is not supported
+* UpdateTable WarmThroughput={ReadUnitsPerSecond: 6000}      -> same rejection
+* UpdateTable WarmThroughput={WriteUnitsPerSecond: 2000}     -> same rejection, naming WriteUnitsPerSecond
+* UpdateTable WarmThroughput={12000, 4000}  (re-assert)      -> ACCEPTED
+* ```
+*
+* So the value is one AWS raises with the table's traffic and never lowers,
+* and a decrease is REJECTED rather than accepted-and-ignored — which is what
+* had to be measured before choosing, because the two produce different
+* correct answers. The caller SKIPS the call on a true here.
+*
+* Evaluated on the COERCED spec, never on the raw bag: analysing the raw bag
+* makes the verdict describe a request that is not the one being sent (a
+* dropped member is not part of the call and must not be part of the
+* comparison).
+*
+* Semantics, all three chosen to FAIL OPEN — i.e. to let the call through and
+* leave AWS as the authority — because a false positive here silently drops a
+* legitimate INCREASE, which is a real capacity change the user asked for,
+* while a false negative merely reproduces the pre-fix behaviour of an
+* AWS-side rejection that names the property:
+*  - DECLARED members only. An absent member is not a request to lower
+*    anything, so it takes no part in the verdict.
+*  - MIXED is not a decrease. One member below live and the other above means
+*    the call carries a genuine increase; AWS decides.
+*  - An absent or unusable LIVE counterpart is not a decrease. Without a
+*    number to compare against there is no evidence of one. Only the LIVE side
+*    can reach that arm: the desired side is a COERCED spec, so a malformed
+*    template value has already been dropped by {@link coerceWarmThroughput}.
+*
+* A decrease therefore requires every declared member to be at-or-below live
+* AND at least one to be strictly below.
+*
+* The skip this drives is right for EVERY `update()` caller — the deploy
+* engine, `cdkd drift --revert`, and the rollback executor's two revert arms —
+* because none of them can make AWS lower the value, so none loses anything a
+* doomed call would have achieved.
+*/
+function isWarmThroughputDecrease(desired, live) {
+	if (desired === void 0 || live === void 0) return false;
+	let sawDecrease = false;
+	for (const member of WARM_THROUGHPUT_MEMBERS) {
+		if (desired[member] === void 0) continue;
+		const wanted = toFiniteNumber(desired[member]);
+		const current = toFiniteNumber(live[member]);
+		if (wanted === void 0 || current === void 0) return false;
+		if (wanted > current) return false;
+		if (wanted < current) sawDecrease = true;
+	}
+	return sawDecrease;
+}
+
 //#endregion
 //#region src/provisioning/stateful-types.ts
 /**
@@ -30140,9 +31040,12 @@ function formatResourceLine(op, logicalId, resourceType, verbOverride) {
 *     "never expire" — the most data-bearing configuration the type
 *     has, and what `LogsLogGroupProvider` records `0` for — so reading
 *     it as "holds nothing" destroyed years of events on a plain
-*     `cdkd deploy`. A recorded `RetentionInDays > 0` still answers
-*     `has-retention` from the bag alone (a cheap positive, never
-*     probed away); every other bag DEFERS, exactly as the bucket does.
+*     `cdkd deploy`. A `RetentionInDays > 0` recorded in EITHER of the
+*     state record's property bags still answers `has-retention` from
+*     the bags alone (a cheap positive, never probed away); every other
+*     bag DEFERS, exactly as the bucket does. Which bags, and why the
+*     value is coerced rather than type-tested, is issue [#2521] —
+*     see {@link logGroupHasPositiveRetention}.
 *     The pre-flight resolves the deferral with a live
 *     `logs:DescribeLogStreams` probe (a log group with no stream can
 *     hold no event, since every event belongs to a stream); mid-deploy,
@@ -30327,10 +31230,66 @@ const STATEFUL_TYPES = /* @__PURE__ */ new Set([
 */
 const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::DynamoDB::GlobalTable"]);
 /**
-* Cheap, synchronous read of the resource's recorded properties only.
+* Does either recorded bag prove this log group carries a POSITIVE
+* `RetentionInDays`? (issue [#2521])
+*
+* Two decisions, and both were defects before this function existed.
+*
+* **The value is COERCED, not type-tested.** The predicate used to gate on
+* `typeof retention === 'number' && retention > 0`, and CloudFormation is
+* stringly typed: a hand-written L1, an `Fn::Sub`-produced value, a
+* `Type: String` parameter's default, or a record imported by
+* `cdkd import --migrate-from-cloudformation` all put `'30'` into the bag,
+* where the type test answers "not a number". {@link toFiniteNumber} is the
+* repo's single answer to "is this stringly-typed CFn value a number?" —
+* imported rather than re-spelled here for the reason its own doc gives, that
+* the same rule hand-written twice diverges on the next fix to one copy. It
+* rejects `''`, `'   '`, `null`, `[]` and `false`, each of which a bare
+* `Number()` turns into a `0` that would read as never-expire.
+*
+* **BOTH bags are consulted, and a positive in EITHER wins.** The old read
+* saw `properties` alone, so a retention set OUT OF BAND (the console,
+* `aws logs put-retention-policy`, another tool) or one recorded only in
+* `observedProperties` — an imported record whose template never declared
+* the property — never produced `has-retention`.
+*
+* The rule is a plain OR, and the loop order below is INERT — a review round
+* caught an earlier version of this paragraph claiming `observedProperties`
+* is "read FIRST", a precedence the code does not implement and must not.
+* A strict "observed when present, else properties" rule — which is what
+* issue [#2521] literally prescribed — was tried and REJECTED:
+* `LogsLogGroupProvider.readCurrentState` writes `RetentionInDays: 0` for a
+* group with no retention policy, so the observed bag almost always CARRIES
+* the key, and precedence would make the recorded bag dead for every record
+* that has ever been captured and would DROP the `has-retention` verdict this
+* guard already produced. A test pins that rejection
+* (`tests/unit/provisioning/stateful-types.test.ts`, "reads a retention that
+* lives ONLY in properties, even against a ZERO observed one"). The OR is
+* also the strictly safer direction: it can only ADD refusals, never remove
+* one.
+*
+* What a `false` here means is DEFER, not "holds nothing" — see the callers.
+*/
+function logGroupHasPositiveRetention(recordedProperties, observedProperties) {
+	for (const bag of [observedProperties, recordedProperties]) {
+		const retention = toFiniteNumber(bag?.["RetentionInDays"]);
+		if (retention !== void 0 && retention > 0) return true;
+	}
+	return false;
+}
+/**
+* Cheap, synchronous read of the state record's own property bags only —
+* no AWS call. Both bags are parameters rather than one: `properties` is
+* what the last deploy applied, `observedProperties` what it read back,
+* and the log group's arm consults BOTH (issue [#2521]). Passing the
+* observed bag is REQUIRED, not optional, so a new call site has to
+* decide what it holds instead of silently repeating the omission that
+* issue records; `undefined` is the right answer where no record is in
+* hand (`recreate-confirm-prompt.ts`).
+*
 * TWO types return `null` meaning DEFER rather than "not stateful":
-* `AWS::S3::Bucket` always, and `AWS::Logs::LogGroup` whenever the
-* recorded bag does not already prove `has-retention`. The live probes
+* `AWS::S3::Bucket` always, and `AWS::Logs::LogGroup` whenever neither
+* bag already proves `has-retention`. The live probes
 * that resolve both deferrals (`ListObjectVersions` for the bucket,
 * `DescribeLogStreams` for the log group) live in
 * `src/deployment/recreate-targets.ts#probeStatefulRecreateTargetsAsync`
@@ -30343,11 +31302,10 @@ const MULTI_REGION_RECREATE_BLOCKED_TYPES = /* @__PURE__ */ new Set(["AWS::Dynam
 * Returns the {@link StatefulReason} when the type is stateful (or
 * `null` for non-stateful types).
 */
-function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
+function isStatefulRecreateTargetSync(resourceType, recordedProperties, observedProperties) {
 	if (!STATEFUL_TYPES.has(resourceType)) return null;
 	if (resourceType === "AWS::Logs::LogGroup") {
-		const retention = recordedProperties?.["RetentionInDays"];
-		if (typeof retention === "number" && retention > 0) return "has-retention";
+		if (logGroupHasPositiveRetention(recordedProperties, observedProperties)) return "has-retention";
 		return null;
 	}
 	if (resourceType === "AWS::S3::Bucket") return null;
@@ -30374,16 +31332,38 @@ function isStatefulRecreateTargetSync(resourceType, recordedProperties) {
 * — be DELETE + CREATEd (data loss) without `--force-stateful-recreation`. To
 * stay fail-safe, both deferrals resolve to stateful here: the user must pass
 * `--force-stateful-recreation` to replace ANY S3 bucket, and any log group
-* whose recorded bag does not already prove `has-retention`, on any of those
-* paths — empty or not.
