@go-to-k/cdkd 0.290.17 → 0.290.18

package/dist/{deploy-engine-BYTwDxet.js → deploy-engine-DuiVEV9B.js}

@@ -1,6 +1,6 @@
-import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
-import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-CT2xso6V.js";
+import { C as displaySafe, S as displayIdent, d as applyDefaultNameForFallback, f as explicitNamePropertyFor, g as looksLikeCdkdGeneratedName, h as getCurrentStackName, m as generateResourceNameWithFallback, n as getLogger, p as generateResourceName, r as isStdoutReservedForPayload, s as getLiveRenderer, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE, y as withoutGeneratedFallbackName } from "./logger-C17H06QA.js";
+import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-BoIxyCir.js";
+import { t as getCdkdVersion } from "./version-Da2VV388.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -306,7 +306,7 @@ const NON_RETRYABLE_MARKER = Symbol.for("cdkd.nonRetryable");
 * the one the code already cites -- a nested-stack failure grows one
 * `ProvisioningError` per level.
 */
-const MAX_CAUSE_CHAIN_DEPTH = 5;
+const MAX_CAUSE_CHAIN_DEPTH$1 = 5;
 /**
 * Stamped on an error whose own message deliberately WITHHOLDS text its
 * `cause` carries (issue [#2302](https://github.com/go-to-k/cdkd/issues/2302)).
@@ -363,7 +363,7 @@ function markRedactedCause(error) {
 */
 function hasRedactedCause(error) {
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		if (typeof current === "object" || typeof current === "function") {
 			if (current[REDACTED_CAUSE_MARKER] === true) return true;
 		}
@@ -438,7 +438,7 @@ function markNonRetryable(error) {
 */
 function isMarkedNonRetryable(error) {
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		if (typeof current === "object" || typeof current === "function") {
 			if (current[NON_RETRYABLE_MARKER] === true) return true;
 		}
@@ -462,7 +462,7 @@ function isMarkedNonRetryable(error) {
 */
 function isThrottlingError(error) {
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		const name = current.name;
 		if (typeof name === "string" && THROTTLING_ERROR_NAMES.has(name)) return true;
 		const status = current.$metadata?.httpStatusCode;
@@ -564,7 +564,7 @@ const TRANSIENT_SERVER_ERROR_STATUS_CODES = /* @__PURE__ */ new Set([
 */
 function isTransientServerError(error) {
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		const status = current.$metadata?.httpStatusCode;
 		if (status !== void 0 && TRANSIENT_SERVER_ERROR_STATUS_CODES.has(status)) return true;
 		current = current.cause;
@@ -615,7 +615,7 @@ function describeRetryClassificationSignals(error) {
 	let sawMetadata = false;
 	let metadataName;
 	let metadataRequestId;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		const name = current.name;
 		if (depth > 0 && typeof name === "string" && name !== "") deepestName = name;
 		const metadata = current.$metadata;
@@ -727,7 +727,7 @@ function retryClassificationText(error) {
 	const parts = [];
 	const seen = /* @__PURE__ */ new Set();
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null && !seen.has(current); depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null && !seen.has(current); depth++) {
 		seen.add(current);
 		if (current instanceof Error) {
 			if (current.message) parts.push(current.message);
@@ -884,7 +884,7 @@ function stringifyForMatch(value) {
 function isNameCollisionErrorFrom(error, logicalId) {
 	if (typeof error === "string") return isNameCollisionError(error);
 	let current = error;
-	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH$1 && current != null; depth++) {
 		const link = current;
 		if (typeof link.logicalId === "string" && link.logicalId !== logicalId) return false;
 		if (typeof link.name === "string" && NAME_COLLISION_ERROR_NAMES.has(link.name)) return true;
@@ -1030,7 +1030,7 @@ const CC_UPDATE_UNSUPPORTED_MESSAGE_FALLBACK = "does not support UPDATE";
 */
 function isUpdateUnsupportedError(error, logicalId) {
 	let current = error;
-	for (let depth = 0; current !== null && current !== void 0 && depth < MAX_CAUSE_CHAIN_DEPTH; depth++) {
+	for (let depth = 0; current !== null && current !== void 0 && depth < MAX_CAUSE_CHAIN_DEPTH$1; depth++) {
 		const link = current;
 		if (typeof link.logicalId === "string" && link.logicalId !== logicalId) return false;
 		if (link.name === "UnsupportedActionException") return true;
@@ -1339,6 +1339,45 @@ var CrossAccountSecretRefusalError = class CrossAccountSecretRefusalError extend
 	}
 };
 /**
+* An `Fn::GetStackOutput` whose PRODUCER's state record has no readable
+* `outputs` map (issue [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A SUBCLASS for the same reason {@link CrossAccountSecretRefusalError} is
+* one, and with the same two independent properties.
+* `instanceof IntrinsicResolutionRefusalError` stays true, so `resolveSub`'s
+* catch re-raises it rather than laundering the reference into a literal
+* `${...}` shipped to AWS; and the one consumer that must treat it
+* DIFFERENTLY from its user-fixable siblings matches on THIS class.
+*
+* That consumer is `cdkd scrub`'s cross-stack pre-pass, and the distinction it
+* needs is neither of the two the base class already carries. A sibling
+* refusal makes scrub REFUSE the stack, on the sound argument that the user
+* can fix the cause and re-run. Here the cause is ANOTHER STACK's record,
+* which the user may not own — so refusing would strand THIS stack's own
+* plaintext in `state.json` over a file they cannot repair. Issue
+* [#3192](https://github.com/go-to-k/cdkd/issues/3192) settled that trade one
+* layer down, for the classifier this refusal now runs ahead of
+* (`docs/design/3192-outputs-consumers.md` §6), and the same answer has to
+* hold here or closing the resolver would silently reverse it: scrub records
+* an unverifiable FINDING, scrubs the rest of the stack, does not report it
+* clean, and exits 2.
+*
+* It is NOT `CrossAccountSecretRefusalError`, whose subclass identity means
+* PERMANENT — "no re-run can change this". A damaged record IS repairable;
+* what it is not is repairable by everyone who meets it.
+*
+* `code` is distinct for the reason the sibling's note gives: a consumer
+* keying on `INTRINSIC_RESOLUTION_REFUSAL` would capture every sibling, and
+* one keying on message text breaks the moment the wording improves.
+*/
+var MalformedProducerRecordRefusalError = class MalformedProducerRecordRefusalError extends IntrinsicResolutionRefusalError {
+	constructor(message, cause) {
+		super(message, cause, "INTRINSIC_RESOLUTION_REFUSAL_MALFORMED_PRODUCER_RECORD");
+		this.name = "MalformedProducerRecordRefusalError";
+		Object.setPrototypeOf(this, MalformedProducerRecordRefusalError.prototype);
+	}
+};
+/**
 * A `{{resolve:...}}` reference whose REGION cannot be established (issue
 * [#2134](https://github.com/go-to-k/cdkd/issues/2134)): it names no region,
 * and the stack it sits in is on record as reading across a region boundary.
@@ -1879,8 +1918,11 @@ var AwsClients = class AwsClients {
 	* falls back to the default chain. The same is true of any library caller
 	* that constructs `AwsClients` directly and therefore never runs the CLI's
 	* `preAction` hook. `--role-arn` needs nothing carried at all —
-	* `applyRoleArnIfSet` exports `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` /
-	* `AWS_SESSION_TOKEN` into the process environment.
+	* `applyRoleArnIfSet` publishes the assumed credentials through
+	* `setAssumedRoleCredentials`, so {@link clientOptions}'s
+	* `awsClientDefaults(...)` spread hands them to every client this instance
+	* builds, and a `profile` beside them selects non-credential settings only
+	* (issue [#3130](https://github.com/go-to-k/cdkd/issues/3130)).
 	*
 	* The `credentials` object is CLONED rather than aliased: the returned bag is
 	* handed to every derived sibling, and sharing one mutable object would let a
@@ -7777,9 +7819,27 @@ var DockerAssetPublisher = class {
 
 //#endregion
 //#region src/utils/aws-failure-text.ts
-/** Appended to a redacted summary so the withheld half is still reachable. */
+/**
+* Appended to a redacted summary so the withheld half is still reachable.
+*
+* EXPORTED because a caller that reduces on its OWN authorship predicate has to
+* compose the same summary by hand, and a second spelling of this sentence is a
+* second thing to keep in sync — `cloud-control-provider.ts`'s `abandonWait`
+* hand-copied it, pinned only by a `toContain('Re-run with --verbose')` that
+* would have gone on passing while the two drifted.
+*/
 const VERBOSE_POINTER = "Re-run with --verbose for AWS's own message.";
 /**
+* The summary {@link describeAwsFailure} builds for an `Error` it is reducing.
+*
+* Exported for the same reason as {@link VERBOSE_POINTER}, one level up: a
+* caller whose authorship predicate is WIDER than this module's reduces shapes
+* the helper hands back raw, and must then build this exact string itself.
+*/
+function redactedAwsFailureSummary(error) {
+	return `${error.name || "Error"}. ${VERBOSE_POINTER}`;
+}
+/**
 * Whether AWS wrote this failure's message.
 *
 * Keyed on the marker fields `@aws-sdk/*` errors carry through
@@ -7807,14 +7867,20 @@ function describeAwsFailure(error) {
 			redacted: false
 		};
 		return {
-			summary: `${error.name || "Error"}. ${VERBOSE_POINTER}`,
+			summary: redactedAwsFailureSummary(error),
 			detail: error.message,
 			redacted: true
 		};
 	}
+	let detail;
+	try {
+		detail = String(error);
+	} catch {
+		detail = "a value that could not be converted to text";
+	}
 	return {
 		summary: `a non-Error value of type ${typeof error}. ${VERBOSE_POINTER}`,
-		detail: String(error),
+		detail,
 		redacted: true
 	};
 }
@@ -20984,6 +21050,133 @@ var DiffCalculator = class DiffCalculator {
 	}
 };
 
+//#endregion
+//#region src/utils/caller-credentials.ts
+/**
+* The CALLER's own AWS identity, for the one channel that reaches a workload
+* cdkd merely emulates (issue
+* [#3130](https://github.com/go-to-k/cdkd/issues/3130)).
+*
+* WHY THIS EXISTS
+*
+* `applyRoleArnIfSet` (`src/utils/role-arn.ts`) assumes `--role-arn` /
+* `CDKD_ROLE_ARN` and then OVERWRITES `process.env.AWS_ACCESS_KEY_ID` /
+* `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` with the role's, so that clients
+* built outside `src/**` (cdk-local's own, the CDK app subprocess) run as the
+* role too. Every `cdkd local *` command then COPIES that triple out of
+* `process.env` into the emulated Lambda / AgentCore container's environment —
+* so `cdkd local invoke --role-arn arn:aws:iam::222:role/cdkd-deploy MyFn` ran
+* the user's local handler AS THE DEPLOY ROLE, normally the more privileged of
+* the two identities and never the one the flag asked for.
+*
+* The SDK-client half of that class was closed by threading
+* `awsClientDefaults({ ignoreAssumedRole: true })` through every client on the
+* surface. That opt-out cannot reach this channel: the value here is not a
+* client config, it is three environment variables whose ORIGINAL contents the
+* assume already destroyed. So `applyRoleArnIfSet` snapshots them first
+* (`setPreAssumeEnvCredentials`) and this module is what turns the snapshot back
+* into an answer.
+*
+* THE ANSWER IS "WHAT WOULD THE CONTAINER HAVE RECEIVED WITHOUT `--role-arn`"
+*
+* Not "who is the caller" in the SDK's sense — that question has a different
+* answer when a profile is selected, and `resolveProfileCredentials` +
+* `applyProfileCredentialsOverlay` already answer it for the `--profile` case
+* and still win, because they are applied AFTER this restore. What this module
+* restores is exactly the status quo ante: the bytes `forwardAwsEnv` would have
+* copied had no role been assumed.
+*
+* WHEN THERE IS NOTHING TO RESTORE, NOTHING IS FORWARDED
+*
+* On an SSO / IMDS / container-role chain the triple was ABSENT before the
+* assume. Fabricating a replacement is not available and inheriting the role is
+* the defect, so the three keys are STRIPPED from the forwarded environment and
+* the container falls back to its own credential resolution — which, with no
+* mounted credentials file, usually means the handler's first AWS call fails
+* with `Could not load credentials from any providers`. That is the documented
+* outcome (`docs/cli-reference.md`), and it is the correct one: a loud missing
+* credential beats a silent privileged one.
+*/
+/**
+* The three environment variables that carry a static AWS identity into a child
+* process or container. Spelled once here so a forwarding site and the fence
+* that watches it cannot disagree about the population.
+*/
+const AWS_CREDENTIAL_ENV_KEYS = [
+	"AWS_ACCESS_KEY_ID",
+	"AWS_SECRET_ACCESS_KEY",
+	"AWS_SESSION_TOKEN"
+];
+/**
+* Read a static credential triple out of an environment bag, or `undefined`
+* when it does not carry a complete one.
+*
+* BOTH halves of the key pair are required: an `AWS_ACCESS_KEY_ID` with no
+* secret is not an identity, and treating it as one would make the caller
+* "have credentials" while handing the container an unusable pair.
+*/
+function readEnvCredentials(source = process.env) {
+	const accessKeyId = source["AWS_ACCESS_KEY_ID"];
+	const secretAccessKey = source["AWS_SECRET_ACCESS_KEY"];
+	if (!accessKeyId || !secretAccessKey) return void 0;
+	const sessionToken = source["AWS_SESSION_TOKEN"];
+	return {
+		accessKeyId,
+		secretAccessKey,
+		...sessionToken ? { sessionToken } : {}
+	};
+}
+/**
+* The static credentials the caller's OWN environment carried — the process
+* environment when no role was assumed, the pre-assume snapshot when one was.
+*
+* For a site that needs the VALUE rather than an env bag to correct (the
+* `--sigv4` signing path in `local-invoke-agentcore.ts`). `undefined` means the
+* caller has no static credentials to offer; the site decides what that means
+* for it (that one refuses with an actionable error).
+*
+* **Do not mutate the returned bag.** On the assumed-role branch it is
+* `aws-client-defaults.ts`'s OWN copy of the pre-assume snapshot — the object
+* shape 2 of the `ignoreAssumedRole` opt-out resolves every opted-out client's
+* identity from — so a caller that edits it in place changes who those clients
+* run as. The note sits here as well as on `getPreAssumeEnvCredentials` because
+* this module's header directs callers to THIS function; reaching the snapshot
+* through the getter directly is what it tells them not to do.
+*/
+function callerEnvCredentials() {
+	if (getAssumedRoleCredentials() === void 0) return readEnvCredentials();
+	return getPreAssumeEnvCredentials();
+}
+/**
+* Correct an environment bag that was populated by copying `process.env`, so it
+* carries the CALLER's identity rather than a `--role-arn` assumed role's.
+*
+* A NO-OP when no role was assumed — the copied triple is already the caller's,
+* and this must not disturb the overwhelmingly common path.
+*
+* Otherwise the role's triple is replaced by the pre-assume snapshot, or — when
+* there was none — REMOVED outright (see this module's header). The
+* session-token handling mirrors `applyProfileCredentialsOverlay`: a restored
+* long-lived key pair strips any inherited token, because a long-lived
+* `AKIA...` beside a foreign session token makes the SDK inside the container
+* fail rather than fall back.
+*
+* Call it AFTER copying `process.env` and BEFORE any `--profile` overlay: the
+* profile identity is more specific and is also the caller's, so it wins.
+*/
+function applyCallerIdentityCredentials(env) {
+	if (getAssumedRoleCredentials() === void 0) return;
+	const caller = getPreAssumeEnvCredentials();
+	if (!caller) {
+		for (const key of AWS_CREDENTIAL_ENV_KEYS) delete env[key];
+		return;
+	}
+	env["AWS_ACCESS_KEY_ID"] = caller.accessKeyId;
+	env["AWS_SECRET_ACCESS_KEY"] = caller.secretAccessKey;
+	if (caller.sessionToken) env["AWS_SESSION_TOKEN"] = caller.sessionToken;
+	else delete env["AWS_SESSION_TOKEN"];
+}
+
 //#endregion
 //#region src/utils/role-arn.ts
 /**
@@ -21050,8 +21243,8 @@ function parseIamRoleArn(roleArn) {
 * reading the producer account's cdkd state bucket.
