@go-to-k/cdkd 0.295.0 → 0.296.0

package/dist/{provider-classes-DiWFkAOH.js → provider-classes-DMOnX5s-.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
-import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-B46YMG0h.js";
-import { $ as compositeIdFormatMessage, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, Ct as injectiveKeyPrefix, D as ProtectionFlipRegistry, Dn as markNameCollision, Dt as withPasteableAwsProfile, H as pasteableAwsCommand, Hn as markNonRetryable, In as describeAwsFailure, J as isInterruptedWaitError, Jt as ProvisioningError, L as userPoolProtectionSite, Ln as isAwsAuthoredFailure, M as observeThenDisableProtection, Mt as AccountIdUnavailableError, N as protectionFlipKey, Nn as isRetryableTransientError, On as markReplayMayCollide, Ot as ambientClientDefaults, P as rdsFamilyProtectionSite, Pn as isTransientServerError, Pt as CdkdError, Q as canonicalizeRoute53QueryName, Rn as safeStringify, S as quotedRemedyLogicalId, St as injectiveKey, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as markRedactedCause, V as isAwsCliLiteral, Vn as isThrottlingError, W as renderDisableCommand, Wn as wrapMaskedAwsError, X as ElapsedBudgetRegistry, Xt as ResourceUpdateNotSupportedError, Y as startInterruptWatch, _ as VALUE_NOT_SHOWN, _n as shellQuote, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, c as recordedPrincipalsRepair, ct as isSecretDerivedValue, dn as isInertUnquoted, dt as withDerivedNameMasks, et as compositeIdSeparatorRefusal, fn as pasteableCommand, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, i as holdsSecretDerivedEntry, j as logGroupProtectionSite, jn as isAmbiguousOutcomeError, jt as credentialFingerprint, k as deleteWithProtectionCompensation, kt as ambientCredentialConfig, ln as commandHole, lt as maskDeep, mn as plainOrDescribed, nt as logicalIdShown, o as readPrincipalLists, ot as createMaskedLogSinks, p as withRemovalDefaults, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedRetryLogger, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, un as hasClauseBreak, ut as maskerOrIdentity, v as isPlainImportJson, vn as withheldTargetClause, w as remedyLogicalId, x as normalizeAwsTagsToCfn, y as isPlainImportValue, z as UNNAMEABLE_ID_CLAUSE, zn as THROTTLING_ERROR_NAMES } from "./iam-policy-targets-CMSQGQnm.js";
+import { A as displaySafe, F as safeMsg, M as isPasteableIdent, P as plainIdentOr, g as generateResourceNameWithFallback, h as generateResourceName, j as displayStackName, k as displayIdent, n as getLogger, v as getCurrentStackName, w as SECRET_REF_MAX_CODE_POINTS } from "./logger-Dvc7ddKe.js";
+import { $ as compositeIdFormatMessage, $n as markRedactedCause, A as isTerminalDeleteFailure, B as WITHHELD_AWS_COMMAND, C as refusalTypeShown, D as ProtectionFlipRegistry, Dn as shellQuote, H as pasteableAwsCommand, Ht as AccountIdUnavailableError, J as isInterruptedWaitError, Jn as safeStringify, Kn as describeAwsFailure, L as userPoolProtectionSite, Ln as markNameCollision, Lt as withPasteableAwsProfile, M as observeThenDisableProtection, Mt as injectiveKey, N as protectionFlipKey, Nt as injectiveKeyPrefix, On as withheldTargetClause, P as rdsFamilyProtectionSite, Q as canonicalizeRoute53QueryName, Qn as markNonRetryable, Rn as markReplayMayCollide, Rt as ambientClientDefaults, S as quotedRemedyLogicalId, Sn as pasteableCommand, T as resolveExplicitPhysicalId, U as protectedReplacementAdvice, Un as isRetryableTransientError, V as isAwsCliLiteral, Vn as isAmbiguousOutcomeError, Vt as credentialFingerprint, W as renderDisableCommand, Wn as isTransientServerError, Wt as CdkdError, X as ElapsedBudgetRegistry, Y as startInterruptWatch, Yn as THROTTLING_ERROR_NAMES, Zn as isThrottlingError, _ as VALUE_NOT_SHOWN, a as onlySecretDerived, at as segmentAfterAnchor, b as isQuotableImportValue, bn as hasClauseBreak, bt as markAuxiliaryFailure, c as recordedPrincipalsRepair, ct as createMaskedRetryLogger, dt as maskerOrIdentity, er as wrapMaskedAwsError, et as compositeIdSeparatorRefusal, ft as withDerivedNameMasks, g as assertRegionMatch, h as RESOURCE_NOT_FOUND, ht as clearCreatedBeforeFailure, i as holdsSecretDerivedEntry, in as ProvisioningError, j as logGroupProtectionSite, k as deleteWithProtectionCompensation, lt as isSecretDerivedValue, nt as logicalIdShown, o as readPrincipalLists, on as ResourceUpdateNotSupportedError, ot as stateOrphanRecordRemedy, p as withRemovalDefaults, qn as isAwsAuthoredFailure, r as SECRET_DERIVED_READ_LIVE, rt as packCompositeId, st as createMaskedLogSinks, tt as compositeIdSkipResult, u as clearOnUpdateRemoval, ut as maskDeep, v as isPlainImportJson, w as remedyLogicalId, wn as plainOrDescribed, x as normalizeAwsTagsToCfn, xn as isInertUnquoted, xt as markCreatedBeforeFailure, y as isPlainImportValue, yn as commandHole, z as UNNAMEABLE_ID_CLAUSE, zt as ambientCredentialConfig } from "./iam-policy-targets-DSDSdxXz.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $i as isWarmThroughputDecrease, A as resolveDynamoDbDeleteBudgetClock, Ao as rewriteTemplateAssetReferences, B as getPriorAttempts, Bi as findSilentDropProperties, Bn as isTerminationProtectionPropagationError, D as beginDeleteWait, Da as hasMaskableValues, Di as refuseMalformedResourcesForDestroy, Dn as getCurrentResourceSecrets, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, F as waitForIndexesSettled, Fn as withIndeterminateGuard, Gs as renderAssemblyPathEscape, Hi as withoutSilentDropProperties, Hn as reDisableInstanceApiTermination, I as ECR_AUTO_DELETE_IMAGES_TAG, In as isWaitAbandonedError, It as REDACTED_DELETE_ADDRESS_SKIP_REASON, Ks as resolveAssemblyPath, L as S3_AUTO_DELETE_OBJECTS_TAG, Ln as markWaitAbandoned, Lt as isRedactedRecordedValue, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Ms as canonicalizeRegion, N as INDEX_SETTLE_POLL_INTERVAL_MS, Ns as derivePartitionAndUrlSuffix, O as compensateRemovedDeletionProtection, Or as passedParameterClassesOf, P as deleteTableWithIndexBusyRetry, Pn as deleteSkipReason, Qi as coerceWarmThroughput$1, R as hasCdkAutoDeleteTag, Ra as markSameGenerationBag, Rt as redactedDeleteAddressFields, T as DynamoDBGlobalTableProvider, To as stringifyValue, Tr as parseWebACLArn, Tt as getCurrentProducerRegions, Ua as dynamicReferenceTokens, Un as reEnableInstanceApiTermination, Us as describeFileReadFailure, V as markRefusedBeforeApplying, Va as recoverMaskedOutput, Vn as observeThenDisableInstanceApiTermination, Ws as displayAssemblyPath, Zi as WARM_THROUGHPUT_MEMBERS, _a as canonicalLambdaFunctionName, _n as refuseMalformedDesiredTags, a as findNestedTemplateTreeDefect, aa as configIntegerRefusal, bn as definedAttributes, c as renderNestedTemplateTreeDefect, ca as replayWarn, ci as refuseMalformedNestedChildOutputs, cn as earliestDefined, cr as s3BucketDomainName, da as requireConfigString, dr as s3BucketWebsiteUrl, ea as toCfnInteger, fn as acquireIdempotencyToken, ft as getCurrentNestedStackContext, ga as markAuxiliaryFailure, gn as readTagList, gt as awaitInFlightSibling, ha as withRetry, hn as planTagDiff, hr as getAccountInfo, ia as configBooleanRefusal, j as resolveDynamoDbDeleteBudgetMs, jn as unchangedBehindSecretReference, k as deleteBudgetKey, kn as slowCcOperationTimeoutMs, ks as decodeListingKey, la as requireConfigArray, lr as s3BucketDualStackDomainName, lt as revertNestedChildFromJournal, mn as DBPROXY_TAG_OPTIONS, na as coerceCfnBoolean, o as isAbsoluteAssetPath, oa as configStringRefusal, or as isSettledInstanceState, ot as getNestedRevertRun, pn as DBPROXY_TAGS_WHAT, pt as withNestedStackContext, qa as carriesSecretMask, ra as coerceCfnInteger, s as listNestedTemplateRows, sa as readConfigString, sr as s3BucketArn, t as DeployEngine, ta as toFiniteNumber, ua as requireConfigObject, un as reserveStackCreateToken, ur as s3BucketRegionalDomainName, va as lambdaFunctionNameForMask, vn as tagMapAsList, vt as getStackRecords, xn as stringifyIfAssigned, ya as sameLambdaFunctionAddress, yn as tagPlanWarning, z as isTruthyCfnBoolean, za as redactSecretsForState, zn as ec2InstanceProtectionSite, zt as redactedDeleteAddressSkip } from "./deploy-engine-CuI_h_Ml.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CyM-wxAp.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-Cbxe8TgI.js";
-import { RDSProvider } from "./rds-provider-D6_Rcnub.js";
-import { NeptuneProvider } from "./neptune-provider-BGVccWhg.js";
-import { ASGProvider } from "./asg-provider-DuAHOXvT.js";
+import { $a as dynamicReferenceTokens, $i as withoutSilentDropProperties, $n as reEnableInstanceApiTermination, A as resolveDynamoDbDeleteBudgetClock, An as definedAttributes, B as getPriorAttempts, Bo as rewriteTemplateAssetReferences, Bs as decodeListingKey, Cn as DBPROXY_TAGS_WHAT, Ct as getStackRecords, D as beginDeleteWait, Da as canonicalLambdaFunctionName, Dn as refuseMalformedDesiredTags, E as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, Ea as withRetry, En as readTagList, F as waitForIndexesSettled, Fo as stringifyValue, Fr as parseWebACLArn, Gn as withIndeterminateGuard, Gt as redactedDeleteAddressFields, I as ECR_AUTO_DELETE_IMAGES_TAG, Ja as markSameGenerationBag, Kn as isWaitAbandonedError, Kt as redactedDeleteAddressSkip, L as S3_AUTO_DELETE_OBJECTS_TAG, La as hasMaskableValues, Ln as getCurrentResourceSecrets, M as DELETE_INDEX_WAIT_PROCEED_NOTE, Mt as getCurrentProducerRegions, N as INDEX_SETTLE_POLL_INTERVAL_MS, O as compensateRemovedDeletionProtection, Oa as lambdaFunctionNameForMask, On as tagMapAsList, P as deleteTableWithIndexBusyRetry, Qn as reDisableInstanceApiTermination, R as hasCdkAutoDeleteTag, Ri as refuseMalformedResourcesForDestroy, Rr as passedParameterClassesOf, Sa as requireConfigString, Sn as acquireIdempotencyToken, T as DynamoDBGlobalTableProvider, Tn as planTagDiff, Tr as getAccountInfo, Us as canonicalizeRegion, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, V as markRefusedBeforeApplying, Vn as unchangedBehindSecretReference, Wn as deleteSkipReason, Ws as derivePartitionAndUrlSuffix, Wt as isRedactedRecordedValue, Xn as isTerminationProtectionPropagationError, Ya as redactSecretsForState, Yn as ec2InstanceProtectionSite, Za as recoverMaskedOutput, Zi as findSilentDropProperties, Zn as observeThenDisableInstanceApiTermination, _a as configStringRefusal, _r as s3BucketArn, _t as getCurrentNestedStackContext, a as findNestedTemplateTreeDefect, ba as requireConfigArray, bn as reserveStackCreateToken, br as s3BucketRegionalDomainName, c as renderNestedTemplateTreeDefect, ca as WARM_THROUGHPUT_MEMBERS, da as toCfnInteger, dt as getNestedRevertRun, ec as describeFileReadFailure, fa as toFiniteNumber, ga as configIntegerRefusal, gr as isSettledInstanceState, ha as configBooleanRefusal, j as resolveDynamoDbDeleteBudgetMs, jn as stringifyIfAssigned, k as deleteBudgetKey, ka as sameLambdaFunctionAddress, kn as tagPlanWarning, la as coerceWarmThroughput$1, ma as coerceCfnInteger, mt as revertNestedChildFromJournal, nc as renderAssemblyPathEscape, o as isAbsoluteAssetPath, pa as coerceCfnBoolean, qn as markWaitAbandoned, rc as resolveAssemblyPath, ro as carriesSecretMask, s as listNestedTemplateRows, t as DeployEngine, tc as displayAssemblyPath, ua as isWarmThroughputDecrease, va as readConfigString, vi as refuseMalformedNestedChildOutputs, vn as earliestDefined, vr as s3BucketDomainName, vt as withNestedStackContext, wn as DBPROXY_TAG_OPTIONS, xa as requireConfigObject, xr as s3BucketWebsiteUrl, xt as awaitInFlightSibling, ya as replayWarn, yr as s3BucketDualStackDomainName, z as isTruthyCfnBoolean, zn as slowCcOperationTimeoutMs } from "./deploy-engine-D7204v7Z.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, t as IAMRoleProvider } from "./iam-role-provider-CCPaZ3U4.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-B0sp_SHG.js";
+import { RDSProvider } from "./rds-provider-DltlcDiQ.js";
+import { NeptuneProvider } from "./neptune-provider-D1t9NgT-.js";
+import { ASGProvider } from "./asg-provider-AVCcoXnQ.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -48,7 +48,7 @@ import { AppSyncClient, CreateApiKeyCommand, CreateDataSourceCommand, CreateGrap
 import { ConcurrentModificationException, CrawlerRunningException, CreateConnectionCommand, CreateCrawlerCommand, CreateDatabaseCommand, CreateJobCommand, CreateSecurityConfigurationCommand, CreateTableCommand as CreateTableCommand$1, CreateTriggerCommand, CreateWorkflowCommand, DeleteConnectionCommand, DeleteCrawlerCommand, DeleteDatabaseCommand, DeleteJobCommand, DeleteSecurityConfigurationCommand, DeleteTableCommand as DeleteTableCommand$1, DeleteTriggerCommand, DeleteWorkflowCommand, EntityNotFoundException, GetConnectionCommand, GetCrawlerCommand, GetDatabaseCommand, GetJobCommand, GetSecurityConfigurationCommand, GetTableCommand, GetTagsCommand, GetTriggerCommand, GetWorkflowCommand, GlueClient, StartCrawlerScheduleCommand, StartTriggerCommand, StopCrawlerCommand, StopCrawlerScheduleCommand, StopTriggerCommand, TagResourceCommand as TagResourceCommand$18, UntagResourceCommand as UntagResourceCommand$18, UpdateConnectionCommand, UpdateCrawlerCommand, UpdateDatabaseCommand, UpdateJobCommand, UpdateTableCommand as UpdateTableCommand$1, UpdateTriggerCommand, UpdateWorkflowCommand } from "@aws-sdk/client-glue";
 import { BudgetsClient, CreateBudgetCommand, CreateNotificationCommand, CreateSubscriberCommand, DeleteBudgetCommand, DeleteNotificationCommand, DeleteSubscriberCommand, DescribeBudgetCommand, DuplicateRecordException, NotFoundException as NotFoundException$5, TagResourceCommand as TagResourceCommand$19, UntagResourceCommand as UntagResourceCommand$19, UpdateBudgetCommand } from "@aws-sdk/client-budgets";
 import { AddTagsToStreamCommand, CreateStreamCommand, DecreaseStreamRetentionPeriodCommand, DeleteStreamCommand, DeregisterStreamConsumerCommand, DescribeStreamCommand, DescribeStreamConsumerCommand, DescribeStreamSummaryCommand, DisableEnhancedMonitoringCommand, EnableEnhancedMonitoringCommand, IncreaseStreamRetentionPeriodCommand, KinesisClient, ListTagsForResourceCommand as ListTagsForResourceCommand$15, ListTagsForStreamCommand, RegisterStreamConsumerCommand, RemoveTagsFromStreamCommand, ResourceNotFoundException as ResourceNotFoundException$10, StartStreamEncryptionCommand, StopStreamEncryptionCommand, TagResourceCommand as TagResourceCommand$20, UntagResourceCommand as UntagResourceCommand$20, UpdateMaxRecordSizeCommand, UpdateShardCountCommand, UpdateStreamModeCommand } from "@aws-sdk/client-kinesis";
-import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
+import { CreateScheduleCommand, DeleteScheduleCommand, GetScheduleCommand, ListSchedulesCommand, ResourceNotFoundException as ResourceNotFoundException$11, SchedulerClient, UpdateScheduleCommand } from "@aws-sdk/client-scheduler";
 import { CreatePipeCommand, DeletePipeCommand, DescribePipeCommand, NotFoundException as NotFoundException$6, PipesClient, TagResourceCommand as TagResourceCommand$21, UntagResourceCommand as UntagResourceCommand$21, UpdatePipeCommand } from "@aws-sdk/client-pipes";
 import { AccessPointAlreadyExists, AccessPointNotFound, CreateAccessPointCommand, CreateFileSystemCommand, CreateMountTargetCommand, DeleteAccessPointCommand, DeleteFileSystemCommand, DeleteMountTargetCommand, DescribeAccessPointsCommand, DescribeBackupPolicyCommand, DescribeFileSystemPolicyCommand, DescribeFileSystemsCommand, DescribeLifecycleConfigurationCommand, DescribeMountTargetSecurityGroupsCommand, DescribeMountTargetsCommand, EFSClient, FileSystemAlreadyExists, FileSystemNotFound, ModifyMountTargetSecurityGroupsCommand, MountTargetNotFound, PutBackupPolicyCommand, PutFileSystemPolicyCommand, PutLifecycleConfigurationCommand, UpdateFileSystemCommand, UpdateFileSystemProtectionCommand } from "@aws-sdk/client-efs";
 import { CreateFileSystemCommand as CreateFileSystemCommand$1, CreateFileSystemFromBackupCommand, DeleteFileSystemCommand as DeleteFileSystemCommand$1, DescribeFileSystemsCommand as DescribeFileSystemsCommand$1, FSxClient, FileSystemNotFound as FileSystemNotFound$1, TagResourceCommand as TagResourceCommand$22, UntagResourceCommand as UntagResourceCommand$22, UpdateFileSystemCommand as UpdateFileSystemCommand$1 } from "@aws-sdk/client-fsx";
@@ -138,6 +138,11 @@ var IAMPolicyProvider = class {
 		const { roles, groups, users } = targets;
 		if (!policyDocument) throw new ProvisioningError(`PolicyDocument is required for IAM policy ${logicalId}`, resourceType, logicalId);
 		if (!(roles && roles.length > 0 || groups && groups.length > 0 || users && users.length > 0)) throw new ProvisioningError(`At least one of Roles, Groups, or Users is required for IAM policy ${logicalId}`, resourceType, logicalId);
+		const attached = {
+			roles: [],
+			groups: [],
+			users: []
+		};
 		try {
 			const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
 			if (roles) for (const roleName of roles) {
@@ -146,6 +151,7 @@ var IAMPolicyProvider = class {
 					PolicyName: policyName,
 					PolicyDocument: policyDoc
 				}));
+				attached.roles.push(roleName);
 				log.debug(`Attached inline policy ${v(policyName)} to role ${v(roleName)}`);
 			}
 			if (groups) for (const groupName of groups) {
@@ -154,6 +160,7 @@ var IAMPolicyProvider = class {
 					PolicyName: policyName,
 					PolicyDocument: policyDoc
 				}));
+				attached.groups.push(groupName);
 				log.debug(`Attached inline policy ${v(policyName)} to group ${v(groupName)}`);
 			}
 			if (users) for (const userName of users) {
@@ -162,6 +169,7 @@ var IAMPolicyProvider = class {
 					PolicyName: policyName,
 					PolicyDocument: policyDoc
 				}));
+				attached.users.push(userName);
 				log.debug(`Attached inline policy ${v(policyName)} to user ${v(userName)}`);
 			}
 			log.debug(`Successfully created IAM policy ${logicalId}: ${v(policyName)}`);
@@ -171,9 +179,59 @@ var IAMPolicyProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM policy ${logicalId}: ${text}`, resourceType, logicalId, policyName, cause));
+			await this.detachPartialPolicy(logicalId, policyName, attached, log, context?.maskSecrets);
+			const errorSinks = withDerivedNameMasks(this.logger, log, [
+				...roles ?? [],
+				...groups ?? [],
+				...users ?? []
+			].map((n) => [n, n]));
+			throw this.wrapMaskedError(errorSinks.mask, error, (text) => new ProvisioningError(`Failed to create IAM policy ${logicalId}: ${text}`, resourceType, logicalId, policyName, cause));
 		}
 	}
+	async detachPartialPolicy(logicalId, policyName, attached, sinks, maskSecrets) {
+		const aws = pasteableAwsCommand(maskSecrets);
+		const log = withDerivedNameMasks(this.logger, sinks, [
+			...attached.roles,
+			...attached.groups,
+			...attached.users
+		].map((n) => [n, n]));
+		const { value: v } = log;
+		const steps = [
+			...attached.roles.map((name) => ({
+				what: `role ${v(name)}`,
+				send: () => this.iamClient.send(new DeleteRolePolicyCommand({
+					RoleName: name,
+					PolicyName: policyName
+				})),
+				command: aws`aws iam delete-role-policy --role-name ${name} --policy-name ${policyName}`.render()
+			})),
+			...attached.groups.map((name) => ({
+				what: `group ${v(name)}`,
+				send: () => this.iamClient.send(new DeleteGroupPolicyCommand({
+					GroupName: name,
+					PolicyName: policyName
+				})),
+				command: aws`aws iam delete-group-policy --group-name ${name} --policy-name ${policyName}`.render()
+			})),
+			...attached.users.map((name) => ({
+				what: `user ${v(name)}`,
+				send: () => this.iamClient.send(new DeleteUserPolicyCommand({
+					UserName: name,
+					PolicyName: policyName
+				})),
+				command: aws`aws iam delete-user-policy --user-name ${name} --policy-name ${policyName}`.render()
+			}))
+		];
+		const failed = [];
+		for (const step of steps) try {
+			await step.send();
+			log.debug(`Detached inline policy ${v(policyName)} from ${step.what} after the create failed`);
+		} catch (error) {
+			if (error instanceof NoSuchEntityException) continue;
+			failed.push(`${step.what} (${log.mask(describeAwsFailure(error).detail)}): ${step.command}`);
+		}
+		if (failed.length > 0) log.warn(`Failed to detach the partially-created IAM policy ${logicalId} (${v(policyName)}) after its create failed; cdkd has no record of it, so it stays attached and granting until it is removed by hand: ${failed.join("; ")}`);
+	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const oldPolicyName = physicalId.includes(":") ? physicalId.split(":")[0] : physicalId;
 		const log = withDerivedNameMasks(this.logger, createMaskedLogSinks(this.logger, context?.maskSecrets), [[previousProperties["PolicyName"], oldPolicyName]]);
@@ -300,11 +358,11 @@ var IAMPolicyProvider = class {
 		let resolvedFromSecret = false;
 		let legacyRoleFromPhysicalId = !roles && !groups && !users && physicalId.includes(":") ? physicalId.split(":")[1] : void 0;
 		if (!policyName && policyNameRedacted) {
-			const skip = redactedDeleteAddressSkip(this.logger, logicalId, "IAM policy", ["PolicyName"]);
+			const skip = redactedDeleteAddressSkip(this.logger, logicalId, "IAM policy", ["PolicyName"], context);
 			if (skip) return skip;
 		}
 		if (!policyName) {
-			this.logger.warn(`Invalid physical ID format: ${physicalId}, and no PolicyName in the state record's properties — skipping deletion. No AWS call is issued, so the inline policy is LEFT ATTACHED to its roles / groups / users, UNLESS the role / group / user it is attached to is itself part of this stack (deleting that principal removes its inline policies, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack> --stack-region <region>', which drops every record the stack has in that region). Otherwise repair the physicalId in state.json and re-run, or delete the inline policy by hand. ${DEPLOY_SKIP_CAVEAT$3}`);
+			this.logger.warn(`Invalid physical ID format: ${physicalId}, and no PolicyName in the state record's properties — skipping deletion. No AWS call is issued, so the inline policy is LEFT ATTACHED to its roles / groups / users, UNLESS the role / group / user it is attached to is itself part of this stack (deleting that principal removes its inline policies, and then only the cdkd record is stale — clear it with ${stateOrphanRecordRemedy(context, logicalId)}). Otherwise repair the physicalId in state.json and re-run, or delete the inline policy by hand. ${DEPLOY_SKIP_CAVEAT$3}`);
 			return {
 				outcome: "skipped",
 				reason: POLICY_NAME_SKIP_REASON
@@ -338,7 +396,7 @@ var IAMPolicyProvider = class {
 		}
 		if (malformedKinds.length > 0 && !resolvedFromSecret) {
 			const plainKinds = malformedKinds.filter((k) => !secretDerivedKinds.includes(k));
-			const repair = secretDerivedKinds.length === 0 ? `Repair ${plainKinds.join(" / ")} in state.json to a list of role / group / user names and re-run, or delete the inline policy by hand.` : `The recorded ${secretDerivedKinds.join(" / ")} is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the name into state.json` + (resolutionAttempted ? "; cdkd could not resolve the reference (its region, access to it, or its value), so fix that and re-run, or" : `:`) + ` cdkd will keep skipping this record` + (plainKinds.length > 0 ? `, whatever is repaired in the recorded ${plainKinds.join(" / ")}` : "") + ". Remove the inline policy from its principals by hand (a principal this stack also deletes takes its inline policies with it); on cdkd destroy every other resource is still deleted, so once this is the stack's last record 'cdkd state orphan <stack> --stack-region <region>' clears it.";
