@go-to-k/cdkd 0.290.23 → 0.290.25

package/dist/{program-BgbPkrcx.js → program-babtsurS.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as scrubResourceRecord, $r as Synthesizer, $t as s3BucketArn, A as extractDeploymentEventError, Ai as setAwsClients, An as repairMalformedResourcesForReadOnly, Ar as isCrossRegionRedirect, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalStartServiceError, Bn as TEMPLATE_SOURCED_RULES, Br as describeDockerExecFailure, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as AssemblyReader, Cn as refuseMalformedOutputs, Cr as loadPublishableAssetManifest, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as AwsClients, Dn as refuseMalformedState, Dr as assertAssetBucketRegion, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as resolveBucketRegion, En as refuseMalformedResourcesForDestroy, Er as BOOTSTRAP_MARKER_PREFIX, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as DagBuilder, Fr as buildDenyExternalAccessPolicy, Ft as isSettledInstanceState, G as gray, Gi as ProvisioningError, Gn as identityKeyFor, Gr as partitionSensitiveEnv, Gt as readConfigString, H as formatResourceLine, Hi as MalformedProducerRecordRefusalError, Hn as createSecretMasker, Hr as dockerSpawnEnvWithSensitive, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as DeployCancelledError, In as TemplateParser, Ir as describeAwsFailure, It as WAFv2WebACLProvider, J as yellow, Ji as StackHasActiveImportsError, Jn as maskSecretsInError, Jr as runDockerStreaming, Jt as requireConfigObject, K as green, Ki as ResourceTimeoutError, Kn as isSingleDynamicReferenceToken, Kr as redactDockerArgvValues, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DynamicReferenceRegionAmbiguousError, Ln as STATE_SOURCED_BASELINE_RULES, Lr as safeStringify, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as CdkdError, Mn as findSilentDropProperties, Mr as readBootstrapMarkerBody, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as describeTypeWithThrottleRetry, Nr as validateAssetBucketName, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as getAwsClients, On as repairMalformedOutputsForReadOnly, Or as ensureAssetStorage, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CrossAccountSecretRefusalError, Pn as withRetry, Pr as validateContainerRepoName, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as redactSecretsForState, Qr as getDockerImageBySourceHash, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as IntrinsicResolutionRefusalError, Rn as STATE_SOURCED_CROSS_GENERATION_RULES, Rr as buildDockerImage, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as derivePartitionAndUrlSuffix, Sn as refuseMalformedNestedChildOutputs, Sr as createAssetRedirectResolver, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Tn as refuseMalformedResourcePropertiesForOrphan, Tr as AssetModeResolver, Tt as carriesDynamicReference, U as bold, Ui as NestedStackChildDirectDestroyError, Un as dynamicReferenceTokens, Ur as formatDockerLoginError, Ut as configIntegerRefusal, V as toFiniteNumber, Vn as carriesSecretMask, Vr as describeDockerFailure, Vt as coerceCfnInteger, W as cyan, Wi as PartialFailureError, Wn as errorCauseChain, Wr as getDockerCmd, Wt as configStringRefusal, X as collectPublishedOutputNames, Xn as recordMaskOnlyValue, Xr as stripControlChars, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackTerminationProtectionError, Yn as maskSecretsInText, Yr as escapeRegExp, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as recoverMaskedOutput, Zr as AssetManifestLoader, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _n as malformedRenderedContainersWarning, _r as shouldRetainResource, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isTransientServerError, ai as resolveCaptureObservedState, an as applyCallerIdentityCredentials, ar as forceQuitRecoveryClause, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as PARTITION_TABLE, bn as malformedStateRefusalMessage, br as WorkGraph, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as retryClassificationText, ci as resolveStateBucketWithDefaultAndSource, cn as INTRINSIC_KEYS, cr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ct as createMaskedRetryLogger, d as updatePartialReason, di as warnDeprecatedNoPrefixCliFlag, dn as hasReadableResources, dr as hasReadableExportSet, dt as beginCommandInterruptScope, ea as normalizeAwsError, ei as synthesisStatusMessage, en as s3BucketDomainName, er as LockManager, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as CFN_TEMPLATE_BODY_LIMIT, fn as malformedExportNamesWarning, fr as importableOutputKeys, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as uploadCfnTemplate, gn as malformedOutputsWarning, gr as orphansCarriedFrom, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as findLargeInlineResources, hn as malformedOutputsRefusalMessage, hr as orphansAfterRollback, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isThrottlingError, ii as resolveAutoAssetStorage, in as applyRoleArnIfSet, ir as buildLockContentionMessage, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as findActionableSilentDrops, jr as parseBootstrapMarker, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as resetAwsClients, kn as repairMalformedResourcePropertiesForReadOnly, kr as getBootstrapMarkerKey, kt as getAccountInfo, l as replayRollback, li as resolveUseCdkBootstrapAssets, ln as STATE_RESOURCES_MALFORMED, lr as DEFAULT_STATE_PREFIX, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as MIGRATE_TMP_PREFIX, mn as malformedLocalOutputsWarning, mr as isReadableBag, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as isMarkedNonRetryable, ni as getLegacyStateBucketName, nn as s3BucketRegionalDomainName, nr as rebuildClientForBucketRegion, nt as getCurrentResourceSecrets, o as planFailedOps, oa as markNonRetryable, oi as resolveSkipPrefix, on as callerEnvCredentials, or as formatLockExpiry, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_URL_LIMIT, pn as malformedExportSourceWarning, pr as importableOutputs, pt as interruptWatchListenerCount, q as red, qi as ResourceUpdateNotSupportedError, qn as markSameGenerationBag, qr as runDockerForeground, qt as requireConfigArray, r as DeployEngine, ra as isRetryableTransientError, ri as resolveApp, rn as s3BucketWebsiteUrl, rr as buildForceUnlockCommand, rt as IAMRoleProvider, s as planRollback, sa as markRedactedCause, si as resolveStateBucketWithDefault, sn as DiffCalculator, sr as shellQuote, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as withErrorHandling, ti as getDefaultStateBucketName, tn as s3BucketDualStackDomainName, tr as S3StateBackend, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as stateBucketExistenceConfirmed, un as hasReadableOutputs, ur as exportNamesCarriedFrom, ut as maskerOrIdentity, v as keptWholeReasonText, vi as decodeListingKey, vn as malformedResourcePropertiesWarning, vr as AssetPublisher, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as processStackMessages, wn as refuseMalformedOutputsForDestroy, wr as rewriteTemplateAssetReferences, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as canonicalizeRegion, xn as producerRecordKey, xr as buildAssetRedirectMap, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as expectedOwnerParam, yn as malformedResourcesWarning, yr as stringifyValue, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as LocalInvokeBuildError$1, zn as STATE_SOURCED_READBACK_RULES, zr as describeDockerCapturedOutput, zt as assertRegionMatch } from "./deploy-engine-CBzq85r6.js";
+import { $ as secretBearing, $i as normalizeAwsError, $n as redactSecretsForState, $r as synthesisStatusMessage, $t as s3BucketArn, A as extractDeploymentEventError, An as repairMalformedResourcePropertiesForReadOnly, Ar as getBootstrapMarkerKey, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bn as STATE_SOURCED_READBACK_RULES, Br as describeDockerFailure, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as processStackMessages, Cn as refuseMalformedNestedChildOutputs, Cr as createAssetRedirectResolver, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as getAwsClients, Dn as refuseMalformedResourcesForDestroy, Dr as BOOTSTRAP_MARKER_PREFIX, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as AwsClients, En as refuseMalformedResourcePropertiesForOrphan, Er as AssetModeResolver, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fi as DeployCancelledError, Fn as withRetry, Fr as validateContainerRepoName, Ft as isSettledInstanceState, G as gray, Gi as ResourceTimeoutError, Gn as errorCauseChain, Gr as redactDockerArgvValues, Gt as readConfigString, H as formatResourceLine, Hi as NestedStackChildDirectDestroyError, Hn as carriesSecretMask, Hr as formatDockerLoginError, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as DynamicReferenceRegionAmbiguousError, In as DagBuilder, Ir as buildDenyExternalAccessPolicy, It as WAFv2WebACLProvider, J as yellow, Ji as StackTerminationProtectionError, Jn as markSameGenerationBag, Jr as escapeRegExp, Jt as requireConfigObject, K as green, Ki as ResourceUpdateNotSupportedError, Kn as identityKeyFor, Kr as runDockerForeground, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as IntrinsicResolutionRefusalError, Ln as TemplateParser, Lr as buildDockerImage, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mn as findActionableSilentDrops, Mr as parseBootstrapMarker, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ni as CrossAccountSecretRefusalError, Nn as findSilentDropProperties, Nr as readBootstrapMarkerBody, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as resetAwsClients, On as refuseMalformedState, Or as assertAssetBucketRegion, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pn as describeTypeWithThrottleRetry, Pr as validateAssetBucketName, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as recoverMaskedOutput, Qr as Synthesizer, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as LocalInvokeBuildError$1, Rn as STATE_SOURCED_BASELINE_RULES, Rr as describeDockerCapturedOutput, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as AssemblyReader, Sn as refuseDivergentRecordRegionForDestroy, Sr as buildAssetRedirectMap, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as resolveBucketRegion, Tn as refuseMalformedOutputsForDestroy, Tr as rewriteTemplateAssetReferences, Tt as carriesDynamicReference, U as bold, Ui as PartialFailureError, Un as createSecretMasker, Ur as getDockerCmd, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as MalformedProducerRecordRefusalError, Vn as TEMPLATE_SOURCED_RULES, Vr as dockerSpawnEnvWithSensitive, Vt as coerceCfnInteger, W as cyan, Wi as ProvisioningError, Wn as dynamicReferenceTokens, Wr as partitionSensitiveEnv, Wt as configStringRefusal, X as collectPublishedOutputNames, Xn as maskSecretsInText, Xr as AssetManifestLoader, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yn as maskSecretsInError, Yr as stripControlChars, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as recordMaskOnlyValue, Zr as getDockerImageBySourceHash, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as decodeListingKey, _n as malformedRenderedContainersWarning, _r as orphansCarriedFrom, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as markNonRetryable, ai as resolveSkipPrefix, an as applyCallerIdentityCredentials, ar as buildLockContentionMessage, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as canonicalizeRegion, bn as malformedStateRefusalMessage, br as stringifyValue, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as describeAwsFailure, ci as resolveUseCdkBootstrapAssets, cn as INTRINSIC_KEYS, cr as shellQuote, ct as createMaskedRetryLogger, d as updatePartialReason, di as CFN_TEMPLATE_BODY_LIMIT, dn as hasReadableResources, dr as exportNamesCarriedFrom, dt as beginCommandInterruptScope, ea as withErrorHandling, ei as getDefaultStateBucketName, en as s3BucketDomainName, er as scrubResourceRecord, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as CFN_TEMPLATE_URL_LIMIT, fn as malformedExportNamesWarning, fr as hasReadableExportSet, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, gn as malformedOutputsWarning, gr as orphansAfterRollback, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as uploadCfnTemplate, hn as malformedOutputsRefusalMessage, hr as isReadableBag, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isTransientServerError, ii as resolveCaptureObservedState, in as applyRoleArnIfSet, ir as buildForceUnlockCommand, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as CdkdError, jn as repairMalformedResourcesForReadOnly, jr as isCrossRegionRedirect, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as setAwsClients, kn as repairMalformedOutputsForReadOnly, kr as ensureAssetStorage, kt as getAccountInfo, l as replayRollback, la as safeStringify, li as stateBucketExistenceConfirmed, ln as STATE_RESOURCES_MALFORMED, lr as CUSTOM_RESOURCE_RESPONSE_PREFIX, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as findLargeInlineResources, mn as malformedLocalOutputsWarning, mr as importableOutputs, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as isRetryableTransientError, ni as resolveApp, nn as s3BucketRegionalDomainName, nr as S3StateBackend, nt as getCurrentResourceSecrets, o as planFailedOps, oa as markRedactedCause, oi as resolveStateBucketWithDefault, on as callerEnvCredentials, or as forceQuitRecoveryClause, ot as ProviderRegistry, p as maskingRetryLogger, pi as MIGRATE_TMP_PREFIX, pn as malformedExportSourceWarning, pr as importableOutputKeys, pt as interruptWatchListenerCount, q as red, qi as StackHasActiveImportsError, qn as isSingleDynamicReferenceToken, qr as runDockerStreaming, qt as requireConfigArray, r as DeployEngine, ra as isThrottlingError, ri as resolveAutoAssetStorage, rn as s3BucketWebsiteUrl, rr as rebuildClientForBucketRegion, rt as IAMRoleProvider, s as planRollback, sa as retryClassificationText, si as resolveStateBucketWithDefaultAndSource, sn as DiffCalculator, sr as formatLockExpiry, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as isMarkedNonRetryable, ti as getLegacyStateBucketName, tn as s3BucketDualStackDomainName, tr as LockManager, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as warnDeprecatedNoPrefixCliFlag, un as hasReadableOutputs, ur as DEFAULT_STATE_PREFIX, ut as maskerOrIdentity, v as keptWholeReasonText, vi as expectedOwnerParam, vn as malformedResourcePropertiesWarning, vr as shouldRetainResource, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wn as refuseMalformedOutputs, wr as loadPublishableAssetManifest, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as derivePartitionAndUrlSuffix, xn as producerRecordKey, xr as WorkGraph, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as PARTITION_TABLE, yn as malformedResourcesWarning, yr as AssetPublisher, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as LocalStartServiceError, zn as STATE_SOURCED_CROSS_GENERATION_RULES, zr as describeDockerExecFailure, zt as assertRegionMatch } from "./deploy-engine-DtFiFMxh.js";
 import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-CkHVgzLx.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-DxUVmvM5.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BOYln2Tw.js";
+import { t as getCdkdVersion } from "./version-CduXA6UL.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-DL62n7uG.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3132,7 +3132,11 @@ async function probeStatefulRecreateTargetsAsync(targets, clients, logger = getL
 			} catch (e) {
 				if (e instanceof ResourceNotFoundException$5) {
 					let regionVerified = true;
-					const recordedRegion = foldRegion(clients.expectedRegion);
+					if (clients.expectedRegionDiverged) {
+						regionVerified = false;
+						logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: CloudWatch Logs reported ${target.logicalId} (log group ${target.physicalId}) missing, but this stack's state record names a region that is not the one its S3 key holds, so cdkd cannot attribute that not-found to any region — run 'cdkd state show' with --verbose to see what the record claims, and repair it. Re-run with --force-stateful-recreation if the log group really is disposable (that flag clears the data guard for every target in the run). Until then it is treated as NOT provably empty.`);
+					}
+					const recordedRegion = clients.expectedRegionDiverged ? void 0 : foldRegion(clients.expectedRegion);
 					if (recordedRegion) {
 						let clientRegion;
 						try {
@@ -12974,6 +12978,88 @@ function mapDeliveryStatusLogging(attrs, stateCaseMap = /* @__PURE__ */ new Map(
 	return result;
 }
 
+//#endregion
+//#region src/provisioning/attribute-map.ts
+/**
+* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
+* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
+* shape `docs/provider-development.md` forbids under "Never store an
+* empty-string placeholder"):
+*
+*   an attribute cdkd could not read back is ABSENT from the map — never
+*   recorded as the empty string, and never as a present-but-`undefined` key.