+* neither of whose recorded property bags already proves `has-retention`, on
+* any of those paths — empty or not.
+*
+* `UpdateReplacePolicy: Retain` is the standing EXEMPTION, and it covers all
+* three (issue [#2604]): the engine never consults this predicate under it —
+* the property-driven guard tests `updateReplacePolicy !== 'Retain'`
+* directly, and the fallback's two triggers short-circuit through
+* `retainOldOnReplace`, which issue [#2518] added. The old resource survives
+* the replacement, so there is no data loss to confirm, and the refusal's own
+* remedy would have destroyed exactly what the user asked to keep.
+* `Snapshot` is NOT exempt on any of them — a snapshot is a copy, not a
+* surviving resource. So read the paragraph above as scoped to a template
+* that is not retaining.
+*
+* The two engine sites are not the only callers: a THIRD sits outside those
+* paths and outside that exemption — `recreate-confirm-prompt.ts` re-derives
+* a `null` verdict for the `--recreate-via-*` pre-flight, where
+* `--force-stateful-recreation` is what skipped the probe.
+* `stateful-replace-message-doc-sync` pins the whole guard's reader list by
+* file, but the residuals comment above its own walk enumerates what that
+* cannot see — among them an ALIASED import, a `.mts` / `.cts` reader, and,
+* the one that bit, a NEW PATH routed through an existing call site, which
+* adds no file and reds nothing (issue [#2514]'s shape). So this enumeration
+* is maintained by hand.
 *
 * The log group's arm is the one issue [#2558] added, and the reason it is
 * needed is that the old predicate treated "no retention recorded" as "holds
 * nothing" when it is CloudWatch Logs' never-expire. Every other type matches
 * {@link isStatefulRecreateTargetSync} exactly.
 */
-function isStatefulRecreateTargetForReplace(resourceType, recordedProperties) {
-	const sync = isStatefulRecreateTargetSync(resourceType, recordedProperties);
+function isStatefulRecreateTargetForReplace(resourceType, recordedProperties, observedProperties) {
+	const sync = isStatefulRecreateTargetSync(resourceType, recordedProperties, observedProperties);
 	if (sync) return sync;
 	if (resourceType === "AWS::S3::Bucket") return "has-objects";
 	if (resourceType === "AWS::Logs::LogGroup") return "has-log-events";
@@ -31545,6 +32525,84 @@ function rollbackFinalSnapshotId(resourceType, record, fallbackProvisionedBy) {
 	return buildFinalSnapshotIdentifier(record.physicalId, resourceType);
 }
 /**
+* `UpdateReplacePolicy: Retain` on the resource a replacement CREATED — the
+* copy a rollback would otherwise destroy (issue
+* [#2598](https://github.com/go-to-k/cdkd/issues/2598)).
+*
+* Reads the CURRENT record, i.e. the one the replacing deploy wrote from the
+* template it was applying (`extractTemplateAttributes`), so the attribute
+* consulted is the one that was in force when the new copy was created. Its
+* `Snapshot` sibling, {@link rollbackFinalSnapshotId}, reads the same field of
+* the same record — `Retain` and `Snapshot` are alternative values of ONE
+* attribute, so the two can never both apply.
+*
+* **`UpdateReplacePolicy`, NOT `DeletionPolicy`, and that is measured, not
+* reasoned.** The repo refuses a CloudFormation-parity claim taken on
+* folklore, and the AWS documentation answers nothing here: every sentence on
+* both attribute pages, in the API reference and in the release notes
+* describes the OLD resource, never the new copy's fate during a rollback. A
+* live four-variant A/B (2026-09-05, us-east-1: a forced `AWS::SSM::Parameter`
+* replacement plus a deterministically failing sibling, rolled back) settled
+* it:
+*
+* | DeletionPolicy | UpdateReplacePolicy | new copy  | decisive event   |
+* | -------------- | ------------------- | --------- | ---------------- |
+* | (none)         | (none)              | DELETED   | `DELETE_COMPLETE` |
+* | Retain         | (none)              | DELETED   | `DELETE_COMPLETE` |
+* | (none)         | Retain              | SURVIVED  | `DELETE_SKIPPED`  |
+* | Retain         | Retain              | SURVIVED  | `DELETE_SKIPPED`  |
+*
+* Row 2 alone refutes "`DeletionPolicy` governs it"; row 3 alone refutes
+* "neither — always deleted". The old copy was restored intact in all four,
+* and both outcomes land in `UPDATE_ROLLBACK_COMPLETE_CLEANUP_IN_PROGRESS`.
+*
+* A retained new copy is ORPHANED OUT of the stack, not kept as a managed
+* resource — the A/B proved it by deleting the whole stack afterwards and
+* finding the retained parameter still alive. So every caller below leaves NO
+* state record naming the survivor: the two arms that can complete point state
+* at the old resource exactly as they already did, and the survivor becomes
+* untracked. That is the same disposition the deploy engine gives a
+* `Retain`-orphaned OLD resource, so the two directions agree.
+*
+* LIMIT OF THAT EVIDENCE, stated so a later reader does not over-read it: all
+* four variants carried the SAME policy in both template versions, so the A/B
+* pinned WHICH ATTRIBUTE wins and did NOT discriminate which template's copy
+* of it is read. This function reads the current record for the reasons above
+* (it is the one the new copy was created under, and it matches the
+* `Snapshot` sibling and both CREATE-rollback arms), not because the A/B
+* settled that question.
+*/
+function rollbackRetainsNewResource(record) {
+	return record?.updateReplacePolicy === "Retain";
+}
+/**
+* The two sentences a `UpdateReplacePolicy: Retain` survivor needs: the `⚠`
+* terminal warning and the compact `reason` that rides on the durable
+* `ROLLBACK_RESOURCE_SUCCEEDED` event.
+*
+* ONE function because the two must not drift apart. Both replacement-rollback
+* retain arms produced these by hand, four near-identical copies, and the
+* failure mode a reviewer named is precise: the warn and the DURABLE record
+* disagreeing about which id survived. Deriving both from one set of inputs
+* makes that unrepresentable. The shapes stay deliberately different -- the
+* warn carries the cost/`cdkd destroy` guidance a human reads once, the reason
+* stays compact for a `--json` consumer -- so this is one input set, not one
+* string.
+*
+* `stateClause` is the only thing that differs between the two arms (the
+* readopt arm restores the old id; the create-first arm records a re-created
+* one), so it is a parameter rather than a branch in here.
+*
+* NOT used by the delete-failed survivor a few lines down: that one is an
+* orphan by OUTCOME rather than by policy, and says so.
+*/
+function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, stateClause) {
+	return {
+		warn: `  ⚠ ${logicalId} (${resourceType}) has UpdateReplacePolicy: Retain — the replacement's new physical resource (${survivorPhysicalId}) is RETAINED by this rollback and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need it. ${stateClause}`,
+		reason: `UpdateReplacePolicy: Retain kept the replacement's new ${resourceType} (${survivorPhysicalId}); it is live, still billing, and no longer tracked by cdkd. ${stateClause}`
+	};
+}
+/**
 * `DeletionPolicy: Snapshot` on a rolled-back CREATE (issue #1358) — the
 * executor's copy of the deploy engine's `prepareFinalSnapshotForDelete`
 * mechanism matrix, run BEFORE the delete. Shared with the FAILED in-flight
@@ -31643,7 +32701,7 @@ function classifyRollbackOp(op, stateResources, orphanLogicalIds) {
 			if (deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
 			return "skip-mismatch";
 		}
-		return op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
+		return op.oldResourceRetained ?? op.previousState.updateReplacePolicy === "Retain" ? "reverse-replacement-readopt" : "reverse-replacement";
 	}
 	if (op.previousState && deepEqual(current.properties, op.previousState.properties)) return "skip-already-done";
 	return "revert";
@@ -31683,12 +32741,16 @@ function planFailedOps(failedOps, stateResources) {
 */
 function planRollback(operations, stateResources, orphanLogicalIds = /* @__PURE__ */ new Set()) {
 	const { createOps, otherOps } = partitionOps(operations);
-	return [...[...otherOps].reverse(), ...sortRollbackCreates(createOps, stateResources)].map((op) => ({
-		op,
-		action: classifyRollbackOp(op, stateResources, orphanLogicalIds),
-		replacement: isReplacementOp(op),
-		effectiveProvisionedBy: effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy)
-	}));
+	return [...[...otherOps].reverse(), ...sortRollbackCreates(createOps, stateResources)].map((op) => {
+		const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
+		return {
+			op,
+			action,
+			replacement: isReplacementOp(op),
+			effectiveProvisionedBy: effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy),
+			retainsNewResource: (action === "reverse-replacement" || action === "reverse-replacement-readopt") && rollbackRetainsNewResource(stateResources[op.logicalId])
+		};
+	});
 }
 function partitionOps(operations) {
 	const createOps = [];
@@ -32046,11 +33108,32 @@ async function resolveLeafByRegion(leaf, propertyPath, logicalId, execCtx, resol
 * writer is one of only two that can honestly claim it.
