@go-to-k/cdkd 0.290.24 → 0.290.26

package/dist/{program-DaoJ7P4H.js → program-BgDlhE-S.js}

@@ -1,8 +1,8 @@
-import { $ as secretBearing, $n as scrubResourceRecord, $r as Synthesizer, $t as s3BucketArn, A as extractDeploymentEventError, Ai as setAwsClients, An as repairMalformedResourcesForReadOnly, Ar as isCrossRegionRedirect, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalStartServiceError, Bn as TEMPLATE_SOURCED_RULES, Br as describeDockerExecFailure, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as AssemblyReader, Cn as refuseMalformedOutputs, Cr as loadPublishableAssetManifest, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as AwsClients, Dn as refuseMalformedState, Dr as assertAssetBucketRegion, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, Ei as resolveBucketRegion, En as refuseMalformedResourcesForDestroy, Er as BOOTSTRAP_MARKER_PREFIX, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fn as DagBuilder, Fr as buildDenyExternalAccessPolicy, Ft as isSettledInstanceState, G as gray, Gi as ProvisioningError, Gn as identityKeyFor, Gr as partitionSensitiveEnv, Gt as readConfigString, H as formatResourceLine, Hi as MalformedProducerRecordRefusalError, Hn as createSecretMasker, Hr as dockerSpawnEnvWithSensitive, Ht as configBooleanRefusal, I as renderStatefulReason, Ii as DeployCancelledError, In as TemplateParser, Ir as describeAwsFailure, It as WAFv2WebACLProvider, J as yellow, Ji as StackHasActiveImportsError, Jn as maskSecretsInError, Jr as runDockerStreaming, Jt as requireConfigObject, K as green, Ki as ResourceTimeoutError, Kn as isSingleDynamicReferenceToken, Kr as redactDockerArgvValues, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DynamicReferenceRegionAmbiguousError, Ln as STATE_SOURCED_BASELINE_RULES, Lr as safeStringify, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mi as CdkdError, Mn as findSilentDropProperties, Mr as readBootstrapMarkerBody, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as describeTypeWithThrottleRetry, Nr as validateAssetBucketName, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as getAwsClients, On as repairMalformedOutputsForReadOnly, Or as ensureAssetStorage, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pi as CrossAccountSecretRefusalError, Pn as withRetry, Pr as validateContainerRepoName, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as redactSecretsForState, Qr as getDockerImageBySourceHash, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as IntrinsicResolutionRefusalError, Rn as STATE_SOURCED_CROSS_GENERATION_RULES, Rr as buildDockerImage, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as derivePartitionAndUrlSuffix, Sn as refuseMalformedNestedChildOutputs, Sr as createAssetRedirectResolver, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Tn as refuseMalformedResourcePropertiesForOrphan, Tr as AssetModeResolver, Tt as carriesDynamicReference, U as bold, Ui as NestedStackChildDirectDestroyError, Un as dynamicReferenceTokens, Ur as formatDockerLoginError, Ut as configIntegerRefusal, V as toFiniteNumber, Vn as carriesSecretMask, Vr as describeDockerFailure, Vt as coerceCfnInteger, W as cyan, Wi as PartialFailureError, Wn as errorCauseChain, Wr as getDockerCmd, Wt as configStringRefusal, X as collectPublishedOutputNames, Xn as recordMaskOnlyValue, Xr as stripControlChars, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackTerminationProtectionError, Yn as maskSecretsInText, Yr as escapeRegExp, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as recoverMaskedOutput, Zr as AssetManifestLoader, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, _n as malformedRenderedContainersWarning, _r as shouldRetainResource, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isTransientServerError, ai as resolveCaptureObservedState, an as applyCallerIdentityCredentials, ar as forceQuitRecoveryClause, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as PARTITION_TABLE, bn as malformedStateRefusalMessage, br as WorkGraph, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as retryClassificationText, ci as resolveStateBucketWithDefaultAndSource, cn as INTRINSIC_KEYS, cr as CUSTOM_RESOURCE_RESPONSE_PREFIX, ct as createMaskedRetryLogger, d as updatePartialReason, di as warnDeprecatedNoPrefixCliFlag, dn as hasReadableResources, dr as hasReadableExportSet, dt as beginCommandInterruptScope, ea as normalizeAwsError, ei as synthesisStatusMessage, en as s3BucketDomainName, er as LockManager, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as CFN_TEMPLATE_BODY_LIMIT, fn as malformedExportNamesWarning, fr as importableOutputKeys, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as uploadCfnTemplate, gn as malformedOutputsWarning, gr as orphansCarriedFrom, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as findLargeInlineResources, hn as malformedOutputsRefusalMessage, hr as orphansAfterRollback, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isThrottlingError, ii as resolveAutoAssetStorage, in as applyRoleArnIfSet, ir as buildLockContentionMessage, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as findActionableSilentDrops, jr as parseBootstrapMarker, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as resetAwsClients, kn as repairMalformedResourcePropertiesForReadOnly, kr as getBootstrapMarkerKey, kt as getAccountInfo, l as replayRollback, li as resolveUseCdkBootstrapAssets, ln as STATE_RESOURCES_MALFORMED, lr as DEFAULT_STATE_PREFIX, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as MIGRATE_TMP_PREFIX, mn as malformedLocalOutputsWarning, mr as isReadableBag, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as isMarkedNonRetryable, ni as getLegacyStateBucketName, nn as s3BucketRegionalDomainName, nr as rebuildClientForBucketRegion, nt as getCurrentResourceSecrets, o as planFailedOps, oa as markNonRetryable, oi as resolveSkipPrefix, on as callerEnvCredentials, or as formatLockExpiry, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_URL_LIMIT, pn as malformedExportSourceWarning, pr as importableOutputs, pt as interruptWatchListenerCount, q as red, qi as ResourceUpdateNotSupportedError, qn as markSameGenerationBag, qr as runDockerForeground, qt as requireConfigArray, r as DeployEngine, ra as isRetryableTransientError, ri as resolveApp, rn as s3BucketWebsiteUrl, rr as buildForceUnlockCommand, rt as IAMRoleProvider, s as planRollback, sa as markRedactedCause, si as resolveStateBucketWithDefault, sn as DiffCalculator, sr as shellQuote, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as withErrorHandling, ti as getDefaultStateBucketName, tn as s3BucketDualStackDomainName, tr as S3StateBackend, tt as secretSafeKeyDisplay, u as updatePartialMessage, ui as stateBucketExistenceConfirmed, un as hasReadableOutputs, ur as exportNamesCarriedFrom, ut as maskerOrIdentity, v as keptWholeReasonText, vi as decodeListingKey, vn as malformedResourcePropertiesWarning, vr as AssetPublisher, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as processStackMessages, wn as refuseMalformedOutputsForDestroy, wr as rewriteTemplateAssetReferences, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as canonicalizeRegion, xn as producerRecordKey, xr as buildAssetRedirectMap, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as expectedOwnerParam, yn as malformedResourcesWarning, yr as stringifyValue, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as LocalInvokeBuildError$1, zn as STATE_SOURCED_READBACK_RULES, zr as describeDockerCapturedOutput, zt as assertRegionMatch } from "./deploy-engine-BcNBidfy.js";
+import { $ as secretBearing, $n as recordMaskOnlyValue, $r as getDockerImageBySourceHash, $t as s3BucketArn, A as extractDeploymentEventError, Ai as resetAwsClients, An as refuseMalformedState, Ar as assertAssetBucketRegion, At as isImpossibleEmptyStoredAttribute, B as toCfnInteger, Bi as LocalInvokeBuildError$1, Bn as STATE_SOURCED_BASELINE_RULES, Br as describeDockerCapturedOutput, Bt as coerceCfnBoolean, C as buildFinalSnapshotIdentifier, Ci as derivePartitionAndUrlSuffix, Cn as producerRecordKey, Cr as WorkGraph, Ct as isTerminationProtectionPropagationError, D as refusesFinalSnapshot, Di as resolveBucketRegion, Dn as refuseMalformedOutputsForDestroy, Dr as rewriteTemplateAssetReferences, Dt as cfnRefValueFromPhysicalId, E as isFinalSnapshotError, En as refuseMalformedOutputs, Er as loadPublishableAssetManifest, Et as carriesFetchableDynamicReference, F as isStatefulRecreateTargetSync, Fi as CrossAccountSecretRefusalError, Fn as findSilentDropProperties, Fr as readBootstrapMarkerBody, Ft as isSettledInstanceState, G as gray, Gi as PartialFailureError, Gn as createSecretMasker, Gr as getDockerCmd, Gt as readConfigString, H as formatResourceLine, Hn as STATE_SOURCED_READBACK_RULES, Hr as describeDockerFailure, Ht as configBooleanRefusal, I as renderStatefulReason, In as describeTypeWithThrottleRetry, Ir as validateAssetBucketName, It as WAFv2WebACLProvider, J as yellow, Ji as ResourceUpdateNotSupportedError, Jn as identityKeyFor, Jr as runDockerForeground, Jt as requireConfigObject, K as green, Ki as ProvisioningError, Kn as dynamicReferenceTokens, Kr as partitionSensitiveEnv, Kt as replayWarn, L as WARM_THROUGHPUT_MEMBERS, Li as DeployCancelledError, Ln as withRetry, Lr as validateContainerRepoName, Lt as normalizeAwsTagsToCfn, M as planOrphanAdoption, Mn as repairMalformedResourcePropertiesForReadOnly, Mr as getBootstrapMarkerKey, Mt as isUnboundTemplateParameter, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Ni as CdkdError, Nn as repairMalformedResourcesForReadOnly, Nr as isCrossRegionRedirect, Nt as parameterTypeMayLoseSecretIdentity, O as unsupportedFinalSnapshotError, Oi as AwsClients, On as refuseMalformedResourcePropertiesForOrphan, Or as AssetModeResolver, Ot as coerceParameterTypedValue, P as isStatefulRecreateTargetForReplace, Pn as findActionableSilentDrops, Pr as parseBootstrapMarker, Pt as refStateLookupFromResource, Q as isExportAliasCollision, Qn as maskSecretsInText, Qr as AssetManifestLoader, Qt as withSharedDrainBudget, R as coerceWarmThroughput$1, Ri as DynamicReferenceRegionAmbiguousError, Rn as DagBuilder, Rr as buildDenyExternalAccessPolicy, Rt as resolveExplicitPhysicalId, S as PRE_DELETE_SNAPSHOT_TYPES, Si as canonicalizeRegion, Sn as malformedStateRefusalMessage, Sr as stringifyValue, St as disableInstanceApiTermination, T as createPreDeleteFinalSnapshot, Ti as processStackMessages, Tn as refuseMalformedNestedChildOutputs, Tr as createAssetRedirectResolver, Tt as carriesDynamicReference, U as bold, Ui as MalformedProducerRecordRefusalError, Un as TEMPLATE_SOURCED_RULES, Ur as dockerSpawnEnvWithSensitive, Ut as configIntegerRefusal, V as toFiniteNumber, Vi as LocalStartServiceError, Vn as STATE_SOURCED_CROSS_GENERATION_RULES, Vr as describeDockerExecFailure, Vt as coerceCfnInteger, W as cyan, Wi as NestedStackChildDirectDestroyError, Wn as carriesSecretMask, Wr as formatDockerLoginError, Wt as configStringRefusal, X as collectPublishedOutputNames, Xi as StackTerminationProtectionError, Xn as markSameGenerationBag, Xr as escapeRegExp, Xt as classifyReplaySecretRegion, Y as collectDeclaredOutputNames, Yi as StackHasActiveImportsError, Yn as isSingleDynamicReferenceToken, Yr as runDockerStreaming, Yt as requireConfigString, Z as exportAliasCollisionScrubWarning, Zn as maskSecretsInError, Zr as stripControlChars, Zt as producerRegionsFromState, _ as isSecretBearingReferenceString, _i as uploadCfnTemplate, _n as malformedOutputsRefusalMessage, _r as isReadableBag, _t as isWaitAbandonedError, a as DeploymentEventsStore, aa as isThrottlingError, ai as resolveAutoAssetStorage, an as AWS_CREDENTIAL_ENV_KEYS, ar as rebuildClientForBucketRegion, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bi as expectedOwnerParam, bn as malformedResourcePropertiesWarning, br as shouldRetainResource, bt as deleteIndeterminateGuards, c as replayFailedOperations, ca as markRedactedCause, ci as resolveStateBucketWithDefault, cn as envCredentialsAreAssumedRole, cr as forceQuitRecoveryClause, ct as createMaskedRetryLogger, d as updatePartialReason, da