@go-to-k/cdkd 0.290.7 → 0.290.9

package/dist/{program-Ckl60p0E.js → program-BslZXdJR.js}

@@ -1,8 +1,8 @@
-import { $ as secretSafeKeyDisplay, $n as isCrossRegionRedirect, $r as CdkdError, $t as applyRoleArnIfSet, A as planOrphanAdoption, An as forceQuitRecoveryClause, Ar as resolveStateBucketWithDefaultAndSource, At as isSettledInstanceState, B as formatResourceLine, Bn as shouldRetainResource, Br as expectedOwnerParam, Bt as readConfigString, C as createPreDeleteFinalSnapshot, Ci as isRetryableTransientError, Cn as redactSecretsForState, Cr as getDefaultStateBucketName, Ct as cfnRefValueFromPhysicalId, D as makeCanonicalizePropertiesFn, Di as markRedactedCause, Dn as rebuildClientForBucketRegion, Dr as resolveCaptureObservedState, Dt as isUnboundTemplateParameter, E as unsupportedFinalSnapshotError, Ei as markNonRetryable, En as S3StateBackend, Er as resolveAutoAssetStorage, Et as isImpossibleEmptyStoredAttribute, F as WARM_THROUGHPUT_MEMBERS, Fn as exportNamesCarriedFrom, Fr as CFN_TEMPLATE_URL_LIMIT, Ft as coerceCfnBoolean, G as red, Gn as createAssetRedirectResolver, Gr as processStackMessages, Gt as classifyReplaySecretRegion, H as cyan, Hn as stringifyValue, Hr as canonicalizeRegion, Ht as requireConfigArray, I as coerceWarmThroughput$1, In as importableOutputKeys, Ir as MIGRATE_TMP_PREFIX, It as coerceCfnInteger, J as collectPublishedOutputNames, Jn as AssetModeResolver, Jr as AwsClients, Jt as s3BucketArn, K as yellow, Kn as loadPublishableAssetManifest, Kt as producerRegionsFromState, L as isWarmThroughputDecrease, Ln as importableOutputs, Lr as findLargeInlineResources, Lt as configBooleanRefusal, M as isStatefulRecreateTargetForReplace, Mn as shellQuote, Mr as stateBucketExistenceConfirmed, Mt as normalizeAwsTagsToCfn, N as isStatefulRecreateTargetSync, Nn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Nr as warnDeprecatedNoPrefixCliFlag, Nt as resolveExplicitPhysicalId, O as extractDeploymentEventError, Oi as retryClassificationText, On as buildForceUnlockCommand, Or as resolveSkipPrefix, Ot as parameterTypeMayLoseSecretIdentity, P as renderStatefulReason, Pn as DEFAULT_STATE_PREFIX, Pr as CFN_TEMPLATE_BODY_LIMIT, Pt as assertRegionMatch, Q as secretBearingStateKeyWarning, Qn as getBootstrapMarkerKey, Qt as s3BucketWebsiteUrl, R as toCfnInteger, Rn as orphansAfterRollback, Rr as uploadCfnTemplate, Rt as configIntegerRefusal, S as ccRoutedFinalSnapshotError, Si as isMarkedNonRetryable, Sn as recoverMaskedOutput, Sr as synthesisStatusMessage, St as carriesDynamicReference, T as refusesFinalSnapshot, Ti as isTransientServerError, Tn as LockManager, Tr as resolveApp, Tt as getAccountInfo, U as gray, Un as WorkGraph, Ur as derivePartitionAndUrlSuffix, Ut as requireConfigObject, V as bold, Vn as AssetPublisher, Vr as PARTITION_TABLE, Vt as replayWarn, W as green, Wn as buildAssetRedirectMap, Wr as AssemblyReader, Wt as requireConfigString, X as isExportAliasCollision, Xn as assertAssetBucketRegion, Xr as resetAwsClients, Xt as s3BucketDualStackDomainName, Y as exportAliasCollisionScrubWarning, Yn as BOOTSTRAP_MARKER_PREFIX, Yr as getAwsClients, Yt as s3BucketDomainName, Z as secretBearing, Zn as ensureAssetStorage, Zr as setAwsClients, Zt as s3BucketRegionalDomainName, _ as isSecretBearingReferenceString, _n as isSingleDynamicReferenceToken, _r as escapeRegExp, _t as deleteIndeterminateGuards, a as DeploymentEventsStore, ai as IntrinsicResolutionRefusalError, an as withRetry, ar as describeAwsFailure, at as wouldReturnToSdkProvider, b as PRE_DELETE_SNAPSHOT_TYPES, bi as normalizeAwsError, bn as maskSecretsInText, br as getDockerImageBySourceHash, bt as isTerminationProtectionPropagationError, c as replayFailedOperations, cn as STATE_SOURCED_BASELINE_RULES, cr as describeDockerExecFailure, ct as maskerOrIdentity, d as updatePartialReason, di as ProvisioningError, dn as TEMPLATE_SOURCED_RULES, dr as formatDockerLoginError, dt as interruptWatchListenerCount, en as DiffCalculator, er as parseBootstrapMarker, et as getCurrentResourceSecrets, f as withResourceDeadline, fi as ResourceTimeoutError, fn as carriesSecretMask, fr as getDockerCmd, ft as isInterruptedWaitError, g as bagHoldsSecretExpression, gn as identityKeyFor, gr as runDockerStreaming, gt as UNSPECIFIED_SKIP_REASON, h as computeImplicitDeleteEdges, hi as StackTerminationProtectionError, hn as errorCauseChain, hr as runDockerForeground, ht as slowCcOperationTimeoutMs, i as DeploymentEventsReader, ii as DynamicReferenceRegionAmbiguousError, in as describeTypeWithThrottleRetry, ir as buildDenyExternalAccessPolicy, it as ProviderRegistry, j as MULTI_REGION_RECREATE_BLOCKED_TYPES, jn as formatLockExpiry, jr as resolveUseCdkBootstrapAssets, jt as WAFv2WebACLProvider, k as makeSiblingClaimReader, kn as buildLockContentionMessage, kr as resolveStateBucketWithDefault, kt as refStateLookupFromResource, l as replayRollback, li as NestedStackChildDirectDestroyError, ln as STATE_SOURCED_CROSS_GENERATION_RULES, lr as describeDockerFailure, lt as beginCommandInterruptScope, m as IMPLICIT_DELETE_DEPENDENCIES, mi as StackHasActiveImportsError, mn as dynamicReferenceTokens, mr as redactDockerArgvValues, mt as CloudControlProvider, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as findActionableSilentDrops, nr as validateAssetBucketName, nt as collectInlinePolicyNamesManagedBySiblings, o as planFailedOps, oi as LocalInvokeBuildError$1, on as DagBuilder, or as buildDockerImage, ot as createMaskedRetryLogger, p as maskingRetryLogger, pi as ResourceUpdateNotSupportedError, pn as createSecretMasker, pr as partitionSensitiveEnv, pt as startInterruptWatch, q as collectDeclaredOutputNames, qn as rewriteTemplateAssetReferences, qr as resolveBucketRegion, qt as withSharedDrainBudget, r as DeployEngine, ri as DeployCancelledError, rn as findSilentDropProperties, rr as validateContainerRepoName, rt as clearOnUpdateRemoval, s as planRollback, si as LocalStartServiceError, sn as TemplateParser, sr as describeDockerCapturedOutput, st as maskDeep, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CrossAccountSecretRefusalError, tn as INTRINSIC_KEYS, tr as readBootstrapMarkerBody, tt as IAMRoleProvider, u as updatePartialMessage, ui as PartialFailureError, un as STATE_SOURCED_READBACK_RULES, ur as dockerSpawnEnvWithSensitive, ut as endCommandInterruptScope, v as bindingSkippedOutputs, vn as markSameGenerationBag, vr as stripControlChars, vt as deleteSkipReason, w as isFinalSnapshotError, wi as isThrottlingError, wn as scrubResourceRecord, wr as getLegacyStateBucketName, wt as coerceParameterTypedValue, x as buildFinalSnapshotIdentifier, xi as withErrorHandling, xn as recordMaskOnlyValue, xr as Synthesizer, xt as IntrinsicFunctionResolver, y as ATOMIC_FINAL_SNAPSHOT_TYPES, yn as maskSecretsInError, yr as AssetManifestLoader, yt as disableInstanceApiTermination, z as toFiniteNumber, zn as orphansCarriedFrom, zr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, zt as configStringRefusal } from "./deploy-engine-BMp4b4Vl.js";
-import { S as truncateCodePoints, _ as withSkipPrefix, b as displayIdent, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as displaySafe, y as UNRENDERABLE } from "./logger-th1myfgh.js";
+import { $ as secretBearing, $n as ensureAssetStorage, $r as setAwsClients, $t as s3BucketRegionalDomainName, A as extractDeploymentEventError, Ai as retryClassificationText, An as buildForceUnlockCommand, Ar as resolveSkipPrefix, At as parameterTypeMayLoseSecretIdentity, B as toCfnInteger, Bn as orphansAfterRollback, Br as uploadCfnTemplate, Bt as configIntegerRefusal, C as buildFinalSnapshotIdentifier, Ci as withErrorHandling, Cn as recordMaskOnlyValue, Cr as Synthesizer, Ct as IntrinsicFunctionResolver, D as refusesFinalSnapshot, Di as isTransientServerError, Dn as LockManager, Dr as resolveApp, Dt as getAccountInfo, E as isFinalSnapshotError, Ei as isThrottlingError, En as scrubResourceRecord, Er as getLegacyStateBucketName, Et as coerceParameterTypedValue, F as isStatefulRecreateTargetSync, Fn as CUSTOM_RESOURCE_RESPONSE_PREFIX, Fr as warnDeprecatedNoPrefixCliFlag, Ft as resolveExplicitPhysicalId, G as gray, Gn as WorkGraph, Gr as derivePartitionAndUrlSuffix, Gt as requireConfigObject, H as formatResourceLine, Hn as shouldRetainResource, Hr as expectedOwnerParam, Ht as readConfigString, I as renderStatefulReason, In as DEFAULT_STATE_PREFIX, Ir as CFN_TEMPLATE_BODY_LIMIT, It as assertRegionMatch, J as yellow, Jn as loadPublishableAssetManifest, Jt as producerRegionsFromState, K as green, Kn as buildAssetRedirectMap, Kr as AssemblyReader, Kt as requireConfigString, L as WARM_THROUGHPUT_MEMBERS, Ln as exportNamesCarriedFrom, Lr as CFN_TEMPLATE_URL_LIMIT, Lt as coerceCfnBoolean, M as planOrphanAdoption, Mn as forceQuitRecoveryClause, Mr as resolveStateBucketWithDefaultAndSource, Mt as isSettledInstanceState, N as MULTI_REGION_RECREATE_BLOCKED_TYPES, Nn as formatLockExpiry, Nr as resolveUseCdkBootstrapAssets, Nt as WAFv2WebACLProvider, O as unsupportedFinalSnapshotError, Oi as markNonRetryable, On as S3StateBackend, Or as resolveAutoAssetStorage, Ot as isImpossibleEmptyStoredAttribute, P as isStatefulRecreateTargetForReplace, Pn as shellQuote, Pr as stateBucketExistenceConfirmed, Pt as normalizeAwsTagsToCfn, Q as isExportAliasCollision, Qn as assertAssetBucketRegion, Qr as resetAwsClients, Qt as s3BucketDualStackDomainName, R as coerceWarmThroughput$1, Rn as importableOutputKeys, Rr as MIGRATE_TMP_PREFIX, Rt as coerceCfnInteger, S as PRE_DELETE_SNAPSHOT_TYPES, Si as normalizeAwsError, Sn as maskSecretsInText, Sr as getDockerImageBySourceHash, St as isTerminationProtectionPropagationError, T as createPreDeleteFinalSnapshot, Ti as isRetryableTransientError, Tn as redactSecretsForState, Tr as getDefaultStateBucketName, Tt as cfnRefValueFromPhysicalId, U as bold, Un as AssetPublisher, Ur as PARTITION_TABLE, Ut as replayWarn, V as toFiniteNumber, Vn as orphansCarriedFrom, Vr as CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION, Vt as configStringRefusal, W as cyan, Wn as stringifyValue, Wr as canonicalizeRegion, Wt as requireConfigArray, X as collectPublishedOutputNames, Xn as AssetModeResolver, Xr as AwsClients, Xt as s3BucketArn, Y as collectDeclaredOutputNames, Yn as rewriteTemplateAssetReferences, Yr as resolveBucketRegion, Yt as withSharedDrainBudget, Z as exportAliasCollisionScrubWarning, Zn as BOOTSTRAP_MARKER_PREFIX, Zr as getAwsClients, Zt as s3BucketDomainName, _ as isSecretBearingReferenceString, _i as StackTerminationProtectionError, _n as errorCauseChain, _r as runDockerForeground, _t as slowCcOperationTimeoutMs, a as DeploymentEventsStore, ai as DeployCancelledError, an as findSilentDropProperties, ar as validateContainerRepoName, at as clearOnUpdateRemoval, b as