@go-to-k/cdkd 0.296.13 → 0.296.15

package/dist/{provider-classes-hW6X0dKh.js → provider-classes-Drnm0GAz.js}

@@ -1,13 +1,13 @@
 import { r as getAwsClients } from "./aws-clients-CnmtbrxD.js";
-import { A as displayIdent, F as plainIdentOr, I as safeMsg, M as displayStackName, N as isPasteableIdent, T as SECRET_REF_MAX_CODE_POINTS, _ as generateResourceNameWithFallback, g as generateResourceName, j as displaySafe, n as getLogger } from "./logger-DAaB7GFO.js";
-import { A as refusalTypeShown, An as pasteableCommand, B as protectionFlipKey, Bt as injectiveKey, C as assertRegionMatch, D as isQuotableImportValue, Dn as commandHole, E as isPlainImportValue, Fn as shellQuote, Gn as markNameCollision, Gt as withPasteableAwsProfile, I as deleteWithProtectionCompensation, In as withheldTargetClause, J as isAwsCliLiteral, Jt as clientDefaultsFor, K as UNNAMEABLE_ID_CLAUSE, Kn as markReplayMayCollide, Kt as ambientClientDefaults, L as isTerminalDeleteFailure, M as resolveExplicitPhysicalId, Mn as plainOrDescribed, O as normalizeAwsTagsToCfn, On as hasClauseBreak, Ot as markAuxiliaryFailure, P as ProtectionFlipRegistry, Qn as isTransientServerError, Qt as CdkdError, R as logGroupProtectionSite, S as RESOURCE_NOT_FOUND, St as clearCreatedBeforeFailure, T as isPlainImportJson, V as rdsFamilyProtectionSite, Vt as injectiveKeyPrefix, W as userPoolProtectionSite, X as protectedReplacementAdvice, Xt as AccountIdUnavailableError, Y as pasteableAwsCommand, Yn as isAmbiguousOutcomeError, Yt as credentialFingerprint, Z as renderDisableCommand, Zn as isRetryableTransientError, _ as RecentIdSet, _t as maskDeep, a as onlySecretDerived, ar as isThrottlingError, at as canonicalizeRoute53QueryName, b as setBounded, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as compositeIdSkipResult, er as describeAwsFailure, fn as ProvisioningError, ft as segmentAfterAnchor, g as AmbiguousCreateLatch, gt as isSecretDerivedValue, h as AMBIGUOUS_LATCH_TTL_MS, ht as createMaskedRetryLogger, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, j as remedyLogicalId, k as quotedRemedyLogicalId, kn as isInertUnquoted, kt as markCreatedBeforeFailure, lt as logicalIdShown, mn as ResourceUpdateNotSupportedError, mt as createMaskedLogSinks, nr as safeStringify, nt as startInterruptWatch, o as readPrincipalLists, or as markNonRetryable, ot as compositeIdFormatMessage, p as withRemovalDefaults, pt as stateOrphanRecordRemedy, q as WITHHELD_AWS_COMMAND, qt as ambientCredentialConfig, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, rt as ElapsedBudgetRegistry, sr as markRedactedCause, st as compositeIdSeparatorRefusal, tr as isAwsAuthoredFailure, tt as isInterruptedWaitError, u as clearOnUpdateRemoval, ut as packCompositeId, v as createAttemptKey, vt as maskerOrIdentity, w as VALUE_NOT_SHOWN, x as withoutServerErrorRetries, y as isInsideWindow, yt as withDerivedNameMasks, z as observeThenDisableProtection } from "./iam-policy-targets-elNafvpb.js";
+import { F as displayStackName, I as isPasteableIdent, N as displayIdent, O as SECRET_REF_MAX_CODE_POINTS, P as displaySafe, R as plainIdentOr, a as getLogger, b as generateResourceNameWithFallback, n as isAwsAuthoredFailure, r as safeStringify, t as describeAwsFailure, y as generateResourceName, z as safeMsg } from "./aws-failure-text-BaWeCWRz.js";
+import { $ as protectedReplacementAdvice, $t as AccountIdUnavailableError, A as isQuotableImportValue, An as commandHole, B as isTerminalDeleteFailure, C as setBounded, D as VALUE_NOT_SHOWN, E as assertRegionMatch, F as resolveExplicitPhysicalId, Fn as plainOrDescribed, H as observeThenDisableProtection, Jn as markNameCollision, Jt as withPasteableAwsProfile, L as ProtectionFlipRegistry, M as quotedRemedyLogicalId, Mn as isInertUnquoted, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as pasteableCommand, O as isPlainImportJson, P as remedyLogicalId, Q as pasteableAwsCommand, Qn as isAmbiguousOutcomeError, Qt as credentialFingerprint, Rn as shellQuote, S as replayedSendWindow, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tt as clearCreatedBeforeFailure, U as protectionFlipKey, Ut as injectiveKey, V as logGroupProtectionSite, W as rdsFamilyProtectionSite, Wt as injectiveKeyPrefix, X as WITHHELD_AWS_COMMAND, Xt as ambientCredentialConfig, Y as UNNAMEABLE_ID_CLAUSE, Yn as markReplayMayCollide, Yt as ambientClientDefaults, Z as isAwsCliLiteral, Zt as clientDefaultsFor, _ as RecentIdSet, _n as ResourceUpdateNotSupportedError, _t as createMaskedLogSinks, a as onlySecretDerived, ar as isThrottlingError, at as startInterruptWatch, b as isInsideWindow, bt as maskDeep, c as recordedPrincipalsRepair, cr as wrapMaskedAwsError, ct as canonicalizeRoute53QueryName, dt as compositeIdSkipResult, er as isRetryableTransientError, et as renderDisableCommand, ft as logicalIdShown, g as AmbiguousCreateLatch, gt as stateOrphanRecordRemedy, h as AMBIGUOUS_LATCH_TTL_MS, hn as ProvisioningError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, ir as isMarkedNonRetryable, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as hasClauseBreak, jt as markAuxiliaryFailure, k as isPlainImportValue, lt as compositeIdFormatMessage, o as readPrincipalLists, or as markNonRetryable, ot as ElapsedBudgetRegistry, p as withRemovalDefaults, pt as packCompositeId, q as userPoolProtectionSite, r as SECRET_DERIVED_READ_LIVE, rr as THROTTLING_ERROR_NAMES, sr as markRedactedCause, tn as CdkdError, tr as isTransientServerError, u as clearOnUpdateRemoval, ut as compositeIdSeparatorRefusal, v as ambiguousAttemptLead, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, x as replayFollowedAmbiguousAttempt, xt as maskerOrIdentity, y as createAttemptKey, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as withheldTargetClause } from "./iam-policy-targets-BoZuWtxK.js";
 import { s as ambientRegion } from "./aws-client-defaults-D0q0z4dG.js";
-import { $r as passedParameterClassesOf, Aa as coerceCfnBoolean, Bn as planTagDiff, Br as getAccountInfo, Ct as INDEX_SETTLE_POLL_INTERVAL_MS, Da as isWarmThroughputDecrease, Dc as renderAssemblyPathEscape, Dt as S3_AUTO_DELETE_OBJECTS_TAG, Ea as coerceWarmThroughput$1, Ec as displayAssemblyPath, Eo as recoverMaskedOutput, Et as ECR_AUTO_DELETE_IMAGES_TAG, Fa as readConfigString, Fn as reserveStackCreateToken, Fr as s3BucketRegionalDomainName, Ga as lambdaFunctionNameForMask, Gn as definedAttributes, Gt as redactedDeleteAddressFields, Hn as refuseMalformedDesiredTags, Ia as replayWarn, Ir as s3BucketWebsiteUrl, Ka as sameLambdaFunctionAddress, Kn as stringifyIfAssigned, Kt as redactedDeleteAddressSkip, La as requireConfigArray, Ln as acquireIdempotencyToken, Ma as configBooleanRefusal, Mr as s3BucketArn, Na as configIntegerRefusal, Nn as earliestDefined, Nr as s3BucketDomainName, Oa as toCfnInteger, Oc as resolveAssemblyPath, Oo as carriesSecretMask, Ot as hasCdkAutoDeleteTag, Pa as configStringRefusal, Pi as refuseMalformedNestedChildOutputs, Pr as s3BucketDualStackDomainName, Qn as getCurrentResourceSecrets, Ra as requireConfigObject, Rn as DBPROXY_TAGS_WHAT, St as DELETE_INDEX_WAIT_PROCEED_NOTE, T as markRefusedBeforeApplying, Ta as WARM_THROUGHPUT_MEMBERS, Tc as describeFileReadFailure, Tt as waitForIndexesSettled, Ua as withRetry, Un as tagMapAsList, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, Vn as readTagList, Vt as getCurrentProducerRegions, Wa as canonicalLambdaFunctionName, Wn as tagPlanWarning, Wt as isRedactedRecordedValue, Xr as parseWebACLArn, Z as getNestedRevertRun, _o as markSameGenerationBag, _t as beginDeleteWait, a as findNestedTemplateTreeDefect, ai as accountArgs, ar as deleteSkipReason, bt as resolveDynamoDbDeleteBudgetClock, c as renderNestedTemplateTreeDefect, cr as markWaitAbandoned, dc as decodeListingKey, dr as isTerminationProtectionPropagationError, ds as rewriteTemplateAssetReferences, ea as refuseMalformedResourcesForDestroy, et as revertNestedChildFromJournal, fa as withheldAccountClause, fr as observeThenDisableInstanceApiTermination, ga as withoutSilentDropProperties, gt as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, hc as derivePartitionAndUrlSuffix, ht as DynamoDBGlobalTableProvider, it as withNestedStackContext, ja as coerceCfnInteger, jr as isSettledInstanceState, ka as toFiniteNumber, kt as isTruthyCfnBoolean, lt as getStackRecords, ma as findSilentDropProperties, mc as canonicalizeRegion, mr as reEnableInstanceApiTermination, nr as unchangedBehindSecretReference, o as isAbsoluteAssetPath, oo as hasMaskableValues, or as withIndeterminateGuard, os as stringifyValue, pr as reDisableInstanceApiTermination, rt as getCurrentNestedStackContext, s as listNestedTemplateRows, sr as isWaitAbandonedError, st as awaitInFlightSibling, t as DeployEngine, to as passedNoEchoParametersOf, tr as slowCcOperationTimeoutMs, ur as ec2InstanceProtectionSite, vo as redactSecretsForState, vt as compensateRemovedDeletionProtection, w as getPriorAttempts, wt as deleteTableWithIndexBusyRetry, xo as dynamicReferenceTokens, xt as resolveDynamoDbDeleteBudgetMs, yt as deleteBudgetKey, za as requireConfigString, zn as DBPROXY_TAG_OPTIONS } from "./deploy-engine-FDsHckZR.js";