 *
 * **Why a dedicated helper (instead of reusing `applyRoleArnIfSet`).** The
-* `--role-arn` flag writes assumed credentials into the process's `AWS_*`
-* env vars so EVERY subsequent SDK client picks them up. That is the right
+* `--role-arn` flag publishes its assumed credentials process-wide, so
+* EVERY subsequent SDK client picks them up. That is the right
 * behavior for the CLI-wide flag, but the wrong behavior for cross-account
 * `Fn::GetStackOutput`: the producer's role should authorize ONLY the S3
 * state read, not the consumer's provisioning calls (which still run under
@@ -21129,16 +21322,57 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 * into `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`
 * for the rest of the process.
 *
-* **Why env vars, not threaded credentials.** cdkd constructs ~13
-* independent `AwsClients` instances across deploy / destroy / state /
-* import / etc. paths (each with its own region, sometimes — e.g. the
-* state-bucket client lives in a different region from the provisioning
-* clients). Threading a `credentials` object through every site is high
-* churn for an opt-in flag. AWS SDK v3 reads the standard `AWS_*` env
-* vars at the top of its default credentials chain, so writing into them
-* once at the command's entry makes every later `new XxxClient()` pick
-* up the assumed-role credentials automatically without touching the
-* client construction sites.
+* **Why not threaded credentials.** cdkd constructs ~13 independent
+* `AwsClients` instances across deploy / destroy / state / import / etc.
+* paths (each with its own region, sometimes — e.g. the state-bucket
+* client lives in a different region from the provisioning clients).
+* Threading a `credentials` object through every site is high churn for
+* an opt-in flag, so the assumed credentials are published ONCE, at the
+* command's entry, through two channels that between them reach every
+* consumer:
+*
+* 1. `setAssumedRoleCredentials` (`src/utils/aws-client-defaults.ts`) —
+*    every SDK client under `src/**` is required to spread
+*    `awsClientDefaults(...)` FIRST, so all of them receive the role as an
+*    EXPLICIT `credentials` value, which outranks a `profile` on the same
+*    config. That helper's header carries the full reasoning.
+* 2. The `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN`
+*    env vars — for the consumers channel 1 cannot reach: cdk-local's own
+*    SDK clients and the CDK app subprocess, which inherit this process's
+*    environment.
+*
+* **Why channel 1 exists, and why `AWS_PROFILE` is nonetheless LEFT ALONE.**
+* Channel 2 used to be the whole mechanism, and it is silently inert
+* whenever a profile is selected: `@aws-sdk/credential-provider-node`
+* skips the env-var provider once `AWS_PROFILE` is set, so
+* `--profile ci --role-arn <r>` assumed the role, reported it assumed,
+* and then ran every call as `ci` — potentially in a different account
+* (issue [#3130](https://github.com/go-to-k/cdkd/issues/3130)). Deleting
+* `AWS_PROFILE` would not have fixed that on its own (cdkd also passes
+* `profile` as an explicit client-config key, which outranks the
+* environment), and it costs something real: `AWS_PROFILE` is the only
+* region source `Synthesizer.resolveSdkDefaultRegion` has when the user
+* exported a profile rather than passing `--profile`, so clearing it would
+* silently drop the CDK app's `CDK_DEFAULT_REGION` and synthesize an
+* env-agnostic stack for a different region than the profile named.
+*
+* **The one consumer channel 2 must NOT reach.** `cdkd local *` copies the
+* same three environment variables into the emulated Lambda / AgentCore
+* container, so the role reached the USER'S OWN CODE — which is what
+* `--assume-role` is for, and never what `--role-arn` asked for. Channel 1's
+* `ignoreAssumedRole` opt-out cannot express that here, because the value is
+* not a client config but three variables whose original contents the
+* overwrite below destroys. So the caller's own triple is SNAPSHOTTED first
+* (`setPreAssumeEnvCredentials`), and the local surface's forwarding sites
+* restore it — or, when the caller had none, strip the role's.
+* `src/utils/caller-credentials.ts` owns that decision and its reasoning.
+*
+* So the split is by ROLE, not by channel: `--role-arn` decides the
+* IDENTITY (channel 1, every client under `src/**`), and the profile keeps
+* the two jobs an assumed role cannot do — answering the `AssumeRole`
+* below, and supplying shared-config settings such as the region. The
+* bound that leaves: with both in play, a client built OUTSIDE `src/**`
+* still resolves the profile, because channel 2 stays inert for it.
 *
 * **What the assumed role must carry.** Unlike `cdk deploy`, cdkd does
 * NOT route through CloudFormation. There is no cfn-exec-role to
@@ -21152,18 +21386,31 @@ async function assumeRoleForCrossAccountStateRead(roleArn) {
 * `AdministratorAccess`. CDK CLI's `cdk-hnb659fds-deploy-role-*` is NOT
 * sufficient — that role only carries CFn + asset-publish permissions.
 *
+* **Once per process, enforced at both ends.** Every command handler calls this
+* exactly once, at its entry, and a second call cannot quietly work: the
+* `AssumeRole` hop below opts out of the published role (so it is answered by
+* the identity the user started with, never by role A assuming role B — a chain
+* AWS caps at one hour and refuses unless B's trust policy names A), and
+* `setAssumedRoleCredentials` then REFUSES the second publish outright. Both
+* are needed: the opt-out alone would let two identities coexist, and the
+* refusal alone would leave the hop chaining.
+*
 * Default session duration is 1 hour. For longer-running deploys, the
 * caller should re-issue the cdkd command (the in-flight credentials
 * stay valid until expiry, but a re-run is the simplest recovery for
-* the rare case where a deploy outlives them).
+* the rare case where a deploy outlives them). Nothing refreshes them —
+* `AssumedRoleCredentials.expiration` is carried for the log line, not acted
+* on; that field's doc in `aws-client-defaults.ts` records the bound.
 */
 async function applyRoleArnIfSet(opts) {
 	const roleArn = opts.roleArn || process.env["CDKD_ROLE_ARN"];
 	if (!roleArn) return;
+	if (getAssumedRoleCredentials() !== void 0) throw new Error(SECOND_ROLE_PUBLISH_REFUSAL);
 	const logger = getLogger().child("role-arn");
-	logger.debug(`Assuming role ${roleArn}...`);
+	const displayRoleArn = displaySafe(roleArn, { asciiOnly: true });
+	logger.debug(`Assuming role ${displayRoleArn}...`);
 	const sts = new STSClient({
-		...awsClientDefaults(),
+		...awsClientDefaults({ ignoreAssumedRole: true }),
 		...opts.region && { region: opts.region }
 	});
 	try {
@@ -21172,13 +21419,22 @@ async function applyRoleArnIfSet(opts) {
 			RoleSessionName: `cdkd-${Date.now()}`,
 			DurationSeconds: 3600
 		}));
-		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${roleArn}`);
+		if (!response.Credentials) throw new Error(`AssumeRole returned no credentials for role ${displayRoleArn}`);
 		const { AccessKeyId, SecretAccessKey, SessionToken, Expiration } = response.Credentials;
-		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${roleArn}`);
+		if (!AccessKeyId || !SecretAccessKey || !SessionToken) throw new Error(`AssumeRole response missing credentials fields for role ${displayRoleArn}`);
+		setPreAssumeEnvCredentials(readEnvCredentials());
 		process.env["AWS_ACCESS_KEY_ID"] = AccessKeyId;
 		process.env["AWS_SECRET_ACCESS_KEY"] = SecretAccessKey;
 		process.env["AWS_SESSION_TOKEN"] = SessionToken;
-		logger.info(`Assumed role ${roleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+		setAssumedRoleCredentials({
+			accessKeyId: AccessKeyId,
+			secretAccessKey: SecretAccessKey,
+			sessionToken: SessionToken,
+			...Expiration && { expiration: Expiration }
+		});
+		logger.info(`Assumed role ${displayRoleArn} (session expires ${Expiration?.toISOString() ?? "unknown"})`);
+		const selectedProfile = process.env["AWS_PROFILE"];
+		if (selectedProfile !== void 0 && selectedProfile !== "") logger.warn("AWS_PROFILE is set and a role has been assumed. The AWS calls cdkd makes to deploy and read state run as the role. The profile still decides the region, it is what your CDK app resolves during synthesis, and — when you passed `--profile` rather than exporting it — it is the identity a `cdkd local` emulated function or task is given. See https://github.com/go-to-k/cdkd/blob/main/docs/cli-reference.md");
 	} finally {
 		sts.destroy();
 	}
@@ -21764,6 +22020,543 @@ function classifyReplaySecretRegion(expression, consumerRegion, importedProducer
 	};
 }
 
+//#endregion
+//#region src/state/malformed-resources-bag.ts
+/** The error code every malformed-record refusal carries, whatever its class. */
+const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
+/**
+* Answer the ONE question both helpers below key on: can this record's
+* resource map be read at all?
+*
+* Widened past `null` / `undefined` because the message says "no readable
+* resources map" and a hand-edited record does not stop at those two: a
+* `[]`, a `5` or a `"ab"` all survive `Object.entries` and yield a bag that is
+* empty or, for the string, absurd — repaired silently and warned about
+* nowhere. The predicate is the plain-object test the bag's own type implies.
+*/
+function hasReadableResources(state) {
+	return isReadableBag(state.resources);
+}
+/**
+* The same question for the `outputs` bag — and it is a SEPARATE predicate
+* rather than a second argument to the one above because the ABSENCE rule
+* differs, which is the split {@link isReadableBag}'s own note calls a
+* per-container call.
+*
+* An absent `outputs` bag is an ordinary record, not a defect: `cdkd scrub`
+* round-trips one deliberately rather than materializing `{}` over it, and the
+* deploy's failure-path saves write `outputs: currentState.outputs`, which
+* `JSON.stringify` drops when it is `undefined`. So `undefined` is EXEMPT here
+* while it is a defect for `resources`. `null` is NOT exempt — it is a value a
+* hand-edited record carries and every consumer either throws on it or
+* launders it into `{}`.
+*
+* Both {@link repairMalformedOutputsForReadOnly} and
+* {@link refuseMalformedOutputs} delegate to this, so the read-only and the
+* write-capable halves cannot come to different verdicts about the same record.
+*/
+function hasReadableOutputs(state) {
+	return state.outputs === void 0 || isReadableBag(state.outputs);
+}
+/**
+* The shared explanation, in the terms the reader needs: what is wrong, what
+* to look at, and what NOT to do next.
+*
+* Both identifiers are SANITIZED and THEN SHELL-QUOTED, and the command is
+* emitted LAST and UNWRAPPED — the shape `lock-contention-message.ts` and
+* `.claude/rules/layout-state-types.md` require of any suggestion a user is
+* meant to paste, for two separate reasons.
+*
+* Sanitizing alone is not enough. `displaySafe(..., { asciiOnly: true })` is a
+* printable-ASCII allowlist, so it removes the line- and escape-forgery class
+* but KEEPS `'`, `;`, `|`, `` ` ``, `$` and spaces — and neither name is
+* trusted here, since a stack name reaches the cross-stack read path from an
+* `Fn::GetStackOutput` argument or an S3 key. A name spelled
+* `a'; curl http://x|sh; echo '` would close the quoting and append its own
+* command to the line this text tells the user to RUN.
+*
+* Wrapping the command in `'...'` is not enough either, and is what makes the
+* two compose badly: `shellQuote` does its own quoting, so an outer wrapper
+* produces something unpastable. Hence unwrapped and last.
+*
+* An identifier that sanitizes to EMPTY becomes `UNRENDERABLE` rather than
+* nothing — an empty argument makes `--stack-region` swallow the next flag,
+* turning a remedy into a differently-broken command.
+*
+* MODULE-PRIVATE, and it stayed that way after go-to-k/cdkd#3206's review
+* considered exporting it. `cdkd scrub`'s audited-record refusal needed the
+* same three properties (sanitize, cap, `UNRENDERABLE` on empty) plus a
+* BOUNDARY, because its names go into a comma-joined list where a name
+* containing the delimiter forges an entry. `displayIdent` has all four —
+* JSON-quoting escapes the delimiter it adds — so that caller uses it and this
+* stays private. The pair here is not duplicated: what differs is the
+* `shellQuote` composition every message in THIS module needs and that one
+* must not have.
+*/
+function safeIdentifier(value) {
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, 128);
+	return truncated ? `${text}...` : text;
+}
+function malformedStateDetail(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'resources' map — the record is malformed or truncated. Do NOT run 'cdkd deploy' or 'cdkd destroy' against it: both read the same map, and an unreadable one is indistinguishable from an empty stack, so deploy would re-CREATE every resource and destroy would delete none of them. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a READ-ONLY command: give the record an empty resource bag so the
+* command can report on it, and say so (issue go-to-k/cdkd#3018).
+*
+* `parseStateBody` deliberately does not validate the inner shape, so a
+* hand-edited or truncated record reaches a command with `resources` absent,
+* `null`, or some other non-object. Every such command then died on a raw
+* `TypeError` from the first `Object.keys` / `in` / index read — the exact
+* wording differs per shape (`Cannot convert undefined or null to object`,
+* `Cannot use 'in' operator`, `Cannot read properties of null`), and none of
+* them names a stack, a key or a remedy, from exactly the commands a user
+* reaches for WHEN the state is broken.
+*
+* WHY AT THE LOAD AND NOT AT EACH LOOP. The first cut of #3018 put `?? {}` on
+* the twelve `Object.entries(state.resources)` loops, which was inert: every
+* one of those flows dereferences the bag EARLIER — `!(id in state.resources)`,
+* `hasOwnProperty.call(...)`, `state.resources[logicalId]` — so the abort still
+* happened one line up and the guards only made it look handled. One call per
+* load dominates the whole flow behind it, including the helpers that take the
+* state as a parameter (`orphan-rewriter`, `diff-calculator`,
+* `collectCcApiRoutes`).
+*
+* Mutates in place and returns whether it repaired anything; the caller warns
+* on `true`. A silent repair is its own defect — an empty resource set is
+* indistinguishable from a healthy empty stack in every later line of output,
+* so `No changes detected` over an unreadable record is a clean verdict about
+* nothing.
+*
+* **Only for a command that cannot WRITE state.** Anything that can persist
+* uses {@link refuseMalformedState} instead; see its note.
+*/
+function repairMalformedResourcesForReadOnly(state) {
+	if (hasReadableResources(state)) return false;
+	state.resources = {};
+	return true;
+}
+/**
+* The refusal TEXT, for a command whose own exit-code contract means this
+* cannot be a plain `CdkdError`.
+*
+* `cdkd scrub` is the case: its exit `1` is SPOKEN FOR ("--fail found
+* plaintext") and every one of its refusals carries `exitCode = 2`, because a
+* CI gate reading the code alone must be able to tell "scrub looked and found
+* a leak" from "scrub refused to look" — the two call for opposite responses.
+* So scrub tests {@link hasReadableResources} and raises its own class around
+* this text rather than calling {@link refuseMalformedState}.
+*
+* The other three refusing commands do NOT share that need, and giving them a
+* single shared code would be wrong in the other direction: `cdkd rollback`
+* documents `2` as "PARTIAL — journal kept, idempotent re-run", so a `2` here
+* would tell an operator to re-run a command that attempted nothing.
+*/
+function malformedStateRefusalMessage(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
+}
+/**
+* The warning a view emits when it emptied one or more {@link
+* RenderedStateContainer}s it could not walk (go-to-k/cdkd#3187).
+*
+* Deliberately NOT {@link malformedResourcesWarning}'s text, and the reason is
+* narrower than it looks. That one tells the reader not to run `cdkd deploy` /
+* `cdkd destroy` because an unreadable `resources` MAP is indistinguishable
+* from an empty stack: deploy would re-CREATE everything and destroy would
+* delete nothing. No container named here can produce that specific confusion —
+* the resource SET is still readable — so borrowing that sentence would attach
+* a re-create-the-world warning to a record whose resource list is intact.
+*
+* It is NOT that these containers are display-only. `properties` is read by the
+* deploy change calculation (`src/analyzer/diff-calculator.ts`), which imports
+* nothing from this module, and a non-object there compares unequal to any
+* desired object and yields a spurious property-change set — filed as
+* go-to-k/cdkd#3191. An earlier revision of this comment asserted the
+* display-only premise, which would have read as licence to drop a guard on
+* that path (review of go-to-k/cdkd#3190).