bindingSkippedOutputs, bn as markSameGenerationBag, br as stripControlChars, bt as deleteSkipReason, c as replayFailedOperations, ci as LocalInvokeBuildError$1, cn as DagBuilder, cr as buildDockerImage, ct as createMaskedRetryLogger, d as updatePartialReason, di as NestedStackChildDirectDestroyError, dn as STATE_SOURCED_CROSS_GENERATION_RULES, dr as describeDockerFailure, dt as beginCommandInterruptScope, en as s3BucketWebsiteUrl, er as getBootstrapMarkerKey, et as secretBearingStateKeyWarning, f as withResourceDeadline, fi as PartialFailureError, fn as STATE_SOURCED_READBACK_RULES, fr as dockerSpawnEnvWithSensitive, ft as endCommandInterruptScope, g as bagHoldsSecretExpression, gi as StackHasActiveImportsError, gn as dynamicReferenceTokens, gr as redactDockerArgvValues, gt as CloudControlProvider, h as computeImplicitDeleteEdges, hi as ResourceUpdateNotSupportedError, hn as createSecretMasker, hr as partitionSensitiveEnv, ht as startInterruptWatch, i as DeploymentEventsReader, in as findActionableSilentDrops, ir as validateAssetBucketName, it as collectInlinePolicyNamesManagedBySiblings, j as makeSiblingClaimReader, jn as buildLockContentionMessage, jr as resolveStateBucketWithDefault, jt as refStateLookupFromResource, k as makeCanonicalizePropertiesFn, ki as markRedactedCause, kn as rebuildClientForBucketRegion, kr as resolveCaptureObservedState, kt as isUnboundTemplateParameter, l as replayRollback, li as LocalStartServiceError, ln as TemplateParser, lr as describeDockerCapturedOutput, lt as maskDeep, m as IMPLICIT_DELETE_DEPENDENCIES, mi as ResourceTimeoutError, mn as carriesSecretMask, mr as getDockerCmd, mt as isInterruptedWaitError, n as DEFAULT_RESOURCE_WARN_AFTER_MS, nn as DiffCalculator, nr as parseBootstrapMarker, nt as getCurrentResourceSecrets, o as planFailedOps, oi as DynamicReferenceRegionAmbiguousError, on as describeTypeWithThrottleRetry, or as buildDenyExternalAccessPolicy, ot as ProviderRegistry, p as maskingRetryLogger, pi as ProvisioningError, pn as TEMPLATE_SOURCED_RULES, pr as formatDockerLoginError, pt as interruptWatchListenerCount, q as red, qn as createAssetRedirectResolver, qr as processStackMessages, qt as classifyReplaySecretRegion, r as DeployEngine, ri as CrossAccountSecretRefusalError, rn as INTRINSIC_KEYS, rr as readBootstrapMarkerBody, rt as IAMRoleProvider, s as planRollback, si as IntrinsicResolutionRefusalError, sn as withRetry, sr as describeAwsFailure, st as wouldReturnToSdkProvider, t as DEFAULT_RESOURCE_TIMEOUT_MS, ti as CdkdError, tn as applyRoleArnIfSet, tr as isCrossRegionRedirect, tt as secretSafeKeyDisplay, u as updatePartialMessage, un as STATE_SOURCED_BASELINE_RULES, ur as describeDockerExecFailure, ut as maskerOrIdentity, v as keptWholeReasonText, vn as identityKeyFor, vr as runDockerStreaming, vt as UNSPECIFIED_SKIP_REASON, w as ccRoutedFinalSnapshotError, wi as isMarkedNonRetryable, wn as recoverMaskedOutput, wr as synthesisStatusMessage, wt as carriesDynamicReference, x as ATOMIC_FINAL_SNAPSHOT_TYPES, xn as maskSecretsInError, xr as AssetManifestLoader, xt as disableInstanceApiTermination, y as mergeNoChangeOutputs, yn as isSingleDynamicReferenceToken, yr as escapeRegExp, yt as deleteIndeterminateGuards, z as isWarmThroughputDecrease, zn as importableOutputs, zr as findLargeInlineResources, zt as configBooleanRefusal } from "./deploy-engine-B3yP0pHa.js";
+import { C as truncateCodePoints, S as displaySafe, _ as withSkipPrefix, b as UNRENDERABLE, c as PATTERN_B_NAME_OPTIONS, f as explicitNamePropertyFor, h as getCurrentStackName, i as reserveStdoutForPayload, l as PATTERN_B_NAME_PROPERTIES, m as generateResourceNameWithFallback, n as getLogger, o as runStackBuffered, p as generateResourceName, s as getLiveRenderer, u as PATTERN_B_RESOURCE_TYPES, v as withStackName, x as displayIdent, y as STACK_REF_MAX_CODE_POINTS } from "./logger-H8n5Qjhq.js";
 import { t as awsClientDefaults } from "./aws-client-defaults-D-iYiIJ6.js";
-import { t as getCdkdVersion } from "./version-XcHj8rQZ.js";
-import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-JRuQeFtl.js";
+import { t as getCdkdVersion } from "./version-wXpog0Ci.js";
+import { a as renderDisableCommand, i as protectedReplacementAdvice, r as UNNAMEABLE_ID_CLAUSE, t as ASGProvider } from "./asg-provider-BTsQjH_E.js";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { CopyObjectCommand, CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, NotFound, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -64114,6 +64114,40 @@ function containsSecretDynamicReference(value) {
 function templateHasSecretDynamicReference(template) {
 	return containsSecretDynamicReference(template);
 }
+/**
+* Can a condition verdict reach an output's VALUE in this template?
+*
+* The no-change merge preview (issue #3101) must not carry a failed output a
+* condition verdict could change, because `cdkd diff` evaluates `Conditions`
+* best-effort and its verdict can differ from the deploy's. An output never
+* reads a resource's template properties (a `Ref` or `Fn::GetAtt` reads the
+* stored record), so a verdict reaches its value only through the output's own
+* `Condition`, or an `Fn::If` / `{ Condition: ... }` outside `Resources`: in an
+* output, or in a mapping `Fn::FindInMap` returns. `Conditions` is skipped as
+* well, since a reference there composes a verdict and reaches an output only
+* through one of those. A verdict that prunes or keeps a resource differently
+* changes the resource set instead; where that leaves the diff seeing no change
+* the deploy sees, the warning naming every carried output already says the
+* next deploy may write a different value for it.
+*
+* Not "the template declares `Conditions`": CDK attaches `CDKMetadataAvailable`
+* to its `AWS::CDK::Metadata` resource in every env-agnostic stack, and that
+* test refused the preview for the default app shape.
+*/
+function templateLetsConditionsReachOutputs(template) {
+	for (const output of Object.values(template.Outputs ?? {})) if (output.Condition !== void 0) return true;
+	return Object.entries(template).some(([section, value]) => section !== "Resources" && section !== "Conditions" && readsConditionVerdict(value));
+}
+/** An `Fn::If`, or a `{ Condition: ... }` reference, anywhere under `value`. */
+function readsConditionVerdict(value) {
+	if (value === null || typeof value !== "object") return false;
+	if (Array.isArray(value)) return value.some(readsConditionVerdict);
+	const record = value;
+	if (Object.prototype.hasOwnProperty.call(record, "Fn::If")) return true;
+	const keys = Object.keys(record);
+	if (keys.length === 1 && keys[0] === "Condition") return true;
+	return Object.values(record).some(readsConditionVerdict);
+}
 /** Structural equality, mirroring the deploy engine's `outputMapsEqual` leaf rule. */
 function valuesEqual(a, b) {
 	if (a === b) return true;
@@ -64193,6 +64227,8 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 	const outputs = Object.create(null);
 	const exportNames = /* @__PURE__ */ new Set();
 	const failedKeys = /* @__PURE__ */ new Set();
+	const failedOutputKeys = /* @__PURE__ */ new Set();
+	let failuresMirrorDeploy = true;
 	const secretSourceKeys = /* @__PURE__ */ new Set();
 	const declaredKeys = /* @__PURE__ */ new Set();
 	const templateHasSecretReference = containsSecretDynamicReference(template);
@@ -64202,6 +64238,8 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 		outputs,
 		exportNames,
 		failedKeys,
+		failedOutputKeys,
+		failuresMirrorDeploy,
 		secretSourceKeys,
 		declaredKeys,
 		templateHasSecretReference,
@@ -64226,7 +64264,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 	}
 	for (const [outputKey, output] of Object.entries(template.Outputs)) {
 		if (output.Condition !== void 0 && conditions?.[output.Condition] === false) {
-			logger.debug(`Skipping output ${outputKey} — condition ${output.Condition} is false`);
+			logger.debug(`Skipping output ${stripControlChars(outputKey)} — condition ${stripControlChars(String(output.Condition))} is false`);
 			continue;
 		}
 		if (skippedOutputKeys?.has(outputKey) && !(storedOutputs !== void 0 && Object.prototype.hasOwnProperty.call(storedOutputs, outputKey))) {
@@ -64238,15 +64276,18 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 		try {
 			value = await resolveFn(structuredClone(output.Value));
 		} catch (error) {
-			logger.debug(`Diff could not resolve output ${outputKey}: ${String(error)}`);
+			logger.debug(`Diff could not resolve output ${stripControlChars(outputKey)}: ${stripControlChars(String(error))}`);
 			resolutionFailed = true;
 			recordFailure(outputKey, output);
+			failedOutputKeys.add(outputKey);
 			continue;
 		}
 		if (isUnresolvedValue(value, sourceUsedSub)) {
-			logger.debug(`Diff left output ${outputKey} unresolved (references a pending resource)`);
+			logger.debug(`Diff left output ${stripControlChars(outputKey)} unresolved (references a pending resource)`);
 			resolutionFailed = true;
 			recordFailure(outputKey, output);
+			if (value === void 0) failedOutputKeys.add(outputKey);
+			else failuresMirrorDeploy = false;
 			continue;
 		}
 		outputs[outputKey] = value;
@@ -64257,8 +64298,9 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 			if (typeof exportName !== "string") try {
 				exportName = await resolveFn(structuredClone(exportName));
 			} catch (error) {
-				logger.debug(`Diff could not resolve Export.Name of ${outputKey}: ${String(error)}`);
+				logger.debug(`Diff could not resolve Export.Name of ${stripControlChars(outputKey)}: ${stripControlChars(String(error))}`);
 				resolutionFailed = true;
+				failuresMirrorDeploy = false;
 				continue;
 			}
 			if (typeof exportName === "string" && !isUnresolvedValue(exportName, exportSourceUsedSub)) {
@@ -64272,18 +64314,24 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 						logger.debug(`Diff cannot decide the export alias of ${stripControlChars(outputKey)} — a literal name may contain a resolved secret and state does not hold that key`);
 						failedKeys.add(exportName);
 						resolutionFailed = true;
+						failuresMirrorDeploy = false;
 					}
 				} else {
 					outputs[exportName] = value;
 					exportNames.add(exportName);
 				}
-			} else resolutionFailed = true;
+			} else {
+				resolutionFailed = true;
+				failuresMirrorDeploy = false;
+			}
 		}
 	}
 	return {
 		outputs,
 		exportNames,
 		failedKeys,
+		failedOutputKeys,
+		failuresMirrorDeploy,
 		secretSourceKeys,
 		declaredKeys,
 		templateHasSecretReference,
@@ -64325,6 +64373,15 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 * Withholding is therefore record-level. The change is still REPORTED — only
 * the value is withheld — so `--fail` and the exports story are unaffected.