-import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-BuWI_oJp.js";
-import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-1S4fU3m4.js";
-import { RDSProvider } from "./rds-provider-Q1U7N7ee.js";
-import { NeptuneProvider } from "./neptune-provider-Bdc1YYxL.js";
-import { ASGProvider } from "./asg-provider-DeeIdM5B.js";
+import { $r as parseWebACLArn, Aa as isWarmThroughputDecrease, Ac as renderAssemblyPathEscape, Ba as requireConfigArray, Bn as DBPROXY_TAGS_WHAT, Ct as INDEX_SETTLE_POLL_INTERVAL_MS, Dt as S3_AUTO_DELETE_OBJECTS_TAG, Et as ECR_AUTO_DELETE_IMAGES_TAG, Fa as configBooleanRefusal, Fn as earliestDefined, Fr as s3BucketArn, Gn as tagMapAsList, Gt as redactedDeleteAddressFields, Ha as requireConfigString, Hn as planTagDiff, Ia as configIntegerRefusal, Ir as s3BucketDomainName, Ja as lambdaFunctionNameForMask, Jn as stringifyIfAssigned, Ka as withRetry, Kn as tagPlanWarning, Kt as redactedDeleteAddressSkip, La as configStringRefusal, Li as refuseMalformedNestedChildOutputs, Ln as reserveStackCreateToken, Lr as s3BucketDualStackDomainName, Ma as toFiniteNumber, Na as coerceCfnBoolean, Oa as WARM_THROUGHPUT_MEMBERS, Oc as describeFileReadFailure, Ot as hasCdkAutoDeleteTag, Pa as coerceCfnInteger, Pr as isSettledInstanceState, Ra as readConfigString, Rr as s3BucketRegionalDomainName, St as DELETE_INDEX_WAIT_PROCEED_NOTE, T as markRefusedBeforeApplying, Tt as waitForIndexesSettled, Un as readTagList, Ur as getAccountInfo, Ut as REDACTED_DELETE_ADDRESS_SKIP_REASON, Va as requireConfigObject, Vn as DBPROXY_TAG_OPTIONS, Vt as getCurrentProducerRegions, W as getNestedRevertRun, Wn as refuseMalformedDesiredTags, Wt as isRedactedRecordedValue, X as getCurrentNestedStackContext, Ya as sameLambdaFunctionAddress, Z as withNestedStackContext, _a as findSilentDropProperties, _c as canonicalizeRegion, _r as reEnableInstanceApiTermination, _t as beginDeleteWait, a as findNestedTemplateTreeDefect, ar as unchangedBehindSecretReference, bo as markSameGenerationBag, bt as resolveDynamoDbDeleteBudgetClock, c as renderNestedTemplateTreeDefect, ci as accountArgs, cr as deleteSkipReason, dr as markWaitAbandoned, gr as reDisableInstanceApiTermination, gt as DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS, ha as withheldAccountClause, hr as observeThenDisableInstanceApiTermination, ht as DynamoDBGlobalTableProvider, io as passedNoEchoParametersOf, ir as slowCcOperationTimeoutMs, ja as toCfnInteger, jc as resolveAssemblyPath, jo as carriesSecretMask, ka as coerceWarmThroughput$1, kc as displayAssemblyPath, ko as recoverMaskedOutput, kt as isTruthyCfnBoolean, lo as hasMaskableValues, lr as withIndeterminateGuard, ls as stringifyValue, lt as getStackRecords, mc as decodeListingKey, mr as isTerminationProtectionPropagationError, ms as rewriteTemplateAssetReferences, ni as passedParameterClassesOf, o as isAbsoluteAssetPath, pr as ec2InstanceProtectionSite, q as revertNestedChildFromJournal, qa as canonicalLambdaFunctionName, qn as definedAttributes, ra as refuseMalformedResourcesForDestroy, s as listNestedTemplateRows, st as awaitInFlightSibling, t as DeployEngine, tr as getCurrentResourceSecrets, ur as isWaitAbandonedError, vc as derivePartitionAndUrlSuffix, vt as compensateRemovedDeletionProtection, w as getPriorAttempts, wo as dynamicReferenceTokens, wt as deleteTableWithIndexBusyRetry, xo as redactSecretsForState, xt as resolveDynamoDbDeleteBudgetMs, ya as withoutSilentDropProperties, yt as deleteBudgetKey, za as replayWarn, zn as acquireIdempotencyToken, zr as s3BucketWebsiteUrl } from "./deploy-engine-CjLZZzyn.js";
+import { n as collectInlinePolicyNamesManagedBySiblings, r as IamCreateClientCache, t as IAMRoleProvider } from "./iam-role-provider-DAqNwSNR.js";
+import { a as canonicalizeIpProtocolValue, i as resolveSecretDerivedPrincipals, n as runDestroyForStack, o as resolvedResourceTimeoutMs, r as isResolvableSecretPrincipalList, t as canonicalizeIpv4Cidr } from "./program-CqKPsOUR.js";
+import { RDSProvider } from "./rds-provider-e6XtJAGl.js";
+import { NeptuneProvider } from "./neptune-provider-DlSon_pZ.js";
+import { ASGProvider } from "./asg-provider-BbWC_1l5.js";
 import { createHash, randomUUID } from "node:crypto";
 import { CreateBucketCommand, DeleteBucketAnalyticsConfigurationCommand, DeleteBucketCommand, DeleteBucketCorsCommand, DeleteBucketEncryptionCommand, DeleteBucketIntelligentTieringConfigurationCommand, DeleteBucketInventoryConfigurationCommand, DeleteBucketLifecycleCommand, DeleteBucketMetricsConfigurationCommand, DeleteBucketOwnershipControlsCommand, DeleteBucketPolicyCommand, DeleteBucketReplicationCommand, DeleteBucketTaggingCommand, DeleteBucketWebsiteCommand, DeleteObjectsCommand, GetBucketAccelerateConfigurationCommand, GetBucketCorsCommand, GetBucketEncryptionCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketLoggingCommand, GetBucketNotificationConfigurationCommand, GetBucketOwnershipControlsCommand, GetBucketPolicyCommand, GetBucketReplicationCommand, GetBucketTaggingCommand, GetBucketVersioningCommand, GetBucketWebsiteCommand, GetObjectCommand, GetObjectLockConfigurationCommand, GetPublicAccessBlockCommand, HeadBucketCommand, ListBucketAnalyticsConfigurationsCommand, ListBucketIntelligentTieringConfigurationsCommand, ListBucketInventoryConfigurationsCommand, ListBucketMetricsConfigurationsCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchBucket, PutBucketAccelerateConfigurationCommand, PutBucketAnalyticsConfigurationCommand, PutBucketCorsCommand, PutBucketEncryptionCommand, PutBucketIntelligentTieringConfigurationCommand, PutBucketInventoryConfigurationCommand, PutBucketLifecycleConfigurationCommand, PutBucketLoggingCommand, PutBucketMetricsConfigurationCommand, PutBucketNotificationConfigurationCommand, PutBucketOwnershipControlsCommand, PutBucketPolicyCommand, PutBucketReplicationCommand, PutBucketTaggingCommand, PutBucketVersioningCommand, PutBucketWebsiteCommand, PutObjectLockConfigurationCommand, PutPublicAccessBlockCommand, S3Client } from "@aws-sdk/client-s3";
 import { AddRoleToInstanceProfileCommand, AddUserToGroupCommand, AttachGroupPolicyCommand, AttachRolePolicyCommand, AttachUserPolicyCommand, CreateAccessKeyCommand, CreateGroupCommand, CreateInstanceProfileCommand, CreateLoginProfileCommand, CreatePolicyCommand, CreatePolicyVersionCommand, CreateUserCommand, DeleteAccessKeyCommand, DeleteGroupCommand, DeleteGroupPolicyCommand, DeleteInstanceProfileCommand, DeleteLoginProfileCommand, DeletePolicyCommand, DeletePolicyVersionCommand, DeleteRolePolicyCommand, DeleteUserCommand, DeleteUserPermissionsBoundaryCommand, DeleteUserPolicyCommand, DetachGroupPolicyCommand, DetachRolePolicyCommand, DetachUserPolicyCommand, GetAccessKeyLastUsedCommand, GetGroupCommand, GetGroupPolicyCommand, GetInstanceProfileCommand, GetPolicyCommand, GetPolicyVersionCommand, GetRolePolicyCommand, GetUserCommand, GetUserPolicyCommand, IAMClient, ListAccessKeysCommand, ListAttachedGroupPoliciesCommand, ListAttachedUserPoliciesCommand, ListEntitiesForPolicyCommand, ListGroupPoliciesCommand, ListGroupsForUserCommand, ListPoliciesCommand, ListPolicyTagsCommand, ListPolicyVersionsCommand, ListUserPoliciesCommand, NoSuchEntityException, PutGroupPolicyCommand, PutRolePolicyCommand, PutUserPermissionsBoundaryCommand, PutUserPolicyCommand, RemoveRoleFromInstanceProfileCommand, RemoveUserFromGroupCommand, TagPolicyCommand, TagUserCommand, UntagPolicyCommand, UntagUserCommand, UpdateAccessKeyCommand, UpdateLoginProfileCommand } from "@aws-sdk/client-iam";
@@ -1389,6 +1389,11 @@ var IAMAccessKeyProvider = class {
 			}
 			log.debug(`Successfully created IAM access key ${logicalId}: ${v(accessKeyId)}`);
 			this.accessKeyIdsCreatedByThisProcess.add(accessKeyId);
+			if (replayFollowedAmbiguousAttempt(response)) try {
+				await this.deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log, "replayed");
+			} catch (reconcileError) {
+				log.warn(`Could not check user ${v(userName)} for an access key left by the replayed CreateAccessKey for ${logicalId}: ${v(describeAwsFailure(reconcileError).detail)}. List the user's keys and delete any that no deploy records: ${aws`aws iam list-access-keys --user-name ${userName}`.render()}`);
+			}
 			return {
 				physicalId: accessKeyId,
 				attributes: {
@@ -1419,7 +1424,7 @@ var IAMAccessKeyProvider = class {
 			release();
 		}
 	}
-	async deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log) {
+	async deleteOrphanFromFailedAttempt(userName, logicalId, baseline, attemptStartMs, log, cause = "failed") {
 		const { value: v } = log;
 		const aws = pasteableAwsCommand(log.mask);
 		const deleted = /* @__PURE__ */ new Set();
@@ -1433,7 +1438,7 @@ var IAMAccessKeyProvider = class {