+			const repair = secretDerivedKinds.length === 0 ? `Repair ${plainKinds.join(" / ")} in state.json to a list of role / group / user names and re-run, or delete the inline policy by hand.` : `The recorded ${secretDerivedKinds.join(" / ")} is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the name into state.json` + (resolutionAttempted ? "; cdkd could not resolve the reference (its region, access to it, or its value), so fix that and re-run, or" : `:`) + ` cdkd will keep skipping this record` + (plainKinds.length > 0 ? `, whatever is repaired in the recorded ${plainKinds.join(" / ")}` : "") + `. Remove the inline policy from its principals by hand (a principal this stack also deletes takes its inline policies with it), then drop this record with ${stateOrphanRecordRemedy(context, logicalId)}.`;
 			this.logger.warn(`The state record for IAM policy ${logicalId} holds ${malformedKinds.join(" / ")} that is not a list of IAM names — skipping deletion rather than guessing which principals it names. No AWS call is issued, so the inline policy is LEFT ATTACHED wherever it is. ${repair} ${DEPLOY_SKIP_CAVEAT$3}`);
 			return {
 				outcome: "skipped",
@@ -346,7 +404,7 @@ var IAMPolicyProvider = class {
 			};
 		}
 		if (!roles && !groups && !users && !legacyRoleFromPhysicalId) {
-			this.logger.warn(`No Roles, Groups or Users in the state record for IAM policy ${logicalId} (physicalId "${physicalId}"), skipping deletion — an inline policy exists only as an attachment, so with no principal named there is no delete to issue and the policy is LEFT ATTACHED wherever it is, UNLESS the role / group / user it is attached to is itself part of this stack (deleting that principal removes its inline policies, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack> --stack-region <region>', which drops every record the stack has in that region). Otherwise restore Roles / Groups / Users in state.json and re-run, or delete the inline policy by hand. ${DEPLOY_SKIP_CAVEAT$3}`);
+			this.logger.warn(`No Roles, Groups or Users in the state record for IAM policy ${logicalId} (physicalId "${physicalId}"), skipping deletion — an inline policy exists only as an attachment, so with no principal named there is no delete to issue and the policy is LEFT ATTACHED wherever it is, UNLESS the role / group / user it is attached to is itself part of this stack (deleting that principal removes its inline policies, and then only the cdkd record is stale — clear it with ${stateOrphanRecordRemedy(context, logicalId)}). Otherwise restore Roles / Groups / Users in state.json and re-run, or delete the inline policy by hand. ${DEPLOY_SKIP_CAVEAT$3}`);
 			return {
 				outcome: "skipped",
 				reason: POLICY_NO_TARGET_SKIP_REASON
@@ -433,7 +491,7 @@ var IAMPolicyProvider = class {
 				}
 			}
 			if (secretPrincipalLacksGrant) {
-				this.logger.warn(safeMsg`IAM policy ${logicalId}: a principal the secret's CURRENT value names does not hold this inline policy. The value may have rotated since the policy was attached, so a principal only the OLD value named may still hold it; or an earlier cdkd run already removed it there, or that principal was deleted first. The record is KEPT rather than read as deleted: delete the inline policy from any old principal by hand (the principals the current value names are done), then drop this record with 'cdkd orphan <constructPath>', or, with no CDK app, 'cdkd state orphan <stack> --stack-region <region>' once it is the stack's last record.`);
+				this.logger.warn(safeMsg`IAM policy ${logicalId}: a principal the secret's CURRENT value names does not hold this inline policy. The value may have rotated since the policy was attached, so a principal only the OLD value named may still hold it; or an earlier cdkd run already removed it there, or that principal was deleted first. The record is KEPT rather than read as deleted: delete the inline policy from any old principal by hand (the principals the current value names are done), then drop this record with 'cdkd orphan <constructPath>', or, with no CDK app, ${stateOrphanRecordRemedy(context, logicalId)}.`);
 				return {
 					outcome: "skipped",
 					reason: POLICY_SECRET_PRINCIPAL_LACKS_GRANT_SKIP_REASON
@@ -544,6 +602,7 @@ var IAMManagedPolicyProvider = class {
 		const principals = principalsOf(properties);
 		if ("malformed" in principals) throw new ProvisioningError(`${principals.malformed.join(" / ")} of IAM managed policy ${logicalId} is not a list of IAM names — no managed policy was created or attached`, resourceType, logicalId);
 		const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
+		let leftBehindArn;
 		try {
 			const createParams = {
 				PolicyName: policyName,
@@ -554,6 +613,7 @@ var IAMManagedPolicyProvider = class {
 			if (tags.length > 0) createParams.Tags = tags;
 			const policyArn = (await this.iamClient.send(new CreatePolicyCommand(createParams))).Policy?.Arn;
 			if (!policyArn) throw new ProvisioningError(`CreatePolicy succeeded but no Arn returned for ${logicalId}`, resourceType, logicalId, policyName);
+			leftBehindArn = policyArn;
 			log.debug(`Created IAM managed policy: ${v(policyArn)}`);
 			try {
 				await this.attachToPrincipals(policyArn, principals.lists.Groups, principals.lists.Roles, principals.lists.Users, log);
@@ -562,6 +622,7 @@ var IAMManagedPolicyProvider = class {
 					await this.detachAllPrincipals(policyArn);
 					await this.deleteAllNonDefaultVersions(policyArn);
 					await this.iamClient.send(new DeletePolicyCommand({ PolicyArn: policyArn }));
+					leftBehindArn = void 0;
 					log.debug(`Cleaned up partially-created managed policy ${logicalId} (${v(policyArn)}) after attachment failure`);
 				} catch (cleanupError) {
 					const aws = pasteableAwsCommand(log.mask);
@@ -574,9 +635,13 @@ var IAMManagedPolicyProvider = class {
 				attributes: { PolicyArn: policyArn }
 			};
 		} catch (error) {
-			if (error instanceof CdkdError) throw error;
+			const markLeftBehind = (e) => leftBehindArn !== void 0 ? markCreatedBeforeFailure(e, logicalId, resourceType, leftBehindArn) : e;
+			if (error instanceof CdkdError) {
+				markLeftBehind(error);
+				throw error;
+			}
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, policyName, cause));
+			throw this.wrapMaskedError(log.mask, error, (text) => markLeftBehind(new ProvisioningError(`Failed to create IAM managed policy ${logicalId}: ${text}`, resourceType, logicalId, policyName, cause)));
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -1070,11 +1135,13 @@ var IAMInstanceProfileProvider = class {
 		const principals = readPrincipalLists({ Roles: properties["Roles"] });
 		if ("malformed" in principals) throw new ProvisioningError(`Roles of IAM instance profile ${logicalId} is not a list of IAM role names — no instance profile was created`, resourceType, logicalId);
 		const roles = principals.lists.Roles;
+		let leftBehind = false;
 		try {
 			const response = await this.iamClient.send(new CreateInstanceProfileCommand({
 				InstanceProfileName: instanceProfileName,
 				Path: path
 			}));
+			leftBehind = true;
 			log.debug(`Created IAM instance profile: ${v(instanceProfileName)}`);
 			const attachedRoles = [];
 			try {
@@ -1097,6 +1164,7 @@ var IAMInstanceProfileProvider = class {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
 					await this.iamClient.send(new DeleteInstanceProfileCommand({ InstanceProfileName: instanceProfileName }));
+					leftBehind = false;
 					log.debug(`Cleaned up partially-created IAM instance profile ${logicalId} (${v(instanceProfileName)}) after wiring failure`);
 				} catch (cleanupError) {
 					const aws = pasteableAwsCommand(log.mask);
@@ -1111,7 +1179,9 @@ var IAMInstanceProfileProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM instance profile ${logicalId}: ${text}`, resourceType, logicalId, instanceProfileName, cause));
+			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM instance profile ${logicalId}: ${text}`, resourceType, logicalId, instanceProfileName, cause));
+			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, instanceProfileName);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -1277,16 +1347,19 @@ var IAMAccessKeyProvider = class {
 		const aws = pasteableAwsCommand(log.mask);
 		const attemptStartMs = Date.now() - CREATE_DATE_SKEW_MARGIN_MS;
 		const baseline = await this.tryListAccessKeyIds(userName, logicalId, log);
+		let leftBehindKeyId;
 		try {
 			const response = await this.iamClient.send(new CreateAccessKeyCommand({ UserName: userName }));
 			const accessKeyId = response.AccessKey?.AccessKeyId;
 			const secretAccessKey = response.AccessKey?.SecretAccessKey;
+			leftBehindKeyId = accessKeyId;
 			if (!accessKeyId || !secretAccessKey) {
 				if (accessKeyId) try {
 					await this.iamClient.send(new DeleteAccessKeyCommand({
 						UserName: userName,
 						AccessKeyId: accessKeyId
 					}));
+					leftBehindKeyId = void 0;
 				} catch (cleanupError) {
 					log.warn(`Failed to clean up IAM access key ${logicalId} (${v(accessKeyId)}) minted by a partial CreateAccessKey response: ${v(describeAwsFailure(cleanupError).detail)}. Manual deletion may be required: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
 				}
@@ -1304,6 +1377,7 @@ var IAMAccessKeyProvider = class {
 						UserName: userName,
 						AccessKeyId: accessKeyId
 					}));
+					leftBehindKeyId = void 0;
 					log.debug(`Cleaned up partially-created IAM access key ${logicalId} (${v(accessKeyId)}) after status wiring failure`);
 				} catch (cleanupError) {
 					log.warn(`Failed to clean up partially-created IAM access key ${logicalId} (${v(accessKeyId)}): ${v(describeAwsFailure(cleanupError).detail)}. Manual deletion may be required before the next deploy: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
@@ -1320,9 +1394,12 @@ var IAMAccessKeyProvider = class {
 				}
 			};
 		} catch (error) {
-			await this.deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log);
+			const reconciled = await this.deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log);
+			if (leftBehindKeyId !== void 0 && reconciled.has(leftBehindKeyId)) leftBehindKeyId = void 0;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM access key ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (leftBehindKeyId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindKeyId);
+			throw thrown;
 		}
 	}
 	async withUserCreateLock(userName, fn) {
@@ -1342,9 +1419,10 @@ var IAMAccessKeyProvider = class {
 	async deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log) {
 		const { value: v } = log;
 		const aws = pasteableAwsCommand(log.mask);
-		if (baseline === void 0) return;
+		const deleted = /* @__PURE__ */ new Set();
+		if (baseline === void 0) return deleted;
 		const current = await this.tryListAccessKeyMetadata(userName, logicalId, log);
-		if (!current) return;
+		if (!current) return deleted;
 		for (const key of current) {
 			const accessKeyId = key.accessKeyId;
 			if (baseline.has(accessKeyId) || this.accessKeyIdsCreatedByThisProcess.has(accessKeyId)) continue;
@@ -1358,10 +1436,12 @@ var IAMAccessKeyProvider = class {
 					UserName: userName,
 					AccessKeyId: accessKeyId
 				}));
+				deleted.add(accessKeyId);
 			} catch (error) {
 				log.warn(`Failed to delete the orphaned IAM access key ${v(accessKeyId)} for user ${v(userName)}: ${v(describeAwsFailure(error).detail)}. Manual deletion may be required: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
 			}
 		}
+		return deleted;
 	}
 	async tryListAccessKeyIds(userName, logicalId, log) {
 		const metadata = await this.tryListAccessKeyMetadata(userName, logicalId, log);
@@ -1615,11 +1695,13 @@ var IAMUserGroupProvider = class {
 		const userName = generateResourceNameWithFallback(properties["UserName"], logicalId, { maxLength: USER_NAME_MAX_LENGTH });
 		const groups = readPrincipalLists({ Groups: properties["Groups"] });
 		if ("malformed" in groups) throw new ProvisioningError(`Groups of IAM user ${logicalId} is not a list of IAM group names — no user was created`, resourceType, logicalId);
+		let leftBehind = false;
 		try {
 			const createParams = { UserName: userName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			if (properties["Tags"] !== void 0 && properties["Tags"] !== null) createParams.Tags = desiredTags;
 			const response = await this.iamClient.send(new CreateUserCommand(createParams));
+			leftBehind = true;
 			try {
 				const permissionsBoundary = properties["PermissionsBoundary"];
 				if (permissionsBoundary) {
@@ -1680,6 +1762,7 @@ var IAMUserGroupProvider = class {
 						if (!(err instanceof NoSuchEntityException)) throw err;
 					}
 					await this.iamClient.send(new DeleteUserCommand({ UserName: userName }));
+					leftBehind = false;
 					log.debug(`Cleaned up partially-created IAM user ${logicalId} (${v(userName)}) after wiring failure`);
 				} catch (cleanupError) {
 					const aws = pasteableAwsCommand(log.mask);
@@ -1694,7 +1777,9 @@ var IAMUserGroupProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM user ${logicalId}: ${text}`, resourceType, logicalId, userName, cause));
+			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM user ${logicalId}: ${text}`, resourceType, logicalId, userName, cause));
+			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, userName);
+			throw thrown;
 		}
 	}
 	async updateUser(logicalId, physicalId, resourceType, properties, previousProperties, log, claimed) {
@@ -1989,10 +2074,12 @@ var IAMUserGroupProvider = class {
 		const { value: v } = log;
 		log.debug(`Creating IAM group ${logicalId}`);
 		const groupName = generateResourceNameWithFallback(properties["GroupName"], logicalId, { maxLength: GROUP_NAME_MAX_LENGTH });
+		let leftBehind = false;
 		try {
 			const createParams = { GroupName: groupName };
 			if (properties["Path"]) createParams.Path = properties["Path"];
 			const response = await this.iamClient.send(new CreateGroupCommand(createParams));
+			leftBehind = true;
 			try {
 				const managedPolicyArns = properties["ManagedPolicyArns"];
 				if (managedPolicyArns && Array.isArray(managedPolicyArns)) for (const policyArn of managedPolicyArns) {
@@ -2017,6 +2104,7 @@ var IAMUserGroupProvider = class {
 					await this.detachAllGroupPolicies(groupName, log);
 					await this.deleteAllGroupInlinePolicies(groupName, log);
 					await this.iamClient.send(new DeleteGroupCommand({ GroupName: groupName }));
+					leftBehind = false;
 					log.debug(`Cleaned up partially-created IAM group ${logicalId} (${v(groupName)}) after wiring failure`);
 				} catch (cleanupError) {
 					const aws = pasteableAwsCommand(log.mask);
@@ -2031,7 +2119,9 @@ var IAMUserGroupProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM group ${logicalId}: ${text}`, resourceType, logicalId, groupName, cause));
+			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create IAM group ${logicalId}: ${text}`, resourceType, logicalId, groupName, cause));
+			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, groupName);
+			throw thrown;
 		}
 	}
 	async updateGroup(logicalId, physicalId, resourceType, properties, previousProperties, log, claimed) {
@@ -2258,7 +2348,7 @@ var IAMUserGroupProvider = class {
 	async deleteUserToGroupAddition(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting IAM UserToGroupAddition ${logicalId}`);
 		if (!properties) {
-			this.logger.warn(`No properties for UserToGroupAddition ${logicalId}, skipping deletion — GroupName and Users are both required to call RemoveUserFromGroup, so no AWS call is issued and the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack> --stack-region <region>', which drops every record the stack has in that region). Otherwise restore the record's properties in state.json and re-run, or remove the users from the group by hand. ${DEPLOY_SKIP_CAVEAT$2}`);
+			this.logger.warn(`No properties for UserToGroupAddition ${logicalId}, skipping deletion — GroupName and Users are both required to call RemoveUserFromGroup, so no AWS call is issued and the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with ${stateOrphanRecordRemedy(context, logicalId)}). Otherwise restore the record's properties in state.json and re-run, or remove the users from the group by hand. ${DEPLOY_SKIP_CAVEAT$2}`);
 			return {
 				outcome: "skipped",
 				reason: MEMBERSHIP_NO_PROPERTIES_SKIP_REASON
@@ -2267,13 +2357,13 @@ var IAMUserGroupProvider = class {
 		const groupName = properties["GroupName"];
 		const recordedUsers = properties["Users"];
 		if (!groupName || !recordedUsers) {
-			this.logger.warn(`Missing GroupName or Users for ${logicalId}, skipping deletion — both are required to call RemoveUserFromGroup, so no AWS call is issued and the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack> --stack-region <region>', which drops every record the stack has in that region). Otherwise restore them in state.json and re-run, or remove the users from the group by hand. ${DEPLOY_SKIP_CAVEAT$2}`);
+			this.logger.warn(`Missing GroupName or Users for ${logicalId}, skipping deletion — both are required to call RemoveUserFromGroup, so no AWS call is issued and the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with ${stateOrphanRecordRemedy(context, logicalId)}). Otherwise restore them in state.json and re-run, or remove the users from the group by hand. ${DEPLOY_SKIP_CAVEAT$2}`);
 			return {
 				outcome: "skipped",
 				reason: MEMBERSHIP_MISSING_FIELDS_SKIP_REASON
 			};
 		}
-		const redactedGroup = redactedDeleteAddressSkip(this.logger, logicalId, "UserToGroupAddition", redactedDeleteAddressFields({ GroupName: properties["GroupName"] }));
+		const redactedGroup = redactedDeleteAddressSkip(this.logger, logicalId, "UserToGroupAddition", redactedDeleteAddressFields({ GroupName: properties["GroupName"] }), context);
 		if (redactedGroup) return redactedGroup;
 		const read = readPrincipalLists({ Users: properties["Users"] });
 		let users = "malformed" in read ? void 0 : read.lists.Users;
@@ -2296,8 +2386,8 @@ var IAMUserGroupProvider = class {
 			}
 		}
 		if ("malformed" in read && users === void 0) {
-			const repair = read.secretDerived.length > 0 ? "The recorded Users is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the name into state.json" + (resolutionAttempted ? "; cdkd could not resolve the reference (its region, access to it, or its value), so fix that and re-run, or" : ":") + " cdkd will keep skipping this record. Remove the users from the group by hand; on cdkd destroy every other resource is still deleted, so once this is the stack's last record 'cdkd state orphan <stack> --stack-region <region>' clears it." : "Repair the recorded Users in state.json to a list of user names and re-run, or remove the users from the group by hand.";
-			this.logger.warn(safeMsg`The state record for UserToGroupAddition ${logicalId} holds a Users that is not a list of IAM user names — skipping deletion rather than guessing which users it names. No AWS call is issued, so the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack> --stack-region <region>', which drops every record the stack has in that region). ${repair} ${DEPLOY_SKIP_CAVEAT$2}`);
+			const repair = read.secretDerived.length > 0 ? "The recorded Users is secret-derived (cdkd keeps the dynamic reference or its mask in state), so do not write the name into state.json" + (resolutionAttempted ? "; cdkd could not resolve the reference (its region, access to it, or its value), so fix that and re-run, or" : ":") + ` cdkd will keep skipping this record. Remove the users from the group by hand, then drop this record with ${stateOrphanRecordRemedy(context, logicalId)}.` : "Repair the recorded Users in state.json to a list of user names and re-run, or remove the users from the group by hand.";
+			this.logger.warn(safeMsg`The state record for UserToGroupAddition ${logicalId} holds a Users that is not a list of IAM user names — skipping deletion rather than guessing which users it names. No AWS call is issued, so the group memberships are LEFT IN PLACE, UNLESS the group or the users are themselves part of this stack (their own deletes remove exactly these memberships, and then only the cdkd record is stale — clear it with ${stateOrphanRecordRemedy(context, logicalId)}). ${repair} ${DEPLOY_SKIP_CAVEAT$2}`);
 			return {
 				outcome: "skipped",
 				reason: MEMBERSHIP_MALFORMED_USERS_SKIP_REASON
@@ -2333,7 +2423,7 @@ var IAMUserGroupProvider = class {
 				}
 			}
 			if (secretUserNotMember) {
-				this.logger.warn(safeMsg`UserToGroupAddition ${logicalId}: a user the secret's CURRENT value names is not in the group. The value may have rotated since the membership was added, so a user only the OLD value named may still be a member; or an earlier cdkd run already removed it, or that user was deleted first. The record is KEPT rather than read as deleted: remove any old user from the group by hand (the users the current value names are done), then drop this record with 'cdkd orphan <constructPath>', or, with no CDK app, 'cdkd state orphan <stack> --stack-region <region>' once it is the stack's last record.`);
+				this.logger.warn(safeMsg`UserToGroupAddition ${logicalId}: a user the secret's CURRENT value names is not in the group. The value may have rotated since the membership was added, so a user only the OLD value named may still be a member; or an earlier cdkd run already removed it, or that user was deleted first. The record is KEPT rather than read as deleted: remove any old user from the group by hand (the users the current value names are done), then drop this record with 'cdkd orphan <constructPath>', or, with no CDK app, ${stateOrphanRecordRemedy(context, logicalId)}.`);
 				return {
 					outcome: "skipped",
 					reason: MEMBERSHIP_SECRET_USER_NOT_MEMBER_SKIP_REASON
@@ -2510,13 +2600,14 @@ var IAMUserGroupProvider = class {
 
 //#endregion
 //#region src/provisioning/providers/s3-bucket-provider.ts
-function manualBucketDeletionClause(bucketName, maskSecrets) {
+function manualBucketDeletionClause(bucketName, maskSecrets, journaled) {
 	const command = renderDisableCommand({
 		before: "aws s3api delete-bucket --bucket",
 		identifier: bucketName,
 		maskSecrets
 	});
-	return command ? `Manual deletion may be required before the next deploy: ${command}` : "Manual deletion may be required before the next deploy, via the console: the bucket name cannot be reproduced safely on a command line, so any command shown here could act on a different bucket or run part of the name as shell.";
+	const lead = journaled ? "On a first-time create the failed deploy's rollback journal records the bucket for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy" : "Manual deletion may be required before the next deploy";
+	return command ? `${lead}: ${command}` : `${lead}, via the console: the bucket name cannot be reproduced safely on a command line, so any command shown here could act on a different bucket or run part of the name as shell.`;
 }
 function configItemId(item) {
 	if (!isPlainObject$2(item)) return void 0;
@@ -4114,7 +4205,7 @@ var S3BucketProvider = class S3BucketProvider {
 			};
 		}
 	}
-	async assertStateBucketRegion(operation, logicalId, resourceType, physicalId, expectedRegion) {
+	async assertStateBucketRegion(operation, logicalId, resourceType, physicalId, expectedRegion, context) {
 		const wantRegion = canonicalizeRegion(expectedRegion);
 		const probe = await this.probeBucketRegion(physicalId);
 		if (probe.kind === "absent") return;
@@ -4125,7 +4216,7 @@ var S3BucketProvider = class S3BucketProvider {
 		}
 		if (probe.region === wantRegion) return;
 		const consequence = operation === "update" ? `Applying this stack's bucket configuration would reconfigure a bucket in ${probe.region} that this stack does not own the definition of.` : `Deleting it would destroy a bucket in ${probe.region} that this stack's region does not contain, and that deletion cannot be undone.`;