 *
 * Using `STATE_SOURCED_READBACK_RULES` here reads plausible and is wrong in the
-* quiet direction: it turns positional array descent off. Since issue #1915 a
-* `Tags[]` / ECS `Environment[]` element is reached by KEYED descent either
-* way, so the concrete loss is narrower than it was — it is a list whose
-* elements carry no `Name` / `Key` identity, which only positional descent can
-* walk.
+* quiet direction: it turns BLIND positional array descent off. BLIND is
+* load-bearing, and an earlier revision of this paragraph omitted it — the
+* concrete loss is narrower than "positional descent is off" makes it sound,
+* by TWO mechanisms rather than one:
+*
+*  - Since issue #1915 a `Tags[]` / ECS `Environment[]` element is reached by
+*    the order-independent KEYED descent either way.
+*  - Since issue #2012 an UNKEYED list is reached too, under corroboration.
+*    That is not a general relaxation: swapping this constant in would satisfy
+*    all three conjuncts of `isReadbackProjectedFromState`
+*    (`trustAnyExpression && !descendArrays && sourceIsSameGeneration`), which
+*    ARMS `refuseUncertifiedReadbackPositions`, and its unkeyed arm walks
+*    element i against element i whenever `unkeyedArrayPairsByAnchors`
+*    corroborates the alignment (index counts match; every position whose
+*    SOURCE subtree carries no dynamic reference is deep-equal on both sides;
+*    every reference-bearing element carries a distinguishing anchor of its own
+*    or, being a bare reference leaf, leans on the array's literal frame; and
+*    no two reference-bearing elements share an order-insensitive anchor
+*    signature).
+*
+* So the residual loss is narrower again: an unkeyed list whose positions ALSO
+* fail to corroborate. The CONCLUSION is unchanged — `STATE_DERIVED_RULES` is
+* still right here, for the reason one paragraph up (the bag was produced by
+* resolving the source, so the two correspond positionally by construction and
+* need no corroboration to say so). What changes is only how much a reader
+* should think the alternative costs (issue #2691).
 *
 * No-op when the op resolved no secret.
 */
@@ -32260,7 +33343,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				return;
 			case "orphan-flag":
 				if (op.changeType === "CREATE") {
-					const orphanFlagProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
+					const record = stateResources[op.logicalId];
+					const orphanFlagProvisionedBy = effectiveProvisionedBy(record, op.provisionedBy);
 					createRollbackRoute = orphanFlagProvisionedBy;
 					delete stateResources[op.logicalId];
 					logger.info(`  Rollback: Orphaning created resource ${op.logicalId} (--orphan)`);
@@ -32271,12 +33355,17 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						operation: "CREATE",
 						logicalId: op.logicalId,
 						resourceType: op.resourceType,
-						...orphanFlagProvisionedBy && { provisionedBy: orphanFlagProvisionedBy }
+						...orphanFlagProvisionedBy && { provisionedBy: orphanFlagProvisionedBy },
+						...record?.physicalId && {
+							physicalId: record.physicalId,
+							reason: `--orphan left ${op.logicalId} (${op.resourceType}) in AWS as ${record.physicalId} and dropped it from state; it is live, still billing, and no longer tracked by cdkd.`
+						}
 					});
 				} else logger.info(`  Rollback: Leaving ${op.logicalId} at its new state (--orphan)`);
 				return;
 			case "orphan-retain": {
-				const orphanProvisionedBy = effectiveProvisionedBy(stateResources[op.logicalId], op.provisionedBy);
+				const record = stateResources[op.logicalId];
+				const orphanProvisionedBy = effectiveProvisionedBy(record, op.provisionedBy);
 				createRollbackRoute = orphanProvisionedBy;
 				delete stateResources[op.logicalId];
 				logger.info(`  Rollback: Leaving ${op.logicalId} (${op.resourceType}) in AWS (DeletionPolicy: Retain) — removed from state`);
@@ -32287,7 +33376,11 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					operation: "CREATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...orphanProvisionedBy && { provisionedBy: orphanProvisionedBy }
+					...orphanProvisionedBy && { provisionedBy: orphanProvisionedBy },
+					...record?.physicalId && {
+						physicalId: record.physicalId,
+						reason: `DeletionPolicy: Retain left ${op.logicalId} (${op.resourceType}) in AWS as ${record.physicalId} and dropped it from state; it is live, still billing, and no longer tracked by cdkd.`
+					}
 				});
 				return;
 			}
@@ -32330,11 +33423,32 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				const current = stateResources[op.logicalId];
 				const prev = op.previousState;
 				logger.info(`  Rollback: Reversing replacement of ${op.logicalId} (${op.resourceType}) — deleting the new resource and re-adopting the retained old one (${prev.physicalId})`);
-				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
-					resourceType: op.resourceType,
-					provisionedBy: current.provisionedBy ?? op.provisionedBy
-				});
-				{
+				/**
+				* Set when this arm ORPHANS the replacement's new copy. Read at the
+				* `ROLLBACK_RESOURCE_SUCCEEDED` event below, which is the only channel
+				* that OUTLIVES the terminal (security review of issue #2598): a
+				* rollback runs during an already-failing deploy, often non-TTY with
+				* the log truncated or discarded, so a `logger.warn` is the least
+				* likely thing the user still has. Without this the survivor's id dies
+				* with the terminal -- `cdkd events` shows a clean success and state
+				* names only the OLD resource, while a live, billing, untracked copy
+				* remains. `Retain` is precisely the marker users put on data-bearing
+				* resources, so that is the worst population to lose the id for.
+				*
+				* Same shape as the `rollbackPartial` survivor record ~700 lines down
+				* and as the deploy engine's `RESOURCE_SKIPPED` twin.
+				*/
+				let survivorReason;
+				if (rollbackRetainsNewResource(current)) {
+					const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, current.physicalId, `State is restored to the old resource (${prev.physicalId}).`);
+					logger.warn(survivorMessages.warn);
+					survivorReason = survivorMessages.reason;
+					result.warnings++;
+				} else {
+					const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+						resourceType: op.resourceType,
+						provisionedBy: current.provisionedBy ?? op.provisionedBy
+					});
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
 					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
@@ -32344,13 +33458,19 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 				stateResources[op.logicalId] = prev;
 				logger.info(`  Rollback: ${op.logicalId} restored to the retained old resource`);
 				await afterOp?.(op.logicalId);
+				const survivorProvisionedBy = current.provisionedBy;
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
 					stackName,
 					operation: "UPDATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					...op.provisionedBy && { provisionedBy: op.provisionedBy },
+					...survivorReason !== void 0 && {
+						physicalId: current.physicalId,
+						reason: maskSecretsInText(survivorReason, secrets),
+						...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
+					}
 				});
 				return;
 			}
@@ -32366,10 +33486,10 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					resourceType: op.resourceType,
 					provisionedBy: prev.provisionedBy
 				});
-				const { provider: newDeleteProvider } = ctx.providerRegistry.getProviderFor({
+				const resolveNewDeleteProvider = () => ctx.providerRegistry.getProviderFor({
 					resourceType: op.resourceType,
 					provisionedBy: current.provisionedBy ?? op.provisionedBy
-				});
+				}).provider;
 				let deletedNewFirst = false;
 				let createResult;
 				try {
@@ -32378,11 +33498,13 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 						interruptedMessage: "Rollback interrupted while waiting out the name cooldown"
 					});
 				} catch (createError) {
-					if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
+					const msg = createError instanceof Error ? createError.message : String(createError);
+					if (!isNameCollisionError(msg)) throw createError;
+					if (rollbackRetainsNewResource(current)) throw markNonRetryable(new CdkdError(maskSecretsInText(`Cannot reverse the replacement of ${op.logicalId} (${op.resourceType}): the re-create of the old resource (${prev.physicalId}) collided with the name still held by the new one (${current.physicalId}), and UpdateReplacePolicy: Retain pins that new resource in place, so cdkd will not delete it to free the name. Delete the new resource yourself, or remove UpdateReplacePolicy: Retain, then re-run \`cdkd rollback\` — the journal is kept, so the revert resumes from here. To leave THIS resource alone and let the rest of the rollback proceed, re-run with \`cdkd rollback --orphan ${op.logicalId}\`: one op failure stops the segment loop, so a single pinned resource otherwise halts every OLDER segment too. Underlying collision: ${msg}`, secrets), "NAMED_REPLACEMENT_COLLISION", maskSecretsInError(createError instanceof Error ? createError : void 0, secrets)));