as safeStringify, di as stateBucketExistenceConfirmed, dn as STATE_RESOURCES_MALFORMED, dr as CUSTOM_RESOURCE_RESPONSE_PREFIX, dt as beginCommandInterruptScope, ei as Synthesizer, en as s3BucketDomainName, er as recoverMaskedOutput, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as warnDeprecatedNoPrefixCliFlag, fn as hasReadableOutputs, fr as DEFAULT_STATE_PREFIX, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as findLargeInlineResources, gn as malformedLocalOutputsWarning, gr as importableOutputs, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as MIGRATE_TMP_PREFIX, hn as malformedExportSourceWarning, hr as importableOutputKeys, ht as startInterruptWatch, i as DeploymentEventsReader, ia as isRetryableTransientError, ii as resolveApp, in as applyRoleArnIfSet, ir as S3StateBackend, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, ji as setAwsClients, jn as repairMalformedOutputsForReadOnly, jr as ensureAssetStorage, jt as isNamelessDynamicReferenceError, k as makeCanonicalizePropertiesFn, ki as getAwsClients, kn as refuseMalformedResourcesForDestroy, kr as BOOTSTRAP_MARKER_PREFIX, kt as getAccountInfo, l as replayRollback, la as retryClassificationText, li as resolveStateBucketWithDefaultAndSource, ln as DiffCalculator, lr as formatLockExpiry, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as CFN_TEMPLATE_URL_LIMIT, mn as malformedExportNamesWarning, mr as hasReadableExportSet, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, na as withErrorHandling, ni as getDefaultStateBucketName, nn as s3BucketRegionalDomainName, nr as scrubResourceRecord, nt as getCurrentResourceSecrets, o as planFailedOps, oa as isTransientServerError, oi as resolveCaptureObservedState, on as applyCallerIdentityCredentials, or as buildForceUnlockCommand, ot as ProviderRegistry, p as maskingRetryLogger, pi as CFN_TEMPLATE_BODY_LIMIT, pn as hasReadableResources, pr as exportNamesCarriedFrom, pt as interruptWatchListenerCount, q as red, qi as ResourceTimeoutError, qn as errorCauseChain, qr as redactDockerArgvValues, qt as requireConfigArray, r as DeployEngine, ra as isMarkedNonRetryable, ri as getLegacyStateBucketName, rn as s3BucketWebsiteUrl, rr as LockManager, rt as IAMRoleProvider, s as planRollback, sa as markNonRetryable, si as resolveSkipPrefix, sn as callerEnvCredentials, sr as buildLockContentionMessage, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ta as normalizeAwsError, ti as synthesisStatusMessage, tn as s3BucketDualStackDomainName, tr as redactSecretsForState, tt as secretSafeKeyDisplay, u as updatePartialMessage, ua as describeAwsFailure, ui as resolveUseCdkBootstrapAssets, un as INTRINSIC_KEYS, ur as shellQuote, ut as maskerOrIdentity, v as keptWholeReasonText, vi as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, vn as malformedOutputsWarning, vr as orphansAfterRollback, vt as slowCcOperationTimeoutMs, w as ccRoutedFinalSnapshotError, wi as AssemblyReader, wn as refuseDivergentRecordRegionForDestroy, wr as buildAssetRedirectMap, wt as IntrinsicFunctionResolver, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xi as PARTITION_TABLE, xn as malformedResourcesWarning, xr as AssetPublisher, xt as deleteSkipReason, y as mergeNoChangeOutputs, yi as decodeListingKey, yn as malformedRenderedContainersWarning, yr as orphansCarriedFrom, yt as UNSPECIFIED_SKIP_REASON, z as isWarmThroughputDecrease, zi as IntrinsicResolutionRefusalError, zn as TemplateParser, zr as buildDockerImage, zt as assertRegionMatch } from "./deploy-engine-CbIc5Y73.js";
 import { C as displaySafe, S as displayIdent, _ as withSkipPrefix, b as STACK_REF_MAX_CODE_POINTS, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, w as truncateCodePoints, x as UNRENDERABLE } from "./logger-CkHVgzLx.js";
 import { n as awsClientDefaults } from "./aws-client-defaults-BoIxyCir.js";
-import { t as getCdkdVersion } from "./version-PsB8OjhM.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-CHeJf5zw.js";
+import { t as getCdkdVersion } from "./version-yD49aCCv.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-7KM2pV3Q.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -3132,7 +3132,11 @@ async function probeStatefulRecreateTargetsAsync(targets, clients, logger = getL
 			} catch (e) {
 				if (e instanceof ResourceNotFoundException$5) {
 					let regionVerified = true;
-					const recordedRegion = foldRegion(clients.expectedRegion);
+					if (clients.expectedRegionDiverged) {
+						regionVerified = false;
+						logger.warn(`--recreate-via-cc-api / --recreate-via-sdk-provider: CloudWatch Logs reported ${target.logicalId} (log group ${target.physicalId}) missing, but this stack's state record names a region that is not the one its S3 key holds, so cdkd cannot attribute that not-found to any region — run 'cdkd state show' with --verbose to see what the record claims, and repair it. Re-run with --force-stateful-recreation if the log group really is disposable (that flag clears the data guard for every target in the run). Until then it is treated as NOT provably empty.`);
+					}
+					const recordedRegion = clients.expectedRegionDiverged ? void 0 : foldRegion(clients.expectedRegion);
 					if (recordedRegion) {
 						let clientRegion;
 						try {
@@ -17831,6 +17835,20 @@ function hasUsableDeclaredCapacity(entry) {
 */
 const PROVISIONED_CAPACITY_MEMBERS = ["ReadCapacityUnits", "WriteCapacityUnits"];
 /**
+* The two `OnDemandThroughput` members, named once for the same reason
+* {@link PROVISIONED_CAPACITY_MEMBERS} is (issue
+* [#3265](https://github.com/go-to-k/cdkd/issues/3265)). CloudFormation's
+* `OnDemandThroughput` block carries the same two members at the TABLE level
+* and inside every `GlobalSecondaryIndexes[]` entry, and all FOUR send sites
+* read them through
+* {@link DynamoDBTableProvider.coerceOnDemandCeilingsForSend}.
+*
+* Both are `Long` in the SDK model and BOTH ARE OPTIONAL — the property that
+* makes this block's drop decision differ from its `ProvisionedThroughput`
+* sibling's. See {@link DynamoDBTableProvider.warnUnusableOnDemandCeiling}.
+*/
+const ON_DEMAND_CEILING_MEMBERS = ["MaxReadRequestUnits", "MaxWriteRequestUnits"];
+/**
 * The capacity both TABLE-level forwarders substitute for a member the
 * template does not declare at all — `create()`'s `CreateTable` and the
 * BillingMode flip's `UpdateTable`. It is the pre-issue-#3147 `?? 5`, kept
@@ -18290,14 +18308,20 @@ function reverseMapSecondaryIndex(live, desired, bagInformative) {
 *    in PR review round 6; the carve-out is gone because the divergence is.
 *  - `ProvisionedThroughput` / `OnDemandThroughput` keep TRUTHINESS, which is
 *    still what their write path does: `applyGsiUpdates` gates on
-*    `gsi.ProvisionedThroughput` alone, `OnDemandThroughput` is forwarded
-*    verbatim on every path, and the `ProvisionedThroughput` coercion issue
-*    [#3255](https://github.com/go-to-k/cdkd/issues/3255) added to ALL FOUR
+*    `gsi.ProvisionedThroughput` / `gsi.OnDemandThroughput` alone, and NEITHER
+*    block's Integer coercion — `ProvisionedThroughput`'s from issue
+*    [#3255](https://github.com/go-to-k/cdkd/issues/3255), across ALL FOUR
 *    per-index send sites (`create()`'s mapper plus `applyGsiUpdates`'
-*    adopted-repair, `Create` and same-name `Update` actions) never
-*    SUPPRESSES the block — it rewrites members inside a block that is sent
-*    either way, so "would cdkd send this block" is unchanged by it, even
-*    where both members were dropped and an empty block goes out. Widening
+*    adopted-repair, `Create` and same-name `Update` actions);
+*    `OnDemandThroughput`'s from issue
+*    [#3265](https://github.com/go-to-k/cdkd/issues/3265), across its own four
+*    (the two TABLE-level forwards plus `create()`'s mapper and
+*    `applyGsiUpdates`' `Create` action) — ever SUPPRESSES the block: each
+*    rewrites members inside a block that is sent either way, so "would cdkd
+*    send this block" is unchanged by them, even where both members were
+*    dropped and an empty block goes out. That is the reason
+*    {@link DynamoDBTableProvider.coerceOnDemandCeilingsForSend} drops a
+*    MEMBER and never the block. Widening
 *    `isSendableWarmThroughput` over them would be wrong twice over — it reads
 *    members those blocks do not have (`ReadUnitsPerSecond` vs
 *    `ReadCapacityUnits`), so every declared capacity would read as undeclared.
@@ -18495,7 +18519,7 @@ var DynamoDBTableProvider = class {
 					WriteCapacityUnits: tableCapacityForSend(pt, "WriteCapacityUnits", onUnusable)
 				};
 			}
-			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = properties["OnDemandThroughput"];
+			if (properties["OnDemandThroughput"]) createParams.OnDemandThroughput = this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets);
 			const createWarmThroughput = this.coerceWarmThroughputForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
 			if (createWarmThroughput) createParams.WarmThroughput = createWarmThroughput;
 			else this.warnRefusedWarmThroughput(`AWS::DynamoDB::Table ${logicalId}`, properties["WarmThroughput"], maskSecrets);
@@ -18664,7 +18688,7 @@ var DynamoDBTableProvider = class {
 				if (properties["OnDemandThroughput"]) {
 					await this.dynamoDBClient.send(new UpdateTableCommand({
 						TableName: physicalId,
-						OnDemandThroughput: properties["OnDemandThroughput"]
+						OnDemandThroughput: this.coerceOnDemandCeilingsForSend(`AWS::DynamoDB::Table ${logicalId}`, properties["OnDemandThroughput"], maskSecrets)
 					}));
 					await this.waitForTableActiveAfterUpdate(physicalId);
 					this.logger.debug(`Updated OnDemandThroughput on DynamoDB table ${physicalId}`);
@@ -19334,7 +19358,7 @@ var DynamoDBTableProvider = class {
 				KeySchema: gsi.KeySchema,
 				Projection: gsi.Projection,
 				...gsi.ProvisionedThroughput ? { ProvisionedThroughput: this.indexCapacityForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.ProvisionedThroughput, maskSecrets) } : {},
-				...gsi.OnDemandThroughput ? { OnDemandThroughput: gsi.OnDemandThroughput } : {},
+				...gsi.OnDemandThroughput ? { OnDemandThroughput: this.coerceOnDemandCeilingsForSend(this.indexScopeAt(name, physicalId, maskSecrets), gsi.OnDemandThroughput, maskSecrets) } : {},
 				...createWarm ? { WarmThroughput: createWarm } : {}
 			} });
 		} else {
@@ -19443,16 +19467,20 @@ var DynamoDBTableProvider = class {
 		return this.coerceIndexCapacityBlock(scope, declared, maskSecrets) ?? declared;
 	}
 	/**
-	* One `CreateTable` index entry with BOTH of its throughput blocks coerced —
-	* `WarmThroughput` (PR review round 6) and `ProvisionedThroughput` (issue
-	* [#3255](https://github.com/go-to-k/cdkd/issues/3255)).
+	* One `CreateTable` index entry with ALL THREE of its throughput blocks
+	* coerced — `WarmThroughput` (PR review round 6), `ProvisionedThroughput`
+	* (issue [#3255](https://github.com/go-to-k/cdkd/issues/3255)) and
+	* `OnDemandThroughput` (issue
+	* [#3265](https://github.com/go-to-k/cdkd/issues/3265)).
 	*
 	* `create()` forwards the declared `GlobalSecondaryIndexes` array to
 	* `CreateTable`, so it is a SEND SITE for the same per-index values the
 	* update path coerces. `WarmThroughput` was the one the round-5 sweep
 	* missed; `ProvisionedThroughput` was missed by round 6 AND by issue #3147's
-	* own enumeration, because this forwarder is a CAST rather than a call, so
-	* neither sweep's grep could see it. The BillingMode flip's per-index reader
+	* own enumeration; `OnDemandThroughput` was missed a THIRD time, by #3265's
+	* own three-site grep — all for one reason, that this forwarder is a CAST
+	* rather than a call, so no sweep's grep could see it. The
+	* BillingMode flip's per-index reader
 	* ({@link readCapacityNumber}) has been on the grammar since #3147, so until
 	* now create and flip disagreed about the same property: a CFn-legal
 	* `ReadCapacityUnits: '7'` reached `CreateTable` as a STRING in a `number`
@@ -19464,18 +19492,20 @@ var DynamoDBTableProvider = class {
 	* and a provider that edits it in place would change what state reports cdkd
 	* sent.