+*
+* The consumers of `ResourceState.attributes` all key off exactly that
+* distinction, and a sentinel puts every one of them on the wrong branch:
+*
+*  - the deploy engine persists the map as-is, so `''` becomes the recorded
+*    value of a field AWS never assigned;
+*  - the intrinsic resolver serves a stored attribute whenever it is not
+*    `undefined`, so `''` shadows `constructAttribute` forever — the
+*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
+*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
+*    only on a MISS;
+*  - the Outputs export pass publishes whatever the resolver returned, so a
+*    stored `''` is exported to every `Fn::ImportValue` consumer.
+*
+* It exists as a MODULE rather than a per-provider idiom because the rule was
+* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
+* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
+* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
+* that DROPS the key is the one form a provider cannot spell wrong by habit.
+*
+* Two values are treated as "not read back":
+*
+*  - `undefined`: the SDK's spelling of an unassigned optional member.
+*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
+*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
+*    like `''` does.
+*
+* Every other value is kept verbatim — INCLUDING an empty string AWS itself
+* reported (`false`, `0`, an empty array and an object likewise). The helper
+* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
+* off the wire is a known value with a meaning the provider owns. The EC2
+* Instance provider is where that distinction is load-bearing: a `running`
+* instance with no public address is described with `PublicDnsName: ''` and
+* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
+* empty, recorded as such so a reference does not degrade to the instance id
+* on every resolution — while the same `''` on a `pending` instance means
+* "not yet", which that provider maps to `undefined` BEFORE calling this
+* helper (its `describedInstanceAttributes`). A caller that knows a `''`
+* means "unknown" is the one that must say so; this helper cannot tell.
+*
+* Deliberately NOT a general "compact this record" utility: it is scoped to
+* attribute maps. A property bag keeps its `undefined`-valued keys out by other
+* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
+* than setting it to `undefined`").
+*
+* A LEAF module (imports nothing) so every provider can take it without adding
+* an edge to the provider import ring.
+*/
+/**
+* Build an attribute map from read-back values, omitting every key whose value
+* is `undefined` or `null`.
+*/
+function definedAttributes(entries) {
+	const out = {};
+	for (const [key, value] of Object.entries(entries)) {
+		if (value === void 0 || value === null) continue;
+		out[key] = value;
+	}
+	return out;
+}
+/**
+* `String(value)` for a numeric read-back whose CloudFormation attribute is a
+* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
+* `definedAttributes` drops the key instead of recording the literal
+* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
+* `?? ''` is merely deleted.
+*/
+function stringifyIfAssigned(value) {
+	if (value === void 0 || value === null) return void 0;
+	return String(value);
+}
+
 //#endregion
 //#region src/provisioning/providers/sns-subscription-provider.ts
 /**
@@ -13046,17 +13132,18 @@ var SNSSubscriptionProvider = class {
 			if (replayPolicy !== void 0) attributes["ReplayPolicy"] = typeof replayPolicy === "string" ? replayPolicy : JSON.stringify(replayPolicy);
 			const subscriptionRoleArn = properties["SubscriptionRoleArn"];
 			if (subscriptionRoleArn !== void 0) attributes["SubscriptionRoleArn"] = stringifyValue(subscriptionRoleArn);
-			const subscriptionArn = (await this.snsClient.send(new SubscribeCommand({
+			const response = await this.snsClient.send(new SubscribeCommand({
 				TopicArn: topicArn,
 				Protocol: protocol,
 				Endpoint: endpoint,
 				ReturnSubscriptionArn: true,
 				...Object.keys(attributes).length > 0 && { Attributes: attributes }
-			}))).SubscriptionArn || `${topicArn}:${logicalId}`;
+			}));
+			const subscriptionArn = response.SubscriptionArn || `${topicArn}:${logicalId}`;
 			this.logger.debug(`Successfully created SNS subscription ${logicalId}: ${subscriptionArn}`);
 			return {
 				physicalId: subscriptionArn,
-				attributes: {}
+				attributes: definedAttributes({ Arn: response.SubscriptionArn?.startsWith("arn:") ? response.SubscriptionArn : void 0 })
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -17748,6 +17835,20 @@ function hasUsableDeclaredCapacity(entry) {
 */
 const PROVISIONED_CAPACITY_MEMBERS = ["ReadCapacityUnits", "WriteCapacityUnits"];
 /**
+* The two `OnDemandThroughput` members, named once for the same reason
+* {@link PROVISIONED_CAPACITY_MEMBERS} is (issue
+* [#3265](https://github.com/go-to-k/cdkd/issues/3265)). CloudFormation's
+* `OnDemandThroughput` block carries the same two members at the TABLE level
+* and inside every `GlobalSecondaryIndexes[]` entry, and all FOUR send sites
+* read them through
+* {@link DynamoDBTableProvider.coerceOnDemandCeilingsForSend}.
+*
+* Both are `Long` in the SDK model and BOTH ARE OPTIONAL — the property that
+* makes this block's drop decision differ from its `ProvisionedThroughput`
+* sibling's. See {@link DynamoDBTableProvider.warnUnusableOnDemandCeiling}.
+*/
+const ON_DEMAND_CEILING_MEMBERS = ["MaxReadRequestUnits", "MaxWriteRequestUnits"];
+/**
 * The capacity both TABLE-level forwarders substitute for a member the
 * template does not declare at all — `create()`'s `CreateTable` and the
 * BillingMode flip's `UpdateTable`. It is the pre-issue-#3147 `?? 5`, kept
@@ -18207,14 +18308,20 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 *    in PR review round 6; the carve-out is gone because the divergence is.
 *  - `ProvisionedThroughput` / `OnDemandThroughput` keep TRUTHINESS, which is
 *    still what their write path does: `applyGsiUpdates` gates on
-*    `gsi.ProvisionedThroughput` alone, `OnDemandThroughput` is forwarded
-*    verbatim on every path, and the `ProvisionedThroughput` coercion issue
-*    [#3255](https://github.com/go-to-k/cdkd/issues/3255) added to ALL FOUR
+*    `gsi.ProvisionedThroughput` / `gsi.OnDemandThroughput` alone, and NEITHER
+*    block's Integer coercion — `ProvisionedThroughput`'s from issue
+*    [#3255](https://github.com/go-to-k/cdkd/issues/3255), across ALL FOUR
 *    per-index send sites (`create()`'s mapper plus `applyGsiUpdates`'
-*    adopted-repair, `Create` and same-name `Update` actions) never
-*    SUPPRESSES the block — it rewrites members inside a block that is sent
-*    either way, so "would cdkd send this block" is unchanged by it, even
-*    where both members were dropped and an empty block goes out. Widening
+*    adopted-repair, `Create` and same-name `Update` actions);
+*    `OnDemandThroughput`'s from issue
+*    [#3265](https://github.com/go-to-k/cdkd/issues/3265), across its own four
+*    (the two TABLE-level forwards plus `create()`'s mapper and
+*    `applyGsiUpdates`' `Create` action) — ever SUPPRESSES the block: each
+*    rewrites members inside a block that is sent either way, so "would cdkd
+*    send this block" is unchanged by them, even where both members were
+*    dropped and an empty block goes out. That is the reason
+*    {@link DynamoDBTableProvider.coerceOnDemandCeilingsForSend} drops a
+*    MEMBER and never the block. Widening
 *    `isSendableWarmThroughput` over them would be wrong twice over — it reads
 *    members those blocks do not have (`ReadUnitsPerSecond` vs
 *    `ReadCapacityUnits`), so every declared capacity would read as undeclared.
@@ -18412,7 +18519,7 @@ var DynamoDBTableProvider = class {
 					WriteCapacityUnits: tableCapacityForSend(pt, "WriteCapacityUnits", onUnusable)
 				};
 			}
-			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = properties["OnDemandThroughput"];
+			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets);
 			const createWarmThroughput = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
 			if (createWarmThroughput) createParams.WarmThroughput = createWarmThroughput;
 			else this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
@@ -18581,7 +18688,7 @@ var DynamoDBTableProvider = class {
 				if (properties["OnDemandThroughput"]) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
-						OnDemandThroughput: properties["OnDemandThroughput"]
+						OnDemandThroughput: this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets)
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
 					this.logger.debug(`Updated OnDemandThroughput on DynamoDB table ${physicalId}`);
@@ -19251,7 +19358,7 @@ var DynamoDBTableProvider = class {
 				KeySchema: gsi.KeySchema,
 				Projection: gsi.Projection,
 				...gsi.ProvisionedThroughput ? { ProvisionedThroughput: this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets) } : {},
-				...gsi.OnDemandThroughput ? { OnDemandThroughput: gsi.OnDemandThroughput } : {},
+				...gsi.OnDemandThroughput ? { OnDemandThroughput: this.coerceOnDemandCeilingsForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.OnDemandThroughput, maskSecrets) } : {},
 				...createWarm ? { WarmThroughput: createWarm } : {}
 			} });
 		} else {
@@ -19360,16 +19467,20 @@ var DynamoDBTableProvider = class {
 		return this.coerceIndexCapacityBlock(scope, declared, maskSecrets) ?? declared;
 	}
 	/**
-	* One `CreateTable` index entry with BOTH of its throughput blocks coerced —
-	* `WarmThroughput` (PR review round 6) and `ProvisionedThroughput` (issue
-	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)).