 *
+* A third input forces the same verdict: `forceLegacyRecord`, set by the
+* no-change merge preview (issue #3101) when a value it carried from state for
+* a failed output, an export alias included, is not itself a secret expression.
+* The first signal reads a carried key's desired side, which is then the stored
+* value, so evidence only its resolved value held is gone; and where a resolved
+* secret expression can come from (a stored attribute, a parameter, another
+* stack's outputs) is not enumerable. Nothing short of the carried key's own stored expression can
+* excuse it — the one value the per-key veto below would have excused.
+*
 * ## The key today's template cannot account for (issue #1948)
 *
 * Neither signal above covers an output DELETED from the template, and an
@@ -64383,7 +64440,7 @@ async function resolveTemplateOutputs(template, resolveFn, conditions, storedOut
 function computeOutputsDiff(current, desired, exportNames, secretSourceKeys = /* @__PURE__ */ new Set(), unaccountableScan = {}) {
 	const changes = [];
 	const currentBag = current ?? {};
-	const legacyRecord = Object.entries(currentBag).some(([name, oldValue]) => {
+	const legacyRecord = unaccountableScan.forceLegacyRecord === true || Object.entries(currentBag).some(([name, oldValue]) => {
 		if (typeof oldValue === "string" && isSecretBearingReferenceString(oldValue)) return false;
 		return containsSecretDynamicReference(desired[name]) || secretSourceKeys.has(name);
 	});
@@ -65363,8 +65420,28 @@ const STATE_RESOURCES_MALFORMED = "STATE_RESOURCES_MALFORMED";
 * nowhere. The predicate is the plain-object test the bag's own type implies.
 */
 function hasReadableResources(state) {
-	const bag = state.resources;
-	return typeof bag === "object" && bag !== null && !Array.isArray(bag);
+	return isReadableBag(state.resources);
+}
+/**
+* The plain-object test itself, without the `resources` field bound to it.
+*
+* Exported because {@link hasReadableResources} is not the only caller any
+* more: `cdkd state show` and `cdkd state resources` walk FOUR more record
+* containers with `Object.entries` — `outputs`, `skippedOutputs`, and each
+* resource's `attributes` and `properties` — and a non-object in any of them
+* fabricates rows exactly as the `resources` bag did (go-to-k/cdkd#3187).
+* Spelling the same test a second time there is what this export exists to
+* prevent: the two could then drift, and the one that drifted would fabricate
+* again while looking guarded.
+*
+* What it does NOT decide is whether a given container is malformed. That is a
+* per-container call, because absence means different things: an absent
+* `resources` bag is a defect ({@link hasReadableResources} says so), while an
+* absent `skippedOutputs` is the normal pre-#2740 record. Each caller pairs
+* this predicate with its own absence rule.
+*/
+function isReadableBag(container) {
+	return typeof container === "object" && container !== null && !Array.isArray(container);
 }
 /**
 * The shared explanation, in the terms the reader needs: what is wrong, what
@@ -65457,6 +65534,65 @@ function repairMalformedResourcesForReadOnly(state) {
 function malformedStateRefusalMessage(stackName, region) {
 	return `${malformedStateDetail(stackName, region)} This command can WRITE state, so it refuses rather than continuing: saving over a record whose resource map could not be read would replace the evidence with a well-formed empty one and lose it permanently. Repair or remove the record first.`;
 }
+/**
+* The warning a view emits when it emptied one or more {@link
+* RenderedStateContainer}s it could not walk (go-to-k/cdkd#3187).
+*
+* Deliberately NOT {@link malformedResourcesWarning}'s text, and the reason is
+* narrower than it looks. That one tells the reader not to run `cdkd deploy` /
+* `cdkd destroy` because an unreadable `resources` MAP is indistinguishable
+* from an empty stack: deploy would re-CREATE everything and destroy would
+* delete nothing. No container named here can produce that specific confusion —
+* the resource SET is still readable — so borrowing that sentence would attach
+* a re-create-the-world warning to a record whose resource list is intact.
+*
+* It is NOT that these containers are display-only. `properties` is read by the
+* deploy change calculation (`src/analyzer/diff-calculator.ts`), which imports
+* nothing from this module, and a non-object there compares unequal to any
+* desired object and yields a spurious property-change set — filed as
+* go-to-k/cdkd#3191. An earlier revision of this comment asserted the
+* display-only premise, which would have read as licence to drop a guard on
+* that path (review of go-to-k/cdkd#3190).
+*
+* What stays the same is the remedy: `--json` is the mode that shows the
+* stored value.
+*
+* ONE warning per record however many containers it names — a stack whose 500
+* resources all carry a hand-edited `properties` gets one line, not 500. The
+* caller FILTERS a fixed order (`RENDERED_CONTAINER_ORDER`), so the text is
+* stable across records. Not `.sort()` — that order is deliberately not
+* alphabetical, and its own JSDoc says so.
+*
+* Both identifiers are sanitized and then shell-quoted, and the command is
+* emitted LAST and UNWRAPPED, for the reasons {@link safeIdentifier}'s own note
+* gives.
+*
+* The container NAMES take {@link safeIdentifier} too — the SAME helper, so
+* they cannot drift from it — but NOT `shellQuote`, because they appear in the
+* PROSE and never inside the command this text tells the reader to run; the
+* command carries the two identifiers and nothing else.
+*
+* Sanitizing them is not dead code written for a case that cannot happen. The
+* union above is closed at COMPILE time, so without this the guarantee would
+* live in a comment, and the day a caller derives a name from a record instead
+* of from a literal an unsanitized element could forge a line, render as empty
+* quotes naming nothing, or run to kilobytes and push the remedy command off
+* the reader's screen. `safeIdentifier` closes all three and is the identity on
+* all four literals, so no user-visible text moves.
+*
+* What it does NOT close, stated rather than reassured away: a forged name made
+* only of printable ASCII still renders verbatim inside its quotes and could
+* read as prose. That residual is bounded to the PROSE — the command the reader
+* pastes is built from the two shell-quoted identifiers alone — and closing it
+* would mean JSON-quoting a name in the one place the text is meant to read as
+* English (review of go-to-k/cdkd#3190).
+*/
+function malformedRenderedContainersWarning(stackName, region, containers) {
+	const stack = safeIdentifier(stackName);
+	const reg = safeIdentifier(region);
+	const names = containers.map((name) => `'${safeIdentifier(name)}'`).join(", ");
+	return `State for ${shellQuote(stack)} (${shellQuote(reg)}) has a non-object ${names} — the record is malformed or truncated. 'Object.entries' walks a string or a list as readily as a map, so rendering one INVENTS a row per character or element. Continuing with it EMPTY: this view shows no rows there, which is not the same as the record holding none. A per-resource container is named once however many resources hold one. See the stored values with: cdkd state show ${shellQuote(stack)} --stack-region ${shellQuote(reg)} --json`;
+}
 /** The warning a caller of {@link repairMalformedResourcesForReadOnly} emits. */
 function malformedResourcesWarning(stackName, region) {
 	return `${malformedStateDetail(stackName, region)} Continuing with an EMPTY resource set: this command's output describes zero resources, which is not the same as the stack having none.`;
@@ -65720,7 +65856,7 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	const tokenParameterNames = new Set(Object.entries(parameters ?? {}).filter(([, value]) => carriesDynamicReference(value)).map(([name]) => name));
 	for (const name of tokenParameterNames) {
 		const declaredType = (template.Parameters?.[name])?.Type;
-		if (typeof declaredType === "string" && parameterTypeMayLoseSecretIdentity(declaredType)) logger.warn(`Stack ${stackName}: parameter '${name}' is declared 'Type: ${declaredType}' and is fed a secret dynamic reference. 'cdkd deploy' refuses this when the coercion actually destroys the plaintext (a comma-bearing secret in a list-typed parameter) — declare it 'Type: String' — and this diff compares the unresolved reference, shaped by the declared type only where that keeps every part of it a string.`);
+		if (typeof declaredType === "string" && parameterTypeMayLoseSecretIdentity(declaredType)) logger.warn(`Stack ${stripControlChars(stackName)}: parameter '${stripControlChars(name)}' is declared 'Type: ${stripControlChars(declaredType)}' and is fed a secret dynamic reference. 'cdkd deploy' refuses this when the coercion actually destroys the plaintext (a comma-bearing secret in a list-typed parameter) — declare it 'Type: String' — and this diff compares the unresolved reference, shaped by the declared type only where that keeps every part of it a string.`);
 	}
 	try {
 		const userParameters = {};
@@ -65784,16 +65920,36 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	const changedLogicalIds = new Set([...changes.values()].filter((c) => c.changeType !== "NO_CHANGE").map((c) => c.logicalId));
 	const bindingSkipped = bindingSkippedOutputs(outputsDigestSource, currentState.skippedOutputs, changedLogicalIds);
 	const resolved = await resolveTemplateOutputs(effectiveTemplate, resolveFn, conditions, currentState.outputs, bindingSkipped);
-	let outputChanges = [];
-	if (resolved.resolutionFailed) {
-		if (computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys, {
-			declaredKeys: resolved.declaredKeys,
-			templateHasSecretReference: resolved.templateHasSecretReference || inheritSecretBearingTemplate === true
-		}).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stackName} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. It is usually an output referencing a resource this deploy has yet to create.`);
-	} else outputChanges = computeOutputsDiff(currentState.outputs, resolved.outputs, resolved.exportNames, resolved.secretSourceKeys, {
+	const templateHasSecretReference = resolved.templateHasSecretReference || inheritSecretBearingTemplate === true;
+	const diffOutputsAgainst = (desired, exportNames, forceLegacyRecord = false) => computeOutputsDiff(currentState.outputs, desired, exportNames, resolved.secretSourceKeys, {
 		declaredKeys: resolved.declaredKeys,
-		templateHasSecretReference: resolved.templateHasSecretReference || inheritSecretBearingTemplate === true
+		templateHasSecretReference,
+		forceLegacyRecord
 	});
+	let outputChanges = [];
+	if (!resolved.resolutionFailed) outputChanges = diffOutputsAgainst(resolved.outputs, resolved.exportNames);
+	else {
+		const resourcesChange = diffCalculator.hasChanges(changes);
+		const merge = resolved.failuresMirrorDeploy && conditions !== void 0 && !templateLetsConditionsReachOutputs(template) && !resourcesChange ? mergeNoChangeOutputs({
+			persisted: currentState.outputs ?? {},
+			resolved: withFailedOutputsUndefined(resolved.outputs, resolved.failedOutputKeys),
+			declaredOutputs: effectiveTemplate.Outputs,
+			previousExportNames: new Set(importableOutputKeys(currentState)),
+			resolvedExportNames: [...resolved.exportNames]
+		}) : void 0;
+		if (merge?.kind === "merged") {
+			const storedOutputs = currentState.outputs ?? {};
+			const withheld = merge.carriedKeys.some((key) => !isSecretBearingReferenceString(storedOutputs[key]));
+			outputChanges = diffOutputsAgainst(merge.outputs, new Set(merge.exportNames), withheld);
+			const failed = [...resolved.failedOutputKeys];
+			const isStored = (key) => Object.prototype.hasOwnProperty.call(storedOutputs, key);
+			const compared = failed.filter(isStored);
+			const unstored = failed.filter((key) => !isStored(key));
+			const names = (keys) => keys.map(stripControlChars).join(", ");
+			const explainWithheld = withheld && outputChanges.some((change) => change.oldValueRedacted === true);
+			logger.warn(`Outputs of stack ${stripControlChars(stackName)}: ${failed.length} output(s) could not be resolved for this diff.` + (compared.length > 0 ? ` Compared at their stored values: ${names(compared)}.` : "") + (unstored.length > 0 ? ` No stored value under their own names: ${names(unstored)}.` : "") + ` The next deploy may write a value for any of them it can resolve.` + (explainWithheld ? ` Previous values in this Outputs section are withheld because a value carried from state for a failed output is not a secret reference, so this diff cannot rule out legacy plaintext in state. That reason no longer applies once every failed output resolves, though other legacy-plaintext checks still can withhold them.` : ""));
+		} else if (diffOutputsAgainst(resolved.outputs, resolved.exportNames).filter((change) => !resolved.failedKeys.has(change.name)).length > 0) logger.warn(`Outputs of stack ${stripControlChars(stackName)} may have changed, but one or more could not be resolved against current state — omitting the Outputs section from this diff. ` + (merge?.kind === "kept" ? keptWholeReasonText(merge.reason) : resourcesChange ? `It is usually an output referencing a resource this deploy has yet to create.` : `The stack has no resource change; this diff cannot preview what the deploy does with the outputs that failed here.`));
+	}
 	return {
 		changes,
 		outputChanges,
@@ -65803,6 +65959,21 @@ async function computeStackDiff(currentState, template, region, stackName, state
 	};
 }
 /**
+* The preview's bag in the shape `mergeNoChangeOutputs` reads from the deploy
+* engine: each failed OUTPUT present with the value `undefined`
+* (issue #3101). This resolver drops a failed key while the deploy keeps it,
+* and the merge tells "failed, keep the stored value" from "not produced,
+* remove it" by exactly that presence. A fresh null-prototype bag, like both
+* bags it stands between, so a resolved `__proto__` export alias survives the
+* copy as a data key.
