@go-to-k/cdkd 0.301.15 → 0.302.1

package/dist/{deploy-engine-Dy7N7-Il.js → deploy-engine-CYVt2NQR.js}

@@ -1,8 +1,8 @@
 import { r as getAwsClients, s as __exportAll } from "./aws-clients-B_CEQGE1.js";
-import { A as SECRET_REF_MAX_CODE_POINTS, C as getCurrentSkipPrefix, D as withStackName, E as withSkipPrefix, F as displayAwsMessage, G as truncateCodePoints, H as safeMsg, I as displayIdent, L as displaySafe, M as UNRENDERABLE, N as asIsMessage, O as withoutGeneratedFallbackName, R as displayStackName, S as generateResourceNameWithFallback, T as looksLikeCdkdGeneratedName, V as plainIdentOr, W as terminalSafe, a as safeStringify$1, b as explicitNamePropertyFor, c as isStdoutReservedForPayload, f as currentLogLineMasker, j as STACK_REF_MAX_CODE_POINTS, k as SAFE_MSG_ALTERED_CHAR, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, s as getLogger, t as VERBOSE_POINTER, v as applyDefaultNameForFallback, w as getCurrentStackName, x as generateResourceName, z as isPasteableIdent } from "./aws-failure-text-CdgZn80O.js";
-import { $ as protectedReplacementAdvice, $n as markReplayMayCollide, $t as ambientCredentialConfig, A as isQuotableImportValue, An as SHELL_ACTIVE, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as shellBoundedDisplay, Bt as formatLockOperation, Cn as StateError, Ct as RETRY_AUXILIARY_OWNER, Dn as normalizeAwsError, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as isInertUnquoted, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gn as isUpdateUnsupportedError, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as withheldTargetClause, Ht as recoveryCommandFlags, In as pasteableCommand, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as isNameCollisionErrorFrom, Kn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as physicalIdShownBesideCommand, M as quotedRemedyLogicalId, Mn as UNSHOWABLE_VALUE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as commandHole, Ot as hasCreatedBeforeFailure, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as plainOrDescribed, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, U as protectionFlipKey, Ut as sanitizeRecoveryValue, Vn as shellQuote, Vt as formatLockOwner, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isRecreateRetryableError, Yn as isNameCooldownError, Yt as producerRecordKey, Zn as isReplayedNameCollisionFrom, Zt as withPasteableAwsProfile, _r as markRedactedCause, _t as createMaskedLogSinks, ar as formatRetryClassificationSignals, at as startInterruptWatch, bn as ResourceUpdateNotSupportedError, bt as maskDeep, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dr as isTransientServerError, en as clientDefaultsFor, er as relayedNameCollision, f as removalWarning, fr as retryClassificationText, ft as logicalIdShown, gr as markNonRetryable, gt as stateOrphanRecordRemedy, hn as MalformedProducerRecordRefusalError, hr as isThrottlingError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jn as SHELL_ACTIVE_WHY, jt as markAuxiliaryFailure, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DynamicReferenceRegionAmbiguousError, lr as isIamPropagationError, m as withoutInjectedRemovals, mn as MacroExpansionError, mr as isMarkedNonRetryable, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as stripControlChars, on as CrossAccountSecretRefusalError, or as isAmbiguousCcHandlerErrorCode, ot as ElapsedBudgetRegistry, pn as LockError, rn as AssetError, sn as DependencyError, sr as isAmbiguousOutcomeError, st as monotonicNowMs, tn as credentialFingerprint, tr as escapeRegExp$3, un as IntrinsicResolutionRefusalError, ur as isRetryableTransientError, ut as compositeIdSeparatorRefusal, vn as ProvisioningError, vr as wrapMaskedAwsError, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as SynthesisError, wt as carryCreatedBeforeFailure, xt as maskerOrIdentity, yn as ResourceTimeoutError, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as quotedOrDescribed, zt as formatLockExpiry } from "./iam-policy-targets-Dap4bLyq.js";