+	* One `CreateTable` index entry with ALL THREE of its throughput blocks
+	* coerced — `WarmThroughput` (PR review round 6), `ProvisionedThroughput`
+	* (issue [#3255](https://github.com/go-to-k/cdkd/issues/3255)) and
+	* `OnDemandThroughput` (issue
+	* [#3265](https://github.com/go-to-k/cdkd/issues/3265)).
 	*
 	* `create()` forwards the declared `GlobalSecondaryIndexes` array to
 	* `CreateTable`, so it is a SEND SITE for the same per-index values the
 	* update path coerces. `WarmThroughput` was the one the round-5 sweep
 	* missed; `ProvisionedThroughput` was missed by round 6 AND by issue #3147's
-	* own enumeration, because this forwarder is a CAST rather than a call, so
-	* neither sweep's grep could see it. The BillingMode flip's per-index reader
+	* own enumeration; `OnDemandThroughput` was missed a THIRD time, by #3265's
+	* own three-site grep — all for one reason, that this forwarder is a CAST
+	* rather than a call, so no sweep's grep could see it. The
+	* BillingMode flip's per-index reader
 	* ({@link readCapacityNumber}) has been on the grammar since #3147, so until
 	* now create and flip disagreed about the same property: a CFn-legal
 	* `ReadCapacityUnits: '7'` reached `CreateTable` as a STRING in a `number`
@@ -19381,18 +19492,20 @@ var DynamoDBTableProvider = class {
 	* and a provider that edits it in place would change what state reports cdkd
 	* sent.
 	*
-	* An entry that is not a plain object, and one declaring NEITHER throughput
-	* block, is returned UNCHANGED — identity included. An entry that DOES
-	* declare one is rebuilt whenever that block's coercion changes anything;
-	* the `WarmThroughput` half rebuilds even for an already-numeric value,
-	* which is pre-existing behaviour and costs one spread per declared block.
+	* An entry that is not a plain object, and one declaring NONE of the three
+	* throughput blocks, is returned UNCHANGED — identity included. An entry that
+	* DOES declare one is rebuilt whenever that block's coercion changes
+	* anything; the `WarmThroughput` half rebuilds even for an already-numeric
+	* value, which is pre-existing behaviour and costs one spread per declared
+	* block.
 	*/
 	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
 		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
 		const bag = entry;
 		const declaredWarm = bag["WarmThroughput"];
 		const declaredCapacity = bag["ProvisionedThroughput"];
-		if (declaredWarm === void 0 && !isPlainCapacityBlock(declaredCapacity)) return entry;
+		const declaredOnDemand = bag["OnDemandThroughput"];
+		if (declaredWarm === void 0 && !isPlainCapacityBlock(declaredCapacity) && !isPlainCapacityBlock(declaredOnDemand)) return entry;
 		const scope = this.indexScope(entry.IndexName, logicalId, maskSecrets);
 		let out = entry;
 		if (declaredWarm !== void 0) {
@@ -19411,6 +19524,13 @@ var DynamoDBTableProvider = class {
 			...out,
 			ProvisionedThroughput: capacity
 		};
+		if (isPlainCapacityBlock(declaredOnDemand)) {
+			const onDemand = this.coerceOnDemandCeilingsForSend(scope, declaredOnDemand, maskSecrets);
+			if (onDemand !== declaredOnDemand) out = {
+				...out,
+				OnDemandThroughput: onDemand
+			};
+		}
 		return out;
 	}
 	/**
@@ -19452,9 +19572,14 @@ var DynamoDBTableProvider = class {
 	*    the template had declared it, with no later call to correct it. Only
 	*    the TABLE level defaults.
 	*  - **A block that is not a plain object is forwarded VERBATIM**, the
-	*    fail-OPEN direction this file takes everywhere: an unresolved intrinsic
-	*    or a mis-nested template value is AWS's to reject by name, and that is
-	*    also the pre-existing behaviour of this forwarder.
+	*    fail-OPEN direction this file takes everywhere: a STRING, a NUMBER or an
+	*    ARRAY block is AWS's to reject by name, and that is also the pre-existing
+	*    behaviour of this forwarder. An unresolved intrinsic (`{Ref: 'X'}`) is
+	*    NOT an example of it — that IS a plain object, so it takes the member
+	*    loop and survives through the preserve-unknown-member rule below. Same
+	*    destination, different route; corrected by the review of issue
+	*    [#3265](https://github.com/go-to-k/cdkd/issues/3265), which found the
+	*    wrong example here and at {@link coerceOnDemandCeilingsForSend}.
 	*
 	* A member name the grammar does not know is preserved untouched, for the
 	* same fail-open reason — a misspelled `ReadCapacityUnit` reaches AWS and is
@@ -19477,6 +19602,178 @@ var DynamoDBTableProvider = class {
 		return rewritten;
 	}
 	/**
+	* One `OnDemandThroughput` block for the wire, with each DECLARED member read
+	* through CloudFormation's DynamoDB Integer grammar (issue
+	* [#3265](https://github.com/go-to-k/cdkd/issues/3265)).
+	*
+	* Called from ALL FOUR send sites, which is the whole point — the block was
+	* forwarded VERBATIM at every one of them, so a CFn-legal
+	* `MaxReadRequestUnits: '100'` reached AWS as the STRING `"100"` in a `Long`
+	* field and the request failed, while a `' 100 '` / `'0x64'` / `'1e2'`
+	* CloudFormation refuses the template for was forwarded unchanged. The sites:
+	*
+	*  1. `create()`'s TABLE-level `CreateTable.OnDemandThroughput`;
+	*  2. `create()`'s PER-INDEX `CreateTable.GlobalSecondaryIndexes[]` forward,
+	*     through {@link coerceIndexThroughputForCreate} — a CAST of the whole
+	*     entry array rather than a named `OnDemandThroughput` expression, which
+	*     is why issue #3265's own grep enumerated three sites and not four (the
+	*     same blind spot that hid this forwarder from issue #3147's sweep and
+	*     from #3255's round 6, one property over);
+	*  3. `update()`'s TABLE-level `UpdateTable.OnDemandThroughput`;
+	*  4. `applyGsiUpdates`' per-index `Create` action.
+	*
+	* FOUR and not six: `UpdateGlobalSecondaryIndexAction` declares
+	* `OnDemandThroughput` too, and neither the adopted-index repair nor the
+	* same-name `Update` arm ever sets it — so a ceiling EDIT on a live index is
+	* silently discarded today. That is a MISSING SEND rather than a grammar
+	* defect, so it is not routed here; issue
+	* [#3287](https://github.com/go-to-k/cdkd/issues/3287) holds it, and it will
+	* read through this function when it lands.
+	*
+	* THREE decisions, each with a plausible alternative:
+	*
+	*  - **A rejected spelling drops the MEMBER, never the BLOCK.** The same
+	*    DECISION {@link coerceIndexCapacityBlock} and {@link tableCapacityForSend}
+	*    already take one property over, so this file's capacity and ceiling
+	*    families answer identically about one template value; it keeps a sibling
+	*    member the template spelled LEGALLY; and it leaves `indexDeclares`'
+	*    TRUTHINESS gate ("would cdkd SEND this block") true without
+	*    qualification, so the #1767 drift-side predicate needs no new arm. An
+	*    all-rejected block therefore goes out EMPTY, as the capacity sibling's
+	*    does. ("The same decision", NOT the same SIGNATURE — the capacity
+	*    sibling answers `undefined` for "nothing to rewrite" while this one
+	*    returns the declared block by IDENTITY. The review of this issue caught
+	*    an earlier "byte for byte the shape" here, which was false and is the
+	*    kind of claim that invites a caller to swap one for the other.)
+	*  - **What a rejected spelling COSTS differs from the capacity sibling's,
+	*    and it is stated at {@link warnUnusableOnDemandCeiling} rather than
+	*    assumed.** Both `OnDemandThroughput` members are SDK-optional, so
+	*    DynamoDB does not necessarily reject a request that omits one — which is
+	*    why the announcement cannot reuse the capacity wording, which promises
+	*    AWS will name the member. **It is NOT a promise of success either**, and
+	*    an earlier revision made it one: the outcome is per PATH (create leaves
+	*    no maximum, update KEEPS the live one since only `-1` removes it) and an
+	*    ALL-rejected block is documented invalid at every one of the four send
+	*    positions ("you must specify `MaxReadRequestUnits`,
+	*    `MaxWriteRequestUnits`, or both"), so that request should FAIL. cdkd has
+	*    not measured the empty-block send against live DynamoDB; the message
+	*    under-claims accordingly.
+	*  - **A block that is not a plain object is forwarded VERBATIM**, the
+	*    fail-OPEN direction this file takes everywhere: a STRING, a NUMBER or an
+	*    ARRAY `OnDemandThroughput` is AWS's to reject by name, and that is the
+	*    pre-existing behaviour of every one of these forwarders. Note what this
+	*    arm does NOT cover: an unresolved intrinsic (`{Ref: 'X'}`) IS a plain
+	*    object, so it takes the member loop instead and survives through the
+	*    preserve-unknown-member rule below — same destination, different route.
+	*    {@link isPlainCapacityBlock}'s own doc is the authority; the review of
+	*    this issue found that example wrong here and at
+	*    {@link coerceIndexCapacityBlock}.
+	*
+	* A member name the grammar does not know is preserved untouched, for the
+	* same fail-open reason. Returns the DECLARED object by IDENTITY when nothing
+	* needs rewriting, so a numeric template rebuilds nothing and
+	* {@link coerceIndexThroughputForCreate} can tell "unchanged" from "rewritten"
+	* without a structural compare.
+	*
+	* **Known residual, deliberately not closed here.** Wherever the call
+	* SUCCEEDS, state records the spelling the TEMPLATE declared while AWS holds
+	* a different ceiling (none on a create, the previous one on an update) — the
+	* permanent phantom-drift class
+	* `.claude/rules/provider-property-fidelity.md` covers, which
+	* {@link coerceIndexCapacityBlock} escapes only because ITS drop makes AWS
+	* fail. Closing it needs `effectiveProperties` AND its
+	* `canonicalizeDesiredProperties` twin (the rule requires the pair; shipping
+	* the first alone re-issues a no-op `UpdateTable` on every later deploy), and
+	* this provider implements neither today. Tracked as issue
+	* [#3286](https://github.com/go-to-k/cdkd/issues/3286); the warning names the
+	* residual so a user is not left to discover it from a `cdkd drift` line. The
+	* `AWS::DynamoDB::GlobalTable` sibling answers the SAME way for the same
+	* spelling — `collectTableOnDemandCeilings` coerces through
+	* `coerceCfnInteger` and a rejected ceiling is reported and LEFT UNSENT, with
+	* AWS untouched and no substituted value (its 5/5 FALLBACK is its PROVISIONED
+	* capacity answer, not its ceiling one) — so the two types do not diverge.