+*
+* What stays the same is the remedy: `--json` is the mode that shows the
+* stored value.
+*
+* ONE warning per record however many containers it names — a stack whose 500
+* resources all carry a hand-edited `properties` gets one line, not 500. The
+* caller FILTERS a fixed order (`RENDERED_CONTAINER_ORDER`), so the text is
+* stable across records. Not `.sort()` — that order is deliberately not
+* alphabetical, and its own JSDoc says so.
+*
+* Both identifiers are sanitized and then shell-quoted, and the command is
+* emitted LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s own note
+* gives.
+*
+* The container NAMES take {@link safeIdentifier} too — the SAME helper, so
+* they cannot drift from it — but NOT `shellQuote`, because they appear in the
+* PROSE and never inside the command this text tells the reader to run; the
+* command carries the two identifiers and nothing else.
+*
+* Sanitizing them is not dead code written for a case that cannot happen. The
+* union above is closed at COMPILE time, so without this the guarantee would
+* live in a comment, and the day a caller derives a name from a record instead
+* of from a literal an unsanitized element could forge a line, render as empty
+* quotes naming nothing, or run to kilobytes and push the remedy command off
+* the reader's screen. `safeIdentifier` closes all three and is the identity on
+* all four literals, so no user-visible text moves.
+*
+* What it does NOT close, stated rather than reassured away: a forged name made
+* only of printable ASCII still renders verbatim inside its quotes and could
+* read as prose. That residual is bounded to the PROSE — the command the reader
+* pastes is built from the two shell-quoted identifiers alone — and closing it
+* would mean JSON-quoting a name in the one place the text is meant to read as
+* English (review of go-to-k/cdkd#3190).
+*/
+function malformedRenderedContainersWarning(stackName, region, containers) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	const names = containers.map((name) => `'${safeIdentifier(name)}'`).join(", ");
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
+function malformedResourcesWarning(stackName, region) {
+	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
+}
+/**
+* The `outputs` half of {@link repairMalformedResourcesForReadOnly}, for a
+* READ-ONLY command that DIFFS the stored bag rather than rendering it
+* (go-to-k/cdkd#3189).
+*
+* `computeOutputsDiff` enumerates the stored bag twice, the second walk
+* emitting one `REMOVE` row per stored key today's template no longer declares.
+* It used to admit the bag on a bare `?? {}`, which covers `null` and
+* `undefined` only — so a hand-edited or truncated record whose `outputs` holds
+* a string or a list previewed the REMOVAL of outputs that never existed, one
+* row per character or element, each carrying a character of the record as its
+* `old:` side, with `cdkd diff --fail` exiting 1 on them.
+*
+* AT THE LOAD, for the reason
+* {@link repairMalformedResourcesForReadOnly}'s own note records and one more
+* that is specific to this container: `cdkd diff` dereferences the stored bag
+* BEFORE the walk that fabricates. `resolveTemplateOutputs` asks
+* `hasOwnProperty.call(storedOutputs, key)` for go-to-k/cdkd#2740's
+* skipped-output record and for go-to-k/cdkd#1942's literal `Export.Name`
+* verdict — which ANSWERS TRUE on a string for `'0'` or `'length'`, and THROWS
+* outright on `null` (`Cannot convert undefined or null to object`). So a guard
+* written at `computeOutputsDiff` alone leaves a wrong decision, or a raw
+* `TypeError`, one call above it.
+*
+* ABSENT IS EXEMPT AND `null` IS NOT, which is the one place this diverges from
+* {@link isReadableBag}'s verdict, and the split is measured rather than
+* stylistic. Both stored-bag lookups named above gate on
+* `storedOutputs !== undefined` before the `hasOwnProperty` call, so an ABSENT
+* bag never reaches one; every other consumer on the diff path carries its own
+* `?? {}` (`mergeNoChangeOutputs`'s `persisted`, `importableOutputKeys`, this
+* function's own walk). An absent bag is therefore inert, exactly the condition
+* under which `state.ts`'s `repairRenderedContainers` exempts it — and warning
+* would be a false positive on a record cdkd itself supports: `cdkd scrub`
+* round-trips a record with no `outputs` deliberately, refusing to materialize
+* `{}` over it, and the deploy's failure-path saves write
+* `outputs: currentState.outputs`, which `JSON.stringify` drops when it is
+* undefined. A `null` bag is NOT inert — it passes the `!== undefined` gate and
+* `hasOwnProperty.call(null, ...)` throws — so it is repaired and warned about
+* like any other unreadable shape.
+*
+* That leaves one clause of go-to-k/cdkd#3189's stated floor overridden on
+* purpose: it asked that a `null` bag "diff exactly as it does today and say
+* nothing", and diffing exactly as it does today means THROWING. Recorded on
+* the issue rather than silently traded.
+*
+* Mutates in place and returns whether it repaired anything; the caller warns
+* on `true` with {@link malformedOutputsWarning}. Read-only commands ONLY, for
+* the reason {@link refuseMalformedState} gives — a bag laundered into a
+* well-formed empty one is permanent, and for `outputs` it would also take the
+* exports index with it on the next write.
+*/
+function repairMalformedOutputsForReadOnly(state) {
+	if (hasReadableOutputs(state)) return false;
+	state.outputs = {};
+	return true;
+}
+/**
+* The warning a caller of {@link repairMalformedOutputsForReadOnly} emits.
+*
+* Deliberately neither {@link malformedResourcesWarning}'s text nor
+* {@link malformedRenderedContainersWarning}'s, because the CONSEQUENCE of
+* continuing empty differs from both. The resources text forbids
+* `cdkd deploy` / `cdkd destroy` because an unreadable resource MAP is
+* indistinguishable from an empty stack; the resource set is intact here. The
+* rendered-containers text says the view "shows no rows there" — true of a
+* renderer, false of a diff, which does not go quiet on an empty stored bag but
+* reports every resolved output as an `ADD`. Saying so is the point: an
+* operator who reads `ADD` rows for outputs the stack already has needs to know
+* the comparison lost its left-hand side.
+*
+* Identifiers are sanitized and then shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOutputsWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. Where the stored value is a string or a list, 'Object.entries' walks it as readily as a map, so diffing it INVENTS a REMOVE row per character or element carrying the record's own characters; where it is a number, a boolean or null, it yields no comparison at all. Continuing with it EMPTY: every output this diff resolves is reported as an ADD and no stored key is reported as a REMOVE, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a command that can WRITE state: refuse the record by name instead of
+* repairing it.
+*
+* Repairing is actively DANGEROUS here, and the PR that introduced this module
+* shipped that danger for one round before its security review caught it.
+* `cdkd scrub` gates its `saveState` on `recordsChanged > 0`, which an OUTPUTS
+* change alone satisfies — so a record holding `"resources": null` and a
+* plaintext secret in `outputs` would be scrubbed, and then saved back with a
+* repaired, WELL-FORMED `resources: {}`. The malformed record is the only
+* signal that anything is wrong; laundering it into a legitimate-looking empty
+* one is permanent and silent. The next `cdkd deploy` then reads zero resources
+* and CREATES the whole stack a second time, and the next `cdkd destroy`
+* deletes nothing and orphans every live resource — and the one-shot warning
+* that would have said so is long gone, quite possibly for a different
+* operator. `cdkd import --force` launders it the same way.
+*
+* Refusing still satisfies #3018, whose complaint was the BARE `TypeError`:
+* this names the stack, the region, the defect and the remedy, and exits on a
+* code rather than on a stack trace.
+*/
+function refuseMalformedState(state, stackName, region) {
+	if (hasReadableResources(state)) return;
+	throw new CdkdError(malformedStateRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+}
+/**
+* The `outputs` half of {@link malformedStateRefusalMessage}, for the same
+* reason that one is exported separately from the throw: `cdkd scrub`'s exit
+* `1` is spoken for and it raises its own exit-2 class around this text.
+*
+* A DIFFERENT text from the `resources` refusal because the consequence of
+* continuing differs, the same way the three warnings in this module differ. The
+* `resources` message forbids `cdkd deploy` / `cdkd destroy` because an
+* unreadable resource MAP is indistinguishable from an empty stack; the resource
+* set is intact here. What is at stake instead is the SHARED exports index:
+* `cdkd/_index/<region>/exports.json` is rebuilt from these bags, and a string
+* bag published one fabricated export per character into the namespace every
+* other stack's `Fn::ImportValue` binds against.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedOutputsRefusalMessage(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command can WRITE state, so it refuses rather than continuing: it REBUILDS the bag before saving, and 'Object.entries' walks a string or a list as readily as a map, so a six-character value would be saved back as a well-formed six-key map (a null one as an empty map). That replaces the only signal anything is wrong with a legitimate-looking record, permanently — and the next deploy republishes it into the shared exports index every other stack's Fn::ImportValue resolves against. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The line `ExportIndexStore`'s rebuild emits for a producer record whose
+* export set it could not read (issue go-to-k/cdkd#3192) — `outputs` not a
+* plain object, or `exportNames` present and not an array.
+*
+* A THIRD outputs text rather than {@link malformedOutputsWarning} because the
+* consequence is again different, which is the rule the two above already
+* follow. That one describes a DIFF continuing with an empty left-hand side.
+* This describes a record CONTRIBUTING NOTHING to a shared, region-wide index
+* other stacks resolve against — so the symptom a reader will actually meet is
+* a later `Fn::ImportValue` failing in a DIFFERENT stack, naming the consumer
+* and not this record. Saying which producer dropped out is the whole value of
+* the line.
+*
+* It says the rebuild CONTINUES, because it does: refusing would take every
+* other producer in the region down with it, and the index is best-effort by
+* design.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedExportSourceWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map or 'exportNames' list — the record is malformed or truncated. It contributes NO exports to this region's index, which is not the same as the stack exporting none: an Fn::ImportValue of a name this stack really publishes will fail in the CONSUMER stack, naming that stack rather than this record. Continuing with the other producers — enumerating a string or a list here would instead publish one FABRICATED export per character or element. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* The line a READ-ONLY command emits when a record's `exportNames` FIELD could
+* not be used (go-to-k/cdkd#3192 review) — present and not an array, or an
+* array with no usable name in it.
+*
+* Why a message at all, when the predicate already fails closed: before this
+* class was guarded, `cdkd diff` over such a record died with
+* `TypeError: state.exportNames.filter is not a function`. Failing closed
+* inside `importableOutputKeys` is right — it is a pure predicate reached from
+* five commands and holds no stack identity — but silently replacing a LOUD
+* wrong answer with a QUIET one is its own regression, and `cdkd diff` is
+* exactly the caller that DOES hold the identity. Without this it warned about
+* a damaged `outputs` bag on one line and said nothing about the damaged
+* `exportNames` on the same record.
+*
+* Deliberately NOT {@link malformedOutputsWarning}'s text: that one is about
+* the BAG, and the consequence differs. An unusable export SET does not lose
+* the comparison's left-hand side — every stored key is still diffed — it
+* makes the preview report no key as an export, so a row that would carry
+* `[export]` renders without it.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedExportNamesWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has an unusable 'exportNames' list — the record is malformed or truncated. It is read as an EMPTY export set, which is not the same as the record holding one: no stored key is reported as an export, so a row that should carry an '[export]' tag renders without it. Reading it as UNKNOWN instead would be worse — that falls back to the pre-v9 rule where every output name is importable. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For a command that can WRITE state: refuse a record whose `outputs` bag
+* cannot be read, instead of rebuilding it (issue go-to-k/cdkd#3192).
+*
+* The SIBLING of {@link refuseMalformedState}, and deliberately a second call
+* rather than a widening of that one. A record can be malformed in either
+* container alone, the two carry different consequences, and the refusal a user
+* sees must name the container that is actually broken — a `resources` message
+* printed over an intact resource map tells them not to run `cdkd deploy` for a
+* reason that does not hold.
+*
+* Why REFUSE and not {@link repairMalformedOutputsForReadOnly}, which is the
+* opposite answer for the same container one function up: repairing the bag and
+* then saving it IS the laundering this is here to stop. Measured, not
+* reasoned — `rewriteResourceReferences` turns `outputs: 'abcdef'` into
+* `{"0":"a",…,"5":"f"}` and `cdkd orphan` saves that; `cdkd scrub`'s
+* `redactUnaccountedOutputs` spreads the same string into a map and its
+* `outputsChanged` compare then satisfies the `recordsChanged > 0` write gate;
+* `cdkd import` carries a `null` bag through `?? {}`. Each one rewrites a
+* damaged record into a well-formed one and the evidence is gone.
+*
+* CALL IT AT THE LOAD, beside {@link refuseMalformedState} and above the first
+* expression that reads the bag — the placement rule
+* {@link repairMalformedResourcesForReadOnly}'s note records, for the reason it
+* records: a guard written at the rebuild leaves every earlier dereference in
+* front of it.
+*/
+function refuseMalformedOutputs(state, stackName, region) {
+	if (hasReadableOutputs(state)) return;
+	throw new CdkdError(malformedOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED);
+}
+/**
+* The DESTROY refusal text (issue
+* [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A FOURTH outputs text rather than {@link malformedOutputsRefusalMessage},
+* for the reason every text in this module is its own: that one says the
+* command "REBUILDS the bag before saving", which is FALSE here. A destroy
+* never rebuilds the bag — its incremental preserve-writes CLEAR `outputs`
+* outright. What it does with the bag instead is DECIDE, and the decision is
+* the strong-reference pre-flight: `state.outputs && Object.keys(...).length >
+* 0` asks "might this stack be a producer?", and only a positive answer runs
+* the cross-stack scan that refuses to delete an exporter while an importer
+* exists.
+*
+* Both directions of that question are wrong on a damaged bag, which is why
+* repairing is not available here. A STRING or a LIST answers YES for the
+* wrong reason — `Object.keys('abcdef')` is six fabricated names — and a
+* `null`, a number or a boolean answers NO, so the scan is SKIPPED and the
+* destroy deletes a producer other stacks still `Fn::ImportValue` from.
+* Reading the bag as empty (the read-only repair) IS that second answer, so
+* the only answer that fabricates nothing and skips no protection is to stop.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedDestroyOutputsRefusalMessage(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. This command DELETES state, so it refuses rather than continuing: it reads this bag to decide whether the stack might export anything, and that decision gates the cross-stack check that refuses to delete a producer another stack still imports from. A string or a list invents one export name per character or element; a null, a number or a boolean reads as 'exports nothing' and SKIPS the check entirely, deleting the record while consumers still resolve against it. Repair or remove the record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For `cdkd destroy` / `cdkd state destroy`: refuse a record whose `outputs`
+* bag cannot be read (issue
+* [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A SEPARATE call from {@link refuseMalformedOutputs} rather than a flag on
+* it, for the same reason {@link refuseMalformedOutputs} is separate from
+* {@link refuseMalformedState}: the refusal a user sees must describe what
+* THIS command would have done with the bag, and the two consequences are
+* different — see {@link malformedDestroyOutputsRefusalMessage}.
+*
+* CALL IT AT THE TOP OF THE DESTROY, above the strong-reference decision it
+* protects. The placement rule is
+* {@link repairMalformedResourcesForReadOnly}'s and applies unchanged.
+*/
+function refuseMalformedOutputsForDestroy(state, stackName, region) {
+	if (hasReadableOutputs(state)) return;
+	throw markNonRetryable(new CdkdError(malformedDestroyOutputsRefusalMessage(stackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The NESTED-STACK refusal text (issue
+* [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A FIFTH text, and the one whose damaged record and saved record are
+* DIFFERENT stacks. `NestedStackProvider.readChildOutputsAsAttributes` reads
+* the CHILD's persisted bag and rebuilds it into the PARENT's
+* `Outputs.<Key>` attributes; the parent's deploy then persists those
+* attributes into the parent's own record, where every `Fn::GetAtt` against
+* the nested stack resolves them — into live AWS calls. So a six-character
+* child bag becomes six fabricated parent attributes, and
+* {@link malformedOutputsRefusalMessage}'s "saved back as a well-formed
+* six-key map ... republished into the shared exports index" would name the
+* wrong record and the wrong blast radius.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedNestedChildOutputsRefusalMessage(childStackName, region) {
+	const stack = safeIdentifier(childStackName);
+	const reg = safeIdentifier(region);
+	return `State for nested stack child ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. The parent's 'Outputs.<Key>' attributes are REBUILT from this bag and persisted into the PARENT's record, and 'Object.entries' walks a string or a list as readily as a map — so a six-character value would become six fabricated parent attributes that every Fn::GetAtt against this nested stack then resolves into live AWS calls. The deploy refuses rather than fabricating them. Repair or remove the child's record first. Inspect it with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+/**
+* For the nested-stack provider: refuse a CHILD record whose `outputs` bag
+* cannot be read (issue [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* The provider itself calls no `saveState`, and that is why this is a refusal
+* rather than a repair anyway: what it returns becomes the parent's
+* `ResourceState.attributes`, which the parent's deploy engine persists. Being
+* write-capable THROUGH A CALLER is the same hazard as writing directly, and
+* repairing here would put a well-formed fabricated attribute set into the
+* parent's record with nothing left to say the child was damaged.
