@go-to-k/cdkd 0.288.6 → 0.289.0

package/dist/{program-CxMjCbiG.js → program-Bg60hZhr.js}

@@ -1,8 +1,8 @@
-import { $ as ProviderRegistry, $n as formatDockerLoginError, $r as PartialFailureError, $t as STATE_SOURCED_BASELINE_RULES, A as renderStatefulReason, An as stringifyValue, Ar as PARTITION_TABLE, At as configStringRefusal, B as red, Bn as getBootstrapMarkerKey, Br as setAwsClients, Bt as s3BucketDomainName, C as refusesFinalSnapshot, Cn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Cr as CFN_TEMPLATE_URL_LIMIT, Ct as refStateLookupFromResource, D as MULTI_REGION_RECREATE_BLOCKED_TYPES, Dn as importableOutputs, Dr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Dt as assertRegionMatch, E as extractDeploymentEventError, En as importableOutputKeys, Er as uploadCfnTemplate, Et as resolveExplicitPhysicalId, F as formatResourceLine, Fn as rewriteTemplateAssetReferences, Ft as requireConfigString, G as isExportAliasCollision, Gn as validateContainerRepoName, Gt as DiffCalculator, H as collectDeclaredOutputNames, Hn as parseBootstrapMarker, Hr as CdkdError, Ht as s3BucketRegionalDomainName, I as bold, In as AssetModeResolver, Ir as resolveBucketRegion, It as classifyReplaySecretRegion, J as secretSafeKeyDisplay, Jn as buildDockerImage, Jr as IntrinsicResolutionRefusalError, Jt as findSilentDropProperties, K as secretBearing, Kn as buildDenyExternalAccessPolicy, Kr as DeployCancelledError, Kt as INTRINSIC_KEYS, L as cyan, Ln as BOOTSTRAP_MARKER_PREFIX, Lr as AwsClients, Lt as producerRegionsFromState, M as coerceWarmThroughput$1, Mn as buildAssetRedirectMap, Mr as derivePartitionAndUrlSuffix, Mt as replayWarn, N as isWarmThroughputDecrease, Nn as createAssetRedirectResolver, Nr as AssemblyReader, Nt as requireConfigArray, O as isStatefulRecreateTargetForReplace, On as shouldRetainResource, Or as displaySafe, Ot as coerceCfnBoolean, P as toFiniteNumber, Pn as loadPublishableAssetManifest, Pr as processStackMessages, Pt as requireConfigObject, Q as clearOnUpdateRemoval, Qn as dockerSpawnEnvWithSensitive, Qr as NestedStackChildDirectDestroyError, Qt as TemplateParser, R as gray, Rn as assertAssetBucketRegion, Rr as getAwsClients, Rt as withSharedDrainBudget, S as isFinalSnapshotError, Sn as shellQuote, Sr as CFN_TEMPLATE_BODY_LIMIT, St as parameterTypeMayLoseSecretIdentity, T as makeCanonicalizePropertiesFn, Tn as exportNamesCarriedFrom, Tr as findLargeInlineResources, Tt as normalizeAwsTagsToCfn, U as collectPublishedOutputNames, Un as readBootstrapMarkerBody, Ut as s3BucketWebsiteUrl, V as yellow, Vn as isCrossRegionRedirect, Vt as s3BucketDualStackDomainName, W as exportAliasCollisionScrubWarning, Wn as validateAssetBucketName, Wr as CrossAccountSecretRefusalError, Wt as applyRoleArnIfSet, X as IAMRoleProvider, Xn as describeDockerExecFailure, Xr as LocalStartServiceError, Xt as withRetry, Y as getCurrentResourceSecrets, Yn as describeDockerCapturedOutput, Yr as LocalInvokeBuildError$1, Yt as describeTypeWithThrottleRetry, Z as collectInlinePolicyNamesManagedBySiblings, Zn as describeDockerFailure, Zt as DagBuilder, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as retryClassificationText, _n as rebuildClientForBucketRegion, _r as resolveStateBucketWithDefault, _t as carriesDynamicReference, a as DeploymentEventsStore, an as dynamicReferenceTokens, ar as escapeRegExp, at as endCommandInterruptScope, b as ccRoutedFinalSnapshotError, bn as buildLockContentionMessage, br as stateBucketExistenceConfirmed, bt as getAccountInfo, c as replayFailedOperations, cn as isSingleDynamicReferenceToken, cr as getDockerImageBySourceHash, ct as startInterruptWatch, d as updatePartialReason, di as isMarkedNonRetryable, dn as recordMaskOnlyValue, dr as getDefaultStateBucketName, dt as UNSPECIFIED_SKIP_REASON, ei as ProvisioningError, en as STATE_SOURCED_CROSS_GENERATION_RULES, er as getDockerCmd, et as wouldReturnToSdkProvider, f as withResourceDeadline, fi as isRetryableTransientError, fn as recoverMaskedOutput, fr as getLegacyStateBucketName, ft as deleteIndeterminateGuards, g as bindingSkippedOutputs, gi as markRedactedCause, gn as S3StateBackend, gr as resolveSkipPrefix, gt as IntrinsicFunctionResolver, h as computeImplicitDeleteEdges, hi as markNonRetryable, hn as LockManager, hr as resolveCaptureObservedState, ht as isTerminationProtectionPropagationError, i as DeploymentEventsReader, ii as StackTerminationProtectionError, in as createSecretMasker, ir as runDockerStreaming, it as beginCommandInterruptScope, j as WARM_THROUGHPUT_MEMBERS, jn as WorkGraph, jr as canonicalizeRegion, jt as readConfigString, k as isStatefulRecreateTargetSync, kn as AssetPublisher, kr as expectedOwnerParam, kt as configBooleanRefusal, l as replayRollback, li as normalizeAwsError, ln as maskSecretsInError, lr as Synthesizer, lt as CloudControlProvider, m as IMPLICIT_DELETE_DEPENDENCIES, mi as isTransientServerError, mn as scrubResourceRecord, mr as resolveAutoAssetStorage, mt as disableInstanceApiTermination, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as ResourceUpdateNotSupportedError, nn as TEMPLATE_SOURCED_RULES, nr as redactDockerArgvValues, nt as maskDeep, o as planFailedOps, on as errorCauseChain, or as stripControlChars, ot as interruptWatchListenerCount, p as maskingRetryLogger, pi as isThrottlingError, pn as redactSecretsForState, pr as resolveApp, pt as deleteSkipReason, q as secretBearingStateKeyWarning, qn as describeAwsFailure, qr as DynamicReferenceRegionAmbiguousError, qt as findActionableSilentDrops, r as DeployEngine, ri as StackHasActiveImportsError, rn as carriesSecretMask, rr as runDockerForeground, rt as maskerOrIdentity, s as planRollback, sn as identityKeyFor, sr as AssetManifestLoader, st as isInterruptedWaitError, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as ResourceTimeoutError, tn as STATE_SOURCED_READBACK_RULES, tr as partitionSensitiveEnv, tt as createMaskedRetryLogger, u as updatePartialMessage, ui as withErrorHandling, un as maskSecretsInText, ur as synthesisStatusMessage, ut as slowCcOperationTimeoutMs, v as PRE_DELETE_SNAPSHOT_TYPES, vn as UNRENDERABLE, vr as resolveStateBucketWithDefaultAndSource, vt as cfnRefValueFromPhysicalId, w as unsupportedFinalSnapshotError, wn as DEFAULT_STATE_PREFIX, wr as MIGRATE_TMP_PREFIX, wt as WAFv2WebACLProvider, x as createPreDeleteFinalSnapshot, xn as forceQuitRecoveryClause, xr as warnDeprecatedNoPrefixCliFlag, xt as isUnboundTemplateParameter, y as buildFinalSnapshotIdentifier, yn as buildForceUnlockCommand, yr as resolveUseCdkBootstrapAssets, yt as coerceParameterTypedValue, z as green, zn as ensureAssetStorage, zr as resetAwsClients, zt as s3BucketArn } from "./deploy-engine-umIP3xus.js";
-import { _ as withStackName, c as PATTERN_B_NAME_OPTIONS, f as generateResourceName, g as withSkipPrefix, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as getCurrentStackName, n as getLogger, o as runStackBuffered, p as generateResourceNameWithFallback, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES } from "./logger-Dw-3y48G.js";
+import { $ as collectInlinePolicyNamesManagedBySiblings, $n as describeDockerCapturedOutput, $r as LocalInvokeBuildError$1, $t as DagBuilder, A as isStatefulRecreateTargetForReplace, An as orphansAfterRollback, Ar as uploadCfnTemplate, At as coerceCfnBoolean, B as gray, Bn as AssetModeResolver, Br as resolveBucketRegion, Bt as withSharedDrainBudget, C as refusesFinalSnapshot, Cn as forceQuitRecoveryClause, Cr as resolveUseCdkBootstrapAssets, Ct as isUnboundTemplateParameter, D as makeSiblingClaimReader, Dn as exportNamesCarriedFrom, Dr as CFN_TEMPLATE_URL_LIMIT, Dt as normalizeAwsTagsToCfn, E as extractDeploymentEventError, En as DEFAULT_STATE_PREFIX, Er as CFN_TEMPLATE_BODY_LIMIT, Et as WAFv2WebACLProvider, F as isWarmThroughputDecrease, Fn as WorkGraph, Fr as canonicalizeRegion, Ft as requireConfigArray, G as collectPublishedOutputNames, Gn as isCrossRegionRedirect, Gt as s3BucketWebsiteUrl, H as red, Hn as assertAssetBucketRegion, Hr as getAwsClients, Ht as s3BucketDomainName, I as toFiniteNumber, In as buildAssetRedirectMap, Ir as derivePartitionAndUrlSuffix, It as requireConfigObject, J as secretBearing, Jn as validateAssetBucketName, Jr as CrossAccountSecretRefusalError, Jt as INTRINSIC_KEYS, K as exportAliasCollisionScrubWarning, Kn as parseBootstrapMarker, Kr as CdkdError, Kt as applyRoleArnIfSet, L as formatResourceLine, Ln as createAssetRedirectResolver, Lr as AssemblyReader, Lt as requireConfigString, M as renderStatefulReason, Mn as shouldRetainResource, Mr as displaySafe, Mt as configStringRefusal, N as WARM_THROUGHPUT_MEMBERS, Nn as AssetPublisher, Nr as expectedOwnerParam, Nt as readConfigString, O as planOrphanAdoption, On as importableOutputKeys, Or as MIGRATE_TMP_PREFIX, Ot as resolveExplicitPhysicalId, P as coerceWarmThroughput$1, Pn as stringifyValue, Pr as PARTITION_TABLE, Pt as replayWarn, Q as IAMRoleProvider, Qn as buildDockerImage, Qr as IntrinsicResolutionRefusalError, Qt as withRetry, R as bold, Rn as loadPublishableAssetManifest, Rr as processStackMessages, Rt as classifyReplaySecretRegion, S as isFinalSnapshotError, Sn as buildLockContentionMessage, Sr as resolveStateBucketWithDefaultAndSource, St as getAccountInfo, T as makeCanonicalizePropertiesFn, Tn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Tr as warnDeprecatedNoPrefixCliFlag, Tt as refStateLookupFromResource, U as yellow, Un as ensureAssetStorage, Ur as resetAwsClients, Ut as s3BucketDualStackDomainName, V as green, Vn as BOOTSTRAP_MARKER_PREFIX, Vr as AwsClients, Vt as s3BucketArn, W as collectDeclaredOutputNames, Wn as getBootstrapMarkerKey, Wr as setAwsClients, Wt as s3BucketRegionalDomainName, X as secretSafeKeyDisplay, Xn as buildDenyExternalAccessPolicy, Xr as DeployCancelledError, Xt as findSilentDropProperties, Y as secretBearingStateKeyWarning, Yn as validateContainerRepoName, Yt as findActionableSilentDrops, Z as getCurrentResourceSecrets, Zn as describeAwsFailure, Zr as DynamicReferenceRegionAmbiguousError, Zt as describeTypeWithThrottleRetry, _ as ATOMIC_FINAL_SNAPSHOT_TYPES, _i as isThrottlingError, _n as LockManager, _r as resolveApp, _t as isTerminationProtectionPropagationError, a as DeploymentEventsStore, ai as ResourceTimeoutError, an as carriesSecretMask, ar as partitionSensitiveEnv, at as maskerOrIdentity, b as ccRoutedFinalSnapshotError, bi as markRedactedCause, bn as UNRENDERABLE, br as resolveSkipPrefix, bt as cfnRefValueFromPhysicalId, c as replayFailedOperations, ci as StackTerminationProtectionError, cn as errorCauseChain, cr as runDockerStreaming, ct as interruptWatchListenerCount, d as updatePartialReason, dn as maskSecretsInError, dr as AssetManifestLoader, dt as CloudControlProvider, ei as LocalStartServiceError, en as TemplateParser, er as describeDockerExecFailure, et as clearOnUpdateRemoval, f as withResourceDeadline, fn as maskSecretsInText, fr as getDockerImageBySourceHash, ft as slowCcOperationTimeoutMs, g as bindingSkippedOutputs, gi as isRetryableTransientError, gn as scrubResourceRecord, gr as getLegacyStateBucketName, gt as disableInstanceApiTermination, h as computeImplicitDeleteEdges, hi as isMarkedNonRetryable, hn as redactSecretsForState, hr as getDefaultStateBucketName, ht as deleteSkipReason, i as DeploymentEventsReader, ii as ProvisioningError, in as TEMPLATE_SOURCED_RULES, ir as getDockerCmd, it as maskDeep, j as isStatefulRecreateTargetSync, jn as orphansCarriedFrom, jr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, jt as configBooleanRefusal, k as MULTI_REGION_RECREATE_BLOCKED_TYPES, kn as importableOutputs, kr as findLargeInlineResources, kt as assertRegionMatch, l as replayRollback, ln as identityKeyFor, lr as escapeRegExp, lt as isInterruptedWaitError, m as IMPLICIT_DELETE_DEPENDENCIES, mi as withErrorHandling, mn as recoverMaskedOutput, mr as synthesisStatusMessage, mt as deleteIndeterminateGuards, n as DEFAULT_RESOURCE_WARN_AFTER_MS, ni as NestedStackChildDirectDestroyError, nn as STATE_SOURCED_CROSS_GENERATION_RULES, nr as dockerSpawnEnvWithSensitive, nt as wouldReturnToSdkProvider, o as planFailedOps, oi as ResourceUpdateNotSupportedError, on as createSecretMasker, or as redactDockerArgvValues, ot as beginCommandInterruptScope, p as maskingRetryLogger, pi as normalizeAwsError, pn as recordMaskOnlyValue, pr as Synthesizer, pt as UNSPECIFIED_SKIP_REASON, q as isExportAliasCollision, qn as readBootstrapMarkerBody, qt as DiffCalculator, r as DeployEngine, ri as PartialFailureError, rn as STATE_SOURCED_READBACK_RULES, rr as formatDockerLoginError, rt as createMaskedRetryLogger, s as planRollback, si as StackHasActiveImportsError, sn as dynamicReferenceTokens, sr as runDockerForeground, st as endCommandInterruptScope, t as DEFAULT_RESOURCE_TIMEOUT_MS, tn as STATE_SOURCED_BASELINE_RULES, tr as describeDockerFailure, tt as ProviderRegistry, u as updatePartialMessage, un as isSingleDynamicReferenceToken, ur as stripControlChars, ut as startInterruptWatch, v as PRE_DELETE_SNAPSHOT_TYPES, vi as isTransientServerError, vn as S3StateBackend, vr as resolveAutoAssetStorage, vt as IntrinsicFunctionResolver, w as unsupportedFinalSnapshotError, wn as shellQuote, wr as stateBucketExistenceConfirmed, wt as parameterTypeMayLoseSecretIdentity, x as createPreDeleteFinalSnapshot, xi as retryClassificationText, xn as buildForceUnlockCommand, xr as resolveStateBucketWithDefault, xt as coerceParameterTypedValue, y as buildFinalSnapshotIdentifier, yi as markNonRetryable, yn as rebuildClientForBucketRegion, yr as resolveCaptureObservedState, yt as carriesDynamicReference, z as cyan, zn as rewriteTemplateAssetReferences, zt as producerRegionsFromState } from "./deploy-engine-B6pEfNd9.js";
+import { _ as withSkipPrefix, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName } from "./logger-D2Md1kTq.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-4xTzOaA1.js";
-import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-CC6BMuNK.js";
+import { t as getCdkdVersion } from "./version-CCKo6fK2.js";
+import { r as protectedReplacementAdvice, t as ASGProvider } from "./asg-provider-1XVtAjhm.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -692,15 +692,70 @@ const allowUnsupportedTypesOption = new Option("--allow-unsupported-types <types
 * time so the user sees the error immediately.