+	*/
+	coerceOnDemandCeilingsForSend(scope, declared, maskSecrets) {
+		if (!isPlainCapacityBlock(declared)) return declared;
+		const block = declared;
+		let rewritten;
+		for (const member of ON_DEMAND_CEILING_MEMBERS) {
+			if (!(member in block)) continue;
+			const coerced = coerceCfnInteger(block[member]);
+			if (coerced === block[member]) continue;
+			rewritten ??= { ...block };
+			if (coerced === void 0) {
+				this.warnUnusableOnDemandCeiling(scope, member, block[member], maskSecrets);
+				delete rewritten[member];
+			} else rewritten[member] = coerced;
+		}
+		return rewritten ?? block;
+	}
+	/**
+	* Announce an `OnDemandThroughput` member a forwarder DROPPED (issue
+	* [#3265](https://github.com/go-to-k/cdkd/issues/3265)).
+	*
+	* A SEPARATE sentence from {@link warnUnusableProvisionedCapacity}, and the
+	* difference is the load-bearing part rather than a wording preference: that
+	* one can promise "DynamoDB will reject the request naming this member",
+	* because both `ProvisionedThroughput` members are REQUIRED wherever the
+	* block is declared. Both `OnDemandThroughput` members are OPTIONAL, so the
+	* same promise would send the user looking for a failure that may never come.
+	*
+	* What it says instead is PER PATH, because the outcome genuinely differs and
+	* an earlier revision of this message asserted ONE outcome for all of them —
+	* wrongly in both directions (the review of this issue):
+	*
+	*  - on a CREATE the table comes up with no maximum for the dropped half;
+	*  - on an UPDATE DynamoDB KEEPS whatever maximum the table already carries.
+	*    Omitting a member is NOT "no maximum" there — `-1` is AWS's documented
+	*    way to REMOVE one (`OnDemandThroughput`'s own SDK model doc), so a
+	*    dropped member silently leaves the live ceiling in force;
+	*  - when NO member survived, the block {@link coerceOnDemandCeilingsForSend}
+	*    sends is EMPTY. AWS's model says at all four of this provider's send
+	*    positions that "if you use this parameter, you must specify
+	*    `MaxReadRequestUnits`, `MaxWriteRequestUnits`, or both", which reads
+	*    like a LOUD failure — and it is NOT enforced.
+	*
+	*    MEASURED us-east-1 2026-09-17, on the go-to-k/cdkd#3291 review's
+	*    request: `CreateTable` with `OnDemandThroughput: {}` and
+	*    `BillingMode: PAY_PER_REQUEST` is ACCEPTED, the table reaches ACTIVE,
+	*    and `DescribeTable` reports NO `OnDemandThroughput` at all. So the
+	*    all-rejected case is the SILENT one, not the loud one: the deploy goes
+	*    green with no ceiling applied.
+	*
+	*    That matters because it is a REGRESSION IN LOUDNESS introduced by this
+	*    very change. Before it, a `' 100 '` reached AWS as a string in a Long
+	*    field and the request FAILED, certainly. After it, the value is dropped
+	*    and the deploy succeeds. The warning is therefore the ONLY signal a user
+	*    gets for the all-rejected case, which is why it is emitted per member
+	*    and why its text was corrected to say so rather than to promise a
+	*    failure that does not come.
+	*
+	* The caller cannot tell the three cases apart from inside the member loop,
+	* so the message names all three rather than asserting the one it cannot
+	* know.
+	*
+	* And it names the residual: where the request does succeed, state keeps the
+	* spelling the template declared and `cdkd drift` reports it until the
+	* template is corrected. `-1` is called out because a user who meant the
+	* removal must not read "spell it as a decimal integer" as excluding it.
+	*
+	* The CloudFormation clause is HEDGED ("is expected to"), and deliberately.
+	* The live A/B that settled this grammar was run on
+	* `ProvisionedThroughput.ReadCapacityUnits`, not on `MaxReadRequestUnits`.
+	* Both are Integer members of the same type validated at the same properties
+	* layer, so the extrapolation is sound and is what issue #3265 reasons from --
+	* but it IS an extrapolation, and a user-facing string asserting it flatly
+	* about an unmeasured property would be the kind of claim nothing downstream
+	* re-checks. Measure it and the hedge can go. Raised by the
+	* go-to-k/cdkd#3291 spec review.
+	*/
+	warnUnusableOnDemandCeiling(scope, member, raw, maskSecrets) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		warn(`${scope}: OnDemandThroughput.${member} ${JSON.stringify(maskLeafValue$1(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO ceiling was substituted for it. Both OnDemandThroughput members are OPTIONAL to DynamoDB, so — unlike a ProvisionedThroughput member — AWS does not necessarily reject the request, and what happens next depends on the path: a CREATE gets no maximum for this half; an UPDATE KEEPS whatever maximum the table already carries, since only an explicit -1 removes one; and if NEITHER member was usable the block is sent EMPTY, which AWS ACCEPTS (measured us-east-1 2026-09-17) and stores as no maximum at all, so the deploy SUCCEEDS with no ceiling applied. cdkd's state keeps the value the template declared and \`cdkd drift\` reports the difference until the template is corrected; CloudFormation is expected to refuse the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer (\`-1\` removes an existing maximum).`);
+	}
+	/**
 	* Announce a `ProvisionedThroughput` member a forwarder DROPPED (issue
 	* [#3147](https://github.com/go-to-k/cdkd/issues/3147); widened to the
 	* per-index create forwarder by issue
@@ -26468,88 +26765,6 @@ var EventBridgeRuleProvider = class {
 	}
 };
 
-//#endregion
-//#region src/provisioning/attribute-map.ts
-/**
-* The ONE spelling of the attribute-map rule an SDK provider's `create()` /
-* `update()` / `import()` result follows (issue #3077, closing the `?? ''`
-* shape `docs/provider-development.md` forbids under "Never store an
-* empty-string placeholder"):
-*
-*   an attribute cdkd could not read back is ABSENT from the map — never
-*   recorded as the empty string, and never as a present-but-`undefined` key.
-*
-* The consumers of `ResourceState.attributes` all key off exactly that
-* distinction, and a sentinel puts every one of them on the wrong branch:
-*
-*  - the deploy engine persists the map as-is, so `''` becomes the recorded
-*    value of a field AWS never assigned;
-*  - the intrinsic resolver serves a stored attribute whenever it is not
-*    `undefined`, so `''` shadows `constructAttribute` forever — the
-*    `AWS::EC2::Instance` IP / DNS / AZ arm re-describes the instance from
-*    AWS only on a MISS, the `Arn` arms of the RDS family rebuild the ARN
-*    only on a MISS;
-*  - the Outputs export pass publishes whatever the resolver returned, so a
-*    stored `''` is exported to every `Fn::ImportValue` consumer.
-*
-* It exists as a MODULE rather than a per-provider idiom because the rule was
-* prose and 96 attribute-position `?? ''` / `|| ''` / bare `''` sites across
-* 18 providers shipped anyway (measured 2026-09-14 with the TypeScript-compiler
-* walk that is now `tests/unit/provisioning/attribute-map.test.ts`). A helper
-* that DROPS the key is the one form a provider cannot spell wrong by habit.
-*
-* Two values are treated as "not read back":
-*
-*  - `undefined`: the SDK's spelling of an unassigned optional member.
-*  - `null`: no AWS SDK v3 read-back reports a scalar attribute as `null`, and
-*    a stored `null` takes the resolver's "not `undefined`" hit branch exactly
-*    like `''` does.
-*
-* Every other value is kept verbatim — INCLUDING an empty string AWS itself
-* reported (`false`, `0`, an empty array and an object likewise). The helper
-* stops cdkd MANUFACTURING `''` for a field it never read; a `''` that came
-* off the wire is a known value with a meaning the provider owns. The EC2
-* Instance provider is where that distinction is load-bearing: a `running`
-* instance with no public address is described with `PublicDnsName: ''` and
-* no `PublicIpAddress`, and CloudFormation answers `''` for both — a KNOWN
-* empty, recorded as such so a reference does not degrade to the instance id
-* on every resolution — while the same `''` on a `pending` instance means
-* "not yet", which that provider maps to `undefined` BEFORE calling this
-* helper (its `describedInstanceAttributes`). A caller that knows a `''`
-* means "unknown" is the one that must say so; this helper cannot tell.
-*
-* Deliberately NOT a general "compact this record" utility: it is scoped to
-* attribute maps. A property bag keeps its `undefined`-valued keys out by other
-* means (`.claude/rules/provider-property-fidelity.md`, "Remove the key rather
-* than setting it to `undefined`").
-*
-* A LEAF module (imports nothing) so every provider can take it without adding
-* an edge to the provider import ring.
-*/
-/**
-* Build an attribute map from read-back values, omitting every key whose value
-* is `undefined` or `null`.
-*/
-function definedAttributes(entries) {
-	const out = {};
-	for (const [key, value] of Object.entries(entries)) {
-		if (value === void 0 || value === null) continue;
-		out[key] = value;
-	}
-	return out;
-}
-/**
-* `String(value)` for a numeric read-back whose CloudFormation attribute is a
-* string (`Endpoint.Port`), or `undefined` when the field is unassigned — so
-* `definedAttributes` drops the key instead of recording the literal
-* `'undefined'`, which is what `String(described?.Port ?? '')` yields once its
-* `?? ''` is merely deleted.