 					logger.info(`  Rollback: re-create collided with the new resource's name — deleting the new resource (${current.physicalId}) first...`);
 					{
 						const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-						throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+						throwIfDeleteSkipped(await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 							expectedRegion: ctx.region,
 							...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 						}), op.logicalId, current.physicalId, "while clearing the new resource so the old one could be re-created");
@@ -32396,7 +33518,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 							interruptedMessage: "Rollback interrupted while waiting for the old name to release"
 						});
 					} catch (recreateError) {
-						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets));
+						throw new Error(maskSecretsInText(`Failed to re-create the old ${op.logicalId} after the new resource (${current.physicalId}) was already deleted: ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. The resource is now absent — fix forward with 'cdkd deploy'.`, secrets), { cause: maskSecretsInError(recreateError instanceof Error ? recreateError : void 0, secrets) });
 					}
 				}
 				const adoptedLiveNewResource = !deletedNewFirst && createResult.physicalId === current.physicalId;
@@ -32412,24 +33534,37 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 					properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
 				}, secrets, prevRecord.properties);
 				await afterOp?.(op.logicalId);
-				if (!deletedNewFirst && !adoptedLiveNewResource) try {
+				let survivorReason;
+				if (!deletedNewFirst && !adoptedLiveNewResource && rollbackRetainsNewResource(current)) {
+					const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, current.physicalId, `State records the re-created old resource (${stateResources[op.logicalId]?.physicalId ?? prev.physicalId}).`);
+					logger.warn(survivorMessages.warn);
+					survivorReason = survivorMessages.reason;
+					result.warnings++;
+				} else if (!deletedNewFirst && !adoptedLiveNewResource) try {
 					const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-					throwIfDeleteSkipped(await newDeleteProvider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+					throwIfDeleteSkipped(await resolveNewDeleteProvider().delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
 						expectedRegion: ctx.region,
 						...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier }
 					}), op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one");
 				} catch (deleteError) {
 					logger.warn(maskSecretsInText(`  Rollback: old ${op.logicalId} re-created, but deleting the new resource (${current.physicalId}) failed: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. Delete it manually — it is no longer tracked in state.`, secrets));
+					survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${deleteError instanceof Error ? deleteError.message : String(deleteError)}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
 					result.warnings++;
 				}
 				logger.info(adoptedLiveNewResource ? `  Rollback: ${op.logicalId} adopted the live resource (${createResult.physicalId}) — replacement NOT fully reversed (name-idempotent Create API)` : `  Rollback: ${op.logicalId} replacement reversed (old resource re-created as ${createResult.physicalId})`);
+				const survivorProvisionedBy = current.provisionedBy;
 				ctx.recordEvent?.({
 					eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
 					stackName,
 					operation: "UPDATE",
 					logicalId: op.logicalId,
 					resourceType: op.resourceType,
-					...op.provisionedBy && { provisionedBy: op.provisionedBy }
+					...op.provisionedBy && { provisionedBy: op.provisionedBy },
+					...survivorReason !== void 0 && {
+						physicalId: current.physicalId,
+						reason: maskSecretsInText(survivorReason, secrets),
+						...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
+					}
 				});
 				return;
 			}
@@ -33118,7 +34253,10 @@ var DeploymentEventsReader = class {
 	* window and rewrites (or removes) `index.json` to match.
 	*
 	* Retention semantics (see {@link DeploymentEventsPruneOptions}):
-	*   - `all`        — delete every run + the index (full purge).
+	*   - `all`        — delete every run + the index. Clears the LISTING only:
+	*                    this deletes by key with no `VersionId`, so on a
+	*                    versioned bucket every earlier version survives
+	*                    (issue #2624).
 	*   - `keep N`     — retain the newest N runs, delete the rest.
 	*   - `olderThanMs`— delete runs whose run-id timestamp is older than the
 	*                    cutoff; a run id with no parseable timestamp is kept.
@@ -33238,31 +34376,15 @@ var InterruptedError = class extends Error {
 		this.name = "InterruptedError";
 	}
 };
-/**
-* Best-effort routing inference for the live-progress task label
-* (#614 §9). Mirrors the routing decision tree but is purely cosmetic:
-* errors here never surface — when the inference fails we return
-* `undefined` and the label gets no `[CC API]` tag. The real
-* `getProviderFor` call inside the deploy/destroy critical path is the
-* load-bearing dispatch.
-*
-* Inputs:
-* - CREATE / UPDATE → template-side `desiredProperties` (top-level CFn
-*   property names; intrinsic resolution does not change those, so we
-*   can route ahead of the resolver run).
-* - DELETE → sticky `provisionedBy` from the existing-state record.
-*
-* Exported so {@link DeployEngine.peekRoutingForLabel} stays a 1-line
-* delegate and the routing-inference logic is directly unit-testable
-* without standing up a full DeployEngine harness.
-*/
-function deriveLabelRouting(change, existingState, registry) {
+function deriveLabelRouting(change, existingState, registry, forceCcApi = false) {
 	try {
 		if (change.changeType === "DELETE") return existingState?.provisionedBy;
 		return registry.getProviderFor({
 			resourceType: change.resourceType,
-			properties: change.desiredProperties,
-			provisionedBy: existingState?.provisionedBy
+			properties: change.desiredProperties ?? {},
+			provisionedBy: existingState?.provisionedBy,
+			previousProperties: existingState?.properties,
+			forceCcApi
 		}).provisionedBy;
 	} catch {
 		return;
@@ -33533,6 +34655,39 @@ var DeployEngine = class {
 	*/
 	attemptedResolvedProps = /* @__PURE__ */ new Map();
 	/**
+	* Logical ids whose replacement this deploy DELIBERATELY left the old
+	* physical resource alive for — `UpdateReplacePolicy: Retain` (issue
+	* [#2603](https://github.com/go-to-k/cdkd/issues/2603)).
+	*
+	* Written by every engine path that skips the post-replacement delete, read
+	* once at the `completedOperations.push` site to stamp
+	* {@link CompletedOperation.oldResourceRetained}. It exists because the
+	* rollback classifier used to re-derive the verdict from
+	* `previousState.updateReplacePolicy` — a DIFFERENT source than the
+	* template read the engine decides from — so the two disagreed on exactly
+	* the deploy that changes the attribute, in both directions:
+	*
+	*   - ADDING `Retain`: the deploy orphans the old resource while the
+	*     previous state record carries no policy, so the rollback re-CREATED a
+	*     resource that is still alive (a duplicate for an auto-named type, an
+	*     `AlreadyExists` failure for a user-named one).
+	*   - DROPPING `Retain`: state still carries the stale `Retain`, the
+	*     template omits it so the deploy correctly DELETES the old resource,
+	*     and the rollback then re-adopted a physical id that no longer exists,
+	*     leaving state naming a deleted resource.
+	*
+	* Records only the DELIBERATE retention. A best-effort cleanup delete that
+	* FAILED, was SKIPPED, or was blocked by a failed final snapshot also leaves
+	* the old resource alive, but the deploy does not KNOW it survived — those
+	* stay `false` and keep today's `reverse-replacement` behaviour rather than
+	* having the rollback re-adopt an id it cannot vouch for (issue
+	* [#2631](https://github.com/go-to-k/cdkd/issues/2631)).
+	*
+	* Cleared per `deploy()` alongside the other per-run maps: a `false` here
+	* must mean "this deploy deleted it", never "a previous run said so".
+	*/
+	retainedOldOnReplacement = /* @__PURE__ */ new Set();
+	/**
 	* Target region for this stack. Required — load-bearing for the
 	* region-prefixed S3 state key and recorded in state.json for
 	* cross-region destroy.