 				log.warn(`IAM access key ${v(accessKeyId)} appeared on user ${v(userName)} while creating ${logicalId}, but cdkd cannot attribute it to this attempt (created ${key.createDateMs === void 0 ? "at an unknown time" : new Date(key.createDateMs).toISOString()}, attempt started ${new Date(attemptStartMs).toISOString()}). Leaving it in place. If it is an orphan of a failed cdkd deploy, delete it with: ${aws`aws iam delete-access-key --user-name ${userName} --access-key-id ${accessKeyId}`.render()}`);
 				continue;
 			}
-			log.warn(`IAM access key ${v(accessKeyId)} was minted on user ${v(userName)} by this failed attempt at ${logicalId} and its secret was lost with the response, so it is unusable and unrecorded; deleting it before the retry`);
+			log.warn(cause === "replayed" ? `IAM access key ${v(accessKeyId)} was minted on user ${v(userName)} by the CreateAccessKey attempt for ${logicalId} that the AWS SDK then sent again, and its secret was lost with that attempt's response, so it is unusable and unrecorded; deleting it (the key the replay returned is recorded)` : `IAM access key ${v(accessKeyId)} was minted on user ${v(userName)} by this failed attempt at ${logicalId} and its secret was lost with the response, so it is unusable and unrecorded; deleting it before the retry`);
 			try {
 				await this.iamClient.send(new DeleteAccessKeyCommand({
 					UserName: userName,
@@ -8387,7 +8392,8 @@ async function reportPossibleOrphans(logicalId, window, log, lookup) {
 	const until = new Date(window.ceilingMs).toISOString();
 	const remove = lookup.remove;
 	const service = lookup.service ?? "API Gateway";
-	const afterward = lookup.afterward ?? "Creating a new one now.";
+	const afterward = window.replayedInSend === true ? "cdkd recorded the one the create returned." : lookup.afterward ?? "Creating a new one now.";
+	const lead = ambiguousAttemptLead(lookup.action, logicalId, window);
 	const when = remove !== void 0 ? `between ${since} and ${until}` : `at ${since}`;
 	let found;
 	try {
@@ -8395,12 +8401,12 @@ async function reportPossibleOrphans(logicalId, window, log, lookup) {
 	} catch (error) {
 		const failure = describeAwsFailure(error);
 		log.debug(`${lookup.listAction} failed with: ${log.value(failure.detail)}`);
-		log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer (${when}), so ${service} may have created ${lookup.subject} that no cdkd state records, and cdkd could not look for it (${lookup.listAction}: ${failure.summary}). Creating it again; check for a duplicate.`);
+		log.warn(`${lead} (${when}), so ${service} may have created ${lookup.subject} that no cdkd state records, and cdkd could not look for it (${lookup.listAction}: ${failure.summary}). ${window.replayedInSend === true ? "Check" : "Creating it again; check"} for a duplicate.`);
 		return;
 	}
 	const incomplete = found.truncated ? ` The search was incomplete: the list was cut at ${20} pages.` : "";
 	if (found.ids.length === 0) {
-		const line = `No listed ${lookup.noun} matching ${lookup.subject} is unrecorded by this deploy, so the listing shows no orphan of the earlier ambiguous ${lookup.action} attempt for ${logicalId} (${when}).${incomplete}`;
+		const line = `No listed ${lookup.noun} matching ${lookup.subject} is unrecorded by this deploy, so the listing shows no orphan of the ${window.replayedInSend === true ? "replayed" : "earlier ambiguous"} ${lookup.action} attempt for ${logicalId} (${when}).${incomplete}`;
 		if (found.truncated) log.warn(line);
 		else log.debug(line);
 		return;
@@ -8410,10 +8416,10 @@ async function reportPossibleOrphans(logicalId, window, log, lookup) {
 	const inspect = [...new Set(shown.map((id) => lookup.inspect(id)))].join(" ; ");
 	if (remove !== void 0) {
 		const deletion = [...new Set(shown.map((id) => remove(id)))].join(" ; ");
-		log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer, and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} were created ${when} that this deploy did not record: ${shown.join(", ")}${more}. cdkd does not adopt or delete them: nothing listed proves which deploy created one. ${afterward} First inspect each candidate: ${inspect}. Only after confirming one is this deploy's orphan and not another deploy's, ${lookup.removeVerb ?? "delete it"}: ${deletion}.${incomplete}`);
+		log.warn(`${lead}, and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} were created ${when} that this deploy did not record: ${shown.join(", ")}${more}. cdkd does not adopt or delete them: nothing listed proves which deploy created one. ${afterward} First inspect each candidate: ${inspect}. Only after confirming one is this deploy's orphan and not another deploy's, ${lookup.removeVerb ?? "delete it"}: ${deletion}.${incomplete}`);
 		return;
 	}
-	log.warn(`An earlier ${lookup.action} attempt for ${logicalId} failed without a definite answer (${when}), and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} match that this deploy did not record: ${shown.join(", ")}${more}. ${service} reports no creation time for them, so any of them may instead be this stack's own recorded one, another stack's, or older than this deploy; cdkd does not adopt or delete them. ${afterward} Inspect each before deleting anything: ${inspect}.${incomplete}`);
+	log.warn(`${lead} (${when}), and ${service} may have created ${lookup.subject} then that no cdkd state records. ${found.ids.length} ${lookup.noun} match that this deploy did not record: ${shown.join(", ")}${more}. ${service} reports no creation time for them, so any of them may instead be this stack's own recorded one, another stack's, or older than this deploy; cdkd does not adopt or delete them. ${afterward} Inspect each before deleting anything: ${inspect}.${incomplete}`);
 }
 
 //#endregion
@@ -8621,6 +8627,8 @@ var LambdaEventSourceMappingProvider = class {
 			const uuid = response.UUID;
 			if (!uuid) throw new Error("CreateEventSourceMapping did not return UUID");
 			mappingsCreatedByThisProcess.add(uuid);
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await this.reportPossibleMappingOrphans(logicalId, replayWindow, log, functionName, params.EventSourceArn);
 			log.debug(`Successfully created event source mapping ${logicalId}: ${uuid}`);
 			return {
 				physicalId: uuid,
@@ -8955,6 +8963,8 @@ var LambdaLayerVersionProvider = class {
 			}
 			const layerVersionArn = response.LayerVersionArn;
 			if (layerVersionArn) versionsPublishedByThisProcess.add(layerVersionArn);
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await this.reportPossibleLayerOrphans(logicalId, replayWindow, log, layerName);
 			log.debug(`Successfully created Lambda layer version ${logicalId}: ${layerVersionArn}`);
 			return {
 				physicalId: layerVersionArn,
@@ -14318,6 +14328,8 @@ var EC2Provider = class {
 			}
 			const vpcId = response.Vpc.VpcId;
 			ec2IdsCreatedByThisProcess.add(vpcId);
+			const vpcReplayWindow = replayedSendWindow(response, attemptStartMs);
+			if (vpcReplayWindow !== void 0) await this.reportPossibleOrphanVpcs(logicalId, cidrBlock, vpcReplayWindow, context);
 			let defaultSgId;
 			try {
 				if (properties["EnableDnsHostnames"] === true || properties["EnableDnsHostnames"] === "true") await this.ec2Client.send(new ModifyVpcAttributeCommand({
@@ -14484,6 +14496,8 @@ var EC2Provider = class {
 			}
 			const subnetId = response.Subnet.SubnetId;
 			ec2IdsCreatedByThisProcess.add(subnetId);
+			const subnetReplayWindow = replayedSendWindow(response, attemptStartMs);
+			if (subnetReplayWindow !== void 0) await this.reportPossibleOrphanSubnets(logicalId, vpcId, cidrBlock, subnetReplayWindow, context);
 			const availabilityZone = response.Subnet.AvailabilityZone;
 			try {
 				await this.applyTags(subnetId, desiredTags, logicalId);
@@ -14648,6 +14662,8 @@ var EC2Provider = class {
 			}
 			const igwId = response.InternetGateway.InternetGatewayId;
 			ec2IdsCreatedByThisProcess.add(igwId);
+			const igwReplayWindow = replayedSendWindow(response, attemptStartMs);
+			if (igwReplayWindow !== void 0) await this.reportPossibleOrphanInternetGateways(logicalId, igwReplayWindow, context);
 			await this.applyTags(igwId, desiredTags, logicalId);
 			this.logger.debug(`Successfully created InternetGateway ${logicalId}: ${igwId}`);
 			return {
@@ -14731,6 +14747,8 @@ var EC2Provider = class {
 				createdId = allocationId;
 			}
 			ec2IdsCreatedByThisProcess.add(allocationId);
+			const eipReplayWindow = replayedSendWindow(response, attemptStartMs);
+			if (eipReplayWindow !== void 0) await this.reportPossibleOrphanAddresses(logicalId, input, eipReplayWindow, context);
 			await this.applyTags(allocationId, desiredTags, logicalId);
 			const instanceId = properties["InstanceId"];
 			if (instanceId) {
@@ -17479,11 +17497,10 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		if (!restApiId || !name || !type) throw new ProvisioningError(`RestApiId, Name, and Type are required for API Gateway Authorizer ${logicalId}`, resourceType, logicalId);
 		try {
 			const providerArns = properties["ProviderARNs"];
-			const orphanWindow = createAuthorizerLatch$1.take(logicalId);