+*/
+function withFailedOutputsUndefined(outputs, failedOutputKeys) {
+	const bag = Object.create(null);
+	for (const [key, value] of Object.entries(outputs)) bag[key] = value;
+	for (const key of failedOutputKeys) bag[key] = void 0;
+	return bag;
+}
+/**
 * Resolve a nested-stack child's input `Parameters` (declared on the parent's
 * `AWS::CloudFormation::Stack` row under `Properties.Parameters`) to scalar
 * values against the PARENT's deployed state + already-resolved parameters.
@@ -66312,7 +66483,7 @@ function renderOutputChangeLines(outputChanges, logFn) {
 */
 function renderDiffTree(node, isRoot, logFn) {
 	const hasChanges = nodeHasChanges(node);
-	if (hasChanges || node.blocking.length > 0) logFn(isRoot ? `\nStack ${node.stackName}:` : `\nNested stack: ${node.displayName}`);
+	if (hasChanges || node.blocking.length > 0) logFn(isRoot ? `\nStack ${stripControlChars(node.stackName)}:` : `\nNested stack: ${stripControlChars(node.displayName)}`);
 	if (hasChanges) {
 		const { create, update, delete: del } = renderChangeLines(node.changes, logFn, node.ccApiRoutes, node.adoptedOrphans);
 		const outputs = renderOutputChangeLines(node.outputChanges, logFn);
@@ -66877,6 +67048,7 @@ async function scrubCommand(stacks, options) {
 	let totalStacksScrubbed = 0;
 	let totalStacksWithUnscrubbableKeys = 0;
 	let totalStacksWithUnverifiableReads = 0;
+	let totalStacksWithUnverifiableLeaves = 0;
 	/**
 	* Stacks this `--dry-run` proceeded over with an UNREADABLE resources map
 	* (issue go-to-k/cdkd#3018). Tracked exactly like `indexUnreadable`: an
@@ -66958,8 +67130,12 @@ async function scrubCommand(stacks, options) {
 		if (scrubbed.recordsChanged > 0) {
 			totalStacksScrubbed++;
 			logger.info(`${options.dryRun ? "Would scrub" : "Scrubbed"} ${scrubbed.recordsChanged} resource record(s) in ${stack.stackName}`);
-		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
+		} else if (scrubbed.secretBearingKeys === 0 && scrubbed.unverifiableReads === 0 && scrubbed.unverifiableLeaves === 0 && indexConverged === 0) logger.info(`No plaintext secrets found in ${stack.stackName}`);
 		if (scrubbed.malformedResources) malformedRecords.push(stack.stackName);
+		if (scrubbed.unverifiableLeaves > 0) {
+			totalStacksWithUnverifiableLeaves++;
+			logger.warn(`${scrubbed.unverifiableLeaves} scan(s) in ${stack.stackName} were ABANDONED mid-value because a {{resolve:...}} reference could not be resolved (see the warnings above). The resolver stops at the first failing token, so a real secret after it in the same value recorded no needle — this stack is not reported clean. The count is per abandoned SCAN, not per secret: one record can contribute more than once (an output whose Export.Name and Value both abandon), and one abandoned scan can hide several unexamined leaves.`);
+		}
 		if (scrubbed.unverifiableReads > 0) {
 			totalStacksWithUnverifiableReads++;
 			logger.warn(`${scrubbed.unverifiableReads} cross-stack read(s) in ${stack.stackName} could NOT be verified — cdkd declines them by design (see the warnings above), so this stack is not reported clean.`);
@@ -66990,7 +67166,7 @@ async function scrubCommand(stacks, options) {
 		totalIndexEntriesUnexamined += unexamined.length;
 		logger.info(`Exports index (${indexRegion}): ${unexamined.length} entr${unexamined.length === 1 ? "y is" : "ies are"} published by a producer this run did not scrub, so nothing here read ${unexamined.length === 1 ? "its" : "their"} value. Coverage composes across the apps sharing this bucket and region — run each app's own cdkd scrub to reach its entries.`);
 	}
-	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0) {
+	if (totalStacksScrubbed === 0 && totalStacksWithUnscrubbableKeys === 0 && totalStacksWithUnverifiableReads === 0 && totalStacksWithUnverifiableLeaves === 0 && totalIndexEntriesConverged === 0 && indexUnwritten.length === 0 && indexUnreadable.length === 0 && malformedRecords.length === 0) {
 		if (failures.length === 0) {
 			logger.info("\nNo plaintext secrets found in any target stack state. Nothing to scrub.");
 			return;
@@ -67000,6 +67176,7 @@ async function scrubCommand(stacks, options) {
 	}
 	const failureNote = failures.length > 0 ? ` ${failures.length} stack(s) could NOT be scrubbed at all and are NOT covered by this summary — see the errors above.` : "";
 	const keyNote = totalStacksWithUnscrubbableKeys > 0 ? ` ${totalStacksWithUnscrubbableKeys} stack(s) hold plaintext in an output KEY, which cdkd scrub cannot rewrite — rename that output's Export.Name and redeploy.` : "";
+	const leafNote = totalStacksWithUnverifiableLeaves > 0 ? ` ${totalStacksWithUnverifiableLeaves} stack(s) had a {{resolve:...}} scan ABANDONED mid-value, so part of their state was never examined (see the warnings above).` : "";
 	const unverifiableNote = totalStacksWithUnverifiableReads > 0 ? ` ${totalStacksWithUnverifiableReads} stack(s) carry a cross-stack read cdkd declines to perform, so their imported values could NOT be checked — export a non-secret value (e.g. the secret's ARN) from the producer, or reference it from within its own account.` : "";
 	const indexNote = (() => {
 		const parts = [];
@@ -67009,20 +67186,20 @@ async function scrubCommand(stacks, options) {
 		return parts.join("");
 	})();
 	if (options.dryRun) {
-		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
-		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
+		if (totalStacksScrubbed > 0) logger.info(`\nPlan: ${totalStacksScrubbed} stack(s) hold plaintext secrets and would be scrubbed (--dry-run, no state written).${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret in Secrets Manager.`);
+		else logger.info(`\nPlan: no state record can be rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 		if (failures.length > 0) throw scrubStacksFailedError(failures);
 		if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, true);
 		if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
 		if (options.fail) throw new ScrubNeededError();
 		return;
 	}
-	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${indexNote}${failureNote}`);
-	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
+	if (totalStacksScrubbed > 0) logger.info(`\nDone: scrubbed ${totalStacksScrubbed} stack(s). The CURRENT state.json no longer holds the plaintext. Where the state bucket is VERSIONED — which cdkd bootstrap enables — the pre-scrub body survives as a noncurrent version, stays readable with GetObject and a VersionId, and scrub does not purge it. So a value that was ever persisted must be treated as compromised — ROTATE it in Secrets Manager (scrub matches the current value, so scrub BEFORE rotating); rotation is what makes any surviving version harmless.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote}`);
+	else logger.info(`\nNo state record was rewritten.${keyNote}${unverifiableNote}${leafNote}${indexNote}${failureNote} ROTATE any exposed secret.`);
 	if (failures.length > 0) throw scrubStacksFailedError(failures);
 	if (indexUnwritten.length > 0 || indexUnreadable.length > 0) throw exportIndexIncompleteError(indexUnwritten, indexUnreadable, false);
 	if (malformedRecords.length > 0) throw malformedRecordsAuditedError(malformedRecords);
-	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0)) throw new ScrubNeededError();
+	if (options.fail && (totalStacksWithUnscrubbableKeys > 0 || totalStacksWithUnverifiableReads > 0 || totalStacksWithUnverifiableLeaves > 0)) throw new ScrubNeededError();
 }
 /**
 * Every secret plaintext this run recorded, from ANY position in the template
@@ -68306,6 +68483,205 @@ function isNamelessDynamicReferenceFailure(err) {
 	return err instanceof Error && errorCauseChain(err).some((link) => link instanceof Error && link.message.includes(DYNAMIC_REFERENCE_PREFIX) && NAMELESS_DYNAMIC_REFERENCE_MARKERS.some((marker) => link.message.includes(marker)));
 }
 /**
+* The per-record line each counting site prints. Deliberately ONE SHORT
+* SENTENCE, and that is a fix rather than a style choice: the first cut emitted
+* a ~440-character paragraph PER RECORD at default verbosity, and the arm it
+* fires on is one a single `Default`-less parameter triggers for every resource
+* in the stack at once. Dozens of identical paragraphs bury the record names,
+* which are the only part a reader cannot reconstruct.
+*
+* The explanation is emitted ONCE PER STACK instead, by
+* {@link abandonedScanStackNote}.
+*
+* The CAUSE is absent on both arms: the sibling log at each site already prints
+* it through `maskSecretsInText`, and a resolver error echoes what it was
+* handed — which, after `pinCrossRegionSecrets`, can be a foreign plaintext.
+*
+* RESIDUAL on the `subject` the call sites pass. They compose
+* `maskSecretsInText(... displaySafe(id) ...)` — sanitise, then mask — and
+* `displaySafe` REPLACES a control character with a space rather than deleting
+* it, so it cannot JOIN a split needle (the go-to-k/cdkd#2874 direction) but it
+* can BREAK one, and it leaves `U+200B`-`U+200D` / `U+FEFF` untouched. A secret
+* would have to sit inside a template logical id or Outputs key to be reachable,
+* which is why `secretSafeKeyDisplay` is not used here — that one is for RESOLVED
+* state-bag keys. Recorded rather than closed: go-to-k/cdkd#3178 security review.