@@ -33571,6 +34726,7 @@ var DeployEngine = class {
 		this.outputSecrets = /* @__PURE__ */ new Map();
 		this.outputsTemplateSource = {};
 		this.outputsSourceUsable = true;
+		this.retainedOldOnReplacement = /* @__PURE__ */ new Set();
 		this.resolver.resetPhysicalIdFallbackCount();
 		return withStackName(stackName, () => this.doDeploy(stackName, template));
 	}
@@ -33992,7 +35148,10 @@ var DeployEngine = class {
 		for (const { logicalId, resource } of candidates) {
 			let provider;
 			try {
-				provider = this.providerRegistry.getProvider(resource.resourceType);
+				provider = this.providerRegistry.getProviderFor({
+					resourceType: resource.resourceType,
+					provisionedBy: resource.provisionedBy
+				}).provider;
 			} catch {
 				continue;
 			}
@@ -34084,6 +35243,11 @@ var DeployEngine = class {
 			diffResolverContext.skipDynamicReferences = true;
 			const diffResolveFn = (value) => this.resolver.resolve(value, diffResolverContext);
 			const changes = await this.diffCalculator.calculateDiff(currentState, effectiveTemplate, diffResolveFn, makeCanonicalizePropertiesFn(this.providerRegistry));
+			const nestedStackTypeChanges = findNestedStackTypeChanges({
+				changes,
+				stateResources: currentState.resources
+			});
+			if (nestedStackTypeChanges.length > 0) throw markNonRetryable(new CdkdError(renderNestedStackTypeChangeRefusal(nestedStackTypeChanges, stackName), "TYPE_CHANGE_NESTED_STACK"));
 			if (!this.diffCalculator.hasChanges(changes)) {
 				this.logger.info("No changes detected. Stack is up to date.");
 				let persistedOutputs = currentState.outputs ?? {};
@@ -34293,7 +35457,8 @@ var DeployEngine = class {
 							provisionedBy: newResources[logicalId]?.provisionedBy ?? previousState?.provisionedBy,
 							previousState,
 							physicalId: newResources[logicalId]?.physicalId,
-							properties: newResources[logicalId]?.properties
+							properties: newResources[logicalId]?.properties,
+							...change.changeType === "UPDATE" && { oldResourceRetained: this.retainedOldOnReplacement.has(logicalId) }
 						});
 						saveStateAfterResource(logicalId);
 					}, () => this.interrupted);
@@ -34611,9 +35776,10 @@ var DeployEngine = class {
 	async provisionResource(logicalId, change, stateResources, stackName, template, parameterValues, conditions, counts, progress) {
 		const resourceType = change.resourceType;
 		const renderer = getLiveRenderer();
-		const needsReplacement = change.changeType === "UPDATE" && (change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false);
+		const labelRecreateDirection = this.recreateDirectionFor(stackName, logicalId);
+		const needsReplacement = change.changeType === "UPDATE" && (change.propertyChanges?.some((pc) => pc.requiresReplacement) ?? false) || labelRecreateDirection !== void 0;
 		const verb = change.changeType === "CREATE" ? "Creating" : change.changeType === "DELETE" ? "Deleting" : needsReplacement ? "Replacing" : "Updating";
-		const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId]);
+		const labelRouting = this.peekRoutingForLabel(change, stateResources[logicalId], stackName, logicalId, needsReplacement, labelRecreateDirection);
 		const baseLabel = `${verb} ${logicalId} (${resourceType})${labelRouting === "cc-api" ? " [CC API]" : ""}`;
 		renderer.addTask(logicalId, baseLabel);
 		const operationKind = change.changeType === "CREATE" ? "CREATE" : change.changeType === "DELETE" ? "DELETE" : "UPDATE";
@@ -34708,8 +35874,51 @@ var DeployEngine = class {
 			renderer.removeTask(logicalId);
 		}
 	}
-	peekRoutingForLabel(change, existingState) {
-		return deriveLabelRouting(change, existingState, this.providerRegistry);
+	/**
+	* Is this resource pinned to Cloud Control for this deploy (`--pin-cc-api`)?
+	*
+	* ONE implementation, called by the update dispatch and by the progress
+	* label. They carried separate copies of this expression for one revision,
+	* and a mutation probe caught the predictable result: neutering the LABEL's
+	* copy left every test green, because the only cases that existed exercised
+	* the dispatch's. Same shape as the duplicated flip predicate this lane
+	* already collapsed once.
+	*
+	* SCOPED BY STACK, like `recreateTargets`. `NestedStackProvider.runChildDeploy`
+	* spreads the parent's options into every child engine, and a logical id is
+	* unique only within one template, so an unscoped set would pin a same-named
+	* resource in a stack the user never named — silently, since a pin produces
+	* no output of its own.
+	*/
+	isPinnedToCcApi(stackName, logicalId) {
+		return this.options.pinCcApi?.stackName === stackName && this.options.pinCcApi.logicalIds.has(logicalId);
+	}
+	/**
+	* The `--recreate-via-*` direction for this resource, or `undefined`.
+	*
+	* Stack-scoped for the same reason as {@link isPinnedToCcApi}, and extracted
+	* for a sharper one: the LABEL and the DISPATCH were computing "is this a
+	* replacement" from DIFFERENT expressions. The dispatch asks
+	* `propertyDrivenReplacement || recreateFlagged`; the label asked only the
+	* property half. So a `--recreate-via-*` target whose property change does
+	* not itself force a replacement took the label's non-replacement path and
+	* was routed from the state record, while the dispatch routed it from the
+	* flag -- mislabelling in BOTH directions, and rendering `Updating` over a
+	* destroy + recreate.
+	*
+	* Three review rounds fixed three instances of that one class (the pin, then
+	* the sticky inputs, then this) by subtracting one input at a time from the
+	* label. The class closes by asking the same QUESTION at both sites instead.
+	*/
+	recreateDirectionFor(stackName, logicalId) {
+		const targets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
+		if (targets === void 0) return void 0;
+		if (targets.viaCcApi.has(logicalId)) return "cc-api";
+		if (targets.viaSdkProvider.has(logicalId)) return "sdk";
+	}
+	peekRoutingForLabel(change, existingState, stackName, logicalId, needsReplacement = false, recreateDirection) {
+		if (needsReplacement) return deriveLabelRouting(change, recreateDirection === void 0 ? void 0 : { provisionedBy: recreateDirection }, this.providerRegistry, recreateDirection === "cc-api");
+		return deriveLabelRouting(change, existingState, this.providerRegistry, this.isPinnedToCcApi(stackName, logicalId));
 	}
 	/**
 	* #808 — forward one structured deployment event to the optional
@@ -34820,7 +36029,7 @@ var DeployEngine = class {
 				isRetryable: isRecreateRetryableError
 			});
 		} catch (recreateError) {
-			throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets));
+			throw new Error(maskSecretsInText(`Failed to re-create ${logicalId} after the --replace delete-first fallback already deleted the old resource (${currentResource.physicalId}): ${recreateError instanceof Error ? recreateError.message : String(recreateError)}. Re-run the deploy to create it fresh.`, secrets), { cause: recreateError instanceof Error ? recreateError : void 0 });
 		}
 	}
 	/**
@@ -34917,15 +36126,16 @@ var DeployEngine = class {
 					break;
 				}
 				const propertyDrivenReplacement = change.propertyChanges?.some((pc) => pc.requiresReplacement);
-				const recreateViaCcApi = this.options.recreateViaCcApiTargets?.has(logicalId) ?? false;
-				const recreateViaSdkProvider = this.options.recreateViaSdkProviderTargets?.has(logicalId) ?? false;
+				const recreateTargets = this.options.recreateTargets?.stackName === stackName ? this.options.recreateTargets : void 0;
+				const recreateViaCcApi = recreateTargets?.viaCcApi.has(logicalId) ?? false;
+				const recreateViaSdkProvider = recreateTargets?.viaSdkProvider.has(logicalId) ?? false;
 				const recreateFlagged = recreateViaCcApi || recreateViaSdkProvider;
 				const needsReplacement = propertyDrivenReplacement || recreateFlagged;
 				const dependencies = this.extractAllDependencies(template, logicalId);
 				const updateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy;
 				if (needsReplacement) {
 					if (propertyDrivenReplacement && !recreateFlagged && updateReplacePolicy !== "Retain") {
-						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps);
+						const statefulReason = isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
 						if (statefulReason && this.options.forceStatefulRecreation !== true) {
 							const immutableProps = change.propertyChanges?.filter((pc) => pc.requiresReplacement).map((pc) => pc.path).join(", ");
 							throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement (immutable property changed: ${immutableProps}) but it is a stateful resource — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.`, "STATEFUL_REPLACE_BLOCKED"));
@@ -34940,7 +36150,8 @@ var DeployEngine = class {
 					const replaceDecision = this.providerRegistry.getProviderFor({
 						resourceType,
 						properties: resolvedProps,
-						...recreateDirectionHint && { provisionedBy: recreateDirectionHint }
+						...recreateDirectionHint && { provisionedBy: recreateDirectionHint },
+						...recreateViaCcApi && { forceCcApi: true }
 					});
 					const replaceProvider = replaceDecision.provider;
 					const replaceProps = replaceDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
@@ -34951,8 +36162,10 @@ var DeployEngine = class {
 					let createResult;
 					if (recreateFlagged) {
 						const recreateFlagName = recreateViaCcApi ? "--recreate-via-cc-api" : "--recreate-via-sdk-provider";
-						if (updateReplacePolicy === "Retain") this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
-						else {
+						if (updateReplacePolicy === "Retain") {
+							this.retainedOldOnReplacement.add(logicalId);
+							this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — ${recreateFlagName} will leak the old physical resource (${currentResource.physicalId}). The new resource shares the same name where applicable; if the type has user-supplied names (e.g. functionName, bucketName), the create will deterministically collide with the retained orphan.`);
+						} else {
 							this.logger.info(`  Destroying old ${logicalId} (${currentResource.physicalId}) before recreate...`);
 							const recreateFinalSnapshotId = await this.prepareFinalSnapshotForDelete(logicalId, resourceType, currentResource, updateReplacePolicy);
 							let recreateDeleteResult;