+import { A as isNameGeneration, B as SECRET_REF_MAX_CODE_POINTS, D as getCurrentStackInstanceId, E as getCurrentSkipPrefix, F as withSkipPrefix, G as displayAwsMessage, H as UNRENDERABLE, I as withStackScope, J as displayStackName, K as displayIdent, L as withStackScopeBeforeStateRead, N as stackInstanceNameSuffix, O as getCurrentStackName, P as withNameGeneration, Q as safeMsg, R as withoutGeneratedFallbackName, S as fallbackNamePropertyFor, T as generatedNameFor, U as asIsMessage, V as STACK_REF_MAX_CODE_POINTS, Y as isPasteableIdent, Z as plainIdentOr, a as safeStringify$1, c as isStdoutReservedForPayload, et as terminalSafe, f as currentLogLineMasker, j as looksLikeCdkdGeneratedName, m as getLiveRenderer, n as describeAwsFailure, p as installLogLineMaskerSource, q as displaySafe, s as getLogger, t as VERBOSE_POINTER, tt as truncateCodePoints, v as applyDefaultNameForFallback, w as generateResourceNameWithFallback, x as explicitNamePropertyFor, y as currentNameGeneration, z as SAFE_MSG_ALTERED_CHAR } from "./aws-failure-text-e_ddrDDo.js";
+import { $ as protectedReplacementAdvice, $n as isReplayedNameCollisionFrom, $t as ambientCredentialConfig, A as isQuotableImportValue, At as isAuxiliaryMarkOf, B as isTerminalDeleteFailure, Bn as plainOrDescribed, Bt as formatLockOperation, Ct as RETRY_AUXILIARY_OWNER, Dt as createdResourceIdentityBeforeFailure, E as assertRegionMatch, Et as createdBeforeFailure, F as resolveExplicitPhysicalId, Fn as commandHole, Ft as UNREPRODUCIBLE_LOCK_CLAUSE, G as runDeleteAttempt, Gt as DEFAULT_STATE_PREFIX, H as observeThenDisableProtection, Hn as shellBoundedDisplay, Ht as recoveryCommandFlags, It as buildForceUnlockCommand, J as DELETION_PROTECTION_DOC_POINTER, Jn as hasReplayMayCollide, Kt as injectiveKey, L as ProtectionFlipRegistry, Ln as isInertUnquoted, M as quotedRemedyLogicalId, Mn as SHELL_ACTIVE, Mt as markCreatedBeforeFailure, N as refusalTypeShown, Nn as SHELL_ACTIVE_WHY, On as isSoftAbort, Ot as hasCreatedBeforeFailure, Pn as UNSHOWABLE_VALUE, Pt as replayMadeAnotherResource, Q as pasteableAwsCommand, Qn as isRecreateRetryableError, Qt as ambientClientDefaults, R as compensateProtectionFlip, Rn as pasteableCommand, St as withDerivedNameMasks, T as RESOURCE_NOT_FOUND, Tn as SynthesisError, U as protectionFlipKey, Un as shellQuote, Ut as sanitizeRecoveryValue, Vn as quotedOrDescribed, Vt as formatLockOwner, Wn as withheldTargetClause, Wt as CUSTOM_RESOURCE_RESPONSE_PREFIX, Xn as isNameCollisionErrorFrom, Yt as producerRecordKey, Zn as isNameCooldownError, Zt as withPasteableAwsProfile, _r as isThrottlingError, _t as createMaskedLogSinks, at as startInterruptWatch, bn as ResourceTimeoutError, br as wrapMaskedAwsError, bt as maskDeep, cr as isAmbiguousCcHandlerErrorCode, ct as canonicalizeRoute53QueryName, d as prepareRemovalForUpdate, dn as IntrinsicResolutionRefusalError, dr as isIamPropagationError, en as clientDefaultsFor, f as removalWarning, fr as isRetryableTransientError, ft as logicalIdShown, gn as MalformedProducerRecordRefusalError, gr as isMarkedNonRetryable, gt as stateOrphanRecordRemedy, hn as MacroExpansionError, ht as segmentAfterAnchor, i as holdsSecretDerivedEntry, in as CdkdError, ir as stripControlChars, it as isInterruptedWaitError, j as normalizeAwsTagsToCfn, jt as markAuxiliaryFailure, kn as normalizeAwsError, kt as isAuxiliaryFailure, l