 */
 const RESOURCE_PROPERTY_FORMAT = /^[A-Z][A-Za-z0-9]+(::[A-Z][A-Za-z0-9]+)+:[A-Z][A-Za-z0-9]*$/;
-function parseAllowUnsupportedPropertiesToken(value, previous) {
+/**
+* The flag the errors below name themselves after.
+*
+* Both spellings share one parser, so the message has to say which one the user
+* typed — quoting the canonical name at someone who typed the deprecated alias
+* sends them looking for a flag they did not use.
+*/
+function parseRouteEntries(value, previous, flag) {
 	const parsed = value.split(",").map((s) => s.trim()).filter(Boolean);
 	for (const token of parsed) {
-		if (!RESOURCE_PROPERTY_FORMAT.test(token)) throw new Error(`Invalid --allow-unsupported-properties value "${token}": expected <ResourceType>:<PropertyName> with PascalCase on both halves (e.g. AWS::Lambda::Function:RuntimeManagementConfig).`);
-		if (token.startsWith("Custom::")) throw new Error(`Invalid --allow-unsupported-properties value "${token}": Custom:: resources are routed through cfn-response and have no write-side silent drop at cdkd, so the flag would have no effect. Use --allow-unsupported-types for type-level escape hatches instead.`);
+		if (!RESOURCE_PROPERTY_FORMAT.test(token)) throw new Error(`Invalid ${flag} value "${token}": expected <ResourceType>:<PropertyName> with PascalCase on both halves (e.g. AWS::Lambda::Function:RuntimeManagementConfig).`);
+		if (token.startsWith("Custom::")) throw new Error(`Invalid ${flag} value "${token}": Custom:: resources are routed through cfn-response and have no write-side silent drop at cdkd, so the flag would have no effect. Use --allow-unsupported-types for type-level escape hatches instead.`);
 	}
 	return [...previous ?? [], ...parsed];
 }
-const allowUnsupportedPropertiesOption = new Option("--allow-unsupported-properties <entries>", "Comma-separated <ResourceType>:<PropertyName> tokens to accept as silently dropped at deploy time. Escape hatch — the property will NOT be written to AWS, the deployed resource will be missing the field. Example: --allow-unsupported-properties AWS::Lambda::Function:RuntimeManagementConfig,AWS::RDS::DBInstance:CACertificateIdentifier").argParser(parseAllowUnsupportedPropertiesToken);
+function parsePreferSdkRouteToken(value, previous) {
+	return parseRouteEntries(value, previous, "--prefer-sdk-route");
+}
+/**
+* Whether the deprecated alias has already warned this process.
+*
+* Commander calls the parser ONCE PER OCCURRENCE, and this flag is repeatable —
+* so without this a user passing it three times gets the deprecation notice
+* three times, which reads as three separate problems.
+*/
+let deprecatedAliasWarned = false;
+function parseAllowUnsupportedPropertiesToken(value, previous) {
+	if (!deprecatedAliasWarned) {
+		deprecatedAliasWarned = true;
+		process.stderr.write("--allow-unsupported-properties is deprecated and will be removed in the first minor release after 2026-12-01; use --prefer-sdk-route, which takes the same <ResourceType>:<PropertyName> tokens and does the same thing. The old name reads as the opposite of its behaviour: it does not make the property reach AWS, it keeps the resource on the SDK provider and accepts that the value is NOT written.\n");
+	}
+	return parseRouteEntries(value, previous, "--allow-unsupported-properties");
+}
+/**
+* `--prefer-sdk-route` — keep a resource on its SDK provider instead of letting
+* an unwired property auto-route it to Cloud Control (issue
+* [#3000](https://github.com/go-to-k/cdkd/issues/3000)).
+*
+* RENAMED from `--allow-unsupported-properties`, which read as the opposite of
+* what it does and rhymed with `--allow-unsupported-types`, a flag that runs the
+* OTHER way: that one ENABLES a Cloud Control attempt, this one DISABLES the
+* Cloud Control auto-route. Two independent readers took the old name backwards
+* in one session, one of them while writing 44 issue bodies describing it.
+*
+* `prefer`, not a negative or a guarantee, and the reason is mechanical rather
+* than stylistic. The allow set is per `<Type>:<Prop>` while ROUTING is per
+* RESOURCE, so one un-allowed sibling drop on the same resource sends the whole
+* resource to Cloud Control anyway — and Cloud Control then forwards the full
+* map, so the named property reaches AWS after all. A name promising "do not
+* route" would be a promise this flag cannot keep; `prefer` is the one modality
+* that is true in both cases.
+*
+* The help text therefore carries what the name deliberately does not: that the
+* values go UNWRITTEN when the preference is honoured, and that it is ignored
+* when the resource routes to Cloud Control for another reason.
+*/
+const preferSdkRouteOption = new Option("--prefer-sdk-route <entries>", "Comma-separated <ResourceType>:<PropertyName> tokens to keep on the SDK provider instead of auto-routing the resource to Cloud Control. The named values are then NOT written to AWS — the deployed resource is missing the field. Ignored for a resource that routes to Cloud Control for another reason (a sibling unwired property, or a sticky cc-api state record), where the values are written after all. Example: --prefer-sdk-route AWS::Lambda::Function:RuntimeManagementConfig").argParser(parsePreferSdkRouteToken);
+/**
+* The deprecated spelling. HIDDEN from `--help` so new users meet only the
+* successor, but still parsed so existing scripts keep working; it warns once
+* per process and feeds the SAME option name, so nothing downstream can tell
+* which spelling was used.
+*/
+const allowUnsupportedPropertiesOption = new Option("--allow-unsupported-properties <entries>", "Deprecated alias for --prefer-sdk-route.").argParser(parseAllowUnsupportedPropertiesToken).hideHelp();
 /**
 * Issue [#615] — `--recreate-via-cc-api <LogicalId>` (repeatable). Each
 * named resource is destroyed + recreated this deploy via Cloud Control
@@ -724,7 +779,7 @@ function parseRecreateViaCcApiToken(value, previous) {
 	if (!LOGICAL_ID_FORMAT.test(token)) throw new Error(`Invalid --recreate-via-cc-api value "${value}": expected a CloudFormation logical id (alphanumeric, starts with a letter, max 255 chars). One --recreate-via-cc-api flag per resource — repeat the flag for additional targets.`);
 	return [...previous ?? [], token];
 }
-const recreateViaCcApiOption = new Option("--recreate-via-cc-api <logicalId>", "Destroy + recreate the named resource (by CloudFormation logical id) via Cloud Control API in this deploy, so a top-level CFn property cdkd would otherwise silently drop reaches AWS via CC. Repeatable — pass the flag once per resource. Per-resource opt-in (no bulk / no per-stack shortcut) so the destroy-and-recreate cost is acknowledged for each target. Stateful resource types (RDS, DynamoDB, S3, EFS, ...) refuse unless --force-stateful-recreation is ALSO passed (two-flag protection). Cannot be combined with --allow-unsupported-properties on the same resource type and property.").argParser(parseRecreateViaCcApiToken);
+const recreateViaCcApiOption = new Option("--recreate-via-cc-api <logicalId>", "Destroy + recreate the named resource (by CloudFormation logical id) via Cloud Control API in this deploy, so a top-level CFn property cdkd would otherwise silently drop reaches AWS via CC. Repeatable — pass the flag once per resource. Per-resource opt-in (no bulk / no per-stack shortcut) so the destroy-and-recreate cost is acknowledged for each target. Stateful resource types (RDS, DynamoDB, S3, EFS, ...) refuse unless --force-stateful-recreation is ALSO passed (two-flag protection). Cannot be combined with --prefer-sdk-route on the same resource type and property.").argParser(parseRecreateViaCcApiToken);
 /**
 * Issue [#651] — `--recreate-via-sdk-provider <LogicalId>` is the reverse
 * direction of `--recreate-via-cc-api`. Once a resource is sticky on
@@ -897,6 +952,7 @@ const deployOptions = [
 	aggressiveVpcParallelOption,
 	new Option("-e, --exclusively", "Only deploy requested stacks, do not include dependencies").default(false),
 	allowUnsupportedTypesOption,
+	preferSdkRouteOption,
 	allowUnsupportedPropertiesOption,
 	recreateViaCcApiOption,
 	recreateViaSdkProviderOption,
@@ -2758,8 +2814,8 @@ function renderRecreateTargetsErrors(validation) {
 	}
 	if (validation.ambiguousIntent.length > 0) {
 		if (lines.length > 0) lines.push("");
-		lines.push(`Ambiguous intent — ${validation.ambiguousIntent.length} resource(s) are named in BOTH --recreate-via-cc-api and --allow-unsupported-properties with the same Type:Prop on a silent-drop property the template uses:`);
-		for (const overlap of validation.ambiguousIntent) lines.push(`  - ${overlap.logicalId} (${overlap.resourceType}) — both --recreate-via-cc-api ${overlap.logicalId} (would migrate to CC, honoring ${overlap.property}) AND --allow-unsupported-properties ${overlap.resourceType}:${overlap.property} (would keep on SDK, accepting silent drop)`);
+		lines.push(`Ambiguous intent — ${validation.ambiguousIntent.length} resource(s) are named in BOTH --recreate-via-cc-api and --prefer-sdk-route with the same Type:Prop on a silent-drop property the template uses:`);
+		for (const overlap of validation.ambiguousIntent) lines.push(`  - ${overlap.logicalId} (${overlap.resourceType}) — both --recreate-via-cc-api ${overlap.logicalId} (would migrate to CC, honoring ${overlap.property}) AND --prefer-sdk-route ${overlap.resourceType}:${overlap.property} (would keep on SDK, accepting silent drop)`);
 		lines.push(`  Fix: pick ONE strategy per resource.`);
 	}
 	if (validation.blockedStatefulTargets.length > 0) {
@@ -2809,9 +2865,9 @@ function renderRecreateTargetsErrors(validation) {
 	}
 	if (validation.ambiguousIntentSdk.length > 0) {
 		if (lines.length > 0) lines.push("");
-		lines.push(`Inverse ambiguous intent — ${validation.ambiguousIntentSdk.length} --recreate-via-sdk-provider target(s) would IMMEDIATELY be re-routed back to Cloud Control after the recreate because their template uses silent-drop properties NOT in --allow-unsupported-properties:`);
+		lines.push(`Inverse ambiguous intent — ${validation.ambiguousIntentSdk.length} --recreate-via-sdk-provider target(s) would IMMEDIATELY be re-routed back to Cloud Control after the recreate because their template uses silent-drop properties NOT in --prefer-sdk-route:`);
 		for (const overlap of validation.ambiguousIntentSdk) lines.push(`  - ${overlap.logicalId} (${overlap.resourceType}) — template uses ${overlap.property}; the default-on CC auto-route would re-route the recreated resource back to CC immediately`);
-		lines.push("  Fix: pass --allow-unsupported-properties <Type>:<Prop> for each silent-drop property so the recreated resource stays on SDK with the property explicitly dropped. Or drop --recreate-via-sdk-provider — the resource already routes via CC and honors the property.");
+		lines.push("  Fix: pass --prefer-sdk-route <Type>:<Prop> for each silent-drop property so the recreated resource stays on SDK with the property explicitly dropped. Or drop --recreate-via-sdk-provider — the resource already routes via CC and honors the property.");
 	}
 	return lines.length > 0 ? lines.join("\n") : null;
 }
@@ -61046,8 +61102,9 @@ async function runDestroyForStack(stackName, state, ctx) {
 	};
 	const guardIndeterminateTargets = /* @__PURE__ */ new Set();
 	const resourceCount = Object.keys(state.resources).length;
+	const orphanCount = (state.orphans ?? []).length;
 	const regionForState = state.region ?? ctx.baseRegion;
-	if (resourceCount === 0) {
+	if (resourceCount === 0 && orphanCount === 0) {
 		logger.info(`Stack ${stackName} has no resources, cleaning up state...`);
 		let emptyLockHeld = false;
 		let emptyInterrupted = false;
@@ -61093,7 +61150,9 @@ async function runDestroyForStack(stackName, state, ctx) {
 		emptyLockHeld = true;
 		try {
 			const recheck = await ctx.stateBackend.getState(stackName, regionForState);
-			if (!(!recheck || Object.keys(recheck.state.resources).length === 0)) throw new Error(`Stack '${stackName}' (${regionForState}) was empty when this run started but now has ${Object.keys(recheck.state.resources).length} resource(s) — another cdkd process deployed into it. Re-run the destroy to act on the current state.`);
+			const recheckResources = recheck ? Object.keys(recheck.state.resources).length : 0;
+			const recheckOrphans = recheck ? (recheck.state.orphans ?? []).length : 0;
+			if (!(!recheck || recheckResources === 0 && recheckOrphans === 0)) throw new Error(`Stack '${stackName}' (${regionForState}) was empty when this run started but now has ${recheckResources} resource(s) and ${recheckOrphans} rollback-orphaned resource(s) — another cdkd process wrote to it. Re-run the destroy to act on the current state.`);
 			await ctx.stateBackend.deleteState(stackName, regionForState);