+*/
+function refuseMalformedNestedChildOutputs(state, childStackName, region) {
+	if (hasReadableOutputs(state)) return;
+	throw markNonRetryable(new CdkdError(malformedNestedChildOutputsRefusalMessage(childStackName, region), STATE_RESOURCES_MALFORMED));
+}
+/**
+* The warning the `cdkd local *` commands emit for a record whose `outputs`
+* bag they had to read as EMPTY (issue
+* [#3207](https://github.com/go-to-k/cdkd/issues/3207)).
+*
+* A SIXTH text, and the only one on this container for a READ-ONLY caller
+* other than {@link malformedOutputsWarning}. It is not that one because the
+* consequence differs the same way every text in this module differs: that one
+* describes a DIFF continuing with an empty left-hand side and reporting every
+* resolved output as an `ADD`. A local run reports no rows at all — it
+* SUBSTITUTES, so the visible effect is an environment variable or a
+* `Fn::GetStackOutput` / `Fn::ImportValue` reference that resolves to nothing
+* and is dropped with a per-key warning, which is what "the record holds no
+* outputs" also looks like.
+*
+* TWO call sites share it, deliberately: `S3LocalStateProvider.load` reading
+* the TARGET stack's record, and `buildCrossStackResolver`'s
+* `Fn::GetStackOutput` arm reading a PRODUCER's. The record named is whichever
+* one is damaged, and the consequence is identical — which is why one text is
+* right here and a second spelling would only drift.
+*
+* Read-only is a property of these callers rather than of the command:
+* `cdkd local` writes no `state.json`. It CAN write one DERIVED key —
+* `ExportIndexStore.load` rebuilds and PUTs `cdkd/_index/<region>/exports.json`
+* on a miss — and that write is already fail-closed and warned about by
+* `hasReadableExportSet` / {@link malformedExportSourceWarning}, so nothing
+* here can launder a record.
+*
+* Identifiers are sanitized and THEN shell-quoted and the command is emitted
+* LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s note gives.
+*/
+function malformedLocalOutputsWarning(stackName, region) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has no readable 'outputs' map — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so reading it would hand this local run one FABRICATED output per character or element. Continuing with it EMPTY: every reference to an output of this record resolves to nothing and is dropped, which is not the same as the record holding none. See the stored value with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
+
 //#endregion
 //#region src/provisioning/config-shape.ts
 /**
@@ -23764,6 +24557,82 @@ function nestedStackChildRegionFromLocalArn(physicalId) {
 	if (typeof physicalId !== "string") return void 0;
 	return NESTED_STACK_LOCAL_ARN.exec(physicalId)?.[1];
 }
+/**
+* The prefix every dynamic-reference diagnostic this resolver spells carries.
+*
+* Exported because `cdkd scrub` applies the SAME partition on its side and must
+* not keep a second spelling of it (issue #1936's rule, one layer up): a bare
+* marker tail is reachable from text this resolver did not write — `Parameter X
+* is required but no value was provided` comes out of `resolveParameters` — so
+* the prefix is what makes the match an assertion about OWNERSHIP.
+*/
+const DYNAMIC_REFERENCE_PREFIX = "Dynamic reference: ";
+/**
+* Does `source` carry a `{{resolve:...}}` reference that could actually be
+* FETCHED — one not still awaiting an `Fn::Sub` placeholder?
+*
+* Moved here from `cdkd scrub` (issue go-to-k/cdkd#3181), which still imports
+* it, because the resolver needs the same question answered per abandoned UNIT
+* and issue #1936 forbids a second spelling of the token pattern.
+*
+* The distinction it draws is between "nobody could have resolved this" and
+* "this one was resolvable and was not resolved" — the line between merely
+* REPORTING an abandonment and letting it gate an exit code.
+*/
+function carriesFetchableDynamicReference(source) {
+	if (typeof source === "string") return dynamicReferenceTokens(source).some((token) => !token.includes("${"));
+	if (Array.isArray(source)) return source.some(carriesFetchableDynamicReference);
+	if (source !== null && typeof source === "object") return Object.values(source).some(carriesFetchableDynamicReference);
+	return false;
+}
+/**
+* The NAMELESS spellings, which REFUSE rather than fail to fetch.
+*
+* `{{resolve:secretsmanager:}}` with an empty argument is a structurally broken
+* template, and no substitution produces one — an unresolved `Fn::Sub` keeps its
+* literal `${...}`. `cdkd scrub` has refused on these since
+* [#2692](https://github.com/go-to-k/cdkd/issues/2692), so the per-unit
+* recovery must not quietly downgrade one to a skipped token.
+*/
+const NAMELESS_DYNAMIC_REFERENCE_MARKERS = ["PARAMETER_NAME is required", "SECRET_ID is required"];
+/**
+* `err` is a refusal this resolver took ON PURPOSE rather than a step that
+* failed, so the per-unit recovery must re-raise it and abort the walk.
+*
+* The partition is the one `cdkd scrub` already applies on its side
+* (go-to-k/cdkd#3178), drawn by OWNERSHIP rather than vocabulary: every refusal
+* here is one THIS repo decides and spells, which is what makes matching it
+* sound in a way that matching AWS's error text never is. Everything else — any
+* SDK rejection, any shape this cannot classify — is treated as a failed step
+* and RECORDED. That asymmetry is deliberate: the residual is a unit reported
+* as unresolved, never a refusal silently skipped.
+*
+* The two halves of the message test open the partition in DIFFERENT
+* directions, and their EVIDENCE differs — stated separately rather than
+* asserted together, because only one of them is demonstrated.
+*
+* {@link DYNAMIC_REFERENCE_PREFIX} is REACHABLE and tested: a secret id is
+* template-assembled, so AWS's rejection echoes the name it was handed, and a
+* parameter named after a marker puts the bare tail inside a message this repo
+* did not write. Matching the tail alone reads that as a refusal and disarms
+* recovery for the leaf — restoring exactly the loss #3181 removes.
+*
+* The CAUSE walk is defence in depth, and NO reachable wrapping of one of these
+* throws was found from inside either walk's `try` (the in-repo precedent for
+* the shape is `role-arn.ts`). It is kept because the two failure directions
+* are not symmetric: an unrecognised refusal is recorded and walked past, which
+* is the one residual this partition promises cannot happen, while the cost of
+* the walk is a bounded chain read. Do not cite it as fenced — it is not.
+*/
+function isNamelessDynamicReferenceError(err) {
+	if (!(err instanceof Error)) return false;
+	return errorCauseChain(err).some((link) => link.message.includes("Dynamic reference: ") && NAMELESS_DYNAMIC_REFERENCE_MARKERS.some((m) => link.message.includes(m)));
+}
+function isDeliberateResolutionRefusal(err) {
+	if (!(err instanceof Error)) return false;
+	if (errorCauseChain(err).some((link) => link instanceof IntrinsicResolutionRefusalError)) return true;
+	return isNamelessDynamicReferenceError(err);
+}
 let cachedAccountIdentity = null;
 /**
 * Cache for availability zones per region
@@ -24995,7 +25864,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (!targetRegion) return ambient;
 		const target = canonicalizeRegion(targetRegion);
 		const loggedTarget = targetLogText ?? (targetRegion === this.explicitRegion ? this.explicitRegionLogText : void 0) ?? target;
-		if (!isClientSafeRegion(target)) throw new Error(`Refusing to build AWS clients for the region '${stripControlChars(loggedTarget).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`);
+		if (!isClientSafeRegion(target)) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to build AWS clients for the region '${stripControlChars(loggedTarget).slice(0, 64)}': it is not a valid AWS region name, and a region is substituted into the AWS service hostname.`));
 		if (typeof ambient.withRegion !== "function") return ambient;
 		const cached = this.regionScopedClients.get(target);
 		if (cached) return cached;
@@ -25191,8 +26060,54 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		this.logger.warn(`A resolution failed while ${parts} still running, and cdkd stopped waiting because the wait after a failure (capped at ${capSeconds}s) was used up. A secret such a part resolves from now on is still recorded, but only what runs after it arrives can mask it: output already printed or saved is not revisited.`);
 	}
 	/**
-	* Recursively resolve a value
-	*/
+	* Resolve ONE key of a bag, recovering per key when the caller opted in.
+	*
+	* Shared by the two sequential key walks that had this defect — the generic
+	* object walk in {@link resolveValue} and `resolveSub`'s variable map — so
+	* the recovery and the REFUSAL partition cannot drift between them. Both were
+	* bare `for … await` loops, so the first failing key abandoned every later
+	* one (issue go-to-k/cdkd#3218; the variable map was found beside it and is
+	* the same defect, not a second one).
+	*
+	* An abandoned key keeps its INPUT value, matching what the per-token
+	* recovery does with an unfetched token. That is safe only because the bag
+	* obliges its consumer to fail the operation — `ResolverContext`'s field doc
+	* carries the obligation and why it is not optional.
+	*
+	* **The log-twin invariant (issue go-to-k/cdkd#3100) under the KEY ordering**,
+	* which is a separate claim from the token one and was missing while the
+	* token half was stated twice. `matches` / `twinTokens` are built inside
+	* `resolveDynamicReferencesWithLogTwin`, once per STRING LEAF, so the
+	* pairing is leaf-local: a key abandoned beside a leaf never enters that
+	* function for it and cannot shift its indices. Skipping a key changes only
+	* WHICH leaves are visited, never how any visited leaf pairs — and a leaf
+	* that is skipped pairs nothing at all rather than pairing wrongly. Fenced
+	* by the key case in
+	* `tests/unit/deployment/intrinsic-resolver-recovered-sibling-log-masking.test.ts`.
+	*
+	* **Both call sites reach it only when a bag is present, and that gate lives
+	* at the CALL SITE rather than in here on purpose.** `resolveValue` recurses
+	* once per nesting level, so routing every level through a second async
+	* frame roughly doubles the resolver's frame cost for a deeply nested
+	* property and lowers the depth at which it raises `RangeError`. An early
+	* return inside this method would not help — the frame is created by the
+	* call. Gating outside leaves every caller that passes no bag (deploy, diff,
+	* drift, rollback) on exactly the pre-#3218 call shape, which is what makes
+	* "a bagless caller is unchanged" true in the stack dimension too. Measured,
+	* not reasoned: the heavier shape inverted the frame-weight ordering that
+	* `tests/unit/cli/import-observed-baseline-refusal-matrix.test.ts` bisects
+	* for, and that is how it was caught rather than shipped.
+	*/
+	async resolveKeyUnit(key, val, context, abandoned) {
+		try {
+			return await this.resolveValue(val, context);
+		} catch (err) {
+			if (isDeliberateResolutionRefusal(err)) throw err;
+			abandoned.push(this.abandonedUnit("key", key, err, context, val));
+			return val;
+		}
+	}
+	/** Recursively resolve a value. */
 	async resolveValue(value, context) {
 		if (typeof value !== "object" || value === null) {
 			if (typeof value === "string" && value.includes("{{resolve:")) return await this.resolveDynamicReferences(value, context);
@@ -25222,7 +26137,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		if (unknownIntrinsicKey !== void 0) throw buildUnknownIntrinsicError(unknownIntrinsicKey);
 		const resolved = {};
 		for (const [key, val] of Object.entries(obj)) {
-			const resolvedVal = await this.resolveValue(val, context);
+			const resolvedVal = context.abandonedResolutions === void 0 ? await this.resolveValue(val, context) : await this.resolveKeyUnit(key, val, context, context.abandonedResolutions);
 			if (resolvedVal !== AWS_NO_VALUE) {
 				if (key === "__proto__") Object.defineProperty(resolved, key, {
 					value: resolvedVal,
@@ -26491,7 +27406,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 				};
 				variables[key] = resolved.result;
 				variableTwins[key] = resolved.twin;
-			} else variables[key] = await this.resolveValue(val, context);
+			} else variables[key] = context.abandonedResolutions === void 0 ? await this.resolveValue(val, context) : await this.resolveKeyUnit(key, val, context, context.abandonedResolutions);
 		} else template = subArgs;
 		const replacements = [];
 		const matches = template.matchAll(/\$\{(!)?([^}]*)\}/g);
@@ -27353,6 +28268,7 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			}
 			throw new Error(`Fn::GetStackOutput: stack '${loggedStackName}' not found in region '${loggedRegion}'${roleArn ? ` (cross-account via ${roleArn})` : ""}. ${!roleArn && this.cfnFallback ? "Searched cdkd state and CloudFormation stacks. Make sure the producer stack has been deployed (via cdkd or CloudFormation)." : `Make sure the producer stack has been deployed via cdkd.`}`);
 		}
+		if (!hasReadableOutputs(stateData.state)) throw markNonRetryable(new MalformedProducerRecordRefusalError(`Fn::GetStackOutput: the state record of producer stack '${loggedStackName}' (${loggedRegion}) has no readable 'outputs' map — the record is malformed or truncated. cdkd refuses to resolve from it rather than reading it as a map: 'Object.hasOwn' answers TRUE for '0' on a string and for an index on a list, so continuing would resolve ONE CHARACTER or element of the record as this reference's value and this deploy would send it to AWS. Inspect the producer's record with 'cdkd state show' --json, repair or remove it, then re-run.`));
 		const outputs = stateData.state.outputs ?? {};
 		if (!Object.hasOwn(outputs, outputName)) {
 			const available = this.describeAvailableOutputs(Object.keys(outputs), context);
@@ -27719,6 +28635,27 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 		return this.maskNeedlesForLog(text, context) !== text ? "***" : registered;
 	}
 	/**
+	* Build one {@link AbandonedResolution}, masking BOTH of its text fields.
+	*
+	* One constructor for both walks so neither can grow a second masking rule:
+	* `subject` and `message` are the only fields a consumer may render, and each
+	* carries its own route to a plaintext — an assembled reference puts one in
+	* the raw token (issue #2827), and an SDK rejection arrives RAW through
+	* `sendWithThrottleRetry` echoing the `Name` it was handed. `error` is kept
+	* unmasked on purpose and is documented as classification-only.