-*/
-function stringifyIfAssigned(value) {
-	if (value === void 0 || value === null) return void 0;
-	return String(value);
-}
-
 //#endregion
 //#region src/provisioning/providers/eventbridge-bus-provider.ts
 /**
@@ -62205,6 +62420,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const guardIndeterminateTargets = /* @__PURE__ */ new Set();
 	const regionForState = state.region ?? ctx.baseRegion;
 	refuseMalformedResourcesForDestroy(state, stackName, regionForState);
+	refuseDivergentRecordRegionForDestroy(state, stackName, regionForState, ctx.divergentBodyRegion);
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
 	refuseMalformedOutputsForDestroy(state, stackName, regionForState);
@@ -62264,7 +62480,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			try {
 				await ctx.lockManager.releaseLock(stackName, regionForState);
 			} catch (releaseErr) {
-				logger.warn(`Failed to release lock after empty-state cleanup: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+				logger.warn(`Failed to release lock after empty-state cleanup: ${describeAwsFailure(releaseErr).detail}`);
 			} finally {
 				process.removeListener("SIGINT", emptySigintHandler);
 			}
@@ -62323,7 +62539,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		try {
 			switchedClients?.destroy();
 		} catch (destroyError) {
-			logger.debug(`Failed to destroy region-scoped AWS clients: ${destroyError instanceof Error ? destroyError.message : String(destroyError)}`);
+			logger.debug(`Failed to destroy region-scoped AWS clients: ${describeAwsFailure(destroyError).detail}`);
 		}
 	};
 	if (stackRegion && stackRegion !== ctx.baseRegion) {
@@ -62392,7 +62608,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			try {
 				await ctx.lockManager.releaseLock(stackName, regionForState);
 			} catch (releaseErr) {
-				logger.warn(`Failed to release lock after strong-ref refusal/failure: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+				logger.warn(`Failed to release lock after strong-ref refusal/failure: ${describeAwsFailure(releaseErr).detail}`);
 			}
 			restoreBaseRegionAndClients();
 			process.removeListener("SIGINT", sigintHandler);
@@ -62432,7 +62648,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 				await ctx.stateBackend.saveState(stackName, regionForState, buildDestroySnapshot());
 				logger.debug(`State persisted after deleting ${logicalId}`);
 			} catch (error) {
-				logger.warn(`Failed to persist state after deleting ${logicalId} (continuing): ${error instanceof Error ? error.message : String(error)}`);
+				logger.warn(`Failed to persist state after deleting ${logicalId} (continuing): ${describeAwsFailure(error).detail}`);
 			}
 		});
 	};
@@ -62628,7 +62844,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 					persistStateAfterDelete(logicalId);
 				} catch (error) {
 					renderer.removeTask(logicalId);
-					const msg = error instanceof Error ? error.message : String(error);
+					const msg = describeAwsFailure(error).detail;
 					if (!isInterruptedWaitError(error) && !isFinalSnapshotError(error) && !isMarkedNonRetryable(error) && !isWaitAbandonedError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
 						logger.debug(`  ${logicalId} already deleted, removing from state`);
 						result.deletedCount++;
@@ -62660,7 +62876,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 							error: extractDeploymentEventError(wrapped)
 						});
 					} else {
-						logger.error(`  ✗ Failed to delete ${logicalId}:`, String(error));
+						logger.error(`  ✗ Failed to delete ${logicalId}:`, safeStringify(error));
 						result.errorCount++;
 						failedStateTargets.add(stateTargetFor(logicalId, resource.resourceType));
 						ctx.eventRecorder?.record({
@@ -62692,7 +62908,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			try {
 				await ctx.stateBackend.saveState(stackName, regionForState, buildDestroySnapshot());
 			} catch (error) {
-				logger.warn(`Failed to persist remaining state after partial destroy: ${error instanceof Error ? error.message : String(error)}. The state file may still list already-deleted resources; a re-run resolves them idempotently.`);
+				logger.warn(`Failed to persist remaining state after partial destroy: ${describeAwsFailure(error).detail}. The state file may still list already-deleted resources; a re-run resolves them idempotently.`);
 			}
 			if (result.interrupted) logger.warn(`Destroy interrupted — ${Object.keys(remainingResources).length} resource(s) not deleted. State preserved.`);
 			else if (result.errorCount > 0) logger.warn(`${result.errorCount} resource(s) failed to delete. State preserved.`);
@@ -62723,14 +62939,14 @@ async function runDestroyForStack(stackName, state, ctx) {
 			try {
 				renderer.stop();
 			} catch (rendererError) {
-				logger.debug(`Live renderer teardown failed (continuing to release the lock): ${rendererError instanceof Error ? rendererError.message : String(rendererError)}`);
+				logger.debug(`Live renderer teardown failed (continuing to release the lock): ${describeAwsFailure(rendererError).detail}`);
 			}
 			await saveChain;
 			logger.debug("Releasing lock...");
 			try {
 				await ctx.lockManager.releaseLock(stackName, regionForState);
 			} catch (releaseErr) {
-				logger.warn(`Failed to release lock for stack '${stackName}': ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+				logger.warn(`Failed to release lock for stack '${stackName}': ${describeAwsFailure(releaseErr).detail}`);
 			}
 		} finally {
 			process.removeListener("SIGINT", sigintHandler);
@@ -63003,6 +63219,7 @@ var NestedStackProvider = class {
 			providerRegistry: ctx.providerRegistry,
 			baseAwsClients: ctx.awsClients,
 			baseRegion: childRegion,
+			...childStateData.divergentBodyRegion !== void 0 && { divergentBodyRegion: childStateData.divergentBodyRegion },
 			stateBucket: ctx.stateBucket,
 			skipConfirmation: true,
 			...ctx.exportIndexStore && { exportIndexStore: ctx.exportIndexStore },
@@ -64377,7 +64594,8 @@ async function deployCommand(stacks, options) {
 						clients: {
 							s3: stackAwsClients.s3,
 							cloudWatchLogs: stackAwsClients.cloudWatchLogs,
-							expectedRegion: stateForRecreateCheck?.state.region
+							expectedRegion: stateForRecreateCheck?.state.region,
+							...stateForRecreateCheck?.divergentBodyRegion !== void 0 && { expectedRegionDiverged: true }
 						},
 						forceStatefulRecreation: options.forceStatefulRecreation ?? false
 					});
@@ -74362,6 +74580,7 @@ async function destroyCommand(stackArgs, options) {
 					providerRegistry,
 					baseAwsClients: awsClients,
 					baseRegion: region,
+					...stateResult.divergentBodyRegion !== void 0 && { divergentBodyRegion: stateResult.divergentBodyRegion },
 					...options.profile && { profile: options.profile },
 					stateBucket,
 					statePrefix: options.statePrefix,
@@ -76116,10 +76335,10 @@ async function exportCommand(stackArg, options) {
 		}
 		const cfnStackName = options.cfnStackName ?? resolvedStackName;
 		const targetRegion = await pickStackRegion$1(stateBackend, resolvedStackName, synthedRegion, options.stackRegion);
-		logger.info(`Migrating cdkd stack '${resolvedStackName}' (${targetRegion}) → CloudFormation stack '${cfnStackName}'`);
+		logger.info(`Migrating cdkd stack '${resolvedStackName}' (${safeSegment(targetRegion)}) → CloudFormation stack '${cfnStackName}'`);
 		await assertCfnStackAbsent(awsClients.cloudFormation, cfnStackName);
 		const stateData = await stateBackend.getState(resolvedStackName, targetRegion);
-		if (!stateData) throw new Error(`No cdkd state found for stack '${resolvedStackName}' (${targetRegion}). Nothing to migrate.`);
+		if (!stateData) throw new Error(`No cdkd state found for stack '${resolvedStackName}' (${safeSegment(targetRegion)}). Nothing to migrate.`);
 		const { state, etag, migrationPending } = stateData;
 		const exportJournal = await stateBackend.loadRollbackJournal(resolvedStackName, targetRegion);
 		if (exportJournal && exportJournal.segments.length > 0) {
@@ -76236,7 +76455,7 @@ async function exportCommand(stackArg, options) {
 				const phase2Note = phase2Creates.length > 0 ? ` Phase 2 will then CREATE ${phase2Creates.length} non-importable resource(s) (invoking each Custom Resource's onCreate handler).` : "";
 				const recreateNote = recreateBeforePhase2.length > 0 ? ` cdkd will also DELETE ${recreateBeforePhase2.length} AWS resource(s) between phases so CFn can re-CREATE them in phase 2 (brief unavailability window — see plan above for the affected resources).` : "";
 				const unchangedClaim = recreateBeforePhase2.length > 0 ? ` All other AWS resources are unchanged on import.` : ` AWS resources are unchanged on import.`;
-				if (!await confirmPrompt$3(`Create CloudFormation stack '${cfnStackName}' by importing ${phase1Imports.length} resource(s) from cdkd state '${resolvedStackName}' (${targetRegion})?` + phase2Note + recreateNote + unchangedClaim + ` cdkd state for '${resolvedStackName}' will be deleted on success.`)) {
+				if (!await confirmPrompt$3(`Create CloudFormation stack '${cfnStackName}' by importing ${phase1Imports.length} resource(s) from cdkd state '${resolvedStackName}' (${safeSegment(targetRegion)})?` + phase2Note + recreateNote + unchangedClaim + ` cdkd state for '${resolvedStackName}' will be deleted on success.`)) {
 					logger.info("Migration cancelled. cdkd state and CloudFormation are unchanged.");
 					return;
 				}
@@ -76271,7 +76490,7 @@ async function exportCommand(stackArg, options) {
 					logger.info(`  ✓ deleted ${entry.physicalId}`);
 				} catch (err) {
 					const msg = err instanceof Error ? err.message : String(err);
-					throw new Error(`Phase 1 (IMPORT) succeeded; pre-delete of ${entry.logicalId} (${entry.resourceType}, physicalId: ${entry.physicalId}) failed: ${msg}\n\nThe CloudFormation stack '${cfnStackName}' contains the phase-1 imports but the IMPORT-unsupported resources (${recreateBeforePhase2.length} total) still exist in AWS unmanaged. cdkd state is UNCHANGED. Re-running \`cdkd export\` does NOT work — the existing-stack check rejects it. To recover manually:\n  1. Fix the failure cause (typically IAM permissions for the underlying      AWS API — e.g. apigatewayv2:DeleteStage for AWS::ApiGatewayV2::Stage).\n  2. Delete the remaining AWS-side IMPORT-unsupported resources by hand:\n       aws apigatewayv2 delete-stage --api-id <ApiId> --stage-name <StageName>\n     (one per entry in the pre-delete list logged above).\n  3. Run the phase-2 UPDATE manually with the full synth template:\n       aws cloudformation create-change-set --stack-name ${cfnStackName} \\\n         --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\\n         --template-body file://<full-template.json>\n  4. Once phase 2 succeeds, run: cdkd state orphan ${resolvedStackName}\n     to clean up cdkd's stale state record.`);
+					throw new Error(`Phase 1 (IMPORT) succeeded; pre-delete of ${entry.logicalId} (${entry.resourceType}, physicalId: ${entry.physicalId}) failed: ${msg}\n\nThe CloudFormation stack '${cfnStackName}' contains the phase-1 imports but the IMPORT-unsupported resources (${recreateBeforePhase2.length} total) still exist in AWS unmanaged. cdkd state is UNCHANGED. Re-running \`cdkd export\` does NOT work — the existing-stack check rejects it. To recover manually:\n  1. Fix the failure cause (typically IAM permissions for the underlying      AWS API — e.g. apigatewayv2:DeleteStage for AWS::ApiGatewayV2::Stage).\n  2. Delete the remaining AWS-side IMPORT-unsupported resources by hand:\n       aws apigatewayv2 delete-stage --api-id <ApiId> --stage-name <StageName>\n     (one per entry in the pre-delete list logged above).\n  3. Run the phase-2 UPDATE manually with the full synth template:\n       aws cloudformation create-change-set --stack-name ${cfnStackName} \\\n         --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\\n         --template-body file://<full-template.json>\n  4. Once phase 2 succeeds, run: ${orphanCommandFor(resolvedStackName, targetRegion)}\n     to clean up cdkd's stale state record.`);
 				}
 			}
 			const phase2Count = phase2Creates.length + recreateBeforePhase2.length;
@@ -76290,10 +76509,10 @@ async function exportCommand(stackArg, options) {
 				const recreateNote = recreateBeforePhase2.length > 0 ? `  - cdkd deleted ${recreateBeforePhase2.length} AWS resource(s) before phase 2 (Stage etc.). They are gone in AWS but absent from the CFn stack. Running phase 2 UPDATE manually will CFn-CREATE them fresh.\n` : "";
 				throw new Error(`Phase 1 (IMPORT) succeeded; phase 2 (UPDATE) failed: ${msg}\n\nThe CloudFormation stack '${cfnStackName}' now contains the imported resources but is missing ${phase2Count} resource(s) (${phase2Creates.length} Custom Resource(s) + ${recreateBeforePhase2.length} IMPORT-unsupported). cdkd state is UNCHANGED so you can inspect what's in it, but DO NOT run \`cdkd deploy\` against this stack (the imported resources are now CFn-managed). To recover:\n` + recreateNote + `  1. Fix the failure cause (typically an onCreate Lambda error).
   2. Re-run the phase 2 UPDATE manually with the full synth template:
-       aws cloudformation create-change-set --stack-name ${cfnStackName} \\\n         --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\\n         --template-body file://<full-template.json>\n  3. Once phase 2 succeeds, run: cdkd state orphan ${resolvedStackName}\n     to clean up cdkd's stale state record.`);
+       aws cloudformation create-change-set --stack-name ${cfnStackName} \\\n         --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\\n         --template-body file://<full-template.json>\n  3. Once phase 2 succeeds, run: ${orphanCommandFor(resolvedStackName, targetRegion)}\n     to clean up cdkd's stale state record.`);
 			}
 			await stateBackend.deleteState(resolvedStackName, targetRegion);
-			logger.info(`cdkd state for '${resolvedStackName}' (${targetRegion}) removed. Manage the stack with 'cdk deploy' or 'aws cloudformation' from here on.`);
+			logger.info(`cdkd state for '${resolvedStackName}' (${safeSegment(targetRegion)}) removed. Manage the stack with 'cdk deploy' or 'aws cloudformation' from here on.`);
 			printNextSteps({
 				cfnStackName,
 				cdkStackName: resolvedStackName,
@@ -76321,7 +76540,7 @@ async function pickStackRegion$1(stateBackend, stackName, synthRegion, flag) {
 	}
 	if (flag) {
 		if (!refs.find((r) => r.region === flag)) {
-			const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
+			const seen = refs.map((r) => safeSegment(r.region ?? "(legacy)")).join(", ");
 			throw new Error(`No state found for stack '${stackName}' in region '${flag}'. Available regions: ${seen}.`);
 		}
 		return flag;
@@ -76330,7 +76549,7 @@ async function pickStackRegion$1(stateBackend, stackName, synthRegion, flag) {
 		if (refs.find((r) => r.region === synthRegion)) return synthRegion;
 	}
 	if (refs.length === 1) return refs[0].region ?? synthRegion ?? "";
-	const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
+	const regions = refs.map((r) => safeSegment(r.region ?? "(legacy)")).join(", ");
 	throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Re-run with --stack-region <region> to disambiguate.`);
 }
 function parseTemplateFile(path) {
@@ -76394,9 +76613,81 @@ function isPhase2CreatableType(resourceType) {
 * Module-scoped rather than local to the walker: the first cut of this change
 * guarded the walker's two refusals and left the root one, which is the shape
 * the issue is about.