as withUnchangedSecretPrincipalLists, ln as DeploymentNotApprovedError, lr as isAmbiguousOutcomeError, m as withoutInjectedRemovals, mn as LockError, mr as retryClassificationText, mt as resourceTypeShown, nn as AccountIdUnavailableError, nr as relayedNameCollision, on as CrossAccountSecretRefusalError, ot as ElapsedBudgetRegistry, pr as isTransientServerError, qn as isUpdateUnsupportedError, rn as AssetError, rr as escapeRegExp$3, sn as DependencyError, sr as formatRetryClassificationSignals, st as monotonicNowMs, tn as credentialFingerprint, tr as markReplayMayCollide, un as DynamicReferenceRegionAmbiguousError, ut as compositeIdSeparatorRefusal, vr as markNonRetryable, vt as createMaskedRetryLogger, w as withoutServerErrorRetries, wn as StateError, wt as carryCreatedBeforeFailure, xn as ResourceUpdateNotSupportedError, xt as maskerOrIdentity, yn as ProvisioningError, yr as markRedactedCause, yt as isSecretDerivedValue, z as deleteWithProtectionCompensation, zn as physicalIdShownBesideCommand, zt as formatLockExpiry } from "./iam-policy-targets-CmHNH1DY.js";
 import { a as setAssumedRoleCredentials, i as getPreAssumeEnvCredentials, n as awsClientDefaults, o as setPreAssumeEnvCredentials, r as getAssumedRoleCredentials, s as ambientRegion, t as SECOND_ROLE_PUBLISH_REFUSAL } from "./aws-client-defaults-DBXBcg0J.js";
-import { t as getCdkdVersion } from "./version-DadUoJjK.js";
+import { t as getCdkdVersion } from "./version-CaejipV3.js";
 import { createHash, randomUUID } from "node:crypto";
 import { AsyncLocalStorage } from "node:async_hooks";
 import { CreateBucketCommand, DeleteObjectCommand, DeleteObjectsCommand, GetBucketLifecycleConfigurationCommand, GetBucketLocationCommand, GetBucketReplicationCommand, GetObjectCommand, HeadBucketCommand, HeadObjectCommand, ListObjectVersionsCommand, ListObjectsV2Command, NoSuchKey, PutBucketEncryptionCommand, PutBucketLifecycleConfigurationCommand, PutBucketPolicyCommand, PutObjectCommand, PutPublicAccessBlockCommand, S3Client, S3ServiceException } from "@aws-sdk/client-s3";
@@ -4577,7 +4577,8 @@ var WorkGraph = class {
 							nodeId: node.id,
 							error
 						});
-						this.logger.error(`Failed: ${node.id}: ${describeAwsFailure(error).detail}`);
+						if (isSoftAbort(error)) this.logger.debug(safeMsg`Not approved: ${node.id}`);
+						else this.logger.error(`Failed: ${node.id}: ${describeAwsFailure(error).detail}`);
 					}).finally(() => {
 						active[node.type]--;
 						dispatch();
@@ -4591,6 +4592,12 @@ var WorkGraph = class {
 					}
 					if (errors.length > 0) {
 						const skippedCount = [...this.nodes.values()].filter((n) => n.state === "skipped").length;
+						if (errors.every((e) => isSoftAbort(e.error))) {
+							const lines = errors.map((e) => e.error.message);
+							if (skippedCount > 0) lines.push(`${skippedCount} node(s) depending on a declined stack were skipped.`);
+							reject(errors.length === 1 && skippedCount === 0 ? errors[0].error : new DeploymentNotApprovedError(lines.join("\n")));
+							return;
+						}
 						const msg = errors.map((e) => `  - ${e.nodeId}: ${describeAwsFailure(e.error).detail}`).join("\n");
 						reject(/* @__PURE__ */ new Error(`${errors.length} node(s) failed${skippedCount > 0 ? `, ${skippedCount} skipped` : ""}:\n${msg}`));
 						return;
@@ -4803,7 +4810,8 @@ const STATE_SCHEMA_VERSIONS_READABLE = [
 	9,
 	10,
 	11,
-	12
+	12,
+	13
 ];
 function hasUnverifiableParameterRefusal(record) {
 	return record?.observedBaselineRefused === true && record.observedBaselineRefusalReason === "unverifiable-parameter";
@@ -4851,6 +4859,13 @@ function importableOutputs(state) {