 			logger.info(`${green("✓")} State deleted`);
 		} finally {
@@ -61116,6 +61175,12 @@ async function runDestroyForStack(stackName, state, ctx) {
 	logger.info(`\nResources to be deleted (${resourceCount}):`);
 	for (const [logicalId, resource] of Object.entries(state.resources)) logger.info(`  - ${logicalId} (${resource.resourceType})`);
 	const protectedCount = ctx.removeProtection ? countProtectedResources(state) : 0;
+	const orphansAtDestroy = state.orphans ?? [];
+	if (orphansAtDestroy.length > 0) {
+		logger.info(`\n${orphansAtDestroy.length} resource(s) are still in AWS from an earlier failed deploy. cdkd left them there because their DeletionPolicy is Retain (CDK's RemovalPolicy.RETAIN), and has been tracking them so a later deploy of this stack could adopt them back instead of colliding with their names.`);
+		logger.info("Destroying this stack deletes that record. The resources stay in AWS, may continue to incur charges, and cdkd will no longer know about them:");
+		for (const entry of orphansAtDestroy) logger.info(`  - ${entry.logicalId} (${entry.state.resourceType})  ${entry.state.physicalId}`);
+	}
 	if (!ctx.skipConfirmation) {
 		if (process.stdin.isTTY !== true) throw new CdkdError(`The destroy confirmation prompt for stack "${stackName}" cannot run in a non-interactive environment. Pass --yes / -y to confirm the destroy (cdkd destroy also accepts -f / --force), or run the command from a real terminal.`, "NON_INTERACTIVE_CONFIRM");
 		const rl = readline$1.createInterface({
@@ -63165,7 +63230,8 @@ async function deployCommand(stacks, options) {
 			registerAllProviders(stackProviderRegistry);
 			stackProviderRegistry.setCustomResourceResponseBucket(stateBucket);
 			if (options.allowUnsupportedTypes?.length) stackProviderRegistry.allowUnsupportedTypes(options.allowUnsupportedTypes);
-			if (options.allowUnsupportedProperties?.length) stackProviderRegistry.allowUnsupportedProperties(options.allowUnsupportedProperties);
+			const preferSdkRoute = [...options.preferSdkRoute ?? [], ...options.allowUnsupportedProperties ?? []];
+			if (preferSdkRoute.length) stackProviderRegistry.allowUnsupportedProperties(preferSdkRoute);
 			const eventRecorder = startRunRecorder({
 				backend: stackStateBackend,
 				stackName: stackInfo.stackName,
@@ -63186,7 +63252,7 @@ async function deployCommand(stacks, options) {
 					const syncValidation = validateRecreateTargets({
 						template: stackInfo.template,
 						state: stateForRecreateCheck?.state ?? {
-							version: 9,
+							version: 10,
 							stackName: stackInfo.stackName,
 							region: stackRegion,
 							resources: {},
@@ -63195,7 +63261,7 @@ async function deployCommand(stacks, options) {
 						},
 						recreateViaCcApi: options.recreateViaCcApi ?? [],
 						recreateViaSdkProvider: options.recreateViaSdkProvider ?? [],
-						allowUnsupportedProperties: new Set(options.allowUnsupportedProperties ?? []),
+						allowUnsupportedProperties: /* @__PURE__ */ new Set([...options.preferSdkRoute ?? [], ...options.allowUnsupportedProperties ?? []]),
 						forceStatefulRecreation: options.forceStatefulRecreation ?? false,
 						hasSdkProvider: (rt) => stackProviderRegistry.getProviderType(rt) === "sdk"
 					});
@@ -64849,7 +64915,7 @@ async function loadStateOrEmpty(stackName, region, stateBackend) {
 		region,
 		resources: {},
 		outputs: {},
-		version: 9,
+		version: 10,
 		lastModified: Date.now()
 	};
 }
@@ -64996,7 +65062,24 @@ async function computeStackDiff(currentState, template, region, stackName, state
 		...conditions && { conditions },
 		skipDynamicReferences: true
 	});
-	const changes = await diffCalculator.calculateDiff(currentState, effectiveTemplate, resolveFn, canonicalizeProperties);
+	let adoptedOrphans = [];
+	let adoptedRecords = {};
+	let blocking = [];
+	let stateForDiff = currentState;
+	if (currentState.orphans?.length && options.previewOrphanAdoption) {
+		const plan = await options.previewOrphanAdoption(currentState, effectiveTemplate, stackName, region);
+		adoptedOrphans = Object.keys(plan.adopted);
+		adoptedRecords = plan.adopted;
+		blocking = plan.refusals;
+		if (adoptedOrphans.length > 0) stateForDiff = {
+			...currentState,
+			resources: {
+				...currentState.resources,
+				...plan.adopted
+			}
+		};
+	}
+	const changes = await diffCalculator.calculateDiff(stateForDiff, effectiveTemplate, resolveFn, canonicalizeProperties);
 	const changedLogicalIds = new Set([...changes.values()].filter((c) => c.changeType !== "NO_CHANGE").map((c) => c.logicalId));
 	const bindingSkipped = bindingSkippedOutputs(outputsDigestSource, currentState.skippedOutputs, changedLogicalIds);
 	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions, currentState.outputs, bindingSkipped);
@@ -65012,7 +65095,10 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	});
 	return {
 		changes,
-		outputChanges
+		outputChanges,
+		adoptedOrphans,
+		adoptedRecords,
+		blocking
 	};
 }
 /**
@@ -65075,22 +65161,32 @@ async function resolveChildStackParameters(parentStackRow, parentTemplate, paren
 * fail at deploy time.
 */
 async function buildDiffTree(args) {
-	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback } = args;
+	const { stackName, displayName, region, template, nestedTemplates, recursive, stateBackend, diffCalculator, parentHasSecretReference, parameters, canonicalizeProperties, assetRedirect, cfnFallback, previewOrphanAdoption } = args;
 	const state = await loadStateOrEmpty(stackName, region, stateBackend);
 	const secretBearingAbove = parentHasSecretReference === true || templateHasSecretDynamicReference(template);
-	const { changes, outputChanges } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
+	const { changes, outputChanges, adoptedOrphans, adoptedRecords, blocking } = await computeStackDiff(state, template, region, stackName, stateBackend, diffCalculator, {
 		...parameters && { parameters },
 		...canonicalizeProperties && { canonicalizeProperties },
 		...cfnFallback !== void 0 && { cfnFallback },
+		...previewOrphanAdoption && { previewOrphanAdoption },
 		inheritSecretBearingTemplate: false
 	});
+	const stateAfterAdoption = Object.keys(adoptedRecords).length > 0 ? {
+		...state,
+		resources: {
+			...state.resources,
+			...adoptedRecords
+		}
+	} : state;
 	const node = {
 		stackName,
 		displayName,
 		region,
 		changes,
-		ccApiRoutes: collectCcApiRoutes(template, state),
+		ccApiRoutes: collectCcApiRoutes(template, stateAfterAdoption),
 		outputChanges,
+		adoptedOrphans,
+		blocking,
 		children: []
 	};
 	if (!recursive) return node;
@@ -65104,7 +65200,7 @@ async function buildDiffTree(args) {
 		const childTemplate = readNestedTemplate(childTemplatePath);
 		if (assetRedirect) rewriteTemplateAssetReferences(childTemplate, assetRedirect);
 		const grandchildTemplates = indexNestedChildTemplates(childTemplate, childTemplatePath);
-		const childParameters = await resolveChildStackParameters(resource, template, state, region, stackName, stateBackend, parameters, cfnFallback);
+		const childParameters = await resolveChildStackParameters(resource, template, stateAfterAdoption, region, stackName, stateBackend, parameters, cfnFallback);
 		node.children.push(await buildDiffTree({
 			stackName: childStackName,
 			displayName: childStackName,
@@ -65118,6 +65214,7 @@ async function buildDiffTree(args) {
 			...canonicalizeProperties && { canonicalizeProperties },
 			...assetRedirect && { assetRedirect },
 			...cfnFallback !== void 0 && { cfnFallback },
+			...previewOrphanAdoption && { previewOrphanAdoption },
 			parentHasSecretReference: secretBearingAbove
 		}));
 	}
@@ -65143,6 +65240,8 @@ async function buildDeletedSubtree(stackName, region, stateBackend, diffCalculat
 		region,
 		changes,
 		ccApiRoutes: /* @__PURE__ */ new Map(),
+		adoptedOrphans: [],
+		blocking: [],
 		outputChanges,
 		children: []
 	};
@@ -65209,9 +65308,41 @@ function collectCcApiRoutes(template, state) {
 /** True when this node has at least one real (non-`NO_CHANGE`) change. */
 function nodeHasChanges(node) {
 	for (const change of node.changes.values()) if (change.changeType !== "NO_CHANGE") return true;
-	return node.outputChanges.length > 0;
+	return node.outputChanges.length > 0 || node.adoptedOrphans.length > 0;
 }
 /** True when this node OR any descendant has a real change (tree-wide drift detector for `--fail`). */
+/**
+* How many deploy refusals the whole tree carries (issue go-to-k/cdkd#2943).
+*
+* A COUNT rather than a boolean because the caller's message quotes it.
+* {@link treeIsWorthRendering} below IS a boolean built on this, added when
+* review found the render gate gated on changes alone — it derives from this
+* count rather than walking the tree again, so there is still one recursion to
+* keep in step.
+*
+* Deliberately SEPARATE from {@link treeHasChanges}: `--fail` answers "is
+* there a delta", and a refusal is not a delta — a user who runs
+* `cdkd diff --fail` in CI to detect drift must not have that signal merged
+* with "the deploy cannot start", which is true whether or not anything
+* changed.
+*/
+function countBlocking(node) {
+	return node.blocking.length + node.children.reduce((n, c) => n + countBlocking(c), 0);
+}
+/**
+* Whether `cdkd diff` should render this tree's block at all (issue
+* go-to-k/cdkd#2943).
+*
+* A named predicate rather than an inline conjunction at the call site,
+* because the two halves are easy to get wrong INDEPENDENTLY and were:
+* {@link renderDiffTree} was written to print a `Blocking` section for a node
+* with no changes, and the caller then skipped the render on
+* `!treeHasChanges` alone — so a changeless refusal would print "No changes
+* detected" and exit non-zero citing reasons that were never printed.
+*/
+function treeIsWorthRendering(node) {
+	return treeHasChanges(node) || countBlocking(node) > 0;
+}
 function treeHasChanges(node) {
 	if (nodeHasChanges(node)) return true;
 	return node.children.some(treeHasChanges);
@@ -65248,6 +65379,8 @@ function diffTreeToJson(node) {
 			...change.changeType !== "REMOVE" ? { newValue: change.newValue } : {},
 			export: change.isExport
 		})),
+		adoptedOrphans: node.adoptedOrphans,
+		blocking: node.blocking,
 		children: node.children.map(diffTreeToJson)
 	};
 }
@@ -65340,11 +65473,22 @@ function renderDiffValue(own, filtered, indent, isNewSide) {
 * #614's auto-fallback decision at plan time. DELETE lines are not annotated
 * — the delete routing is recorded on each resource's `provisionedBy` state
 * field rather than re-derived from the template.
+*
+* `adoptedOrphans` annotates the rows whose resource is in this diff only
+* because a rollback-orphan record was verified and spliced in (issue
+* go-to-k/cdkd#2943). Without it the row is indistinguishable from an ordinary
+* update, and the user last saw that resource FAIL and leave state — so an
+* unannotated `[~]` reads as cdkd having quietly kept managing it. Both
+* annotations can apply to one row; adoption is printed first because it is
+* why the row exists at all, where the routing describes how it will be
+* carried out.
 */
-function renderChangeLines(changes, logFn, ccApiRoutes) {
+function renderChangeLines(changes, logFn, ccApiRoutes, adoptedOrphans) {
 	let createCount = 0;
 	let updateCount = 0;
 	let deleteCount = 0;
+	const adopted = new Set(adoptedOrphans ?? []);
+	const annotateAdoption = (logicalId) => adopted.has(logicalId) ? " [adopted from a rollback orphan]" : "";
 	const annotateRouting = (logicalId) => {
 		const props = ccApiRoutes?.get(logicalId);
 		if (!props || props.length === 0) return "";
@@ -65354,11 +65498,11 @@ function renderChangeLines(changes, logFn, ccApiRoutes) {
 	for (const [logicalId, change] of changes.entries()) switch (change.changeType) {
 		case "CREATE":
 			createCount++;
-			logFn(`  [+] ${logicalId} (${change.resourceType})${annotateRouting(logicalId)}`);
+			logFn(`  [+] ${logicalId} (${change.resourceType})${annotateAdoption(logicalId)}${annotateRouting(logicalId)}`);
 			break;
 		case "UPDATE":
 			updateCount++;
-			logFn(`  [~] ${logicalId} (${change.resourceType})${annotateRouting(logicalId)}`);
+			logFn(`  [~] ${logicalId} (${change.resourceType})${annotateAdoption(logicalId)}${annotateRouting(logicalId)}`);
 			if (change.propertyChanges && change.propertyChanges.length > 0) for (const propChange of change.propertyChanges) {
 				const requiresReplace = propChange.requiresReplacement ? " [requires replacement]" : "";
 				const propagated = propChange.replacementPropagated ? " [replacement propagated]" : "";
@@ -65466,12 +65610,18 @@ function renderOutputChangeLines(outputChanges, logFn) {
 * (the A4 `state show --show-nested` convention, full `~`-joined name).