 	*
-	* An entry that is not a plain object, and one declaring NEITHER throughput
-	* block, is returned UNCHANGED — identity included. An entry that DOES
-	* declare one is rebuilt whenever that block's coercion changes anything;
-	* the `WarmThroughput` half rebuilds even for an already-numeric value,
-	* which is pre-existing behaviour and costs one spread per declared block.
+	* An entry that is not a plain object, and one declaring NONE of the three
+	* throughput blocks, is returned UNCHANGED — identity included. An entry that
+	* DOES declare one is rebuilt whenever that block's coercion changes
+	* anything; the `WarmThroughput` half rebuilds even for an already-numeric
+	* value, which is pre-existing behaviour and costs one spread per declared
+	* block.
 	*/
 	coerceIndexThroughputForCreate(logicalId, entry, maskSecrets = (text) => text) {
 		if (typeof entry !== "object" || entry === null || Array.isArray(entry)) return entry;
 		const bag = entry;
 		const declaredWarm = bag["WarmThroughput"];
 		const declaredCapacity = bag["ProvisionedThroughput"];
-		if (declaredWarm === void 0 && !isPlainCapacityBlock(declaredCapacity)) return entry;
+		const declaredOnDemand = bag["OnDemandThroughput"];
+		if (declaredWarm === void 0 && !isPlainCapacityBlock(declaredCapacity) && !isPlainCapacityBlock(declaredOnDemand)) return entry;
 		const scope = this.indexScope(entry.IndexName, logicalId, maskSecrets);
 		let out = entry;
 		if (declaredWarm !== void 0) {
@@ -19494,6 +19524,13 @@ var DynamoDBTableProvider = class {
 			...out,
 			ProvisionedThroughput: capacity
 		};
+		if (isPlainCapacityBlock(declaredOnDemand)) {
+			const onDemand = this.coerceOnDemandCeilingsForSend(scope, declaredOnDemand, maskSecrets);
+			if (onDemand !== declaredOnDemand) out = {
+				...out,
+				OnDemandThroughput: onDemand
+			};
+		}
 		return out;
 	}
 	/**
@@ -19535,9 +19572,14 @@ var DynamoDBTableProvider = class {
 	*    the template had declared it, with no later call to correct it. Only
 	*    the TABLE level defaults.
 	*  - **A block that is not a plain object is forwarded VERBATIM**, the
-	*    fail-OPEN direction this file takes everywhere: an unresolved intrinsic
-	*    or a mis-nested template value is AWS's to reject by name, and that is
-	*    also the pre-existing behaviour of this forwarder.
+	*    fail-OPEN direction this file takes everywhere: a STRING, a NUMBER or an
+	*    ARRAY block is AWS's to reject by name, and that is also the pre-existing
+	*    behaviour of this forwarder. An unresolved intrinsic (`{Ref: 'X'}`) is
+	*    NOT an example of it — that IS a plain object, so it takes the member
+	*    loop and survives through the preserve-unknown-member rule below. Same
+	*    destination, different route; corrected by the review of issue
+	*    [#3265](https://github.com/go-to-k/cdkd/issues/3265), which found the
+	*    wrong example here and at {@link coerceOnDemandCeilingsForSend}.
 	*
 	* A member name the grammar does not know is preserved untouched, for the
 	* same fail-open reason — a misspelled `ReadCapacityUnit` reaches AWS and is
@@ -19560,6 +19602,178 @@ var DynamoDBTableProvider = class {
 		return rewritten;
 	}
 	/**
+	* One `OnDemandThroughput` block for the wire, with each DECLARED member read
+	* through CloudFormation's DynamoDB Integer grammar (issue
+	* [#3265](https://github.com/go-to-k/cdkd/issues/3265)).
+	*
+	* Called from ALL FOUR send sites, which is the whole point — the block was
+	* forwarded VERBATIM at every one of them, so a CFn-legal
+	* `MaxReadRequestUnits: '100'` reached AWS as the STRING `"100"` in a `Long`
+	* field and the request failed, while a `' 100 '` / `'0x64'` / `'1e2'`
+	* CloudFormation refuses the template for was forwarded unchanged. The sites:
+	*
+	*  1. `create()`'s TABLE-level `CreateTable.OnDemandThroughput`;
+	*  2. `create()`'s PER-INDEX `CreateTable.GlobalSecondaryIndexes[]` forward,
+	*     through {@link coerceIndexThroughputForCreate} — a CAST of the whole
+	*     entry array rather than a named `OnDemandThroughput` expression, which
+	*     is why issue #3265's own grep enumerated three sites and not four (the
+	*     same blind spot that hid this forwarder from issue #3147's sweep and
+	*     from #3255's round 6, one property over);
+	*  3. `update()`'s TABLE-level `UpdateTable.OnDemandThroughput`;
+	*  4. `applyGsiUpdates`' per-index `Create` action.
+	*
+	* FOUR and not six: `UpdateGlobalSecondaryIndexAction` declares
+	* `OnDemandThroughput` too, and neither the adopted-index repair nor the
+	* same-name `Update` arm ever sets it — so a ceiling EDIT on a live index is
+	* silently discarded today. That is a MISSING SEND rather than a grammar
+	* defect, so it is not routed here; issue
+	* [#3287](https://github.com/go-to-k/cdkd/issues/3287) holds it, and it will
+	* read through this function when it lands.
+	*
+	* THREE decisions, each with a plausible alternative:
+	*
+	*  - **A rejected spelling drops the MEMBER, never the BLOCK.** The same
+	*    DECISION {@link coerceIndexCapacityBlock} and {@link tableCapacityForSend}
+	*    already take one property over, so this file's capacity and ceiling
+	*    families answer identically about one template value; it keeps a sibling
+	*    member the template spelled LEGALLY; and it leaves `indexDeclares`'
+	*    TRUTHINESS gate ("would cdkd SEND this block") true without
+	*    qualification, so the #1767 drift-side predicate needs no new arm. An
+	*    all-rejected block therefore goes out EMPTY, as the capacity sibling's
+	*    does. ("The same decision", NOT the same SIGNATURE — the capacity
+	*    sibling answers `undefined` for "nothing to rewrite" while this one
+	*    returns the declared block by IDENTITY. The review of this issue caught
+	*    an earlier "byte for byte the shape" here, which was false and is the
+	*    kind of claim that invites a caller to swap one for the other.)
+	*  - **What a rejected spelling COSTS differs from the capacity sibling's,
+	*    and it is stated at {@link warnUnusableOnDemandCeiling} rather than
+	*    assumed.** Both `OnDemandThroughput` members are SDK-optional, so
+	*    DynamoDB does not necessarily reject a request that omits one — which is
+	*    why the announcement cannot reuse the capacity wording, which promises
+	*    AWS will name the member. **It is NOT a promise of success either**, and
+	*    an earlier revision made it one: the outcome is per PATH (create leaves
+	*    no maximum, update KEEPS the live one since only `-1` removes it) and an
+	*    ALL-rejected block is documented invalid at every one of the four send
+	*    positions ("you must specify `MaxReadRequestUnits`,
+	*    `MaxWriteRequestUnits`, or both"), so that request should FAIL. cdkd has
+	*    not measured the empty-block send against live DynamoDB; the message
+	*    under-claims accordingly.
+	*  - **A block that is not a plain object is forwarded VERBATIM**, the
+	*    fail-OPEN direction this file takes everywhere: a STRING, a NUMBER or an
+	*    ARRAY `OnDemandThroughput` is AWS's to reject by name, and that is the
+	*    pre-existing behaviour of every one of these forwarders. Note what this
+	*    arm does NOT cover: an unresolved intrinsic (`{Ref: 'X'}`) IS a plain
+	*    object, so it takes the member loop instead and survives through the
+	*    preserve-unknown-member rule below — same destination, different route.
+	*    {@link isPlainCapacityBlock}'s own doc is the authority; the review of
+	*    this issue found that example wrong here and at
+	*    {@link coerceIndexCapacityBlock}.
+	*
+	* A member name the grammar does not know is preserved untouched, for the
+	* same fail-open reason. Returns the DECLARED object by IDENTITY when nothing
+	* needs rewriting, so a numeric template rebuilds nothing and
+	* {@link coerceIndexThroughputForCreate} can tell "unchanged" from "rewritten"
+	* without a structural compare.
+	*
+	* **Known residual, deliberately not closed here.** Wherever the call
+	* SUCCEEDS, state records the spelling the TEMPLATE declared while AWS holds
+	* a different ceiling (none on a create, the previous one on an update) — the
+	* permanent phantom-drift class
+	* `.claude/rules/provider-property-fidelity.md` covers, which
+	* {@link coerceIndexCapacityBlock} escapes only because ITS drop makes AWS
+	* fail. Closing it needs `effectiveProperties` AND its
+	* `canonicalizeDesiredProperties` twin (the rule requires the pair; shipping
+	* the first alone re-issues a no-op `UpdateTable` on every later deploy), and
+	* this provider implements neither today. Tracked as issue
+	* [#3286](https://github.com/go-to-k/cdkd/issues/3286); the warning names the
+	* residual so a user is not left to discover it from a `cdkd drift` line. The
+	* `AWS::DynamoDB::GlobalTable` sibling answers the SAME way for the same
+	* spelling — `collectTableOnDemandCeilings` coerces through
+	* `coerceCfnInteger` and a rejected ceiling is reported and LEFT UNSENT, with
+	* AWS untouched and no substituted value (its 5/5 FALLBACK is its PROVISIONED
+	* capacity answer, not its ceiling one) — so the two types do not diverge.
+	*/
+	coerceOnDemandCeilingsForSend(scope, declared, maskSecrets) {
+		if (!isPlainCapacityBlock(declared)) return declared;
+		const block = declared;
+		let rewritten;
+		for (const member of ON_DEMAND_CEILING_MEMBERS) {
+			if (!(member in block)) continue;
+			const coerced = coerceCfnInteger(block[member]);
+			if (coerced === block[member]) continue;
+			rewritten ??= { ...block };
+			if (coerced === void 0) {
+				this.warnUnusableOnDemandCeiling(scope, member, block[member], maskSecrets);
+				delete rewritten[member];
+			} else rewritten[member] = coerced;
+		}
+		return rewritten ?? block;
+	}
+	/**
+	* Announce an `OnDemandThroughput` member a forwarder DROPPED (issue
+	* [#3265](https://github.com/go-to-k/cdkd/issues/3265)).
+	*
+	* A SEPARATE sentence from {@link warnUnusableProvisionedCapacity}, and the
+	* difference is the load-bearing part rather than a wording preference: that
+	* one can promise "DynamoDB will reject the request naming this member",
+	* because both `ProvisionedThroughput` members are REQUIRED wherever the
+	* block is declared. Both `OnDemandThroughput` members are OPTIONAL, so the
+	* same promise would send the user looking for a failure that may never come.
+	*
+	* What it says instead is PER PATH, because the outcome genuinely differs and
+	* an earlier revision of this message asserted ONE outcome for all of them —
+	* wrongly in both directions (the review of this issue):
+	*
+	*  - on a CREATE the table comes up with no maximum for the dropped half;
+	*  - on an UPDATE DynamoDB KEEPS whatever maximum the table already carries.
+	*    Omitting a member is NOT "no maximum" there — `-1` is AWS's documented
+	*    way to REMOVE one (`OnDemandThroughput`'s own SDK model doc), so a
+	*    dropped member silently leaves the live ceiling in force;
+	*  - when NO member survived, the block {@link coerceOnDemandCeilingsForSend}
+	*    sends is EMPTY. AWS's model says at all four of this provider's send
+	*    positions that "if you use this parameter, you must specify
+	*    `MaxReadRequestUnits`, `MaxWriteRequestUnits`, or both", which reads
+	*    like a LOUD failure — and it is NOT enforced.