+*/
+function abandonedScanWarning(subject, verdict) {
+	return verdict === "count" ? `The {{resolve:...}} scan of ${subject} was ABANDONED — this record is NOT certified clean.` : `The {{resolve:...}} scan of ${subject} was cut short by a TEMPLATE problem — this record is NOT certified clean.`;
+}
+/**
+* The one-per-stack explanation behind {@link abandonedScanWarning}'s lines.
+*
+* Two arms, because they need opposite things said. The `count` arm is a
+* FINDING and gates; the reader needs the cause, which is verbose-only. The
+* `warn` arm does NOT gate, and a reader seeing "NOT certified clean" beside a
+* green exit has no way to tell a passing run from a broken one unless it says
+* so.
+*
+* The `warn` arm's remedy is deliberately two-sided. The dominant population is
+* a parameter with no `Default` — legal CloudFormation, no defect to fix — so
+* telling the reader only to "fix the template reference" describes a repair
+* that does not exist for them. It names what they CAN do and then says plainly
+* that scrub may simply not be able to certify the record.
+*/
+function abandonedScanStackNote(verdict, records) {
+	const subject = `${records} record(s) above`;
+	return verdict === "count" ? `${subject}: the resolver stops at the first {{resolve:...}} token it cannot fetch, so any secret after it in the same value recorded no needle and could not be rewritten. Re-run with --verbose for the cause of each.` : `${subject}: the scan stopped on something cdkd scrub cannot resolve with template defaults alone — an unresolvable Ref or Fn::GetAtt, a parameter with no Default, or a reference whose own argument still holds an unsubstituted \${...}. These do NOT fail --fail, because scrub takes no --parameters and a gate failure here could not be cleared. Give the parameter a Default, or resolve the reference, to let scrub certify these records; otherwise accept that it cannot.`;
+}
+/**
+* The verdict a counting site acts on: `count` (a finding — warn AND raise the
+* exit code), `warn` (say it, but do not gate) or `silent`.
+*
+* The middle arm exists because the EXCLUSION has a cost in
+* go-to-k/cdkd#3160's OWN harm direction, and two round-4 reviewers found it
+* independently. `resolver.resolve` walks the whole properties bag and ONE
+* throw aborts the rest of it — so a bag holding `{A: {Ref: NoSuchThing},
+* B: '{{resolve:secretsmanager:prod/db:...}}'}` has `B` abandoned by a failure
+* that is nothing to do with `B`. Excluding it means `B` records no needle, its
+* legacy plaintext is never rewritten, and the stack can still print
+* `No plaintext secrets found` at exit 0. Reachable accidentally (one
+* `Default`-less parameter empties the bag, so every `{Ref: <param>}` throws)
+* and, on a repo whose CI runs `--dry-run --fail`, defeatable on purpose by
+* adding one dangling `Ref` ahead of the secret. That loss is REAL and is not
+* repaired by making it visible — go-to-k/cdkd#3196 tracks scoping the resolve
+* per property so the sibling reference is still scanned.
+*
+* Counting it is not the answer — that is the round-2 blocker, an unclearable
+* red gate on a healthy stack. What the two failure modes do NOT share is
+* VISIBILITY: an operator can act on a warning naming the record, and a warning
+* gates nothing. So the excluded arm still speaks, and only the exit code is
+* withheld.
+*
+* **The ORDER of the three tests is load-bearing, and getting it wrong is how
+* round 5 nearly shipped a silent regression.** An earlier cut asked
+* `carriesFetchableDynamicReference` FIRST and returned `silent` on a miss,
+* which made a gate-downgrade test into a universal silencer. Because
+* `DYNAMIC_REFERENCE_INNER_CHAR` is `[^}]`, a token with a placeholder
+* ANYWHERE in it fails that test — including the dominant CDK spelling, where
+* the reference is assembled by an `Fn::Sub` over parameters that DO have
+* defaults:
+*
+* ```json
+* {"A": {"Fn::Sub": "{{resolve:ssm-secure:/deleted/${Env}/p}}"},
+*  "B": {"Fn::Sub": "{{resolve:secretsmanager:${Db}:SecretString:password}}"}}
+* ```
+*
+* Those assemble fine, `A` raises a RAW `ParameterNotFound`, `B` is abandoned
+* and records no needle — and the earlier order printed nothing at all. That is
+* go-to-k/cdkd#3160's own headline repro, silenced by the fix for a different
+* false positive.
+*
+* So the tests are separated by what each one is EVIDENCE of:
+*
+* - `carriesDynamicReference` — did this bag hold a reference at all? If not,
+*   nothing was lost and the pre-existing `logger.debug` is the right level.
+*   This, and only this, decides SILENCE.
+* - `isTemplateShapeResolutionFailure` / `carriesFetchableDynamicReference` —
+*   is the abandonment one an operator could act on? If not, it still gets said;
+*   it just does not gate. These decide the EXIT CODE, never the visibility.
+*/
+function abandonedScanVerdict(source, err) {
+	if (!carriesDynamicReference(source)) return "silent";
+	if (isTemplateShapeResolutionFailure(err) || !carriesFetchableDynamicReference(source)) return "warn";
+	return "count";
+}
+/**
+* `source` carries a `{{resolve:...}}` token cdkd could actually have FETCHED —
+* i.e. one whose argument holds no surviving `${...}` placeholder.
+*
+* `carriesDynamicReference` alone is too generous here, and the gap is not
+* theoretical: scrub resolves with `bestEffort`, under which
+* `rethrowStructuralSubFailure` returns EARLY, so an `Fn::Sub` over an unbound
+* placeholder does not throw — it warn-and-KEEPS the literal `${Field}`. The
+* assembled token is then a request for a JSON key literally named `${Field}`,
+* which fails as `Dynamic reference: key '${Field}' not found in secret '<id>'`.
+* That is not a fetch that failed; it is a token that was never fetchable,
+* because scrub has only template DEFAULTS and accepts no `--parameters`. It is
+* ALSO not excludable by message, since `key ... not found` is a class
+* go-to-k/cdkd#3160 asks to COUNT when the key was real. So the discriminator
+* has to be the TOKEN, not the error.
+*
+* `some`, not `every`: a bag holding one placeholder-bearing token and one
+* fully substituted token still counts, because the second one genuinely was
+* fetchable and its scan genuinely stopped.
+*
+* WHAT THIS DOES AND DOES NOT BUY, since round 5 shipped a cut that confused
+* the two. A `false` here downgrades the GATE only — the record is still named
+* at default verbosity by the `warn` arm. It must never decide SILENCE: the
+* inner class is `[^}]`, so a placeholder ANYWHERE in a token fails this test,
+* and the reference assembled by an `Fn::Sub` over DEFAULTED parameters is the
+* dominant CDK spelling rather than an edge case.
+*
+* STATED RESIDUALS, both UNDER-counts against the gate, neither a silence:
+*
+* - A two-argument `Fn::Sub` whose placeholder IS bound
+*   (`{'Fn::Sub': ['{{resolve:ssm:${N}}}', {N: 'x'}]}`) substitutes fine and
+*   yields a fetchable token, but the raw bag still spells `${`, so a real
+*   fetch failure there warns instead of gating.
+* - The same for a single-argument `Fn::Sub` over a defaulted parameter, and
+*   for a placeholder mid-token, which yields no token at all.
+*
+* And one OVER-count, recorded for symmetry: this predicate is BAG-scoped while
+* the failure is TOKEN-scoped, so a bag holding a placeholder-bearing token
+* BESIDE a genuinely fetchable one returns `true`, and a `key '${Field}' not
+* found` raised for the first is gated as if it came from the second. Safety
+* is in the right direction (a gate that fires, not a plaintext under `clean`),
+* and same-bag co-location bounds it.
+*
+* go-to-k/cdkd#3181 is the fix that removes the need for any of these proxies.
+*/
+function carriesFetchableDynamicReference(source) {
+	if (typeof source === "string") return dynamicReferenceTokens(source).some((token) => !token.includes("${"));
+	if (Array.isArray(source)) return source.some(carriesFetchableDynamicReference);
+	if (source !== null && typeof source === "object") return Object.values(source).some(carriesFetchableDynamicReference);
+	return false;
+}
+/**
+* `err` is cdkd's OWN refusal to resolve a template SHAPE — a `Ref`, an
+* `Fn::GetAtt`, a parameter binding — rather than a failure to fetch a
+* `{{resolve:...}}` reference.
+*
+* Matched on cdkd-authored prose, which is sound here for the reason the
+* inverse is not: every string below is built by `intrinsic-function-resolver.ts`
+* itself, so it changes only when this repo changes it, and the fence in
+* `tests/unit/cli/scrub-abandoned-scan-origin.test.ts` reds when a throw site
+* there stops matching. An AWS-authored message could never carry that
+* guarantee.
+*/
+function isTemplateShapeResolutionFailure(err) {
+	if (!(err instanceof Error)) return false;
+	return TEMPLATE_SHAPE_FAILURE_PATTERNS.some((pattern) => pattern.test(err.message));
+}
+/**
+* The cdkd-authored messages {@link isTemplateShapeResolutionFailure} excludes,
+* ANCHORED. A substring test cannot be used here and the reason is concrete:
+* `'Parameter '` alone also matches the SDK's own `Parameter /deleted not
+* found.` — `ParameterNotFound`, this issue's HEADLINE repro — so the loose
+* spelling would have excluded the very case the positional half exists to
+* catch. Each pattern must stay tight enough that no AWS-authored message can
+* satisfy it.
+*
+* Deliberately just these THREE, not every shape failure the resolver can
+* raise. They are the ones that fire EN MASSE on a healthy stack:
+* `resolveParameters` is caught wholesale by `scrubStack`, so one
+* `Default`-less parameter empties the whole bag and every `{Ref: <param>}`
+* throws; and `resolveGetAtt` refuses on the same condition as `resolveRef`,
+* which a branch adding a not-yet-deployed resource hits for every
+* `Fn::GetAtt` to it. A rarer shape failure (an `Fn::Select` over a
+* non-array, say) is a genuine template defect, and counting a leaf whose
+* scan it abandoned is not wrong — the scan really did stop. Over-counting
+* THERE costs a warn on a broken template; over-counting on the three below
+* would cost a red CI gate on a working one.
+*
+* Per-pattern throw sites, and the fence that keeps them true, are in
+* `tests/unit/cli/scrub-abandoned-scan-origin.test.ts`.
+*/
+const TEMPLATE_SHAPE_FAILURE_PATTERNS = [
+	/^Ref \S+ not found$/,
+	/^Resource \S+ not found for Fn::GetAtt$/,
+	/^Parameter \S+ is required but no value was provided/
+];
+/**
 * A secrets map with its OWN identity whose entries ARE `target`'s (issue
 * #2531): every read and write goes to `target`; nothing is stored here.
 *
@@ -68736,6 +69112,33 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 	*/
 	const orphanSecrets = /* @__PURE__ */ new Map();
 	const prePassFindings = { unverifiable: [] };
+	/**
+	* Leaves whose dynamic-reference scan was ABANDONED mid-token (issue
+	* go-to-k/cdkd#3160). A counted finding, not a refusal — see
+	* `abandonedScanVerdict` for why these cannot refuse.
+	*/
+	let unverifiableLeaves = 0;
+	let ungateableAbandonedScans = 0;
+	/**
+	* ONE note per stack per arm. The per-record lines are deliberately short
+	* (see `abandonedScanWarning`), so this is where the explanation lives, and
+	* emitting it after the loops rather than at the first occurrence is what
+	* lets it say HOW MANY records it is explaining.
+	*
+	* A CLOSURE called at BOTH returns, not a block at the late one. The early
+	* `totalSecrets === 0` return is the DOMINANT path for an abandoned scan --
+	* an abandoned scan records no needle, which is the whole defect -- so a
+	* single late emission left the note unreachable for exactly the case it
+	* exists to explain. `emitted` because the two call sites are exclusive
+	* today and a third would not be.