 */
 function renderDiffTree(node, isRoot, logFn) {
-	if (nodeHasChanges(node)) {
-		logFn(isRoot ? `\nStack ${node.stackName}:` : `\nNested stack: ${node.displayName}`);
-		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes);
+	const hasChanges = nodeHasChanges(node);
+	if (hasChanges || node.blocking.length > 0) logFn(isRoot ? `\nStack ${node.stackName}:` : `\nNested stack: ${node.displayName}`);
+	if (hasChanges) {
+		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes, node.adoptedOrphans);
 		const outputs = renderOutputChangeLines(node.outputChanges, logFn);
 		logFn(`\n${create} to create, ${update} to update, ${del} to delete`);
 		if (outputs.add + outputs.change + outputs.remove > 0) logFn(`${outputs.add} output(s) to add, ${outputs.change} to change, ${outputs.remove} to remove`);
+		if (node.adoptedOrphans.length > 0) logFn(`${node.adoptedOrphans.length} resource(s) to adopt from a previous rollback: ${node.adoptedOrphans.map(stripControlChars).join(", ")}`);
+	}
+	if (node.blocking.length > 0) {
+		logFn("\n  Blocking (cdkd deploy will refuse):");
+		for (const reason of node.blocking) logFn(`    ! ${stripControlChars(reason)}`);
 	}
 	for (const child of node.children) renderDiffTree(child, false, logFn);
 }
@@ -65493,6 +65643,35 @@ var DiffDetectedError = class DiffDetectedError extends CdkdError {
 	}
 };
 /**
+* Signals that the preview completed and `cdkd deploy` would REFUSE to start
+* (issue go-to-k/cdkd#2943) — today, a rollback-orphan record whose physical
+* id another cdkd stack already manages.
+*
+* Exit **3**, and neither 1 nor 2, for reasons that are about what a caller
+* can conclude:
+*
+*  - **1** is `--fail`'s "a change was detected". A refusal is not a change,
+*    and merging them would make a CI job that gates on drift report the same
+*    code for "there is work to do" and "the work cannot begin".
+*  - **2** is this CLI's partial-failure family, documented as "work
+*    completed, re-running typically resolves it" (`docs/cli-reference.md`).
+*    A refusal is the opposite: re-running changes nothing until a human
+*    resolves the ownership conflict.
+*
+* It is NOT silent: unlike `--fail`, this is not a flag the user opted into,
+* so the reason has to be visible even when the diff report scrolled away.
+* The `Blocking` section already printed the per-record detail; this adds the
+* one line that says the run cannot proceed.
+*/
+var DeployRefusalPreviewError = class DeployRefusalPreviewError extends CdkdError {
+	exitCode = 3;
+	constructor(count) {
+		super(`cdkd deploy would refuse to start: ${count} blocking condition(s) reported above. Resolve them, or run \`cdkd state\` to inspect the conflicting stack.`, "DEPLOY_REFUSAL_PREVIEW");
+		this.name = "DeployRefusalPreviewError";
+		Object.setPrototypeOf(this, DeployRefusalPreviewError.prototype);
+	}
+};
+/**
 * Diff command implementation
 */
 async function diffCommand(stacks, options) {
@@ -65553,6 +65732,34 @@ async function diffCommand(stacks, options) {
 		const diffProviderRegistry = new ProviderRegistry();
 		registerAllProviders(diffProviderRegistry);
 		const canonicalizeProperties = makeCanonicalizePropertiesFn(diffProviderRegistry);
+		const previewOrphanAdoption = async (state, effectiveTemplate, orphanStackName, orphanRegion) => {
+			const outcome = await planOrphanAdoption({
+				records: state.orphans ?? [],
+				managedLogicalIds: new Set(Object.keys(state.resources)),
+				template: effectiveTemplate,
+				stackName: orphanStackName,
+				region: orphanRegion,
+				getProvider: (resourceType, provisionedBy) => diffProviderRegistry.getProviderFor({
+					resourceType,
+					provisionedBy
+				}).provider,
+				nameProperties: (resourceType) => {
+					const property = explicitNamePropertyFor(resourceType);
+					return property ? [property] : [];
+				},
+				readSiblingClaims: makeSiblingClaimReader({
+					stateBackend,
+					selfStackName: orphanStackName,
+					selfRegion: orphanRegion,
+					logger
+				}),
+				logger
+			});
+			return {
+				adopted: outcome.adopted,
+				refusals: outcome.refusals
+			};
+		};
 		const recursive = options.recursive ?? false;
 		const resolveAssetRedirect = createAssetRedirectResolver({
 			stateBackend,
@@ -65581,17 +65788,20 @@ async function diffCommand(stacks, options) {
 				diffCalculator,
 				canonicalizeProperties,
 				...assetRedirect && { assetRedirect },
-				...options.cfnFallback === false && { cfnFallback: false }
+				...options.cfnFallback === false && { cfnFallback: false },
+				previewOrphanAdoption
 			}));
 		}
 		if (options.json) process.stdout.write(`${JSON.stringify(trees.map(diffTreeToJson), null, 2)}\n`);
 		else for (const tree of trees) {
-			if (!treeHasChanges(tree)) {
+			if (!treeIsWorthRendering(tree)) {
 				logger.info(`\n✓ No changes detected for stack ${tree.stackName}`);
 				continue;
 			}
 			renderDiffTree(tree, true, (msg) => logger.info(msg));
 		}
+		const blockingCount = trees.reduce((n, tree) => n + countBlocking(tree), 0);
+		if (blockingCount > 0) throw new DeployRefusalPreviewError(blockingCount);
 		if (options.fail && trees.some(treeHasChanges)) throw new DiffDetectedError();
 	} finally {
 		awsClients.destroy();
@@ -66109,10 +66319,9 @@ async function scrubCommand(stacks, options) {
 * (issue #2005) — the outputs' own map plus every resource's, filtered to the
 * values long enough to be a safe needle.
 *
-* Used ONLY by {@link redactUnaccountedOutputs}, which is why the union is built
-* here rather than kept as the pass's input everywhere: `outputSecrets` and
-* `perResourceSecrets` are deliberately SEPARATE bags so one resource's secret
-* value cannot rewrite another resource's coinciding literal (the collision the
+* Built here rather than kept as each pass's input everywhere — `outputSecrets`
+* and `perResourceSecrets` are deliberately SEPARATE bags so one resource's
+* secret value cannot rewrite another's coinciding literal (the collision the
 * deploy engine's `perResourceSecrets` doc describes), and widening the bag the
 * RESOURCE walk uses would re-open exactly that.
 *
@@ -66198,9 +66407,10 @@ async function scrubCommand(stacks, options) {
 * command can. Refusing the substring arm here would trade the irreversible
 * failure for the reversible one in the wrong direction.
 */
-function allRecordedSecrets(outputSecrets, perResourceSecrets) {
+function allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets) {
 	const union = /* @__PURE__ */ new Map();
 	for (const recorded of perResourceSecrets.values()) for (const [value, expression] of recorded) union.set(value, expression);
+	for (const recorded of orphanSecrets.values()) for (const [value, expression] of recorded) union.set(value, expression);
 	for (const [value, expression] of outputSecrets) union.set(value, expression);
 	for (const value of union.keys()) if (value.length < 4) union.delete(value);
 	return union;
@@ -67721,6 +67931,13 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	if (acquired) await lockManager.acquireLockWithRetry(stack.stackName, region, void 0, "scrub");
 	const perResourceSecrets = /* @__PURE__ */ new Map();
 	const outputSecrets = /* @__PURE__ */ new Map();
+	/**
+	* Needles derived from each rollback-orphan record's OWN recorded bag
+	* (issue go-to-k/cdkd#2943), keyed by logical id — per-record for the same
+	* reason `perResourceSecrets` is per-resource: one record's secret must not
+	* rewrite another's coinciding literal.
+	*/
+	const orphanSecrets = /* @__PURE__ */ new Map();
 	const prePassFindings = { unverifiable: [] };
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
@@ -67801,6 +68018,27 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
 			}
+			for (const record of state.orphans ?? []) {
+				const recordedSecretValues = /* @__PURE__ */ new Map();
+				orphanSecrets.set(record.logicalId, recordedSecretValues);
+				const resolveInput = await pinCrossRegionSecrets({
+					properties: record.state.properties,
+					attributes: record.state.attributes ?? {},
+					observedProperties: record.state.observedProperties ?? {}
+				}, stack.stackName, {
+					stackRegion: region,
+					producerRegions,
+					resolvers,
+					recordedSecretValues,
+					origin: `orphan record '${record.logicalId}'`
+				});
+				try {
+					await resolver.resolve(resolveInput, resolverContext(recordedSecretValues));
+				} catch (err) {
+					if (isRegionAmbiguousRefusal(err)) throw err;
+					logger.debug(`Resolution of orphan record ${record.logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
+				}
+			}
 			for (const [name, output] of Object.entries(templateOutputs)) {
 				const declaredExportName = output.Export?.Name;
 				let exportName = declaredExportName;
@@ -67871,7 +68109,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretBearingKeys.push(key);
 			logger.warn(secretBearingStateKeyWarning(stack.stackName, display));
 		}
-		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0);
+		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0) + [...orphanSecrets.values()].reduce((n, m) => n + m.size, 0);
 		if (totalSecrets === 0) return {
 			recordsChanged: 0,
 			secretsFound: 0,
@@ -67894,13 +68132,27 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			if (JSON.stringify(scrubbed) !== JSON.stringify(record)) recordsChanged++;
 			newResources[logicalId] = scrubbed;
 		}
-		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets));
+		const newOrphans = (state.orphans ?? []).map((record) => {
+			const own = orphanSecrets.get(record.logicalId);
+			const needles = new Map(allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
+			for (const [plaintext, expression] of own ?? []) needles.set(plaintext, expression);
+			if (needles.size === 0) return record;
+			const scrubbed = scrubResourceRecord(record.state, needles, void 0, STATE_SOURCED_CROSS_GENERATION_RULES);
+			if (JSON.stringify(scrubbed) === JSON.stringify(record.state)) return record;
+			recordsChanged++;
+			return {
+				...record,
+				state: scrubbed
+			};
+		});
+		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
 			const { skippedOutputs: _droppedByScrub, ...carriedState } = state;
 			const nextState = {
 				...carriedState,
 				resources: newResources,
+				...state.orphans !== void 0 && { orphans: newOrphans },
 				outputs: newOutputs,
 				lastModified: Date.now()
 			};
@@ -67915,7 +68167,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 		};
 	} catch (err) {
-		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets));
+		throw maskSecretsInError(err, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 	} finally {
 		if (acquired) await lockManager.releaseLock(stack.stackName, region).catch((err) => {
 			logger.warn(`Failed to release lock for ${stack.stackName}: ${err instanceof Error ? err.message : String(err)}`);
@@ -68826,6 +69078,17 @@ function stripWalk(value) {
 //#endregion
 //#region src/cli/commands/drift.ts
 /**
+* The schema version at which `ResourceState.observedBaselineRefused` arrived.
+* A record BELOW it could not carry a refusal, which is what
+* {@link warnIfPreV10BaselineGap} keys on (issue
+* [#3011](https://github.com/go-to-k/cdkd/issues/3011)).
+*
+* A literal rather than `STATE_SCHEMA_VERSION_CURRENT`: this is a FIXED
+* historical boundary, and binding it to "current" would silently stop warning
+* about v10 records on the next bump — the population it names does not move.
+*/
+const PRE_V10_BASELINE_WARNING_FLOOR = 10;
+/**
 * Route one outcome to the handler for its variant.
 *
 * The mechanism issue [#2135](https://github.com/go-to-k/cdkd/issues/2135) asks
@@ -69047,6 +69310,10 @@ const UNCOMPARED_REASONS = {
 		kind: "unknown",
 		phrase: "not compared AT ALL: the read or comparison failed"
 	},
+	baselineRefused: {
+		kind: "unknown",
+		phrase: "not compared AT ALL: a `cdkd import` run refused to capture their observed baseline"
+	},
 	refused: {
 		kind: "unknown",
 		phrase: "only PARTIALLY compared: cdkd refused to resolve a dynamic reference their state records"
@@ -69592,7 +69859,8 @@ function notComparedReason(cause) {
 	return {
 		refused: "cdkd refused to resolve a dynamic reference its state records (spell the reference as a full ARN, which names its region)",
 		unresolvedToken: "its state records a `{{resolve:...}}` spelling cdkd resolves for nobody (permanent; a re-run cannot clear it)",
-		readFailed: "the read or comparison threw, so NONE of its properties were compared"
+		readFailed: "the read or comparison threw, so NONE of its properties were compared",
+		baselineRefused: "a `cdkd import` run refused to capture its observed baseline, so the only baseline available is the recorded properties that refusal already found untrustworthy (deploy a change to this resource to restore one)"
 	}[cause];
 }
 /**
@@ -69980,6 +70248,15 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				});
 				continue;
 			}
+			if (resource.observedBaselineRefused === true) {
+				outcomes.push({
+					kind: "notCompared",
+					logicalId,
+					resourceType: resource.resourceType,
+					notComparedCause: "baselineRefused"
+				});
+				continue;
+			}
 			try {
 				let aws;
 				if (provider.readCurrentState) aws = await provider.readCurrentState(resource.physicalId, logicalId, resource.resourceType, resource.properties ?? {}, buildReadCurrentStateContext(state, logicalId));
@@ -70106,17 +70383,56 @@ async function runDriftForStack(stackName, region, stateBackend, providerRegistr
 				continue;
 			}
 		}
+		const warnings = warnIfPreV10BaselineGap(state, outcomes, logger);
 		return {
 			stackName,
 			region,
 			outcomes,
 			state,
 			etag: result.etag,
-			migrationPending: result.migrationPending ?? false
+			migrationPending: result.migrationPending ?? false,
+			warnings
 		};
 	});
 }
 /**
+* Warn once for a stack whose state PREDATES the refused-baseline marker
+* (`ResourceState.observedBaselineRefused`, state schema v10) and still has a
+* resource without a drift baseline (issue
+* [#3011](https://github.com/go-to-k/cdkd/issues/3011)).