+	*
+	*    MEASURED us-east-1 2026-09-17, on the go-to-k/cdkd#3291 review's
+	*    request: `CreateTable` with `OnDemandThroughput: {}` and
+	*    `BillingMode: PAY_PER_REQUEST` is ACCEPTED, the table reaches ACTIVE,
+	*    and `DescribeTable` reports NO `OnDemandThroughput` at all. So the
+	*    all-rejected case is the SILENT one, not the loud one: the deploy goes
+	*    green with no ceiling applied.
+	*
+	*    That matters because it is a REGRESSION IN LOUDNESS introduced by this
+	*    very change. Before it, a `' 100 '` reached AWS as a string in a Long
+	*    field and the request FAILED, certainly. After it, the value is dropped
+	*    and the deploy succeeds. The warning is therefore the ONLY signal a user
+	*    gets for the all-rejected case, which is why it is emitted per member
+	*    and why its text was corrected to say so rather than to promise a
+	*    failure that does not come.
+	*
+	* The caller cannot tell the three cases apart from inside the member loop,
+	* so the message names all three rather than asserting the one it cannot
+	* know.
+	*
+	* And it names the residual: where the request does succeed, state keeps the
+	* spelling the template declared and `cdkd drift` reports it until the
+	* template is corrected. `-1` is called out because a user who meant the
+	* removal must not read "spell it as a decimal integer" as excluding it.
+	*
+	* The CloudFormation clause is HEDGED ("is expected to"), and deliberately.
+	* The live A/B that settled this grammar was run on
+	* `ProvisionedThroughput.ReadCapacityUnits`, not on `MaxReadRequestUnits`.
+	* Both are Integer members of the same type validated at the same properties
+	* layer, so the extrapolation is sound and is what issue #3265 reasons from --
+	* but it IS an extrapolation, and a user-facing string asserting it flatly
+	* about an unmeasured property would be the kind of claim nothing downstream
+	* re-checks. Measure it and the hedge can go. Raised by the
+	* go-to-k/cdkd#3291 spec review.
+	*/
+	warnUnusableOnDemandCeiling(scope, member, raw, maskSecrets) {
+		const warn = (message) => this.logger.warn(maskSecrets(message));
+		warn(`${scope}: OnDemandThroughput.${member} ${JSON.stringify(maskLeafValue$1(raw, maskSecrets))} is not an Integer CloudFormation accepts (an optional sign and decimal digits only — no surrounding whitespace, hex, exponent or decimal point), so it was NOT sent and NO ceiling was substituted for it. Both OnDemandThroughput members are OPTIONAL to DynamoDB, so — unlike a ProvisionedThroughput member — AWS does not necessarily reject the request, and what happens next depends on the path: a CREATE gets no maximum for this half; an UPDATE KEEPS whatever maximum the table already carries, since only an explicit -1 removes one; and if NEITHER member was usable the block is sent EMPTY, which AWS ACCEPTS (measured us-east-1 2026-09-17) and stores as no maximum at all, so the deploy SUCCEEDS with no ceiling applied. cdkd's state keeps the value the template declared and \`cdkd drift\` reports the difference until the template is corrected; CloudFormation is expected to refuse the same template at properties validation. Check for an unresolved intrinsic, or spell the value as a decimal integer (\`-1\` removes an existing maximum).`);
+	}
+	/**
 	* Announce a `ProvisionedThroughput` member a forwarder DROPPED (issue
 	* [#3147](https://github.com/go-to-k/cdkd/issues/3147); widened to the
 	* per-index create forwarder by issue
@@ -62206,6 +62420,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 	const guardIndeterminateTargets = /* @__PURE__ */ new Set();
 	const regionForState = state.region ?? ctx.baseRegion;
 	refuseMalformedResourcesForDestroy(state, stackName, regionForState);
+	refuseDivergentRecordRegionForDestroy(state, stackName, regionForState, ctx.divergentBodyRegion);
 	const resourceCount = Object.keys(state.resources).length;
 	const orphanCount = (state.orphans ?? []).length;
 	refuseMalformedOutputsForDestroy(state, stackName, regionForState);
@@ -62265,7 +62480,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			try {
 				await ctx.lockManager.releaseLock(stackName, regionForState);
 			} catch (releaseErr) {
-				logger.warn(`Failed to release lock after empty-state cleanup: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+				logger.warn(`Failed to release lock after empty-state cleanup: ${describeAwsFailure(releaseErr).detail}`);
 			} finally {
 				process.removeListener("SIGINT", emptySigintHandler);
 			}
@@ -62324,7 +62539,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 		try {
 			switchedClients?.destroy();
 		} catch (destroyError) {
-			logger.debug(`Failed to destroy region-scoped AWS clients: ${destroyError instanceof Error ? destroyError.message : String(destroyError)}`);
+			logger.debug(`Failed to destroy region-scoped AWS clients: ${describeAwsFailure(destroyError).detail}`);
 		}
 	};
 	if (stackRegion && stackRegion !== ctx.baseRegion) {
@@ -62393,7 +62608,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			try {
 				await ctx.lockManager.releaseLock(stackName, regionForState);
 			} catch (releaseErr) {
-				logger.warn(`Failed to release lock after strong-ref refusal/failure: ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+				logger.warn(`Failed to release lock after strong-ref refusal/failure: ${describeAwsFailure(releaseErr).detail}`);
 			}
 			restoreBaseRegionAndClients();
 			process.removeListener("SIGINT", sigintHandler);
@@ -62433,7 +62648,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 				await ctx.stateBackend.saveState(stackName, regionForState, buildDestroySnapshot());
 				logger.debug(`State persisted after deleting ${logicalId}`);
 			} catch (error) {
-				logger.warn(`Failed to persist state after deleting ${logicalId} (continuing): ${error instanceof Error ? error.message : String(error)}`);
+				logger.warn(`Failed to persist state after deleting ${logicalId} (continuing): ${describeAwsFailure(error).detail}`);
 			}
 		});
 	};
@@ -62629,7 +62844,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 					persistStateAfterDelete(logicalId);
 				} catch (error) {
 					renderer.removeTask(logicalId);
-					const msg = error instanceof Error ? error.message : String(error);
+					const msg = describeAwsFailure(error).detail;
 					if (!isInterruptedWaitError(error) && !isFinalSnapshotError(error) && !isMarkedNonRetryable(error) && !isWaitAbandonedError(error) && (msg.includes("does not exist") || msg.includes("not found") || msg.includes("No policy found") || msg.includes("NoSuchEntity") || msg.includes("NotFoundException"))) {
 						logger.debug(`  ${logicalId} already deleted, removing from state`);
 						result.deletedCount++;
@@ -62661,7 +62876,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 							error: extractDeploymentEventError(wrapped)
 						});
 					} else {
-						logger.error(`  ✗ Failed to delete ${logicalId}:`, String(error));
+						logger.error(`  ✗ Failed to delete ${logicalId}:`, safeStringify(error));
 						result.errorCount++;
 						failedStateTargets.add(stateTargetFor(logicalId, resource.resourceType));
 						ctx.eventRecorder?.record({
@@ -62693,7 +62908,7 @@ async function runDestroyForStack(stackName, state, ctx) {
 			try {
 				await ctx.stateBackend.saveState(stackName, regionForState, buildDestroySnapshot());
 			} catch (error) {
-				logger.warn(`Failed to persist remaining state after partial destroy: ${error instanceof Error ? error.message : String(error)}. The state file may still list already-deleted resources; a re-run resolves them idempotently.`);
+				logger.warn(`Failed to persist remaining state after partial destroy: ${describeAwsFailure(error).detail}. The state file may still list already-deleted resources; a re-run resolves them idempotently.`);
 			}
 			if (result.interrupted) logger.warn(`Destroy interrupted — ${Object.keys(remainingResources).length} resource(s) not deleted. State preserved.`);
 			else if (result.errorCount > 0) logger.warn(`${result.errorCount} resource(s) failed to delete. State preserved.`);
@@ -62724,14 +62939,14 @@ async function runDestroyForStack(stackName, state, ctx) {
 			try {
 				renderer.stop();
 			} catch (rendererError) {
-				logger.debug(`Live renderer teardown failed (continuing to release the lock): ${rendererError instanceof Error ? rendererError.message : String(rendererError)}`);
+				logger.debug(`Live renderer teardown failed (continuing to release the lock): ${describeAwsFailure(rendererError).detail}`);
 			}
 			await saveChain;
 			logger.debug("Releasing lock...");
 			try {
 				await ctx.lockManager.releaseLock(stackName, regionForState);
 			} catch (releaseErr) {
-				logger.warn(`Failed to release lock for stack '${stackName}': ${releaseErr instanceof Error ? releaseErr.message : String(releaseErr)}`);
+				logger.warn(`Failed to release lock for stack '${stackName}': ${describeAwsFailure(releaseErr).detail}`);
 			}
 		} finally {
 			process.removeListener("SIGINT", sigintHandler);
@@ -63004,6 +63219,7 @@ var NestedStackProvider = class {
 			providerRegistry: ctx.providerRegistry,
 			baseAwsClients: ctx.awsClients,
 			baseRegion: childRegion,
+			...childStateData.divergentBodyRegion !== void 0 && { divergentBodyRegion: childStateData.divergentBodyRegion },
 			stateBucket: ctx.stateBucket,
 			skipConfirmation: true,
 			...ctx.exportIndexStore && { exportIndexStore: ctx.exportIndexStore },
@@ -64378,7 +64594,8 @@ async function deployCommand(stacks, options) {
 						clients: {
 							s3: stackAwsClients.s3,
 							cloudWatchLogs: stackAwsClients.cloudWatchLogs,
-							expectedRegion: stateForRecreateCheck?.state.region
+							expectedRegion: stateForRecreateCheck?.state.region,
+							...stateForRecreateCheck?.divergentBodyRegion !== void 0 && { expectedRegionDiverged: true }
 						},
 						forceStatefulRecreation: options.forceStatefulRecreation ?? false
 					});
@@ -69889,6 +70106,28 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				state: scrubbed
 			};
 		});
+		const crossStackNeedles = allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets);
+		const redactCrossStackName = (name) => redactSecretsForState(name, crossStackNeedles);
+		const newImports = state.imports?.map((entry) => {
+			const exportName = redactCrossStackName(entry.exportName);
+			if (exportName === entry.exportName) return entry;
+			recordsChanged++;
+			return {
+				...entry,
+				exportName
+			};
+		});
+		const newOutputReads = state.outputReads?.map((entry) => {
+			const sourceStack = redactCrossStackName(entry.sourceStack);
+			const outputName = redactCrossStackName(entry.outputName);
+			if (sourceStack === entry.sourceStack && outputName === entry.outputName) return entry;
+			recordsChanged++;
+			return {
+				...entry,
+				sourceStack,
+				outputName
+			};
+		});
 		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
 		emitAbandonedScanNotes();
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
@@ -69898,6 +70137,8 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				...carriedState,
 				resources: newResources,
 				...state.orphans !== void 0 && { orphans: newOrphans },
+				...newImports !== void 0 && { imports: newImports },
+				...newOutputReads !== void 0 && { outputReads: newOutputReads },
 				outputs: newOutputs,
 				lastModified: Date.now()
 			};
@@ -74363,6 +74604,7 @@ async function destroyCommand(stackArgs, options) {
 					providerRegistry,
 					baseAwsClients: awsClients,
 					baseRegion: region,
+					...stateResult.divergentBodyRegion !== void 0 && { divergentBodyRegion: stateResult.divergentBodyRegion },
 					...options.profile && { profile: options.profile },
 					stateBucket,
 					statePrefix: options.statePrefix,
@@ -76117,10 +76359,10 @@ async function exportCommand(stackArg, options) {
 		}
 		const cfnStackName = options.cfnStackName ?? resolvedStackName;
 		const targetRegion = await pickStackRegion$1(stateBackend, resolvedStackName, synthedRegion, options.stackRegion);
-		logger.info(`Migrating cdkd stack '${resolvedStackName}' (${targetRegion}) → CloudFormation stack '${cfnStackName}'`);
+		logger.info(`Migrating cdkd stack '${resolvedStackName}' (${safeSegment(targetRegion)}) → CloudFormation stack '${cfnStackName}'`);