+	*/
+	let notesEmitted = false;
+	const emitAbandonedScanNotes = () => {
+		if (notesEmitted) return;
+		notesEmitted = true;
+		if (unverifiableLeaves > 0) logger.warn(abandonedScanStackNote("count", unverifiableLeaves));
+		if (ungateableAbandonedScans > 0) logger.warn(abandonedScanStackNote("warn", ungateableAbandonedScans));
+	};
 	try {
 		const loaded = await stateBackend.getState(stack.stackName, region);
 		if (!loaded) {
@@ -68745,6 +69148,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 				secretsFound: 0,
 				secretBearingKeys: 0,
 				unverifiableReads: 0,
+				unverifiableLeaves: 0,
 				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
 			};
 		}
@@ -68818,6 +69222,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					await resolver.resolve(resolveInput, resourceContext);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+					const leafVerdict = abandonedScanVerdict(resolveInput, err);
+					if (leafVerdict !== "silent") {
+						if (leafVerdict === "count") unverifiableLeaves++;
+						else ungateableAbandonedScans++;
+						logger.warn(maskSecretsInText(abandonedScanWarning(`resource '${displaySafe(logicalId)}'`, leafVerdict), recordedSecretValues));
+					}
 					logger.debug(`Resolution of ${logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 				perResourceTemplateProps.set(logicalId, templateResource.Properties);
@@ -68840,6 +69250,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					await resolver.resolve(resolveInput, resolverContext(recordedSecretValues));
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+					const leafVerdict = abandonedScanVerdict(resolveInput, err);
+					if (leafVerdict !== "silent") {
+						if (leafVerdict === "count") unverifiableLeaves++;
+						else ungateableAbandonedScans++;
+						logger.warn(maskSecretsInText(abandonedScanWarning(`orphan record '${displaySafe(record.logicalId)}'`, leafVerdict), recordedSecretValues));
+					}
 					logger.debug(`Resolution of orphan record ${record.logicalId} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), recordedSecretValues)}`);
 				}
 			}
@@ -68863,6 +69279,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 						exportName = await resolver.resolve(nameSource, nameContext);
 					} catch (err) {
 						if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+						const leafVerdict = abandonedScanVerdict(nameSource, err);
+						if (leafVerdict !== "silent") {
+							if (leafVerdict === "count") unverifiableLeaves++;
+							else ungateableAbandonedScans++;
+							logger.warn(maskSecretsInText(abandonedScanWarning(`the Export.Name of output '${displaySafe(name)}'`, leafVerdict), outputSecrets));
+						}
 						nameFailed = true;
 						nameError = err;
 					}
@@ -68901,6 +69323,12 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 					await resolver.resolve(valueSource, valueContext);
 				} catch (err) {
 					if (isRegionAmbiguousRefusal(err) || isNamelessDynamicReferenceFailure(err)) throw err;
+					const leafVerdict = abandonedScanVerdict(valueSource, err);
+					if (leafVerdict !== "silent") {
+						if (leafVerdict === "count") unverifiableLeaves++;
+						else ungateableAbandonedScans++;
+						logger.warn(maskSecretsInText(abandonedScanWarning(`output '${displaySafe(name)}'`, leafVerdict), outputSecrets));
+					}
 					logger.debug(`Resolution of output ${name} during scrub was partial: ${maskSecretsInText(err instanceof Error ? err.message : String(err), outputSecrets)}`);
 				}
 			}
@@ -68914,15 +69342,19 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			logger.warn(secretBearingStateKeyWarning(stack.stackName, display));
 		}
 		const totalSecrets = outputSecrets.size + [...perResourceSecrets.values()].reduce((n, m) => n + m.size, 0) + [...orphanSecrets.values()].reduce((n, m) => n + m.size, 0);
-		if (totalSecrets === 0) return {
-			recordsChanged: 0,
-			secretsFound: 0,
-			secretBearingKeys: secretBearingKeys.length,
-			unverifiableReads: prePassFindings.unverifiable.length,
-			...malformedResources ? { malformedResources } : {},
-			outputs: state.outputs,
-			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
-		};
+		if (totalSecrets === 0) {
+			emitAbandonedScanNotes();
+			return {
+				recordsChanged: 0,
+				secretsFound: 0,
+				secretBearingKeys: secretBearingKeys.length,
+				unverifiableReads: prePassFindings.unverifiable.length,
+				unverifiableLeaves,
+				...malformedResources ? { malformedResources } : {},
+				outputs: state.outputs,
+				exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
+			};
+		}
 		let recordsChanged = 0;
 		const newResources = {};
 		for (const [logicalId, record] of Object.entries(state.resources ?? {})) {
@@ -68951,6 +69383,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			};
 		});
 		const newOutputs = redactUnaccountedOutputs(outputSecrets.size > 0 ? redactSecretsForState(state.outputs, outputSecrets, outputsSourceUntrusted ? void 0 : outputsTemplateSource, TEMPLATE_SOURCED_RULES) : state.outputs, state.outputs, accountedOutputKeys, allRecordedSecrets(outputSecrets, perResourceSecrets, orphanSecrets));
+		emitAbandonedScanNotes();
 		if (JSON.stringify(newOutputs) !== JSON.stringify(state.outputs)) recordsChanged++;
 		if (recordsChanged > 0 && !opts.dryRun) {
 			const { skippedOutputs: _droppedByScrub, ...carriedState } = state;
@@ -68968,6 +69401,7 @@ async function scrubStack(stack, region, stateBackend, lockManager, opts) {
 			secretsFound: totalSecrets,
 			secretBearingKeys: secretBearingKeys.length,
 			unverifiableReads: prePassFindings.unverifiable.length,
+			unverifiableLeaves,
 			...malformedResources ? { malformedResources } : {},
 			outputs: newOutputs,
 			exportNameDisplay: (name) => secretSafeKeyDisplay(name, outputSecrets)
@@ -75430,7 +75864,13 @@ async function buildCdkdStateStackTree(rootStackName, region, stateBackend, pref
 }
 async function walkCdkdStateStackTree(stackName, region, state, stateBackend) {
 	const nestedChildren = /* @__PURE__ */ new Map();
-	for (const [logicalId, entry] of Object.entries(state.resources ?? {})) {
+	if (!hasReadableResources(state)) return {
+		stackName,
+		region,
+		state,
+		nestedChildren
+	};
+	for (const [logicalId, entry] of Object.entries(state.resources)) {
 		if (entry?.resourceType !== "AWS::CloudFormation::Stack") continue;
 		const childStackName = `${stackName}~${logicalId}`;
 		const childResult = await stateBackend.getState(childStackName, region);
@@ -77556,14 +77996,74 @@ function isoTimestampOrNull(value) {
 * PROMPT is strictly worse than one in an error, because the sentence it
 * corrupts is the one the operator answers `y` to.
 *
-* `asciiOnly` matches the lock error's own call on these same values — a
-* stack name and an AWS region both have a known charset — and is a no-op on
-* every ordinary input, so the shipped prompt strings are byte-identical.
-* `UNRENDERABLE` stands in when sanitising leaves nothing, since an empty
-* `()` would read as "no region" rather than "a region cdkd will not print".
+* BOTH halves go through `displayIdent`, not the bare `safe()` allowlist below
+* (issue #3164). The allowlist closes line FORGERY and nothing else: it is the
+* identity on printable ASCII, and this function's ` (` / `)` is cdkd's OWN
+* annotation of the line, so a planted 2-segment legacy key
+* `cdkd/ProdStack (us-east-1)/state.json` yields a region-LESS ref whose
+* `stackName` is literally `ProdStack (us-east-1)` and renders BYTE-EQUAL to
+* the genuine `ProdStack` in `us-east-1`. A `while read -r ref` cleanup loop —
+* the consumer the sanitization exists for — cannot tell the two apart, so it
+* acts on the reference the operator believes is real and the planted record
+* survives the sweep. The join in the two prompt callers is a second boundary
+* of the same kind: they `join(', ')`, which a name carrying `, ` forges an
+* extra entry in -- and quoting closes that, since a space is outside
+* `PLAIN_IDENT`.
+*
+* A BARE `,` is NOT closed, and an earlier revision of this comment was wrong
+* to call it harmless: the formatter supplies the space that completes the
+* separator, so `ProdStack,` renders `ProdStack, (us-east-1)` and a two-target
+* list reads as THREE entries. Only `state refresh-observed` prints a count
+* beside its list; `state orphan`'s banner prints none, so there nothing on
+* screen contradicts the forged entry -- the worse of the two. Removing `,`
+* from `PLAIN_IDENT` would close it and was tried; it regresses a legitimate
+* IAM role ARN, whose role-name segment allows `[\w+=,.@-]`. Recorded on
+* go-to-k/cdkd#3179 rather than traded for that.
+*
+* `displayIdent` makes the boundary VISIBLE by JSON-quoting anything that is
+* not a plain identifier, so the row above reads `"ProdStack (us-east-1)"` and
+* no longer collides. It is applied to the REGION half too: a region is an S3
+* key segment (or, for a legacy record, the state body via `readLegacyRegion`),
+* so it is attacker-chosen in exactly the same way, and a planted region alone
+* renders `Decoy (x) (us-east-1)` — the same spoof from the right-hand side.
+*
+* Every legitimate row is byte-identical, because `displayIdent` is the
+* identity on a plain identifier and CloudFormation stack names
+* (`Parent~Child` included) and AWS region codes all are — so no fixture, no
+* script's grep and no round-trip into `cdkd state show` changes. It keeps
+* `safe()`'s `UNRENDERABLE` fallback for a value sanitising leaves empty, since
+* an empty `()` would read as "no region" rather than "a region cdkd will not
+* print".
+*
+* The NAME half passes `STACK_REF_MAX_CODE_POINTS` rather than taking
+* `displayIdent`'s 255 default, and that is load-bearing for the paragraph
+* above rather than a tuning knob: a cdkd state-record name is not a
+* CloudFormation stack name, because `deriveChildStackName` appends
+* `~<logicalId>` per nesting level, so a legitimate deep nested-stack child
+* exceeds 255 and would be rendered CUT — a byte change on a legitimate row, in
+* the middle of a line `while read -r ref` consumes. The REGION half keeps the
+* default; an AWS region code is at most 25 characters.
+*
+* The consequence is taken at ALL SIX callers, the confirmation prompt
+* included, rather than at the listing alone: guarding one site and leaving
+* five is the per-site spelling `safe()`'s own comment below records having
+* failed twice. In the prompt a quoted spoof is the most valuable of the six —
+* that sentence is the one an operator answers `y` to.
+*
+* What the quoting is NOT: shell-safe. A JSON string literal is visually
+* indistinguishable from a shell DOUBLE-quoted argument, in which `$(...)`,
+* backticks and `!` still expand — so `"Prod$(touch /tmp/pwn)" (us-east-1)`
+* must not be pasted into a command line, and this rendering makes no claim
+* that it may be. The repo's answer for a value that has to survive a command
+* line is elsewhere and is SUPPRESSION, not quoting: `buildForceUnlockCommand`
+* declines to print a command at all unless sanitisation was the identity, and
+* `rollback-executor.ts`'s `PASTEABLE_LOGICAL_ID` records why identity alone is
+* still not enough (`~user` and `=x` expand). What this function provides is a
+* visible BOUNDARY for a value a human is reading, which is a different job.
 */
 function formatStackRefSafe(ref) {
-	return ref.region ? `${safe$1(ref.stackName)} (${safe$1(ref.region)})` : safe$1(ref.stackName);
+	const name = displayIdent(ref.stackName, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+	return ref.region ? `${name} (${displayIdent(ref.region)})` : name;
 }
 /**
 * One spelling of "this value came from an S3 key or a state record, and is
@@ -77588,6 +78088,29 @@ function formatStackRefSafe(ref) {
 * no-op on every legitimate input while an S3 key admits any UTF-8. Free-form
 * text (a parser's own message, an AWS error) takes the denylist class
 * instead; `display-safe.ts`'s header draws that line.