+*
+* Both conjuncts are load-bearing, and neither is a heuristic:
+*
+*  - `version < 10` is not "probably imported" — it is the exact statement that
+*    this record could not carry a refusal even if one was made. A v10 record
+*    that omits the field is a record nothing refused, and warning there would
+*    be false.
+*  - the missing baseline is what makes the warning ACTIONABLE. A pre-v10 stack
+*    where every resource has a baseline has nothing for drift to fall back to
+*    `properties` for, so it cannot hit the disclosure.
+*
+* Exported for unit testing -- internal to the drift flow otherwise.
+*/
+function warnIfPreV10BaselineGap(state, outcomes, logger) {
+	if ((state.version ?? 1) >= PRE_V10_BASELINE_WARNING_FLOOR) return [];
+	const compared = new Set(outcomes.flatMap((o) => matchOutcome(o, {
+		drifted: (d) => [d.logicalId],
+		clean: (c) => [c.logicalId],
+		notCompared: (n) => [n.logicalId],
+		unsupported: () => [],
+		skipped: () => []
+	})));
+	const affected = Object.entries(state.resources ?? {}).filter(([id, r]) => r.observedProperties === void 0 && compared.has(id)).map(([id]) => id);
+	if (affected.length === 0) return [];
+	const shown = affected.slice(0, 10).join(", ");
+	const rest = affected.length > 10 ? `, and ${affected.length - 10} more` : "";
+	const finding = `${state.stackName} (${state.region ?? "unknown region"}): this stack's state predates cdkd's refused-baseline marker (schema v${state.version ?? 1}; the marker arrived in v${PRE_V10_BASELINE_WARNING_FLOOR}), and ${affected.length} of its compared resource(s) have no drift baseline: ${shown}${rest}. If any were adopted by 'cdkd import' and that import REFUSED to capture a baseline, cdkd cannot tell — so it compares them against their recorded properties, which can hold a placeholder the deployed stack never used and can surface a live secret in this report. Re-run 'cdkd import' for this stack to put the record right.`;
+	const note = "  Note: ANY write to this stack's state — including this run's --accept / --revert, or a deploy that changes nothing about the resources above — re-stamps it at the current schema version and SILENCES this warning without fixing those records. Only a re-import, or a deploy that actually CHANGES a listed resource, repairs one.";
+	logger.warn(finding);
+	logger.warn(note);
+	return [finding, note];
+}
+/**
 * Set a value at a dotted path inside a plain object, creating intermediate
 * objects as needed. Mirrors `lodash.set` for the subset of paths the drift
 * comparator actually emits — dotted nested keys, no array indices.
@@ -70226,6 +70542,10 @@ async function runAccept(reports, stateBackend, stateConfig, awsClients, options
 			for (const outcome of driftedOutcomes) {
 				const existing = resources[outcome.logicalId];
 				if (!existing) continue;
+				if (existing.observedBaselineRefused === true) {
+					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): NOT accepted — a 'cdkd import' run refused to capture this resource's observed-properties baseline, because its recorded properties can no longer position the secret redaction. Accepting would write the AWS readback into those properties, which can persist a resolved secret into state.json in plaintext. Deploy a change to this resource to restore a baseline first.`);
+					continue;
+				}
 				const hasObserved = existing.observedProperties !== void 0;
 				const baselineSource = hasObserved ? existing.observedProperties : existing.properties ?? {};
 				const newBaseline = JSON.parse(JSON.stringify(baselineSource));
@@ -71389,6 +71709,11 @@ async function runRevert(reports, providerRegistry, stateBackend, stateConfig, a
 					logger.error(`  ✗ ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): resource missing from state; skipped.`);
 					return;
 				}
+				if (stateResource.observedBaselineRefused === true) {
+					totalUnresolvable++;
+					logger.warn(`  ! ${report.stackName}/${outcome.logicalId} (${outcome.resourceType}): NOT reverted — a 'cdkd import' run refused to capture this resource's observed-properties baseline, so the only baseline available is its recorded properties, which the refusal already found untrustworthy. Reverting from them could overwrite a live value (a resolved secret among them) with a placeholder the deployed stack never used. Deploy a change to this resource to restore a baseline first.`);
+					return;
+				}
 				const provider = providerRegistry.getProviderFor({
 					resourceType: outcome.resourceType,
 					provisionedBy: stateResource.provisionedBy
@@ -71571,6 +71896,10 @@ function printAcceptPlan(reports, out) {
 		const lines = [];
 		let plannedWrites = 0;
 		for (const o of drifted) {
+			if (report.state.resources[o.logicalId]?.observedBaselineRefused === true) {
+				lines.push(`  ~ ${o.logicalId} (${o.resourceType})\n    SKIPPED — a 'cdkd import' run refused this resource's observed-properties baseline; accepting would write the AWS readback into properties it already found untrustworthy. Deploy a change to this resource first.\n`);
+				continue;
+			}
 			lines.push(`  ~ ${o.logicalId} (${o.resourceType})\n`);
 			for (const change of o.changes) {
 				const refusal = acceptRefusalReason(change, o.maskedPaths);
@@ -71603,6 +71932,10 @@ function printRevertPlan(reports, out) {
 		if (drifted.length === 0) continue;
 		out.write(`\nPlan (--revert): push cdkd state values back into AWS for ${report.stackName} (${report.region}):\n`);
 		for (const o of drifted) {
+			if (report.state.resources[o.logicalId]?.observedBaselineRefused === true) {
+				out.write(`  ! ${o.logicalId} (${o.resourceType}): NOT reverted — a 'cdkd import' run refused this resource's observed-properties baseline, so the only baseline available is the one that refusal already found untrustworthy. Deploy a change to this resource first.\n`);
+				continue;
+			}
 			const word = o.changes.length === 1 ? "property path" : "property paths";
 			out.write(`  → provider.update on ${o.logicalId} (${o.resourceType}): revert ${o.changes.length} ${word}\n`);
 			for (const change of o.changes) out.write(`    ${change.path}: ${formatScalar(change.awsValue)} -> ${formatScalar(change.stateValue)}\n`);
@@ -71709,12 +72042,13 @@ function writeJsonReport(reports) {
 		const notCompared = notComparedOutcomes(r).map(({ outcome, cause }) => ({
 			logicalId: outcome.logicalId,
 			type: outcome.resourceType,
-			referencesUnresolved: cause !== "readFailed",
+			referencesUnresolved: cause !== "readFailed" && cause !== "baselineRefused",
 			cause
 		}));
 		return {
 			stack: r.stackName,
 			region: r.region,
+			...r.warnings.length > 0 && { warnings: r.warnings },
 			drifted,
 			clean,
 			notSupported,
@@ -71753,7 +72087,7 @@ function writeHumanReport(reports) {
 		const checked = inspected - notCompared.length;
 		if (drifted.length === 0) {
 			if (notCompared.length === 0 && checked === 0 && report.outcomes.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but NOTHING was compared — 0 of ${report.outcomes.length} resource${report.outcomes.length === 1 ? "" : "s"} checked (${unsupported.length} unsupported, ${skippedCount} skipped)\n`);
-			else if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => n.cause === "readFailed") ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
+			else if (notCompared.length > 0) process.stdout.write(`⚠ ${report.stackName} (${report.region}): no drift detected, but ${checked} of ${inspected} resource${inspected === 1 ? "" : "s"} fully checked ` + (notCompared.some((n) => n.cause === "readFailed" || n.cause === "baselineRefused") ? `(${notCompared.length} not fully compared), ` : `(${notCompared.length} only partially compared), `) + `${unsupported.length} unsupported\n`);
 			else process.stdout.write(`✓ ${report.stackName} (${report.region}): no drift detected (${checked} resource${checked === 1 ? "" : "s"} checked, ${unsupported.length} unsupported)\n`);
 		} else {
 			const word = drifted.length === 1 ? "resource" : "resources";
@@ -71768,9 +72102,12 @@ function writeHumanReport(reports) {
 			}
 		}
 		if (notCompared.length > 0) {
-			const readFailed = notCompared.filter((n) => n.cause === "readFailed").length;
-			const referenceCaused = notCompared.length - readFailed;
-			process.stdout.write(readFailed === 0 ? `\n  ${notCompared.length} resource(s) only PARTIALLY compared — cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared:\n` : `\n  ${notCompared.length} resource(s) NOT fully compared — ${readFailed} not compared AT ALL (the read or comparison failed)` + (referenceCaused > 0 ? `, ${referenceCaused} only PARTIALLY compared (a dynamic reference cdkd could not, or refused to, resolve)` : "") + `:\n`);
+			const notComparedAtAll = notCompared.filter((n) => n.cause === "readFailed" || n.cause === "baselineRefused").length;
+			const readFailedCount = notCompared.filter((n) => n.cause === "readFailed").length;
+			const baselineRefusedCount = notCompared.filter((n) => n.cause === "baselineRefused").length;
+			const referenceCaused = notCompared.length - notComparedAtAll;
+			const atAllCause = [...readFailedCount > 0 ? ["the read or comparison failed"] : [], ...baselineRefusedCount > 0 ? ["an import refused their observed baseline"] : []].join("; ");
+			process.stdout.write(notComparedAtAll === 0 ? `\n  ${notCompared.length} resource(s) only PARTIALLY compared — cdkd could not, or refused to, resolve a dynamic reference their state records, so their secret-bearing properties were NOT compared:\n` : `\n  ${notCompared.length} resource(s) NOT fully compared — ${notComparedAtAll} not compared AT ALL (${atAllCause})` + (referenceCaused > 0 ? `, ${referenceCaused} only PARTIALLY compared (a dynamic reference cdkd could not, or refused to, resolve)` : "") + `:\n`);
 			for (const { outcome, cause } of notCompared) process.stdout.write(`    ! ${outcome.logicalId} (${outcome.resourceType}) — ${notComparedReason(cause)}\n`);
 		}
 		if (unsupported.length > 0) {
@@ -75015,9 +75352,18 @@ function reportDriftBaselineGaps(state, logger) {
 		logger.warn(`cdkd state schema is v${state.version} (pre-observedProperties). cdkd drift cannot reliably compare against AWS for this stack; the next \`cdk deploy\` after migration may surface spurious changes if AWS has drifted from the template. Run \`cdkd state refresh-observed ${state.stackName}\` (or any redeploy) before export to capture an AWS-current baseline.`);
 		return;
 	}
-	logger.warn(`${missing.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next \`cdk deploy\` after migration may surface unexpected changes. Run \`cdkd state refresh-observed ${state.stackName}\` to capture a baseline before export, then \`cdkd drift\` to verify the stack matches AWS.`);
-	for (const [logicalId] of missing.slice(0, 10)) logger.warn(`  ${logicalId}`);
-	if (missing.length > 10) logger.warn(`  ... and ${missing.length - 10} more`);
+	const refused = missing.filter(([, r]) => r.observedBaselineRefused === true);
+	const refreshable = missing.filter(([, r]) => r.observedBaselineRefused !== true);
+	if (refreshable.length > 0) {
+		logger.warn(`${refreshable.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next \`cdk deploy\` after migration may surface unexpected changes. Run \`cdkd state refresh-observed ${state.stackName}\` to capture a baseline before export, then \`cdkd drift\` to verify the stack matches AWS.`);
+		for (const [logicalId] of refreshable.slice(0, 10)) logger.warn(`  ${logicalId}`);
+		if (refreshable.length > 10) logger.warn(`  ... and ${refreshable.length - 10} more`);
+	}
+	if (refused.length > 0) {
+		logger.warn(`${refused.length} of ${entries.length} resource(s) had their baseline REFUSED by a \`cdkd import\` run, because their recorded properties can no longer position the secret redaction. \`cdkd state refresh-observed\` will decline them too — capturing a readback against those properties could persist a resolved secret into state.json in plaintext. Deploy a change to each one to restore its baseline.`);
+		for (const [logicalId] of refused.slice(0, 10)) logger.warn(`  ${logicalId}`);
+		if (refused.length > 10) logger.warn(`  ... and ${refused.length - 10} more`);
+	}
 }
 /**
 * Walk every stack other than `exportingStackName` looking for
@@ -76374,10 +76720,10 @@ async function stateResourcesCommand(stackName, options) {
 		if (options.long) {
 			const lines = [];
 			for (const detail of details) {
-				lines.push(detail.logicalId);
-				lines.push(`  Type: ${detail.resourceType}`);
-				lines.push(`  PhysicalID: ${stripControlChars(detail.physicalId)}`);
-				lines.push(`  Dependencies: ${detail.dependencies.length > 0 ? detail.dependencies.join(", ") : "(none)"}`);
+				lines.push(stripControlChars(detail.logicalId));
+				lines.push(`  Type: ${formatAttributeValue(detail.resourceType)}`);
+				lines.push(`  PhysicalID: ${formatAttributeValue(detail.physicalId)}`);
+				lines.push(`  Dependencies: ${formatDependencyList(detail.dependencies)}`);
 				const attrEntries = Object.entries(detail.attributes);
 				if (attrEntries.length === 0) lines.push("  Attributes: (none)");
 				else {
@@ -76390,15 +76736,27 @@ async function stateResourcesCommand(stackName, options) {
 			process.stdout.write(`${lines.join("\n")}\n`);
 			return;
 		}
-		const idWidth = Math.max(...details.map((d) => d.logicalId.length));
-		const typeWidth = Math.max(...details.map((d) => d.resourceType.length));
-		for (const detail of details) process.stdout.write(`${detail.logicalId.padEnd(idWidth)}  ${detail.resourceType.padEnd(typeWidth)}  ${detail.physicalId}\n`);
+		const rows = details.map((d) => ({
+			logicalId: stripControlChars(d.logicalId),
+			resourceType: formatAttributeValue(d.resourceType),
+			physicalId: formatAttributeValue(d.physicalId)
+		}));
+		const idWidth = Math.max(...rows.map((r) => r.logicalId.length));
+		const typeWidth = Math.max(...rows.map((r) => r.resourceType.length));
+		for (const row of rows) process.stdout.write(`${row.logicalId.padEnd(idWidth)}  ${row.resourceType.padEnd(typeWidth)}  ${row.physicalId}\n`);
 	} finally {
 		setup.dispose();
 	}
 }
 /**
-* Render a single attribute value for the `--long` human-readable form.
+* Render one record-derived value into a human row.
+*
+* Named for its first caller and used well beyond an attribute now: a state or
+* lock record is read as an unchecked cast, so a field declared `string` can
+* hold anything, and the bare strip throws on it and empties the whole render.