 		await assertCfnStackAbsent(awsClients.cloudFormation, cfnStackName);
 		const stateData = await stateBackend.getState(resolvedStackName, targetRegion);
-		if (!stateData) throw new Error(`No cdkd state found for stack '${resolvedStackName}' (${targetRegion}). Nothing to migrate.`);
+		if (!stateData) throw new Error(`No cdkd state found for stack '${resolvedStackName}' (${safeSegment(targetRegion)}). Nothing to migrate.`);
 		const { state, etag, migrationPending } = stateData;
 		const exportJournal = await stateBackend.loadRollbackJournal(resolvedStackName, targetRegion);
 		if (exportJournal && exportJournal.segments.length > 0) {
@@ -76237,7 +76479,7 @@ async function exportCommand(stackArg, options) {
 				const phase2Note = phase2Creates.length > 0 ? ` Phase 2 will then CREATE ${phase2Creates.length} non-importable resource(s) (invoking each Custom Resource's onCreate handler).` : "";
 				const recreateNote = recreateBeforePhase2.length > 0 ? ` cdkd will also DELETE ${recreateBeforePhase2.length} AWS resource(s) between phases so CFn can re-CREATE them in phase 2 (brief unavailability window — see plan above for the affected resources).` : "";
 				const unchangedClaim = recreateBeforePhase2.length > 0 ? ` All other AWS resources are unchanged on import.` : ` AWS resources are unchanged on import.`;
-				if (!await confirmPrompt$3(`Create CloudFormation stack '${cfnStackName}' by importing ${phase1Imports.length} resource(s) from cdkd state '${resolvedStackName}' (${targetRegion})?` + phase2Note + recreateNote + unchangedClaim + ` cdkd state for '${resolvedStackName}' will be deleted on success.`)) {
+				if (!await confirmPrompt$3(`Create CloudFormation stack '${cfnStackName}' by importing ${phase1Imports.length} resource(s) from cdkd state '${resolvedStackName}' (${safeSegment(targetRegion)})?` + phase2Note + recreateNote + unchangedClaim + ` cdkd state for '${resolvedStackName}' will be deleted on success.`)) {
 					logger.info("Migration cancelled. cdkd state and CloudFormation are unchanged.");
 					return;
 				}
@@ -76272,7 +76514,7 @@ async function exportCommand(stackArg, options) {
 					logger.info(`  ✓ deleted ${entry.physicalId}`);
 				} catch (err) {
 					const msg = err instanceof Error ? err.message : String(err);
-					throw new Error(`Phase 1 (IMPORT) succeeded; pre-delete of ${entry.logicalId} (${entry.resourceType}, physicalId: ${entry.physicalId}) failed: ${msg}\n\nThe CloudFormation stack '${cfnStackName}' contains the phase-1 imports but the IMPORT-unsupported resources (${recreateBeforePhase2.length} total) still exist in AWS unmanaged. cdkd state is UNCHANGED. Re-running \`cdkd export\` does NOT work — the existing-stack check rejects it. To recover manually:\n  1. Fix the failure cause (typically IAM permissions for the underlying      AWS API — e.g. apigatewayv2:DeleteStage for AWS::ApiGatewayV2::Stage).\n  2. Delete the remaining AWS-side IMPORT-unsupported resources by hand:\n       aws apigatewayv2 delete-stage --api-id <ApiId> --stage-name <StageName>\n     (one per entry in the pre-delete list logged above).\n  3. Run the phase-2 UPDATE manually with the full synth template:\n       aws cloudformation create-change-set --stack-name ${cfnStackName} \\\n         --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\\n         --template-body file://<full-template.json>\n  4. Once phase 2 succeeds, run: cdkd state orphan ${resolvedStackName}\n     to clean up cdkd's stale state record.`);
+					throw new Error(`Phase 1 (IMPORT) succeeded; pre-delete of ${entry.logicalId} (${entry.resourceType}, physicalId: ${entry.physicalId}) failed: ${msg}\n\nThe CloudFormation stack '${cfnStackName}' contains the phase-1 imports but the IMPORT-unsupported resources (${recreateBeforePhase2.length} total) still exist in AWS unmanaged. cdkd state is UNCHANGED. Re-running \`cdkd export\` does NOT work — the existing-stack check rejects it. To recover manually:\n  1. Fix the failure cause (typically IAM permissions for the underlying      AWS API — e.g. apigatewayv2:DeleteStage for AWS::ApiGatewayV2::Stage).\n  2. Delete the remaining AWS-side IMPORT-unsupported resources by hand:\n       aws apigatewayv2 delete-stage --api-id <ApiId> --stage-name <StageName>\n     (one per entry in the pre-delete list logged above).\n  3. Run the phase-2 UPDATE manually with the full synth template:\n       aws cloudformation create-change-set --stack-name ${cfnStackName} \\\n         --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\\n         --template-body file://<full-template.json>\n  4. Once phase 2 succeeds, run: ${orphanCommandFor(resolvedStackName, targetRegion)}\n     to clean up cdkd's stale state record.`);
 				}
 			}
 			const phase2Count = phase2Creates.length + recreateBeforePhase2.length;
@@ -76291,10 +76533,10 @@ async function exportCommand(stackArg, options) {
 				const recreateNote = recreateBeforePhase2.length > 0 ? `  - cdkd deleted ${recreateBeforePhase2.length} AWS resource(s) before phase 2 (Stage etc.). They are gone in AWS but absent from the CFn stack. Running phase 2 UPDATE manually will CFn-CREATE them fresh.\n` : "";
 				throw new Error(`Phase 1 (IMPORT) succeeded; phase 2 (UPDATE) failed: ${msg}\n\nThe CloudFormation stack '${cfnStackName}' now contains the imported resources but is missing ${phase2Count} resource(s) (${phase2Creates.length} Custom Resource(s) + ${recreateBeforePhase2.length} IMPORT-unsupported). cdkd state is UNCHANGED so you can inspect what's in it, but DO NOT run \`cdkd deploy\` against this stack (the imported resources are now CFn-managed). To recover:\n` + recreateNote + `  1. Fix the failure cause (typically an onCreate Lambda error).
   2. Re-run the phase 2 UPDATE manually with the full synth template:
-       aws cloudformation create-change-set --stack-name ${cfnStackName} \\\n         --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\\n         --template-body file://<full-template.json>\n  3. Once phase 2 succeeds, run: cdkd state orphan ${resolvedStackName}\n     to clean up cdkd's stale state record.`);
+       aws cloudformation create-change-set --stack-name ${cfnStackName} \\\n         --change-set-name cdkd-phase2-retry --change-set-type UPDATE \\\n         --template-body file://<full-template.json>\n  3. Once phase 2 succeeds, run: ${orphanCommandFor(resolvedStackName, targetRegion)}\n     to clean up cdkd's stale state record.`);
 			}
 			await stateBackend.deleteState(resolvedStackName, targetRegion);
-			logger.info(`cdkd state for '${resolvedStackName}' (${targetRegion}) removed. Manage the stack with 'cdk deploy' or 'aws cloudformation' from here on.`);
+			logger.info(`cdkd state for '${resolvedStackName}' (${safeSegment(targetRegion)}) removed. Manage the stack with 'cdk deploy' or 'aws cloudformation' from here on.`);
 			printNextSteps({
 				cfnStackName,
 				cdkStackName: resolvedStackName,
@@ -76322,7 +76564,7 @@ async function pickStackRegion$1(stateBackend, stackName, synthRegion, flag) {
 	}
 	if (flag) {
 		if (!refs.find((r) => r.region === flag)) {
-			const seen = refs.map((r) => r.region ?? "(legacy)").join(", ");
+			const seen = refs.map((r) => safeSegment(r.region ?? "(legacy)")).join(", ");
 			throw new Error(`No state found for stack '${stackName}' in region '${flag}'. Available regions: ${seen}.`);
 		}
 		return flag;
@@ -76331,7 +76573,7 @@ async function pickStackRegion$1(stateBackend, stackName, synthRegion, flag) {
 		if (refs.find((r) => r.region === synthRegion)) return synthRegion;
 	}
 	if (refs.length === 1) return refs[0].region ?? synthRegion ?? "";
-	const regions = refs.map((r) => r.region ?? "(legacy)").join(", ");
+	const regions = refs.map((r) => safeSegment(r.region ?? "(legacy)")).join(", ");
 	throw new Error(`Stack '${stackName}' has state in multiple regions: ${regions}. Re-run with --stack-region <region> to disambiguate.`);
 }
 function parseTemplateFile(path) {
@@ -76395,9 +76637,81 @@ function isPhase2CreatableType(resourceType) {
 * Module-scoped rather than local to the walker: the first cut of this change
 * guarded the walker's two refusals and left the root one, which is the shape
 * the issue is about.
+*
+* The parameter is `unknown`, not `string | undefined`, because a record-body
+* value is only TYPED as a string: the region-mismatch refusal below has
+* rendered `{"toString": null}` since issue #2947, and `getState`'s
+* `divergentBodyRegion` (#3328) is declared honestly as `unknown`.
+* `displaySafe` has always accepted `unknown` and coerces totally, so this
+* widens the signature to what the function already did.
+*
+* CAPPED as well as sanitized, since go-to-k/cdkd#3328 review round 2. Every
+* value reaching here is a state-record field or an S3 key segment, so a
+* planted multi-kilobyte one — or an ARRAY, which `String` comma-joins with no
+* bound — pushes the rest of the refusal off the reader's screen. The bound is
+* the STATE-RECORD grammar rather than `IDENT_MAX_CODE_POINTS` because a
+* legitimate multi-level nested-child stack name runs past 255 code points,
+* and this function renders those; `truncateCodePoints` so a cut never lands
+* inside a surrogate pair.
 */
 function safeSegment(value) {
-	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
+	const safe = displaySafe(value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, STACK_REF_MAX_CODE_POINTS);
+	return truncated ? `${text} [cut: ${safe.length - text.length} more characters withheld]` : text;
+}
+/**
+* The free-form counterpart of {@link safeSegment}: an AWS error message, not
+* an identifier.
+*
+* **Its BEHAVIOUR is identical today, and the separation is about the CALLER's
+* contract rather than about the transformation** — stated plainly because an
+* earlier revision of this comment claimed a "tighter cap" for identifiers that
+* does not exist, and a false distinction is worse than none. What differs is
+* what a caller may DO with the result: `safeSegment`'s callers compare it
+* against the raw value to decide whether an identity renders EXACTLY
+* ({@link orphanCommandFor}), which is meaningless for a sentence; and
+* `display-safe.ts` says its identifier helpers are not for free-form text, so
+* routing a message through the one named `Segment` invites the next reader to
+* give it the identifier grammar's cap. Both sanitize with the ASCII allowlist
+* and bound the length, because both are untrusted text bound for a terminal.
+*/
+function safeDetail(value) {
+	const safe = displaySafe(value instanceof Error ? value.message : value, { asciiOnly: true });
+	if (!safe) return UNRENDERABLE;
+	const { text, truncated } = truncateCodePoints(safe, STACK_REF_MAX_CODE_POINTS);
+	return truncated ? `${text} [cut: ${safe.length - text.length} more characters withheld]` : text;
+}
+/**
+* A `cdkd state orphan` line for a record-derived stack name — PASTEABLE only
+* when that name renders EXACTLY, and a template otherwise (issue
+* [#3328](https://github.com/go-to-k/cdkd/issues/3328), review round 3).
+*
+* Three messages in this file suggested that command with a name minted from
+* `Object.keys(state.resources)` (`walkCdkdStateStackTree` builds
+* `` `${parent}~${logicalId}` ``), i.e. body content anyone able to write one
+* state key chooses. Two rendered it RAW, so a newline or a CSI sequence in a
+* logical id forged whole lines around a DELETE command; the third sanitized
+* but did not shell-quote, so `'`, `;`, `|` and `` ` `` survived into a line an
+* operator pastes into a shell.
+*
+* Both halves of `malformed-resources-bag.ts`'s rule, and for its reasons:
+* sanitize THEN shell-quote, and gate the substituted form on the identity
+* rendering exactly — `displaySafe` TRIMS, so a name ending in a space renders
+* byte-identically to a healthy sibling, and `state orphan` DELETES a record.
+* Every caller emits the result LAST and unwrapped so the quoting composes; that
+* is an instruction to the CALLER and must not leak into the message it builds.
+*
+* `region` is REQUIRED even though the flag is optional on the command: omitting
+* `--stack-region` makes `state orphan` drop the record for that name in EVERY
+* region, which is wider than any of these messages describes. A helper whose
+* job is to make a destructive suggestion safe should not have an arm that
+* widens one.