+*
+* The parameter is `unknown`, not `string | undefined`, because a record-body
+* value is only TYPED as a string: the region-mismatch refusal below has
+* rendered `{"toString": null}` since issue #2947, and `getState`'s
+* `divergentBodyRegion` (#3328) is declared honestly as `unknown`.
+* `displaySafe` has always accepted `unknown` and coerces totally, so this
+* widens the signature to what the function already did.
+*
+* CAPPED as well as sanitized, since go-to-k/cdkd#3328 review round 2. Every
+* value reaching here is a state-record field or an S3 key segment, so a
+* planted multi-kilobyte one — or an ARRAY, which `String` comma-joins with no
+* bound — pushes the rest of the refusal off the reader's screen. The bound is
+* the STATE-RECORD grammar rather than `IDENT_MAX_CODE_POINTS` because a
+* legitimate multi-level nested-child stack name runs past 255 code points,
+* and this function renders those; `truncateCodePoints` so a cut never lands
+* inside a surrogate pair.
 */
 function safeSegment(value) {
-	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, STACK_REF_MAX_CODE_POINTS);
+	return truncated ? `${text} [cut: ${safe.length - text.length} more characters withheld]` : text;
+}
+/**
+* The free-form counterpart of {@link safeSegment}: an AWS error message, not
+* an identifier.
+*
+* **Its BEHAVIOUR is identical today, and the separation is about the CALLER's
+* contract rather than about the transformation** — stated plainly because an
+* earlier revision of this comment claimed a "tighter cap" for identifiers that
+* does not exist, and a false distinction is worse than none. What differs is
+* what a caller may DO with the result: `safeSegment`'s callers compare it
+* against the raw value to decide whether an identity renders EXACTLY
+* ({@link orphanCommandFor}), which is meaningless for a sentence; and
+* `display-safe.ts` says its identifier helpers are not for free-form text, so
+* routing a message through the one named `Segment` invites the next reader to
+* give it the identifier grammar's cap. Both sanitize with the ASCII allowlist
+* and bound the length, because both are untrusted text bound for a terminal.
+*/
+function safeDetail(value) {
+	const safe = displaySafe(value instanceof Error ? value.message : value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, STACK_REF_MAX_CODE_POINTS);
+	return truncated ? `${text} [cut: ${safe.length - text.length} more characters withheld]` : text;
+}
+/**
+* A `cdkd state orphan` line for a record-derived stack name — PASTEABLE only
+* when that name renders EXACTLY, and a template otherwise (issue
+* [#3328](https://github.com/go-to-k/cdkd/issues/3328), review round 3).
+*
+* Three messages in this file suggested that command with a name minted from
+* `Object.keys(state.resources)` (`walkCdkdStateStackTree` builds
+* `` `${parent}~${logicalId}` ``), i.e. body content anyone able to write one
+* state key chooses. Two rendered it RAW, so a newline or a CSI sequence in a
+* logical id forged whole lines around a DELETE command; the third sanitized
+* but did not shell-quote, so `'`, `;`, `|` and `` ` `` survived into a line an
+* operator pastes into a shell.
+*
+* Both halves of `malformed-resources-bag.ts`'s rule, and for its reasons:
+* sanitize THEN shell-quote, and gate the substituted form on the identity
+* rendering exactly — `displaySafe` TRIMS, so a name ending in a space renders
+* byte-identically to a healthy sibling, and `state orphan` DELETES a record.
+* Every caller emits the result LAST and unwrapped so the quoting composes; that
+* is an instruction to the CALLER and must not leak into the message it builds.
+*
+* `region` is REQUIRED even though the flag is optional on the command: omitting
+* `--stack-region` makes `state orphan` drop the record for that name in EVERY
+* region, which is wider than any of these messages describes. A helper whose
+* job is to make a destructive suggestion safe should not have an arm that
+* widens one.
+*/
+function orphanCommandFor(stackName, region) {
+	const shownStack = safeSegment(stackName);
+	if (!(typeof stackName === "string" && shownStack === stackName && typeof region === "string" && safeSegment(region) === region)) return "cdkd state orphan <stack> --stack-region <region> — spelled out because this record's name or region does NOT render exactly, so another record may render identically; list them as stored with 'cdkd state list --long' and act on the one whose key matches";
+	return `cdkd state orphan ${shellQuote(shownStack)} --stack-region ${shellQuote(safeSegment(region))}`;
 }
 /**
 * Recursively load the cdkd-state tree rooted at `(rootStackName, region)`.
@@ -76451,8 +76742,8 @@ async function walkCdkdStateStackTree(stackName, region, state, stateBackend) {
 		if (entry?.resourceType !== "AWS::CloudFormation::Stack") continue;
 		const childStackName = `${stackName}~${logicalId}`;
 		const childResult = await stateBackend.getState(childStackName, region);
-		if (!childResult) throw new Error(`cdkd state is missing nested-child '${safeSegment(childStackName)}' (${safeSegment(region)}). Parent stack '${safeSegment(stackName)}' lists '${safeSegment(logicalId)}' as an ${NESTED_STACK_RESOURCE_TYPE} row but no child state file exists at 'cdkd/${safeSegment(childStackName)}/${safeSegment(region)}/state.json'. The cdkd state tree is inconsistent — re-deploy the parent stack to refresh, or run 'cdkd state orphan ${safeSegment(stackName)}' and re-import.`);
-		if (childResult.state.region !== void 0 && childResult.state.region !== region) throw new Error(`cdkd state region mismatch: nested-child '${safeSegment(childStackName)}' has state.region='${safeSegment(childResult.state.region)}' but its parent '${safeSegment(stackName)}' is being walked against region='${safeSegment(region)}'. AWS does not support cross-region nested stacks; the state tree appears corrupt — re-deploy the parent stack to refresh.`);
+		if (!childResult) throw new Error(`cdkd state is missing nested-child '${safeSegment(childStackName)}' (${safeSegment(region)}). Parent stack '${safeSegment(stackName)}' lists '${safeSegment(logicalId)}' as an ${NESTED_STACK_RESOURCE_TYPE} row but no child state file exists at 'cdkd/${safeSegment(childStackName)}/${safeSegment(region)}/state.json'. The cdkd state tree is inconsistent — re-deploy the parent stack to refresh, or drop the parent's record and re-import with: ${orphanCommandFor(stackName, region)}`);
+		if (childResult.divergentBodyRegion !== void 0) throw new Error(`cdkd state region mismatch: nested-child '${safeSegment(childStackName)}' has state.region='${safeSegment(childResult.divergentBodyRegion)}' but its parent '${safeSegment(stackName)}' is being walked against region='${safeSegment(region)}'. AWS does not support cross-region nested stacks; the state tree appears corrupt — re-deploy the parent stack to refresh.`);
 		nestedChildren.set(logicalId, await walkCdkdStateStackTree(childStackName, region, childResult.state, stateBackend));
 	}
 	return {
@@ -76533,7 +76824,7 @@ function flattenCdkdStateTreeRootFirst(tree) {
 */
 function cdkd2cfnStackName(cdkdStackName) {
 	const cfnName = cdkdStackName.replace(/~/g, "-");
-	if (!/^[a-zA-Z][-a-zA-Z0-9]*$/.test(cfnName)) throw new Error(`cdkd stack name '${cdkdStackName}' maps to CFn stack name '${cfnName}', which violates the CloudFormation stack-name constraint [a-zA-Z][-a-zA-Z0-9]* (must start with a letter; no '_', '.', '/', or other special characters). Supply an explicit name via --cfn-stack-name (root) or --cfn-child-stack-name '<cdkdName>=<cfnName>' (nested child).`);
+	if (!/^[a-zA-Z][-a-zA-Z0-9]*$/.test(cfnName)) throw new Error(`cdkd stack name '${safeSegment(cdkdStackName)}' maps to CFn stack name '${safeSegment(cfnName)}', which violates the CloudFormation stack-name constraint [a-zA-Z][-a-zA-Z0-9]* (must start with a letter; no '_', '.', '/', or other special characters). Supply an explicit name via --cfn-stack-name (root) or --cfn-child-stack-name '<cdkdName>=<cfnName>' (nested child).`);
 	return cfnName;
 }
 /**
@@ -76559,7 +76850,7 @@ function parseCfnChildStackNameOverrides(values) {
 		if (!cdkdName) throw new Error(`--cfn-child-stack-name '${raw}' has an empty cdkd stack name.`);
 		if (!cfnName) throw new Error(`--cfn-child-stack-name '${raw}' has an empty CFn stack name.`);
 		if (!/^[a-zA-Z][-a-zA-Z0-9]*$/.test(cfnName)) throw new Error(`--cfn-child-stack-name '${raw}': CFn stack name '${cfnName}' must match [a-zA-Z][-a-zA-Z0-9]* (no '~', no '/', no '_', no '.').`);
-		if (out.has(cdkdName)) throw new Error(`--cfn-child-stack-name: duplicate override for cdkd stack '${cdkdName}'. Pass it once with the final CFn name.`);
+		if (out.has(cdkdName)) throw new Error(`--cfn-child-stack-name: duplicate override for cdkd stack '${safeSegment(cdkdName)}'. Pass it once with the final CFn name.`);
 		out.set(cdkdName, cfnName);
 	}
 	return out;
@@ -76645,7 +76936,7 @@ function indexNestedTemplatePaths(template, templateDir) {
 * orchestrator.