-		const remedy = operation === "update" ? `Confirm which bucket you mean, then either rerun this stack against ${probe.region}, or — if the recorded id is stale — drop this bucket's record with 'cdkd orphan <StackPath>/<Path/To/Bucket>', which removes only that record (and rewrites the references to it) without touching any AWS resource, then deploy again to create the bucket in this stack's region — first giving it a BucketName unique to that region if the template fixes this one, since S3 names are global.` : `Confirm which bucket you mean. If ${displaySafe(physicalId)} is genuinely yours to delete, delete it deliberately in ${probe.region}; if this record is simply stale, drop it with 'cdkd state orphan <stack> --stack-region <region>' (this stack's region, not the bucket's), which removes EVERY record the stack has in that region without touching any AWS resource, so run it once this is the stack's last record.`;
+		const remedy = operation === "update" ? `Confirm which bucket you mean, then either rerun this stack against ${probe.region}, or — if the recorded id is stale — drop this bucket's record with 'cdkd orphan <StackPath>/<Path/To/Bucket>', which removes only that record (and rewrites the references to it) without touching any AWS resource, then deploy again to create the bucket in this stack's region — first giving it a BucketName unique to that region if the template fixes this one, since S3 names are global.` : `Confirm which bucket you mean. If ${displaySafe(physicalId)} is genuinely yours to delete, delete it deliberately in ${probe.region}; if this record is simply stale, drop it without touching any AWS resource (<region> is this stack's region, not the bucket's) with ${stateOrphanRecordRemedy(context, logicalId)}.`;
 		throw markNonRetryable(new ProvisioningError(`Refusing to ${operation} S3 bucket ${this.shown(physicalId)} for ${displaySafe(logicalId)} (${resourceType}): the bucket lives in ${probe.region}, while this stack's state is for ${wantRegion}. S3 bucket names are globally unique, so a state record can name a bucket in another region — records written before the create-path region guard can carry one. ${consequence} ${remedy}`, resourceType, logicalId, physicalId));
 	}
 	announceUnverifiedBucketIdentity(operation, logicalId, physicalId, cause) {
@@ -4145,6 +4236,7 @@ var S3BucketProvider = class S3BucketProvider {
 			lowercase: true,
 			allowedPattern: /[^a-z0-9.-]/g
 		});
+		let bucketLeftBehind = false;
 		try {
 			const createParams = { Bucket: bucketName };
 			const region = await this.getRegion();
@@ -4156,6 +4248,7 @@ var S3BucketProvider = class S3BucketProvider {
 			try {
 				await this.s3Client.send(new CreateBucketCommand(createParams));
 				createdNewBucket = preflight.kind === "absent";
+				bucketLeftBehind = createdNewBucket;
 				if (preflight.kind === "region" && preflight.region !== "us-east-1") this.refuseForeignRegionAdopt(logicalId, resourceType, bucketName, "us-east-1", preflight.region);
 				if (preflight.kind === "region") this.logger.warn(`S3 bucket ${this.shown(bucketName)} for ${displaySafe(logicalId)} (${resourceType}) already existed in ${preflight.region} and was ADOPTED, not created. In us-east-1 S3 answers a re-create of a bucket you already own with 200 OK and RESETS that bucket's access control lists, so any ACL previously set on ${this.shown(bucketName)} is now the default. cdkd will not delete this bucket if the rest of this create fails.`);
 				this.logger.debug(`Created S3 bucket: ${this.shown(bucketName)}`);
@@ -4176,14 +4269,15 @@ var S3BucketProvider = class S3BucketProvider {
 			} catch (innerError) {
 				if (createdNewBucket) try {
 					await this.s3Client.send(new DeleteBucketCommand({ Bucket: bucketName }));
+					bucketLeftBehind = false;
 					this.logger.debug(`Cleaned up partially-created S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}) after wiring failure`);
 				} catch (cleanupError) {
 					this.logger.debug(`DeleteBucket cleanup failed for S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}): ${describeAwsFailure(cleanupError).detail}`);
-					this.logger.warn(safeMsg`Failed to clean up partially-created S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}) ` + safeMsg`(${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). ` + `Re-run with --verbose for AWS's own message. ` + safeMsg`${manualBucketDeletionClause(bucketName, this.shownMask)}`);
+					this.logger.warn(safeMsg`Failed to clean up partially-created S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}) ` + safeMsg`(${cleanupError instanceof Error ? cleanupError.name : typeof cleanupError}). ` + `Re-run with --verbose for AWS's own message. ` + safeMsg`${manualBucketDeletionClause(bucketName, this.shownMask, true)}`);
 				}
 				else if (preflight.kind === "indeterminate") {
 					this.logger.debug(`GetBucketLocation failed for S3 bucket ${this.shown(bucketName)} (${displaySafe(logicalId)}) during create: ${preflight.reason}`);
-					this.logger.warn(safeMsg`Not cleaning up S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}) after a wiring failure: ` + `this deploy could not confirm whether it created the bucket (region probe failed: ` + safeMsg`${preflight.errorName}), and in us-east-1 a successful CreateBucket does not ` + "prove it. Re-run with --verbose for AWS's own message. If cdkd created it, the bucket is an orphan. " + safeMsg`${manualBucketDeletionClause(bucketName, this.shownMask)}`);
+					this.logger.warn(safeMsg`Not cleaning up S3 bucket ${displaySafe(logicalId)} (${this.shown(bucketName)}) after a wiring failure: ` + `this deploy could not confirm whether it created the bucket (region probe failed: ` + safeMsg`${preflight.errorName}), and in us-east-1 a successful CreateBucket does not ` + "prove it. Re-run with --verbose for AWS's own message. If cdkd created it, the bucket is an orphan. " + safeMsg`${manualBucketDeletionClause(bucketName, this.shownMask, false)}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -4196,7 +4290,9 @@ var S3BucketProvider = class S3BucketProvider {
 				...effectiveProperties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
-			throw this.wrapOperationError("create", logicalId, resourceType, bucketName, error);
+			const thrown = this.wrapOperationError("create", logicalId, resourceType, bucketName, error);
+			if (bucketLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, bucketName);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -4248,7 +4344,7 @@ var S3BucketProvider = class S3BucketProvider {
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting S3 bucket ${displaySafe(logicalId)}: ${displaySafe(physicalId)}`);
 		const allowAutoEmpty = context?.forceDataDelete === true || hasCdkAutoDeleteTag(properties, "aws-cdk:auto-delete-objects");
-		if (context?.expectedRegion) await this.assertStateBucketRegion("delete", logicalId, resourceType, physicalId, context.expectedRegion);
+		if (context?.expectedRegion) await this.assertStateBucketRegion("delete", logicalId, resourceType, physicalId, context.expectedRegion, context);
 		else this.announceUnverifiedBucketIdentity("delete", logicalId, physicalId, noRecordedRegionCause());
 		try {
 			await this.deleteBucketWithEmptyRetry(logicalId, physicalId, allowAutoEmpty);
@@ -5408,6 +5504,7 @@ var SQSQueuePolicyProvider = class {
 		const policyDocument = properties["PolicyDocument"];
 		if (!queues || queues.length === 0) throw new ProvisioningError(`Queues is required for SQS queue policy ${logicalId}`, resourceType, logicalId);
 		if (!policyDocument) throw new ProvisioningError(`PolicyDocument is required for SQS queue policy ${logicalId}`, resourceType, logicalId);
+		const applied = [];
 		try {
 			const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
 			for (const queueUrl of queues) {
@@ -5416,6 +5513,7 @@ var SQSQueuePolicyProvider = class {
 					QueueUrl: queueUrl,
 					Attributes: { Policy: policyDoc }
 				}));
+				applied.push(queueUrl);
 			}
 			this.logger.debug(`Successfully created SQS queue policy ${logicalId}`);
 			return {
@@ -5424,7 +5522,9 @@ var SQSQueuePolicyProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, queues[0], cause);
+			const thrown = new ProvisioningError(`Failed to create SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, queues[0], cause);
+			if (applied.length > 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, applied.join(","));
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
@@ -5455,22 +5555,23 @@ var SQSQueuePolicyProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, _properties, context) {
 		this.logger.debug(`Deleting SQS queue policy ${logicalId}: ${physicalId}`);
-		try {
+		const queueUrls = physicalId.split(",");
+		for (const queueUrl of queueUrls) try {
 			await this.sqsClient.send(new SetQueueAttributesCommand({
-				QueueUrl: physicalId,
+				QueueUrl: queueUrl,
 				Attributes: { Policy: "" }
 			}));
-			this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 		} catch (error) {
 			if (error instanceof Error && (error.name === "QueueDoesNotExist" || error.message.includes("does not exist"))) {
 				const clientRegion = await this.sqsClient.config.region();
-				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`Queue ${physicalId} does not exist, skipping policy deletion`);
-				return;
+				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, queueUrl);
+				this.logger.debug(`Queue ${queueUrl} does not exist, skipping policy deletion`);
+				continue;
 			}
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to delete SQS queue policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
+		this.logger.debug(`Successfully deleted SQS queue policy ${logicalId}`);
 	}
 	async readCurrentState(physicalId, _logicalId, _resourceType) {
 		let policyAttr;
@@ -5592,6 +5693,7 @@ var SNSTopicProvider = class {
 		this.logger.debug(`Creating SNS topic ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const topicName = properties["TopicName"] || generateResourceName(logicalId, { maxLength: 256 });
+		let leftBehindArn;
 		try {
 			const topicAttributes = {};
 			if (properties["FifoTopic"]) topicAttributes["FifoTopic"] = stringifyValue(properties["FifoTopic"]);
@@ -5645,7 +5747,8 @@ var SNSTopicProvider = class {
 					await this.snsClient.send(new DeleteTopicCommand({ TopicArn: topicArn }));
 					this.logger.debug(`Cleaned up partially-created SNS topic ${logicalId} (${topicArn}) after wiring failure`);
 				} catch (cleanupError) {
-					warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws sns delete-topic --topic-arn ${topicArn}`.render()}`);
+					leftBehindArn = topicArn;
+					warn(`Failed to clean up partially-created SNS topic ${logicalId} (${topicArn}): ${describeAwsFailure(cleanupError).detail}. On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws sns delete-topic --topic-arn ${topicArn}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -5659,7 +5762,9 @@ var SNSTopicProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SNS topic ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, topicName, cause);
+			const thrown = new ProvisioningError(`Failed to create SNS topic ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, topicName, cause);
+			if (leftBehindArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindArn);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -6241,16 +6346,21 @@ var SNSTopicPolicyProvider = class {
 		if (!topics || topics.length === 0) throw new ProvisioningError(`Topics is required for SNS topic policy ${logicalId}`, resourceType, logicalId);
 		if (!policyDocument) throw new ProvisioningError(`PolicyDocument is required for SNS topic policy ${logicalId}`, resourceType, logicalId);
 		const policyDoc = typeof policyDocument === "string" ? policyDocument : JSON.stringify(policyDocument);
+		const applied = [];
 		try {
-			for (const topicArn of topics) await this.setTopicPolicy(topicArn, policyDoc);
+			for (const topicArn of topics) {
+				await this.setTopicPolicy(topicArn, policyDoc);
+				applied.push(topicArn);
+			}
 			this.logger.debug(`Successfully created SNS topic policy ${logicalId}`);
 			return {
 				physicalId: topics.join(","),
 				attributes: {}
 			};
 		} catch (error) {
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create SNS topic policy ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			if (applied.length > 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, applied.join(","));
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, _previousProperties) {
@@ -6579,6 +6689,8 @@ var LambdaFunctionProvider = class {
 		if (!role) throw new ProvisioningError(`Role is required for Lambda function ${logicalId}`, resourceType, logicalId);
 		refuseImageFunctionUnsupported(logicalId, resourceType, properties);
 		let functionCreated = false;
+		let createdFunctionName;
+		const postCreateCleanup = { deleted: false };
 		try {
 			const tags = properties["Tags"] ? Object.fromEntries(desiredTags.map((tag) => [tag.Key, tag.Value])) : void 0;
 			const createParams = {
@@ -6610,6 +6722,7 @@ var LambdaFunctionProvider = class {
 			};
 			const response = await this.lambdaClient.send(new CreateFunctionCommand(createParams));
 			functionCreated = true;
+			createdFunctionName = response.FunctionName || functionName;
 			const recursiveLoop = properties["RecursiveLoop"];
 			if (recursiveLoop !== void 0) await this.applyPostCreateConfig(() => this.lambdaClient.send(new PutFunctionRecursionConfigCommand({
 				FunctionName: functionName,
@@ -6620,7 +6733,8 @@ var LambdaFunctionProvider = class {
 				logicalId,
 				resourceType,
 				functionName,
-				log
+				log,
+				cleanup: postCreateCleanup
 			});
 			const reservedConcurrentExecutions = properties["ReservedConcurrentExecutions"];
 			if (reservedConcurrentExecutions !== void 0) await this.applyPostCreateConfig(() => this.lambdaClient.send(new PutFunctionConcurrencyCommand({
@@ -6632,7 +6746,8 @@ var LambdaFunctionProvider = class {
 				logicalId,
 				resourceType,
 				functionName,
-				log
+				log,
+				cleanup: postCreateCleanup
 			});
 			const runtimeManagementConfig = properties["RuntimeManagementConfig"];
 			if (runtimeManagementConfig !== void 0) await this.applyPostCreateConfig(async () => {
@@ -6649,7 +6764,8 @@ var LambdaFunctionProvider = class {
 				logicalId,
 				resourceType,
 				functionName,
-				log
+				log,
+				cleanup: postCreateCleanup
 			});
 			log.debug(`Successfully created Lambda function ${logicalId}: ${log.value(functionName)}`);
 			return {
@@ -6662,7 +6778,9 @@ var LambdaFunctionProvider = class {
 		} catch (error) {
 			if (functionCreated) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create Lambda function ${logicalId}: ${text}`, resourceType, logicalId, functionName, cause ?? new Error(String(error))));
+			const thrown = this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create Lambda function ${logicalId}: ${text}`, resourceType, logicalId, functionName, cause ?? new Error(String(error))));
+			if (createdFunctionName !== void 0 && !postCreateCleanup.deleted) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFunctionName);
+			throw thrown;
 		}
 	}
 	wrapMaskedError(log, error, build) {
@@ -6691,6 +6809,7 @@ var LambdaFunctionProvider = class {
 				if (!/currently in the following state|ResourceConflict/i.test(deleteMessage)) break;
 				if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, this.cleanupDeleteRetryDelayMs * (attempt + 1)));
 			}
+			if (cleanupFailure === void 0) ctx.cleanup.deleted = true;
 			if (cleanupFailure !== void 0) this.logger.error(log.mask(`Cleanup DeleteFunction failed for ${ctx.logicalId} after ${ctx.apiName} failure — function may be orphaned: ${cleanupFailure}`));
 			const cause = error instanceof Error ? error : void 0;
 			const refusal = new ProvisioningError(`Failed to set ${ctx.propertyName} on Lambda function ${ctx.logicalId} (function was deleted to maintain atomicity): ${message}`, ctx.resourceType, ctx.logicalId, ctx.functionName, cause ?? new Error(rawMessage));
@@ -7358,7 +7477,7 @@ var LambdaPermissionProvider = class {
 			}
 		}
 		if (statementId === "") {
-			this.logger.warn(safeMsg`Lambda permission ${logicalId} has no StatementId in its physicalId ` + safeMsg`("${physicalId}"), skipping deletion — no AWS call is issued, so the permission ` + `statement is LEFT IN PLACE on the function's resource policy, UNLESS the function itself is part of this stack (deleting it removes its whole resource policy, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack> --stack-region <region>', which drops every record the stack has in that region). Otherwise repair the physicalId in state.json and re-run, or remove the statement by hand ('aws lambda remove-permission'). ${DEPLOY_SKIP_CAVEAT$1}`);
+			this.logger.warn(safeMsg`Lambda permission ${logicalId} has no StatementId in its physicalId ` + safeMsg`("${physicalId}"), skipping deletion — no AWS call is issued, so the permission ` + "statement is LEFT IN PLACE on the function's resource policy, UNLESS the function itself is part of this stack (deleting it removes its whole resource policy, and then only the cdkd record is stale — clear it with " + safeMsg`${stateOrphanRecordRemedy(context, logicalId)}). ` + `Otherwise repair the physicalId in state.json and re-run, or remove the statement by hand ('aws lambda remove-permission'). ${DEPLOY_SKIP_CAVEAT$1}`);
 			return {
 				outcome: "skipped",
 				reason: PERMISSION_STATEMENT_ID_SKIP_REASON
@@ -7366,11 +7485,11 @@ var LambdaPermissionProvider = class {
 		}
 		const functionName = functionNameFromProperties || functionNameFromPhysicalId;
 		if (!functionName && functionNameRedacted) {
-			const skip = redactedDeleteAddressSkip(this.logger, logicalId, "Lambda permission", ["FunctionName"]);
+			const skip = redactedDeleteAddressSkip(this.logger, logicalId, "Lambda permission", ["FunctionName"], context);
 			if (skip) return skip;
 		}
 		if (!functionName) {
-			this.logger.warn(safeMsg`FunctionName not available for Lambda permission ${logicalId} (neither the state ` + `record's FunctionName nor a function ARN in the physicalId), skipping deletion — no AWS call is issued, so the permission statement is LEFT IN PLACE on the function's resource policy, UNLESS the function itself is part of this stack (deleting it removes its whole resource policy, and then only the cdkd record is stale — clear it with 'cdkd state orphan <stack> --stack-region <region>', which drops every record the stack has in that region). Otherwise repair the record's FunctionName in state.json and re-run, or remove the statement by hand ('aws lambda remove-permission'). ${DEPLOY_SKIP_CAVEAT$1}`);
+			this.logger.warn(safeMsg`FunctionName not available for Lambda permission ${logicalId} (neither the state ` + "record's FunctionName nor a function ARN in the physicalId), skipping deletion — no AWS call is issued, so the permission statement is LEFT IN PLACE on the function's resource policy, UNLESS the function itself is part of this stack (deleting it removes its whole resource policy, and then only the cdkd record is stale — clear " + safeMsg`it with ${stateOrphanRecordRemedy(context, logicalId)}). ` + `Otherwise repair the record's FunctionName in state.json and re-run, or remove the statement by hand ('aws lambda remove-permission'). ${DEPLOY_SKIP_CAVEAT$1}`);
 			return {
 				outcome: "skipped",
 				reason: PERMISSION_FUNCTION_NAME_SKIP_REASON
@@ -7771,6 +7890,7 @@ async function reportPossibleOrphans(logicalId, window, log, lookup) {
 	const until = new Date(window.ceilingMs).toISOString();
 	const remove = lookup.remove;
 	const service = lookup.service ?? "API Gateway";
+	const afterward = lookup.afterward ?? "Creating a new one now.";
 	const when = remove !== void 0 ? `between ${since} and ${until}` : `at ${since}`;
 	let found;
 	try {
@@ -7793,10 +7913,10 @@ async function reportPossibleOrphans(logicalId, window, log, lookup) {
 	const inspect = [...new Set(shown.map((id) => lookup.inspect(id)))].join(" ; ");
 	if (remove !== void 0) {
 		const deletion = [...new Set(shown.map((id) => remove(id)))].join(" ; ");
-		log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer, and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} were created ${when} that this deploy did not record: ${shown.join(", ")}${more}. cdkd does not adopt or delete them: nothing listed proves which deploy created one. Creating a new one now. First inspect each candidate: ${inspect}. Only after confirming one is this deploy's orphan and not another deploy's, ${lookup.removeVerb ?? "delete it"}: ${deletion}.${incomplete}`);
+		log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer, and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} were created ${when} that this deploy did not record: ${shown.join(", ")}${more}. cdkd does not adopt or delete them: nothing listed proves which deploy created one. ${afterward} First inspect each candidate: ${inspect}. Only after confirming one is this deploy's orphan and not another deploy's, ${lookup.removeVerb ?? "delete it"}: ${deletion}.${incomplete}`);
 		return;
 	}
-	log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer (${when}), and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} match that this deploy did not record: ${shown.join(", ")}${more}. ${service} reports no creation time for them, so any of them may instead be this stack's own recorded one, another stack's, or older than this deploy; cdkd does not adopt or delete them. Creating a new one now. Inspect each before deleting anything: ${inspect}.${incomplete}`);
+	log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer (${when}), and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} match that this deploy did not record: ${shown.join(", ")}${more}. ${service} reports no creation time for them, so any of them may instead be this stack's own recorded one, another stack's, or older than this deploy; cdkd does not adopt or delete them. ${afterward} Inspect each before deleting anything: ${inspect}.${incomplete}`);
 }
 
 //#endregion
@@ -8715,9 +8835,11 @@ var LambdaMicrovmImageProvider = class {
 			...buildCommonImageInput(properties)
 		};
 		if (tagList.length > 0) input.tags = Object.fromEntries(tagList.map((t) => [t.Key, t.Value]));
+		let createdArn;
 		try {
 			const response = await this.client.send(new CreateMicrovmImageCommand(input));
 			const imageArn = response.imageArn;
+			createdArn = imageArn;
 			if (!imageArn) throw new ProvisioningError(`CreateMicrovmImage succeeded but no imageArn returned for ${logicalId}`, resourceType, logicalId);
 			this.logger.debug(`Created MicroVM image ${logicalId}: ${imageArn} (state=${response.state})`);
 			const noWait = process.env["CDKD_NO_WAIT"] === "true";
@@ -8740,7 +8862,9 @@ var LambdaMicrovmImageProvider = class {
 				})
 			};
 		} catch (error) {
-			throw this.wrapError("create", logicalId, resourceType, void 0, error);
+			const thrown = this.wrapError("create", logicalId, resourceType, void 0, error);
+			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -9734,18 +9858,20 @@ var DynamoDBTableProvider = class {
 				}
 			};
 		} catch (error) {
+			let tableLeftBehind = false;
 			if (tableCreated) {
 				try {
 					await this.dynamoDBClient.send(new DeleteTableCommand({ TableName: tableName }));
 					debug(`Rolled back partially-created DynamoDB table ${tableName}`);
 				} catch (cleanupError) {
+					tableLeftBehind = true;
 					warn(`Failed to roll back partially-created DynamoDB table ${tableName}: ${describeAwsFailure(cleanupError).detail}`);
 				}
 				markAuxiliaryFailure(error, logicalId);
 			}
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create DynamoDB table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, tableName, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DynamoDB table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, tableName, error instanceof Error ? error : void 0);