+*/
+function orphanCommandFor(stackName, region) {
+	const shownStack = safeSegment(stackName);
+	if (!(typeof stackName === "string" && shownStack === stackName && typeof region === "string" && safeSegment(region) === region)) return "cdkd state orphan <stack> --stack-region <region> — spelled out because this record's name or region does NOT render exactly, so another record may render identically; list them as stored with 'cdkd state list --long' and act on the one whose key matches";
+	return `cdkd state orphan ${shellQuote(shownStack)} --stack-region ${shellQuote(safeSegment(region))}`;
 }
 /**
 * Recursively load the cdkd-state tree rooted at `(rootStackName, region)`.
@@ -76452,8 +76766,8 @@ async function walkCdkdStateStackTree(stackName, region, state, stateBackend) {
 		if (entry?.resourceType !== "AWS::CloudFormation::Stack") continue;
 		const childStackName = `${stackName}~${logicalId}`;
 		const childResult = await stateBackend.getState(childStackName, region);
-		if (!childResult) throw new Error(`cdkd state is missing nested-child '${safeSegment(childStackName)}' (${safeSegment(region)}). Parent stack '${safeSegment(stackName)}' lists '${safeSegment(logicalId)}' as an ${NESTED_STACK_RESOURCE_TYPE} row but no child state file exists at 'cdkd/${safeSegment(childStackName)}/${safeSegment(region)}/state.json'. The cdkd state tree is inconsistent — re-deploy the parent stack to refresh, or run 'cdkd state orphan ${safeSegment(stackName)}' and re-import.`);
-		if (childResult.state.region !== void 0 && childResult.state.region !== region) throw new Error(`cdkd state region mismatch: nested-child '${safeSegment(childStackName)}' has state.region='${safeSegment(childResult.state.region)}' but its parent '${safeSegment(stackName)}' is being walked against region='${safeSegment(region)}'. AWS does not support cross-region nested stacks; the state tree appears corrupt — re-deploy the parent stack to refresh.`);
+		if (!childResult) throw new Error(`cdkd state is missing nested-child '${safeSegment(childStackName)}' (${safeSegment(region)}). Parent stack '${safeSegment(stackName)}' lists '${safeSegment(logicalId)}' as an ${NESTED_STACK_RESOURCE_TYPE} row but no child state file exists at 'cdkd/${safeSegment(childStackName)}/${safeSegment(region)}/state.json'. The cdkd state tree is inconsistent — re-deploy the parent stack to refresh, or drop the parent's record and re-import with: ${orphanCommandFor(stackName, region)}`);
+		if (childResult.divergentBodyRegion !== void 0) throw new Error(`cdkd state region mismatch: nested-child '${safeSegment(childStackName)}' has state.region='${safeSegment(childResult.divergentBodyRegion)}' but its parent '${safeSegment(stackName)}' is being walked against region='${safeSegment(region)}'. AWS does not support cross-region nested stacks; the state tree appears corrupt — re-deploy the parent stack to refresh.`);
 		nestedChildren.set(logicalId, await walkCdkdStateStackTree(childStackName, region, childResult.state, stateBackend));
 	}
 	return {
@@ -76534,7 +76848,7 @@ function flattenCdkdStateTreeRootFirst(tree) {
 */
 function cdkd2cfnStackName(cdkdStackName) {
 	const cfnName = cdkdStackName.replace(/~/g, "-");
-	if (!/^[a-zA-Z][-a-zA-Z0-9]*$/.test(cfnName)) throw new Error(`cdkd stack name '${cdkdStackName}' maps to CFn stack name '${cfnName}', which violates the CloudFormation stack-name constraint [a-zA-Z][-a-zA-Z0-9]* (must start with a letter; no '_', '.', '/', or other special characters). Supply an explicit name via --cfn-stack-name (root) or --cfn-child-stack-name '<cdkdName>=<cfnName>' (nested child).`);
+	if (!/^[a-zA-Z][-a-zA-Z0-9]*$/.test(cfnName)) throw new Error(`cdkd stack name '${safeSegment(cdkdStackName)}' maps to CFn stack name '${safeSegment(cfnName)}', which violates the CloudFormation stack-name constraint [a-zA-Z][-a-zA-Z0-9]* (must start with a letter; no '_', '.', '/', or other special characters). Supply an explicit name via --cfn-stack-name (root) or --cfn-child-stack-name '<cdkdName>=<cfnName>' (nested child).`);
 	return cfnName;
 }
 /**
@@ -76560,7 +76874,7 @@ function parseCfnChildStackNameOverrides(values) {
 		if (!cdkdName) throw new Error(`--cfn-child-stack-name '${raw}' has an empty cdkd stack name.`);
 		if (!cfnName) throw new Error(`--cfn-child-stack-name '${raw}' has an empty CFn stack name.`);
 		if (!/^[a-zA-Z][-a-zA-Z0-9]*$/.test(cfnName)) throw new Error(`--cfn-child-stack-name '${raw}': CFn stack name '${cfnName}' must match [a-zA-Z][-a-zA-Z0-9]* (no '~', no '/', no '_', no '.').`);
-		if (out.has(cdkdName)) throw new Error(`--cfn-child-stack-name: duplicate override for cdkd stack '${cdkdName}'. Pass it once with the final CFn name.`);
+		if (out.has(cdkdName)) throw new Error(`--cfn-child-stack-name: duplicate override for cdkd stack '${safeSegment(cdkdName)}'. Pass it once with the final CFn name.`);
 		out.set(cdkdName, cfnName);
 	}
 	return out;
@@ -76646,7 +76960,7 @@ function indexNestedTemplatePaths(template, templateDir) {
 * orchestrator.
 */
 function buildPerStackImportNodes(rootStackName, rootTemplate, rootNestedTemplatePaths, rootTemplateFormat, tree) {
-	if (tree.stackName !== rootStackName) throw new Error(`buildPerStackImportNodes: tree root '${tree.stackName}' does not match expected root stack name '${rootStackName}'.`);
+	if (tree.stackName !== rootStackName) throw new Error(`buildPerStackImportNodes: tree root '${safeSegment(tree.stackName)}' does not match expected root stack name '${safeSegment(rootStackName)}'.`);
 	const out = /* @__PURE__ */ new Map();
 	walk(tree, rootTemplate, rootNestedTemplatePaths, rootTemplateFormat);
 	return out;
@@ -76660,7 +76974,7 @@ function buildPerStackImportNodes(rootStackName, rootTemplate, rootNestedTemplat
 		});
 		for (const [childLogicalId, childNode] of node.nestedChildren) {
 			const childTemplatePath = nodeNestedTemplatePaths[childLogicalId];
-			if (!childTemplatePath) throw new Error(`cdkd export: nested-stack child '${childLogicalId}' under parent '${node.stackName}' has cdkd state but no Metadata['aws:asset:path'] in the parent template's '${childLogicalId}' row. The synth output and the cdkd state tree are out of sync — re-deploy the parent stack to refresh, or remove the cdkd state for the orphaned child via 'cdkd state orphan ${childNode.stackName}'.`);
+			if (!childTemplatePath) throw new Error(`cdkd export: nested-stack child '${safeSegment(childLogicalId)}' under parent '${safeSegment(node.stackName)}' has cdkd state but no Metadata['aws:asset:path'] in the parent template's '${safeSegment(childLogicalId)}' row. The synth output and the cdkd state tree are out of sync — re-deploy the parent stack to refresh, or remove the cdkd state for the orphaned child with ${orphanCommandFor(childNode.stackName, childNode.region)}`);
 			const { template: childTemplate, format: childFormat } = readNestedChildTemplateFile(childTemplatePath, childLogicalId);
 			walk(childNode, childTemplate, indexNestedTemplatePaths(childTemplate, path.dirname(childTemplatePath)), childFormat);
 		}
@@ -76712,7 +77026,7 @@ async function buildImportPlan(state, template, cfnClient, parentStackName, opti
 				blocked.push({
 					logicalId,
 					resourceType,
-					reason: `template has AWS::CloudFormation::Stack row '${logicalId}' but cdkd state has no matching nested-stack entry on parent '${parentStackName}'. Re-deploy or re-import the parent stack to refresh state.`
+					reason: `template has AWS::CloudFormation::Stack row '${logicalId}' but cdkd state has no matching nested-stack entry on parent '${safeSegment(parentStackName)}'. Re-deploy or re-import the parent stack to refresh state.`
 				});
 				continue;
 			}
@@ -77405,13 +77719,13 @@ function reportDriftBaselineGaps(state, logger) {
 	const missing = entries.filter(([, r]) => r.observedProperties === void 0);
 	if (missing.length === 0) return;
 	if (state.version !== void 0 && state.version < 3) {
-		logger.warn(`cdkd state schema is v${state.version} (pre-observedProperties). cdkd drift cannot reliably compare against AWS for this stack; the next \`cdk deploy\` after migration may surface spurious changes if AWS has drifted from the template. Run \`cdkd state refresh-observed ${state.stackName}\` (or any redeploy) before export to capture an AWS-current baseline.`);
+		logger.warn(`cdkd state schema is v${state.version} (pre-observedProperties). cdkd drift cannot reliably compare against AWS for this stack; the next \`cdk deploy\` after migration may surface spurious changes if AWS has drifted from the template. Run \`cdkd state refresh-observed ${safeSegment(state.stackName)}\` (or any redeploy) before export to capture an AWS-current baseline.`);
 		return;
 	}
 	const refused = missing.filter(([, r]) => r.observedBaselineRefused === true);
 	const refreshable = missing.filter(([, r]) => r.observedBaselineRefused !== true);
 	if (refreshable.length > 0) {
-		logger.warn(`${refreshable.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next \`cdk deploy\` after migration may surface unexpected changes. Run \`cdkd state refresh-observed ${state.stackName}\` to capture a baseline before export, then \`cdkd drift\` to verify the stack matches AWS.`);
+		logger.warn(`${refreshable.length} of ${entries.length} resource(s) in cdkd state lack an AWS-current baseline (observedProperties). cdkd drift may produce false positives for them; the next \`cdk deploy\` after migration may surface unexpected changes. Run \`cdkd state refresh-observed ${safeSegment(state.stackName)}\` to capture a baseline before export, then \`cdkd drift\` to verify the stack matches AWS.`);
 		for (const [logicalId] of refreshable.slice(0, 10)) logger.warn(`  ${logicalId}`);
 		if (refreshable.length > 10) logger.warn(`  ... and ${refreshable.length - 10} more`);
 	}
@@ -77954,12 +78268,12 @@ async function buildResolvedParametersPerStack(args) {
 	for (const ref of flattenCdkdStateTreeRootFirst(args.tree)) {
 		if (ref.stackName === args.rootStackName) continue;
 		const node = nodeByName.get(ref.stackName);
-		if (!node) throw new Error(`buildResolvedParametersPerStack: tree node '${ref.stackName}' has no per-stack template/state entry. This is a cdkd bug.`);
+		if (!node) throw new Error(`buildResolvedParametersPerStack: tree node '${safeSegment(ref.stackName)}' has no per-stack template/state entry. This is a cdkd bug.`);
 		const parentLogicalId = node.state.parentLogicalId;
 		const parentStackName = node.state.parentStack;
-		if (!parentLogicalId || !parentStackName) throw new Error(`buildResolvedParametersPerStack: child '${node.cdkdName}' state is missing parentLogicalId / parentStack (v6 fields). Re-deploy or re-import the parent stack.`);
+		if (!parentLogicalId || !parentStackName) throw new Error(`buildResolvedParametersPerStack: child '${safeSegment(node.cdkdName)}' state is missing parentLogicalId / parentStack (v6 fields). Re-deploy or re-import the parent stack.`);
 		const parentNode = nodeByName.get(parentStackName);
-		if (!parentNode) throw new Error(`buildResolvedParametersPerStack: child '${node.cdkdName}' references parent '${parentStackName}' which is not in the per-stack node list — tree shape is inconsistent.`);
+		if (!parentNode) throw new Error(`buildResolvedParametersPerStack: child '${safeSegment(node.cdkdName)}' references parent '${safeSegment(parentStackName)}' which is not in the per-stack node list — tree shape is inconsistent.`);
 		const parentParamValues = {};
 		for (const p of paramsByCdkdName.get(parentStackName) ?? []) if (p.ParameterKey !== void 0) parentParamValues[p.ParameterKey] = p.ParameterValue;
 		const parentResolverContext = {
@@ -78044,7 +78358,7 @@ async function runPerStackImportLoop(args) {
 	};