+* This survives that, and for an actual string it is byte-identical to the
+* strip — which is why it is the default choice for a record FIELD, and the bare
+* strip is kept only where the value is a string by construction.
 *
 * Scalar values render as-is; objects/arrays are JSON-encoded inline so a
 * resource block stays compact even when an attribute is structured.
@@ -76417,16 +76775,24 @@ async function stateResourcesCommand(stackName, options) {
 * pretty-prints — `JSON.stringify` is called without an indent, so a newline
 * here is content injected by the value, not layout.
 *
-* Only the human path routes through this; `--json` serializes the state
-* record directly and stays byte-faithful, which is the same split
-* `renderOutputChangeLines` makes.
+* Only the human path routes through this, which is the same split
+* `renderOutputChangeLines` makes. `--json` is the OTHER side of it rather than
+* a byte-faithful echo: `state show --json` reserializes the parsed record and
+* the lock it prints was sanitised upstream, and `state resources --json` emits
+* a constructed summary with defaults filled in. What `--json` does not do is
+* pass a value through THIS function.
 */
 function formatAttributeValue(value) {
 	if (value === null) return "null";
 	if (value === void 0) return "undefined";
 	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") return stripControlChars(String(value));
-	const json = JSON.stringify(value);
-	return json === void 0 ? "(unserializable)" : stripControlChars(json);
+	let json;
+	try {
+		json = JSON.stringify(value);
+	} catch {
+		json = void 0;
+	}
+	return json === void 0 ? UNSERIALIZABLE : stripControlChars(json);
 }
 /**
 * Render a duration in milliseconds as `1m23s` / `45s`.
@@ -76437,7 +76803,65 @@ function formatDuration(ms) {
 	return `${Math.floor(seconds / 60)}m${seconds % 60}s`;
 }
 /**
+* Render a whole `Dependencies` row from a list that is an unchecked cast.
+*
+* It owns the `(none)` case as well as the values, so that no caller touches
+* `.length` on a value whose type it cannot trust — reading `.length` is itself
+* a throw site, and `"A".length > 0` would pass an emptiness test and then
+* throw inside `join`, which is a method of an ARRAY. So the test is
+* array-ness. Elements are rendered ONE AT A TIME through the field guard
+* rather than joined by it: an element that throws on STRING COERCION
+* (`{"toString": null}` is valid JSON, and `JSON.stringify` handles it fine)
+* throws INSIDE `join`, where no guard wrapping the result can catch it.
+*
+* ABSENT and `null` part company here, deliberately. An absent field is a
+* record saying nothing, which `(none)` states correctly; a `null` is a record
+* saying `null`, and printing `(none)` over it would claim something the record
+* does not. JSON can express `null` here and a hand-edited record can carry it,
+* so the difference is worth the surprise of seeing `Dependencies: null`.
+*/
+function formatDependencyList(deps) {
+	if (Array.isArray(deps)) return deps.length > 0 ? deps.map((dep) => formatAttributeValue(dep)).join(", ") : "(none)";
+	return deps === void 0 ? "(none)" : formatAttributeValue(deps);
+}
+/**
+* Render `Last Modified` from a record whose `lastModified` is an unchecked cast.
+*
+* `new Date(x).toISOString()` throws a RangeError on a value it cannot date —
+* an out-of-range number, most non-numeric strings — and that empties the whole
+* render, the failure `formatAttributeValue` exists to stop everywhere else in
+* this block. `new Date` ITSELF throws a TypeError on an object whose
+* `toString` is unusable (`{"toString": null}` is valid JSON), which is why the
+* construction is inside the `try` and not only the formatting.
+*
+* Only the throw is guarded: the value still reaches `new Date` as-is, so every
+* input the previous line already dated renders the same ISO string — an ISO or
+* `YYYY-MM-DD` string, `null` and a boolean included. Anything else falls
+* through to the guard the other fields take.
+*/
+function formatLastModified(value) {
+	try {
+		return new Date(value).toISOString();
+	} catch {
+		return formatAttributeValue(value);
+	}
+}
+/**
 * Render lock metadata for the `state show` block.
+*
+* This row takes NO display guard — `Version` is the other, for its own reason —
+* and here the reason is upstream: `LockManager.getLockRecord` already passes
+* `owner` and `operation` through `displaySafe`, which coerces and replaces the
+* whole control class with spaces. They arrive here as control-free strings, so
+* a guard would be redundant — and a test for one could only be written by
+* mocking the read that sanitises them, which would pin nothing about the real
+* path. `displaySafe`'s own `String(value)` is unguarded, so a value that throws
+* on coercion fails THERE, before this function; that is go-to-k/cdkd#2947 and
+* not something a guard here could catch either.
+*
+* `expiresAt` is declared a number and is not guaranteed to be one, but it
+* reaches the row only through subtraction and `formatDuration`, so no character
+* the record carries can survive into the output either.
 */
 function formatLockSummary(lockInfo) {
 	if (!lockInfo) return "unlocked";
@@ -76459,8 +76883,8 @@ function createStateResourcesCommand() {
 * `cdkd state show <stack>` command implementation
 *
 * Renders the full state record for one stack: stack-level metadata, lock
-* status, outputs, and every resource (including properties). The deepest /
-* most verbose `state` subcommand — use `state list` / `state resources` for
+* status, outputs, skipped outputs, and every resource (including properties).
+* The deepest / most verbose `state` subcommand — use `state list` / `state resources` for
 * lighter inspection.
 *
 * When the same stack name has state in multiple regions, requires
@@ -76473,8 +76897,9 @@ function createStateResourcesCommand() {
 * - `--show-nested` (issue #555 A4): when the stack contains
 *   `AWS::CloudFormation::Stack` rows, recursively load every child state
 *   record (`cdkd/<parent>~<childLogicalId>/<region>/state.json`) and append
-*   its block after the parent's. No-op when the stack has no nested
-*   children.
+*   its block after the parent's. With no nested children the rendered
+*   blocks are the same, though a `Skipped outputs:` explanation moves to
+*   the end of the tree.
 */
 async function stateShowCommand(stackName, options) {
 	const logger = getLogger();
@@ -76503,27 +76928,82 @@ async function stateShowCommand(stackName, options) {
 			}, null, 2)}\n`);
 			return;
 		}
-		process.stdout.write(`${renderStateBlock(stateResult.state, lockInfo).join("\n")}\n`);
+		process.stdout.write(`${renderStateBlock(stateResult.state, lockInfo, true).join("\n")}\n`);
 	} finally {
 		setup.dispose();
 	}
 }
 /**
+* How much of a `skippedOutputs` digest the text view shows. A prefix
+* DIFFERENCE proves two records differ, which is what a reader wants at a
+* glance; a prefix MATCH proves nothing, so an exact comparison belongs to
+* `--json`, which carries the digest whole.
+*/
+const SKIPPED_DIGEST_PREVIEW_LEN = 12;
+/** What `formatAttributeValue` prints for a value `JSON.stringify` refuses. */
+const UNSERIALIZABLE = "(unserializable)";
+/**
+* The `skippedOutputs` rows a state record owes, sorted by key.
+*/
+function sortedSkippedOutputs(state) {
+	return Object.entries(state.skippedOutputs ?? {}).sort(([a], [b]) => a.localeCompare(b));
+}
+/** Whether one record renders the block. The ONE copy of that condition. */
+function rendersSkippedBlock(state) {
+	return Object.keys(state.skippedOutputs ?? {}).length > 0;
+}
+/**
+* The explanation printed under a `Skipped outputs:` block.
+*
+* At column ZERO, unlike the rows it follows. At the rows' two-space indent a
+* reader — or a `grep '^  '` — takes these lines for another key. It also
+* quotes `Outputs:` mid-sentence, so a test matching that as a SUBSTRING has
+* to anchor on the section's own line to mean anything.
+*
+* Emitted ONCE per render rather than per block: under `--show-nested` the
+* same explanation would otherwise repeat for every child that skipped
+* anything.
+*
+* That placement is why the opening sentence NAMES its referent rather than
+* saying "these". At the end of a tree render it follows every rendered stack
+* block, so it is not adjacent to the block it explains and a bare
+* demonstrative reads as belonging to whichever stack printed last. The
+* single-stack path still has the adjacency; the wording holds in both.
+*
+* It does not claim `Outputs:` is on the screen. That block is omitted when
+* the bag is empty, which includes the first-deploy case this record exists
+* for — every output failed, so `outputs` is `{}` while `skippedOutputs` is
+* populated.
+*/
+function skippedOutputsLegend() {
+	return [
+		"",
+		"The last deploy could not resolve the keys listed under `Skipped outputs:`",
+		"above, and recorded a digest of their template inputs. While the record",
+		"binds and a key is still absent from the stored outputs, `cdkd diff`",
+		"previews it as ABSENT — no row, no warning. A key whose earlier value",
+		"was retained is also stored under `Outputs:` here, where the record does",
+		"NOT suppress it: the ordinary rules apply, up to `cdkd diff` suppressing",
+		"its whole Outputs section if the key still cannot resolve.",
+		"Binding rule: `bindingSkippedOutputs` in src/analyzer/skipped-outputs.ts."
+	];
+}
+/**
 * Render one stack's state record as a human-readable multi-line block —
 * the shared body used by both the single-stack default output and each
 * nested child rendered under `--show-nested`.
 */
-function renderStateBlock(state, lockInfo) {
+function renderStateBlock(state, lockInfo, withLegend) {
 	const lines = [];
-	lines.push(`Stack: ${state.stackName}`);
-	if (state.region) lines.push(`  Region: ${state.region}`);
+	lines.push(`Stack: ${formatAttributeValue(state.stackName)}`);
+	if (state.region) lines.push(`  Region: ${formatAttributeValue(state.region)}`);
 	lines.push(`  Version: ${state.version}`);
-	lines.push(`  Last Modified: ${new Date(state.lastModified).toISOString()}`);
+	lines.push(`  Last Modified: ${formatLastModified(state.lastModified)}`);
 	lines.push(`  Lock: ${formatLockSummary(lockInfo)}`);
 	if (state.parentStack !== void 0) {
-		const parentRegionStr = state.parentRegion ? ` (${state.parentRegion})` : "";
-		const logicalIdStr = state.parentLogicalId !== void 0 ? `, logical id: ${state.parentLogicalId}` : "";
-		lines.push(`  Parent: ${state.parentStack}${parentRegionStr}${logicalIdStr}`);
+		const parentRegionStr = state.parentRegion ? ` (${formatAttributeValue(state.parentRegion)})` : "";
+		const logicalIdStr = state.parentLogicalId !== void 0 ? `, logical id: ${formatAttributeValue(state.parentLogicalId)}` : "";
+		lines.push(`  Parent: ${formatAttributeValue(state.parentStack)}${parentRegionStr}${logicalIdStr}`);
 	}
 	const outputEntries = Object.entries(state.outputs ?? {});
 	if (outputEntries.length > 0) {
@@ -76531,18 +77011,28 @@ function renderStateBlock(state, lockInfo) {
 		lines.push("Outputs:");
 		for (const [k, v] of outputEntries) lines.push(`  ${stripControlChars(k)}: ${formatAttributeValue(v)}`);
 	}
+	if (rendersSkippedBlock(state)) {
+		lines.push("");
+		lines.push("Skipped outputs:");
+		for (const [k, digest] of sortedSkippedOutputs(state)) {
+			const fullDigest = formatAttributeValue(digest);
+			const shownDigest = fullDigest.length > SKIPPED_DIGEST_PREVIEW_LEN && fullDigest !== UNSERIALIZABLE ? `${fullDigest.slice(0, SKIPPED_DIGEST_PREVIEW_LEN)}…` : fullDigest;
+			lines.push(`  ${stripControlChars(k)}: ${shownDigest}`);
+		}
+		if (withLegend) lines.push(...skippedOutputsLegend());
+	}
 	const resourceEntries = Object.entries(state.resources ?? {}).sort(([a], [b]) => a.localeCompare(b));
 	lines.push("");
 	lines.push(`Resources (${resourceEntries.length}):`);
 	for (const [logicalId, resource] of resourceEntries) {
 		lines.push("");
-		lines.push(logicalId);
-		lines.push(`  Type: ${resource.resourceType}`);
-		lines.push(`  PhysicalID: ${stripControlChars(resource.physicalId)}`);
+		lines.push(stripControlChars(logicalId));
+		lines.push(`  Type: ${formatAttributeValue(resource.resourceType)}`);
+		lines.push(`  PhysicalID: ${formatAttributeValue(resource.physicalId)}`);
 		const provisionedBy = resource.provisionedBy ?? "(sdk, legacy default)";
-		lines.push(`  ProvisionedBy: ${provisionedBy}`);
-		const deps = resource.dependencies ?? [];
-		lines.push(`  Dependencies: ${deps.length > 0 ? deps.join(", ") : "(none)"}`);
+		lines.push(`  ProvisionedBy: ${formatAttributeValue(provisionedBy)}`);
+		if (resource.observedBaselineRefused === true) lines.push("  ObservedBaseline: REFUSED by 'cdkd import' — no baseline will be captured (deploy a change to this resource to restore one)");
+		lines.push(`  Dependencies: ${formatDependencyList(resource.dependencies)}`);
 		const attrEntries = Object.entries(resource.attributes ?? {});
 		if (attrEntries.length === 0) lines.push("  Attributes: (none)");
 		else {
@@ -76598,6 +77088,14 @@ async function loadLocksForTree(tree, lockManager, rootLock) {
 	return decorate(tree);
 }
 /**
+* Whether any node in this tree owes a `Skipped outputs:` block, and so
+* whether the tree render owes the legend once at its end. Asked through
+* {@link rendersSkippedBlock}, the same predicate the block's own guard uses.
+*/
+function treeOwesSkippedLegend(node) {
+	return rendersSkippedBlock(node.state) || node.children.some(treeOwesSkippedLegend);
+}
+/**
 * Render the parent's block followed by every descendant in DFS order,
 * each separated by a blank line and prefixed with a `Nested stack: ...`
 * header so the user can scan the tree top-down in one screen.