+	*/
+	abandonedUnit(unit, subject, error, context, rawInput, preRedact) {
+		const raw = error instanceof Error ? error.message : String(error);
+		return {
+			unit,
+			subject: this.maskSecretsForLog(subject, context),
+			message: this.maskSecretsForLog(preRedact === void 0 ? raw : preRedact(raw), context),
+			error,
+			carriedDynamicReference: carriesDynamicReference(rawInput),
+			carriedFetchableReference: carriesFetchableDynamicReference(rawInput)
+		};
+	}
+	/**
 	* The needle mask alone: {@link maskSecretsForLog} without the log-twin
 	* lookup. For the two DETECTORS that must ask the needle mask apart from the
 	* position mask: `logTwinText`, which asks it of a value that already has a
@@ -28130,77 +29067,92 @@ var IntrinsicFunctionResolver = class IntrinsicFunctionResolver {
 			const pairedTwin = tokensAligned ? twinTokens[index] : void 0;
 			const tokenLogText = inherited?.tokenLogText ?? (pairedTwin === void 0 ? "***" : this.straddleSafeTwin(fullMatch, pairedTwin, context));
 			const nameLogText = inherited?.nameLogText ?? (pairedTwin === void 0 ? () => "***" : this.dynamicReferenceNameLogText(inner, pairedTwin, context));
-			const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
-			if (isKnownSecret && context?.skipDynamicReferences) continue;
-			const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
-			if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(tokenLogText, context)}: it names '${this.maskSecretsForLog(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.maskSecretsForLog(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
-			if (regionVerdict.kind === "named-region") {
-				const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
-					tokenLogText,
-					nameLogText
-				});
-				result = result.replace(fullMatch, () => foreign.result);
-				twin = twin.replace(fullMatch, () => foreign.twin);
-				continue;
-			}
-			const cached = this.cachedDynamicReferences.get(fullMatch);
-			if (cached) {
-				if (cached.secret && cached.value) {
-					context?.recordedSecretValues?.set(cached.value, fullMatch);
-					if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, cached.value);
+			try {
+				const isKnownSecret = service === "secretsmanager" || service === "ssm-secure" || recordedSecretExpressions.has(fullMatch);
+				if (isKnownSecret && context?.skipDynamicReferences) continue;
+				const regionVerdict = classifyReplaySecretRegion(fullMatch, this.explicitRegion ?? this.resolverRegion, context?.producerRegions);
+				if (regionVerdict.kind === "ambiguous") throw markNonRetryable(new DynamicReferenceRegionAmbiguousError(`Refusing to resolve the secret reference ${this.maskSecretsForLog(tokenLogText, context)}: it names '${this.maskSecretsForLog(nameLogText(regionVerdict.secretName), context)}' without a region, and this stack reads from ${this.maskSecretsForLog(regionVerdict.foreignProducerRegions.map((r) => this.maskSecretsForLog(r, context)).join(", "), context)} as well as its own region. cdkd cannot tell which one must answer, and resolving against the wrong one yields a different secret. Spell the reference as a full ARN to say which region owns it.`));
+				if (regionVerdict.kind === "named-region") {
+					const foreign = await this.resolverForProducerRegion(regionVerdict.region, context, nameLogText(regionVerdict.region)).resolveDynamicReferencesWithLogTwin(fullMatch, fullMatch, withoutProducerRegions(context), {
+						tokenLogText,
+						nameLogText
+					});
+					result = result.replace(fullMatch, () => foreign.result);
+					twin = twin.replace(fullMatch, () => foreign.twin);
+					continue;
 				}
-				result = result.replace(fullMatch, () => cached.value);
-				twin = twin.replace(fullMatch, () => cached.secret && cached.value ? "***" : cached.value);
-				continue;
-			}
-			const parts = inner.split(":");
-			let resolved;
-			let isSecret = isKnownSecret;
-			/**
-			* May the resolved value be REMEMBERED, or must the next pass re-ask?
-			*
-			* Cleared for exactly the answers the verdict store refuses to pin — an
-			* ssm parameter judged secret from a `Type` that is not a definitive
-			* `SecureString` (issue #1901's fail-closed arm). Caching one would pin
-			* the transient answer for the whole resolver anyway, which is what the
-			* refusal to memoize exists to prevent: before the value cache became
-			* instance-scoped this was already true process-wide, and the
-			* "next pass re-asks" property only ever held on the comparison path,
-			* which caches nothing (issue #1933).
-			*/
-			let cacheable = true;
-			if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText);
-			else if (service === "ssm") {
-				const decrypt = context?.skipDynamicReferences !== true;
-				const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
-				if (param.type === "SecureString") this.pinSecretVerdict(fullMatch, true);
-				else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
-				else cacheable = false;
-				isSecret = param.secure;
-				if (param.secure) {
-					if (!decrypt) continue;
+				const cached = this.cachedDynamicReferences.get(fullMatch);
+				if (cached) {
+					if (cached.secret && cached.value) {
+						context?.recordedSecretValues?.set(cached.value, fullMatch);
+						if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, cached.value);
+					}
+					result = result.replace(fullMatch, () => cached.value);
+					twin = twin.replace(fullMatch, () => cached.secret && cached.value ? "***" : cached.value);
+					continue;
 				}
-				resolved = param.value;
-			} else if (service === "ssm-secure") {
-				const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
-				if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
-				isSecret = true;
-				resolved = param.value;
-			} else {
-				this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.maskSecretsForLog(nameLogText(String(service)), context)}`, context));
+				const parts = inner.split(":");
+				let resolved;
+				let isSecret = isKnownSecret;
+				/**
+				* May the resolved value be REMEMBERED, or must the next pass re-ask?
+				*
+				* Cleared for exactly the answers the verdict store refuses to pin — an
+				* ssm parameter judged secret from a `Type` that is not a definitive
+				* `SecureString` (issue #1901's fail-closed arm). Caching one would pin
+				* the transient answer for the whole resolver anyway, which is what the
+				* refusal to memoize exists to prevent: before the value cache became
+				* instance-scoped this was already true process-wide, and the
+				* "next pass re-asks" property only ever held on the comparison path,
+				* which caches nothing (issue #1933).
+				*/
+				let cacheable = true;
+				if (service === "secretsmanager") resolved = await this.resolveSecretsManagerReference(inner, context, nameLogText);
+				else if (service === "ssm") {
+					const decrypt = context?.skipDynamicReferences !== true;
+					const param = await this.resolveSSMReference(parts, decrypt, "ssm", context, nameLogText);
+					if (param.type === "SecureString") this.pinSecretVerdict(fullMatch, true);
+					else if (!param.secure) this.pinSecretVerdict(fullMatch, false);
+					else cacheable = false;
+					isSecret = param.secure;
+					if (param.secure) {
+						if (!decrypt) continue;
+					}
+					resolved = param.value;
+				} else if (service === "ssm-secure") {
+					const param = await this.resolveSSMReference(parts, true, "ssm-secure", context, nameLogText);
+					if (!param.secure) throw markNonRetryable(new IntrinsicResolutionRefusalError(`Refusing to resolve ${this.maskSecretsForLog(tokenLogText, context)}: the parameter is a ${param.type} parameter, and the ssm-secure spelling is defined for SecureString parameters only. Reference it as {{resolve:ssm:...}} if it is public configuration.`));
+					isSecret = true;
+					resolved = param.value;
+				} else {
+					this.logger.warn(this.maskSecretsForLog(`Unsupported dynamic reference service: ${this.maskSecretsForLog(nameLogText(String(service)), context)}`, context));
+					continue;
+				}
+				if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
+					value: resolved,
+					secret: isSecret
+				});
+				if (isSecret && resolved) {
+					context?.recordedSecretValues?.set(resolved, fullMatch);
+					if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, resolved);
+					if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true);
+				}
+				result = result.replace(fullMatch, () => resolved);
+				twin = twin.replace(fullMatch, () => isSecret && resolved ? "***" : resolved);
+			} catch (err) {
+				if (context?.abandonedResolutions === void 0) throw err;
+				if (isDeliberateResolutionRefusal(err)) throw err;
+				context.abandonedResolutions.push(this.abandonedUnit("token", tokenLogText, err, context, fullMatch, (text) => {
+					let out = text;
+					const segments = [...new Set(inner.split(":"))].filter((segment) => segment.length > 0).sort((a, b) => b.length - a.length);
+					for (const segment of segments) {
+						const logged = nameLogText(segment);
+						if (logged !== segment) out = out.split(segment).join(logged);
+					}
+					return out;
+				}));
 				continue;
 			}
-			if (cacheable) this.cachedDynamicReferences.set(fullMatch, {
-				value: resolved,
-				secret: isSecret
-			});
-			if (isSecret && resolved) {
-				context?.recordedSecretValues?.set(resolved, fullMatch);
-				if (context?.recordedSecretValues) recordResolvedPair(context.recordedSecretValues, fullMatch, resolved);
-				if (service === "secretsmanager" || service === "ssm-secure") this.pinSecretVerdict(fullMatch, true);
-			}
-			result = result.replace(fullMatch, () => resolved);
-			twin = twin.replace(fullMatch, () => isSecret && resolved ? "***" : resolved);
 		}
 		if (context) this.rememberLogTwin(context, result, twin);
 		return {
@@ -29343,6 +30295,99 @@ function slowCcOperationTimeoutMs(resourceType, operation) {
 	}
 }
 
+//#endregion
+//#region src/provisioning/wait-abandoned.ts
+/**
+* The "cdkd stopped watching an operation that may still be running" marker
+* (issue [#3236](https://github.com/go-to-k/cdkd/issues/3236), widened by
+* [#3253](https://github.com/go-to-k/cdkd/issues/3253)).
+*
+* `CloudControlWaitAbandonedError` is raised in `cloud-control-provider.ts`,
+* but FIVE call sites have to refuse it, and three of them live in other
+* files. Four are GOVERNED by
+* `tests/unit/provisioning/wait-abandoned-guard-population.test.ts`:
+*
+*  - `cloud-control-provider.ts`'s own `delete()` catch,
+*  - `deploy-engine.ts`'s replacement delete-then-CREATE arm,
+*  - `deploy-engine.ts`'s template-removal delete arm,
+*  - `destroy-runner.ts`'s per-resource delete loop.
+*
+* The FIFTH is `cleanupFailedCreateRemnant`, and it is outside that population
+* by construction rather than by oversight: its partner classifier is the
+* REGEX helper `isNotFoundMessage`, which carries no literal needles, so no
+* needle-driven scan can find it. It has a behavioural case instead, and it
+* needs the guard for a sharper reason than the other four — that regex is
+* case-INSENSITIVE, so `getaddrinfo ENOTFOUND ...` matches `/not\s*found/i`.
+*
+* Each decides "the resource is already gone" by SUBSTRING-matching the error
+* message, and each then DROPS the state row. An abandoned wait says the
+* opposite — the delete may still be running — and its message interpolates
+* the LOGICAL ID and the last-seen IDENTIFIER, both user- or template-chosen,
+* so a resource named `PageNotFound` satisfies those needles. Round 1 of
+* go-to-k/cdkd#3249 guarded the first site with a local `instanceof` and left
+* the other three, which is what this module exists to fix: ONE predicate the
+* three foreign sites can import without importing the provider.
+*
+* **A marker rather than an exported class + `instanceof`**, for the reason
+* `markNonRetryable` is one: `deploy-engine.ts` reaches the provider only
+* through `ProviderRegistry`, so importing the class there would add an edge
+* into an already dense ring, and a marker survives a wrapper that copies a
+* message without preserving a prototype.
+*
+* **NOT `markNonRetryable`**, though the mechanism is identical: a DELETE or
+* UPDATE abandonment is deliberately left RETRYABLE so the destroy runner can
+* re-issue an idempotent delete, and only CREATE is marked. Reusing that
+* marker would either make the guards miss DELETE — the case that drops a
+* state row — or make a DELETE non-retryable and lose the recovery.
+*
+* A LEAF: no imports, ever. All four consumers sit on the deploy engine ->
+* rollback executor -> registry -> provider ring, and a new edge into it from
+* any of them would close a cycle.
+*/
+const WAIT_ABANDONED_MARKER = Symbol.for("cdkd.waitAbandoned");
+/**
+* The `.cause` walk depth, the same bound `retryable-errors.ts` uses. cdkd
+* wraps errors, so the marked error is routinely one or two hops down.
+*/
+const MAX_CAUSE_CHAIN_DEPTH = 5;
+/**
+* Stamp an error as an abandoned wait.
+*
+* `E extends Error`, not `object`: the reader below is a PROTOTYPE-CHAIN
+* lookup, so marking a class or a shared prototype would silently mark every
+* instance of it. A non-extensible (frozen / sealed) error is returned
+* UNMARKED rather than allowed to throw — callers use this inline, so a
+* `TypeError` raised here would REPLACE the error the caller meant to raise.
+* Both rules are `markNonRetryable`'s, for its reasons.
+*/
+function markWaitAbandoned(error) {
+	if (!Object.isExtensible(error)) return error;
+	Object.defineProperty(error, WAIT_ABANDONED_MARKER, {
+		value: true,
+		enumerable: false,
+		configurable: true,
+		writable: false
+	});
+	return error;
+}
+/**
+* True when the error, or anything in its bounded `.cause` chain, was marked
+* by {@link markWaitAbandoned}.
+*
+* Every already-deleted classifier must test this BEFORE its substring match,
+* and must treat a true answer as "not already deleted" — i.e. re-throw. The
+* ordering is the whole point: a message-first guard has already decided by
+* the time it would consult the marker.
+*/
+function isWaitAbandonedError(error) {
+	let current = error;
+	for (let depth = 0; depth < MAX_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		if (current[WAIT_ABANDONED_MARKER] === true) return true;
+		current = current.cause;
+	}
+	return false;
+}
+
 //#endregion
 //#region src/provisioning/cloud-control-provider.ts
 /**
@@ -29411,6 +30456,297 @@ var CloudControlOperationFailedError = class CloudControlOperationFailedError ex
 	}
 };
 /**
+* Thrown when cdkd STOPPED WAITING on a Cloud Control operation it had already
+* submitted — never when the operation itself reported a verdict (issue
+* [#3236](https://github.com/go-to-k/cdkd/issues/3236)).
+*
+* Deliberately NOT a subclass of {@link CloudControlOperationFailedError}, and
+* the distinction is load-bearing in three places that key off that class:
+* `cleanupFailedCreateRemnant`'s first guard, `delete()`'s structured
+* `ErrorCode: NotFound` absorption, and `isUpdateUnsupportedError`'s chain
+* walk. All three ask "what did the handler report", and the answer here is
+* NOTHING — the handler was still running when cdkd lost sight of it. In
+* particular the remnant cleanup must not fire: it deletes by
+* `error.physicalId`, and an identifier seen on an IN_PROGRESS event names a
+* resource whose create may be about to SUCCEED.
+*
+* Carries {@link requestToken} because that token is the only handle on an
+* operation cdkd has no state record for, and Cloud Control keeps a request's
+* status queryable by it well after the operation settles. Before this class
+* the token lived only in `waitForOperation`'s parameter list, so a poll that
+* threw discarded it and the resource — which AWS went on to create — became
+* invisible to state, to rollback and to `cdkd destroy`.
+*
+* **The protection is the MARKER, not the wording** — `markWaitAbandoned` in
+* the constructor below, which four already-deleted classifiers test before
+* their substring match (`src/provisioning/wait-abandoned.ts` names them;
+* `.claude/rules/cloud-control-wait.md` carries the whole contract). An
+* earlier revision of this comment said the wording was the protection, and
+* that is exactly what review disproved: the message interpolates the LOGICAL
+* ID and the last-seen IDENTIFIER, both user- or template-chosen, so a
+* resource named `PageNotFound` satisfies every needle no matter how carefully
+* the template is worded.
+*
+* The wording constraint is still KEPT as a second layer — the message avoids
+* the phrases where it can, the same discipline `src/deployment/delete-outcome.ts`
+* and `src/provisioning/nested-stack-messages.ts` carry, and
+* `tests/unit/provisioning/cloud-control-wait-abandoned.test.ts` asserts it
+* over the RENDERED message (cause text and identifier clause included) rather
+* than over the template. But it is belt to the marker's braces. Do not reword
+* this comment back into a claim that it suffices.
+*/
+var CloudControlWaitAbandonedError = class CloudControlWaitAbandonedError extends ProvisioningError {
+	requestToken;
+	ccOperation;
+	/**
+	* The `Identifier` from the last progress event cdkd managed to read, when
+	* one carried it. Cloud Control populates it on IN_PROGRESS events once the
+	* handler has materialized the resource, so on a CREATE this is frequently
+	* the physical id of the very resource that is about to go untracked — worth
+	* printing, and deliberately NOT worth acting on (see the remnant-cleanup
+	* note above).
+	*/
+	lastSeenIdentifier;
+	constructor(message, resourceType, logicalId, requestToken, ccOperation, lastSeenIdentifier, cause) {
+		super(message, resourceType, logicalId, lastSeenIdentifier, cause);
+		this.requestToken = requestToken;
+		this.ccOperation = ccOperation;
+		this.lastSeenIdentifier = lastSeenIdentifier;
+		this.name = "CloudControlWaitAbandonedError";
+		Object.setPrototypeOf(this, CloudControlWaitAbandonedError.prototype);
+		markWaitAbandoned(this);
+	}
+};
+/**
+* Node / undici socket-level failure codes, i.e. the request never reached
+* Cloud Control or its response never came back.
+*
+* Mirrors `@smithy/service-error-classification`'s own
+* `NODEJS_TIMEOUT_ERROR_CODES` (`ECONNRESET` / `ECONNREFUSED` / `EPIPE` /
+* `ETIMEDOUT`), widened by the DNS and route shapes a dropped VPN also
+* produces. The SDK already retries every one of these under STANDARD mode —
+* three attempts, sub-second — so an error that reaches cdkd here is one the
+* SDK's own budget did not outlast, not one it declined to retry.