@@ -35003,8 +36216,10 @@ var DeployEngine = class {
 							deletedOldFirst = true;
 							createResult = await this.replaceDeleteFirstAndRecreate(logicalId, resourceType, currentResource, oldDeleteProvider, replaceProvider, replaceProps, updateSecrets, updateReplacePolicy);
 						}
-						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
-						else {
+						if (deletedOldFirst) {} else if (updateReplacePolicy === "Retain") {
+							this.retainedOldOnReplacement.add(logicalId);
+							this.logger.info(`  Retaining old ${logicalId} (${currentResource.physicalId}) - UpdateReplacePolicy: Retain`);
+						} else {
 							this.logger.info(`  Deleting old ${logicalId} (${currentResource.physicalId})...`);
 							let cleanupFinalSnapshotId;
 							let snapshotBlockedDelete = false;
@@ -35055,12 +36270,30 @@ var DeployEngine = class {
 					const updateDecision = this.providerRegistry.getProviderFor({
 						resourceType,
 						properties: resolvedProps,
-						provisionedBy: currentResource.provisionedBy
+						provisionedBy: currentResource.provisionedBy,
+						previousProperties: currentResource.properties,
+						...this.isPinnedToCcApi(stackName, logicalId) && { forceCcApi: true }
 					});
+					if (updateDecision.sdkMigration === true) {
+						const exemptMode = STICKY_CC_MIGRATION_EXEMPT.get(resourceType)?.mode;
+						const preserved = "The physical id is preserved";
+						let message;
+						switch (exemptMode) {
+							case "cc-broken":
+								message = `${logicalId} (${resourceType}): moving to the SDK provider — Cloud Control cannot manage this type correctly. ${preserved}, and this routing is not optional.`;
+								break;
+							case "sdk-coverage":
+								message = `${logicalId} (${resourceType}): returning to the SDK provider — cdkd now covers every property this resource uses. ${preserved}; pass --pin-cc-api ${logicalId} to decline this for a deploy.`;
+								break;
+							default: message = `${logicalId} (${resourceType}): moving to the SDK provider. ${preserved}.`;
+						}
+						this.logger.info(message);
+					}
 					const updateProvider = updateDecision.provider;
 					const updateProps = updateDecision.provisionedBy === "cc-api" ? this.preparePropertiesForCcApi(resourceType, resolvedProps, logicalId) : resolvedProps;
 					let result;
 					let resultProvisionedBy = updateDecision.provisionedBy;
+					let captureProvider = updateProvider;
 					try {
 						result = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, updateProps, currentProps, {
 							maskSecrets: createSecretMasker(updateSecrets),
@@ -35071,7 +36304,7 @@ var DeployEngine = class {
 						const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && this.options.replace === true;
 						if (ccUnsupported || replaceOptIn) {
 							const retainOldOnReplace = updateReplacePolicy === "Retain";
-							const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps);
+							const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
 							if (statefulReason && this.options.forceStatefulRecreation !== true) throw markNonRetryable(new CdkdError(replaceOptIn ? `--replace would DELETE + CREATE the stateful resource ${logicalId} (${resourceType}) — ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.` : `${logicalId} (${resourceType}) cannot be updated in place by the provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: ${renderStatefulReason(statefulReason)}. Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update.`, "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
 							this.logger.info(retainOldOnReplace ? `UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : `UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
 							if (!retainOldOnReplace) {
@@ -35102,7 +36335,7 @@ var DeployEngine = class {
 							try {
 								createResult = await this.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
 							} catch (createError) {
-								if (!retainOldOnReplace) throw createError;
+								if (!retainOldOnReplace) throw new Error(maskSecretsInText(`Failed to create ${logicalId} after the UPDATE-not-supported replacement: the old resource (${currentResource.physicalId}) is now gone. Cause: ${createError instanceof Error ? createError.message : String(createError)}. Re-run the deploy to create it fresh.`, updateSecrets), { cause: createError instanceof Error ? createError : void 0 });
 								if (!isNameCollisionError(createError instanceof Error ? createError.message : String(createError))) throw createError;
 								const nameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 								throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement because the provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. ${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.`, "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
@@ -35112,6 +36345,7 @@ var DeployEngine = class {
 									const idempotentNameOrigin = this.replacementNameOrigin(logicalId, currentResource.physicalId);
 									throw markNonRetryable(new CdkdError(`${logicalId} (${resourceType}) requires replacement, but its Create API is name-idempotent: the create returned the existing resource (${currentResource.physicalId}) instead of creating a new one, and UpdateReplacePolicy: Retain pins that resource in place, so the new properties were not applied. ${idempotentNameOrigin.descriptor}. ${idempotentNameOrigin.remedy} — with Retain, the old resource keeps the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 								}
+								this.retainedOldOnReplacement.add(logicalId);
 								this.logger.warn(`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical resource (${currentResource.physicalId}) is RETAINED and is no longer tracked by cdkd: it keeps running and incurring cost, and \`cdkd destroy\` will not remove it. Delete it yourself once you no longer need its data.`);
 								retainedSurvivorReason = `UpdateReplacePolicy: Retain kept the old ${resourceType} (${currentResource.physicalId}), now untracked by cdkd`;
 							}
@@ -35129,6 +36363,7 @@ var DeployEngine = class {
 							if (createResult.effectiveProperties) replacementResult.effectiveProperties = createResult.effectiveProperties;
 							result = replacementResult;
 							resultProvisionedBy = replDecision.provisionedBy;
+							captureProvider = replProvider;
 						} else throw updateError;
 					}
 					if (result.wasReplaced) this.logger.info(`Resource ${logicalId} was replaced: ${currentResource.physicalId} -> ${result.physicalId}`);
@@ -35148,7 +36383,7 @@ var DeployEngine = class {
 						provisionedBy: resultProvisionedBy
 					};
 					const updateCaptureSiblings = await this.buildObservedCaptureSiblings(resourceType, logicalId, result.physicalId, template, stateResources, stackName, parameterValues, conditions);
-					this.kickOffObservedCapture(updateProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
+					this.kickOffObservedCapture(captureProvider, logicalId, result.physicalId, resourceType, resolvedProps, updateCaptureSiblings);
 					const updatePartial = updatePartialReason(result);
 					if (counts) if (updatePartial !== void 0) counts.updatePartial++;
 					else counts.updated++;
@@ -35506,10 +36741,55 @@ var DeployEngine = class {
 	* the deploy instead of silently publishing nothing (which breaks downstream
 	* `Fn::ImportValue` consumers with "export not found" long after this deploy
 	* exits 0).
-	*/
-	handleOutputResolutionFailure(error, outputKey, outputs) {
-		if (this.options.strictGetAtt) throw new Error(`Failed to resolve output ${outputKey}: ${error instanceof Error ? error.message : String(error)} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, { cause: error });
-		this.logger.warn(`Failed to resolve output ${outputKey}: ${String(error)}`);
+	*
+	* The error is masked on both arms (issue
+	* [#2728](https://github.com/go-to-k/cdkd/issues/2728)). The resolver's own
+	* failures echo the offending reference token, a secret id / JSON key, or
+	* an SSM parameter name, and `resolveSub` / `resolveJoin` re-enter
+	* `resolveDynamicReferences` with the ASSEMBLED string — so a reference
+	* built out of a value this same pass resolved from a secret puts that
+	* plaintext into the echoed field (a JSON key assembled from the resolved
+	* password says `key '<password>' not found`).
+	*
+	* TWO bags, the inherited one first, the same pair the resolver's
+	* `maskSecretsForLog` masks against and for the same reason (issue #1903
+	* round 2): on a nested-stack child the parent-decrypted parameter
+	* plaintext is in `inheritedSecrets` and not in the pass map until a
+	* `{Ref: <Param>}` resolution copies it across. No shape reaching this
+	* handler before that copy has been constructed (every `${Param}` route
+	* goes through `resolveRef`, which records), so the inherited bag is
+	* defense in depth here — but two masking sites in one flow must not argue
+	* opposite sides of the same question. `secrets` is the outputs pass's own
+	* map: everything recorded before this handler runs, an `Export.Name`
+	* resolution's entries included (its `finally` merges them back before the
+	* `catch` reaches here). What a still-pending concurrent part would have
+	* recorded is outside both — issue #2563's late write, the same bound every
+	* other masking site in this engine has.
+	*
+	* The strict arm's `cause` is masked as an OBJECT, through
+	* `maskSecretsInError` — a clone of each `Error` link `errorCauseChain`
+	* reaches (`ERROR_CAUSE_MASK_MAX_DEPTH` links, a cycle stops it; a
+	* non-`Error` cause is kept verbatim), symbols included, so
+	* `isMarkedNonRetryable`'s non-enumerable marker survives (the same reason
+	* `provisionResource` uses it). No sink on the deploy path renders past
+	* one level today (`formatError` prints `Caused by:` for a `CdkdError`'s
+	* direct cause only), but that is a property of reachability, not of the
+	* sinks: `cdkd scrub`'s `describeFailure` renders a chain, and is safe
+	* because its boundary masks with this same helper and it walks the same
+	* bounded `errorCauseChain`. Masking here gives a renderer within that
+	* bound nothing to leak. A thrown STRING is masked as text; any other
+	* non-`Error` value is not threaded as a cause at all (it would travel
+	* unmasked, and `markNonRetryable` cannot have marked it).