@@ -76608,15 +77106,16 @@ async function loadLocksForTree(tree, lockManager, rootLock) {
 */
 function renderTreeWithChildren(root) {
 	const lines = [];
-	lines.push(...renderStateBlock(root.state, root.lock));
+	lines.push(...renderStateBlock(root.state, root.lock, false));
 	appendDescendants(root.children, lines);
+	if (treeOwesSkippedLegend(root)) lines.push(...skippedOutputsLegend());
 	return lines;
 }
 function appendDescendants(children, out) {
 	for (const child of children) {
 		out.push("");
-		out.push(`Nested stack: ${child.stackName}`);
-		out.push(...renderStateBlock(child.state, child.lock));
+		out.push(`Nested stack: ${stripControlChars(child.stackName)}`);
+		out.push(...renderStateBlock(child.state, child.lock, false));
 		appendDescendants(child.children, out);
 	}
 }
@@ -77268,6 +77767,7 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 		let totalRefreshed = 0;
 		let totalUnsupported = 0;
 		let totalFailed = 0;
+		let totalRefusedBaseline = 0;
 		for (const target of targets) {
 			if (!target.region) throw new Error(`Stack '${target.stackName}' has only a legacy state record without a region. Run 'cdkd deploy ${target.stackName}' (or any cdkd write) first to migrate it to the region-scoped layout, then re-run refresh-observed.`);
 			const counts = await refreshObservedForStack(target.stackName, target.region, setup.stateBackend, setup.lockManager, providerRegistry, {
@@ -77282,9 +77782,11 @@ async function stateRefreshObservedCommand(stackArgs, options) {
 			totalRefreshed += counts.refreshed;
 			totalUnsupported += counts.unsupported;
 			totalFailed += counts.failed;
+			totalRefusedBaseline += counts.refusedBaseline;
 		}
 		const summary = options.dryRun ? `Plan: ${totalRefreshed} resource(s) would be refreshed, ${totalUnsupported} unsupported, ${totalFailed} would fail (--dry-run, no state was written)` : `Done: ${totalRefreshed} resource(s) refreshed, ${totalUnsupported} unsupported, ${totalFailed} failed`;
 		logger.info(`\n${summary}`);
+		if (totalRefusedBaseline > 0) logger.warn(`${totalRefusedBaseline} resource(s) ${options.dryRun ? "would NOT be refreshed" : "were NOT refreshed"}: a 'cdkd import' run refused to capture their observed-properties baseline, because their recorded properties can no longer position the secret redaction — refreshing against those properties could persist a resolved secret into state.json in plaintext. A deploy that actually CHANGES one of them restores its baseline — a NO_CHANGE deploy does not, and re-running this command will refuse them again. Drift compares against their recorded properties until then.`);
 		if (totalFailed > 0) throw new PartialFailureError(`Refresh completed with ${totalFailed} per-resource readCurrentState failure(s). Affected resources keep their previous observedProperties (or no observedProperties at all). Re-run 'cdkd state refresh-observed' to retry.`);
 	} finally {
 		setup.dispose();
@@ -77351,13 +77853,19 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		return {
 			refreshed: 0,
 			unsupported: 0,
-			failed: 0
+			failed: 0,
+			refusedBaseline: 0
 		};
 	}
 	if (opts.dryRun) {
 		let wouldRefresh = 0;
 		let wouldUnsupported = 0;
+		let wouldRefuse = 0;
 		for (const [, resource] of entries) {
+			if (resource.observedBaselineRefused === true) {
+				wouldRefuse++;
+				continue;
+			}
 			let provider;
 			try {
 				provider = providerRegistry.getProviderFor({
@@ -77371,11 +77879,12 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 			if (provider.readCurrentState) wouldRefresh++;
 			else wouldUnsupported++;
 		}
-		logger.info(`Plan ${stackName} (${region}): ${wouldRefresh} resource(s) would be refreshed, ${wouldUnsupported} unsupported`);
+		logger.info(`Plan ${stackName} (${region}): ${wouldRefresh} resource(s) would be refreshed, ${wouldUnsupported} unsupported` + (wouldRefuse > 0 ? `, ${wouldRefuse} refused (import baseline refusal)` : ""));
 		return {
 			refreshed: wouldRefresh,
 			unsupported: wouldUnsupported,
-			failed: 0
+			failed: 0,
+			refusedBaseline: wouldRefuse
 		};
 	}
 	const owner = `${process.env["USER"] || "unknown"}@${process.env["HOSTNAME"] || "host"}:${process.pid}`;
@@ -77389,8 +77898,13 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		let refreshed = 0;
 		let unsupported = 0;
 		let failed = 0;
+		let refusedBaseline = 0;
 		await withStackName(stackName, async () => {
 			const tasks = entries.map(async ([logicalId, resource]) => {
+				if (resource.observedBaselineRefused === true) {
+					refusedBaseline++;
+					return;
+				}
 				if (providerRegistry.shouldSkipResource(resource.resourceType)) {
 					unsupported++;
 					return;
@@ -77429,11 +77943,12 @@ async function refreshObservedForStack(stackName, region, stateBackend, lockMana
 		const saveOptions = { expectedEtag: etag };
 		if (migrationPending) saveOptions.migrateLegacy = true;
 		await stateBackend.saveState(stackName, region, state, saveOptions);
-		logger.info(`✓ ${stackName} (${region}): ${refreshed} refreshed, ${unsupported} unsupported, ${failed} failed`);
+		logger.info(`✓ ${stackName} (${region}): ${refreshed} refreshed, ${unsupported} unsupported, ${failed} failed` + (refusedBaseline > 0 ? `, ${refusedBaseline} refused (import baseline refusal)` : ""));
 		return {
 			refreshed,
 			unsupported,
-			failed
+			failed,
+			refusedBaseline
 		};
 	} finally {
 		await lockManager.releaseLock(stackName, region).catch((err) => {
@@ -77674,6 +78189,7 @@ async function rollbackCommand(stackArg, options) {
 			if (!stateData) throw new Error(`Rollback journal exists for '${stackName}' (${region}) but its state.json is missing (keys: ${setup.prefix}/${stackName}/${region}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			const baseState = stateData.state;
 			const stateResources = { ...baseState.resources };
+			const mintedOrphans = [];
 			const orphanLogicalIds = new Set(options.orphan ?? []);
 			const newestSegment = journal.segments[journal.segments.length - 1];
 			if (newestSegment.roleArn && !options.roleArn) logger.info(`Note: the failed deploy ran with --role-arn ${newestSegment.roleArn}; this rollback is running with ambient credentials (pass --role-arn to match).`);
@@ -77720,9 +78236,10 @@ async function rollbackCommand(stackArg, options) {
 				const { skippedOutputs: _droppedByRollback, ...carriedState } = baseState;
 				const next = () => ({
 					...carriedState,
-					version: 9,
+					version: 10,
 					region,
 					resources: { ...stateResources },
+					...orphansAfterRollback(baseState, mintedOrphans),
 					lastModified: Date.now()
 				});
 				try {
@@ -77764,7 +78281,8 @@ async function rollbackCommand(stackArg, options) {
 							const failedResult = await replayFailedOperations(segment.failedOperations, stateResources, stackName, ctx, {
 								afterOp: saveState,
 								isInterrupted: () => interrupted,
-								emitEnvelope: segment.operations.length === 0
+								emitEnvelope: segment.operations.length === 0,
+								onOrphan: (record) => mintedOrphans.push(record)
 							});
 							failedOpFailures = failedResult.failures;
 							failedOpWarnings = failedResult.warnings;
@@ -77785,7 +78303,8 @@ async function rollbackCommand(stackArg, options) {
 						const replayResult = await replayRollback(segment.operations, stateResources, stackName, ctx, {
 							orphanLogicalIds,
 							afterOp: saveState,
-							isInterrupted: () => interrupted
+							isInterrupted: () => interrupted,
+							onOrphan: (record) => mintedOrphans.push(record)
 						});
 						return {
 							failures: replayResult.failures + failedOpFailures,
@@ -77806,7 +78325,8 @@ async function rollbackCommand(stackArg, options) {
 			} finally {
 				await eventRecorder.finalize(totalFailures > 0 || interrupted ? "FAILED" : "SUCCEEDED");
 			}
-			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0) {
+			const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
+			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
 				await setup.stateBackend.deleteState(stackName, region);
 				logger.info(`State for '${stackName}' (${region}) removed (stack fully rolled back).`);
 			}
@@ -80793,7 +81313,7 @@ async function importCommand(stackArg, options) {
 				}
 			}
 			const stackState = buildStackState(stackInfo.stackName, targetRegion, rows, templateParser, stateTemplate, existingState, selectiveMode);
-			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger)));
+			await captureObservedForImportedResources(stackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(stackState, stateTemplate, targetRegion, stateBackend, logger)), rebuiltLogicalIdsFrom(rows, stateTemplate));
 			const saveOptions = {};
 			if (existingEtag) saveOptions.expectedEtag = existingEtag;
 			if (migrationPending) saveOptions.migrateLegacy = true;
@@ -81109,6 +81629,30 @@ function collectImportableResources(template) {
 	return out;
 }
 /**
+* The logical ids whose `ResourceState` a run REBUILT from the template — the
+* discriminator `captureObservedForImportedResources` needs for schema v10's
+* `observedBaselineRefused` (issue
+* [#2944](https://github.com/go-to-k/cdkd/issues/2944)).
+*
+* It is a function, exported and tested, rather than an inline
+* `rows.filter(...)` at each call site, because the predicate is the whole
+* safety property: `buildStackState` overwrites exactly the `'imported'` rows
+* and PRESERVES every other record in a selective merge, so a predicate that
+* drifts wider (`rows.map(...)`, or admitting another outcome) silently
+* re-opens the fifth-writer leak — a preserved record's stale, distrusted
+* `properties` would be treated as this run's resolution, captured against,
+* and its refusal cleared. Two inline copies could also drift apart from each
+* other and from `buildStackState`'s own test.
+*
+* Every non-`'imported'` outcome is EXCLUDED, including the ones that sound
+* harmless: `skipped-out-of-scope` is precisely the selective-merge case, and
+* `failed` / `skipped-not-found` / `skipped-no-impl` leave whatever the record
+* already held.
+*/
+function rebuiltLogicalIdsFrom(rows, template) {
+	return new Set(rows.filter((r) => r.outcome === "imported" && r.physicalId !== void 0 && template.Resources[r.logicalId] !== void 0).map((r) => r.logicalId));
+}
+/**
 * Compose a `StackState` from the per-resource import outcomes plus
 * dependency info recovered from the template.
 *
@@ -81148,12 +81692,13 @@ function buildStackState(stackName, region, rows, templateParser, template, exis
 		};
 	}
 	return {
-		version: 9,
+		version: 10,
 		stackName,
 		region,
 		resources,
 		outputs: existingState?.outputs ?? {},
 		...existingState ? exportNamesCarriedFrom(existingState) : { exportNames: [] },
+		...existingState ? orphansCarriedFrom(existingState) : {},
 		lastModified: Date.now()
 	};
 }
@@ -81236,7 +81781,7 @@ function defaultOnlyParameterTemplate(template) {
 * the clear.
 *
 * The predicate is deliberately CONSERVATIVE — it over-refuses — and that is a
-* decision a review round paid for. Two arms:
+* decision a review round paid for. Three arms:
 *
 *  - **Resolution THREW** — refuse, unconditionally. A throw means the
 *    resolver could not finish, so nothing about the persisted bag is
@@ -81264,6 +81809,19 @@ function defaultOnlyParameterTemplate(template) {
 *    remedy -- because a populated map makes absence from it real evidence of
 *    a public parameter, exactly as the deploy path already relies on.
 *
+*  - **Resolution SUCCEEDED but DISCARDED a subtree that is not provably
+*    inert** (issue [#2850](https://github.com/go-to-k/cdkd/issues/2850)).
+*    The count in arm 2 sees only what the raw bag SPELLS, and that issue
+*    measured two ways past it: a downgraded `Fn::If` dropping one reference
+*    while a parameter-sourced reference is ADDED elsewhere (the totals
+*    balance), and a reference sourced ENTIRELY from a parameter `Default` or
+*    a `Mappings` entry then dropped (both counts read zero, and nothing
+*    warns). {@link resolveDiscardsNonInertSubtree} carries the discard-event
+*    enumeration and the fail-closed rules; "inert" is
+*    {@link isInertDiscardedSubtree}'s definition — pure literals with no
+*    opener text and no intrinsic anywhere, because every way a discarded
+*    subtree could have SOURCED a reference is an intrinsic.
+*
 * The cost of a false refusal is one resource's drift baseline until its next
 * deploy; the cost of a false pass is a plaintext secret in `state.json`. So an
 * unmeasurable bag refuses too.
@@ -81277,9 +81835,6 @@ function defaultOnlyParameterTemplate(template) {
 * PLAINTEXT CAN STILL BE PERSISTED by this capture. Known ways, each with its
 * issue and none of them proven to be all of them:
 *
-*  - the resolve drops a reference, or trades one away, in a manner the opener
-*    comparison below cannot see --
-*    [#2850](https://github.com/go-to-k/cdkd/issues/2850);
 *  - a parameter binds to a placeholder `Default` while the DEPLOYED value was
 *    the reference, so no opener exists in any template this walk is handed --
 *    [#2854](https://github.com/go-to-k/cdkd/issues/2854);
@@ -81371,7 +81926,14 @@ async function resolveImportedProperties(stackState, template, region, stateBack
 		}
 		const rawOpeners = countDynamicReferenceOpeners(unresolvedProperties);
 		const persistedOpeners = countDynamicReferenceOpeners(resource.properties);
-		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners) unsafeObservedBaselineLogicalIds.add(logicalId);
+		let discardsNonInertSubtree;
+		try {
+			discardsNonInertSubtree = resolveDiscardsNonInertSubtree(unresolvedProperties, conditions, template.Mappings);
+		} catch (err) {
+			logger.debug(`observed-baseline discard walk failed for imported ${logicalId} (${resource.resourceType}): ${err instanceof Error ? err.name : typeof err} — refusing the baseline fail-closed.`);
+			discardsNonInertSubtree = true;
+		}
+		if (rawOpeners === void 0 || persistedOpeners === void 0 || persistedOpeners < rawOpeners || discardsNonInertSubtree) unsafeObservedBaselineLogicalIds.add(logicalId);
 	}
 	return unsafeObservedBaselineLogicalIds;
 }
@@ -81405,6 +81967,199 @@ function countDynamicReferenceOpeners(bag) {
 		from = at + 10;
 	}
 }
+/**
+* Whether an object key can make the resolver treat its object as an
+* INTRINSIC. Deliberately BROADER than the resolver's own dispatch list
+* (`resolveValue` names specific keys; this matches any `Fn::`-prefixed one):
+* the callers below use it to decide what a DISCARDED subtree could have
+* been, and over-matching there only widens a refusal, never a pass.