+*/
+const POLL_TRANSPORT_ERROR_CODES = /* @__PURE__ */ new Set([
+	"ECONNRESET",
+	"ECONNREFUSED",
+	"ECONNABORTED",
+	"EPIPE",
+	"ETIMEDOUT",
+	"ENOTFOUND",
+	"EAI_AGAIN",
+	"EHOSTUNREACH",
+	"ENETUNREACH",
+	"ENETDOWN",
+	"EPROTO"
+]);
+/** SDK error names for a request that timed out or was aborted in transit. */
+const POLL_TRANSPORT_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"TimeoutError",
+	"RequestTimeout",
+	"RequestTimeoutException",
+	"RequestAbortedException"
+]);
+/**
+* Matches one of {@link POLL_TRANSPORT_ERROR_CODES} as a whole word inside a
+* message that lost its `code` property.
+*
+* DERIVED from the set rather than hand-spelled, so the two can never disagree
+* about which codes count — and so the pattern cannot be wrong about a code's
+* LENGTH, which a hand-written `E[A-Z]{3,10}` was: it is eleven characters
+* after the `E` in `ECONNREFUSED`, the exact code the issue reported, so the
+* arm silently matched nothing for the case it was added for.
+*/
+const POLL_TRANSPORT_CODE_IN_MESSAGE = new RegExp(`\\b(?:${[...POLL_TRANSPORT_ERROR_CODES].join("|")})\\b`);
+/**
+* The `.cause` walk depth. It is `retryable-errors.ts`'s `MAX_CAUSE_CHAIN_DEPTH`
+* VALUE, and equality is the requirement rather than a coincidence: a transport
+* code this predicate finds at a depth `isThrottlingError` /
+* `isMarkedNonRetryable` / `isRetryableTransientError` structurally cannot
+* reach means two classifiers answering differently about one chain, which is
+* the divergence this area keeps collapsing. A literal because that constant is
+* module-private there, and `tests/unit/provisioning/cloud-control-wait-abandoned.test.ts`
+* pins the pair by building a chain one hop deeper than the bound and asserting
+* BOTH refuse it -- a claim an earlier revision made with no such case behind
+* it, which is exactly the shape a fence audit greps for.
+*
+* cdkd wraps errors (`ProvisioningError` keeps the raw one as `cause`), so the
+* socket error is routinely one or two hops down; the bound also keeps a cyclic
+* chain from hanging the classifier.
+*/
+const POLL_CAUSE_CHAIN_DEPTH = 5;
+/**
+* The ONE name whose message must be withheld from a non-`debug` line, and the
+* enumeration behind why it is exactly one.
+*
+* `@smithy/property-provider` exports a family of three -- `ProviderError`, and
+* its subclasses `CredentialsProviderError` and `TokenProviderError` -- plus
+* `@smithy/credential-provider-imds`'s `InstanceMetadataV1FallbackError`, the
+* only subclass OF `CredentialsProviderError` in the installed tree. (All four
+* set `name`; the qualifier is what makes the sentence true, and an earlier
+* revision read "the only subclass that overrides `name`", which is false of
+* the three siblings.) Each was read rather than reasoned about, because the
+* answers differ and go BOTH ways:
+*
+*  - `CredentialsProviderError` is the one that leaks.
+*    `@aws-sdk/credential-provider-process` wraps EVERY exec failure in it, so
+*    its message interpolates the helper's ARGV and its stderr. Measured
+*    through a real client: `Command failed: /bin/sh -c 'echo "vault: token
+*    hvs.<...> rejected" >&2; exit 1'` followed by that stderr. An aws-vault /
+*    saml2aws setup whose credentials expire mid-wait would persist a token.
+*  - `TokenProviderError` must NOT be reduced. Its message IS the remedy --
+*    `Token is expired. To refresh this SSO session run 'aws sso login' with
+*    the corresponding profile.` -- so reducing it to a wire name would delete
+*    the fix instruction. A round-9 revision of this predicate matched the
+*    whole `*ProviderError` suffix and did exactly that.
+*
+*    The benefit is NOT realized on THIS path today, and saying otherwise was
+*    the claim review measured false: `@aws-sdk/credential-provider-sso`
+*    catches every token failure and rethrows it as a
+*    `CredentialsProviderError`, so the shape cannot escape a SigV4 client and
+*    an SSO expiry reaches here already reduced. The carve-out is a rule about
+*    the FAMILY, kept because the rewrap is upstream behaviour that can change
+*    and because the reduction is wrong for this class on any path that does
+*    surface it -- not a user-visible improvement this PR delivers.
+*  - `ProviderError` (the base) and `InstanceMetadataV1FallbackError` carry
+*    connectivity and CONFIG wording respectively -- the IMDS one interpolates
+*    three fixed literals naming config keys, with no argv, stderr, profile
+*    value or identity in it. Both are more useful raw.
+*
+* So string EQUALITY is right here, and it is right by enumeration rather than
+* by assumption. Re-check this list when the SDK major moves; do not widen it
+* to a suffix.
+*
+* The specific mechanism to re-check is `ProviderError.from()`, which does
+* `Object.assign(new this(...), error)` -- that copies a SOURCE error's own
+* `name` over the class field and would defeat string equality outright. It
+* has ZERO call sites anywhere in `node_modules` today, which is the only
+* reason equality is safe rather than merely correct-looking.
+*/
+const CREDENTIAL_LEAK_ERROR_NAME = "CredentialsProviderError";
+/**
+* Decide what a `GetResourceRequestStatus` failure may say outside `--verbose`.
+*
+* ONE function because there are TWO readers and they must not disagree about
+* one error: `abandonWait`, whose message is persisted verbatim into
+* `deployments/{runId}.jsonl`, and the re-poll `logger.warn`, which runs at
+* DEFAULT verbosity. They were separate, and the gap was reachable rather than
+* theoretical -- `POLL_TRANSPORT_CODE_IN_MESSAGE` matches a socket code
+* ANYWHERE in the message, so a `credential_process` stderr that happens to
+* contain `ETIMEDOUT` classifies as transient, and the warn printed the helper
+* argv and stderr on every re-poll while the abandonment that eventually
+* followed reduced them.
+*
+* The authorship test is NOT `describeAwsFailure`'s. That one keys on the mere
+* PRESENCE of `$metadata`, and `@smithy/core`'s retry middleware stamps
+* `$metadata = {attempts, totalRetryDelay}` onto EVERY error it gives up on --
+* socket errors included. Measured against a real client pointed at a closed
+* port:
+*
+*     name 'Error', code 'ECONNREFUSED', $fault undefined,
+*     message 'connect ECONNREFUSED 127.0.0.1:1',
+*     $metadata { attempts: 3, totalRetryDelay: 58 }
+*
+* so reducing on it DELETES `connect ECONNREFUSED ...` -- the exact wording
+* issue [#3236](https://github.com/go-to-k/cdkd/issues/3236) was reported with
+* -- and leaves the bare token `Error.`, a socket error's `name` being `Error`.
+* The discriminator here is a real SERVICE signal instead: `$fault`, or a
+* NUMERIC `$metadata.httpStatusCode`, which a transport failure never carries
+* and a service rejection always does.
+*
+* Credential resolution carries NEITHER signal, which is why
+* {@link CREDENTIAL_LEAK_ERROR_NAME} is a third arm. That is measured, not
+* read off the middleware table -- review round 8 argued from middleware
+* priorities that identity is resolved inside the retry middleware, and a real
+* `CloudControlClient` whose credential provider throws answers
+* `{name:'CredentialsProviderError', $fault: undefined, $metadata: undefined}`.
+* The mechanism, confirmed afterwards: identity is resolved by
+* `httpAuthSchemeMiddleware` at step `serialize`, which WRAPS retry's
+* `finalizeRequest`, and retry's own catch CREATES `$metadata` when it is
+* absent -- so an escaping error with none PROVES it never entered retry. Do
+* not "correct" this back.
+*
+* Retiring the divergence with the shared helper is
+* [#3297](https://github.com/go-to-k/cdkd/issues/3297).
+*/
+function describePollFailure(error) {
+	if (error === void 0) return {
+		display: "",
+		detail: "",
+		marker: false
+	};
+	if (!(error instanceof Error)) {
+		const other = describeAwsFailure(error);
+		return {
+			display: other.summary,
+			detail: other.detail,
+			marker: false
+		};
+	}
+	if (!(error.$fault !== void 0 || typeof error.$metadata?.httpStatusCode === "number" || error.name === CREDENTIAL_LEAK_ERROR_NAME)) return {
+		display: error.message,
+		detail: "",
+		marker: false
+	};
+	if (error.message === "") return {
+		display: "",
+		detail: "",
+		marker: false
+	};
+	return {
+		display: redactedAwsFailureSummary(error),
+		detail: error.message,
+		marker: true
+	};
+}
+/**
+* True when a `GetResourceRequestStatus` call failed for a reason that says
+* nothing about the OPERATION — the poll could not be delivered or answered,
+* so re-polling the same token is the correct response.
+*
+* Fail-CLOSED: an unmodelled shape answers false, so the wait is not RETRIED.
+* It is still ABANDONED rather than aborted bare — the caller carries the
+* request token out on that arm too, since losing the handle is issue #3236's
+* defect whatever the trigger. The safe direction here is about retrying, not
+* about reporting: the errors this must NOT absorb are the ones a retry can
+* only re-derive —
+* `RequestTokenNotFoundException` (the token is genuinely gone),
+* `AccessDeniedException`, `ValidationException`.
+*
+* Throttles and transient 5xx are in scope alongside transport, and not as a
+* generalization for its own sake: they are the same defect with a different
+* trigger, and the throttle case is the WORSE of the two today. The abort
+* is retryable by BOTH routes the classifier offers — `isThrottlingError`'s
+* chain walk over the threaded cause, and (before the cause is reduced to its
+* wire code) AWS's own `Rate exceeded` wording against
+* `RETRYABLE_ERROR_MESSAGE_PATTERNS` — so the deploy engine's outer `withRetry`
+* re-invokes `create()` and duplicates a resource that is already being created
+* (go-to-k/cdkd#2039), where the transport case merely loses track of one.
+* Measured, not assumed: `isRetryableTransientError` answers true for a
+* throttle and false for `connect ECONNREFUSED ...`.
+*
+* The message arm exists for a wrapper that dropped `.code` while keeping the
+* text. It is scoped by its SOURCE — the only input is an error thrown by the
+* SDK out of `cloudControlClient.send`, never template- or user-authored text
+* — so an `E`-prefixed token there denotes a socket error rather than
+* something a user happened to type.
+*/
+function isTransientPollFailure(error) {
+	if (isThrottlingError(error) || isTransientServerError(error)) return true;
+	let current = error;
+	for (let depth = 0; depth < POLL_CAUSE_CHAIN_DEPTH && current != null; depth++) {
+		const code = current.code;
+		if (typeof code === "string" && POLL_TRANSPORT_ERROR_CODES.has(code)) return true;
+		const name = current.name;
+		if (typeof name === "string" && POLL_TRANSPORT_ERROR_NAMES.has(name)) return true;
+		const message = current.message;
+		if (typeof message === "string" && POLL_TRANSPORT_CODE_IN_MESSAGE.test(message)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+/**
 * Matches service-worded "the resource is gone" failure messages, including
 * shapes whose wording lacks the canonical `not found` substring (CodeDeploy:
 * "No Deployment Group found for name: ..."). Deliberately scoped to the
@@ -29614,6 +30950,34 @@ var CloudControlProvider = class {
 	MAX_WAIT_TIME_MS = 9e5;
 	INITIAL_POLL_INTERVAL_MS = 1e3;
 	MAX_POLL_INTERVAL_MS = 1e4;
+	/**
+	* How long an UNBROKEN run of transient poll failures is tolerated before
+	* `waitForOperation` gives up and throws {@link CloudControlWaitAbandonedError}
+	* (issue #3236). Reset by any poll that gets an answer, so it measures one
+	* outage rather than a session's total flakiness.
+	*
+	* It is a SECOND bound INSIDE the existing wall-clock budget, never an
+	* extension of one: the `while` condition below still holds, so re-polling
+	* can only consume time the wait already had. `slow-cc-operation-timeouts.ts`
+	* couples that budget to the two outer per-resource deadlines deliberately,
+	* and a separate attempt budget able to outlive it would break the coupling.
+	*
+	* Two minutes because the failures that reach this loop have already
+	* outlasted the SDK's own three STANDARD-mode attempts, so the population is
+	* outages of seconds to minutes — a VPN reconnect, a DHCP renew, a throttle
+	* that needs more than the SDK's sub-second backoff. Waiting the FULL budget
+	* instead (up to 60 min for a slow type) would buy nothing the resume hint
+	* does not: past this point the operation is equally unreachable, and the
+	* user gets the same request token thirteen to fifty-eight minutes sooner.
+	*/
+	POLL_TRANSIENT_GRACE_MS = 12e4;
+	/**
+	* The grace `disableCcProtection`'s wait takes instead (issue
+	* go-to-k/cdkd#3253 item 1). Its call site carries the reasoning; the short
+	* version is that the flip is best-effort and swallowed, so a long wait there
+	* is dead wall clock on a destroy that is failing anyway.
+	*/
+	PROTECTION_FLIP_TRANSIENT_GRACE_MS = 1e4;
 	constructor() {
 		const awsClients = getAwsClients();
 		this.cloudControlClient = awsClients.cloudControl;
@@ -29689,17 +31053,21 @@ var CloudControlProvider = class {
 		try {
 			const cleanupResult = await this.delete(logicalId, error.physicalId, resourceType);
 			if (cleanupResult?.outcome === "skipped") {
-				this.logger.warn(`Skipped deleting the remnant ${error.physicalId} left by the failed CREATE of ${logicalId}: ${cleanupResult.reason} — a retry may fail with AlreadyExists until it is removed manually`);
+				this.logger.warn(`Skipped deleting the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(cleanupResult.reason)}`);
 				return;
 			}
 			this.logger.debug(`Removed failed-create remnant ${error.physicalId} for ${logicalId}`);
 		} catch (cleanupError) {
 			const message = cleanupError instanceof Error ? cleanupError.message : String(cleanupError);
+			if (isWaitAbandonedError(cleanupError)) {
+				this.logger.warn(`Could not confirm whether the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} was removed (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(message)}`);
+				return;
+			}
 			if (isNotFoundMessage(message)) {
 				this.logger.info(`The remnant ${error.physicalId} left by the failed CREATE of ${logicalId} was already gone (not found); nothing to clean up`);
 				return;
 			}
-			this.logger.warn(`Failed to delete the remnant ${error.physicalId} left by the failed CREATE of ${logicalId}: ${message} — a retry may fail with AlreadyExists until it is removed manually`);
+			this.logger.warn(`Failed to delete the remnant ${error.physicalId} left by the failed CREATE of ${logicalId} (a retry may fail with AlreadyExists until it is removed manually): ${displaySafe(message)}`);
 		}
 	}
 	/**
@@ -29770,7 +31138,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-BPBdAAGQ.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-Di5-tD3l.js").then((n) => n.n);
 			const asgProvider = new ASGProvider();
 			return withIndeterminateGuard(await asgProvider.delete(logicalId, physicalId, resourceType, _properties, context), indeterminateGuard);
 		}
@@ -29793,7 +31161,8 @@ var CloudControlProvider = class {
 			return withIndeterminateGuard(void 0, indeterminateGuard);
 		} catch (error) {
 			const err = error;
-			if (error instanceof CloudControlOperationFailedError && error.ccOperation === "DELETE" && error.ccErrorCode === "NotFound" || err.name === "ResourceNotFoundException" || err.message?.includes("does not exist") || err.message?.includes("not found") || err.message?.includes("NotFound")) {
+			const notFoundErrorCode = error instanceof CloudControlOperationFailedError && error.ccOperation === "DELETE" && error.ccErrorCode === "NotFound";
+			if (!isWaitAbandonedError(error) && (notFoundErrorCode || err.name === "ResourceNotFoundException" || err.message?.includes("does not exist") || err.message?.includes("not found") || err.message?.includes("NotFound"))) {
 				await this.assertRecordedRegionAgainstClient("not-found", context?.expectedRegion, resourceType, logicalId, physicalId);
 				this.logger.debug(`Resource ${logicalId} already deleted (not found), treating as success`);
 				return withIndeterminateGuard(void 0, indeterminateGuard);
@@ -29858,7 +31227,7 @@ var CloudControlProvider = class {
 		try {
 			clientRegion = canonicalizeRegion((await this.cloudControlClient.config.region())?.trim());
 		} catch (error) {
-			this.logger.debug(`Could not resolve the Cloud Control client region before the ${phase} region check for ${logicalId} (${resourceType}): ${error instanceof Error ? error.message : String(error)}`);
+			this.logger.debug(`Could not resolve the Cloud Control client region before the ${phase} region check for ${logicalId} (${resourceType}): ${displaySafe(describeAwsFailure(error).detail)}`);
 			clientRegion = void 0;
 		}
 		try {
@@ -30021,11 +31390,14 @@ var CloudControlProvider = class {
 				this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId}: no request token received; proceeding with delete`);
 				return;
 			}
-			await this.waitForOperation(response.ProgressEvent.RequestToken, logicalId, "UPDATE", resourceType);
+			await this.waitForOperation(response.ProgressEvent.RequestToken, logicalId, "UPDATE", resourceType, this.PROTECTION_FLIP_TRANSIENT_GRACE_MS);
 			this.logger.debug(`Disabled ${protectionProperty} on ${logicalId}`);
 		} catch (error) {
-			const message = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId} (${resourceType}): ${message}; proceeding with delete`);
+			const described = describePollFailure(error);
+			const safeMessage = displaySafe(described.display);
+			this.logger.warn(`Could not disable ${protectionProperty} on ${logicalId} (${resourceType}), proceeding with delete${safeMessage === "" ? "" : `: ${safeMessage}`}`);
+			const detail = described.detail;
+			if (detail !== "") this.logger.debug(`Could not disable ${protectionProperty} on ${logicalId}, underlying failure: ${displaySafe(detail)}`);
 		}
 	}
 	/**
@@ -30045,17 +31417,61 @@ var CloudControlProvider = class {
 		}
 	}
 	/**
-	* Wait for an asynchronous operation to complete
+	* Wait for an asynchronous operation to complete.