-			if (orphanWindow !== void 0) {
+			const reportOrphans = async (lookupWindow) => {
 				const aws = pasteableAwsCommand(log.mask);
 				const regionArg = await this.orphanCommandRegionArg(aws);
-				await reportPossibleOrphans(logicalId, orphanWindow, log, {
+				await reportPossibleOrphans(logicalId, lookupWindow, log, {
 					action: "CreateAuthorizer",
 					listAction: "GetAuthorizers",
 					subject: `an authorizer named ${log.value(name)} (type ${log.value(type)}) in REST API ${log.value(restApiId)}`,
@@ -17501,7 +17518,9 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 					}, (a) => a.id && a.name === name && a.type === type && !authorizersCreatedByThisProcess$1.has(injectiveKey(restApiId, a.id)) ? a.id : void 0),
 					inspect: (id) => aws`aws apigateway get-authorizer --rest-api-id ${restApiId} --authorizer-id ${id}${regionArg}`.render()
 				});
-			}
+			};
+			const orphanWindow = createAuthorizerLatch$1.take(logicalId);
+			if (orphanWindow !== void 0) await reportOrphans(orphanWindow);
 			const createClient = await this.getCreateClient();
 			const attemptStartMs = Date.now();
 			let response;
@@ -17524,6 +17543,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			}
 			const authorizerId = response.id;
 			authorizersCreatedByThisProcess$1.add(injectiveKey(restApiId, authorizerId));
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			log.debug(`Successfully created API Gateway Authorizer ${logicalId}: ${authorizerId}`);
 			return {
 				physicalId: authorizerId,
@@ -17718,11 +17739,10 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 		if (!restApiId) throw new ProvisioningError(`RestApiId is required for API Gateway Deployment ${logicalId}`, resourceType, logicalId);
 		try {
 			const description = properties["Description"];
-			const orphanWindow = createDeploymentLatch.take(logicalId);
-			if (orphanWindow !== void 0) {
+			const reportOrphans = async (lookupWindow) => {
 				const aws = pasteableAwsCommand(log.mask);
 				const regionArg = await this.orphanCommandRegionArg(aws);
-				await reportPossibleOrphans(logicalId, orphanWindow, log, {
+				await reportPossibleOrphans(logicalId, lookupWindow, log, {
 					action: "CreateDeployment",
 					listAction: "GetDeployments",
 					subject: `a deployment of REST API ${log.value(restApiId)}${description !== void 0 ? ` described ${log.value(description)}` : ""}`,
@@ -17737,11 +17757,13 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 							items: page.items ?? [],
 							next: page.position
 						};
-					}, (d) => d.id && (d.description ?? "") === (description ?? "") && isInsideWindow(d.createdDate, orphanWindow) && !deploymentsCreatedByThisProcess.has(injectiveKey(restApiId, d.id)) ? d.id : void 0),
+					}, (d) => d.id && (d.description ?? "") === (description ?? "") && isInsideWindow(d.createdDate, lookupWindow) && !deploymentsCreatedByThisProcess.has(injectiveKey(restApiId, d.id)) ? d.id : void 0),
 					inspect: (id) => aws`aws apigateway get-deployment --rest-api-id ${restApiId} --deployment-id ${id}${regionArg}`.render(),
 					remove: (id) => aws`aws apigateway delete-deployment --rest-api-id ${restApiId} --deployment-id ${id}${regionArg}`.render()
 				});
-			}
+			};
+			const orphanWindow = createDeploymentLatch.take(logicalId);
+			if (orphanWindow !== void 0) await reportOrphans(orphanWindow);
 			const createClient = await this.getCreateClient();
 			const attemptStartMs = Date.now();
 			let response;
@@ -17756,6 +17778,8 @@ var ApiGatewayProvider = class ApiGatewayProvider {
 			}
 			const deploymentId = response.id;
 			deploymentsCreatedByThisProcess.add(injectiveKey(restApiId, deploymentId));
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			log.debug(`Successfully created API Gateway Deployment ${logicalId}: ${deploymentId}`);
 			return {
 				physicalId: deploymentId,
@@ -18773,11 +18797,10 @@ var ApiGatewayV2Provider = class {
 		const protocolType = properties["ProtocolType"];
 		if (!name || !protocolType) throw new ProvisioningError(`Name and ProtocolType are required for API Gateway V2 Api ${logicalId}`, resourceType, logicalId);
 		try {
-			const orphanWindow = createApiLatch.take(logicalId);
-			if (orphanWindow !== void 0) {
+			const reportOrphans = async (lookupWindow) => {
 				const aws = pasteableAwsCommand(log.mask);
 				const regionArg = await this.orphanCommandRegionArg(aws);
-				await reportPossibleOrphans(logicalId, orphanWindow, log, {
+				await reportPossibleOrphans(logicalId, lookupWindow, log, {
 					action: "CreateApi",
 					listAction: "GetApis",
 					subject: `an API named ${log.value(name)} (protocol ${log.value(protocolType)})`,
@@ -18791,11 +18814,13 @@ var ApiGatewayV2Provider = class {
 							items: page.Items ?? [],
 							next: page.NextToken
 						};
-					}, (a) => a.ApiId && a.Name === name && a.ProtocolType === protocolType && isInsideWindow(a.CreatedDate, orphanWindow) && !apisCreatedByThisProcess.has(a.ApiId) ? a.ApiId : void 0),
+					}, (a) => a.ApiId && a.Name === name && a.ProtocolType === protocolType && isInsideWindow(a.CreatedDate, lookupWindow) && !apisCreatedByThisProcess.has(a.ApiId) ? a.ApiId : void 0),
 					inspect: (id) => aws`aws apigatewayv2 get-api --api-id ${id}${regionArg}`.render(),
 					remove: (id) => aws`aws apigatewayv2 delete-api --api-id ${id}${regionArg}`.render()
 				});
-			}
+			};
+			const orphanWindow = createApiLatch.take(logicalId);
+			if (orphanWindow !== void 0) await reportOrphans(orphanWindow);
 			const attemptStartMs = Date.now();
 			let response;
 			try {
@@ -18817,6 +18842,8 @@ var ApiGatewayV2Provider = class {
 			}
 			const apiId = response.ApiId;
 			apisCreatedByThisProcess.add(apiId);
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			const apiEndpoint = response.ApiEndpoint;
 			log.debug(`Successfully created API Gateway V2 Api ${logicalId}: ${apiId}`);
 			const executeApiArn = await this.buildExecuteApiArn(apiId, log);
@@ -18931,11 +18958,10 @@ var ApiGatewayV2Provider = class {
 		this.warnTlsConfigIgnoredIfPublic(logicalId, properties, log);
 		try {
 			const integrationUri = properties["IntegrationUri"];
-			const orphanWindow = createIntegrationLatch.take(logicalId);
-			if (orphanWindow !== void 0) {
+			const reportOrphans = async (lookupWindow) => {
 				const aws = pasteableAwsCommand(log.mask);
 				const regionArg = await this.orphanCommandRegionArg(aws);
-				await reportPossibleOrphans(logicalId, orphanWindow, log, {
+				await reportPossibleOrphans(logicalId, lookupWindow, log, {
 					action: "CreateIntegration",
 					listAction: "GetIntegrations",
 					subject: `an integration of type ${log.value(integrationType)}${integrationUri !== void 0 ? ` to ${log.value(integrationUri)}` : ""} in API ${log.value(apiId)}`,
@@ -18953,7 +18979,9 @@ var ApiGatewayV2Provider = class {
 					}, (i) => i.IntegrationId && i.IntegrationType === integrationType && (i.IntegrationUri ?? "") === (integrationUri ?? "") && !integrationsCreatedByThisProcess.has(injectiveKey(apiId, i.IntegrationId)) ? i.IntegrationId : void 0),
 					inspect: (id) => aws`aws apigatewayv2 get-integration --api-id ${apiId} --integration-id ${id}${regionArg}`.render()
 				});
-			}
+			};
+			const orphanWindow = createIntegrationLatch.take(logicalId);
+			if (orphanWindow !== void 0) await reportOrphans(orphanWindow);
 			const attemptStartMs = Date.now();
 			let response;
 			try {
@@ -18983,6 +19011,8 @@ var ApiGatewayV2Provider = class {
 			}
 			const integrationId = response.IntegrationId;
 			integrationsCreatedByThisProcess.add(injectiveKey(apiId, integrationId));
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			log.debug(`Successfully created API Gateway V2 Integration ${logicalId}: ${integrationId}`);
 			return {
 				physicalId: integrationId,
@@ -19078,11 +19108,10 @@ var ApiGatewayV2Provider = class {
 		const name = properties["Name"] || logicalId;
 		if (!apiId || !authorizerType) throw new ProvisioningError(`ApiId and AuthorizerType are required for API Gateway V2 Authorizer ${logicalId}`, resourceType, logicalId);
 		try {
-			const orphanWindow = createAuthorizerLatch.take(logicalId);
-			if (orphanWindow !== void 0) {
+			const reportOrphans = async (lookupWindow) => {
 				const aws = pasteableAwsCommand(log.mask);
 				const regionArg = await this.orphanCommandRegionArg(aws);
-				await reportPossibleOrphans(logicalId, orphanWindow, log, {
+				await reportPossibleOrphans(logicalId, lookupWindow, log, {
 					action: "CreateAuthorizer",
 					listAction: "GetAuthorizers",
 					subject: `an authorizer named ${log.value(name)} (type ${log.value(authorizerType)}) in API ${log.value(apiId)}`,
@@ -19100,7 +19129,9 @@ var ApiGatewayV2Provider = class {
 					}, (a) => a.AuthorizerId && a.Name === name && a.AuthorizerType === authorizerType && !authorizersCreatedByThisProcess.has(injectiveKey(apiId, a.AuthorizerId)) ? a.AuthorizerId : void 0),