 */
 function buildPerStackImportNodes(rootStackName, rootTemplate, rootNestedTemplatePaths, rootTemplateFormat, tree) {
-	if (tree.stackName !== rootStackName) throw new Error(`buildPerStackImportNodes: tree root '${tree.stackName}' does not match expected root stack name '${rootStackName}'.`);
+	if (tree.stackName !== rootStackName) throw new Error(`buildPerStackImportNodes: tree root '${safeSegment(tree.stackName)}' does not match expected root stack name '${safeSegment(rootStackName)}'.`);
 	const out = /* @__PURE__ */ new Map();
 	walk(tree, rootTemplate, rootNestedTemplatePaths, rootTemplateFormat);
 	return out;
@@ -76659,7 +76950,7 @@ function buildPerStackImportNodes(rootStackName, rootTemplate, rootNestedTemplat
 		});
 		for (const [childLogicalId, childNode] of node.nestedChildren) {
 			const childTemplatePath = nodeNestedTemplatePaths[childLogicalId];
-			if (!childTemplatePath) throw new Error(`cdkd export: nested-stack child '${childLogicalId}' under parent '${node.stackName}' has cdkd state but no Metadata['aws:asset:path'] in the parent template's '${childLogicalId}' row. The synth output and the cdkd state tree are out of sync — re-deploy the parent stack to refresh, or remove the cdkd state for the orphaned child via 'cdkd state orphan ${childNode.stackName}'.`);
+			if (!childTemplatePath) throw new Error(`cdkd export: nested-stack child '${safeSegment(childLogicalId)}' under parent '${safeSegment(node.stackName)}' has cdkd state but no Metadata['aws:asset:path'] in the parent template's '${safeSegment(childLogicalId)}' row. The synth output and the cdkd state tree are out of sync — re-deploy the parent stack to refresh, or remove the cdkd state for the orphaned child with ${orphanCommandFor(childNode.stackName, childNode.region)}`);
 			const { template: childTemplate, format: childFormat } = readNestedChildTemplateFile(childTemplatePath, childLogicalId);
 			walk(childNode, childTemplate, indexNestedTemplatePaths(childTemplate, path.dirname(childTemplatePath)), childFormat);
 		}
@@ -76711,7 +77002,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 				blocked.push({
 					logicalId,
 					resourceType,
-					reason: `template has AWS::CloudFormation::Stack row '${logicalId}' but cdkd state has no matching nested-stack entry on parent '${parentStackName}'. Re-deploy or re-import the parent stack to refresh state.`
+					reason: `template has AWS::CloudFormation::Stack row '${logicalId}' but cdkd state has no matching nested-stack entry on parent '${safeSegment(parentStackName)}'. Re-deploy or re-import the parent stack to refresh state.`
 				});
 				continue;
 			}
@@ -77404,13 +77695,13 @@ function reportDriftBaselineGaps(state, logger) {
 	const missing = entries.filter(([, r]) => r.observedProperties === void 0);
 	if (missing.length === 0) return;
 	if (state.version !== void 0 && state.version < 3) {
-		logger.warn(`cdkd state schema is v${state.version} (pre-observedProperties). cdkd drift cannot reliably compare against AWS for this stack; the next \`cdk deploy\` after migration may surface spurious changes if AWS has drifted from the template. Run \`cdkd state refresh-observed ${state.stackName}\` (or any redeploy) before export to capture an AWS-current baseline.`);
+		logger.warn(`cdkd state schema is v${state.version} (pre-observedProperties). cdkd drift cannot reliably compare against AWS for this stack; the next \`cdk deploy\` after migration may surface spurious changes if AWS has drifted from the template. Run \`cdkd state refresh-observed ${safeSegment(state.stackName)}\` (or any redeploy) before export to capture an AWS-current baseline.`);
 		return;
 	}
 	const refused = missing.filter(([, r]) => r.observedBaselineRefused === true);
 	const refreshable = missing.filter(([, r]) => r.observedBaselineRefused !== true);
 	if (refreshable.length > 0) {
-		logger.warn(`${refreshable.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next \`cdk deploy\` after migration may surface unexpected changes. Run \`cdkd state refresh-observed ${state.stackName}\` to capture a baseline before export, then \`cdkd drift\` to verify the stack matches AWS.`);
+		logger.warn(`${refreshable.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next \`cdk deploy\` after migration may surface unexpected changes. Run \`cdkd state refresh-observed ${safeSegment(state.stackName)}\` to capture a baseline before export, then \`cdkd drift\` to verify the stack matches AWS.`);
 		for (const [logicalId] of refreshable.slice(0, 10)) logger.warn(`  ${logicalId}`);
 		if (refreshable.length > 10) logger.warn(`  ... and ${refreshable.length - 10} more`);
 	}
@@ -77953,12 +78244,12 @@ async function buildResolvedParametersPerStack(args) {
 	for (const ref of flattenCdkdStateTreeRootFirst(args.tree)) {
 		if (ref.stackName === args.rootStackName) continue;
 		const node = nodeByName.get(ref.stackName);
-		if (!node) throw new Error(`buildResolvedParametersPerStack: tree node '${ref.stackName}' has no per-stack template/state entry. This is a cdkd bug.`);
+		if (!node) throw new Error(`buildResolvedParametersPerStack: tree node '${safeSegment(ref.stackName)}' has no per-stack template/state entry. This is a cdkd bug.`);
 		const parentLogicalId = node.state.parentLogicalId;
 		const parentStackName = node.state.parentStack;
-		if (!parentLogicalId || !parentStackName) throw new Error(`buildResolvedParametersPerStack: child '${node.cdkdName}' state is missing parentLogicalId / parentStack (v6 fields). Re-deploy or re-import the parent stack.`);
+		if (!parentLogicalId || !parentStackName) throw new Error(`buildResolvedParametersPerStack: child '${safeSegment(node.cdkdName)}' state is missing parentLogicalId / parentStack (v6 fields). Re-deploy or re-import the parent stack.`);
 		const parentNode = nodeByName.get(parentStackName);
-		if (!parentNode) throw new Error(`buildResolvedParametersPerStack: child '${node.cdkdName}' references parent '${parentStackName}' which is not in the per-stack node list — tree shape is inconsistent.`);
+		if (!parentNode) throw new Error(`buildResolvedParametersPerStack: child '${safeSegment(node.cdkdName)}' references parent '${safeSegment(parentStackName)}' which is not in the per-stack node list — tree shape is inconsistent.`);
 		const parentParamValues = {};
 		for (const p of paramsByCdkdName.get(parentStackName) ?? []) if (p.ParameterKey !== void 0) parentParamValues[p.ParameterKey] = p.ParameterValue;
 		const parentResolverContext = {
@@ -78043,7 +78334,7 @@ async function runPerStackImportLoop(args) {
 	};
 	const nodesByCdkdName = buildPerStackImportNodes(rootStackName, rootTemplate, rootStackInfoNestedTemplates, rootTemplateFormat, tree);
 	const leafFirst = flattenCdkdStateTreeLeafFirst(tree);
-	for (const n of leafFirst) if (!nodesByCdkdName.has(n.stackName)) throw new Error(`runPerStackImportLoop: missing per-stack template for '${n.stackName}' — tree node has cdkd state but no synth template was loaded. This is a cdkd bug.`);
+	for (const n of leafFirst) if (!nodesByCdkdName.has(n.stackName)) throw new Error(`runPerStackImportLoop: missing per-stack template for '${safeSegment(n.stackName)}' — tree node has cdkd state but no synth template was loaded. This is a cdkd bug.`);
 	const perStackPlans = [];
 	for (const node of leafFirst) {
 		const meta = nodesByCdkdName.get(node.stackName);
@@ -78054,7 +78345,7 @@ async function runPerStackImportLoop(args) {
 		});
 		if (plan.blocked.length > 0) {
 			const lines = groupBlockedReasons(plan.blocked);
-			throw new Error(`Stack '${meta.cdkdStackName}' has ${new Set(plan.blocked.map((b) => b.logicalId)).size} resource(s) that block migration:\n${lines.join("\n")}`);
+			throw new Error(`Stack '${safeSegment(meta.cdkdStackName)}' has ${new Set(plan.blocked.map((b) => b.logicalId)).size} resource(s) that block migration:\n${lines.join("\n")}`);
 		}
 		perStackPlans.push({
 			cdkdName: meta.cdkdStackName,
@@ -78073,7 +78364,7 @@ async function runPerStackImportLoop(args) {
 	const totalRecreate = perStackPlans.reduce((acc, p) => acc + p.recreateBeforePhase2.length, 0);
 	logger.info("");
 	logger.info(`Migrating cdkd nested-stack tree rooted at '${rootStackName}' → CloudFormation (${perStackPlans.length} stack(s), leaf-first):`);
-	for (const plan of perStackPlans) logger.info(`  [${plan.cdkdName}] → CFn stack '${plan.cfnName}': ${plan.phase1Imports.length} leaf import(s)` + (plan.nestedStackRows.length > 0 ? `, ${plan.nestedStackRows.length} nested-child adoption(s)` : "") + (plan.phase2Creates.length > 0 ? `, ${plan.phase2Creates.length} phase-2 CREATE(s)` : "") + (plan.recreateBeforePhase2.length > 0 ? `, ${plan.recreateBeforePhase2.length} pre-delete + re-CREATE` : ""));
+	for (const plan of perStackPlans) logger.info(`  [${safeSegment(plan.cdkdName)}] → CFn stack '${safeSegment(plan.cfnName)}': ${plan.phase1Imports.length} leaf import(s)` + (plan.nestedStackRows.length > 0 ? `, ${plan.nestedStackRows.length} nested-child adoption(s)` : "") + (plan.phase2Creates.length > 0 ? `, ${plan.phase2Creates.length} phase-2 CREATE(s)` : "") + (plan.recreateBeforePhase2.length > 0 ? `, ${plan.recreateBeforePhase2.length} pre-delete + re-CREATE` : ""));
 	logger.info("");
 	if (totalPhase2Creates > 0 && !options.includeNonImportable) {
 		if (options.dryRun) {
@@ -78097,7 +78388,7 @@ async function runPerStackImportLoop(args) {
 	if (!options.yes) {
 		const phase2Note = totalPhase2Creates > 0 ? ` Phase 2 will CREATE ${totalPhase2Creates} non-importable resource(s) across the tree.` : "";
 		const recreateNote = totalRecreate > 0 ? ` cdkd will also pre-DELETE + re-CREATE ${totalRecreate} IMPORT-unsupported resource(s) (brief unavailability window per resource).` : "";
-		if (!await confirmPrompt$3(`Create ${perStackPlans.length} CloudFormation stack(s) by importing the cdkd nested-stack tree rooted at '${rootStackName}' (${rootRegion}) — leaf-first, per-stack IMPORT loop (#464 design §4.3).` + phase2Note + recreateNote + " AWS resources are unchanged. cdkd state for every adopted stack will be deleted on success.")) {
+		if (!await confirmPrompt$3(`Create ${perStackPlans.length} CloudFormation stack(s) by importing the cdkd nested-stack tree rooted at '${rootStackName}' (${safeSegment(rootRegion)}) — leaf-first, per-stack IMPORT loop (#464 design §4.3).` + phase2Note + recreateNote + " AWS resources are unchanged. cdkd state for every adopted stack will be deleted on success.")) {
 			logger.info("Migration cancelled. cdkd state and CloudFormation are unchanged.");
 			return {
 				outcome: "cancelled",
@@ -78143,11 +78434,11 @@ async function runPerStackImportLoop(args) {
 			resolver: paramResolver,
 			stateBackend: deps.stateBackend
 		}));
-		for (const [cdkdName, skipped] of sessionIntrinsicSkipped) logger.warn(`  Child '${cdkdName}': could not resolve intrinsic-valued Parameter(s) ${skipped.join(", ")} at IMPORT time. The child template's Parameter Default values must cover these — otherwise CFn will reject the IMPORT.`);
+		for (const [cdkdName, skipped] of sessionIntrinsicSkipped) logger.warn(`  Child '${safeSegment(cdkdName)}': could not resolve intrinsic-valued Parameter(s) ${skipped.join(", ")} at IMPORT time. The child template's Parameter Default values must cover these — otherwise CFn will reject the IMPORT.`);
 		try {
 			for (let i = 0; i < perStackPlans.length; i++) {
 				const plan = perStackPlans[i];
-				logger.info(`[${i + 1}/${perStackPlans.length}] Importing cdkd stack '${plan.cdkdName}' → CFn stack '${plan.cfnName}' (${plan.phase1Imports.length} leaf, ${plan.nestedStackRows.length} nested-child adoption)`);
+				logger.info(`[${i + 1}/${perStackPlans.length}] Importing cdkd stack '${safeSegment(plan.cdkdName)}' → CFn stack '${plan.cfnName}' (${plan.phase1Imports.length} leaf, ${plan.nestedStackRows.length} nested-child adoption)`);
 				const stackParameters = paramsByCdkdName.get(plan.cdkdName) ?? [];
 				const phase1ATemplate = filterTemplateForImport(plan.template, plan.phase1Imports);
 				const phase1AResources = plan.phase1Imports.map((entry) => ({
@@ -78156,13 +78447,13 @@ async function runPerStackImportLoop(args) {
 					ResourceIdentifier: entry.resourceIdentifier
 				}));
 				const injectedDeletion = injectDeletionPolicyForImport(phase1ATemplate);
-				if (injectedDeletion > 0) logger.info(`  Injected DeletionPolicy: Delete on ${injectedDeletion} resource(s) in '${plan.cdkdName}' (required by CFn IMPORT; matches CDK/CFn default).`);