+*
+* It is the WEAKER of this file's two spellings and stays so deliberately.
+* `formatStackRefSafe` above uses `displayIdent` instead, because it renders
+* cdkd's own ` (region)` annotation right beside the value and the allowlist
+* cannot stop a value from carrying that annotation itself (issue #3164).
+* Widening this helper is tracked as go-to-k/cdkd#3179 rather than done here,
+* for reasons that are per-SITE rather than uniform, so read that issue's
+* table rather than generalising from this paragraph: most of these sites are
+* REFUSALS, where the surrounding `'...'` is at least SOME boundary -- but not
+* all of them are, and `  Region: ${safe(...)}` in the `--long` view below has
+* no surrounding anything -- while `Run 'cdkd deploy <stack>'` sites are
+* COMMAND HINTS, where quoting is not this repo's answer at all:
+* `buildForceUnlockCommand` SUPPRESSES the whole command instead.
+*
+* `grep safe(` does NOT enumerate the class, in BOTH directions. Some sites
+* spell `displaySafe(..., { asciiOnly: true })` inline rather than calling this
+* helper (`warnOnLiveForeignLock` renders its own `stack (region)` that way,
+* inside the same `state orphan` output); others sanitise NOTHING
+* (`stateRefreshObservedCommand` interpolates raw `listStacks` values into its
+* refusals, including a third `cdkd deploy` hint, and `stateDestroyCommand`
+* writes raw names into its `--all` confirmation list); and `describeStateKey`
+* (`state-file-keys.ts`) renders the same shape from raw key segments.
+* go-to-k/cdkd#3179 enumerates them all; a grep of this helper does not.
 */
 function safe$1(value) {
 	return displaySafe(value, { asciiOnly: true }) || "<unrenderable>";
@@ -77841,7 +78364,9 @@ async function stateResourcesCommand(stackName, options) {
 		if (!ref.region) throw new Error(`Stack '${safe$1(stackName)}' has only a legacy state record without a region. Run 'cdkd deploy ${safe$1(stackName)}' (or any cdkd write) to migrate it to the region-scoped layout, then re-run this command.`);
 		const stateResult = await setup.stateBackend.getState(stackName, ref.region);
 		if (!stateResult) throw new Error(`No state found for stack '${safe$1(stackName)}' (${safe$1(ref.region)}) in s3://${setup.bucket}/${setup.prefix}/. Run 'cdkd state list' to see available stacks.`);
-		const resources = stateResult.state.resources ?? {};
+		if (repairMalformedResourcesForReadOnly(stateResult.state)) logger.warn(malformedResourcesWarning(stackName, ref.region));
+		if (options.long || options.json) repairRenderedContainers(stateResult.state, RESOURCES_RENDERED_CONTAINERS, stackName, ref.region, logger);
+		const resources = stateResult.state.resources;
 		const details = Object.entries(resources).map(([logicalId, entry]) => {
 			const resource = entry ?? {};
 			return {
@@ -78049,9 +78574,11 @@ async function stateShowCommand(stackName, options) {
 		if (options.showNested) {
 			const treeWithLocks = await loadLocksForTree(await buildCdkdStateStackTree(stackName, ref.region, setup.stateBackend, stateResult.state), setup.lockManager, lockInfo);
 			if (options.json) {
+				warnUnreadableTreeNodes(treeWithLocks, logger);
 				process.stdout.write(`${JSON.stringify(treeToShowJson(treeWithLocks), null, 2)}\n`);
 				return;
 			}
+			repairTreeForTextRender(treeWithLocks, logger);
 			const lines = renderTreeWithChildren(treeWithLocks);
 			process.stdout.write(`${lines.join("\n")}\n`);
 			return;
@@ -78063,6 +78590,7 @@ async function stateShowCommand(stackName, options) {
 			}, null, 2)}\n`);
 			return;
 		}
+		repairRecordForTextRender(stateResult.state, stackName, ref.region, logger);
 		process.stdout.write(`${renderStateBlock(stateResult.state, lockInfo, true).join("\n")}\n`);
 	} finally {
 		setup.dispose();
@@ -78079,6 +78607,11 @@ const SKIPPED_DIGEST_PREVIEW_LEN = 12;
 const UNSERIALIZABLE = "(unserializable)";
 /**
 * The `skippedOutputs` rows a state record owes, sorted by key.
+*
+* The `?? {}` covers an ABSENT field — every pre-#2740 record, plus the writers
+* that drop it. A non-object one is emptied at the render entry instead
+* (`repairRenderedContainers`, issue go-to-k/cdkd#3187), so this walk and
+* {@link rendersSkippedBlock}'s cannot disagree about how many rows exist.
 */
 function sortedSkippedOutputs(state) {
 	return Object.entries(state.skippedOutputs ?? {}).sort(([a], [b]) => a.localeCompare(b));
@@ -78124,9 +78657,186 @@ function skippedOutputsLegend() {
 	];
 }
 /**
+* The order {@link repairRenderedContainers} names repaired containers in.
+*
+* Fixed here rather than taken from the order they were found in, so two
+* records that lost the same containers produce the same warning line and a
+* test can assert the text rather than a set.
+*/
+const RENDERED_CONTAINER_ORDER = [
+	"outputs",
+	"skippedOutputs",
+	"attributes",
+	"properties"
+];
+/** Every container {@link renderStateBlock}'s text walks. */
+const SHOW_RENDERED_CONTAINERS = new Set(RENDERED_CONTAINER_ORDER);
+/**
+* What `cdkd state resources` walks: the attribute bag alone.
+*
+* `properties` is deliberately absent — that command excludes them from every
+* mode (`docs/cli-state.md` says so and `stateResourcesCommand`'s own doc
+* repeats it), so warning about a container it never renders would report a
+* defect the user cannot see in the output in front of them. `outputs` and
+* `skippedOutputs` are absent for the same reason.
+*/
+const RESOURCES_RENDERED_CONTAINERS = /* @__PURE__ */ new Set(["attributes"]);
+/**
+* Empty every container this view walks but cannot read, and warn ONCE naming
+* the ones that were emptied (issue go-to-k/cdkd#3187).
+*
+* `renderStateBlock` and `stateResourcesCommand --long` walk four more
+* containers with `Object.entries` than the `resources` bag go-to-k/cdkd#3185
+* guarded, and `Object.entries` takes a string, a list, a number and a boolean
+* as readily as an object. Measured on the shipped bundle: `cdkd state show`
+* over a record whose `outputs` is a 5,000,000-character string and whose
+* `resources` bag is HEALTHY costs ~1616 ms and ~1010 MB RSS and emits
+* 5,000,002 lines; the same shape in `skippedOutputs` costs ~2436 ms and
+* ~2148 MB. `--show-nested` pays that per node.
+*
+* AT THE RENDER ENTRY, not at the four loops, which is the rule
+* `src/state/malformed-resources-bag.ts`'s header records and the measurement
+* behind it. Here the reason the entry wins is narrower but the same in kind:
+* the per-resource containers are reached from inside the resource loop, so a
+* guard written there is one decision repeated per resource per container, and
+* the `?? {}` already sitting at each of them is exactly the spelling that
+* looks like a guard and is not.
+*
+* **Absent is NOT malformed here, and that is a different call from the one
+* {@link hasReadableResources} makes.** `undefined` and `null` both mean "no
+* such container" for all four, and the `?? {}` at each walk has always
+* rendered the nullish case as empty, so none of them can fabricate a row.
+* An unreadable `resources` bag is judged the other way because
+* `Object.entries(null)` THROWS and takes the whole render with it.
+*
+* The stronger half of the reason covers TWO of the four, not all of them, and
+* saying so is the point: `skippedOutputs?` and `attributes?` are OPTIONAL in
+* `src/types/state.ts`, so cdkd itself writes records without them and warning
+* would be a false positive on healthy state. `outputs` and `properties` are
+* REQUIRED there, so a nullish one IS a malformed record and this exemption
+* rests on the weaker reason alone — it cannot invent a row, and it renders
+* identically to the empty bag the reader would otherwise see. Warning on a
+* nullish REQUIRED container would be defensible; it is not done because the
+* harm this guard exists for is fabrication (review of go-to-k/cdkd#3190).
+*
+* Callers must have repaired the `resources` bag first; both do — one line up
+* in `repairRecordForTextRender`, and ~30 lines up in `stateResourcesCommand`,
+* where the mode gate sits between them.
+* The bag test below is that ORDER made local rather than a fallback: an
+* unreadable bag is emptied by the repair, so the record renders zero resources
+* and owns no per-resource container to repair. It reads
+* {@link isReadableBag} rather than {@link hasReadableResources} on purpose —
+* the latter is the probe `tests/unit/cli/state-record-shape.test.ts` counts to
+* measure the nested walk, and a second caller here would silently inflate it.
+*/
+function repairRenderedContainers(state, walked, stackName, region, logger) {
+	const repaired = /* @__PURE__ */ new Set();
+	const emptyIfUnwalkable = (owner, name) => {
+		if (!walked.has(name)) return;
+		const container = owner[name];
+		if (container === void 0 || container === null) return;
+		if (isReadableBag(container)) return;
+		owner[name] = {};
+		repaired.add(name);
+	};
+	const record = state;
+	emptyIfUnwalkable(record, "outputs");
+	emptyIfUnwalkable(record, "skippedOutputs");
+	if ((walked.has("attributes") || walked.has("properties")) && isReadableBag(state.resources)) for (const entry of Object.values(state.resources)) {
+		if (!isReadableBag(entry)) continue;
+		const fields = entry;
+		emptyIfUnwalkable(fields, "attributes");
+		emptyIfUnwalkable(fields, "properties");
+	}
+	if (repaired.size === 0) return;
+	logger.warn(malformedRenderedContainersWarning(stackName, region, RENDERED_CONTAINER_ORDER.filter((name) => repaired.has(name))));
+}
+/**
+* Give the TEXT render a readable `resources` bag and readable value
+* containers, and warn when either was a repair rather than a no-op.
+*
+* {@link renderStateBlock} walks the bag with `Object.entries`, which takes a
+* string, a list, a number and a boolean as readily as an object. A planted
+* `"abcdef"` rendered six `[index, character]` pairs as six resources that do
+* not exist, under a `Resources (6):` header — and the cost grows with the
+* planted length, since one pair is allocated per character.
+*
+* Called AFTER every `--json` branch rather than at the load, which is this
+* command's one departure from the rule `src/state/malformed-resources-bag.ts`
+* states, and is deliberate: `cdkd state show --json` is the command
+* `cdkd state list --long` names as the way to SEE a record it could not count,
+* so repairing above that branch would hand the operator a well-formed
+* `"resources": {}` and delete the evidence they came for.
+*
+* That placement is only safe because ONE thing reads the bag earlier — the
+* `--show-nested` walker — and `walkCdkdStateStackTree` now returns a childless
+* node on an unreadable bag before it dereferences one. The comment at that
+* guard carries what the walker did with such a bag before, in both directions:
+* a scalar-element bag yielded no children but still allocated per element, and
+* a LIST of resource objects hard-failed. Do not move this call up, and do not
+* drop that guard: either one alone leaves the other half live.
+*
+* The guard is in the WALKER and not at its caller because the walker recurses.
+* A caller-side test covers the root record only, which is what an earlier cut
+* of this fix shipped — a healthy root naming a nested child still walked that
+* child's bag unguarded.
+*
+* The container pass runs SECOND and under the same `--json` placement, for one
+* reason each. Second, because {@link repairRenderedContainers} reads the
+* resource entries and the repair above is what guarantees there is a map to
+* read them from. Under the same placement, because `--json` emits the record
+* as parsed and a non-object `outputs` is evidence there exactly as a
+* non-object `resources` bag is — and because the payload carries the stored
+* value whole, it fabricates nothing to emit it.