 					inspect: (id) => aws`aws apigatewayv2 get-authorizer --api-id ${apiId} --authorizer-id ${id}${regionArg}`.render()
 				});
-			}
+			};
+			const orphanWindow = createAuthorizerLatch.take(logicalId);
+			if (orphanWindow !== void 0) await reportOrphans(orphanWindow);
 			const attemptStartMs = Date.now();
 			let response;
 			try {
@@ -19123,6 +19154,8 @@ var ApiGatewayV2Provider = class {
 			}
 			const authorizerId = response.AuthorizerId;
 			authorizersCreatedByThisProcess.add(injectiveKey(apiId, authorizerId));
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			log.debug(`Successfully created API Gateway V2 Authorizer ${logicalId}: ${authorizerId}`);
 			return {
 				physicalId: authorizerId,
@@ -22107,6 +22140,8 @@ var ECSProvider = class {
 			const taskDef = response.taskDefinition;
 			if (!taskDef || !taskDef.taskDefinitionArn) throw new Error("RegisterTaskDefinition did not return task definition ARN");
 			taskDefinitionsRegisteredByThisProcess.add(taskDef.taskDefinitionArn);
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await this.reportPossibleOrphanTaskDefinitions(logicalId, family, replayWindow, log);
 			log.debug(`Successfully created ECS task definition ${logicalId}: ${taskDef.taskDefinitionArn}`);
 			return {
 				physicalId: taskDef.taskDefinitionArn,
@@ -25643,6 +25678,9 @@ function instanceAttributes(instance) {
 		Arn: instance?.DBInstanceArn
 	});
 }
+function isDbIdentifier(id) {
+	return id.length <= 63 && /^[A-Za-z](?:-?[A-Za-z0-9])*$/.test(id);
+}
 var DocDBProvider = class {
 	docdbClient;
 	createClient;
@@ -25723,6 +25761,7 @@ var DocDBProvider = class {
 			lowercase: true
 		});
 		let clusterCreated = false;
+		let createdResourceId;
 		try {
 			const response = await this.getCreateClient().send(new CreateDBClusterCommand$1({
 				DBClusterIdentifier: dbClusterIdentifier,
@@ -25743,6 +25782,7 @@ var DocDBProvider = class {
 				...tags.length > 0 && { Tags: tags }
 			}));
 			clusterCreated = true;
+			createdResourceId = response.DBCluster?.DbClusterResourceId;
 			if (!response.DBCluster) throw new Error("CreateDBCluster did not return DBCluster");
 			this.logger.debug(`Successfully created DocDB DBCluster ${logicalId}: ${dbClusterIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForClusterAvailable(dbClusterIdentifier);
@@ -25752,7 +25792,7 @@ var DocDBProvider = class {
 			};
 		} catch (error) {
 			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DocDB DBCluster ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbClusterIdentifier, error instanceof Error ? error : void 0);
-			if (clusterCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbClusterIdentifier);
+			if (clusterCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbClusterIdentifier, createdResourceId);
 			throw thrown;
 		}
 	}
@@ -25854,7 +25894,8 @@ var DocDBProvider = class {
 			if (isDocDBNotFoundError(error, "DBClusterNotFoundFault")) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`DocDB DBCluster ${logicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  DocDB DB cluster ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`DocDB DBCluster ${logicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -25869,6 +25910,7 @@ var DocDBProvider = class {
 			lowercase: true
 		});
 		let instanceCreated = false;
+		let createdResourceId;
 		try {
 			const response = await this.getCreateClient().send(new CreateDBInstanceCommand$1({
 				DBInstanceIdentifier: dbInstanceIdentifier,
@@ -25881,6 +25923,7 @@ var DocDBProvider = class {
 				...tags.length > 0 && { Tags: tags }
 			}));
 			instanceCreated = true;
+			createdResourceId = response.DBInstance?.DbiResourceId;
 			if (!response.DBInstance) throw new Error("CreateDBInstance did not return DBInstance");
 			this.logger.debug(`Successfully created DocDB DBInstance ${logicalId}: ${dbInstanceIdentifier}`);
 			if (process.env["CDKD_NO_WAIT"] !== "true") await this.waitForInstanceAvailable(dbInstanceIdentifier);
@@ -25890,7 +25933,7 @@ var DocDBProvider = class {
 			};
 		} catch (error) {
 			const thrown = error instanceof ProvisioningError ? error : new ProvisioningError(`Failed to create DocDB DBInstance ${logicalId}: ${error instanceof Error ? error.message : String(error)}`, resourceType, logicalId, dbInstanceIdentifier, error instanceof Error ? error : void 0);
-			if (instanceCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbInstanceIdentifier);
+			if (instanceCreated) markCreatedBeforeFailure(thrown, logicalId, resourceType, dbInstanceIdentifier, createdResourceId);
 			throw thrown;
 		}
 	}
@@ -25928,7 +25971,8 @@ var DocDBProvider = class {
 			if (isDocDBNotFoundError(error, "DBInstanceNotFoundFault")) {
 				const clientRegion = await this.getClient().config.region();
 				assertRegionMatch(clientRegion, context?.expectedRegion, resourceType, logicalId, physicalId);
-				this.logger.debug(`DocDB DBInstance ${physicalId} does not exist, skipping deletion`);
+				if (context?.failedCreateOrphan === true) this.logger.info(safeMsg`  DocDB DB instance ${physicalId} (${logicalId}), which a failed deploy created, is already gone; nothing to delete`);
+				else this.logger.debug(`DocDB DBInstance ${physicalId} does not exist, skipping deletion`);
 				return;
 			}
 			const cause = error instanceof Error ? error : void 0;
@@ -25941,6 +25985,55 @@ var DocDBProvider = class {
 	async describeDBInstance(dbInstanceIdentifier) {
 		return (await this.getClient().send(new DescribeDBInstancesCommand$1({ DBInstanceIdentifier: dbInstanceIdentifier }))).DBInstances?.[0];
 	}
+	async isSameResource(journaledPhysicalId, record, resourceType, context) {
+		if (resourceType !== "AWS::DocDB::DBCluster" && resourceType !== "AWS::DocDB::DBInstance") return "unknown";
+		if (!isDbIdentifier(journaledPhysicalId) || !isDbIdentifier(record.physicalId)) return "unknown";
+		if (journaledPhysicalId.toLowerCase() === record.physicalId.toLowerCase()) return "same";
+		if (await this.getClient().config.region() !== context.expectedRegion) return "unknown";
+		const recordResourceId = await this.readDbResourceIdIfExists(resourceType, record.physicalId);
+		if (recordResourceId === void 0) return "unknown";
+		const journaledResourceId = await this.readDbResourceIdIfExists(resourceType, journaledPhysicalId);
+		if (journaledResourceId === void 0) return "different";
+		return journaledResourceId === recordResourceId ? "same" : "different";
+	}
+	async resourceIdentity(physicalId, resourceType, context) {
+		if (resourceType !== "AWS::DocDB::DBCluster" && resourceType !== "AWS::DocDB::DBInstance") return;
+		if (!isDbIdentifier(physicalId)) return void 0;
+		if (await this.getClient().config.region() !== context.expectedRegion) return void 0;
+		const live = await this.readDbResourceIdIfExists(resourceType, physicalId);
+		return live === void 0 ? RESOURCE_NOT_FOUND : live;
+	}
+	async readDbResourceIdIfExists(resourceType, identifier) {
+		const isCluster = resourceType === "AWS::DocDB::DBCluster";
+		let found;
+		try {
+			if (isCluster) {
+				const cluster = await this.describeDBCluster(identifier);
+				found = cluster && {
+					identifier: cluster.DBClusterIdentifier,
+					engine: cluster.Engine,
+					resourceId: cluster.DbClusterResourceId
+				};
+			} else {
+				const instance = await this.describeDBInstance(identifier);
+				found = instance && {
+					identifier: instance.DBInstanceIdentifier,
+					engine: instance.Engine,
+					resourceId: instance.DbiResourceId
+				};
+			}
+		} catch (error) {
+			const notFound = isCluster ? "DBClusterNotFoundFault" : "DBInstanceNotFoundFault";
+			if (error?.name === notFound) return void 0;
+			throw error;
+		}
+		if (found === void 0) return void 0;
+		const api = isCluster ? "DescribeDBClusters" : "DescribeDBInstances";
+		if (found.identifier?.toLowerCase() !== identifier.toLowerCase()) throw new Error(`${api} answered for another identifier`);
+		if (found.engine !== "docdb") throw new Error(`${api} answered with a resource of another engine`);
+		if (typeof found.resourceId !== "string" || found.resourceId === "") throw new Error(`${api} returned no resource id`);
+		return found.resourceId;
+	}
 	async waitForClusterAvailable(dbClusterIdentifier, maxWaitMs = 18e5) {
 		const startTime = Date.now();
 		let delay = 5e3;
@@ -28068,17 +28161,20 @@ var CognitoUserPoolProvider = class {
 			if (properties["UserPoolTier"]) createParams.UserPoolTier = properties["UserPoolTier"];
 			const orphanWindow = createUserPoolLatch.take(logicalId);
 			if (orphanWindow !== void 0) await this.reportPossibleOrphanPools(logicalId, poolName, orphanWindow, createMaskedLogSinks(this.logger, context?.maskSecrets));
-			let userPool;
+			let created;
 			const attemptStartMs = Date.now();
 			try {
-				userPool = (await this.getCreateClient().send(new CreateUserPoolCommand(createParams))).UserPool;
+				created = await this.getCreateClient().send(new CreateUserPoolCommand(createParams));
 			} catch (error) {