 	const nodesByCdkdName = buildPerStackImportNodes(rootStackName, rootTemplate, rootStackInfoNestedTemplates, rootTemplateFormat, tree);
 	const leafFirst = flattenCdkdStateTreeLeafFirst(tree);
-	for (const n of leafFirst) if (!nodesByCdkdName.has(n.stackName)) throw new Error(`runPerStackImportLoop: missing per-stack template for '${n.stackName}' — tree node has cdkd state but no synth template was loaded. This is a cdkd bug.`);
+	for (const n of leafFirst) if (!nodesByCdkdName.has(n.stackName)) throw new Error(`runPerStackImportLoop: missing per-stack template for '${safeSegment(n.stackName)}' — tree node has cdkd state but no synth template was loaded. This is a cdkd bug.`);
 	const perStackPlans = [];
 	for (const node of leafFirst) {
 		const meta = nodesByCdkdName.get(node.stackName);
@@ -78055,7 +78369,7 @@ async function runPerStackImportLoop(args) {
 		});
 		if (plan.blocked.length > 0) {
 			const lines = groupBlockedReasons(plan.blocked);
-			throw new Error(`Stack '${meta.cdkdStackName}' has ${new Set(plan.blocked.map((b) => b.logicalId)).size} resource(s) that block migration:\n${lines.join("\n")}`);
+			throw new Error(`Stack '${safeSegment(meta.cdkdStackName)}' has ${new Set(plan.blocked.map((b) => b.logicalId)).size} resource(s) that block migration:\n${lines.join("\n")}`);
 		}
 		perStackPlans.push({
 			cdkdName: meta.cdkdStackName,
@@ -78074,7 +78388,7 @@ async function runPerStackImportLoop(args) {
 	const totalRecreate = perStackPlans.reduce((acc, p) => acc + p.recreateBeforePhase2.length, 0);
 	logger.info("");
 	logger.info(`Migrating cdkd nested-stack tree rooted at '${rootStackName}' → CloudFormation (${perStackPlans.length} stack(s), leaf-first):`);
-	for (const plan of perStackPlans) logger.info(`  [${plan.cdkdName}] → CFn stack '${plan.cfnName}': ${plan.phase1Imports.length} leaf import(s)` + (plan.nestedStackRows.length > 0 ? `, ${plan.nestedStackRows.length} nested-child adoption(s)` : "") + (plan.phase2Creates.length > 0 ? `, ${plan.phase2Creates.length} phase-2 CREATE(s)` : "") + (plan.recreateBeforePhase2.length > 0 ? `, ${plan.recreateBeforePhase2.length} pre-delete + re-CREATE` : ""));
+	for (const plan of perStackPlans) logger.info(`  [${safeSegment(plan.cdkdName)}] → CFn stack '${safeSegment(plan.cfnName)}': ${plan.phase1Imports.length} leaf import(s)` + (plan.nestedStackRows.length > 0 ? `, ${plan.nestedStackRows.length} nested-child adoption(s)` : "") + (plan.phase2Creates.length > 0 ? `, ${plan.phase2Creates.length} phase-2 CREATE(s)` : "") + (plan.recreateBeforePhase2.length > 0 ? `, ${plan.recreateBeforePhase2.length} pre-delete + re-CREATE` : ""));
 	logger.info("");
 	if (totalPhase2Creates > 0 && !options.includeNonImportable) {
 		if (options.dryRun) {
@@ -78098,7 +78412,7 @@ async function runPerStackImportLoop(args) {
 	if (!options.yes) {
 		const phase2Note = totalPhase2Creates > 0 ? ` Phase 2 will CREATE ${totalPhase2Creates} non-importable resource(s) across the tree.` : "";
 		const recreateNote = totalRecreate > 0 ? ` cdkd will also pre-DELETE + re-CREATE ${totalRecreate} IMPORT-unsupported resource(s) (brief unavailability window per resource).` : "";
-		if (!await confirmPrompt$3(`Create ${perStackPlans.length} CloudFormation stack(s) by importing the cdkd nested-stack tree rooted at '${rootStackName}' (${rootRegion}) — leaf-first, per-stack IMPORT loop (#464 design §4.3).` + phase2Note + recreateNote + " AWS resources are unchanged. cdkd state for every adopted stack will be deleted on success.")) {
+		if (!await confirmPrompt$3(`Create ${perStackPlans.length} CloudFormation stack(s) by importing the cdkd nested-stack tree rooted at '${rootStackName}' (${safeSegment(rootRegion)}) — leaf-first, per-stack IMPORT loop (#464 design §4.3).` + phase2Note + recreateNote + " AWS resources are unchanged. cdkd state for every adopted stack will be deleted on success.")) {
 			logger.info("Migration cancelled. cdkd state and CloudFormation are unchanged.");
 			return {
 				outcome: "cancelled",
@@ -78144,11 +78458,11 @@ async function runPerStackImportLoop(args) {
 			resolver: paramResolver,
 			stateBackend: deps.stateBackend
 		}));
-		for (const [cdkdName, skipped] of sessionIntrinsicSkipped) logger.warn(`  Child '${cdkdName}': could not resolve intrinsic-valued Parameter(s) ${skipped.join(", ")} at IMPORT time. The child template's Parameter Default values must cover these — otherwise CFn will reject the IMPORT.`);
+		for (const [cdkdName, skipped] of sessionIntrinsicSkipped) logger.warn(`  Child '${safeSegment(cdkdName)}': could not resolve intrinsic-valued Parameter(s) ${skipped.join(", ")} at IMPORT time. The child template's Parameter Default values must cover these — otherwise CFn will reject the IMPORT.`);
 		try {
 			for (let i = 0; i < perStackPlans.length; i++) {
 				const plan = perStackPlans[i];
-				logger.info(`[${i + 1}/${perStackPlans.length}] Importing cdkd stack '${plan.cdkdName}' → CFn stack '${plan.cfnName}' (${plan.phase1Imports.length} leaf, ${plan.nestedStackRows.length} nested-child adoption)`);
+				logger.info(`[${i + 1}/${perStackPlans.length}] Importing cdkd stack '${safeSegment(plan.cdkdName)}' → CFn stack '${plan.cfnName}' (${plan.phase1Imports.length} leaf, ${plan.nestedStackRows.length} nested-child adoption)`);
 				const stackParameters = paramsByCdkdName.get(plan.cdkdName) ?? [];
 				const phase1ATemplate = filterTemplateForImport(plan.template, plan.phase1Imports);
 				const phase1AResources = plan.phase1Imports.map((entry) => ({
@@ -78157,13 +78471,13 @@ async function runPerStackImportLoop(args) {
 					ResourceIdentifier: entry.resourceIdentifier
 				}));
 				const injectedDeletion = injectDeletionPolicyForImport(phase1ATemplate);
-				if (injectedDeletion > 0) logger.info(`  Injected DeletionPolicy: Delete on ${injectedDeletion} resource(s) in '${plan.cdkdName}' (required by CFn IMPORT; matches CDK/CFn default).`);
+				if (injectedDeletion > 0) logger.info(`  Injected DeletionPolicy: Delete on ${injectedDeletion} resource(s) in '${safeSegment(plan.cdkdName)}' (required by CFn IMPORT; matches CDK/CFn default).`);
 				try {
 					await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1ATemplate, phase1AResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 				} catch (err) {
-					const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${s.cdkdStackName} → ${s.cfnStackName}`).join(", ") : "(none)";
-					const remainingSummary = perStackPlans.slice(i).map((p) => p.cdkdName).join(", ");
-					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack '${plan.cdkdName}' (CFn name '${plan.cfnName}'). Stacks imported successfully so far: ${importedSummary}. Stacks not yet imported (cdkd state preserved): ${remainingSummary}. After resolving the underlying cause, re-run 'cdkd export ${rootStackName}' — already-imported children will be adopted as nested references on retry. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
+					const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${safeSegment(s.cdkdStackName)} → ${safeSegment(s.cfnStackName)}`).join(", ") : "(none)";
+					const remainingSummary = perStackPlans.slice(i).map((p) => safeSegment(p.cdkdName)).join(", ");
+					throw new Error(`Phase 1A IMPORT changeset failed for cdkd stack '${safeSegment(plan.cdkdName)}' (CFn name '${plan.cfnName}'). Stacks imported successfully so far: ${importedSummary}. Stacks not yet imported (cdkd state preserved): ${remainingSummary}. After resolving the underlying cause, re-run 'cdkd export ${rootStackName}' — already-imported children will be adopted as nested references on retry. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
 				}
 				const cfnArn = (await deps.cfnClient.send(new DescribeStacksCommand({ StackName: plan.cfnName }))).Stacks?.[0]?.StackId;
 				if (!cfnArn) throw new Error(`runPerStackImportLoop: DescribeStacks returned no StackId for '${plan.cfnName}' immediately after Phase 1A IMPORT — AWS may be in an unexpected state.`);
@@ -78185,7 +78499,7 @@ async function runPerStackImportLoop(args) {
 					const phase1BResources = [];
 					for (const row of plan.nestedStackRows) {
 						const childArn = cfnArnByCdkdName.get(row.childStackName);
-						if (!childArn) throw new Error(`runPerStackImportLoop: nested-stack child '${row.childStackName}' has no recorded CFn ARN when processing parent '${plan.cdkdName}'. Leaf-first iteration order should have IMPORTed the child first — this is a cdkd bug.`);
+						if (!childArn) throw new Error(`runPerStackImportLoop: nested-stack child '${safeSegment(row.childStackName)}' has no recorded CFn ARN when processing parent '${safeSegment(plan.cdkdName)}'. Leaf-first iteration order should have IMPORTed the child first — this is a cdkd bug.`);
 						const childCfnName = cfnStackNameOf(row.childStackName);
 						const childTemplateBody = await fetchCfnStackTemplate(deps.cfnClient, childCfnName);
 						const uploaded = await uploadCfnTemplate({
@@ -78198,7 +78512,7 @@ async function runPerStackImportLoop(args) {
 						uploadCleanups.push(uploaded.cleanup);
 						const childActualTags = (await deps.cfnClient.send(new DescribeStacksCommand({ StackName: childCfnName }))).Stacks?.[0]?.Tags ?? [];
 						const originalRow = getResourceFromTemplate(plan.template, row.logicalId);
-						if (!originalRow) throw new Error(`runPerStackImportLoop: parent template for '${plan.cdkdName}' has no resource '${row.logicalId}'. State and template are out of sync.`);
+						if (!originalRow) throw new Error(`runPerStackImportLoop: parent template for '${safeSegment(plan.cdkdName)}' has no resource '${row.logicalId}'. State and template are out of sync.`);
 						const rewrittenRow = injectRetainAndRewriteTemplateUrl(originalRow, uploaded.url, childActualTags);
 						phase1BTemplate["Resources"][row.logicalId] = rewrittenRow;
 						rewrittenNestedRows.set(row.logicalId, rewrittenRow);
@@ -78211,8 +78525,8 @@ async function runPerStackImportLoop(args) {
 					try {
 						await submitImportChangeSet(deps.cfnClient, plan.cfnName, phase1BTemplate, phase1BResources, stackParameters, plan.templateFormat, deps.uploadOpts);
 					} catch (err) {
-						const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${s.cdkdStackName} → ${s.cfnStackName}`).join(", ") : "(none)";
-						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent '${plan.cdkdName}' (CFn name '${plan.cfnName}'). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each is a standalone CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover: (1) fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"); (2) clear cdkd state for the migrated stacks via 'cdkd state orphan <stack>' (do NOT 'cdkd destroy' — that would tear down the live AWS resources); (3) re-attempt the parent-side nested adoption manually via the AWS console or CLI per the AWS docs procedure. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
+						const importedSummary = importedStacks.length > 0 ? importedStacks.map((s) => `${safeSegment(s.cdkdStackName)} → ${safeSegment(s.cfnStackName)}`).join(", ") : "(none)";
+						throw new Error(`Phase 1B (nested-child adoption) IMPORT changeset failed for parent '${safeSegment(plan.cdkdName)}' (CFn name '${safeSegment(plan.cfnName)}'). The parent CFn stack exists with its ${plan.phase1Imports.length} leaf resource(s); ${plan.nestedStackRows.length} nested-child adoption(s) did NOT complete. Stacks IMPORTed so far (each is a standalone CFn stack): ${importedSummary}. cdkd state for every stack in the tree is preserved. To recover: (1) fix the underlying cause (typically a template-match validation error per AWS-docs "Nested stack import validation"); (2) clear cdkd state for the migrated stacks via 'cdkd state orphan <stack>' (do NOT 'cdkd destroy' — that would tear down the live AWS resources); (3) re-attempt the parent-side nested adoption manually via the AWS console or CLI per the AWS docs procedure. Cause: ${err instanceof Error ? err.message : String(err)}`, { cause: err instanceof Error ? err : void 0 });