+	*/
+	handleOutputResolutionFailure(error, outputKey, outputs, secrets, inheritedSecrets) {
+		let detail = error instanceof Error ? error.message || error.name : String(error);
+		for (const bag of [inheritedSecrets, secrets]) detail = maskSecretsInText(detail, bag);
+		if (this.options.strictGetAtt) {
+			let cause = error;
+			for (const bag of [inheritedSecrets, secrets]) cause = typeof cause === "string" ? maskSecretsInText(cause, bag) : maskSecretsInError(cause, bag);
+			throw new Error(`Failed to resolve output ${outputKey}: ${detail} (--strict-getatt promotes output resolution failures to deploy errors; drop the flag to warn and skip the output instead)`, cause instanceof Error || typeof cause === "string" ? { cause } : {});
+		}
+		this.logger.warn(`Failed to resolve output ${outputKey}: ${detail}`);
 		outputs[outputKey] = void 0;
 	}
 	/**
@@ -35531,6 +36811,8 @@ var DeployEngine = class {
 			...parameterValues && { parameters: parameterValues },
 			...conditions && { conditions }
 		}, stackName);
+		const outputsPassSecrets = context.recordedSecretValues ?? EMPTY_SECRETS;
+		const outputsPassInherited = context.inheritedSecrets ?? EMPTY_SECRETS;
 		const publishedOutputNames = collectPublishedOutputNames(template.Outputs, conditions);
 		let outputsPassCompleted = false;
 		try {
@@ -35542,7 +36824,7 @@ var DeployEngine = class {
 				try {
 					outputs[outputKey] = await this.resolver.resolve(output.Value, context);
 				} catch (error) {
-					this.handleOutputResolutionFailure(error, outputKey, outputs);
+					this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 				}
 			}
 			for (const [outputKey, output] of Object.entries(template.Outputs)) {
@@ -35562,7 +36844,7 @@ var DeployEngine = class {
 						for (const [plaintext, expression] of nameSecrets) context.recordedSecretValues?.set(plaintext, expression);
 					}
 				} catch (error) {
-					this.handleOutputResolutionFailure(error, outputKey, outputs);
+					this.handleOutputResolutionFailure(error, outputKey, outputs, outputsPassSecrets, outputsPassInherited);
 					continue;
 				}
 				if (typeof exportName !== "string") continue;
@@ -35601,5 +36883,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { beginCommandInterruptScope as $, synthesisStatusMessage as $n, withErrorHandling as $r, maskSecretsInError as $t, formatResourceLine as A, ensureAssetStorage as An, AssetError as Ar, requireConfigString as At, isExportAliasCollision as B, describeDockerCapturedOutput as Bn, LockError as Br, INTRINSIC_KEYS as Bt, unsupportedFinalSnapshotError as C, loadPublishableAssetManifest as Cn, processStackMessages as Cr, coerceCfnBoolean as Ct, isStatefulRecreateTargetForReplace as D, AssetModeResolver as Dn, getAwsClients as Dr, replayWarn as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, stripControlChars as En, AwsClients as Er, readConfigString as Et, red as F, validateAssetBucketName as Fn, DeployCancelledError as Fr, s3BucketDualStackDomainName as Ft, collectInlinePolicyNamesManagedBySiblings as G, getDockerCmd as Gn, ResourceUpdateNotSupportedError as Gr, STATE_SOURCED_CROSS_GENERATION_RULES as Gt, stateKeySecretExposure as H, describeDockerFailure as Hn, PartialFailureError as Hr, withRetry as Ht, yellow as I, validateContainerRepoName as In, DynamicReferenceRegionAmbiguousError as Ir, s3BucketRegionalDomainName as It, findActionableSilentDrops as J, runDockerForeground as Jn, StateError as Jr, carriesSecretMask as Jt, clearOnUpdateRemoval as K, partitionSensitiveEnv as Kn, StackHasActiveImportsError as Kr, STATE_SOURCED_READBACK_RULES as Kt, collectDeclaredOutputNames as L, buildDenyExternalAccessPolicy as Ln, IntrinsicResolutionRefusalError as Lr, s3BucketWebsiteUrl as Lt, cyan as M, isCrossRegionRedirect as Mn, ConfigError as Mr, producerRegionsFromState as Mt, gray as N, parseBootstrapMarker as Nn, CrossAccountSecretRefusalError as Nr, s3BucketArn as Nt, isStatefulRecreateTargetSync as O, BOOTSTRAP_MARKER_PREFIX as On, resetAwsClients as Or, requireConfigArray as Ot, green as P, readBootstrapMarkerBody as Pn, DependencyError as Pr, s3BucketDomainName as Pt, maskerOrIdentity as Q, Synthesizer as Qn, normalizeAwsError as Qr, isSingleDynamicReferenceToken as Qt, collectPublishedOutputNames as R, describeAwsFailure as Rn, LocalInvokeBuildError as Rr, applyRoleArnIfSet as Rt, refusesFinalSnapshot as S, createAssetRedirectResolver as Sn, AssemblyReader as Sr, assertRegionMatch as St, extractDeploymentEventError as T, escapeRegExp$1 as Tn, resolveBucketRegion as Tr, configStringRefusal as Tt, getCurrentResourceSecrets as U, dockerSpawnEnvWithSensitive as Un, ProvisioningError as Ur, DagBuilder as Ut, secretBearingStateKeyWarning as V, describeDockerExecFailure as Vn, NestedStackChildDirectDestroyError as Vr, describeTypeWithThrottleRetry as Vt, IAMRoleProvider as W, formatDockerLoginError as Wn, ResourceTimeoutError as Wr, TemplateParser as Wt, createMaskedRetryLogger as X, AssetManifestLoader as Xn, formatError as Xr, dynamicReferenceTokens as Xt, findSilentDropProperties as Y, runDockerStreaming as Yn, SynthesisError as Yr, createSecretMasker as Yt, maskDeep as Z, getDockerImageBySourceHash as Zn, isCdkdError as Zr, errorCauseChain as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shouldRetainResource as _n, displaySafe as _r, parameterTypeMayLoseSecretIdentity as _t, DeploymentEventsStore as a, markRedactedCause as ai, LockManager as an, resolveSkipPrefix as ar, slowCcOperationTimeoutMs as at, createPreDeleteFinalSnapshot as b, WorkGraph as bn, canonicalizeRegion as br, normalizeAwsTagsToCfn as bt, replayFailedOperations as c, UNRENDERABLE as cn, resolveUseCdkBootstrapAssets as cr, deleteSkipReason as ct, updatePartialReason as d, forceQuitRecoveryClause as dn, CFN_TEMPLATE_BODY_LIMIT as dr, IntrinsicFunctionResolver as dt, isMarkedNonRetryable as ei, maskSecretsInText as en, getDefaultStateBucketName as er, endCommandInterruptScope as et, withResourceDeadline as f, CUSTOM_RESOURCE_RESPONSE_PREFIX as fn, CFN_TEMPLATE_URL_LIMIT as fr, carriesDynamicReference as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, importableOutputs as gn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as gr, isUnboundTemplateParameter as gt, computeImplicitDeleteEdges as h, importableOutputKeys as hn, uploadCfnTemplate as hr, getAccountInfo as ht, DeploymentEventsReader as i, markNonRetryable as ii, scrubResourceRecord as in, resolveCaptureObservedState as ir, CloudControlProvider as it, bold as j, getBootstrapMarkerKey as jn, CdkdError as jr, classifyReplaySecretRegion as jt, renderStatefulReason as k, assertAssetBucketRegion as kn, setAwsClients as kr, requireConfigObject as kt, replayRollback as l, buildForceUnlockCommand as ln, stateBucketExistenceConfirmed as lr, disableInstanceApiTermination as lt, IMPLICIT_DELETE_DEPENDENCIES as m, exportNamesCarriedFrom as mn, findLargeInlineResources as mr, coerceParameterTypedValue as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, isThrottlingError as ni, recoverMaskedOutput as nn, resolveApp as nr, isInterruptedWaitError as nt, planFailedOps as o, retryClassificationText as oi, S3StateBackend as on, resolveStateBucketWithDefault as or, UNSPECIFIED_SKIP_REASON as ot, maskingRetryLogger as p, DEFAULT_STATE_PREFIX as pn, MIGRATE_TMP_PREFIX as pr, cfnRefValueFromPhysicalId as pt, ProviderRegistry as q, redactDockerArgvValues as qn, StackTerminationProtectionError as qr, TEMPLATE_SOURCED_RULES as qt, DeployEngine as r, isTransientServerError as ri, redactSecretsForState as rn, resolveAutoAssetStorage as rr, startInterruptWatch as rt, planRollback as s, __exportAll as si, rebuildClientForBucketRegion as sn, resolveStateBucketWithDefaultAndSource as sr, deleteIndeterminateGuards as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, isRetryableTransientError as ti, recordMaskOnlyValue as tn, getLegacyStateBucketName as tr, interruptWatchListenerCount as tt, updatePartialMessage as u, buildLockContentionMessage as un, warnDeprecatedNoPrefixCliFlag as ur, isTerminationProtectionPropagationError as ut, buildFinalSnapshotIdentifier as v, AssetPublisher as vn, expectedOwnerParam as vr, refStateLookupFromResource as vt, makeCanonicalizePropertiesFn as w, rewriteTemplateAssetReferences as wn, clearBucketRegionCache as wr, configBooleanRefusal as wt, isFinalSnapshotError as x, buildAssetRedirectMap as xn, derivePartitionAndUrlSuffix as xr, resolveExplicitPhysicalId as xt, ccRoutedFinalSnapshotError as y, stringifyValue as yn, PARTITION_TABLE as yr, WAFv2WebACLProvider as yt, exportAliasCollisionScrubWarning as z, buildDockerImage as zn, LocalStartServiceError as zr, DiffCalculator as zt };