+			if (tableLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, tableName);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -10993,6 +11119,7 @@ var LogsLogGroupProvider = class {
 			allowedPattern: /[^a-zA-Z0-9-/_]/g
 		})}`;
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		let leftBehind = false;
 		try {
 			const createParams = { logGroupName };
 			if (properties["KmsKeyId"]) createParams.kmsKeyId = properties["KmsKeyId"];
@@ -11003,6 +11130,7 @@ var LogsLogGroupProvider = class {
 			try {
 				await this.logsClient.send(new CreateLogGroupCommand(createParams));
 				createdNewLogGroup = true;
+				leftBehind = true;
 			} catch (createError) {
 				if (createError instanceof ResourceAlreadyExistsException) this.logger.debug(`Log group ${logGroupName} already exists, using existing`);
 				else throw createError;
@@ -11048,6 +11176,7 @@ var LogsLogGroupProvider = class {
 			} catch (innerError) {
 				if (createdNewLogGroup) try {
 					await this.logsClient.send(new DeleteLogGroupCommand({ logGroupName }));
+					leftBehind = false;
 					this.logger.debug(`Cleaned up partially-created log group ${displaySafe(logicalId)} (${displaySafe(logGroupName)}) after wiring failure`);
 				} catch (cleanupError) {
 					const mask = maskerOrIdentity(context?.maskSecrets);
@@ -11056,7 +11185,7 @@ var LogsLogGroupProvider = class {
 						identifier: logGroupName,
 						maskSecrets: mask
 					});
-					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
+					const manualStep = deleteCommand ? `On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "On a first-time create the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the log group name cannot be reproduced safely on a command line.";
 					this.logger.warn(mask(`Failed to clean up partially-created log group ${displaySafe(logicalId)} (${displaySafe(mask(logGroupName))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`));
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -11069,7 +11198,9 @@ var LogsLogGroupProvider = class {
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			const mask = maskerOrIdentity(context?.maskSecrets);
-			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to create log group ${logicalId}: ${text}`, resourceType, logicalId, logGroupName, cause));
+			const thrown = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to create log group ${logicalId}: ${text}`, resourceType, logicalId, logGroupName, cause));
+			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, logGroupName);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, callerContext) {
@@ -11649,7 +11780,7 @@ var CloudWatchAnomalyDetectorProvider = class {
 	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
 		this.logger.debug(`Deleting CloudWatch anomaly detector ${logicalId}: ${physicalId}`);
-		if (!properties) throw new ProvisioningError(`Cannot delete AnomalyDetector ${logicalId}: the state record carries no properties, and DeleteAnomalyDetector addresses the model by its metric descriptor. Use 'cdkd state orphan <stack> --stack-region <region>' to drop the record (that command drops every record the stack has in that region) and delete the detector manually.`, resourceType, logicalId, physicalId);
+		if (!properties) throw new ProvisioningError(`Cannot delete AnomalyDetector ${logicalId}: the state record carries no properties, and DeleteAnomalyDetector addresses the model by its metric descriptor. Delete the detector manually and drop the record with ${stateOrphanRecordRemedy(context, logicalId)}.`, resourceType, logicalId, physicalId);
 		const skip = redactedDeleteAddressSkip(this.logger, logicalId, "CloudWatch anomaly detector", redactedDeleteAddressFields({
 			Namespace: properties["Namespace"],
 			MetricName: properties["MetricName"],
@@ -11657,7 +11788,7 @@ var CloudWatchAnomalyDetectorProvider = class {
 			Dimensions: properties["Dimensions"],
 			SingleMetricAnomalyDetector: properties["SingleMetricAnomalyDetector"],
 			MetricMathAnomalyDetector: properties["MetricMathAnomalyDetector"]
-		}));
+		}), context);
 		if (skip) return skip;
 		try {
 			await this.cloudWatchClient.send(new DeleteAnomalyDetectorCommand(buildDeleteParams(properties)));
@@ -12208,6 +12339,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 		const type = properties["Type"] || "String";
 		const value = properties["Value"];
 		if (!value) throw new ProvisioningError(`Value is required for SSM parameter ${displaySafe(logicalId)}`, resourceType, logicalId);
+		let leftBehind = false;
 		try {
 			const putParams = {
 				Name: name,
@@ -12221,6 +12353,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 			if (properties["Policies"]) putParams.Policies = properties["Policies"];
 			if (properties["DataType"]) putParams.DataType = properties["DataType"];
 			await this.ssmClient.send(new PutParameterCommand(putParams));
+			leftBehind = true;
 			try {
 				if (ssmTags.length > 0) await this.ssmClient.send(new AddTagsToResourceCommand({
 					ResourceType: "Parameter",
@@ -12230,6 +12363,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 			} catch (innerError) {
 				try {
 					await this.ssmClient.send(new DeleteParameterCommand({ Name: name }));
+					leftBehind = false;
 					debug(`Cleaned up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}) after wiring failure`);
 				} catch (cleanupError) {
 					const deleteCommand = renderDisableCommand({
@@ -12237,7 +12371,7 @@ var SSMParameterProvider = class SSMParameterProvider {
 						identifier: name,
 						maskSecrets: mask
 					});
-					const manualStep = deleteCommand ? `Manual deletion may be required before the next deploy: ${deleteCommand}` : "Manual deletion may be required before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line: a command naming the sanitized form would delete a DIFFERENT parameter, and one naming a name that is not inert unquoted could run part of it as shell.";
+					const manualStep = deleteCommand ? `On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${deleteCommand}` : "On a first-time create the failed deploy's rollback journal records it for `cdkd rollback --revert-failed`; otherwise delete it yourself before the next deploy, via the console: the parameter name cannot be reproduced safely on a command line: a command naming the sanitized form would delete a DIFFERENT parameter, and one naming a name that is not inert unquoted could run part of it as shell.";
 					warn(`Failed to clean up partially-created SSM parameter ${displaySafe(logicalId)} (${displaySafe(mask(name))}): ${describeAwsFailure(cleanupError).detail}. ${manualStep}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -12254,7 +12388,9 @@ var SSMParameterProvider = class SSMParameterProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to create SSM parameter ${displaySafe(logicalId)}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapMaskedError(mask, error, (text) => new ProvisioningError(`Failed to create SSM parameter ${displaySafe(logicalId)}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (leftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, name);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -12532,6 +12668,7 @@ var EventBridgeRuleProvider = class {
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const ruleName = properties["Name"] || generateResourceName(logicalId, { maxLength: 64 });
 		const targets = properties["Targets"];
+		let leftLiveArn;
 		try {
 			const heldBefore = targets && targets.length > 0 ? await nameHeldBefore(async () => {
 				await this.eventBridgeClient.send(new DescribeRuleCommand({
@@ -12581,6 +12718,7 @@ var EventBridgeRuleProvider = class {
 					}));
 					this.logger.debug(`Cleaned up partially-created EventBridge rule ${logicalId} (${ruleName}) after wiring failure`);
 				} catch (cleanupError) {
+					leftLiveArn = ruleArn;
 					this.logger.warn(mask(`Failed to clean up partially-created EventBridge rule ${logicalId} (${ruleName}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy` + (command.text === void 0 ? `: ${command.render()}` : `. If the rule has no targets left, the remove-targets step reports an empty id list; that error is harmless and the delete-rule step still runs: ${command.render()}`)));
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -12591,7 +12729,9 @@ var EventBridgeRuleProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, ruleName, cause);
+			const thrown = new ProvisioningError(`Failed to create EventBridge rule ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, ruleName, cause);
+			if (leftLiveArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftLiveArn);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -13137,6 +13277,13 @@ function isEc2NotFoundCode(error) {
 	const name = error?.name;
 	return typeof name === "string" && name.endsWith(".NotFound");
 }
+const createVpcLatch = new AmbiguousCreateLatch("ec2:CreateVpc");
+const createSubnetLatch = new AmbiguousCreateLatch("ec2:CreateSubnet");
+const createInternetGatewayLatch = new AmbiguousCreateLatch("ec2:CreateInternetGateway");
+const allocateAddressLatch = new AmbiguousCreateLatch("ec2:AllocateAddress");
+const ec2IdsCreatedByThisProcess = new RecentIdSet();
+const isUntagged = (tags) => tags === void 0 || tags.length === 0;
+const ORPHAN_LIST_PAGE_SIZE$2 = 1e3;
 var EC2Provider = class {
 	ec2Client;
 	ec2AuthorizeClient;
@@ -13263,11 +13410,128 @@ var EC2Provider = class {
 		this.ec2Client = awsClients.ec2;
 		this.ec2AuthorizeClient = awsClients.ec2SingleSend ?? awsClients.ec2;
 	}
+	createClient;
+	getCreateClient() {
+		const shared = this.ec2Client;
+		if (!(shared instanceof EC2Client)) return Promise.resolve(shared);
+		this.createClient ??= shared.config.region().then((region) => withoutServerErrorRetries(new EC2Client({
+			...ambientClientDefaults(),
+			region
+		})), (error) => {
+			this.createClient = void 0;
+			throw error;
+		});
+		return this.createClient;
+	}
+	async reportPossibleEc2Orphans(logicalId, window, log, lookup) {
+		const aws = pasteableAwsCommand(log.mask);
+		const regionArg = await orphanCommandRegionArg(this.ec2Client, aws);
+		await reportPossibleOrphans(logicalId, window, log, {
+			action: lookup.action,
+			service: "EC2",
+			listAction: lookup.listAction,
+			subject: lookup.subject,
+			noun: lookup.noun,
+			...lookup.afterward !== void 0 && { afterward: lookup.afterward },
+			list: lookup.list,
+			inspect: (id) => lookup.inspect(aws, id, regionArg)
+		});
+	}
+	async reportPossibleOrphanVpcs(logicalId, cidrBlock, window, context) {
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
+		await this.reportPossibleEc2Orphans(logicalId, window, log, {
+			action: "CreateVpc",
+			listAction: "DescribeVpcs",
+			subject: `a VPC with CIDR ${log.value(cidrBlock)}`,
+			noun: "untagged VPC(s)",
+			list: () => collectOrphanIds(async (token) => {
+				const page = await this.ec2Client.send(new DescribeVpcsCommand({
+					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
+					NextToken: token
+				}));
+				return {
+					items: page.Vpcs ?? [],
+					next: page.NextToken
+				};
+			}, (vpc) => vpc.VpcId !== void 0 && vpc.IsDefault !== true && isUntagged(vpc.Tags) && vpc.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(vpc.CidrBlock) ?? vpc.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(vpc.VpcId) ? vpc.VpcId : void 0),
+			inspect: (aws, id, regionArg) => aws`aws ec2 describe-vpcs --vpc-ids ${id}${regionArg}`.render()
+		});
+	}
+	async reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, window, context) {
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		const wanted = canonicalizeIpv4Cidr(cidrBlock) ?? cidrBlock;
+		await this.reportPossibleEc2Orphans(logicalId, window, log, {
+			action: "CreateSubnet",
+			listAction: "DescribeSubnets",
+			subject: `a subnet with CIDR ${log.value(cidrBlock)} in VPC ${log.value(vpcId)}`,
+			noun: "untagged subnet(s)",
+			afterward: "Creating it again, which fails with InvalidSubnet.Conflict while that subnet exists.",
+			list: () => collectOrphanIds(async (token) => {
+				const page = await this.ec2Client.send(new DescribeSubnetsCommand({
+					Filters: [{
+						Name: "vpc-id",
+						Values: [vpcId]
+					}],
+					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
+					NextToken: token
+				}));
+				return {
+					items: page.Subnets ?? [],
+					next: page.NextToken
+				};
+			}, (subnet) => subnet.SubnetId !== void 0 && isUntagged(subnet.Tags) && subnet.CidrBlock !== void 0 && (canonicalizeIpv4Cidr(subnet.CidrBlock) ?? subnet.CidrBlock) === wanted && !ec2IdsCreatedByThisProcess.has(subnet.SubnetId) ? subnet.SubnetId : void 0),
+			inspect: (aws, id, regionArg) => aws`aws ec2 describe-subnets --subnet-ids ${id}${regionArg}`.render()
+		});
+	}
+	async reportPossibleOrphanInternetGateways(logicalId, window, context) {
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		await this.reportPossibleEc2Orphans(logicalId, window, log, {
+			action: "CreateInternetGateway",
+			listAction: "DescribeInternetGateways",
+			subject: "an internet gateway",
+			noun: "detached, untagged internet gateway(s)",
+			list: () => collectOrphanIds(async (token) => {
+				const page = await this.ec2Client.send(new DescribeInternetGatewaysCommand({
+					MaxResults: ORPHAN_LIST_PAGE_SIZE$2,
+					NextToken: token
+				}));
+				return {
+					items: page.InternetGateways ?? [],
+					next: page.NextToken
+				};
+			}, (igw) => igw.InternetGatewayId !== void 0 && (igw.Attachments ?? []).length === 0 && isUntagged(igw.Tags) && !ec2IdsCreatedByThisProcess.has(igw.InternetGatewayId) ? igw.InternetGatewayId : void 0),
+			inspect: (aws, id, regionArg) => aws`aws ec2 describe-internet-gateways --internet-gateway-ids ${id}${regionArg}`.render()
+		});
+	}
+	async reportPossibleOrphanAddresses(logicalId, input, window, context) {
+		const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
+		await this.reportPossibleEc2Orphans(logicalId, window, log, {
+			action: "AllocateAddress",
+			listAction: "DescribeAddresses",
+			subject: `an Elastic IP address (domain ${log.value(input.Domain ?? "vpc")})`,
+			noun: "unassociated, untagged Elastic IP address(es)",
+			list: async () => {
+				const response = await this.ec2Client.send(new DescribeAddressesCommand({}));
+				const ids = [];
+				for (const address of response.Addresses ?? []) {
+					const id = address.AllocationId;
+					if (id === void 0 || (address.Domain ?? "vpc") !== (input.Domain ?? "vpc") || address.AssociationId !== void 0 || !isUntagged(address.Tags) || input.NetworkBorderGroup !== void 0 && address.NetworkBorderGroup !== input.NetworkBorderGroup || input.PublicIpv4Pool !== void 0 && address.PublicIpv4Pool !== input.PublicIpv4Pool || ec2IdsCreatedByThisProcess.has(id)) continue;
+					ids.push(id);
+				}
+				return {
+					ids,
+					truncated: false
+				};
+			},
+			inspect: (aws, id, regionArg) => aws`aws ec2 describe-addresses --allocation-ids ${id}${regionArg}`.render()
+		});
+	}
 	async create(logicalId, resourceType, properties, context) {
 		switch (resourceType) {
-			case "AWS::EC2::VPC": return this.createVpc(logicalId, resourceType, properties);
-			case "AWS::EC2::Subnet": return this.createSubnet(logicalId, resourceType, properties);
-			case "AWS::EC2::InternetGateway": return this.createInternetGateway(logicalId, resourceType, properties);
+			case "AWS::EC2::VPC": return this.createVpc(logicalId, resourceType, properties, context);
+			case "AWS::EC2::Subnet": return this.createSubnet(logicalId, resourceType, properties, context);
+			case "AWS::EC2::InternetGateway": return this.createInternetGateway(logicalId, resourceType, properties, context);
 			case "AWS::EC2::EIP": return this.createEip(logicalId, resourceType, properties, context);
 			case "AWS::EC2::VPCGatewayAttachment": return this.createVpcGatewayAttachment(logicalId, resourceType, properties, context);
 			case "AWS::EC2::NatGateway": return this.createNatGateway(logicalId, resourceType, properties);
@@ -13344,16 +13608,29 @@ var EC2Provider = class {
 			default: return;
 		}
 	}
-	async createVpc(logicalId, resourceType, properties) {
+	async createVpc(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating VPC ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const cidrBlock = properties["CidrBlock"];
 		if (!cidrBlock) throw new ProvisioningError(`CidrBlock is required for VPC ${logicalId}`, resourceType, logicalId);
+		let leftBehindId;
 		try {
-			const vpcId = (await this.ec2Client.send(new CreateVpcCommand({
-				CidrBlock: cidrBlock,
-				InstanceTenancy: properties["InstanceTenancy"] ?? void 0
-			}))).Vpc.VpcId;
+			const createClient = await this.getCreateClient();
+			const orphanWindow = createVpcLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, orphanWindow, context);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new CreateVpcCommand({
+					CidrBlock: cidrBlock,
+					InstanceTenancy: properties["InstanceTenancy"] ?? void 0
+				}));
+			} catch (error) {
+				createVpcLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			const vpcId = response.Vpc.VpcId;
+			ec2IdsCreatedByThisProcess.add(vpcId);
 			let defaultSgId;
 			try {
 				if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
@@ -13382,6 +13659,7 @@ var EC2Provider = class {
 					await this.ec2Client.send(new DeleteVpcCommand({ VpcId: vpcId }));
 					this.logger.debug(`Cleaned up partially-created VPC ${logicalId} (${vpcId}) after wiring failure`);
 				} catch (cleanupError) {
+					leftBehindId = vpcId;
 					this.logger.warn(`Failed to clean up partially-created VPC ${logicalId} (${vpcId}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand()`aws ec2 delete-vpc --vpc-id ${vpcId}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -13397,7 +13675,9 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create VPC ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create VPC ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+			throw thrown;
 		}
 	}
 	async updateVpc(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -13491,19 +13771,31 @@ var EC2Provider = class {
 			return;
 		}
 	}
-	async createSubnet(logicalId, resourceType, properties) {
+	async createSubnet(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating Subnet ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const vpcId = properties["VpcId"];
 		const cidrBlock = properties["CidrBlock"];
 		if (!vpcId || !cidrBlock) throw new ProvisioningError(`VpcId and CidrBlock are required for Subnet ${logicalId}`, resourceType, logicalId);
+		let leftBehindId;
 		try {
-			const response = await this.ec2Client.send(new CreateSubnetCommand({
-				VpcId: vpcId,
-				CidrBlock: cidrBlock,
-				AvailabilityZone: properties["AvailabilityZone"] ?? void 0
-			}));
+			const createClient = await this.getCreateClient();
+			const orphanWindow = createSubnetLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, orphanWindow, context);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new CreateSubnetCommand({
+					VpcId: vpcId,
+					CidrBlock: cidrBlock,
+					AvailabilityZone: properties["AvailabilityZone"] ?? void 0
+				}));
+			} catch (error) {
+				createSubnetLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
 			const subnetId = response.Subnet.SubnetId;
+			ec2IdsCreatedByThisProcess.add(subnetId);
 			const availabilityZone = response.Subnet.AvailabilityZone;
 			try {
 				await this.applyTags(subnetId, desiredTags, logicalId);
@@ -13520,6 +13812,7 @@ var EC2Provider = class {
 					await this.ec2Client.send(new DeleteSubnetCommand({ SubnetId: subnetId }));
 					this.logger.debug(`Cleaned up partially-created Subnet ${logicalId} (${subnetId}) after wiring failure`);
 				} catch (cleanupError) {
+					leftBehindId = subnetId;
 					this.logger.warn(`Failed to clean up partially-created Subnet ${logicalId} (${subnetId}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand()`aws ec2 delete-subnet --subnet-id ${subnetId}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -13534,7 +13827,9 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Subnet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create Subnet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+			throw thrown;
 		}
 	}
 	async updateSubnet(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -13647,11 +13942,23 @@ var EC2Provider = class {
 			return;
 		}
 	}
-	async createInternetGateway(logicalId, resourceType, properties) {
+	async createInternetGateway(logicalId, resourceType, properties, context) {
 		this.logger.debug(`Creating InternetGateway ${logicalId}`);
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		try {
-			const igwId = (await this.ec2Client.send(new CreateInternetGatewayCommand({}))).InternetGateway.InternetGatewayId;
+			const createClient = await this.getCreateClient();
+			const orphanWindow = createInternetGatewayLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, orphanWindow, context);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new CreateInternetGatewayCommand({}));
+			} catch (error) {
+				createInternetGatewayLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
+			const igwId = response.InternetGateway.InternetGatewayId;
+			ec2IdsCreatedByThisProcess.add(igwId);
 			await this.applyTags(igwId, desiredTags, logicalId);
 			this.logger.debug(`Successfully created InternetGateway ${logicalId}: ${igwId}`);
 			return {
@@ -13708,15 +14015,33 @@ var EC2Provider = class {
 		let allocationId;
 		let publicIp;
 		let created = false;
+		let createdId;
 		try {
-			const response = await this.ec2Client.send(new AllocateAddressCommand({
+			const input = {
 				Domain: requireConfigString(properties["Domain"], "vpc", "AWS::EC2::EIP Domain", replayWarn(this.logger, context)),
 				NetworkBorderGroup: properties["NetworkBorderGroup"],
 				PublicIpv4Pool: properties["PublicIpv4Pool"]
-			}));
+			};
+			const createClient = await this.getCreateClient();
+			const orphanWindow = allocateAddressLatch.take(logicalId);
+			if (orphanWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, orphanWindow, context);
+			const attemptStartMs = Date.now();
+			let response;
+			try {
+				response = await createClient.send(new AllocateAddressCommand(input));
+			} catch (error) {
+				allocateAddressLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
+				throw error;
+			}
 			created = true;
 			allocationId = response.AllocationId;
 			publicIp = response.PublicIp;
+			try {
+				createdId = this.eipPhysicalId(logicalId, publicIp, allocationId);
+			} catch {
+				createdId = allocationId;
+			}
+			ec2IdsCreatedByThisProcess.add(allocationId);
 			await this.applyTags(allocationId, desiredTags, logicalId);
 			const instanceId = properties["InstanceId"];
 			if (instanceId) {
@@ -13733,7 +14058,9 @@ var EC2Provider = class {
 		} catch (error) {
 			if (created) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create EIP ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			if (createdId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
+			throw thrown;
 		}
 		return {
 			physicalId: this.eipPhysicalId(logicalId, publicIp, allocationId, {
@@ -13878,6 +14205,7 @@ var EC2Provider = class {
 			scope: "CreateNatGateway",
 			logicalId
 		});
+		let createdId;
 		try {
 			const natGatewayId = (await this.ec2Client.send(new CreateNatGatewayCommand({
 				ClientToken: natGatewayToken.value,
@@ -13889,6 +14217,7 @@ var EC2Provider = class {
 				SecondaryPrivateIpAddresses: properties["SecondaryPrivateIpAddresses"],
 				SecondaryPrivateIpAddressCount: properties["SecondaryPrivateIpAddressCount"]
 			}))).NatGateway.NatGatewayId;
+			createdId = natGatewayId;