+	*
+	* Reached from FOUR call sites — `create()`, `update()`, `delete()` and
+	* `disableCcProtection()` — so everything here is CREATE / UPDATE / DELETE
+	* behavior at once.
+	*
+	* The poll is fenced against its own transport (issue #3236). Before that,
+	* a `GetResourceRequestStatus` that failed for ANY reason propagated out of
+	* this loop, out of `create()`, and took the `RequestToken` — which lives
+	* only in this parameter list — with it. The Cloud Control operation keeps
+	* running server-side regardless, so a CREATE that AWS went on to complete
+	* left a live resource with no state record: invisible to rollback, to
+	* `cdkd destroy`, and to `cleanupFailedCreateRemnant` (whose first guard
+	* admits only a `CloudControlOperationFailedError`, which a transport
+	* failure never is). Reported against a `AWS::RDS::DBInstance` whose CREATE
+	* outlived a dropped VPN; the untracked instance then blocked the deletion
+	* of five tracked resources that depended on it.
+	*
+	* Re-polling is IDEMPOTENT in a way replaying the create is not, which is
+	* what makes this the right layer for the fix: `GetResourceRequestStatus`
+	* invokes no resource handler and the token is unchanged across attempts, so
+	* the duplicate-create hazard of go-to-k/cdkd#2039 is structurally absent.
+	* The complementary half is {@link CloudControlWaitAbandonedError}, for the
+	* outage that outlives the grace or the budget.
 	*/
-	async waitForOperation(requestToken, logicalId, operation, resourceType) {
+	async waitForOperation(requestToken, logicalId, operation, resourceType, transientGraceMs = this.POLL_TRANSIENT_GRACE_MS) {
 		const startTime = Date.now();
 		let attempts = 0;
 		let pollInterval = this.INITIAL_POLL_INTERVAL_MS;
+		let lastSeenIdentifier;
+		let transientOutageStartedAt;
+		let lastTransientError;
 		const maxWaitMs = Math.max(this.MAX_WAIT_TIME_MS, slowCcOperationTimeoutMs(resourceType, operation));
 		while (Date.now() - startTime < maxWaitMs) {
 			attempts++;
-			const progressEvent = (await this.cloudControlClient.send(new GetResourceRequestStatusCommand({ RequestToken: requestToken }))).ProgressEvent;
+			let statusResponse;
+			try {
+				statusResponse = await this.cloudControlClient.send(new GetResourceRequestStatusCommand({ RequestToken: requestToken }));
+			} catch (error) {
+				if (!isTransientPollFailure(error)) throw await this.abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, "cdkd could not read the operation status and the failure is not retryable", error);
+				transientOutageStartedAt ??= Date.now();
+				lastTransientError = error;
+				const outageMs = Date.now() - transientOutageStartedAt;
+				if (outageMs >= transientGraceMs) throw await this.abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, `cdkd could not reach Cloud Control API for ${Math.round(outageMs / 1e3)}s`, error);
+				const safePollText = displaySafe(describePollFailure(error).display);
+				this.logger.warn(`${operation} ${logicalId}: could not read the Cloud Control operation status (attempt ${attempts})${safePollText === "" ? "" : `: ${safePollText}`} — the operation may still be running in AWS; re-polling the same request token in ${pollInterval}ms`);
+				await this.sleep(pollInterval);
+				pollInterval = Math.min(Math.ceil(pollInterval * 1.5), this.MAX_POLL_INTERVAL_MS);
+				continue;
+			}
+			transientOutageStartedAt = void 0;
+			lastTransientError = void 0;
+			const progressEvent = statusResponse.ProgressEvent;
 			if (!progressEvent) throw new ProvisioningError(`Failed to get status for ${logicalId}: No progress event`, "Unknown", logicalId);
+			if (progressEvent.Identifier) lastSeenIdentifier = progressEvent.Identifier;
 			this.logger.debug(`${operation} ${logicalId}: ${progressEvent.OperationStatus} (attempt ${attempts}, next poll ${pollInterval}ms)`);
 			switch (progressEvent.OperationStatus) {
 				case "SUCCESS": return progressEvent;
@@ -30075,12 +31491,93 @@ var CloudControlProvider = class {
 					pollInterval = Math.min(Math.ceil(pollInterval * 1.5), this.MAX_POLL_INTERVAL_MS);
 			}
 		}
-		throw new ProvisioningError(`${operation} timeout for ${logicalId} after ${maxWaitMs / 1e3}s`, "Unknown", logicalId);
+		throw await this.abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, `${operation} timeout for ${logicalId} after ${maxWaitMs / 1e3}s`, lastTransientError);
+	}
+	/**
+	* Build the {@link CloudControlWaitAbandonedError} for a wait cdkd is giving
+	* up on while the operation is, as far as cdkd knows, still running (issue
+	* [#3236](https://github.com/go-to-k/cdkd/issues/3236)).
+	*
+	* Returns rather than throws so every call site reads `throw await
+	* this.abandonWait(...)` — the `throw` stays visible at the site, which is
+	* what keeps the control flow legible to the compiler and to a reader.
+	*
+	* CREATE is marked non-retryable and the other two are not, and the
+	* asymmetry is the whole point rather than an oversight:
+	*
+	*  - **CREATE** — a replay issues a SECOND `CreateResource` for a resource
+	*    the first call is already creating, which is go-to-k/cdkd#2039's
+	*    duplicate-create. It must be refused, and the marker is what refuses
+	*    it — but by a different mechanism than an earlier revision of this
+	*    comment claimed. That one said the message interpolates AWS's own
+	*    `Rate exceeded`, which `RETRYABLE_ERROR_MESSAGE_PATTERNS` matches; a
+	*    real `ThrottlingException` carries `$fault`, so its cause is REDUCED to
+	*    the wire code and the message no longer contains that wording.
+	*    Re-measured at this head: without the marker `isRetryableTransientError`
+	*    still answers TRUE, via `isThrottlingError`'s CHAIN walk over the
+	*    threaded cause rather than via the message. The marker stays
+	*    load-bearing; only the route changed.
+	*  - **DELETE** — a replay issues a second `DeleteResource`, which is
+	*    idempotent: if the first delete landed, the retry meets the
+	*    already-gone signal `delete()` absorbs. Retrying is strictly better
+	*    than surfacing a failure over a resource that may be gone.
+	*  - **UPDATE** — a replay re-derives and re-sends the same patch, the
+	*    behavior every other UPDATE failure already gets.
+	*/
+	async abandonWait(requestToken, logicalId, operation, resourceType, lastSeenIdentifier, reason, cause) {
+		const described = describePollFailure(cause);
+		const safeDisplay = displaySafe(described.display);
+		const causeText = safeDisplay === "" ? "" : `: ${safeDisplay}`;
+		if (described.detail !== "") this.logger.debug(`${operation} ${logicalId}: the abandoned operation's underlying failure was: ${displaySafe(described.detail)}`);
+		const identifierClause = lastSeenIdentifier === void 0 ? "" : ` The last status cdkd read named the resource ${displaySafe(lastSeenIdentifier, { asciiOnly: true })}.`;
+		const error = new CloudControlWaitAbandonedError(`${operation} of ${logicalId} was accepted by Cloud Control API, but cdkd stopped waiting for it (${reason}${causeText}). The operation may still be running in AWS, and ${operation === "CREATE" ? "cdkd has NO state record for it, so any resource it creates is untracked by rollback and by cdkd destroy" : operation === "DELETE" ? "the resource may or may not have been removed; its state record is kept so a re-run can finish the delete" : "its state record still holds the PREVIOUS properties, so the record may no longer describe the live resource"}.${identifierClause} Check what it did with:\n  ${await this.buildResumeCommand(requestToken)}`, resourceType, logicalId, requestToken, operation, lastSeenIdentifier, cause instanceof Error ? cause : void 0);
+		if (described.marker) markRedactedCause(error);
+		return operation === "CREATE" ? markNonRetryable(error) : error;
+	}
+	/**
+	* The `aws cloudcontrol get-resource-request-status` line an abandoned wait
+	* hands the user — the only way back to an operation cdkd has no record of.
+	*
+	* SANITIZE-then-QUOTE-then-SUPPRESS, the full convention
+	* `replacement-protection-advice.ts` applies (issue
+	* [#2669](https://github.com/go-to-k/cdkd/issues/2669)) — quoting ALONE is
+	* not it, and the gap is not theoretical here. The region comes from
+	* `config.region()`, i.e. `--region` / `AWS_REGION` / a profile's `region =`
+	* line, so it is USER text: `AWS_REGION=$'us-east-1\nrm -rf x'` is inert once
+	* `shellQuote` wraps it, and still renders a two-line "recovery command" on
+	* the terminal and into `deployments/{runId}.jsonl` — the forgery
+	* `lock-contention-message.ts` says quoting does not cover. So each part is
+	* `displaySafe`d first and DROPPED when sanitizing changed it: the region
+	* flag is simply omitted (absent is already legal — the user supplies their
+	* own), and a changed TOKEN suppresses the whole command, since a command
+	* naming the wrong operation is worse than none.
+	*
+	* The region is best-effort in a second sense: `config.region` is a resolver
+	* that can throw (no credentials, no configured region), and a wait that
+	* already failed must not fail a second time inside its own error message.
+	*/
+	async buildResumeCommand(requestToken) {
+		const safeToken = displaySafe(requestToken, { asciiOnly: true });
+		if (!safeToken || safeToken !== requestToken) return "(cdkd cannot render a safe resume command for this request token — see the Cloud Control console)";
+		let region;
+		try {
+			region = (await this.cloudControlClient.config.region())?.trim();
+		} catch {
+			region = void 0;
+		}
+		const safeRegion = region === void 0 || region === "" || displaySafe(region, { asciiOnly: true }) !== region ? void 0 : region;
+		const regionFlag = safeRegion === void 0 ? "" : ` --region ${shellQuote(safeRegion)}`;
+		return `aws cloudcontrol get-resource-request-status --request-token ${shellQuote(safeToken)}${regionFlag}`;
 	}
 	/**
 	* Parse resource model JSON string.