+				if (injectedDeletion > 0) logger.info(`  Injected DeletionPolicy: Delete on ${injectedDeletion} resource(s) in '${safeSegment(plan.cdkdName)}' (required by CFn IMPORT; matches CDK/CFn default).`);
 				try {
 					await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1ATemplate, phase1AResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 				} catch (err) {
-					const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${s.cdkdStackName} → ${s.cfnStackName}`).join(", ") : "(none)";
-					const remainingSummary = perStackPlans.slice(i).map((p) => p.cdkdName).join(", ");
-					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack '${plan.cdkdName}' (CFn name '${plan.cfnName}'). Stacks imported successfully so far: ${importedSummary}. Stacks not yet imported (cdkd state preserved): ${remainingSummary}. After resolving the underlying cause, re-run 'cdkd export ${rootStackName}' — already-imported children will be adopted as nested references on retry. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
+					const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${safeSegment(s.cdkdStackName)} → ${safeSegment(s.cfnStackName)}`).join(", ") : "(none)";
+					const remainingSummary = perStackPlans.slice(i).map((p) => safeSegment(p.cdkdName)).join(", ");
+					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack '${safeSegment(plan.cdkdName)}' (CFn name '${plan.cfnName}'). Stacks imported successfully so far: ${importedSummary}. Stacks not yet imported (cdkd state preserved): ${remainingSummary}. After resolving the underlying cause, re-run 'cdkd export ${rootStackName}' — already-imported children will be adopted as nested references on retry. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
 				}
 				const cfnArn = (await deps.cfnClient.send(new DescribeStacksCommand({ StackName: plan.cfnName }))).Stacks?.[0]?.StackId;
 				if (!cfnArn) throw new Error(`runPerStackImportLoop: DescribeStacks returned no StackId for '${plan.cfnName}' immediately after Phase 1A IMPORT — AWS may be in an unexpected state.`);
@@ -78184,7 +78475,7 @@ async function runPerStackImportLoop(args) {
 					const phase1BResources = [];
 					for (const row of plan.nestedStackRows) {
 						const childArn = cfnArnByCdkdName.get(row.childStackName);
-						if (!childArn) throw new Error(`runPerStackImportLoop: nested-stack child '${row.childStackName}' has no recorded CFn ARN when processing parent '${plan.cdkdName}'. Leaf-first iteration order should have IMPORTed the child first — this is a cdkd bug.`);
+						if (!childArn) throw new Error(`runPerStackImportLoop: nested-stack child '${safeSegment(row.childStackName)}' has no recorded CFn ARN when processing parent '${safeSegment(plan.cdkdName)}'. Leaf-first iteration order should have IMPORTed the child first — this is a cdkd bug.`);
 						const childCfnName = cfnStackNameOf(row.childStackName);
 						const childTemplateBody = await fetchCfnStackTemplate(deps.cfnClient, childCfnName);
 						const uploaded = await uploadCfnTemplate({
@@ -78197,7 +78488,7 @@ async function runPerStackImportLoop(args) {
 						uploadCleanups.push(uploaded.cleanup);
 						const childActualTags = (await deps.cfnClient.send(new DescribeStacksCommand({ StackName: childCfnName }))).Stacks?.[0]?.Tags ?? [];
 						const originalRow = getResourceFromTemplate(plan.template, row.logicalId);
-						if (!originalRow) throw new Error(`runPerStackImportLoop: parent template for '${plan.cdkdName}' has no resource '${row.logicalId}'. State and template are out of sync.`);
+						if (!originalRow) throw new Error(`runPerStackImportLoop: parent template for '${safeSegment(plan.cdkdName)}' has no resource '${row.logicalId}'. State and template are out of sync.`);
 						const rewrittenRow = injectRetainAndRewriteTemplateUrl(originalRow, uploaded.url, childActualTags);
 						phase1BTemplate["Resources"][row.logicalId] = rewrittenRow;
 						rewrittenNestedRows.set(row.logicalId, rewrittenRow);
@@ -78210,8 +78501,8 @@ async function runPerStackImportLoop(args) {
 					try {
 						await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1BTemplate, phase1BResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 					} catch (err) {
-						const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${s.cdkdStackName} → ${s.cfnStackName}`).join(", ") : "(none)";
-						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent '${plan.cdkdName}' (CFn name '${plan.cfnName}'). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each is a standalone CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover: (1) fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"); (2) clear cdkd state for the migrated stacks via 'cdkd state orphan <stack>' (do NOT 'cdkd destroy' — that would tear down the live AWS resources); (3) re-attempt the parent-side nested adoption manually via the AWS console or CLI per the AWS docs procedure. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
+						const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${safeSegment(s.cdkdStackName)} → ${safeSegment(s.cfnStackName)}`).join(", ") : "(none)";
+						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent '${safeSegment(plan.cdkdName)}' (CFn name '${safeSegment(plan.cfnName)}'). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each is a standalone CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover: (1) fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"); (2) clear cdkd state for the migrated stacks via 'cdkd state orphan <stack>' (do NOT 'cdkd destroy' — that would tear down the live AWS resources); (3) re-attempt the parent-side nested adoption manually via the AWS console or CLI per the AWS docs procedure. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
 					}
 					logger.info(`  ✓ Phase 1B: parent '${plan.cfnName}' adopted ${plan.nestedStackRows.length} nested child(ren) via UPDATE-IMPORT.`);
 					if (plan.cdkdName !== rootStackName) {
@@ -78221,7 +78512,7 @@ async function runPerStackImportLoop(args) {
 				}
 				if (plan.recreateBeforePhase2.length > 0) for (const entry of plan.recreateBeforePhase2) {
 					const handler = PRE_DELETE_HANDLERS[entry.resourceType];
-					if (!handler) throw new Error(`No pre-delete handler registered for ${entry.resourceType} (${entry.logicalId}) in stack '${plan.cdkdName}'. This is a cdkd bug — the resource is in IMPORT_UNSUPPORTED_RECREATABLE_TYPES but lacks a PRE_DELETE_HANDLERS entry.`);
+					if (!handler) throw new Error(`No pre-delete handler registered for ${entry.resourceType} (${entry.logicalId}) in stack '${safeSegment(plan.cdkdName)}'. This is a cdkd bug — the resource is in IMPORT_UNSUPPORTED_RECREATABLE_TYPES but lacks a PRE_DELETE_HANDLERS entry.`);
 					logger.info(`  Pre-deleting AWS resource for ${entry.logicalId} (${entry.resourceType}) so CFn can re-CREATE in phase 2...`);
 					await handler(entry);
 					logger.info(`    ✓ deleted ${entry.physicalId}`);
@@ -78240,21 +78531,21 @@ async function runPerStackImportLoop(args) {
 			const stateDeletionFailures = [];
 			for (const node of leafFirst) try {
 				await deps.stateBackend.deleteState(node.stackName, node.region);
-				logger.info(`cdkd state for '${node.stackName}' (${node.region}) removed.`);
+				logger.info(`cdkd state for '${safeSegment(node.stackName)}' (${safeSegment(node.region)}) removed.`);
 			} catch (err) {
 				stateDeletionFailures.push({
 					stackName: node.stackName,
 					region: node.region,
 					reason: err instanceof Error ? err.message : String(err)
 				});
-				logger.warn(`Failed to delete cdkd state for '${node.stackName}' (${node.region}): ${err instanceof Error ? err.message : String(err)}. The stack IS CFn-managed; clean up with 'cdkd state orphan ${node.stackName}'.`);
+				logger.warn(`Failed to delete cdkd state for '${safeSegment(node.stackName)}' (${safeSegment(node.region)}): ${safeDetail(err)}. The stack IS CFn-managed; clean up with: ${orphanCommandFor(node.stackName, node.region)}`);
 			}
 			if (stateDeletionFailures.length > 0) {
-				const lines = stateDeletionFailures.map((f) => `  - cdkd/${f.stackName}/${f.region}/state.json: ${f.reason}`).join("\n");
-				throw new Error(`${stateDeletionFailures.length} cdkd state record(s) could not be deleted after a successful per-stack IMPORT loop. Every stack in the tree IS CFn-managed (the migration succeeded AWS-side); orphan state remains under:\n${lines}\nRecover with 'cdkd state orphan <stack>' per record.`);
+				const lines = stateDeletionFailures.map((f) => `  - cdkd/${safeSegment(f.stackName)}/${safeSegment(f.region)}/state.json: ${safeDetail(f.reason)}`).join("\n");
+				throw new Error(`${stateDeletionFailures.length} cdkd state record(s) could not be deleted after a successful per-stack IMPORT loop. Every stack in the tree IS CFn-managed (the migration succeeded AWS-side); orphan state remains under:\n${lines}\nRecover with 'cdkd state orphan <stack> --stack-region <region>' per record.`);
 			}
 			if (sessionIntrinsicSkipped.size > 0) {
-				const detail = [...sessionIntrinsicSkipped.entries()].map(([cdkdName, params]) => `${cdkdName} (${params.join(", ")})`).join("; ");
+				const detail = [...sessionIntrinsicSkipped.entries()].map(([cdkdName, params]) => `${safeSegment(cdkdName)} (${params.join(", ")})`).join("; ");
 				logger.warn(`${sessionIntrinsicSkipped.size} stack(s) had intrinsic-valued Parameter(s) that cdkd could not resolve at IMPORT time: ${detail}. Verify each child template's Parameter Default values cover these before the first 'cdk deploy'.`);
 			}
 			return {
@@ -78268,7 +78559,7 @@ async function runPerStackImportLoop(args) {
 		for (let i = acquiredChildLocks.length - 1; i >= 0; i--) {
 			const lock = acquiredChildLocks[i];
 			await deps.lockManager.releaseLock(lock.stackName, lock.region).catch((err) => {
-				logger.warn(`Failed to release lock for '${lock.stackName}' (${lock.region}): ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`Failed to release lock for '${safeSegment(lock.stackName)}' (${safeSegment(lock.region)}): ${safeDetail(err)}`);
 			});
 		}
 	}
@@ -79678,9 +79969,29 @@ function createStateOrphanCommand() {
 *   state record. AWS resources are left intact.
 *
 * Region scoping: when a stack name has multiple state records spread across
-* regions (PR 1 territory), `--region` selects one. With the current single-
-* region-per-name layout the flag still works — it sets the AWS clients'
-* region and refuses to proceed if the loaded state.region disagrees.
+* regions (PR 1 territory), `--stack-region` selects one — it picks WHICH
+* record is loaded, because the region is part of the S3 key.
+*
+* What it does with a record whose BODY names a different region than that key
+* is two things, neither of which this comment described until issue
+* [#3328](https://github.com/go-to-k/cdkd/issues/3328) — it claimed a refusal
+* on `state.region` that had never existed anywhere in the command, while the
+* measured behaviour was the opposite: a planted record at
+* `.../us-east-1/state.json` carrying `"region": "eu-west-1"` locked, saved
+* and deleted against `eu-west-1` and reported `✓ State deleted` while the
+* us-east-1 key survived.
+*
+* 1. `S3StateBackend.getState` normalizes the loaded record's `region` to the
+*    KEY's and WARNS, so this command — which hands `stateResult.state`
+*    straight to `runDestroyForStack` — acts on the region it was pointed at.
+*    The read itself refuses NOTHING; `adoptKeyRegion` carries why, and it is
+*    what keeps `state show` / `state list` / `state orphan` working on such a
+*    record.
+* 2. The DESTROY refuses it when the record still lists resources
+*    (`refuseDivergentRecordRegionForDestroy`, reached through
+*    `runDestroyForStack`), because which region those resources are in is
+*    exactly what the divergence makes undecidable. A resource-less record is
+*    not refused, so cleaning one up still works.
 */
 async function stateDestroyCommand(stackArgs, options) {
 	const logger = getLogger();
@@ -79827,6 +80138,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					providerRegistry,
 					baseAwsClients: setup.awsClients,
 					baseRegion: setup.region,
+					...stateResult.divergentBodyRegion !== void 0 && { divergentBodyRegion: stateResult.divergentBodyRegion },
 					...options.profile && { profile: options.profile },
 					stateBucket: setup.bucket,
 					statePrefix: options.statePrefix,
@@ -94394,4 +94706,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-BgbPkrcx.js.map
+//# sourceMappingURL=program-babtsurS.js.map