 			await this.applyTags(natGatewayId, desiredTags, logicalId);
 			if (process.env["CDKD_NO_WAIT"] !== "true") {
 				this.logger.debug(`Waiting for NatGateway ${natGatewayId} to reach available state...`);
@@ -13908,7 +14237,9 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create NatGateway ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create NatGateway ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			if (createdId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdId);
+			throw thrown;
 		}
 	}
 	updateNatGateway(logicalId, physicalId) {
@@ -14134,8 +14465,9 @@ var EC2Provider = class {
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const groupDescription = properties["GroupDescription"];
 		if (!groupDescription) throw new ProvisioningError(`GroupDescription is required for SecurityGroup ${logicalId}`, resourceType, logicalId);
+		let leftBehindId;
 		try {
-			const groupId = (await this.ec2Client.send(new CreateSecurityGroupCommand({
+			const groupId = (await (await this.getCreateClient()).send(new CreateSecurityGroupCommand({
 				GroupName: properties["GroupName"] ?? logicalId,
 				Description: groupDescription,
 				VpcId: properties["VpcId"] ?? void 0
@@ -14158,6 +14490,7 @@ var EC2Provider = class {
 					await this.ec2Client.send(new DeleteSecurityGroupCommand({ GroupId: groupId }));
 					this.logger.debug(`Cleaned up partially-created SecurityGroup ${logicalId} (${groupId}) after wiring failure`);
 				} catch (cleanupError) {
+					leftBehindId = groupId;
 					this.logger.warn(`Failed to clean up partially-created SecurityGroup ${logicalId} (${groupId}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand()`aws ec2 delete-security-group --group-id ${groupId}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -14172,7 +14505,9 @@ var EC2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create SecurityGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create SecurityGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+			throw thrown;
 		}
 	}
 	async authorizeInlineIngress(groupId, ingressRules) {
@@ -14560,7 +14895,7 @@ var EC2Provider = class {
 			if (keptFor !== void 0) this.logger.info(safeMsg`SecurityGroupIngress ${logicalId}: its previous rule is also held by ${keptFor} of this stack, so the update left it in place`);
 			const revoked = keptFor !== void 0 ? void 0 : await this.deleteSecurityGroupIngress(logicalId, physicalId, resourceType, previousProperties, recordedAttributes ? { recordedAttributes } : void 0);
 			const revokeSkip = deleteSkipReason(revoked);
-			if (revokeSkip !== void 0) throw markNonRetryable(new ProvisioningError(`Cannot update SecurityGroupIngress ${logicalId}: the previous rule could not be revoked because ${revokeSkip === "redacted address property in state — no delete issued" ? "its recorded permission is redacted in state" : "its delete was skipped"}, so the new rule was NOT authorized. Revoke the old rule by hand, then clear the stack's records with 'cdkd state orphan <stack>' — that command drops EVERY record for the stack, not just this one — and re-deploy.`, resourceType, logicalId, physicalId));
+			if (revokeSkip !== void 0) throw markNonRetryable(new ProvisioningError(`Cannot update SecurityGroupIngress ${logicalId}: the previous rule could not be revoked because ${revokeSkip === "redacted address property in state — no delete issued" ? "its recorded permission is redacted in state" : "its delete was skipped"}, so the new rule was NOT authorized. Revoke the old rule by hand, then drop its record with ${stateOrphanRecordRemedy(void 0, logicalId)}; then re-deploy.`, resourceType, logicalId, physicalId));
 			const createResult = await this.createSecurityGroupIngress(logicalId, resourceType, properties, (message) => this.logger.warn(message), maskSecrets, replayingState, keptFor !== void 0 ? void 0 : typeof recordedAttributes?.["Id"] === "string" ? recordedAttributes["Id"] : physicalId);
 			return {
 				physicalId: createResult.physicalId,
@@ -14617,7 +14952,7 @@ var EC2Provider = class {
 				SourceSecurityGroupId: properties["SourceSecurityGroupId"],
 				SourceSecurityGroupOwnerId: properties["SourceSecurityGroupOwnerId"],
 				SourcePrefixListId: properties["SourcePrefixListId"]
-			}));
+			}), context);
 			if (redactedSkip) return redactedSkip;
 		}
 		const ipPermission = properties ? this.withoutDescription(this.buildIpPermission(properties)) : {
@@ -14656,6 +14991,7 @@ var EC2Provider = class {
 		const imageId = properties["ImageId"];
 		if (!imageId) throw new ProvisioningError(`ImageId is required for EC2 Instance ${logicalId}`, resourceType, logicalId);
 		const instanceType = requireConfigString(properties["InstanceType"], "t3.micro", "AWS::EC2::Instance InstanceType", replayWarn(this.logger, context));
+		let leftBehindId;
 		try {
 			const securityGroupIds = properties["SecurityGroupIds"];
 			const securityGroups = properties["SecurityGroups"];
@@ -14723,14 +15059,15 @@ var EC2Provider = class {
 					runInstancesToken.release();
 					this.logger.debug(`Terminate requested for partially-created EC2 Instance ${logicalId} (${instanceId}) after wiring failure (not waiting for terminated state)`);
 				} catch (cleanupError) {
+					leftBehindId = instanceId;
 					this.logger.warn(`Failed to terminate partially-created EC2 Instance ${logicalId} (${instanceId}): ${describeAwsFailure(cleanupError).detail}. THE INSTANCE IS STILL RUNNING AND BILLING. Manual termination required: ${pasteableAwsCommand(context?.maskSecrets)`aws ec2 terminate-instances --instance-ids ${instanceId}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create EC2 Instance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create EC2 Instance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			if (leftBehindId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindId);
+			throw thrown;
 		}
 	}
 	normalizeIamInstanceProfile(raw) {
@@ -15214,7 +15551,10 @@ var EC2Provider = class {
 		this.logger.debug(`Deleting NetworkAclEntry ${logicalId}: ${physicalId}`);
 		const parts = physicalId.split("|");
 		if (parts.length < 3) {
-			this.logger.warn(compositeIdFormatMessage(EC2_NETWORK_ACL_ENTRY_ID_FORMAT, logicalId, physicalId, { skipping: true }));
+			this.logger.warn(compositeIdFormatMessage(EC2_NETWORK_ACL_ENTRY_ID_FORMAT, logicalId, physicalId, {
+				skipping: true,
+				context
+			}));
 			return compositeIdSkipResult();
 		}
 		const networkAclId = parts[0];
@@ -16772,6 +17112,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			const block = properties[key];
 			if (block != null && !isPlainObjectBlock(block)) throw new ProvisioningError(`AWS::ApiGateway::Stage ${key} for ${logicalId} must be an object block; got ${Array.isArray(block) ? "an array" : typeof block}. Fix the template value instead of letting cdkd drop the config.`, resourceType, logicalId);
 		}
+		let stageLeftBehind = false;
 		try {
 			const rawCacheClusterSize = properties["CacheClusterSize"];
 			await this.apiGatewayClient.send(new CreateStageCommand({
@@ -16821,6 +17162,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 						stageName
 					}));
 				} catch (cleanupError) {
+					stageLeftBehind = true;
 					log.warn(`Failed to clean up stage ${log.value(stageName)} after a post-create patch failure: ${describeAwsFailure(cleanupError).detail}`);
 				}
 				throw markAuxiliaryFailure(patchError, logicalId);
@@ -16832,7 +17174,9 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create API Gateway Stage ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create API Gateway Stage ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (stageLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, stageName);
+			throw thrown;
 		}
 	}
 	async updateStage(logicalId, physicalId, resourceType, properties, previousProperties, log) {
@@ -17038,6 +17382,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			httpMethod
 		].map((id) => log.value(id));
 		const methodPath = maskedIds.join("/");
+		let methodLeftBehind = false;
 		try {
 			await this.apiGatewayClient.send(new PutMethodCommand({
 				restApiId,
@@ -17111,6 +17456,7 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 					}));
 					log.debug(`Cleaned up partially-created API Gateway Method ${logicalId} (${methodPath}) after wiring failure`);
 				} catch (cleanupError) {
+					methodLeftBehind = true;
 					log.warn(`Failed to clean up partially-created API Gateway Method ${logicalId} (${methodPath}): ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand(log.mask)`aws apigateway delete-method --rest-api-id ${restApiId} --resource-id ${resourceId} --http-method ${httpMethod}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -17122,7 +17468,9 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create API Gateway Method ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create API Gateway Method ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (methodLeftBehind) markCreatedBeforeFailure(thrown, logicalId, resourceType, physicalId);
+			throw thrown;
 		}
 	}
 	async updateMethod(logicalId, physicalId, resourceType, properties, previousProperties, log) {
@@ -21094,7 +21442,9 @@ var ECSProvider = class {
 		const desiredTags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const client = this.getClient();
 		const serviceName = properties["ServiceName"] || generateResourceName(logicalId, { maxLength: 255 });
+		let survivorArn;
 		try {
+			const heldBefore = process.env["CDKD_FULL_WAIT"] === "true" ? await nameHeldBefore(() => this.serviceNameHeld(properties["Cluster"], serviceName), (error) => hasErrorName(error, ["ClusterNotFoundException"])) : "free";
 			const service = (await client.send(new CreateServiceCommand({
 				cluster: properties["Cluster"],
 				serviceName,
@@ -21132,7 +21482,9 @@ var ECSProvider = class {
 				const cleanupCluster = properties["Cluster"];
 				const clusterArg = cleanupCluster ? aws` --cluster ${cleanupCluster}` : aws``;
 				const listStopped = aws`aws ecs list-tasks${clusterArg} --desired-status STOPPED`;
-				try {
+				const deleteCommand = aws`aws ecs delete-service${clusterArg} --service ${service.serviceArn} --force`;
+				if (heldBefore !== "free") log.warn(skippedCleanupText(heldBefore, `ECS service ${logicalIdShown(logicalId)} ${isPlainImportValue(service.serviceArn) ? `(${service.serviceArn})` : VALUE_NOT_SHOWN}`, deleteCommand.render()));
+				else try {
 					await client.send(new DeleteServiceCommand({
 						cluster: properties["Cluster"],
 						service: service.serviceArn,
@@ -21140,7 +21492,8 @@ var ECSProvider = class {
 					}));
 					log.warn(`Deleted partially-created ECS service ${logicalId} (${service.serviceArn}) after the steady-state wait failed, so the next deploy's CreateService does not collide on the name. Its stopped tasks remain inspectable for about an hour: ${listStopped.render()}`);
 				} catch (cleanupError) {
-					log.warn(`Failed to clean up partially-created ECS service ${logicalIdShown(logicalId)} ${isPlainImportValue(service.serviceArn) ? `(${service.serviceArn})` : VALUE_NOT_SHOWN}: ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: ${aws`aws ecs delete-service${clusterArg} --service ${service.serviceArn} --force`.render()}`);
+					survivorArn = service.serviceArn;
+					log.warn(`Failed to clean up partially-created ECS service ${logicalIdShown(logicalId)} ${isPlainImportValue(service.serviceArn) ? `(${service.serviceArn})` : VALUE_NOT_SHOWN}: ${describeAwsFailure(cleanupError).detail}. Manual deletion may be required before the next deploy: ${deleteCommand.render()}`);
 				}
 				throw new Error(`ECS service ${logicalIdShown(logicalId)} did not reach steady state under --full-wait: ${waitError instanceof Error ? waitError.message : String(waitError)}. Inspect why its tasks stopped (stopped tasks stay visible for about an hour): ${listStopped.render()}, then ${aws`aws ecs describe-tasks${clusterArg} --tasks '<task-arn>' --query 'tasks[].[stoppedReason,containers[].reason]'`.render()}`, { cause: waitError });
 			}
@@ -21153,9 +21506,24 @@ var ECSProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log, error, (text) => new ProvisioningError(`Failed to create ECS service ${logicalIdShown(logicalId)}: ${text}`, resourceType, logicalId, serviceName, cause));
+			throw this.wrapMaskedError(log, error, (text) => {
+				const wrapped = new ProvisioningError(`Failed to create ECS service ${logicalIdShown(logicalId)}: ${text}`, resourceType, logicalId, serviceName, cause);
+				if (survivorArn !== void 0) markCreatedBeforeFailure(wrapped, logicalId, resourceType, survivorArn);
+				return wrapped;
+			});
 		}
 	}
+	async serviceNameHeld(cluster, serviceName) {
+		const response = await this.getClient().send(new DescribeServicesCommand({
+			cluster,
+			services: [serviceName]
+		}));
+		const services = response.services ?? [];
+		const failures = response.failures ?? [];
+		if (services.length === 0 && failures.length === 1 && failures[0]?.reason === "MISSING") return false;
+		if (failures.length > 0 || services.length !== 1) throw new Error("DescribeServices gave no readable answer for the service name");
+		return services[0].status !== "INACTIVE";
+	}
 	async settleService(logicalId, serviceRef, cluster, log) {
 		if (process.env["CDKD_FULL_WAIT"] === "true") {
 			log.debug(`Waiting for ECS service ${logicalId} to reach steady state...`);
@@ -22335,6 +22703,7 @@ var ELBv2Provider = class {
 	async createLoadBalancer(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating LoadBalancer ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		let leftBehindArn;
 		try {
 			const lbName = sentElbv2Name(properties, logicalId);
 			const lbAttributes = this.normalizeAttributes(properties["LoadBalancerAttributes"]);
@@ -22398,6 +22767,7 @@ var ELBv2Provider = class {
 					await this.getClient().send(new DeleteLoadBalancerCommand({ LoadBalancerArn: lbArn }));
 					this.logger.debug(`Cleaned up partially-created LoadBalancer ${logicalId} (${lbArn}) after wiring failure`);
 				} catch (cleanupError) {
+					leftBehindArn = lbArn;
 					this.logger.warn(`Failed to clean up partially-created LoadBalancer ${logicalId} (${lbArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-load-balancer --load-balancer-arn ${lbArn}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -22408,7 +22778,9 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create LoadBalancer ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create LoadBalancer ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (leftBehindArn !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindArn);
+			throw thrown;
 		}
 	}
 	async updateLoadBalancer(logicalId, physicalId, resourceType, properties, previousProperties, callerMaskSecrets, fromReadback = false) {
@@ -22616,6 +22988,7 @@ var ELBv2Provider = class {
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
 		const desiredTargets = readTargets(properties["Targets"], "desired");
 		if (desiredTargets.kind === "malformed") throw markNonRetryable(new ProvisioningError(`Targets of TargetGroup ${logicalId} is not a list of ${TARGETS_WHAT}${targetsSecretCause(desiredTargets)} — the target group was not created`, resourceType, logicalId));
+		let leftBehindArn;
 		try {
 			const matcher = properties["Matcher"];
 			const tgName = sentElbv2Name(properties, logicalId);
@@ -22666,6 +23039,7 @@ var ELBv2Provider = class {
 					await this.getClient().send(new DeleteTargetGroupCommand({ TargetGroupArn: tgArn }));
 					this.logger.debug(`Cleaned up partially-created TargetGroup ${logicalId} (${tgArn}) after wiring failure`);
 				} catch (cleanupError) {
+					leftBehindArn = tgArn;
 					this.logger.warn(`Failed to clean up partially-created TargetGroup ${logicalId} (${tgArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-target-group --target-group-arn ${tgArn}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
@@ -22676,7 +23050,9 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create TargetGroup ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create TargetGroup ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (leftBehindArn !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindArn);
+			throw thrown;
 		}
 	}
 	async updateTargetGroup(logicalId, physicalId, resourceType, properties, previousProperties, callerMaskSecrets, fromReadback = false) {
@@ -22774,14 +23150,30 @@ var ELBv2Provider = class {
 			throw new ProvisioningError(`Failed to delete TargetGroup ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	async listenerPortHeld(loadBalancerArn, port) {
+		let marker;
+		for (let page = 0; page < 100; page++) {
+			const response = await this.getClient().send(new DescribeListenersCommand({
+				LoadBalancerArn: loadBalancerArn,
+				...marker !== void 0 && { Marker: marker }
+			}));
+			if ((response.Listeners ?? []).some((l) => l.Port === port)) return true;
+			if (!response.NextMarker) return false;
+			marker = response.NextMarker;
+		}
+		throw new Error("DescribeListeners did not finish paging");
+	}
 	async createListener(logicalId, resourceType, properties, maskSecrets) {
 		this.logger.debug(`Creating Listener ${logicalId}`);
 		const tags = refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId);
+		let leftBehindArn;
 		try {
 			const defaultActions = this.convertActions(properties["DefaultActions"]);
 			const certificates = this.convertCertificates(properties["Certificates"]);
 			const alpnPolicy = properties["AlpnPolicy"];
 			const mutualAuth = properties["MutualAuthentication"];
+			const listenerAttributes = this.normalizeAttributes(properties["ListenerAttributes"]);
+			const heldBefore = listenerAttributes.length > 0 ? await nameHeldBefore(() => this.listenerPortHeld(properties["LoadBalancerArn"], properties["Port"] !== void 0 ? Number(properties["Port"]) : void 0), (error) => hasErrorName(error, ["LoadBalancerNotFoundException"])) : "free";
 			const listener = (await this.getClient().send(new CreateListenerCommand({
 				LoadBalancerArn: properties["LoadBalancerArn"],
 				Port: properties["Port"] !== void 0 ? Number(properties["Port"]) : void 0,
@@ -22797,7 +23189,6 @@ var ELBv2Provider = class {
 			const listenerArn = listener.ListenerArn;
 			this.logger.debug(`Successfully created Listener ${logicalId}: ${listenerArn}`);
 			try {
-				const listenerAttributes = this.normalizeAttributes(properties["ListenerAttributes"]);
 				if (listenerAttributes.length > 0) {
 					const watch = startInterruptWatch(`ELBv2 Listener ${logicalId} attributes`);
 					try {
@@ -22815,12 +23206,17 @@ var ELBv2Provider = class {
 					this.logger.debug(`Applied ${listenerAttributes.length} ListenerAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
-				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and neither rollback nor destroy could reach it. If that delete does not complete, remove it manually: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`));
+				if (heldBefore !== "free") {
+					this.logger.warn(maskerOrIdentity(maskSecrets)(skippedCleanupText(heldBefore, `Listener ${logicalId} (${listenerArn})`, pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render())));
+					throw markAuxiliaryFailure(innerError, logicalId);
+				}
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating Listener ${logicalId} (${listenerArn}) but before its attributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy with DuplicateListener and destroy could not reach it. If that delete fails, on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`));
 				try {
 					await this.getClient().send(new DeleteListenerCommand({ ListenerArn: listenerArn }));
 					this.logger.debug(`Cleaned up partially-created Listener ${logicalId} (${listenerArn}) after attributes-wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`);
+					leftBehindArn = listenerArn;
+					this.logger.warn(`Failed to clean up partially-created Listener ${logicalId} (${listenerArn}): ${this.maskErrorMessage(cleanupError, maskSecrets)}. On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws elbv2 delete-listener --listener-arn ${listenerArn}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -22830,7 +23226,9 @@ var ELBv2Provider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create Listener ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create Listener ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (leftBehindArn !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindArn);
+			throw thrown;
 		}
 	}
 	async updateListener(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets, fromReadback = false) {
@@ -23362,24 +23760,29 @@ var RDSDBProxyProvider = class {
 		let vpcId;
 		const deadline = Date.now() + POLL_TIMEOUT_MS$1;
 		let status;
-		while (Date.now() < deadline) {
-			try {
-				const proxy = (await client.send(new DescribeDBProxiesCommand({ DBProxyName: dbProxyName }))).DBProxies?.[0];
-				status = proxy?.Status;
-				if (status === "available") {
-					endpoint = proxy?.Endpoint;
-					dbProxyArn = proxy?.DBProxyArn;
-					vpcId = proxy?.VpcId;
-					break;
+		try {
+			while (Date.now() < deadline) {
+				try {
+					const proxy = (await client.send(new DescribeDBProxiesCommand({ DBProxyName: dbProxyName }))).DBProxies?.[0];
+					status = proxy?.Status;
+					if (status === "available") {
+						endpoint = proxy?.Endpoint;
+						dbProxyArn = proxy?.DBProxyArn;
+						vpcId = proxy?.VpcId;
+						break;
+					}
+					if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(`DBProxy ${dbProxyName} entered terminal failure state: ${status}`, resourceType, logicalId, dbProxyName);
+				} catch (error) {
+					if (error instanceof DBProxyNotFoundFault) {} else if (error instanceof ProvisioningError) throw error;
+					else throw this.wrapError(error, "CREATE (poll)", resourceType, logicalId, dbProxyName);
 				}
-				if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(`DBProxy ${dbProxyName} entered terminal failure state: ${status}`, resourceType, logicalId, dbProxyName);
-			} catch (error) {
-				if (error instanceof DBProxyNotFoundFault) {} else if (error instanceof ProvisioningError) throw error;
-				else throw this.wrapError(error, "CREATE (poll)", resourceType, logicalId, dbProxyName);
+				await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS$1));
 			}
-			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS$1));
+			if (!endpoint || !dbProxyArn) throw new ProvisioningError(`Timed out waiting for DBProxy ${dbProxyName} to become available (last status: ${status ?? "unknown"})`, resourceType, logicalId, dbProxyName);
+		} catch (error) {
+			markCreatedBeforeFailure(error, logicalId, resourceType, dbProxyName);
+			throw error;
 		}
-		if (!endpoint || !dbProxyArn) throw new ProvisioningError(`Timed out waiting for DBProxy ${dbProxyName} to become available (last status: ${status ?? "unknown"})`, resourceType, logicalId, dbProxyName);
 		return {
 			physicalId: dbProxyName,
 			attributes: definedAttributes({
@@ -23660,26 +24063,31 @@ var RDSDBProxyEndpointProvider = class {
 		let vpcId;
 		const deadline = Date.now() + POLL_TIMEOUT_MS;
 		let status;
-		while (Date.now() < deadline) {
-			try {
-				const ep = (await client.send(new DescribeDBProxyEndpointsCommand({ DBProxyEndpointName: dbProxyEndpointName }))).DBProxyEndpoints?.[0];
-				status = ep?.Status;
-				this.logger.debug(`DBProxyEndpoint ${dbProxyEndpointName} poll: status=${status ?? "not-yet-visible"}`);
-				if (status === "available") {
-					endpoint = ep?.Endpoint;
-					arn = ep?.DBProxyEndpointArn;
-					isDefault = ep?.IsDefault;
-					vpcId = ep?.VpcId;
-					break;
+		try {
+			while (Date.now() < deadline) {
+				try {