 	*
-	* On a parse failure this logs the error plus the model's SHAPE — never its
+	* On a parse failure the WARN line logs the error's CLASS plus the model's
+	* SHAPE. The `debug` line beside it DOES carry the raw parser message, echo
+	* included, and naming that carve-out is the point (issue
+	* [#3290](https://github.com/go-to-k/cdkd/issues/3290)): an unqualified
+	* promise that a sibling line falsifies is exactly what that issue was filed
+	* for. What follows is about the WARN line — never its
 	* body (issue #1908, a GHSA-p5qg-v9gv-hc7w residual). The model is an AWS
 	* readback, and a read handler cannot return write-only properties (the #809
 	* premise), so the common secret shapes are absent — but a `{{resolve:...}}`
@@ -30098,8 +31595,9 @@ var CloudControlProvider = class {
 		try {
 			return JSON.parse(resourceModel);
 		} catch (error) {
-			const errorMessage = error instanceof Error ? error.message : String(error);
-			this.logger.warn(`Failed to parse resource model: ${errorMessage}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
+			const described = describeAwsFailure(error);
+			this.logger.warn(`Failed to parse resource model: ${described.redacted ? described.summary : error instanceof Error ? error.name : "Error"}\nModel shape: ${resourceModel.length} chars, ${describeJsonKeys(resourceModel)}`);
+			this.logger.debug(`Resource model parse failure detail: ${displaySafe(described.detail)}`);
 			return {};
 		}
 	}
@@ -40527,6 +42025,7 @@ var DeployEngine = class DeployEngine {
 				lastModified: Date.now()
 			};
 			const currentEtag = currentStateData?.etag;
+			refuseMalformedOutputs(currentState, stackName, this.stackRegion);
 			const migrationPending = currentStateData?.migrationPending ?? false;
 			this.logger.debug(`Loaded current state: ${Object.keys(currentState.resources).length} resources`);
 			if (this.options.onCurrentStateLoaded) await this.options.onCurrentStateLoaded(stackName, currentStateData?.state);
@@ -41758,7 +43257,7 @@ var DeployEngine = class DeployEngine {
 									});
 								} catch (deleteError) {
 									const deleteMsg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-									if (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound")) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
+									if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) this.logger.debug(`Old resource ${logicalId} already gone, proceeding with CREATE`);
 									else throw deleteError;
 								}
 								const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
@@ -41863,7 +43362,7 @@ var DeployEngine = class DeployEngine {
 					}), logicalId, 3, 5e3, deleteProvider);
 				} catch (deleteError) {
 					const msg = deleteError instanceof Error ? deleteError.message : String(deleteError);
-					if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
+					if (!isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && !isWaitAbandonedError(deleteError) && (msg.includes("does not exist") || msg.includes("was not found") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException") || msg.includes("ResourceNotFoundException"))) this.logger.debug(`Resource ${logicalId} already deleted (${msg}), removing from state`);
 					else throw deleteError;
 				}
 				const deleteSkipped = deleteSkipReason(deleteResult);
@@ -42530,5 +44029,5 @@ var DeployEngine = class DeployEngine {
 };
 
 //#endregion
-export { secretBearing as $, BOOTSTRAP_MARKER_PREFIX as $n, getAwsClients as $r, s3BucketRegionalDomainName as $t, extractDeploymentEventError as A, markNonRetryable as Ai, buildForceUnlockCommand as An, resolveAutoAssetStorage as Ar, parameterTypeMayLoseSecretIdentity as At, toCfnInteger as B, importableOutputs as Bn, MIGRATE_TMP_PREFIX as Br, configIntegerRefusal as Bt, buildFinalSnapshotIdentifier as C, isCdkdError as Ci, recordMaskOnlyValue as Cn, AssetManifestLoader as Cr, IntrinsicFunctionResolver as Ct, refusesFinalSnapshot as D, isRetryableTransientError as Di, LockManager as Dn, getDefaultStateBucketName as Dr, getAccountInfo as Dt, isFinalSnapshotError as E, isMarkedNonRetryable as Ei, scrubResourceRecord as En, synthesisStatusMessage as Er, coerceParameterTypedValue as Et, isStatefulRecreateTargetSync as F, CUSTOM_RESOURCE_RESPONSE_PREFIX as Fn, resolveUseCdkBootstrapAssets as Fr, resolveExplicitPhysicalId as Ft, gray as G, AssetPublisher as Gn, PARTITION_TABLE as Gr, requireConfigObject as Gt, formatResourceLine as H, orphansAfterRollback as Hn, uploadCfnTemplate as Hr, readConfigString as Ht, renderStatefulReason as I, DEFAULT_STATE_PREFIX as In, stateBucketExistenceConfirmed as Ir, assertRegionMatch as It, yellow as J, buildAssetRedirectMap as Jn, AssemblyReader as Jr, producerRegionsFromState as Jt, green as K, stringifyValue as Kn, canonicalizeRegion as Kr, requireConfigString as Kt, WARM_THROUGHPUT_MEMBERS as L, exportNamesCarriedFrom as Ln, warnDeprecatedNoPrefixCliFlag as Lr, coerceCfnBoolean as Lt, planOrphanAdoption as M, retryClassificationText as Mi, forceQuitRecoveryClause as Mn, resolveSkipPrefix as Mr, isSettledInstanceState as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, __exportAll as Ni, formatLockExpiry as Nn, resolveStateBucketWithDefault as Nr, WAFv2WebACLProvider as Nt, unsupportedFinalSnapshotError as O, isThrottlingError as Oi, S3StateBackend as On, getLegacyStateBucketName as Or, isImpossibleEmptyStoredAttribute as Ot, isStatefulRecreateTargetForReplace as P, shellQuote as Pn, resolveStateBucketWithDefaultAndSource as Pr, normalizeAwsTagsToCfn as Pt, isExportAliasCollision as Q, AssetModeResolver as Qn, AwsClients as Qr, s3BucketDualStackDomainName as Qt, coerceWarmThroughput as R, hasReadableExportSet as Rn, CFN_TEMPLATE_BODY_LIMIT as Rr, coerceCfnInteger as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, formatError as Si, maskSecretsInText as Sn, stripControlChars as Sr, isTerminationProtectionPropagationError as St, createPreDeleteFinalSnapshot as T, withErrorHandling as Ti, redactSecretsForState as Tn, Synthesizer as Tr, cfnRefValueFromPhysicalId as Tt, bold as U, orphansCarriedFrom as Un, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Ur, replayWarn as Ut, toFiniteNumber as V, isReadableBag as Vn, findLargeInlineResources as Vr, configStringRefusal as Vt, cyan as W, shouldRetainResource as Wn, expectedOwnerParam as Wr, requireConfigArray as Wt, collectPublishedOutputNames as X, loadPublishableAssetManifest as Xn, clearBucketRegionCache as Xr, s3BucketArn as Xt, collectDeclaredOutputNames as Y, createAssetRedirectResolver as Yn, processStackMessages as Yr, withSharedDrainBudget as Yt, exportAliasCollisionScrubWarning as Z, rewriteTemplateAssetReferences as Zn, resolveBucketRegion as Zr, s3BucketDomainName as Zt, isSecretBearingReferenceString as _, ResourceUpdateNotSupportedError as _i, errorCauseChain as _n, partitionSensitiveEnv as _r, slowCcOperationTimeoutMs as _t, DeploymentEventsStore as a, CrossAccountSecretRefusalError as ai, findSilentDropProperties as an, readBootstrapMarkerBody as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, StateError as bi, markSameGenerationBag as bn, runDockerStreaming as br, deleteSkipReason as bt, replayFailedOperations as c, DynamicReferenceRegionAmbiguousError as ci, DagBuilder as cn, buildDenyExternalAccessPolicy as cr, createMaskedRetryLogger as ct, updatePartialReason as d, LocalStartServiceError as di, STATE_SOURCED_CROSS_GENERATION_RULES as dn, describeDockerCapturedOutput as dr, beginCommandInterruptScope as dt, resetAwsClients as ei, s3BucketWebsiteUrl as en, assertAssetBucketRegion as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, LockError as fi, STATE_SOURCED_READBACK_RULES as fn, describeDockerExecFailure as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, ResourceTimeoutError as gi, dynamicReferenceTokens as gn, getDockerCmd as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, ProvisioningError as hi, createSecretMasker as hn, formatDockerLoginError as hr, startInterruptWatch as ht, DeploymentEventsReader as i, ConfigError as ii, findActionableSilentDrops as in, parseBootstrapMarker as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, markRedactedCause as ji, buildLockContentionMessage as jn, resolveCaptureObservedState as jr, refStateLookupFromResource as jt, makeCanonicalizePropertiesFn as k, isTransientServerError as ki, rebuildClientForBucketRegion as kn, resolveApp as kr, isUnboundTemplateParameter as kt, replayRollback as l, IntrinsicResolutionRefusalError as li, TemplateParser as ln, describeAwsFailure as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, PartialFailureError as mi, carriesSecretMask as mn, dockerSpawnEnvWithSensitive as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, AssetError as ni, DiffCalculator as nn, getBootstrapMarkerKey as nr, getCurrentResourceSecrets as nt, planFailedOps as o, DependencyError as oi, describeTypeWithThrottleRetry as on, validateAssetBucketName as or, ProviderRegistry as ot, maskingRetryLogger as p, NestedStackChildDirectDestroyError as pi, TEMPLATE_SOURCED_RULES as pn, describeDockerFailure as pr, interruptWatchListenerCount as pt, red as q, WorkGraph as qn, derivePartitionAndUrlSuffix as qr, classifyReplaySecretRegion as qt, DeployEngine as r, CdkdError as ri, INTRINSIC_KEYS as rn, isCrossRegionRedirect as rr, IAMRoleProvider as rt, planRollback as s, DeployCancelledError as si, withRetry as sn, validateContainerRepoName as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, setAwsClients as ti, applyRoleArnIfSet as tn, ensureAssetStorage as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, LocalInvokeBuildError as ui, STATE_SOURCED_BASELINE_RULES as un, buildDockerImage as ur, maskerOrIdentity as ut, keptWholeReasonText as v, StackHasActiveImportsError as vi, identityKeyFor as vn, redactDockerArgvValues as vr, UNSPECIFIED_SKIP_REASON as vt, ccRoutedFinalSnapshotError as w, normalizeAwsError as wi, recoverMaskedOutput as wn, getDockerImageBySourceHash as wr, carriesDynamicReference as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, SynthesisError as xi, maskSecretsInError as xn, escapeRegExp$1 as xr, disableInstanceApiTermination as xt, mergeNoChangeOutputs as y, StackTerminationProtectionError as yi, isSingleDynamicReferenceToken as yn, runDockerForeground as yr, deleteIndeterminateGuards as yt, isWarmThroughputDecrease as z, importableOutputKeys as zn, CFN_TEMPLATE_URL_LIMIT as zr, configBooleanRefusal as zt };
-//# sourceMappingURL=deploy-engine-BYTwDxet.js.map
+export { secretBearing as $, markNonRetryable as $i, buildLockContentionMessage as $n, resolveCaptureObservedState as $r, malformedExportNamesWarning as $t, extractDeploymentEventError as A, DynamicReferenceRegionAmbiguousError as Ai, DagBuilder as An, buildDenyExternalAccessPolicy as Ar, isImpossibleEmptyStoredAttribute as At, toCfnInteger as B, ResourceUpdateNotSupportedError as Bi, identityKeyFor as Bn, redactDockerArgvValues as Br, coerceCfnBoolean as Bt, buildFinalSnapshotIdentifier as C, setAwsClients as Ci, callerEnvCredentials as Cn, ensureAssetStorage as Cr, isTerminationProtectionPropagationError as Ct, refusesFinalSnapshot as D, CrossAccountSecretRefusalError as Di, findSilentDropProperties as Dn, readBootstrapMarkerBody as Dr, cfnRefValueFromPhysicalId as Dt, isFinalSnapshotError as E, ConfigError as Ei, findActionableSilentDrops as En, parseBootstrapMarker as Er, carriesFetchableDynamicReference as Et, isStatefulRecreateTargetSync as F, MalformedProducerRecordRefusalError as Fi, TEMPLATE_SOURCED_RULES as Fn, describeDockerFailure as Fr, isSettledInstanceState as Ft, gray as G, formatError as Gi, recordMaskOnlyValue as Gn, AssetManifestLoader as Gr, readConfigString as Gt, formatResourceLine as H, StackTerminationProtectionError as Hi, markSameGenerationBag as Hn, runDockerStreaming as Hr, configBooleanRefusal as Ht, renderStatefulReason as I, NestedStackChildDirectDestroyError as Ii, carriesSecretMask as In, dockerSpawnEnvWithSensitive as Ir, WAFv2WebACLProvider as It, yellow as J, withErrorHandling as Ji, scrubResourceRecord as Jn, synthesisStatusMessage as Jr, requireConfigObject as Jt, green as K, isCdkdError as Ki, recoverMaskedOutput as Kn, getDockerImageBySourceHash as Kr, replayWarn as Kt, WARM_THROUGHPUT_MEMBERS as L, PartialFailureError as Li, createSecretMasker as Ln, formatDockerLoginError as Lr, normalizeAwsTagsToCfn as Lt, planOrphanAdoption as M, LocalInvokeBuildError as Mi, STATE_SOURCED_BASELINE_RULES as Mn, buildDockerImage as Mr, isUnboundTemplateParameter as Mt, MULTI_REGION_RECREATE_BLOCKED_TYPES as N, LocalStartServiceError as Ni, STATE_SOURCED_CROSS_GENERATION_RULES as Nn, describeDockerCapturedOutput as Nr, parameterTypeMayLoseSecretIdentity as Nt, unsupportedFinalSnapshotError as O, DependencyError as Oi, describeTypeWithThrottleRetry as On, validateAssetBucketName as Or, coerceParameterTypedValue as Ot, isStatefulRecreateTargetForReplace as P, LockError as Pi, STATE_SOURCED_READBACK_RULES as Pn, describeDockerExecFailure as Pr, refStateLookupFromResource as Pt, isExportAliasCollision as Q, isTransientServerError as Qi, buildForceUnlockCommand as Qn, resolveAutoAssetStorage as Qr, hasReadableResources as Qt, coerceWarmThroughput as R, ProvisioningError as Ri, dynamicReferenceTokens as Rn, getDockerCmd as Rr, resolveExplicitPhysicalId as Rt, PRE_DELETE_SNAPSHOT_TYPES as S, resetAwsClients as Si, applyCallerIdentityCredentials as Sn, assertAssetBucketRegion as Sr, disableInstanceApiTermination as St, createPreDeleteFinalSnapshot as T, CdkdError as Ti, INTRINSIC_KEYS as Tn, isCrossRegionRedirect as Tr, carriesDynamicReference as Tt, bold as U, StateError as Ui, maskSecretsInError as Un, escapeRegExp$1 as Ur, configIntegerRefusal as Ut, toFiniteNumber as V, StackHasActiveImportsError as Vi, isSingleDynamicReferenceToken as Vn, runDockerForeground as Vr, coerceCfnInteger as Vt, cyan as W, SynthesisError as Wi, maskSecretsInText as Wn, stripControlChars as Wr, configStringRefusal as Wt, collectPublishedOutputNames as X, isRetryableTransientError as Xi, S3StateBackend as Xn, getLegacyStateBucketName as Xr, STATE_RESOURCES_MALFORMED as Xt, collectDeclaredOutputNames as Y, isMarkedNonRetryable as Yi, LockManager as Yn, getDefaultStateBucketName as Yr, requireConfigString as Yt, exportAliasCollisionScrubWarning as Z, isThrottlingError as Zi, rebuildClientForBucketRegion as Zn, resolveApp as Zr, hasReadableOutputs as Zt, isSecretBearingReferenceString as _, processStackMessages as _i, s3BucketDomainName as _n, createAssetRedirectResolver as _r, isWaitAbandonedError as _t, DeploymentEventsStore as a, warnDeprecatedNoPrefixCliFlag as ai, malformedResourcesWarning as an, exportNamesCarriedFrom as ar, clearOnUpdateRemoval as at, bindingSkippedOutputs as b, AwsClients as bi, s3BucketWebsiteUrl as bn, AssetModeResolver as br, deleteIndeterminateGuards as bt, replayFailedOperations as c, MIGRATE_TMP_PREFIX as ci, refuseMalformedOutputs as cn, importableOutputs as cr, createMaskedRetryLogger as ct, updatePartialReason as d, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as di, repairMalformedOutputsForReadOnly as dn, orphansCarriedFrom as dr, beginCommandInterruptScope as dt, markRedactedCause as ea, resolveSkipPrefix as ei, malformedExportSourceWarning as en, forceQuitRecoveryClause as er, secretBearingStateKeyWarning as et, withResourceDeadline as f, expectedOwnerParam as fi, repairMalformedResourcesForReadOnly as fn, shouldRetainResource as fr, endCommandInterruptScope as ft, bagHoldsSecretExpression as g, AssemblyReader as gi, s3BucketArn as gn, buildAssetRedirectMap as gr, CloudControlProvider as gt, computeImplicitDeleteEdges as h, derivePartitionAndUrlSuffix as hi, withSharedDrainBudget as hn, WorkGraph as hr, startInterruptWatch as ht, DeploymentEventsReader as i, stateBucketExistenceConfirmed as ii, malformedRenderedContainersWarning as in, DEFAULT_STATE_PREFIX as ir, collectInlinePolicyNamesManagedBySiblings as it, makeSiblingClaimReader as j, IntrinsicResolutionRefusalError as ji, TemplateParser as jn, describeAwsFailure as jr, isNamelessDynamicReferenceError as jt, makeCanonicalizePropertiesFn as k, DeployCancelledError as ki, withRetry as kn, validateContainerRepoName as kr, getAccountInfo as kt, replayRollback as l, findLargeInlineResources as li, refuseMalformedOutputsForDestroy as ln, isReadableBag as lr, maskDeep as lt, IMPLICIT_DELETE_DEPENDENCIES as m, canonicalizeRegion as mi, producerRegionsFromState as mn, stringifyValue as mr, isInterruptedWaitError as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, __exportAll as na, resolveStateBucketWithDefaultAndSource as ni, malformedOutputsRefusalMessage as nn, shellQuote as nr, getCurrentResourceSecrets as nt, planFailedOps as o, CFN_TEMPLATE_BODY_LIMIT as oi, malformedStateRefusalMessage as on, hasReadableExportSet as or, ProviderRegistry as ot, maskingRetryLogger as p, PARTITION_TABLE as pi, classifyReplaySecretRegion as pn, AssetPublisher as pr, interruptWatchListenerCount as pt, red as q, normalizeAwsError as qi, redactSecretsForState as qn, Synthesizer as qr, requireConfigArray as qt, DeployEngine as r, resolveUseCdkBootstrapAssets as ri, malformedOutputsWarning as rn, CUSTOM_RESOURCE_RESPONSE_PREFIX as rr, IAMRoleProvider as rt, planRollback as s, CFN_TEMPLATE_URL_LIMIT as si, refuseMalformedNestedChildOutputs as sn, importableOutputKeys as sr, wouldReturnToSdkProvider as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, retryClassificationText as ta, resolveStateBucketWithDefault as ti, malformedLocalOutputsWarning as tn, formatLockExpiry as tr, secretSafeKeyDisplay as tt, updatePartialMessage as u, uploadCfnTemplate as ui, refuseMalformedState as un, orphansAfterRollback as ur, maskerOrIdentity as ut, keptWholeReasonText as v, clearBucketRegionCache as vi, s3BucketDualStackDomainName as vn, loadPublishableAssetManifest as vr, slowCcOperationTimeoutMs as vt, ccRoutedFinalSnapshotError as w, AssetError as wi, DiffCalculator as wn, getBootstrapMarkerKey as wr, IntrinsicFunctionResolver as wt, ATOMIC_FINAL_SNAPSHOT_TYPES as x, getAwsClients as xi, applyRoleArnIfSet as xn, BOOTSTRAP_MARKER_PREFIX as xr, deleteSkipReason as xt, mergeNoChangeOutputs as y, resolveBucketRegion as yi, s3BucketRegionalDomainName as yn, rewriteTemplateAssetReferences as yr, UNSPECIFIED_SKIP_REASON as yt, isWarmThroughputDecrease as z, ResourceTimeoutError as zi, errorCauseChain as zn, partitionSensitiveEnv as zr, assertRegionMatch as zt };
+//# sourceMappingURL=deploy-engine-DuiVEV9B.js.map