 				createUserPoolLatch.noteFailure(logicalId, error, attemptStartMs, orphanWindow);
 				throw error;
 			}
+			const userPool = created.UserPool;
 			if (!userPool?.Id) throw new Error("CreateUserPool did not return UserPool.Id");
 			const userPoolId = userPool.Id;
 			createdUserPoolId = userPoolId;
+			const replayWindow = replayedSendWindow(created, attemptStartMs);
+			if (replayWindow !== void 0) await this.reportPossibleOrphanPools(logicalId, poolName, replayWindow, createMaskedLogSinks(this.logger, context?.maskSecrets), userPoolId);
 			const userPoolArn = userPool.Arn;
 			const region = await this.getClient().config.region();
 			const { urlSuffix } = derivePartitionAndUrlSuffix(region);
@@ -28125,10 +28221,12 @@ var CognitoUserPoolProvider = class {
 		}
 		return region ? aws` --region ${region}` : aws``;
 	}
-	async reportPossibleOrphanPools(logicalId, poolName, window, log) {
+	async reportPossibleOrphanPools(logicalId, poolName, window, log, returnedId) {
 		const { value: v } = log;
 		const since = new Date(window.floorMs).toISOString();
 		const until = new Date(window.ceilingMs).toISOString();
+		const lead = ambiguousAttemptLead("CreateUserPool", logicalId, window);
+		const replayed = window.replayedInSend === true;
 		const candidates = [];
 		let truncated = false;
 		try {
@@ -28139,7 +28237,7 @@ var CognitoUserPoolProvider = class {
 					MaxResults: 60,
 					...nextToken && { NextToken: nextToken }
 				}));
-				for (const pool of page.UserPools ?? []) if (pool.Id && pool.Name === poolName && isInsideWindow(pool.CreationDate, window) && !userPoolsCreatedByThisProcess.has(pool.Id)) candidates.push(pool.Id);
+				for (const pool of page.UserPools ?? []) if (pool.Id && pool.Name === poolName && isInsideWindow(pool.CreationDate, window) && pool.Id !== returnedId && !userPoolsCreatedByThisProcess.has(pool.Id)) candidates.push(pool.Id);
 				nextToken = page.NextToken;
 				pages++;
 			} while (nextToken && pages < MAX_USER_POOL_LIST_PAGES);
@@ -28147,12 +28245,12 @@ var CognitoUserPoolProvider = class {
 		} catch (error) {
 			const failure = describeAwsFailure(error);
 			log.debug(`ListUserPools failed with: ${v(failure.detail)}`);
-			log.warn(`An earlier CreateUserPool attempt for ${logicalId} failed without a definite answer, so Cognito may have created a user pool named ${v(poolName)} that no cdkd state records, and cdkd could not look for it (ListUserPools: ${failure.summary}). Creating a new pool; check for a pool of that name created between ${since} and ${until}.`);
+			log.warn(`${lead}, so Cognito may have created a user pool named ${v(poolName)} that no cdkd state records, and cdkd could not look for it (ListUserPools: ${failure.summary}). ${replayed ? "Check" : "Creating a new pool; check"} for a pool of that name created between ${since} and ${until}.`);
 			return;
 		}
 		const incomplete = truncated ? ` The search was incomplete: the pool list was cut at ${MAX_USER_POOL_LIST_PAGES} pages.` : "";
 		if (candidates.length === 0) {
-			const line = `No listed user pool named ${v(poolName)} was created between ${since} and ${until}, where the earlier ambiguous CreateUserPool attempt for ${logicalId} ran.${incomplete}`;
+			const line = `No listed user pool named ${v(poolName)} was created between ${since} and ${until}, where the ${replayed ? "replayed" : "earlier ambiguous"} CreateUserPool attempt for ${logicalId} ran.${incomplete}`;
 			if (truncated) log.warn(line);
 			else log.debug(line);
 			return;
@@ -28162,7 +28260,7 @@ var CognitoUserPoolProvider = class {
 		const region = await this.regionArg(aws);
 		const inspect = shown.map((id) => aws`aws cognito-idp describe-user-pool --user-pool-id ${id}${region}`.render()).join(" ; ");
 		const deletion = shown.map((id) => aws`aws cognito-idp delete-user-pool --user-pool-id ${id}${region}`.render()).join(" ; ");
-		log.warn(`An earlier CreateUserPool attempt for ${logicalId} failed without a definite answer, and Cognito may have created a pool then that no cdkd state records. ${candidates.length} user pool(s) named ${v(poolName)} were created between ${since} and ${until}: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. cdkd does not adopt or delete them: a pool name does not prove which deploy created it. Creating a new pool now, so the new pool and the candidate(s) above will ALL be named ${v(poolName)} -- Cognito allows duplicate names. First inspect each candidate (its user count, creation date and tags): ${inspect}. Only after confirming a pool is this deploy's orphan and not another deploy's, delete it: ${deletion}.${incomplete}`);
+		log.warn(`${lead}, and Cognito may have created a pool then that no cdkd state records. ${candidates.length} user pool(s) named ${v(poolName)} were created between ${since} and ${until}: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. cdkd does not adopt or delete them: a pool name does not prove which deploy created it. ${replayed ? `The pool the create returned and the candidate(s) above are ALL named ${v(poolName)}` : `Creating a new pool now, so the new pool and the candidate(s) above will ALL be named ${v(poolName)}`} -- Cognito allows duplicate names. First inspect each candidate (its user count, creation date and tags): ${inspect}. Only after confirming a pool is this deploy's orphan and not another deploy's, delete it: ${deletion}.${incomplete}`);
 	}
 	async applyMfaConfig(physicalId, properties, declaredMfaConfiguration, options = {}) {
 		const request = buildMfaConfigRequest(physicalId, properties, this.logger, declaredMfaConfiguration, options.maskSecrets ?? ((text) => text));
@@ -30887,6 +30985,8 @@ var AppSyncProvider = class {
 			}
 			createdApiId = response.graphqlApi?.apiId;
 			const apiId = response.graphqlApi.apiId;
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await this.reportPossibleOrphanApis(logicalId, input, replayWindow, maskerOrIdentity(context?.maskSecrets), apiId);
 			const arn = response.graphqlApi.arn;
 			const graphQLUrl = response.graphqlApi.uris?.["GRAPHQL"];
 			const envRecord = await this.applyEnvironmentVariables(apiId, resourceType, logicalId, properties, void 0, context?.replayingState === true, maskerOrIdentity(context?.maskSecrets));
@@ -30928,8 +31028,10 @@ var AppSyncProvider = class {
 		}
 		return region ? aws` --region ${region}` : aws``;
 	}
-	async reportPossibleOrphanApis(logicalId, input, window, mask) {
+	async reportPossibleOrphanApis(logicalId, input, window, mask, returnedId) {
 		const since = new Date(window.floorMs).toISOString();
+		const lead = ambiguousAttemptLead("CreateGraphqlApi", logicalId, window);
+		const replayed = window.replayedInSend === true;
 		const name = mask(String(input.name));
 		const wantedType = input.apiType ?? "GRAPHQL";
 		const candidates = [];
@@ -30942,7 +31044,7 @@ var AppSyncProvider = class {
 					maxResults: 25,
 					...nextToken && { nextToken }
 				}));
-				for (const api of page.graphqlApis ?? []) if (api.apiId && api.name === input.name && (api.apiType ?? "GRAPHQL") === wantedType && !graphqlApisCreatedByThisProcess.has(api.apiId)) candidates.push(api.apiId);
+				for (const api of page.graphqlApis ?? []) if (api.apiId && api.name === input.name && (api.apiType ?? "GRAPHQL") === wantedType && api.apiId !== returnedId && !graphqlApisCreatedByThisProcess.has(api.apiId)) candidates.push(api.apiId);
 				nextToken = page.nextToken;
 				pages++;
 			} while (nextToken && pages < MAX_GRAPHQL_API_LIST_PAGES);
@@ -30950,12 +31052,12 @@ var AppSyncProvider = class {
 		} catch (error) {
 			const failure = describeAwsFailure(error);
 			this.logger.debug(mask(`ListGraphqlApis failed with: ${failure.detail}`));
-			this.logger.warn(mask(`An earlier CreateGraphqlApi attempt for ${logicalId} failed without a definite answer (at ${since}), so AppSync may have created an API named ${name} that no cdkd state records, and cdkd could not list APIs to look for it (${failure.summary}). Creating a new API; check for another API of that name.`));
+			this.logger.warn(mask(`${lead} (at ${since}), so AppSync may have created an API named ${name} that no cdkd state records, and cdkd could not list APIs to look for it (${failure.summary}). ${replayed ? "Check" : "Creating a new API; check"} for another API of that name.`));
 			return;
 		}
 		const incomplete = truncated ? ` The search was incomplete: the API list was cut at ${MAX_GRAPHQL_API_LIST_PAGES} pages.` : "";
 		if (candidates.length === 0) {
-			const line = mask(`No listed GraphQL API named ${name} is unrecorded by this deploy, so the listing shows no orphan of the earlier ambiguous CreateGraphqlApi attempt for ${logicalId} (at ${since}).${incomplete}`);
+			const line = mask(`No listed GraphQL API named ${name} is unrecorded by this deploy, so the listing shows no orphan of the ${replayed ? "replayed" : "earlier ambiguous"} CreateGraphqlApi attempt for ${logicalId} (at ${since}).${incomplete}`);