+					const ep = (await client.send(new DescribeDBProxyEndpointsCommand({ DBProxyEndpointName: dbProxyEndpointName }))).DBProxyEndpoints?.[0];
+					status = ep?.Status;
+					this.logger.debug(`DBProxyEndpoint ${dbProxyEndpointName} poll: status=${status ?? "not-yet-visible"}`);
+					if (status === "available") {
+						endpoint = ep?.Endpoint;
+						arn = ep?.DBProxyEndpointArn;
+						isDefault = ep?.IsDefault;
+						vpcId = ep?.VpcId;
+						break;
+					}
+					if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(`DBProxyEndpoint ${dbProxyEndpointName} entered terminal failure state: ${status}`, resourceType, logicalId, dbProxyEndpointName);
+				} catch (error) {
+					if (error instanceof DBProxyEndpointNotFoundFault || error instanceof DBProxyNotFoundFault) {} else if (error instanceof ProvisioningError) throw error;
+					else throw this.wrapError(error, "CREATE (poll)", resourceType, logicalId, dbProxyEndpointName);
 				}
-				if (status === "incompatible-network" || status === "insufficient-resource-limits") throw new ProvisioningError(`DBProxyEndpoint ${dbProxyEndpointName} entered terminal failure state: ${status}`, resourceType, logicalId, dbProxyEndpointName);
-			} catch (error) {
-				if (error instanceof DBProxyEndpointNotFoundFault || error instanceof DBProxyNotFoundFault) {} else if (error instanceof ProvisioningError) throw error;
-				else throw this.wrapError(error, "CREATE (poll)", resourceType, logicalId, dbProxyEndpointName);
+				await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
 			}
-			await new Promise((resolve) => setTimeout(resolve, POLL_INTERVAL_MS));
+			if (!endpoint || !arn) throw new ProvisioningError(`Timed out waiting for DBProxyEndpoint ${dbProxyEndpointName} to become available (last status: ${status ?? "unknown"})`, resourceType, logicalId, dbProxyEndpointName);
+		} catch (error) {
+			markCreatedBeforeFailure(error, logicalId, resourceType, dbProxyEndpointName);
+			throw error;
 		}
-		if (!endpoint || !arn) throw new ProvisioningError(`Timed out waiting for DBProxyEndpoint ${dbProxyEndpointName} to become available (last status: ${status ?? "unknown"})`, resourceType, logicalId, dbProxyEndpointName);
 		return {
 			physicalId: dbProxyEndpointName,
 			attributes: definedAttributes({
@@ -24004,7 +24412,11 @@ var RDSDBProxyTargetGroupProvider = class {
 				Tags: tags
 			}));
 		} catch (error) {
-			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (add tags)", resourceType, logicalId, void 0), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets);
+			throw await this.retireRegistrationAfterFailedCreate(this.wrapError(error, "CREATE (add tags)", resourceType, logicalId, void 0), dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, context?.maskSecrets, {
+				logicalId,
+				resourceType,
+				physicalId: targetGroupArn
+			});
 		}
 		return {
 			physicalId: targetGroupArn,
@@ -24036,8 +24448,10 @@ var RDSDBProxyTargetGroupProvider = class {
 		}
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId, "Tags", DBPROXY_TAGS_WHAT, DBPROXY_TAG_OPTIONS);
 		if (context?.expectedRegion) assertRegionMatch(await this.getClient().config.region(), context.expectedRegion, resourceType, logicalId, physicalId, "pre-update");
-		if (exemptedBySecretReference.length > 0) {
-			const fields = exemptedBySecretReference.join(" / ");
+		const replayCheck = exemptedBySecretReference.length === 0 && context?.replayingState === true;
+		if (exemptedBySecretReference.length > 0 || replayCheck) {
+			const fields = replayCheck ? "DBProxyName / TargetGroupName" : exemptedBySecretReference.join(" / ");
+			const provenance = replayCheck ? "replayed by a rollback, which resolves any secret they come from again" : "secret-derived";
 			const base = context?.maskSecrets ?? ((t) => t);
 			const maskNames = (text) => {
 				let out = text;
@@ -24060,11 +24474,11 @@ var RDSDBProxyTargetGroupProvider = class {
 			}
 			if (lookupFailure !== void 0) {
 				const failureClass = lookupFailure instanceof Error && lookupFailure.name !== "" ? lookupFailure.name : "an unreadable failure";
-				const refusal = new ProvisioningError(`${fields} of AWS::RDS::DBProxyTargetGroup ${logicalId} is secret-derived, and whether the value its secret resolves to still addresses the recorded target group could not be confirmed (${maskNames(failureClass)}) — re-run once the lookup can succeed`, resourceType, logicalId, physicalId, lookupFailure instanceof Error ? lookupFailure : void 0);
+				const refusal = new ProvisioningError(`${fields} of AWS::RDS::DBProxyTargetGroup ${logicalId} is ${provenance}, and whether ${replayCheck ? "the names still address" : "the value its secret resolves to still addresses"} the recorded target group could not be confirmed (${maskNames(failureClass)}) — re-run once the lookup can succeed`, resourceType, logicalId, physicalId, lookupFailure instanceof Error ? lookupFailure : void 0);
 				markRedactedCause(refusal);
 				throw refusal;
 			}
-			if (liveArn !== physicalId) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `${fields} is immutable on AWS::RDS::DBProxyTargetGroup, and the value its secret now resolves to ${liveArn === void 0 ? "addresses no target group" : "addresses a different target group"} (the secret may have been rotated) — destroy + redeploy to change it`);
+			if (liveArn !== physicalId) throw markNonRetryable(new ProvisioningError(`${fields} of AWS::RDS::DBProxyTargetGroup ${logicalId} is ${provenance}, and ${replayCheck ? "the names now address" : "the value its secret now resolves to addresses"} ${liveArn === void 0 ? "no target group" : "a different target group"} (${replayCheck ? "the proxy, or a secret its name comes from, may have changed" : "the secret may have been rotated"}). cdkd does not move registered targets to another proxy, with or without --replace: ${replayCheck ? "make the names address the proxy that holds this target group again" : "restore the secret's value to the proxy that holds this target group"}`, resourceType, logicalId, physicalId));
 		}
 		const next = readTargetLists({
 			DBClusterIdentifiers: properties["DBClusterIdentifiers"],
@@ -24298,7 +24712,7 @@ var RDSDBProxyTargetGroupProvider = class {
 		}
 		return result;
 	}
-	async retireRegistrationAfterFailedCreate(original, dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, maskSecrets) {
+	async retireRegistrationAfterFailedCreate(original, dbProxyName, targetGroupName, dbClusterIdentifiers, dbInstanceIdentifiers, maskSecrets, leftBehind) {
 		const clusters = dbClusterIdentifiers?.length ? dbClusterIdentifiers : void 0;
 		const instances = dbInstanceIdentifiers?.length ? dbInstanceIdentifiers : void 0;
 		if (!clusters && !instances) return original;
@@ -24322,6 +24736,7 @@ var RDSDBProxyTargetGroupProvider = class {
 				for (const id of instances) targets = aws`${targets} ${id}`;
 			}
 			original.message += ` The targets this create registered are still registered and could not be deregistered (${describeAwsFailure(cleanupError).detail}). Manual cleanup: ` + aws`aws rds deregister-db-proxy-targets --db-proxy-name ${dbProxyName} --target-group-name ${targetGroupName}${targets}`.render();
+			if (leftBehind) markCreatedBeforeFailure(original, leftBehind.logicalId, leftBehind.resourceType, leftBehind.physicalId);
 			return original;
 		}
 	}
@@ -24508,8 +24923,9 @@ var DocDBProvider = class {
 			maxLength: 63,
 			lowercase: true
 		});
+		let clusterCreated = false;
 		try {
-			if (!(await this.getClient().send(new CreateDBClusterCommand$1({
+			const response = await this.getClient().send(new CreateDBClusterCommand$1({
 				DBClusterIdentifier: dbClusterIdentifier,
 				Engine: "docdb",
 				EngineVersion: properties["EngineVersion"],
@@ -24526,7 +24942,9 @@ var DocDBProvider = class {
 				DBClusterParameterGroupName: properties["DBClusterParameterGroupName"],
 				DeletionProtection: properties["DeletionProtection"],
 				...tags.length > 0 && { Tags: tags }
-			}))).DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
+			}));
+			clusterCreated = true;
+			if (!response.DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created DocDB DBCluster ${logicalId}: ${dbClusterIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(dbClusterIdentifier);
 			return {
@@ -24534,9 +24952,9 @@ var DocDBProvider = class {
 				attributes: clusterAttributes(await this.describeDBCluster(dbClusterIdentifier))
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create DocDB DBCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbClusterIdentifier, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DocDB DBCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbClusterIdentifier, error instanceof Error ? error : void 0);
+			if (clusterCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbClusterIdentifier);
+			throw thrown;
 		}
 	}
 	async updateDBCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -24651,8 +25069,9 @@ var DocDBProvider = class {
 			maxLength: 63,
 			lowercase: true
 		});
+		let instanceCreated = false;
 		try {
-			if (!(await this.getClient().send(new CreateDBInstanceCommand$1({
+			const response = await this.getClient().send(new CreateDBInstanceCommand$1({
 				DBInstanceIdentifier: dbInstanceIdentifier,
 				DBInstanceClass: properties["DBInstanceClass"],
 				Engine: "docdb",
@@ -24661,7 +25080,9 @@ var DocDBProvider = class {
 				PreferredMaintenanceWindow: properties["PreferredMaintenanceWindow"],
 				AutoMinorVersionUpgrade: properties["AutoMinorVersionUpgrade"],
 				...tags.length > 0 && { Tags: tags }
-			}))).DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
+			}));
+			instanceCreated = true;
+			if (!response.DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created DocDB DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(dbInstanceIdentifier);
 			return {
@@ -24669,9 +25090,9 @@ var DocDBProvider = class {
 				attributes: instanceAttributes(await this.describeDBInstance(dbInstanceIdentifier))
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create DocDB DBInstance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbInstanceIdentifier, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DocDB DBInstance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbInstanceIdentifier, error instanceof Error ? error : void 0);
+			if (instanceCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbInstanceIdentifier);
+			throw thrown;
 		}
 	}
 	async updateDBInstance(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -25143,6 +25564,8 @@ var Route53Provider = class {
 		const name = properties["Name"];
 		if (!name) throw new ProvisioningError(`Name is required for hosted zone ${logicalId}`, resourceType, logicalId);
 		let zoneCreated = false;
+		let createdZoneId;
+		let zoneRolledBack = false;
 		try {
 			const hostedZoneConfig = properties["HostedZoneConfig"];
 			const createComment = readConfigString(hostedZoneConfig, "Comment", "", "AWS::Route53::HostedZone HostedZoneConfig");
@@ -25169,6 +25592,7 @@ var Route53Provider = class {
 			const hostedZone = response.HostedZone;
 			if (!hostedZone?.Id) throw new Error("CreateHostedZone did not return HostedZone.Id");
 			const zoneId = hostedZone.Id.replace("/hostedzone/", "");
+			createdZoneId = zoneId;
 			if (vpcs && vpcs.length > 1) for (let i = 1; i < vpcs.length; i++) {
 				const additionalVpc = vpcs[i];
 				this.logger.debug(`Associating additional VPC ${String(additionalVpc["VPCId"])} with hosted zone ${zoneId}`);
@@ -25192,6 +25616,7 @@ var Route53Provider = class {
 				try {
 					await this.deleteQueryLoggingConfigForZone(zoneId, logicalId);
 					await this.getClient().send(new DeleteHostedZoneCommand({ Id: zoneId }));
+					zoneRolledBack = true;
 					callerReferenceToken.release();
 				} catch (deleteError) {
 					this.logger.warn(`Best-effort rollback DeleteHostedZone for ${zoneId} also failed: ${describeAwsFailure(deleteError).detail} — operator may need to clean up the orphan zone`);
@@ -25211,9 +25636,9 @@ var Route53Provider = class {
 			};
 		} catch (error) {
 			if (zoneCreated) markAuxiliaryFailure(error, logicalId);
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create hosted zone ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			if (createdZoneId !== void 0 && !zoneRolledBack) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdZoneId);
+			throw thrown;
 		}
 	}
 	async createOrAdoptHostedZone(input) {
@@ -26853,17 +27278,21 @@ var CognitoUserPoolProvider = class {
 				...effectiveProperties !== properties ? { effectiveProperties } : {}
 			};
 		} catch (error) {
+			let poolLeftBehind = false;
 			if (createdUserPoolId) {
 				markAuxiliaryFailure(error, logicalId);
 				try {
 					await this.getClient().send(new DeleteUserPoolCommand({ UserPoolId: createdUserPoolId }));
 					this.logger.debug(`Rolled back partially-created Cognito User Pool ${createdUserPoolId}`);
 				} catch (rollbackError) {
+					poolLeftBehind = true;
 					this.logger.warn(`Failed to roll back partially-created Cognito User Pool ${createdUserPoolId}: ${describeAwsFailure(rollbackError).detail}`);
 				}
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, poolName, cause);
+			const thrown = new ProvisioningError(`Failed to create Cognito User Pool ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, poolName, cause);
+			if (poolLeftBehind && createdUserPoolId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdUserPoolId);
+			throw thrown;
 		}
 	}
 	async regionArg(aws) {
@@ -27584,6 +28013,7 @@ var ElastiCacheProvider = class {
 			maxLength: 40,
 			lowercase: true
 		});
+		let clusterCreated = false;
 		try {
 			await this.getClient().send(new CreateCacheClusterCommand({
 				CacheClusterId: cacheClusterId,
@@ -27610,6 +28040,7 @@ var ElastiCacheProvider = class {
 				TransitEncryptionEnabled: properties["TransitEncryptionEnabled"],
 				...tags.length > 0 && { Tags: tags }
 			}));
+			clusterCreated = true;
 			this.logger.debug(`Successfully created CacheCluster ${logicalId}: ${cacheClusterId}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(cacheClusterId);
 			const described = await this.describeCacheCluster(cacheClusterId);
@@ -27629,9 +28060,9 @@ var ElastiCacheProvider = class {
 				attributes
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CacheCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, cacheClusterId, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create CacheCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, cacheClusterId, error instanceof Error ? error : void 0);
+			if (clusterCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, cacheClusterId);
+			throw thrown;
 		}
 	}
 	async updateCacheCluster(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -28036,6 +28467,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		if (!name) throw new ProvisioningError(`Name is required for PrivateDnsNamespace ${logicalId}`, resourceType, logicalId);
 		if (!vpc) throw new ProvisioningError(`Vpc is required for PrivateDnsNamespace ${logicalId}`, resourceType, logicalId);
 		const inputProperties = this.extractSoaTtlProperties(properties);
+		let createdNamespaceId;
 		try {
 			const operationId = (await client.send(new CreatePrivateDnsNamespaceCommand({
 				Name: name,
@@ -28046,6 +28478,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			}))).OperationId;
 			if (!operationId) throw new Error("CreatePrivateDnsNamespace did not return OperationId");
 			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
+			if (namespaceId !== operationId) createdNamespaceId = namespaceId;
 			const arn = await this.buildNamespaceArn(namespaceId);
 			this.logger.debug(`Successfully created private DNS namespace ${logicalId}: ${namespaceId}`);
 			return {
@@ -28056,9 +28489,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				}
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create private DNS namespace ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create private DNS namespace ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdNamespaceId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdNamespaceId);
+			throw thrown;
 		}
 	}
 	async updateNamespace(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
@@ -28131,6 +28565,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		const name = properties["Name"];
 		const description = properties["Description"];
 		if (!name) throw new ProvisioningError(`Name is required for HttpNamespace ${logicalId}`, resourceType, logicalId);
+		let createdNamespaceId;
 		try {
 			const operationId = (await client.send(new CreateHttpNamespaceCommand({
 				Name: name,
@@ -28139,6 +28574,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			}))).OperationId;
 			if (!operationId) throw new Error("CreateHttpNamespace did not return OperationId");
 			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
+			if (namespaceId !== operationId) createdNamespaceId = namespaceId;
 			const arn = await this.resolveNamespaceArn(namespaceId);
 			this.logger.debug(`Successfully created HTTP namespace ${logicalId}: ${namespaceId}`);
 			return {
@@ -28149,9 +28585,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				}
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create HTTP namespace ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create HTTP namespace ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdNamespaceId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdNamespaceId);
+			throw thrown;
 		}
 	}
 	async updateHttpNamespace(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
@@ -28188,6 +28625,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		const description = properties["Description"];
 		if (!name) throw new ProvisioningError(`Name is required for PublicDnsNamespace ${logicalId}`, resourceType, logicalId);
 		const inputProperties = this.extractSoaTtlProperties(properties);
+		let createdNamespaceId;
 		try {
 			const operationId = (await client.send(new CreatePublicDnsNamespaceCommand({
 				Name: name,
@@ -28197,6 +28635,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			}))).OperationId;
 			if (!operationId) throw new Error("CreatePublicDnsNamespace did not return OperationId");
 			const namespaceId = await this.pollOperation(operationId, logicalId, resourceType, maskSecrets);
+			if (namespaceId !== operationId) createdNamespaceId = namespaceId;
 			let arn;
 			let hostedZoneId;
 			try {
@@ -28217,9 +28656,10 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 				}
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create public DNS namespace ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create public DNS namespace ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdNamespaceId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdNamespaceId);
+			throw thrown;
 		}
 	}
 	async updatePublicDnsNamespace(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
@@ -28263,6 +28703,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 		const healthCheckConfig = properties["HealthCheckConfig"];
 		const type = properties["Type"];
 		if (!name) throw new ProvisioningError(`Name is required for ServiceDiscovery Service ${logicalId}`, resourceType, logicalId);
+		let leftBehindServiceId;
 		try {
 			const service = (await client.send(new CreateServiceCommand$1({
 				Name: name,
@@ -28276,6 +28717,7 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			}))).Service;
 			if (!service || !service.Id) throw new Error("CreateService did not return Service ID");
 			const serviceId = service.Id;
+			leftBehindServiceId = serviceId;
 			this.logger.debug(`Successfully created service discovery service ${logicalId}: ${serviceId}`);
 			try {
 				const attrs = this.normalizeServiceAttributes(properties["ServiceAttributes"]);
@@ -28296,12 +28738,13 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 					this.logger.debug(`Applied ${Object.keys(attrs).length} ServiceAttribute(s) for ${logicalId}`);
 				}
 			} catch (innerError) {
-				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating ServiceDiscovery Service ${logicalId} (${serviceId}) but before its ServiceAttributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy on a name collision AND block deletion of its namespace with ResourceInUse. If that delete does not complete, remove it manually: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`));
+				if (isInterruptedWaitError(innerError)) this.logger.warn(maskerOrIdentity(maskSecrets)(`Interrupted after creating ServiceDiscovery Service ${logicalId} (${serviceId}) but before its ServiceAttributes were applied. Nothing in cdkd state refers to it, so cdkd is deleting it now — left behind it would fail the next deploy on a name collision AND block deletion of its namespace with ResourceInUse. If that delete fails, on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise remove it yourself: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`));
 				try {
 					await client.send(new DeleteServiceCommand$1({ Id: serviceId }));
+					leftBehindServiceId = void 0;
 					this.logger.debug(`Cleaned up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure`);
 				} catch (cleanupError) {
-					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${this.maskErrorMessage(cleanupError, maskSecrets)}. Manual deletion may be required before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`);
+					this.logger.warn(`Failed to clean up partially-created ServiceDiscovery Service ${logicalId} (${serviceId}) after ServiceAttributes wiring failure: ${this.maskErrorMessage(cleanupError, maskSecrets)}. On a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself before the next deploy: ${pasteableAwsCommand(maskSecrets)`aws servicediscovery delete-service --id ${serviceId}`.render()}`);
 				}
 				throw markAuxiliaryFailure(innerError, logicalId);
 			}
@@ -28315,7 +28758,9 @@ var ServiceDiscoveryProvider = class ServiceDiscoveryProvider {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = this.wrapMaskedError(maskerOrIdentity(maskSecrets), error, (text) => new ProvisioningError(`Failed to create service discovery service ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (leftBehindServiceId) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftBehindServiceId);
+			throw thrown;
 		}
 	}
 	async updateService(logicalId, physicalId, resourceType, properties, previousProperties, maskSecrets) {
@@ -29625,17 +30070,21 @@ var AppSyncProvider = class {
 				...envRecord && { effectiveProperties: this.withEnvironmentVariablesRecord(properties, envRecord) }
 			};
 		} catch (error) {
+			let apiLeftBehind = false;
 			if (createdApiId) {
 				markAuxiliaryFailure(error, logicalId);
 				try {
 					await this.getClient().send(new DeleteGraphqlApiCommand({ apiId: createdApiId }));
 					this.logger.debug(`Rolled back partially-created GraphQL API ${createdApiId}`);
 				} catch (rollbackError) {
+					apiLeftBehind = true;
 					this.logger.warn(`Failed to roll back partially-created GraphQL API ${createdApiId}: ${describeAwsFailure(rollbackError).detail}`);
 				}
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create GraphQL API ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			if (apiLeftBehind && createdApiId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdApiId);
+			throw thrown;
 		}
 	}
 	async regionArg(aws) {
@@ -32558,10 +33007,12 @@ var KMSProvider = class {
 				markAuxiliaryFailure(error, logicalId);
 				const aws = pasteableAwsCommand();
 				const region = await this.regionArg(aws);
-				this.logger.warn(safeMsg`KMS key ${createdKeyId} was created for ${logicalId}, but a follow-up call failed. A retry of this create reuses that key instead of creating another, so do not delete it while the deploy is still retrying. Only if the deploy then FAILS is the key left unrecorded in cdkd state; delete it then with: ${aws`aws kms schedule-key-deletion --key-id ${createdKeyId}${region} --pending-window-in-days 7`.render()}`);