+*/
+function isIntrinsicShapedKey(key) {
+	return key === "Ref" || key.startsWith("Fn::");
+}
+/**
+* Whether a subtree the resolve DISCARDED is provably INERT: pure JSON
+* literals, carrying no `{{resolve:` opener text in any string leaf and no
+* intrinsic-shaped object key anywhere.
+*
+* This is the capability question of issue
+* [#2850](https://github.com/go-to-k/cdkd/issues/2850) asked in the
+* fail-closed direction. Asking "could this subtree have carried or SOURCED a
+* dynamic reference" precisely would need enumerating every source a reference
+* can arrive from — a parameter `Default` via `Ref` or `Fn::Sub`, a `Mappings`
+* entry via `Fn::FindInMap`, another stack's outputs via `Fn::ImportValue` /
+* `Fn::GetStackOutput` — and the enumeration missing one form is exactly how
+* the opener COUNT missed the first two. Every one of those source forms is an
+* intrinsic, so "no intrinsic at all" covers them all without naming any, and
+* a plain-literal subtree is one whose value at deploy time was the same
+* public template text this walk can read.
+*/
+function isInertDiscardedSubtree(node) {
+	if (typeof node === "string") return !node.includes(DYNAMIC_REFERENCE_OPENER);
+	if (node === null || typeof node !== "object") return true;
+	if (Array.isArray(node)) return node.every((element) => isInertDiscardedSubtree(element));
+	const record = node;
+	const keys = Object.keys(record);
+	if (keys.length === 1 && keys[0] === "Ref" && record["Ref"] === "AWS::NoValue") return true;
+	return Object.entries(record).every(([key, value]) => !isIntrinsicShapedKey(key) && isInertDiscardedSubtree(value));
+}
+/**
+* Whether a scalar the resolver consumes RAW (an `Fn::Select` index) is a
+* template-constant literal that `resolveSelect`'s `resolvedList[index]` read
+* actually honors: a number, or the CANONICAL digit-string of one. The
+* canonical form is load-bearing, not pedantry — a delta review round
+* measured `['a','b']['01']` as `undefined` (a non-canonical string is a
+* property name, not an index) while CloudFormation integer-parses it to 1,
+* so `'01'` is exactly as selection-divergent as an intrinsic index and must
+* not count as static. Anything non-static makes the selection depend on a
+* value this import cannot reproduce.
+*/
+function isStaticSelectIndex(value) {
+	if (typeof value === "number") return Number.isInteger(value) && value >= 0;
+	return typeof value === "string" && /^(0|[1-9]\d*)$/.test(value);
+}
+/**
+* A `Fn::FindInMap` lookup-key argument the resolver can only have resolved
+* to the same key at deploy time: a plain scalar literal CARRYING NO
+* `{{resolve:` opener. The opener clause is the same delta-review finding one
+* helper up: `resolveFindInMap` resolves each key through `resolveValue`, so
+* a dynamic-reference STRING key is decrypted before the lookup and the
+* selected entry depends on the secret's deploy-time value — not on the
+* template text this walk reads.
+*/
+function isStaticLookupKey(value) {
+	if (typeof value === "string") return !value.includes(DYNAMIC_REFERENCE_OPENER);
+	return typeof value === "number" || typeof value === "boolean";
+}
+/**
+* ARM 3 of the observed-baseline refusal (issue
+* [#2850](https://github.com/go-to-k/cdkd/issues/2850)): did the resolve
+* DISCARD a subtree it cannot vouch is inert?
+*
+* The opener-count comparison (ARM 2) sees only what the raw bag SPELLS, and
+* the issue measured two ways past it on the success arm: a downgraded
+* `Fn::If` that drops one reference while a parameter-sourced reference is
+* added elsewhere (the totals balance), and a reference sourced ENTIRELY from
+* outside the bag then dropped (both counts read zero, nothing throws, no
+* warn fires). Both are DISCARD events: the resolver threw a subtree away
+* unresolved, and whatever that subtree would have produced — which is what
+* AWS actually holds when the deployed condition took the other branch — is
+* exactly what the persisted bag cannot position a redaction for.
+*
+* So this walk detects the discard EVENTS on the RAW bag instead of comparing
+* positions across the resolve (which would need a path identity across the
+* `Fn::If` collapse that does not exist). The discarders, enumerated from
+* `IntrinsicFunctionResolver` rather than assumed — and re-enumerated by this
+* PR's review round, which found the first cut had missed TWO (`Fn::FindInMap`
+* and `Fn::Select` below; an earlier revision called `resolveIf` "the only
+* LAZY selector" and the resolver's own source refutes it):
+*
+*  - `resolveIf` — a LAZY selector: it resolves the selected branch
+*    only, so the unselected branch is discarded UNRESOLVED. A missing
+*    condition warns and selects the FALSE branch (no throw), so the success
+*    arm reaches it. Dispatch is `'Fn::If' in obj`, not single-key.
+*  - `resolveFindInMap` — the OTHER lazy site: the 4-argument form's
+*    `DefaultValue` is resolved only on a lookup MISS, so a HIT discards it
+*    unresolved; and a non-literal lookup KEY makes the un-taken mapping
+*    entries discarded template content. The walk's own arm comment carries
+*    both modes.
+*  - `resolveSelect` — eager on the LIST but the INDEX is consumed RAW, never
+*    resolved: an intrinsic index selects `undefined` here while
+*    CloudFormation resolved it at deploy, so the whole list is potentially
+*    discarded content. (With a NUMERIC-LITERAL index the selection is
+*    template-constant and the un-selected elements were discarded at deploy
+*    too — that case discards nothing AWS could hold.)
+*  - Dispatch order itself — `resolveValue` dispatches on the first matching
+*    intrinsic key, so an object holding an intrinsic key AMONG OTHER KEYS
+*    resolves as that intrinsic and silently DROPS the sibling keys'
+*    subtrees.
+*  - NOT `Fn::Sub`: its variable map is resolved eagerly, every entry.
+*  - NOT `Fn::Join`'s delimiter: it is consumed raw too, but CloudFormation
+*    itself admits no intrinsic there, and an intrinsic delimiter joins as
+*    `[object Object]` — a mangled value, not a discarded reference.
+*
+* Fail-closed rules, in the order tested (an earlier revision of this list
+* omitted the two arms the review round added while still claiming to BE the
+* tested order — a list that claims an order and is not the order is worse
+* than no list, so keep it complete or delete the claim):
+*
+*  - an ARRAY recurses element-wise, so a discarder inside a list property
+*    (`SecurityGroupIds: [{Fn::If: ...}]`) is found;
+*  - single-key `Fn::If` with well-formed args and a condition the evaluated
+*    map carries (`Object.hasOwn`, the same test `resolveIf` uses since issue
+*    #2767): the UNSELECTED branch must be inert, and the SELECTED branch is
+*    recursed into;
+*  - single-key `Fn::If` whose condition the map does NOT carry: BOTH
+*    branches must be inert. The resolver warns and takes the false branch,
+*    so this is a SUPERSET of mirroring it — mirroring the lookup exactly is
+*    the two-spellings-of-one-question drift this repo keeps paying for, and
+*    the superset can only over-refuse, never leak;
+*  - single-key `Fn::If` with MALFORMED args: refuse;
+*  - single-key `Fn::FindInMap`: MALFORMED (< 3 args) refuses; a 4th
+*    argument must be inert AS A WHOLE (its `DefaultValue` is resolved only
+*    on a lookup miss, and any sibling key there — or a whole 4th arg with
+*    no `DefaultValue` key — is discarded unconditionally); a non-literal
+*    lookup key refuses unless the map in scope is inert (the NAMED map for
+*    a literal map name, the whole `Mappings` section otherwise); then the
+*    args recurse;
+*  - single-key `Fn::Select`: MALFORMED (not exactly 2 args) refuses; a
+*    non-static index refuses unless the list argument is inert; then the
+*    args recurse;
+*  - a MULTI-KEY object carrying intrinsic-shaped keys: TWO or more such
+*    keys refuse outright (dispatch drops the losers as whole INTRINSICS,
+*    whose values' text is not evidence of what they pull); with exactly
+*    one, every value must be inert — which sibling the dispatch order
+*    drops is deliberately not mirrored here;
+*  - everything else recurses, so a nested `Fn::If` inside an `Fn::Join` /
+*    `Fn::Sub` argument is still found.
+*
+* Additive beside ARM 1 (throw) and ARM 2 (count loss): refusal strictly
+* widens, so no previously-refused shape can start leaking, and the risk
+* direction is over-refusal alone. The negative controls live in the matrix:
+* an `Fn::If` discarding pure literals stays ADMITTED, and so does a
+* multi-key intrinsic object whose sibling values are literals.
+*
+* THE CALLER WRAPS EVERY CALL IN A FAIL-CLOSED try (see the ARM 3 note at
+* the call site): this walk recurses synchronously and a deep-enough bag
+* overflows the call stack where the JSON.stringify arms still compute.
+*/
+function resolveDiscardsNonInertSubtree(node, conditions, mappings) {
+	if (node === null || typeof node !== "object") return false;
+	if (Array.isArray(node)) return node.some((element) => resolveDiscardsNonInertSubtree(element, conditions, mappings));
+	const record = node;
+	const keys = Object.keys(record);
+	if (keys.length === 1 && keys[0] === "Fn::If") {
+		const args = record["Fn::If"];
+		if (!Array.isArray(args) || args.length !== 3 || typeof args[0] !== "string") return true;
+		const [conditionName, valueIfTrue, valueIfFalse] = args;
+		if (!Object.hasOwn(conditions, conditionName)) return !isInertDiscardedSubtree(valueIfTrue) || !isInertDiscardedSubtree(valueIfFalse);
+		const selected = conditions[conditionName] ? valueIfTrue : valueIfFalse;
+		if (!isInertDiscardedSubtree(conditions[conditionName] ? valueIfFalse : valueIfTrue)) return true;
+		return resolveDiscardsNonInertSubtree(selected, conditions, mappings);
+	}
+	if (keys.length === 1 && keys[0] === "Fn::FindInMap") {
+		const args = record["Fn::FindInMap"];
+		if (!Array.isArray(args) || args.length < 3 || args.length > 4) return true;
+		if (args.length > 3) {
+			if (!isInertDiscardedSubtree(args[3])) return true;
+		}
+		if (!args.slice(0, 3).every((key) => isStaticLookupKey(key))) {
+			if (!isInertDiscardedSubtree(typeof args[0] === "string" && mappings !== null && typeof mappings === "object" && Object.hasOwn(mappings, args[0]) ? mappings[args[0]] : mappings)) return true;
+		}
+		return args.some((arg) => resolveDiscardsNonInertSubtree(arg, conditions, mappings));
+	}
+	if (keys.length === 1 && keys[0] === "Fn::Select") {
+		const args = record["Fn::Select"];
+		if (!Array.isArray(args) || args.length !== 2) return true;
+		if (!(isStaticSelectIndex(args[0]) && (!Array.isArray(args[1]) || Number(args[0]) < args[1].length)) && !isInertDiscardedSubtree(args[1])) return true;
+		return args.some((arg) => resolveDiscardsNonInertSubtree(arg, conditions, mappings));
+	}
+	if (keys.length > 1 && keys.some((key) => isIntrinsicShapedKey(key))) {
+		if (keys.filter((key) => isIntrinsicShapedKey(key)).length > 1) return true;
+		return !keys.every((key) => isInertDiscardedSubtree(record[key]));
+	}
+	return keys.some((key) => resolveDiscardsNonInertSubtree(record[key], conditions, mappings));
+}
 function printSummary(rows) {
 	const logger = getLogger();
 	const counts = {
@@ -81531,14 +82286,20 @@ const NO_RECORDED_SECRETS = /* @__PURE__ */ new Map();
 * call site's own note (issue
 * [#2828](https://github.com/go-to-k/cdkd/issues/2828)).
 */
-async function captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds) {
+async function captureObservedForImportedResources(stackState, providerRegistry, logger, unsafeObservedBaselineLogicalIds, rebuiltLogicalIds) {
 	const entries = Object.entries(stackState.resources);
 	if (entries.length === 0) return;
 	await Promise.all(entries.map(async ([logicalId, resource]) => {
+		if (resource.observedBaselineRefused === true && !rebuiltLogicalIds.has(logicalId)) {
+			logger.debug(`observedProperties capture SKIPPED for preserved ${logicalId} (${resource.resourceType}): a previous 'cdkd import' run refused this record's baseline and this run did not re-import it, so its recorded properties are still the ones that refusal distrusted. Deploy a change to this resource to restore a baseline.`);
+			return;
+		}
 		if (unsafeObservedBaselineLogicalIds.has(logicalId)) {
+			resource.observedBaselineRefused = true;
 			logger.debug(`observedProperties capture SKIPPED for imported ${logicalId} (${resource.resourceType}): the recorded properties no longer spell the template's dynamic reference, so they cannot position a redaction — capturing an AWS readback against them could persist a resolved secret in plaintext. Drift will compare against the recorded properties for this resource until the next successful deploy.`);
 			return;
 		}
+		delete resource.observedBaselineRefused;
 		try {
 			const provider = providerRegistry.getProviderFor({
 				resourceType: resource.resourceType,
@@ -81718,7 +82479,7 @@ async function importNestedStackChildrenRecursive(args) {
 			childStackState.parentStack = parentStackName;
 			childStackState.parentLogicalId = childLogicalId;
 			childStackState.parentRegion = parentRegion;
-			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger)));
+			await captureObservedForImportedResources(childStackState, providerRegistry, logger, await withSharedDrainBudget(() => resolveImportedProperties(childStackState, childStateTemplate, childRegion, stateBackend, logger)), rebuiltLogicalIdsFrom(rows, childTemplate));
 			await stateBackend.saveState(childStackName, childRegion, childStackState);
 			logger.info(`✓ Nested stack state written: ${childStackName} (${childRegion}) — ${rows.filter((r) => r.outcome === "imported").length} resource(s) imported.`);
 			if (childTreeNode.nested.size > 0) await importNestedStackChildrenRecursive({
@@ -90949,4 +91710,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-CxMjCbiG.js.map
+//# sourceMappingURL=program-Bg60hZhr.js.map