 					}
 					logger.info(`  ✓ Phase 1B: parent '${plan.cfnName}' adopted ${plan.nestedStackRows.length} nested child(ren) via UPDATE-IMPORT.`);
 					if (plan.cdkdName !== rootStackName) {
@@ -78222,7 +78536,7 @@ async function runPerStackImportLoop(args) {
 				}
 				if (plan.recreateBeforePhase2.length > 0) for (const entry of plan.recreateBeforePhase2) {
 					const handler = PRE_DELETE_HANDLERS[entry.resourceType];
-					if (!handler) throw new Error(`No pre-delete handler registered for ${entry.resourceType} (${entry.logicalId}) in stack '${plan.cdkdName}'. This is a cdkd bug — the resource is in IMPORT_UNSUPPORTED_RECREATABLE_TYPES but lacks a PRE_DELETE_HANDLERS entry.`);
+					if (!handler) throw new Error(`No pre-delete handler registered for ${entry.resourceType} (${entry.logicalId}) in stack '${safeSegment(plan.cdkdName)}'. This is a cdkd bug — the resource is in IMPORT_UNSUPPORTED_RECREATABLE_TYPES but lacks a PRE_DELETE_HANDLERS entry.`);
 					logger.info(`  Pre-deleting AWS resource for ${entry.logicalId} (${entry.resourceType}) so CFn can re-CREATE in phase 2...`);
 					await handler(entry);
 					logger.info(`    ✓ deleted ${entry.physicalId}`);
@@ -78241,21 +78555,21 @@ async function runPerStackImportLoop(args) {
 			const stateDeletionFailures = [];
 			for (const node of leafFirst) try {
 				await deps.stateBackend.deleteState(node.stackName, node.region);
-				logger.info(`cdkd state for '${node.stackName}' (${node.region}) removed.`);
+				logger.info(`cdkd state for '${safeSegment(node.stackName)}' (${safeSegment(node.region)}) removed.`);
 			} catch (err) {
 				stateDeletionFailures.push({
 					stackName: node.stackName,
 					region: node.region,
 					reason: err instanceof Error ? err.message : String(err)
 				});
-				logger.warn(`Failed to delete cdkd state for '${node.stackName}' (${node.region}): ${err instanceof Error ? err.message : String(err)}. The stack IS CFn-managed; clean up with 'cdkd state orphan ${node.stackName}'.`);
+				logger.warn(`Failed to delete cdkd state for '${safeSegment(node.stackName)}' (${safeSegment(node.region)}): ${safeDetail(err)}. The stack IS CFn-managed; clean up with: ${orphanCommandFor(node.stackName, node.region)}`);
 			}
 			if (stateDeletionFailures.length > 0) {
-				const lines = stateDeletionFailures.map((f) => `  - cdkd/${f.stackName}/${f.region}/state.json: ${f.reason}`).join("\n");
-				throw new Error(`${stateDeletionFailures.length} cdkd state record(s) could not be deleted after a successful per-stack IMPORT loop. Every stack in the tree IS CFn-managed (the migration succeeded AWS-side); orphan state remains under:\n${lines}\nRecover with 'cdkd state orphan <stack>' per record.`);
+				const lines = stateDeletionFailures.map((f) => `  - cdkd/${safeSegment(f.stackName)}/${safeSegment(f.region)}/state.json: ${safeDetail(f.reason)}`).join("\n");
+				throw new Error(`${stateDeletionFailures.length} cdkd state record(s) could not be deleted after a successful per-stack IMPORT loop. Every stack in the tree IS CFn-managed (the migration succeeded AWS-side); orphan state remains under:\n${lines}\nRecover with 'cdkd state orphan <stack> --stack-region <region>' per record.`);
 			}
 			if (sessionIntrinsicSkipped.size > 0) {
-				const detail = [...sessionIntrinsicSkipped.entries()].map(([cdkdName, params]) => `${cdkdName} (${params.join(", ")})`).join("; ");
+				const detail = [...sessionIntrinsicSkipped.entries()].map(([cdkdName, params]) => `${safeSegment(cdkdName)} (${params.join(", ")})`).join("; ");
 				logger.warn(`${sessionIntrinsicSkipped.size} stack(s) had intrinsic-valued Parameter(s) that cdkd could not resolve at IMPORT time: ${detail}. Verify each child template's Parameter Default values cover these before the first 'cdk deploy'.`);
 			}
 			return {
@@ -78269,7 +78583,7 @@ async function runPerStackImportLoop(args) {
 		for (let i = acquiredChildLocks.length - 1; i >= 0; i--) {
 			const lock = acquiredChildLocks[i];
 			await deps.lockManager.releaseLock(lock.stackName, lock.region).catch((err) => {
-				logger.warn(`Failed to release lock for '${lock.stackName}' (${lock.region}): ${err instanceof Error ? err.message : String(err)}`);
+				logger.warn(`Failed to release lock for '${safeSegment(lock.stackName)}' (${safeSegment(lock.region)}): ${safeDetail(err)}`);
 			});
 		}
 	}
@@ -79679,9 +79993,29 @@ function createStateOrphanCommand() {
 *   state record. AWS resources are left intact.
 *
 * Region scoping: when a stack name has multiple state records spread across
-* regions (PR 1 territory), `--region` selects one. With the current single-
-* region-per-name layout the flag still works — it sets the AWS clients'
-* region and refuses to proceed if the loaded state.region disagrees.
+* regions (PR 1 territory), `--stack-region` selects one — it picks WHICH
+* record is loaded, because the region is part of the S3 key.
+*
+* What it does with a record whose BODY names a different region than that key
+* is two things, neither of which this comment described until issue
+* [#3328](https://github.com/go-to-k/cdkd/issues/3328) — it claimed a refusal
+* on `state.region` that had never existed anywhere in the command, while the
+* measured behaviour was the opposite: a planted record at
+* `.../us-east-1/state.json` carrying `"region": "eu-west-1"` locked, saved
+* and deleted against `eu-west-1` and reported `✓ State deleted` while the
+* us-east-1 key survived.
+*
+* 1. `S3StateBackend.getState` normalizes the loaded record's `region` to the
+*    KEY's and WARNS, so this command — which hands `stateResult.state`
+*    straight to `runDestroyForStack` — acts on the region it was pointed at.
+*    The read itself refuses NOTHING; `adoptKeyRegion` carries why, and it is
+*    what keeps `state show` / `state list` / `state orphan` working on such a
+*    record.
+* 2. The DESTROY refuses it when the record still lists resources
+*    (`refuseDivergentRecordRegionForDestroy`, reached through
+*    `runDestroyForStack`), because which region those resources are in is
+*    exactly what the divergence makes undecidable. A resource-less record is
+*    not refused, so cleaning one up still works.
 */
 async function stateDestroyCommand(stackArgs, options) {
 	const logger = getLogger();
@@ -79828,6 +80162,7 @@ async function stateDestroyCommand(stackArgs, options) {
 					providerRegistry,
 					baseAwsClients: setup.awsClients,
 					baseRegion: setup.region,
+					...stateResult.divergentBodyRegion !== void 0 && { divergentBodyRegion: stateResult.divergentBodyRegion },
 					...options.profile && { profile: options.profile },
 					stateBucket: setup.bucket,
 					statePrefix: options.statePrefix,
@@ -90003,13 +90338,12 @@ function readEnvOverridesFile$3(filePath) {
 * which drives the `--role-arn` cases without booting the API server.
 */
 function forwardAwsEnv$2(env) {
-	for (const key of [
-		"AWS_ACCESS_KEY_ID",
-		"AWS_SECRET_ACCESS_KEY",
-		"AWS_SESSION_TOKEN",
+	const passThrough = [
+		...AWS_CREDENTIAL_ENV_KEYS,
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
-	]) {
+	];
+	for (const key of passThrough) {
 		const value = process.env[key];
 		if (value !== void 0) env[key] = value;
 	}
@@ -92484,6 +92818,36 @@ async function buildSigV4HeadersIfRequested(options, resolved, loaded, host, por
 	return headers;
 }
 /**
+* The `--sigv4` refusal, as a pure function of the two facts that decide its
+* wording (issue [#3250](https://github.com/go-to-k/cdkd/issues/3250) item 5).
+*
+* NAMING THE EXCLUSION. On a `--role-arn` run over a caller with no static
+* triple, `AWS_ACCESS_KEY_ID` IS set in this process — cdkd set it, to the
+* role — so "set AWS_ACCESS_KEY_ID" alone reads as a bug report about cdkd
+* rather than as the refusal it is. The message has to say which value it
+* declines and why.
+*
+* THE REMEDY ORDER DIFFERS PER BRANCH, deliberately. The assumed-role branch
+* fires precisely when the caller has no static pair BY DESIGN — SSO, an
+* instance role, a container role — so leading with "mint an access key pair"
+* tells the one user who should not do that to do it first. The role-less
+* branch is the opposite: there the pair genuinely is the simplest answer.
+* `--profile` is dropped from either list when one was already passed and did
+* not produce a usable pair — the same already-followed-advice defect, one arm
+* over.
+*
+* PURE, and separate from its caller, for a reason the caller cannot give: the
+* `--profile` arm of {@link resolveHostCredentialsForSigV4} transacts with AWS,
+* so the unit suite's network fence refuses every route that reaches this throw
+* with `options.profile` set. As a helper, all four combinations are testable
+* with no network at all.
+*/
+function sigv4NoCredentialsRefusal(args) {
+	const exportPair = `set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY in your shell before running cdkd (the snapshot cdkd puts back is taken before it assumes the role, so exporting them afterwards is too late)`;
+	const profileRemedy = args.profileAlreadyPassed ? "" : `pass --profile <name>, `;
+	return new CdkdError(args.assumedRolePublished ? `--sigv4: no AWS credentials available to sign the request as YOU. AWS_ACCESS_KEY_ID is set in this process, but cdkd set it: it holds the --role-arn assumed role, and this signature is what the emulated agent sees as its INVOKER, so cdkd deliberately will not sign as that role. Your own credentials carried no static triple before the assume — an SSO / IAM Identity Center, EC2 instance or ECS container chain, or a profile you exported rather than passed — so there is nothing to put back. To fix: ${profileRemedy}pass --assume-role <arn>, or ${exportPair}.` : `--sigv4: no AWS credentials available to sign the request. To fix: ${exportPair}, ${profileRemedy}or pass --assume-role <arn>.`, "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_CREDENTIALS");
+}
+/**
 * Resolve credentials for host-side SigV4 signing. Precedence:
 *   1. `--assume-role` → STS temp creds (warn + fall through on STS failure);
 *   2. `--profile` → profile creds (sessionToken when the profile carries one);
@@ -92526,7 +92890,10 @@ async function resolveHostCredentialsForSigV4(options, resolved, loaded, region)
 		secretAccessKey: shellCredentials.secretAccessKey,
 		...shellCredentials.sessionToken && { sessionToken: shellCredentials.sessionToken }
 	};
-	throw new CdkdError("--sigv4: no AWS credentials available to sign the request. Set AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY, pass --profile <name>, or pass --assume-role <arn>.", "LOCAL_INVOKE_AGENTCORE_SIGV4_NO_CREDENTIALS");
+	throw sigv4NoCredentialsRefusal({
+		assumedRolePublished: envCredentialsAreAssumedRole(),
+		profileAlreadyPassed: options.profile !== void 0
+	});
 }
 /**
 * Acquire the agent image. A CODE artifact (managed runtime) is built from
@@ -92967,9 +93334,7 @@ function platformToArchitecture(platform) {
 */
 function forwardAwsEnv$1(env) {
 	const passThrough = [
-		"AWS_ACCESS_KEY_ID",
-		"AWS_SECRET_ACCESS_KEY",
-		"AWS_SESSION_TOKEN",
+		...AWS_CREDENTIAL_ENV_KEYS,
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
 	];
@@ -94145,9 +94510,7 @@ async function assumeLambdaExecutionRole(roleArn, region) {
 */
 function forwardAwsEnv(env) {
 	const passThrough = [
-		"AWS_ACCESS_KEY_ID",
-		"AWS_SECRET_ACCESS_KEY",
-		"AWS_SESSION_TOKEN",
+		...AWS_CREDENTIAL_ENV_KEYS,
 		"AWS_REGION",
 		"AWS_DEFAULT_REGION"
 	];
@@ -94395,4 +94758,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-DaoJ7P4H.js.map
+//# sourceMappingURL=program-BgDlhE-S.js.map