+				this.logger.warn(safeMsg`KMS key ${createdKeyId} was created for ${logicalId}, but a follow-up call failed. A retry of this create reuses that key instead of creating another, so do not delete it while the deploy is still retrying. If the deploy then FAILS on a first-time create, its rollback journal records the key for \`cdkd rollback --revert-failed\` to schedule its deletion; otherwise schedule it yourself with: ${aws`aws kms schedule-key-deletion --key-id ${createdKeyId}${region} --pending-window-in-days 7`.render()}`);
 			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create KMS Key ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			if (createdKeyId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdKeyId);
+			throw thrown;
 		}
 	}
 	async regionArg(aws) {
@@ -33123,6 +33574,7 @@ var BudgetsBudgetProvider = class {
 			const accountId = await this.resolveAccountId();
 			const notifications = this.toSdkNotificationsWithSubscribers(lists.NotificationsWithSubscribers);
 			const resourceTags = this.toSdkResourceTags(lists.ResourceTags);
+			const arn = await this.budgetArn(accountId, name);
 			await this.getClient().send(new CreateBudgetCommand({
 				AccountId: accountId,
 				Budget: this.toSdkBudget(properties["Budget"], name, logicalId, resourceType, mask),
@@ -33132,7 +33584,7 @@ var BudgetsBudgetProvider = class {
 			this.logger.debug(`Successfully created budget ${logicalId}: ${name}`);
 			return {
 				physicalId: name,
-				attributes: { Arn: await this.budgetArn(accountId, name) }
+				attributes: { Arn: arn }
 			};
 		} catch (error) {
 			if (error instanceof ProvisioningError) throw error;
@@ -33498,6 +33950,30 @@ function readMaxRecordSize(value, mask) {
 		reason: `AWS::Kinesis::Stream MaxRecordSizeInKiB must be a number, got ${JSON.stringify(maskDeep(value, mask))}`
 	};
 }
+function readRetentionHours(value, mask) {
+	if (value == null) return { kind: "absent" };
+	if (typeof value === "number" && Number.isFinite(value)) return {
+		kind: "usable",
+		hours: value
+	};
+	if (typeof value === "string" && value.trim() !== "" && Number.isFinite(Number(value))) return {
+		kind: "usable",
+		hours: Number(value)
+	};
+	return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream RetentionPeriodHours must be a number, got ${JSON.stringify(maskDeep(value, mask))}`
+	};
+}
+function readEncryptionKeyId(value, mask) {
+	if (!isKmsEncryption(value)) return { kind: "absent" };
+	const keyId = value?.["KeyId"];
+	if (typeof keyId === "string" && keyId.trim() !== "") return { kind: "usable" };
+	return {
+		kind: "unusable",
+		reason: `AWS::Kinesis::Stream StreamEncryption selects KMS but KeyId is not a non-empty string, got ${JSON.stringify(maskDeep(keyId, mask)) ?? "undefined"}`
+	};
+}
 function comparableRecordSize(value, mask) {
 	const read = readMaxRecordSize(value, mask);
 	return read.kind === "usable" ? read.size : void 0;
@@ -33541,6 +34017,13 @@ var KinesisStreamProvider = class {
 			if (context?.replayingState === true) warn(`${maxRecordRead.reason}. Replaying a state record, so ${streamName} is created with AWS's default maximum record size rather than refusing the restore`);
 			else throw new ProvisioningError(maxRecordRead.reason, resourceType, logicalId, streamName);
 		}
+		const retentionRead = readRetentionHours(properties["RetentionPeriodHours"], mask);
+		if (retentionRead.kind === "unusable") {
+			if (context?.replayingState !== true) throw new ProvisioningError(retentionRead.reason, resourceType, logicalId, streamName);
+			warn(`${retentionRead.reason}. Replaying a state record, so the retention period is left at AWS's default on ${streamName} rather than refusing the restore`);
+		}
+		const encryptionRead = readEncryptionKeyId(properties["StreamEncryption"], mask);
+		if (encryptionRead.kind === "unusable") throw new ProvisioningError(encryptionRead.reason, resourceType, logicalId, streamName);
 		let streamCreated = false;
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
@@ -33562,7 +34045,7 @@ var KinesisStreamProvider = class {
 				StreamName: streamName,
 				Tags: tags
 			}));
-			const retentionPeriodHours = properties["RetentionPeriodHours"];
+			const retentionPeriodHours = retentionRead.kind === "usable" ? retentionRead.hours : void 0;
 			if (retentionPeriodHours !== void 0 && retentionPeriodHours !== 24) {
 				this.logger.debug(`Setting retention period to ${retentionPeriodHours} hours for ${streamName}`);
 				if (retentionPeriodHours > 24) await this.getClient().send(new IncreaseStreamRetentionPeriodCommand({
@@ -33604,9 +34087,9 @@ var KinesisStreamProvider = class {
 			};
 		} catch (error) {
 			if (streamCreated) markAuxiliaryFailure(error, logicalId);
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Kinesis stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, streamName, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create Kinesis stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, streamName, error instanceof Error ? error : void 0);
+			if (streamCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, streamName);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -33614,6 +34097,10 @@ var KinesisStreamProvider = class {
 		const warn = (message) => this.logger.warn(mask(message));
 		this.logger.debug(`Updating Kinesis stream ${logicalId}: ${physicalId}`);
 		refuseMalformedDesiredTags(properties["Tags"], resourceType, logicalId, physicalId);
+		const desiredRetention = readRetentionHours(properties["RetentionPeriodHours"], mask);
+		if (desiredRetention.kind === "unusable" && context?.replayingState !== true) throw new ProvisioningError(desiredRetention.reason, resourceType, logicalId, physicalId);
+		if (desiredRetention.kind === "unusable") warn(`${desiredRetention.reason}. Replaying a state record, so the retention period of ${physicalId} is left as it is rather than refusing the restore`);
+		const previousRetention = readRetentionHours(previousProperties["RetentionPeriodHours"], mask);
 		try {
 			const streamModeDetails = properties["StreamModeDetails"];
 			const streamMode = readConfigString(streamModeDetails, "StreamMode", "PROVISIONED", "AWS::Kinesis::Stream StreamModeDetails");
@@ -33641,11 +34128,9 @@ var KinesisStreamProvider = class {
 					await this.waitForStreamActive(physicalId);
 				}
 			}
-			const newRetention = properties["RetentionPeriodHours"];
-			const oldRetention = previousProperties["RetentionPeriodHours"];
-			const effectiveNewRetention = newRetention ?? 24;
-			const effectiveOldRetention = oldRetention ?? 24;
-			if (effectiveNewRetention !== effectiveOldRetention) {
+			const effectiveNewRetention = desiredRetention.kind === "usable" ? desiredRetention.hours ?? 24 : 24;
+			const effectiveOldRetention = previousRetention.kind === "usable" ? previousRetention.hours ?? 24 : 24;
+			if (desiredRetention.kind !== "unusable" && effectiveNewRetention !== effectiveOldRetention) {
 				this.logger.debug(`Updating retention period for ${physicalId}: from ${effectiveOldRetention} to ${effectiveNewRetention}`);
 				if (effectiveNewRetention > effectiveOldRetention) await this.getClient().send(new IncreaseStreamRetentionPeriodCommand({
 					StreamName: physicalId,
@@ -33920,6 +34405,7 @@ var KinesisStreamConsumerProvider = class {
 		if (!streamArn) throw new ProvisioningError("AWS::Kinesis::StreamConsumer requires StreamARN", resourceType, logicalId);
 		this.logger.debug(`Registering Kinesis stream consumer ${logicalId}: ${consumerName}`);
 		const tagMap = tagListToMap(tagList);
+		let createdArn;
 		try {
 			const consumer = (await this.getClient().send(new RegisterStreamConsumerCommand({
 				StreamARN: streamArn,
@@ -33928,6 +34414,7 @@ var KinesisStreamConsumerProvider = class {
 			}))).Consumer;
 			if (!consumer?.ConsumerARN || !consumer.ConsumerName) throw new ProvisioningError("RegisterStreamConsumer did not return ConsumerARN/ConsumerName", resourceType, logicalId);
 			const consumerArn = consumer.ConsumerARN;
+			createdArn = consumerArn;
 			await this.waitForConsumerActive(consumerArn);
 			this.logger.debug(`Successfully registered Kinesis stream consumer ${logicalId}`);
 			return {
@@ -33942,9 +34429,9 @@ var KinesisStreamConsumerProvider = class {
 				}
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to register Kinesis stream consumer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, consumerName, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to register Kinesis stream consumer ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, consumerName, error instanceof Error ? error : void 0);
+			if (createdArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdArn);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -34088,6 +34575,33 @@ function tagListToMap(tags) {
 
 //#endregion
 //#region src/provisioning/providers/scheduler-schedule-provider.ts
+const RECORDED_CREATION_DATE_KEY = "cdkd:CreationDate";
+function recordedCreationDate(attributes) {
+	const value = attributes?.[RECORDED_CREATION_DATE_KEY];
+	if (typeof value !== "string" || value === "") return void 0;
+	const parsed = new Date(value);
+	return !Number.isNaN(parsed.getTime()) && parsed.toISOString() === value ? value : void 0;
+}
+const RECORDED_ONLY = maskerOrIdentity(void 0);
+function usableRecorded(value) {
+	return typeof value === "string" && value !== "" && !isSecretDerivedValue(value, RECORDED_ONLY) ? value : void 0;
+}
+function recordedTarget(properties) {
+	const target = properties?.["Target"];
+	const fields = typeof target === "object" && target !== null && !Array.isArray(target) ? target : {};
+	return {
+		targetArn: usableRecorded(fields["Arn"]),
+		roleArn: usableRecorded(fields["RoleArn"])
+	};
+}
+function sameRecordedDate(live, recorded) {
+	return live.creation !== void 0 && live.creation === recorded.creation;
+}
+function sameRecordedIdentity(live, recorded) {
+	return sameRecordedDate(live, recorded) && (recorded.targetArn === void 0 || live.targetArn === recorded.targetArn) && (recorded.roleArn === void 0 || live.roleArn === recorded.roleArn);
+}
+const NO_REGION_FOR_SCHEDULE_SEARCH_SKIP_REASON = "secret-derived group and no recorded region — no delete issued";
+const AMBIGUOUS_SCHEDULE_SKIP_REASON = "schedule matches the recorded date but not its target — no delete issued";
 function groupShown(group) {
 	return group === "***" ? group : plainOrDescribed(group, "group name");
 }
@@ -34200,20 +34714,97 @@ var SchedulerScheduleProvider = class {
 				...groupName && { GroupName: groupName },
 				...this.toSdkFields(properties)
 			}));
+			const creationDate = await this.creationDateBestEffort(logicalId, name, groupName);
 			return {
 				physicalId: name,
-				attributes: response.ScheduleArn ? { Arn: response.ScheduleArn } : {}
+				attributes: {
+					...response.ScheduleArn && { Arn: response.ScheduleArn },
+					...creationDate !== void 0 && { ["cdkd:CreationDate"]: creationDate }
+				}
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
 			throw new ProvisioningError(`Failed to create Schedule ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, void 0, cause);
 		}
 	}
+	async readIdentity(name, groupName) {
+		const response = await this.getClient().send(new GetScheduleCommand({
+			Name: name,
+			...groupName && { GroupName: groupName }
+		}));
+		const date = response.CreationDate;
+		const text = (value) => typeof value === "string" && value !== "" ? value : void 0;
+		return {
+			creation: date instanceof Date && !Number.isNaN(date.getTime()) ? date.toISOString() : void 0,
+			targetArn: text(response.Target?.Arn),
+			roleArn: text(response.Target?.RoleArn)
+		};
+	}
+	sleep(ms) {
+		return new Promise((resolve) => setTimeout(resolve, ms));
+	}
+	readBackDelaysMs = [500, 1e3];
+	async creationDateBestEffort(logicalId, name, groupName) {
+		for (let attempt = 0;; attempt++) try {
+			return (await this.readIdentity(name, groupName)).creation;
+		} catch (error) {
+			const transient = error instanceof ResourceNotFoundException$11 || isThrottlingError(error);
+			const delay = this.readBackDelaysMs[attempt];
+			if (transient && delay !== void 0) {
+				await this.sleep(delay);
+				continue;
+			}
+			const failureClass = error instanceof Error && error.name !== "" ? error.name : "an unreadable failure";
+			this.logger.debug(safeMsg`Could not read the creation date of Schedule ${logicalId} (${failureClass}); none is recorded`);
+			return;
+		}
+	}
+	wrapUnconfirmedGroupError(logicalId, physicalId, resourceType, error, mask) {
+		const failureClass = error instanceof Error && error.name !== "" ? error.name : "an unreadable failure";
+		return markRedactedCause(new ProvisioningError(`Whether the group the GroupName of Schedule ${logicalId} resolves to still holds this schedule could not be confirmed (${mask(failureClass)}) — re-run once the lookup can succeed`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0));
+	}
+	refuseUnconfirmed(logicalId, physicalId, resourceType, finding, secretDerived, remedy) {
+		throw markNonRetryable(new ProvisioningError(`${secretDerived ? `GroupName of Schedule ${logicalId} is secret-derived, and the group its secret now resolves to` : `The group of Schedule ${logicalId}`} ${finding}${secretDerived ? " (the secret may have been rotated)" : ""}, so nothing is written to it, with or without --replace: ${remedy}`, resourceType, logicalId, physicalId));
+	}
+	async confirmRecordedSchedule(logicalId, physicalId, resourceType, groupName, recorded, mask) {
+		if (recorded.creation === void 0) return "undated";
+		let live;
+		try {
+			live = await this.readIdentity(physicalId, groupName);
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$11) return "absent";
+			throw this.wrapUnconfirmedGroupError(logicalId, physicalId, resourceType, error, mask);
+		}
+		if (sameRecordedDate(live, recorded) && !sameRecordedIdentity(live, recorded)) this.refuseUnconfirmed(logicalId, physicalId, resourceType, "holds a schedule of this name that carries the recorded creation date but not the recorded target or role (edited outside cdkd?)", false, "restore them, or drop the record with `cdkd orphan <construct path>` and deploy again");
+		if (!sameRecordedIdentity(live, recorded)) this.refuseUnconfirmed(logicalId, physicalId, resourceType, "holds a different schedule of this name (its creation date is not the one cdkd recorded)", true, "restore the secret's value to the schedule's group");
+		return "confirmed";
+	}
+	referenceRepointed(desiredGroup, recordedGroup) {
+		const bag = getCurrentResourceSecrets();
+		if (bag === void 0 || typeof desiredGroup !== "string") return false;
+		if (typeof recordedGroup !== "string" || !recordedGroup.includes("{{resolve:")) return false;
+		return redactSecretsForState(desiredGroup, bag) !== recordedGroup;
+	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
 		const groupName = this.groupNameOf(properties);
 		const previousGroupName = this.groupNameOf(previousProperties);
 		const mask = maskerOrIdentity(context?.maskSecrets);
-		if (groupName !== previousGroupName) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `GroupName addresses the schedule (from ${groupShown(mask(previousGroupName ?? "default"))} to ${groupShown(mask(groupName ?? "default"))}); re-run with \`cdkd deploy --replace\` to recreate it in the new group (--replace is a boolean flag and takes no resource id; it applies to every resource in the run whose in-place update is refused)`);
+		const recorded = {
+			creation: recordedCreationDate(context?.recordedAttributes),
+			...recordedTarget(previousProperties)
+		};
+		const replaying = context?.replayingState === true;
+		const desiredSecretDerived = isSecretDerivedValue(properties["GroupName"], mask);
+		let confirmedMove = false;
+		if (groupName !== previousGroupName && isSecretDerivedValue(previousProperties["GroupName"], RECORDED_ONLY) && desiredSecretDerived) {
+			const verdict = await this.confirmRecordedSchedule(logicalId, physicalId, resourceType, groupName, recorded, mask);
+			if (verdict === "undated") this.refuseUnconfirmed(logicalId, physicalId, resourceType, "cannot be confirmed to hold this schedule: its state record predates the creation date cdkd now records", true, "delete the schedule by hand (`aws scheduler delete-schedule`), drop its record with `cdkd orphan <construct path>`, and deploy again, which records the date");
+			if (verdict === "absent" && !this.referenceRepointed(groupName, previousProperties["GroupName"])) this.refuseUnconfirmed(logicalId, physicalId, resourceType, "holds no schedule of this name", true, "restore the secret's value to the schedule's group; if the schedule was deleted outside cdkd, drop its record with `cdkd orphan <construct path>` and deploy again");
+			confirmedMove = verdict === "confirmed";
+		} else if (groupName === previousGroupName && replaying && recorded.creation !== void 0 && desiredSecretDerived) {
+			if (await this.confirmRecordedSchedule(logicalId, physicalId, resourceType, groupName, recorded, mask) !== "confirmed") this.refuseUnconfirmed(logicalId, physicalId, resourceType, "holds no schedule of this name", true, "restore the secret's value to the schedule's group, then re-run the rollback");
+		}
+		if (groupName !== previousGroupName && !confirmedMove) throw new ResourceUpdateNotSupportedError(resourceType, logicalId, `GroupName addresses the schedule (from ${groupShown(mask(previousGroupName ?? "default"))} to ${groupShown(mask(groupName ?? "default"))}); re-run with \`cdkd deploy --replace\` to recreate it in the new group (--replace is a boolean flag and takes no resource id; it applies to every resource in the run whose in-place update is refused)`);
 		this.logger.debug(mask(`Updating Schedule ${logicalId}: ${mask(physicalId)}${groupName ? ` (group: ${mask(groupName)})` : ""}`));
 		try {
 			const input = {
@@ -34222,10 +34813,14 @@ var SchedulerScheduleProvider = class {
 				...this.toSdkFields(properties)
 			};
 			const response = await this.getClient().send(new UpdateScheduleCommand(input));
+			const creationDate = replaying || desiredSecretDerived ? recorded.creation : await this.creationDateBestEffort(logicalId, physicalId, groupName) ?? recorded.creation;
 			return {
 				physicalId,
 				wasReplaced: false,
-				attributes: response.ScheduleArn ? { Arn: response.ScheduleArn } : {}
+				attributes: {
+					...response.ScheduleArn && { Arn: response.ScheduleArn },
+					...creationDate !== void 0 && { ["cdkd:CreationDate"]: creationDate }
+				}
 			};
 		} catch (error) {
 			if (error instanceof ResourceUpdateNotSupportedError) throw error;
@@ -34233,8 +34828,89 @@ var SchedulerScheduleProvider = class {
 			throw new ProvisioningError(`Failed to update Schedule ${logicalId}: ${cause?.message ?? String(error)}`, resourceType, logicalId, physicalId, cause);
 		}
 	}
+	async deleteByRecordedIdentity(logicalId, physicalId, resourceType, recorded, context) {
+		if (!context?.expectedRegion) {
+			this.logger.warn(safeMsg`Schedule ${logicalId} is recorded with a secret-derived GroupName and no stack region, so cdkd cannot scope the search for it; skipping deletion and keeping its state record. Delete the schedule by hand, then drop the record with 'cdkd orphan'.`);
+			return {
+				outcome: "skipped",
+				reason: NO_REGION_FOR_SCHEDULE_SEARCH_SKIP_REASON
+			};
+		}
+		assertRegionMatch(await this.getClient().config.region(), context.expectedRegion, resourceType, logicalId, physicalId);
+		const wrapDeleteError = (step, error) => {
+			const failureClass = error instanceof Error && error.name !== "" ? error.name : "an unreadable failure";
+			return markRedactedCause(new ProvisioningError(`Failed to delete Schedule ${logicalId}: its recorded GroupName is secret-derived, and ${step} failed (${failureClass})`, resourceType, logicalId, physicalId, error instanceof Error ? error : void 0));
+		};
+		const findMatches = async () => {
+			const groups = [];
+			try {
+				let nextToken;
+				do {
+					const page = await this.getClient().send(new ListSchedulesCommand({
+						NamePrefix: physicalId,
+						...nextToken !== void 0 && { NextToken: nextToken }
+					}));
+					for (const schedule of page.Schedules ?? []) if (schedule.Name === physicalId && typeof schedule.GroupName === "string") groups.push(schedule.GroupName);
+					nextToken = page.NextToken;
+				} while (nextToken !== void 0 && nextToken !== "");
+			} catch (error) {
+				throw wrapDeleteError("listing the schedules of its name", error);
+			}
+			const matches = [];
+			let datedOnly = 0;
+			for (const group of groups) {
+				let live;
+				try {
+					live = await this.readIdentity(physicalId, group);
+				} catch (error) {
+					if (error instanceof ResourceNotFoundException$11) continue;
+					throw wrapDeleteError("reading a schedule of its name", error);
+				}
+				if (sameRecordedIdentity(live, recorded)) matches.push(group);
+				else if (sameRecordedDate(live, recorded)) datedOnly++;
+			}
+			return {
+				matches,
+				datedOnly
+			};
+		};
+		let found = await findMatches();
+		if (found.matches.length === 0 && found.datedOnly === 0) {
+			await this.sleep(this.readBackDelaysMs[0] ?? 0);
+			found = await findMatches();
+		}
+		const { matches } = found;
+		if (matches.length === 0 && found.datedOnly > 0) {
+			this.logger.warn(safeMsg`Schedule ${logicalId}: a schedule of its name carries the recorded creation date but not the recorded target or role (edited outside cdkd?), so cdkd cannot tell whether it is this one; skipping deletion and keeping its state record. Delete it by hand if it is, then drop the record with 'cdkd orphan'.`);
+			return {
+				outcome: "skipped",
+				reason: AMBIGUOUS_SCHEDULE_SKIP_REASON
+			};
+		}
+		if (matches.length === 0) {
+			this.logger.warn(safeMsg`Schedule ${logicalId}: no schedule of its name carries the creation date cdkd recorded, so it is treated as already deleted and its state record is removed`);
+			return;
+		}
+		if (matches.length > 1) throw markNonRetryable(new ProvisioningError(`Failed to delete Schedule ${logicalId}: its recorded GroupName is secret-derived, and ${matches.length} schedules of its name match the one cdkd recorded, so none is deleted`, resourceType, logicalId, physicalId));
+		try {
+			await this.getClient().send(new DeleteScheduleCommand({
+				Name: physicalId,
+				GroupName: matches[0]
+			}));
+			this.logger.debug(safeMsg`Deleted Schedule ${logicalId} (found by its recorded creation date)`);
+		} catch (error) {
+			if (error instanceof ResourceNotFoundException$11) return;
+			throw wrapDeleteError("the delete", error);
+		}
+	}
 	async delete(logicalId, physicalId, resourceType, properties, context) {
-		const skip = redactedDeleteAddressSkip(this.logger, logicalId, "Schedule", redactedDeleteAddressFields({ GroupName: properties?.["GroupName"] }));
+		const redactedFields = redactedDeleteAddressFields({ GroupName: properties?.["GroupName"] });
+		const recordedCreation = recordedCreationDate(context?.recordedAttributes);
+		if (redactedFields.length > 0 && recordedCreation !== void 0) return this.deleteByRecordedIdentity(logicalId, physicalId, resourceType, {
+			creation: recordedCreation,
+			...recordedTarget(properties)
+		}, context);
+		const skip = redactedDeleteAddressSkip(this.logger, logicalId, "Schedule", redactedFields);
 		if (skip) return skip;
 		const groupName = this.groupNameOf(properties);
 		if (properties === void 0) {
@@ -34310,7 +34986,10 @@ var SchedulerScheduleProvider = class {
 			}));
 			return {
 				physicalId: explicit,
-				attributes: response.Arn ? { Arn: response.Arn } : {}