 			if (truncated) this.logger.warn(line);
 			else this.logger.debug(line);
 			return;
@@ -30963,7 +31065,7 @@ var AppSyncProvider = class {
 		const shown = candidates.slice(0, MAX_REPORTED_ORPHAN_APIS);
 		const aws = pasteableAwsCommand(mask);
 		const region = await this.regionArg(aws);
-		this.logger.warn(mask(`An earlier CreateGraphqlApi attempt for ${logicalId} failed without a definite answer (at ${since}), and AppSync may have created an API then that no cdkd state records. ${candidates.length} GraphQL API(s) named ${name} exist that this deploy did not record: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. AppSync reports no creation time, so any of them may instead be this stack's own recorded API, another stack's, or older than this deploy; cdkd does not adopt or delete them. Creating a new API. Inspect each before deleting anything: ${shown.map((apiId) => aws`aws appsync get-graphql-api --api-id ${apiId}${region}`.render()).join(" ; ")}${incomplete}`));
+		this.logger.warn(mask(`${lead} (at ${since}), and AppSync may have created an API then that no cdkd state records. ${candidates.length} GraphQL API(s) named ${name} exist that this deploy did not record: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. AppSync reports no creation time, so any of them may instead be this stack's own recorded API, another stack's, or older than this deploy; cdkd does not adopt or delete them. ${replayed ? "cdkd recorded the API the create returned." : "Creating a new API."} Inspect each before deleting anything: ${shown.map((apiId) => aws`aws appsync get-graphql-api --api-id ${apiId}${region}`.render()).join(" ; ")}${incomplete}`));
 	}
 	async deleteGraphQLApi(logicalId, physicalId, resourceType, context) {
 		this.logger.debug(`Deleting GraphQL API ${logicalId}: ${physicalId}`);
@@ -31164,6 +31266,8 @@ var AppSyncProvider = class {
 			}
 			apiKeyId = response.apiKey.id;
 			apiKeysCreatedByThisProcess.add(injectiveKey(apiId, apiKeyId));
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await this.reportPossibleOrphanApiKeys(logicalId, input, replayWindow, createMaskedLogSinks(this.logger, context?.maskSecrets));
 			this.logger.debug(`Successfully created ApiKey ${logicalId}: ${apiKeyId}`);
 		} catch (error) {
 			const cause = error instanceof Error ? error : void 0;
@@ -33836,6 +33940,9 @@ var KMSProvider = class {
 					inputDigest,
 					heldAtMs: Date.now()
 				});
+				createdKeyId = keyId;
+				const replayWindow = replayedSendWindow(result, attemptStartMs);
+				if (replayWindow !== void 0) await this.reportPossibleOrphanKeys(logicalId, input, replayWindow);
 			}
 			createdKeyId = keyId;
 			if (enableKeyRotation) {
@@ -33917,6 +34024,7 @@ var KMSProvider = class {
 	async reportPossibleOrphanKeys(logicalId, input, window) {
 		const since = new Date(window.floorMs).toISOString();
 		const until = new Date(window.ceilingMs).toISOString();
+		const lead = ambiguousAttemptLead("CreateKey", logicalId, window);
 		const pendingIds = new Set([...pendingKeys.values()].map((entry) => entry.keyId));
 		const ids = [];
 		let listTruncated = false;
@@ -33936,7 +34044,7 @@ var KMSProvider = class {
 		} catch (error) {
 			const failure = describeAwsFailure(error);
 			this.logger.debug(safeMsg`ListKeys failed with: ${failure.detail}`);
-			this.logger.warn(safeMsg`An earlier CreateKey attempt for ${logicalId} failed without a definite answer, so KMS may have created a key that no cdkd state records, and cdkd could not list keys to look for it (${failure.summary}). Check the account's customer managed keys created between ${since} and ${until}.`);
+			this.logger.warn(safeMsg`${lead}, so KMS may have created a key that no cdkd state records, and cdkd could not list keys to look for it (${failure.summary}). Check the account's customer managed keys created between ${since} and ${until}.`);
 			return;
 		}
 		const describable = ids.slice(-200).reverse();
@@ -33968,7 +34076,7 @@ var KMSProvider = class {
 		];
 		const incomplete = gaps.length > 0 ? ` The search was incomplete: ${gaps.join(", ")}.` : "";
 		if (candidates.length === 0) {
-			const line = safeMsg`An earlier CreateKey attempt for ${logicalId} failed without a definite answer; no listed customer managed key matching it was created between ${since} and ${until}.${incomplete}`;
+			const line = safeMsg`${lead}; no listed customer managed key matching it was created between ${since} and ${until}.${incomplete}`;
 			if (incomplete) this.logger.warn(line);
 			else this.logger.debug(line);
 			return;
@@ -33978,7 +34086,7 @@ var KMSProvider = class {
 		const shown = candidates.slice(0, MAX_REPORTED_ORPHANS);
 		const inspect = shown.map((keyId) => aws`aws kms describe-key --key-id ${keyId}${region}`.render()).join(" ; ");
 		const deletion = shown.map((keyId) => aws`aws kms schedule-key-deletion --key-id ${keyId}${region} --pending-window-in-days 7`.render()).join(" ; ");
-		this.logger.warn(safeMsg`An earlier CreateKey attempt for ${logicalId} failed without a definite answer, and KMS may have created a key then that no cdkd state records. ${candidates.length} customer managed key(s) created between ${since} and ${until} match this key's settings: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. cdkd does not adopt or delete them, because a key has no name or token that ties it to ${logicalId} -- another key with the same settings is indistinguishable. Creating a new key now, so the orphan (if any) and the new key will both exist. First inspect each candidate: ${inspect}. Only after confirming a key is this deploy's orphan and no other deploy uses it, schedule its deletion: ${deletion}.${incomplete}`);
+		this.logger.warn(safeMsg`${lead}, and KMS may have created a key then that no cdkd state records. ${candidates.length} customer managed key(s) created between ${since} and ${until} match this key's settings: ${shown.join(", ")}${candidates.length > shown.length ? ", ..." : ""}. cdkd does not adopt or delete them, because a key has no name or token that ties it to ${logicalId} -- another key with the same settings is indistinguishable. ${window.replayedInSend === true ? "cdkd recorded the key the create returned, so the orphan (if any) and that key both exist." : "Creating a new key now, so the orphan (if any) and the new key will both exist."} First inspect each candidate: ${inspect}. Only after confirming a key is this deploy's orphan and no other deploy uses it, schedule its deletion: ${deletion}.${incomplete}`);
 	}
 	async updateKey(logicalId, physicalId, resourceType, properties, previousProperties) {
 		this.logger.debug(`Updating KMS Key ${logicalId}: ${physicalId}`);
@@ -38417,14 +38525,13 @@ var EMRClusterProvider = class {
 				})),
 				Instances: this.toJobFlowInstancesConfig(properties["Instances"])
 			};
-			const orphanWindow = runJobFlowLatch.take(logicalId);
-			if (orphanWindow !== void 0) {
+			const reportOrphans = async (lookupWindow) => {
 				const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 				const aws = pasteableAwsCommand(log.mask);
 				const regionArg = await orphanCommandRegionArg(this.getClient(), aws);
 				const name = input.Name;
 				const protectedCluster = input.Instances?.TerminationProtected === true;
-				await reportPossibleOrphans(logicalId, orphanWindow, log, {
+				await reportPossibleOrphans(logicalId, lookupWindow, log, {
 					action: "RunJobFlow",
 					service: "EMR",
 					listAction: "ListClusters",
@@ -38432,8 +38539,8 @@ var EMRClusterProvider = class {
 					noun: "cluster(s)",
 					list: () => collectOrphanIds(async (marker) => {
 						const page = await this.getClient().send(new ListClustersCommand({
-							CreatedAfter: new Date(orphanWindow.floorMs),
-							CreatedBefore: new Date(orphanWindow.ceilingMs),
+							CreatedAfter: new Date(lookupWindow.floorMs),
+							CreatedBefore: new Date(lookupWindow.ceilingMs),
 							ClusterStates: LIVE_CLUSTER_STATES,
 							...marker && { Marker: marker }
 						}));
@@ -38441,12 +38548,14 @@ var EMRClusterProvider = class {
 							items: page.Clusters ?? [],
 							next: page.Marker
 						};
-					}, (c) => c.Id && c.Name === name && isInsideWindow(c.Status?.Timeline?.CreationDateTime, orphanWindow) && !clustersCreatedByThisProcess.has(c.Id) ? c.Id : void 0),
+					}, (c) => c.Id && c.Name === name && isInsideWindow(c.Status?.Timeline?.CreationDateTime, lookupWindow) && !clustersCreatedByThisProcess.has(c.Id) ? c.Id : void 0),
 					inspect: (id) => aws`aws emr describe-cluster --cluster-id ${id}${regionArg}`.render(),
 					remove: (id) => aws`aws emr terminate-clusters --cluster-ids ${id}${regionArg}`.render(),
 					removeVerb: protectedCluster ? `terminate it (this template turns termination protection on, so if describe-cluster shows it on for the candidate, first run ${aws`aws emr modify-cluster-attributes --cluster-id`.render()} ${commandHole("id")} ${aws`--no-termination-protected${regionArg}`.render()} with its id)` : "terminate it"