+*/
+function repairRecordForTextRender(state, stackName, region, logger) {
+	if (repairMalformedResourcesForReadOnly(state)) logger.warn(malformedResourcesWarning(stackName, region));
+	repairRenderedContainers(state, SHOW_RENDERED_CONTAINERS, stackName, region, logger);
+}
+/**
+* The same repair for every node {@link renderTreeWithChildren} will render,
+* the root included. Each node carries its own record, so a CHILD with a
+* malformed bag fabricates rows exactly as the root does; one warning per
+* repaired record names which stack it came from.
+*
+* Both identifiers are strings by construction rather than record fields: the
+* walker builds a child's name as `` `${parent}~${logicalId}` `` and threads the
+* region it walked against, having already refused any child whose recorded
+* region disagrees.
+*/
+function repairTreeForTextRender(node, logger) {
+	repairRecordForTextRender(node.state, node.stackName, node.region, logger);
+	for (const child of node.children) repairTreeForTextRender(child, logger);
+}
+/**
+* Say which nodes the walk could not read, WITHOUT repairing any of them.
+*
+* `--show-nested --json` is the one mode that must not repair — it exists to
+* show the operator the stored record — but "cannot repair" is not "must stay
+* silent". An unreadable bag makes the walk return that node childless, and a
+* childless node is byte-indistinguishable from a genuine leaf: a consumer
+* enumerating `children` reads a CUT subtree as a complete one. The text views
+* do not have this problem, because a cut node renders `Resources (0):` where
+* the operator expected rows.
+*
+* `logger.warn` writes to stderr, and `stateShowCommand` has already called
+* `reserveStdoutForPayload()` for this branch, so this cannot corrupt the JSON.
+*/
+function warnUnreadableTreeNodes(node, logger) {
+	if (!hasReadableResources(node.state)) logger.warn(malformedResourcesWarning(node.stackName, node.region));
+	for (const child of node.children) warnUnreadableTreeNodes(child, logger);
+}
+/**
 * Render one stack's state record as a human-readable multi-line block —
 * the shared body used by both the single-stack default output and each
 * nested child rendered under `--show-nested`.
+*
+* Every caller must have run {@link repairRecordForTextRender} over the
+* record first (`repairTreeForTextRender` does it per node for the tree): the
+* resource walk below is what fabricates rows from a non-object bag, and the
+* `state.ts names renderStateBlock in CODE exactly 1 + 3 times` case in
+* `tests/unit/cli/state-record-shape.test.ts` refuses a fourth call site so
+* that choice cannot be made silently.
 */
 function renderStateBlock(state, lockInfo, withLegend) {
 	const lines = [];
@@ -78157,7 +78867,7 @@ function renderStateBlock(state, lockInfo, withLegend) {
 		}
 		if (withLegend) lines.push(...skippedOutputsLegend());
 	}
-	const resourceEntries = Object.entries(state.resources ?? {}).map(([logicalId, entry]) => [logicalId, entry ?? {}]).sort(([a], [b]) => a.localeCompare(b));
+	const resourceEntries = Object.entries(state.resources).map(([logicalId, entry]) => [logicalId, entry ?? {}]).sort(([a], [b]) => a.localeCompare(b));
 	lines.push("");
 	lines.push(`Resources (${resourceEntries.length}):`);
 	for (const [logicalId, resource] of resourceEntries) {
@@ -79238,11 +79948,39 @@ function snapshotNote(resourceType, effectiveProvisionedBy, skipFinalSnapshot) {
 * one calls `displaySafe()` directly and takes the DENYLIST -- the same class
 * `formatError` picks for a `cause`, and for the same reason. `grep displaySafe(`
 * answers how many; a count written here was wrong on its first revision.
+*
+* Scope is answered by grepping BOTH `safe(` and `safeStack(` -- the latter is
+* not matched by the former, and a sentence naming only one understates the
+* population by twelve.
 */
 function safe(value) {
 	return displayIdent(value);
 }
 /**
+* `safe()` for a cdkd STATE-RECORD STACK NAME specifically, which is the one
+* value class in this file whose legitimate grammar runs past `displayIdent`'s
+* 255-code-point default (issue #3164).
+*
+* A stack name here is not a CloudFormation stack name: `deriveChildStackName`
+* appends `~<logicalId>` per nesting level, and with CDK's ~60-character
+* generated nested-stack logical ids a legitimate child passes 255 around the
+* fourth level. Cutting one is a byte change on a LEGITIMATE value, and this
+* file is the worst place for it -- three of its renders are
+* `re-run 'cdkd rollback <stack>'` COPY-PASTE hints and one is the
+* confirmation prompt, so a cut name hands an operator an unrunnable command
+* mid-incident.
+*
+* It is a NAMED helper rather than a `maxCodePoints` argument repeated per
+* site, because a per-site spelling of exactly this rule is what issue #3164
+* exists to stop: the first cut of that fix widened ONE of this file's twelve
+* stack-name renders and left eleven cut. Every value that is NOT a stack name --
+* a region (at most 25 characters), a logical id, a resource type, a change
+* type -- keeps `safe()` and its tighter default.
+*/
+function safeStack(value) {
+	return displayIdent(value, { maxCodePoints: STACK_REF_MAX_CODE_POINTS });
+}
+/**
 * Human label for a planned rollback action (plan preview). `skipFinalSnapshot`
 * is threaded in because the classifier is pure (it cannot see CLI flags) and
 * the Snapshot label would otherwise promise a final snapshot the run is about
@@ -79321,7 +80059,7 @@ async function rollbackCommand(stackArg, options) {
 				return;
 			}
 			if (scoped.length > 1) {
-				const list = scoped.map((c) => `  - ${safe(c.stackName)} (${safe(c.region)})`).join("\n");
+				const list = scoped.map((c) => `  - ${safeStack(c.stackName)} (${safe(c.region)})`).join("\n");
 				throw new Error(`Multiple stacks have a rollback journal. Pick one:\n${list}\nRe-run 'cdkd rollback <stack>' (add --stack-region if the same name spans regions).`);
 			}
 			ref = scoped[0];
@@ -79354,8 +80092,8 @@ async function rollbackCommand(stackArg, options) {
 		try {
 			const stateData = await setup.stateBackend.getState(stackName, region);
 			const journal = await setup.stateBackend.loadRollbackJournal(stackName, region);
-			if (!journal || journal.segments.length === 0) throw new Error(`Nothing to roll back for '${safe(stackName)}' (${safe(region)}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
-			if (!stateData) throw new Error(`Rollback journal exists for '${safe(stackName)}' (${safe(region)}) but its state.json is missing (keys: ${safe(`${setup.prefix}/${stackName}/${region}`)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
+			if (!journal || journal.segments.length === 0) throw new Error(`Nothing to roll back for '${safeStack(stackName)}' (${safe(region)}). Run 'cdkd deploy' to (re)deploy, or 'cdkd destroy' to clean up.`);
+			if (!stateData) throw new Error(`Rollback journal exists for '${safeStack(stackName)}' (${safe(region)}) but its state.json is missing (keys: ${safe(setup.prefix)}/${safeStack(stackName)}/${safe(region)}/state.json and .../rollback-journal.json). State appears corrupted — inspect the bucket manually.`);
 			const baseState = stateData.state;
 			refuseMalformedState(baseState, stackName, region);
 			const stateResources = { ...baseState.resources };
@@ -79363,7 +80101,7 @@ async function rollbackCommand(stackArg, options) {
 			const orphanLogicalIds = new Set(options.orphan ?? []);
 			const newestSegment = journal.segments[journal.segments.length - 1];
 			if (newestSegment.roleArn && !options.roleArn) logger.info(`Note: the failed deploy ran with --role-arn ${safe(newestSegment.roleArn)}; this rollback is running with ambient credentials (pass --role-arn to match).`);
-			logger.info(`\nRollback plan for '${safe(stackName)}' (${safe(region)}):`);
+			logger.info(`\nRollback plan for '${safeStack(stackName)}' (${safe(region)}):`);
 			const planStateView = { ...stateResources };
 			for (let s = journal.segments.length - 1; s >= 0; s--) {
 				const segment = journal.segments[s];
@@ -79381,7 +80119,7 @@ async function rollbackCommand(stackArg, options) {
 			}
 			logger.info("");
 			if (!skipConfirmation) {
-				if (!await confirm(`Roll back '${safe(stackName)}' (${safe(region)})?`)) {
+				if (!await confirm(`Roll back '${safeStack(stackName)}' (${safe(region)})?`)) {
 					logger.info("Rollback cancelled");
 					return;
 				}
@@ -79419,7 +80157,7 @@ async function rollbackCommand(stackArg, options) {
 						const fresh = await setup.stateBackend.getState(stackName, region);
 						currentEtag = await setup.stateBackend.saveState(stackName, region, next(), { ...fresh?.etag !== void 0 && { expectedEtag: fresh.etag } });
 					} catch (retryError) {
-						logger.warn(`Failed to persist state after a rollback operation: ${displaySafe(retryError instanceof Error ? retryError.message : String(retryError))}. The resource was reverted in AWS; re-run 'cdkd rollback ${safe(stackName)}' to reconcile state.`);
+						logger.warn(`Failed to persist state after a rollback operation: ${displaySafe(retryError instanceof Error ? retryError.message : String(retryError))}. The resource was reverted in AWS; re-run 'cdkd rollback ${safeStack(stackName)}' to reconcile state.`);
 					}
 				}
 			};
@@ -79498,16 +80236,16 @@ async function rollbackCommand(stackArg, options) {
 			const survivingOrphans = orphansAfterRollback(baseState, mintedOrphans).orphans ?? [];
 			if (journal.segments.length === 0 && oldestInitialDeploy && Object.keys(stateResources).length === 0 && survivingOrphans.length === 0) {
 				await setup.stateBackend.deleteState(stackName, region);
-				logger.info(`State for '${safe(stackName)}' (${safe(region)}) removed (stack fully rolled back).`);
+				logger.info(`State for '${safeStack(stackName)}' (${safe(region)}) removed (stack fully rolled back).`);
 			}
-			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run 'cdkd rollback ${safe(stackName)}' to finish.`);
-			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run 'cdkd rollback ${safe(stackName)}' to retry.`);
+			if (interrupted) throw new PartialFailureError(`Rollback interrupted. Journal preserved — re-run 'cdkd rollback ${safeStack(stackName)}' to finish.`);
+			if (totalFailures > 0) throw new PartialFailureError(`Rollback completed with ${totalFailures} failed operation(s). Journal preserved — re-run 'cdkd rollback ${safeStack(stackName)}' to retry.`);
 			if (totalWarnings > 0) throw new PartialFailureError(`Rollback completed with ${totalWarnings} skipped/unrecoverable operation(s) (see warnings above).`);
-			logger.info(`\nRollback of '${safe(stackName)}' (${safe(region)}) complete.`);
+			logger.info(`\nRollback of '${safeStack(stackName)}' (${safe(region)}) complete.`);
 		} finally {
 			try {
 				await setup.lockManager.releaseLock(stackName, region).catch((err) => {
-					logger.warn(`Failed to release lock for '${safe(stackName)}' (${safe(region)}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
+					logger.warn(`Failed to release lock for '${safeStack(stackName)}' (${safe(region)}): ${displaySafe(err instanceof Error ? err.message : String(err))}`);
 				});
 			} finally {
 				process.removeListener("SIGINT", sigintHandler);
@@ -92998,4 +93736,4 @@ function buildProgram() {
 
 //#endregion
 export { buildProgram };
-//# sourceMappingURL=program-Ckl60p0E.js.map
+//# sourceMappingURL=program-BslZXdJR.js.map