 function exportNamesCarriedFrom(previous) {
 	return previous.exportNames === void 0 ? {} : { exportNames: previous.exportNames };
 }
+function stackInstanceIdCarriedFrom(previous) {
+	return {
+		...previous?.stackInstanceId !== void 0 && { stackInstanceId: previous.stackInstanceId },
+		...previous?.retiredNameGenerations !== void 0 && { retiredNameGenerations: previous.retiredNameGenerations },
+		...previous?.supersededResources !== void 0 && { supersededResources: previous.supersededResources }
+	};
+}
 function skippedOutputsCarriedFrom(previous) {
 	return previous.skippedOutputs === void 0 ? {} : { skippedOutputs: previous.skippedOutputs };
 }
@@ -4942,6 +4957,7 @@ function refuseMalformedOperation(shownStack, where, op) {
 		if (o["changeType"] !== "UPDATE") refuseMalformed(shownStack, `${where}.replacementOrphaned is only valid on an UPDATE.`);
 	}
 	if (o["wasReplaced"] !== void 0 && typeof o["wasReplaced"] !== "boolean") fail("wasReplaced", o["wasReplaced"], "a boolean when present");
+	if (o["nameGeneration"] !== void 0 && !(typeof o["nameGeneration"] === "number" && Number.isSafeInteger(o["nameGeneration"]) && o["nameGeneration"] >= 0)) fail("nameGeneration", o["nameGeneration"], "a non-negative integer when present");
 	if (o["oldDeletedBeforeCreate"] !== void 0 && typeof o["oldDeletedBeforeCreate"] !== "boolean") fail("oldDeletedBeforeCreate", o["oldDeletedBeforeCreate"], "a boolean when present");
 	if (o["oldResourceMaySurvive"] !== void 0 && !["kept", "unconfirmed"].includes(o["oldResourceMaySurvive"])) fail("oldResourceMaySurvive", o["oldResourceMaySurvive"], "kept or unconfirmed when present");
 	if (o["physicalIdRecoveredFromError"] !== void 0 && typeof o["physicalIdRecoveredFromError"] !== "boolean") fail("physicalIdRecoveredFromError", o["physicalIdRecoveredFromError"], "a boolean when present");
@@ -5099,6 +5115,53 @@ async function notifyStateSaved(stackName, region) {
 	await stateSavedObserver.getStore()?.(stackName, region);
 }
 
+//#endregion
+//#region src/state/stack-instance-id.ts
+const STACK_INSTANCE_SIBLING_VERSION = 1;
+const STACK_INSTANCE_SIBLING_FILE = "stack-instance.json";
+const STACK_INSTANCE_ID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+function isStackInstanceId(value) {
+	return typeof value === "string" && STACK_INSTANCE_ID_PATTERN.test(value);
+}
+function stackInstanceSiblingBody(id) {
+	return JSON.stringify({
+		stackInstanceVersion: 1,
+		stackInstanceId: id
+	}, null, 2);
+}
+function parseStackInstanceSibling(body) {
+	let raw;
+	try {
+		raw = JSON.parse(body);
+	} catch {
+		return null;
+	}
+	if (typeof raw !== "object" || raw === null) return null;
+	const doc = raw;
+	if (doc["stackInstanceVersion"] !== 1) return null;
+	return isStackInstanceId(doc["stackInstanceId"]) ? doc["stackInstanceId"] : null;
+}
+var MalformedStackInstanceIdError = class extends Error {
+	constructor(stackLabel) {
+		super(`The state record of ${stackLabel} holds a stackInstanceId that is not a well-formed id. cdkd does not guess which lifetime of the stack it names, since names derive from it; restore the field from an earlier version of state.json.`);
+		this.name = "MalformedStackInstanceIdError";
+	}
+};
+function stackInstanceIdOf(state, stackLabel) {
+	const value = state?.stackInstanceId;
+	if (value === void 0) return void 0;
+	if (!isStackInstanceId(value)) throw new MalformedStackInstanceIdError(stackLabel);
+	return value;
+}
+const STACK_INSTANCE_ID_WITHHELD = "<withheld>";
+function withStackInstanceIdWithheld(state) {
+	if (state === null || typeof state !== "object" || state.stackInstanceId === void 0) return state;
+	return {
+		...state,
+		stackInstanceId: STACK_INSTANCE_ID_WITHHELD