 				});
-			}
+			};
+			const orphanWindow = runJobFlowLatch.take(logicalId);
+			if (orphanWindow !== void 0) await reportOrphans(orphanWindow);
 			const attemptStartMs = Date.now();
 			let response;
 			try {
@@ -38457,6 +38566,8 @@ var EMRClusterProvider = class {
 			}
 			clusterId = response.JobFlowId;
 			if (clusterId) clustersCreatedByThisProcess.add(clusterId);
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await reportOrphans(replayWindow);
 			if (!clusterId) throw new ProvisioningError(`EMR RunJobFlow for ${logicalId} returned no JobFlowId`, resourceType, logicalId);
 			const cluster = await this.waitForClusterReady(clusterId, logicalId, resourceType);
 			this.logger.debug(`Successfully created EMR Cluster ${logicalId}: ${clusterId}`);
@@ -39098,13 +39209,12 @@ var EMRInstanceGroupConfigProvider = class {
 		let createdGroupId;
 		try {
 			const group = this.toInstanceGroupConfig(properties);
-			const orphanWindow = addInstanceGroupsLatch.take(logicalId);
-			if (orphanWindow !== void 0 && group.InstanceRole === "TASK") {
+			const reportOrphans = async (lookupWindow) => {
 				const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 				const aws = pasteableAwsCommand(log.mask);
 				const regionArg = await orphanCommandRegionArg(this.getClient(), aws);
 				const name = group.Name;
-				await reportPossibleOrphans(logicalId, orphanWindow, log, {
+				await reportPossibleOrphans(logicalId, lookupWindow, log, {
 					action: "AddInstanceGroups",
 					service: "EMR",
 					listAction: "ListInstanceGroups",
@@ -39119,12 +39229,14 @@ var EMRInstanceGroupConfigProvider = class {
 							items: page.InstanceGroups ?? [],
 							next: page.Marker
 						};
-					}, (item) => item.Id && item.InstanceGroupType === "TASK" && (name === void 0 || item.Name === name) && isInsideWindow(item.Status?.Timeline?.CreationDateTime, orphanWindow) && !groupsCreatedByThisProcess.has(item.Id) ? item.Id : void 0),
+					}, (item) => item.Id && item.InstanceGroupType === "TASK" && (name === void 0 || item.Name === name) && isInsideWindow(item.Status?.Timeline?.CreationDateTime, lookupWindow) && !groupsCreatedByThisProcess.has(item.Id) ? item.Id : void 0),
 					inspect: () => aws`aws emr list-instance-groups --cluster-id ${jobFlowId}${regionArg}`.render(),
 					remove: (id) => aws`aws emr modify-instance-groups --cluster-id ${jobFlowId} --instance-groups InstanceGroupId=${id},InstanceCount=0${regionArg}`.render(),
 					removeVerb: "scale it to zero, which releases its instances (EMR has no call that removes an instance group; it ends with its cluster)"
 				});
-			}
+			};
+			const orphanWindow = addInstanceGroupsLatch.take(logicalId);
+			if (orphanWindow !== void 0 && group.InstanceRole === "TASK") await reportOrphans(orphanWindow);
 			const attemptStartMs = Date.now();
 			let response;
 			try {
@@ -39139,6 +39251,8 @@ var EMRInstanceGroupConfigProvider = class {
 			const groupId = response.InstanceGroupIds?.[0];
 			if (groupId) groupsCreatedByThisProcess.add(groupId);
 			createdGroupId = groupId;
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0 && group.InstanceRole === "TASK") await reportOrphans(replayWindow);
 			if (!groupId) throw new ProvisioningError(`EMR AddInstanceGroups for ${logicalId} returned no instance group id`, resourceType, logicalId);
 			await this.waitForGroupReady(jobFlowId, groupId, logicalId, resourceType, toNumber$1(properties["InstanceCount"]) ?? 0);
 			this.logger.debug(`Successfully added EMR instance group ${logicalId}: ${groupId}`);
@@ -39394,13 +39508,12 @@ var EMRInstanceFleetConfigProvider = class {
 		let createdFleetId;
 		try {
 			const fleet = this.toInstanceFleetConfig(properties);
-			const orphanWindow = addInstanceFleetLatch.take(logicalId);
-			if (orphanWindow !== void 0 && fleet.InstanceFleetType === "TASK") {
+			const reportOrphans = async (lookupWindow) => {
 				const log = createMaskedLogSinks(this.logger, context?.maskSecrets);
 				const aws = pasteableAwsCommand(log.mask);
 				const regionArg = await orphanCommandRegionArg(this.getClient(), aws);
 				const name = fleet.Name;
-				await reportPossibleOrphans(logicalId, orphanWindow, log, {
+				await reportPossibleOrphans(logicalId, lookupWindow, log, {
 					action: "AddInstanceFleet",
 					service: "EMR",
 					listAction: "ListInstanceFleets",
@@ -39415,12 +39528,14 @@ var EMRInstanceFleetConfigProvider = class {
 							items: page.InstanceFleets ?? [],
 							next: page.Marker
 						};
-					}, (item) => item.Id && item.InstanceFleetType === "TASK" && (name === void 0 || item.Name === name) && isInsideWindow(item.Status?.Timeline?.CreationDateTime, orphanWindow) && !fleetsCreatedByThisProcess.has(item.Id) ? item.Id : void 0),
+					}, (item) => item.Id && item.InstanceFleetType === "TASK" && (name === void 0 || item.Name === name) && isInsideWindow(item.Status?.Timeline?.CreationDateTime, lookupWindow) && !fleetsCreatedByThisProcess.has(item.Id) ? item.Id : void 0),
 					inspect: () => aws`aws emr list-instance-fleets --cluster-id ${clusterId}${regionArg}`.render(),
 					remove: (id) => aws`aws emr modify-instance-fleet --cluster-id ${clusterId} --instance-fleet InstanceFleetId=${id},TargetOnDemandCapacity=0,TargetSpotCapacity=0${regionArg}`.render(),
 					removeVerb: "scale it to zero, which releases its instances (EMR has no call that removes an instance fleet; it ends with its cluster)"
 				});
-			}
+			};
+			const orphanWindow = addInstanceFleetLatch.take(logicalId);
+			if (orphanWindow !== void 0 && fleet.InstanceFleetType === "TASK") await reportOrphans(orphanWindow);
 			const attemptStartMs = Date.now();
 			let response;
 			try {
@@ -39435,6 +39550,8 @@ var EMRInstanceFleetConfigProvider = class {
 			const fleetId = response.InstanceFleetId;
 			if (fleetId) fleetsCreatedByThisProcess.add(fleetId);
 			createdFleetId = fleetId;
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0 && fleet.InstanceFleetType === "TASK") await reportOrphans(replayWindow);
 			if (!fleetId) throw new ProvisioningError(`EMR AddInstanceFleet for ${logicalId} returned no instance fleet id`, resourceType, logicalId);
 			await this.waitForFleetReady(clusterId, fleetId, logicalId, resourceType, this.targetCapacities(properties), {
 				onDemand: 0,
@@ -41943,6 +42060,8 @@ var DLMLifecyclePolicyProvider = class {
 			}
 			if (!response.PolicyId) throw new Error("CreateLifecyclePolicy did not return a PolicyId");
 			policiesCreatedByThisProcess.add(response.PolicyId);
+			const replayWindow = replayedSendWindow(response, attemptStartMs);
+			if (replayWindow !== void 0) await this.reportPossibleOrphanPolicies(logicalId, input, replayWindow, log);
 			let arn = "";
 			try {
 				arn = await this.fetchPolicyArn(response.PolicyId);
@@ -44223,4 +44342,4 @@ var ACMCertificateProvider = class {
 
 //#endregion
 export { ACMCertificateProvider, ASGProvider, AgentCoreBrowserProvider, AgentCoreCodeInterpreterProvider, AgentCoreEvaluatorProvider, AgentCoreRuntimeProvider, ApiGatewayProvider, ApiGatewayV2Provider, AppSyncProvider, BudgetsBudgetProvider, CloudFrontDistributionProvider, CloudFrontOACProvider, CloudFrontOAIProvider, CloudTrailProvider, CloudWatchAlarmProvider, CloudWatchAnomalyDetectorProvider, CodeBuildProvider, CodeCommitRepositoryProvider, CognitoUserPoolProvider, DLMLifecyclePolicyProvider, DocDBProvider, DocDBSubnetGroupProvider, DynamoDBGlobalTableProvider, DynamoDBTableProvider, EC2Provider, ECRProvider, ECSProvider, EFSProvider, ELBv2Provider, EMRClusterProvider, EMRInstanceFleetConfigProvider, EMRInstanceGroupConfigProvider, ElastiCacheProvider, EventBridgeBusProvider, EventBridgeRuleProvider, FSxFileSystemProvider, FirehoseProvider, GlueConnectionProvider, GlueCrawlerProvider, GlueJobProvider, GlueProvider, GlueSecurityConfigurationProvider, GlueTriggerProvider, GlueWorkflowProvider, IAMAccessKeyProvider, IAMInstanceProfileProvider, IAMManagedPolicyProvider, IAMPolicyProvider, IAMRoleProvider, IAMUserGroupProvider, KMSProvider, KinesisStreamConsumerProvider, KinesisStreamProvider, LambdaEventInvokeConfigProvider, LambdaEventSourceMappingProvider, LambdaFunctionProvider, LambdaLayerVersionProvider, LambdaMicrovmImageProvider, LambdaPermissionProvider, LambdaUrlProvider, LogsLogGroupProvider, NeptuneProvider, NestedStackProvider, PipesPipeProvider, RDSDBProxyEndpointProvider, RDSDBProxyProvider, RDSDBProxyTargetGroupProvider, RDSProvider, Route53Provider, S3BucketPolicyProvider, S3BucketProvider, S3DirectoryBucketProvider, S3TablesProvider, S3VectorsProvider, SNSSubscriptionProvider, SNSTopicPolicyProvider, SNSTopicProvider, SQSQueuePolicyProvider, SQSQueueProvider, SSMParameterProvider, SchedulerScheduleProvider, SecretsManagerSecretProvider, ServiceDiscoveryProvider, StepFunctionsProvider, WAFv2WebACLProvider, WaitConditionHandleProvider };
-//# sourceMappingURL=provider-classes-hW6X0dKh.js.map
+//# sourceMappingURL=provider-classes-Drnm0GAz.js.map