+				attributes: {
+					...response.Arn && { Arn: response.Arn },
+					...response.CreationDate instanceof Date && !Number.isNaN(response.CreationDate.getTime()) && { ["cdkd:CreationDate"]: response.CreationDate.toISOString() }
+				}
 			};
 		} catch (error) {
 			if (error instanceof ResourceNotFoundException$11) return null;
@@ -34553,7 +35232,7 @@ var PipesPipeProvider = class {
 		try {
 			settled = await this.waitForSettled(name, logicalId, resourceType, "create", mask);
 		} catch (error) {
-			throw await this.retireFailedCreate(name, logicalId, error, mask);
+			throw await this.retireFailedCreate(name, logicalId, resourceType, error, mask);
 		}
 		return {
 			physicalId: name,
@@ -34773,13 +35452,14 @@ var PipesPipeProvider = class {
 			watch.dispose();
 		}
 	}
-	async retireFailedCreate(name, logicalId, error, mask) {
+	async retireFailedCreate(name, logicalId, resourceType, error, mask) {
 		const original = error instanceof Error ? error : new Error(String(error));
+		const leftBehind = () => markCreatedBeforeFailure(original, logicalId, resourceType, name);
 		const orphaned = async (why) => {
 			const aws = pasteableAwsCommand(mask);
 			const command = aws`aws pipes delete-pipe --name ${name}${await orphanCommandRegionArg(this.getClient(), aws)}`;
-			original.message += ` (cdkd could not delete the pipe it had created: ${why}; it is not recorded in state. ` + (command.text !== void 0 ? `Delete it with: ${command.text})` : `Delete it from the EventBridge Pipes console.)`);
-			return original;
+			original.message += ` (cdkd could not delete the pipe it had created: ${why}; on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`. ` + (command.text !== void 0 ? `Otherwise delete it yourself with: ${command.text})` : `Otherwise delete it yourself from the EventBridge Pipes console.)`);
+			return leftBehind();
 		};
 		try {
 			await this.getClient().send(new DeletePipeCommand({ Name: name }));
@@ -34822,7 +35502,7 @@ var PipesPipeProvider = class {
 		const describe = aws`aws pipes describe-pipe --name ${name}${region}`;
 		const remove = aws`aws pipes delete-pipe --name ${name}${region}`;
 		original.message += " (cdkd asked AWS to delete the pipe it had created but could not confirm the delete progressed; " + (describe.text !== void 0 && remove.text !== void 0 ? `if ${describe.text} still shows it, delete it with: ${remove.text})` : "if the EventBridge Pipes console still shows it, delete it there.)");
-		return original;
+		return leftBehind();
 	}
 };
 
@@ -35055,6 +35735,7 @@ var EFSProvider = class {
 		if (reservation.ledgerStartedThisDeploy) await this.warnOfPreLedgerHolder(logicalId, reservation.base, log);
 		const tags = properties["FileSystemTags"];
 		let fileSystemId;
+		let fileSystemLeftBehind = false;
 		try {
 			const created = await this.sendCreateFileSystem(logicalId, resourceType, reservation, {
 				CreationToken: creationToken,
@@ -35093,12 +35774,14 @@ var EFSProvider = class {
 					this.unconfirmedCreationTokens.delete(creationToken);
 					log.debug(`Rolled back partially-created EFS FileSystem ${fileSystemId}`);
 				} catch (cleanupError) {
+					fileSystemLeftBehind = true;
 					log.warn(`Failed to roll back partially-created EFS FileSystem ${fileSystemId}: ${describeAwsFailure(cleanupError).detail}`);
 				}
 			}
-			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS FileSystem ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (fileSystemLeftBehind && fileSystemId !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, fileSystemId);
+			throw thrown;
 		}
 	}
 	async sendCreateFileSystem(logicalId, resourceType, reservation, input) {
@@ -35243,12 +35926,14 @@ var EFSProvider = class {
 		const subnetId = properties["SubnetId"];
 		if (!subnetId) throw new ProvisioningError(`SubnetId is required for EFS MountTarget ${logicalId}`, resourceType, logicalId);
 		const securityGroups = properties["SecurityGroups"];
+		let createdMountTargetId;
 		try {
 			const mountTargetId = (await this.getClient().send(new CreateMountTargetCommand({
 				FileSystemId: fileSystemId,
 				SubnetId: subnetId,
 				SecurityGroups: securityGroups
 			}))).MountTargetId;
+			createdMountTargetId = mountTargetId;
 			log.debug(`Created EFS MountTarget ${logicalId}: ${mountTargetId}, waiting for available state`);
 			await this.waitForMountTargetAvailable(mountTargetId, logicalId, resourceType, log);
 			log.debug(`Successfully created EFS MountTarget ${logicalId}: ${mountTargetId}`);
@@ -35257,9 +35942,10 @@ var EFSProvider = class {
 				attributes: {}
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			const thrown = error instanceof ProvisioningError ? error : this.wrapMaskedError(log.mask, error, (text) => new ProvisioningError(`Failed to create EFS MountTarget ${logicalId}: ${text}`, resourceType, logicalId, void 0, cause));
+			if (createdMountTargetId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdMountTargetId);
+			throw thrown;
 		}
 	}
 	async waitForMountTargetAvailable(mountTargetId, logicalId, resourceType, log) {
@@ -35799,16 +36485,27 @@ var FSxFileSystemProvider = class {
 				attributes: this.buildAttributes(fs)
 			};
 		} catch (error) {
+			let survivorId;
 			if (fileSystemId !== void 0) try {
 				await this.getClient().send(new DeleteFileSystemCommand$1({ FileSystemId: fileSystemId }));
 				this.createTokenFirstSentAt.delete(clientRequestToken);
 				this.logger.warn(`Rolled back partially-created FSx FileSystem ${fileSystemId}`);
 			} catch (cleanupError) {
-				this.logger.warn(`Failed to roll back partially-created FSx FileSystem ${fileSystemId}: ${describeAwsFailure(cleanupError).detail} — delete it manually to stop billing`);
+				survivorId = fileSystemId;
+				this.logger.warn(`Failed to roll back partially-created FSx FileSystem ${fileSystemId}: ${describeAwsFailure(cleanupError).detail} — on a first-time create the failed deploy's rollback journal records it for \`cdkd rollback --revert-failed\`; otherwise delete it yourself to stop billing`);
+			}
+			if (error instanceof ProvisioningError) {
+				if (survivorId !== void 0) markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
+				throw error;
 			}
-			if (error instanceof ProvisioningError) throw error;
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create FSx FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const message = `Failed to create FSx FileSystem ${logicalId}: ${error instanceof Error ? error.message : String(error)}`;
+			if (survivorId !== void 0) {
+				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
+				throw thrown;
+			}
+			throw new ProvisioningError(message, resourceType, logicalId, void 0, cause);
 		}
 	}
 	toCreateLustreConfiguration(config) {
@@ -36786,6 +37483,7 @@ var EMRClusterProvider = class {
 				attributes: this.buildAttributes(cluster)
 			};
 		} catch (error) {
+			let survivorId;
 			if (clusterId !== void 0) try {
 				await this.getClient().send(new SetTerminationProtectionCommand({
 					JobFlowIds: [clusterId],
@@ -36794,11 +37492,21 @@ var EMRClusterProvider = class {
 				await this.getClient().send(new TerminateJobFlowsCommand({ JobFlowIds: [clusterId] }));
 				this.logger.warn(`Rolled back partially-created EMR Cluster ${clusterId}`);
 			} catch (cleanupError) {
+				survivorId = clusterId;
 				this.logger.warn(`Failed to roll back partially-created EMR Cluster ${clusterId}: ${describeAwsFailure(cleanupError).detail} — terminate it manually to stop billing`);
 			}
-			if (error instanceof ProvisioningError) throw error;
+			if (error instanceof ProvisioningError) {
+				if (survivorId !== void 0) markCreatedBeforeFailure(error, logicalId, resourceType, survivorId);
+				throw error;
+			}
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create EMR Cluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const message = `Failed to create EMR Cluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`;
+			if (survivorId !== void 0) {
+				const thrown = new ProvisioningError(message, resourceType, logicalId, void 0, cause);
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, survivorId);
+				throw thrown;
+			}
+			throw new ProvisioningError(message, resourceType, logicalId, void 0, cause);
 		}
 	}
 	toJobFlowInstancesConfig(config) {
@@ -37382,6 +38090,7 @@ var EMRInstanceGroupConfigProvider = class {
 		const jobFlowId = properties["JobFlowId"];
 		if (!jobFlowId) throw new ProvisioningError(`EMR InstanceGroupConfig ${logicalId} is missing JobFlowId (the parent cluster id)`, resourceType, logicalId);
 		this.logger.debug(`Adding EMR instance group ${logicalId} to cluster ${jobFlowId}`);
+		let createdGroupId;
 		try {
 			const group = this.toInstanceGroupConfig(properties);
 			const orphanWindow = addInstanceGroupsLatch.take(logicalId);
@@ -37424,6 +38133,7 @@ var EMRInstanceGroupConfigProvider = class {
 			}
 			const groupId = response.InstanceGroupIds?.[0];
 			if (groupId) groupsCreatedByThisProcess.add(groupId);
+			createdGroupId = groupId;
 			if (!groupId) throw new ProvisioningError(`EMR AddInstanceGroups for ${logicalId} returned no instance group id`, resourceType, logicalId);
 			await this.waitForGroupReady(jobFlowId, groupId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
 			this.logger.debug(`Successfully added EMR instance group ${logicalId}: ${groupId}`);
@@ -37435,9 +38145,9 @@ var EMRInstanceGroupConfigProvider = class {
 				}
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance group ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			if (createdGroupId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdGroupId);
+			throw thrown;
 		}
 	}
 	toInstanceGroupConfig(properties) {
@@ -37676,6 +38386,7 @@ var EMRInstanceFleetConfigProvider = class {
 		const clusterId = properties["ClusterId"];
 		if (!clusterId) throw new ProvisioningError(`EMR InstanceFleetConfig ${logicalId} is missing ClusterId (the parent cluster id)`, resourceType, logicalId);
 		this.logger.debug(`Adding EMR instance fleet ${logicalId} to cluster ${clusterId}`);
+		let createdFleetId;
 		try {
 			const fleet = this.toInstanceFleetConfig(properties);
 			const orphanWindow = addInstanceFleetLatch.take(logicalId);
@@ -37718,6 +38429,7 @@ var EMRInstanceFleetConfigProvider = class {
 			}
 			const fleetId = response.InstanceFleetId;
 			if (fleetId) fleetsCreatedByThisProcess.add(fleetId);
+			createdFleetId = fleetId;
 			if (!fleetId) throw new ProvisioningError(`EMR AddInstanceFleet for ${logicalId} returned no instance fleet id`, resourceType, logicalId);
 			await this.waitForFleetReady(clusterId, fleetId, logicalId, resourceType, this.targetCapacities(properties), {
 				onDemand: 0,
@@ -37729,9 +38441,9 @@ var EMRInstanceFleetConfigProvider = class {
 				attributes: { Id: fleetId }
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to add EMR instance fleet ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			if (createdFleetId) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdFleetId);
+			throw thrown;
 		}
 	}
 	toInstanceFleetConfig(properties) {
@@ -37954,6 +38666,7 @@ var FirehoseProvider = class {
 		const deliveryStreamName = properties["DeliveryStreamName"];
 		const deliveryStreamType = properties["DeliveryStreamType"] || "DirectPut";
 		if (!isReadableTagList(properties["Tags"])) throw markNonRetryable(new ProvisioningError(`Tags of Firehose delivery stream ${logicalId} is not a list of tags with a Key — the delivery stream was not created`, resourceType, logicalId));
+		let createdStreamName;
 		try {
 			const input = {
 				DeliveryStreamName: deliveryStreamName || logicalId,
@@ -38082,6 +38795,7 @@ var FirehoseProvider = class {
 			}));
 			const response = await this.getClient().send(new CreateDeliveryStreamCommand(input));
 			const physicalId = deliveryStreamName || input.DeliveryStreamName || response.DeliveryStreamARN?.split("/").pop() || "";
+			createdStreamName = physicalId;
 			const arn = response.DeliveryStreamARN;
 			this.logger.debug(`Successfully created Firehose delivery stream ${logicalId}: ${physicalId}`);
 			await this.waitForActive(physicalId, logicalId);
@@ -38090,9 +38804,9 @@ var FirehoseProvider = class {
 				attributes: { Arn: arn }
 			};
 		} catch (error) {
-			if (error instanceof ProvisioningError) throw error;
-			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create Firehose delivery stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create Firehose delivery stream ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, error instanceof Error ? error : void 0);
+			if (createdStreamName !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdStreamName);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -38836,6 +39550,7 @@ var CloudTrailProvider = class {
 		const eventSelectors = properties["EventSelectors"];
 		const insightSelectors = properties["InsightSelectors"];
 		let trailCreated = false;
+		let createdTrailArn;
 		try {
 			const result = await this.getClient().send(new CreateTrailCommand({
 				Name: trailName ?? logicalId,
@@ -38856,6 +39571,7 @@ var CloudTrailProvider = class {
 			}));
 			trailCreated = true;
 			const trailArn = result.TrailARN;
+			createdTrailArn = result.TrailARN;
 			if (eventSelectors && eventSelectors.length > 0) {
 				this.logger.debug(`Setting event selectors for CloudTrail Trail ${logicalId}`);
 				await this.getClient().send(new PutEventSelectorsCommand({
@@ -38882,7 +39598,9 @@ var CloudTrailProvider = class {
 		} catch (error) {
 			if (trailCreated) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create CloudTrail Trail ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			if (createdTrailArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, createdTrailArn);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -39668,6 +40386,7 @@ var CodeCommitRepositoryProvider = class {
 			Triggers: properties["Triggers"],
 			Tags: properties["Tags"]
 		}, void 0);
+		let leftLiveName;
 		try {
 			const tags = toSdkTagMap(lists.Tags);
 			const description = properties["RepositoryDescription"];
@@ -39680,6 +40399,7 @@ var CodeCommitRepositoryProvider = class {
 			}))).repositoryMetadata;
 			if (!metadata?.repositoryName) throw new Error("CreateRepository did not return repository metadata");
 			const createdName = metadata.repositoryName;
+			leftLiveName = createdName;
 			try {
 				const code = properties["Code"];
 				if (code) await this.seedInitialCommit(createdName, code);
@@ -39693,7 +40413,7 @@ var CodeCommitRepositoryProvider = class {
 				}
 			} catch (postCreateError) {
 				this.logger.warn(`Post-create step failed for CodeCommit Repository ${logicalId}; deleting the just-created repository ${createdName} to avoid an orphan`);
-				await this.bestEffortDelete(createdName);
+				if (await this.bestEffortDelete(createdName)) leftLiveName = void 0;
 				throw markAuxiliaryFailure(postCreateError, logicalId);
 			}
 			this.logger.debug(`Successfully created CodeCommit Repository ${logicalId}: ${createdName}`);
@@ -39703,7 +40423,9 @@ var CodeCommitRepositoryProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, repositoryName, cause);
+			const thrown = new ProvisioningError(`Failed to create CodeCommit Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, repositoryName, cause);
+			if (leftLiveName !== void 0) markCreatedBeforeFailure(thrown, logicalId, resourceType, leftLiveName);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties, context) {
@@ -40031,8 +40753,10 @@ var CodeCommitRepositoryProvider = class {
 	async bestEffortDelete(repositoryName) {
 		try {
 			await this.getClient().send(new DeleteRepositoryCommand$1({ repositoryName }));
+			return true;
 		} catch (cleanupError) {
 			this.logger.warn(`Failed to clean up CodeCommit Repository ${repositoryName} after a post-create failure: ${describeAwsFailure(cleanupError).detail}`);
+			return false;
 		}
 	}
 	async getRepositoryMetadata(repositoryName) {
@@ -40600,6 +41324,7 @@ var S3DirectoryBucketProvider = class {
 		const tags = desiredTags;
 		const includeTags = tags.length > 0;
 		try {
+			const attributes = await this.buildAttributes(bucketName);
 			await this.s3Client.send(new CreateBucketCommand({
 				Bucket: bucketName,
 				CreateBucketConfiguration: {
@@ -40615,7 +41340,6 @@ var S3DirectoryBucketProvider = class {
 				}
 			}));
 			this.logger.debug(`Created S3 Express Directory Bucket: ${bucketName}`);
-			const attributes = await this.buildAttributes(bucketName);
 			return {
 				physicalId: bucketName,
 				attributes
@@ -41036,6 +41760,7 @@ var S3TablesProvider = class {
 			maskSecrets: context?.maskSecrets,
 			...context?.replayingState === true && { onRefusal: (message) => this.logger.warn(message) }
 		});
+		let tableCreated = false;
 		try {
 			const response = await this.getClient().send(new CreateTableCommand$2({
 				tableBucketARN,
@@ -41044,6 +41769,7 @@ var S3TablesProvider = class {
 				format,
 				...tags !== void 0 && { tags }
 			}));
+			tableCreated = true;
 			if (!response.tableARN) throw new ProvisioningError(`CreateTable did not return a tableARN for ${logicalId} (${physicalId}) — refusing to record an empty TableARN attribute`, resourceType, logicalId, physicalId);
 			const tableARN = response.tableARN;
 			this.logger.debug(`Successfully created S3 Tables Table ${logicalId}: ${physicalId}`);
@@ -41053,7 +41779,9 @@ var S3TablesProvider = class {
 			};
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create S3 Tables Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			const thrown = new ProvisioningError(`Failed to create S3 Tables Table ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, void 0, cause);
+			if (tableCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, physicalId);
+			throw thrown;
 		}
 	}
 	async readCurrentState(physicalId, logicalId, resourceType) {
@@ -41537,7 +42265,9 @@ var ECRProvider = class {
 		} catch (error) {
 			if (repositoryCreated) markAuxiliaryFailure(error, logicalId);
 			const cause = error instanceof Error ? error : void 0;
-			throw new ProvisioningError(`Failed to create ECR Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, repositoryName, cause);
+			const thrown = new ProvisioningError(`Failed to create ECR Repository ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, repositoryName, cause);
+			if (repositoryCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, repositoryName);
+			throw thrown;
 		}
 	}
 	async update(logicalId, physicalId, resourceType, properties, previousProperties) {
@@ -41751,7 +42481,7 @@ var NestedStackProvider = class {
 		["Tags", "CFn-only — cdkd does not tag the synthesized \"stack\" (the parent's synthesized ARN is a cdkd-local placeholder, not a real AWS resource)"],
 		["TimeoutInMinutes", "CFn-only stack-create deadline — cdkd uses per-resource --resource-timeout instead (issue #459 design §9)"]
 	])]]);
-	async create(logicalId, _resourceType, properties, context) {
+	async create(logicalId, resourceType, properties, context) {
 		const ctx = this.requireContext();
 		this.requireDeployContext(ctx, "create");
 		const childTemplatePath = ctx.nestedTemplates[logicalId];
@@ -41763,15 +42493,27 @@ var NestedStackProvider = class {
 		const childParameters = this.extractParameters(properties);
 		const resourceCount = Object.keys(childTemplate.Resources ?? {}).length;
 		this.logger.info(`Deploying nested stack ${displaySafe(childStackName)} (logicalId=${displaySafe(logicalId)}, ${resourceCount} resource(s))`);
-		const pendingChildDeletes = await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
-		const childOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
-		const pendingRecord = context?.replayingState === true ? void 0 : recordWithPendingChildDeletes(properties, pendingChildDeletes);
-		return {
-			physicalId: this.synthesizeArn(ctx.accountId, childRegion, ctx.parentStackName, logicalId),
-			attributes: childOutputs.attributes,
-			...childOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: childOutputs.noEchoAttributeNames },
-			...pendingRecord && { effectiveProperties: pendingRecord }
-		};
+		let pendingChildDeletes;
+		try {
+			pendingChildDeletes = await this.runChildDeploy(ctx, logicalId, childStackName, childRegion, childTemplate, childParameters, grandchildTemplates);
+		} catch (error) {
+			clearCreatedBeforeFailure(error);
+			throw error;
+		}
+		const physicalId = this.synthesizeArn(ctx.accountId, childRegion, ctx.parentStackName, logicalId);
+		try {
+			const childOutputs = await this.readChildOutputsAsAttributes(ctx, childStackName, childRegion);
+			const pendingRecord = context?.replayingState === true ? void 0 : recordWithPendingChildDeletes(properties, pendingChildDeletes);
+			return {
+				physicalId,
+				attributes: childOutputs.attributes,
+				...childOutputs.noEchoAttributeNames.length > 0 && { noEchoAttributeNames: childOutputs.noEchoAttributeNames },
+				...pendingRecord && { effectiveProperties: pendingRecord }
+			};
+		} catch (error) {
+			markCreatedBeforeFailure(error, logicalId, resourceType, physicalId);
+			throw error;
+		}
 	}
 	async update(logicalId, physicalId, _resourceType, properties, _previousProperties, context) {
 		const ctx = this.requireContext();
@@ -41858,6 +42600,7 @@ var NestedStackProvider = class {
 			...ctx.destroyOptions?.statePrefix !== void 0 && { statePrefix: ctx.destroyOptions.statePrefix },
 			...deleteContext?.removeProtection === true && { removeProtection: true },
 			...deleteContext?.resolveSecretDerivedPrincipals !== void 0 && { resolveSecretDerivedPrincipals: { inheritedProducerRegions: deleteContext.resolveSecretDerivedPrincipals.importedProducerRegions } },
+			...deleteContext?.stackDestroy === true && { stackDestroy: true },
 			...(ctx.destroyOptions?.skipFinalSnapshot === true || ctx.options?.skipFinalSnapshot === true) && { skipFinalSnapshot: true },
 			...ctx.destroyOptions?.resourceWarnAfterMs !== void 0 && { resourceWarnAfterMs: ctx.destroyOptions.resourceWarnAfterMs },
 			...ctx.destroyOptions?.resourceTimeoutMs !== void 0 && { resourceTimeoutMs: ctx.destroyOptions.resourceTimeoutMs },
@@ -42141,11 +42884,19 @@ var ACMCertificateProvider = class {
 			const survivorNote = requestedArn ? await this.cleanupRequestedCertificate(requestedArn, logicalId, idempotencyToken) : void 0;
 			if (error instanceof CdkdError) {
 				if (survivorNote === void 0) throw error;
-				throw new ProvisioningError(`${error.message} ${survivorNote}`, resourceType, logicalId, requestedArn, error);
+				const thrown = new ProvisioningError(`${error.message} ${survivorNote}`, resourceType, logicalId, requestedArn, error);
+				if (requestedArn) markCreatedBeforeFailure(thrown, logicalId, resourceType, requestedArn);
+				throw thrown;
 			}
 			const cause = error instanceof Error ? error : void 0;
 			const detail = error instanceof Error ? error.message : String(error);
-			throw new ProvisioningError(`Failed to create ACM certificate ${logicalIdShown(logicalId)}: ${detail}` + (survivorNote === void 0 ? "" : ` ${survivorNote}`), resourceType, logicalId, requestedArn, cause);
+			const message = `Failed to create ACM certificate ${logicalIdShown(logicalId)}: ${detail}`;
+			if (requestedArn && survivorNote !== void 0) {
+				const thrown = new ProvisioningError(`${message} ${survivorNote}`, resourceType, logicalId, requestedArn, cause);
+				markCreatedBeforeFailure(thrown, logicalId, resourceType, requestedArn);
+				throw thrown;
+			}
+			throw new ProvisioningError(message, resourceType, logicalId, requestedArn, cause);
 		}
 	}
 	regionOfArn(arn) {
@@ -42385,4 +43136,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-DiWFkAOH.js.map
+//# sourceMappingURL=provider-classes-DMOnX5s-.js.map