-//# sourceMappingURL=deploy-engine--rkIGhow.js.map
+export { findActionableSilentDrops as $, runDockerStreaming as $n, StackTerminationProtectionError as $r, carriesSecretMask as $t, WARM_THROUGHPUT_MEMBERS as A, rewriteTemplateAssetReferences as An, clearBucketRegionCache as Ar, configStringRefusal as At, yellow as B, validateContainerRepoName as Bn, DependencyError as Br, s3BucketDualStackDomainName as Bt, unsupportedFinalSnapshotError as C, shouldRetainResource as Cn, displaySafe as Cr, refStateLookupFromResource as Ct, isStatefulRecreateTargetForReplace as D, buildAssetRedirectMap as Dn, derivePartitionAndUrlSuffix as Dr, assertRegionMatch as Dt, MULTI_REGION_RECREATE_BLOCKED_TYPES as E, WorkGraph as En, canonicalizeRegion as Er, resolveExplicitPhysicalId as Et, bold as F, getBootstrapMarkerKey as Fn, setAwsClients as Fr, requireConfigString as Ft, secretBearingStateKeyWarning as G, describeDockerExecFailure as Gn, LocalStartServiceError as Gr, INTRINSIC_KEYS as Gt, collectPublishedOutputNames as H, describeAwsFailure as Hn, DynamicReferenceRegionAmbiguousError as Hr, s3BucketWebsiteUrl as Ht, cyan as I, isCrossRegionRedirect as In, AssetError as Ir, classifyReplaySecretRegion as It, IAMRoleProvider as J, formatDockerLoginError as Jn, PartialFailureError as Jr, DagBuilder as Jt, stateKeySecretExposure as K, describeDockerFailure as Kn, LockError as Kr, describeTypeWithThrottleRetry as Kt, gray as L, parseBootstrapMarker as Ln, CdkdError as Lr, producerRegionsFromState as Lt, isWarmThroughputDecrease as M, BOOTSTRAP_MARKER_PREFIX as Mn, AwsClients as Mr, replayWarn as Mt, toFiniteNumber as N, assertAssetBucketRegion as Nn, getAwsClients as Nr, requireConfigArray as Nt, isStatefulRecreateTargetSync as O, createAssetRedirectResolver as On, AssemblyReader as Or, coerceCfnBoolean as Ot, formatResourceLine as P, ensureAssetStorage as Pn, resetAwsClients as Pr, requireConfigObject as Pt, wouldReturnToSdkProvider as Q, runDockerForeground as Qn, StackHasActiveImportsError as Qr, TEMPLATE_SOURCED_RULES as Qt, green as R, readBootstrapMarkerBody as Rn, ConfigError as Rr, s3BucketArn as Rt, refusesFinalSnapshot as S, importableOutputs as Sn, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Sr, parameterTypeMayLoseSecretIdentity as St, extractDeploymentEventError as T, stringifyValue as Tn, PARTITION_TABLE as Tr, normalizeAwsTagsToCfn as Tt, exportAliasCollisionScrubWarning as U, buildDockerImage as Un, IntrinsicResolutionRefusalError as Ur, applyRoleArnIfSet as Ut, collectDeclaredOutputNames as V, buildDenyExternalAccessPolicy as Vn, DeployCancelledError as Vr, s3BucketRegionalDomainName as Vt, isExportAliasCollision as W, describeDockerCapturedOutput as Wn, LocalInvokeBuildError as Wr, DiffCalculator as Wt, clearOnUpdateRemoval as X, partitionSensitiveEnv as Xn, ResourceTimeoutError as Xr, STATE_SOURCED_CROSS_GENERATION_RULES as Xt, collectInlinePolicyNamesManagedBySiblings as Y, getDockerCmd as Yn, ProvisioningError as Yr, TemplateParser as Yt, ProviderRegistry as Z, redactDockerArgvValues as Zn, ResourceUpdateNotSupportedError as Zr, STATE_SOURCED_READBACK_RULES as Zt, PRE_DELETE_SNAPSHOT_TYPES as _, shellQuote as _n, CFN_TEMPLATE_BODY_LIMIT as _r, carriesDynamicReference as _t, DeploymentEventsStore as a, withErrorHandling as ai, maskSecretsInText as an, synthesisStatusMessage as ar, endCommandInterruptScope as at, createPreDeleteFinalSnapshot as b, exportNamesCarriedFrom as bn, findLargeInlineResources as br, getAccountInfo as bt, replayFailedOperations as c, isThrottlingError as ci, redactSecretsForState as cn, resolveApp as cr, startInterruptWatch as ct, updatePartialReason as d, markRedactedCause as di, S3StateBackend as dn, resolveSkipPrefix as dr, UNSPECIFIED_SKIP_REASON as dt, StateError as ei, createSecretMasker as en, escapeRegExp$1 as er, findSilentDropProperties as et, withResourceDeadline as f, retryClassificationText as fi, rebuildClientForBucketRegion as fn, resolveStateBucketWithDefault as fr, deleteIndeterminateGuards as ft, ATOMIC_FINAL_SNAPSHOT_TYPES as g, forceQuitRecoveryClause as gn, warnDeprecatedNoPrefixCliFlag as gr, IntrinsicFunctionResolver as gt, computeImplicitDeleteEdges as h, buildLockContentionMessage as hn, stateBucketExistenceConfirmed as hr, isTerminationProtectionPropagationError as ht, DeploymentEventsReader as i, normalizeAwsError as ii, maskSecretsInError as in, Synthesizer as ir, beginCommandInterruptScope as it, coerceWarmThroughput as j, AssetModeResolver as jn, resolveBucketRegion as jr, readConfigString as jt, renderStatefulReason as k, loadPublishableAssetManifest as kn, processStackMessages as kr, configBooleanRefusal as kt, replayRollback as l, isTransientServerError as li, scrubResourceRecord as ln, resolveAutoAssetStorage as lr, CloudControlProvider as lt, IMPLICIT_DELETE_DEPENDENCIES as m, buildForceUnlockCommand as mn, resolveUseCdkBootstrapAssets as mr, disableInstanceApiTermination as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, formatError as ni, errorCauseChain as nn, AssetManifestLoader as nr, maskDeep as nt, planFailedOps as o, isMarkedNonRetryable as oi, recordMaskOnlyValue as on, getDefaultStateBucketName as or, interruptWatchListenerCount as ot, maskingRetryLogger as p, __exportAll as pi, UNRENDERABLE as pn, resolveStateBucketWithDefaultAndSource as pr, deleteSkipReason as pt, getCurrentResourceSecrets as q, dockerSpawnEnvWithSensitive as qn, NestedStackChildDirectDestroyError as qr, withRetry as qt, DeployEngine as r, isCdkdError as ri, isSingleDynamicReferenceToken as rn, getDockerImageBySourceHash as rr, maskerOrIdentity as rt, planRollback as s, isRetryableTransientError as si, recoverMaskedOutput as sn, getLegacyStateBucketName as sr, isInterruptedWaitError as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, SynthesisError as ti, dynamicReferenceTokens as tn, stripControlChars as tr, createMaskedRetryLogger as tt, updatePartialMessage as u, markNonRetryable as ui, LockManager as un, resolveCaptureObservedState as ur, slowCcOperationTimeoutMs as ut, buildFinalSnapshotIdentifier as v, CUSTOM_RESOURCE_RESPONSE_PREFIX as vn, CFN_TEMPLATE_URL_LIMIT as vr, cfnRefValueFromPhysicalId as vt, makeCanonicalizePropertiesFn as w, AssetPublisher as wn, expectedOwnerParam as wr, WAFv2WebACLProvider as wt, isFinalSnapshotError as x, importableOutputKeys as xn, uploadCfnTemplate as xr, isUnboundTemplateParameter as xt, ccRoutedFinalSnapshotError as y, DEFAULT_STATE_PREFIX as yn, MIGRATE_TMP_PREFIX as yr, coerceParameterTypedValue as yt, red as z, validateAssetBucketName as zn, CrossAccountSecretRefusalError as zr, s3BucketDomainName as zt };
+//# sourceMappingURL=deploy-engine-B377YKBI.js.map