+	};
+}
+
 //#endregion
 //#region src/state/cross-prefix-stack-scan.ts
 function journalCanOwnResources(journal) {
@@ -5110,6 +5173,8 @@ function recordCanOwnResources(record, journal) {
 	if (Object.keys(resources).length > 0) return true;
 	const orphans = record.orphans;
 	if (orphans !== void 0 && (!Array.isArray(orphans) || orphans.length > 0)) return true;
+	const superseded = record.supersededResources;
+	if (superseded !== void 0 && (!Array.isArray(superseded) || superseded.length > 0)) return true;
 	if (journal === null) return false;
 	const segments = journal.segments;
 	if (!Array.isArray(segments)) return true;
@@ -5616,6 +5681,7 @@ function legacyProbeBelongsTo(probe, region) {
 }
 const KEPT_AT_CLOCK_TOLERANCE_MS = 2e3;
 const ROLLBACK_JOURNAL_OBJECT_DESCRIPTION = "the rollback journal, whose `failedOperations[].attemptedProperties` records the properties of the failed write verbatim";
+const STACK_INSTANCE_OBJECT_DESCRIPTION = "the write-ahead stack instance id, from which a stack's generated resource names derive";
 const STATE_RECORD_OBJECT_DESCRIPTION = "the stack's state record, which carries every resource's recorded properties and attributes";
 var S3StateBackend = class S3StateBackend {
 	logger = getLogger().child("S3StateBackend");
@@ -5627,6 +5693,7 @@ var S3StateBackend = class S3StateBackend {
 	resolveInFlight = null;
 	journalsReadAbsent = /* @__PURE__ */ new Set();
 	journalTouches = /* @__PURE__ */ new Map();
+	pendingStackInstanceSiblings = /* @__PURE__ */ new Map();
 	constructor(s3Client, config, clientOpts = {}) {
 		this.s3Client = s3Client;
 		this.config = config;
@@ -5684,6 +5751,9 @@ var S3StateBackend = class S3StateBackend {
 	async purgeRollbackJournalVersions(stackName, region) {
 		await this.purgeNoncurrentVersions([this.rollbackJournalKey(stackName, region)], { objectDescription: ROLLBACK_JOURNAL_OBJECT_DESCRIPTION });
 	}
+	getStackInstanceKey(stackName, region) {
+		return `${this.config.prefix}/${stackName}/${region}/${STACK_INSTANCE_SIBLING_FILE}`;
+	}
 	getCreateTokenLedgerKey(stackName, region) {
 		return `${this.config.prefix}/${stackName}/${region}/create-tokens.json`;
 	}
@@ -5798,7 +5868,8 @@ var S3StateBackend = class S3StateBackend {
 		const { expectedEtag, migrateLegacy } = options;
 		const body = {
 			...state,
-			version: 12,
+			...stackInstanceIdCarriedFrom(state),
+			version: 13,
 			stackName,
 			region
 		};
@@ -5827,6 +5898,12 @@ var S3StateBackend = class S3StateBackend {
 				this.logger.warn(`Migrated stack ${this.displayName(stackName)} to new key, but failed to delete legacy key: ${errorDetail$2(deleteError)}`);
 			}
 			await notifyStateSaved(stackName, region);
+			const siblingKey = this.getStackInstanceKey(stackName, region);
+			const pendingId = this.pendingStackInstanceSiblings.get(siblingKey);
+			if (pendingId !== void 0 && body.stackInstanceId === pendingId) {
+				this.pendingStackInstanceSiblings.delete(siblingKey);
+				await this.dropStackInstanceSiblingAfterSave(stackName, region);
+			}
 			return response.ETag;
 		} catch (error) {
 			if (error.name === "PreconditionFailed") throw new StateError(`State has been modified by another process. Expected ETag: ${expectedEtag}, but state has changed.`, error instanceof Error ? error : void 0);
@@ -5840,6 +5917,7 @@ var S3StateBackend = class S3StateBackend {
 	async deleteState(stackName, region) {
 		await this.ensureClientForBucket();
 		await this.deleteCreateTokenLedger(stackName, region);
+		await this.deleteStackInstanceSibling(stackName, region);
 		try {
 			this.logger.debug(`Deleting state: ${this.stackRef(stackName, region)}`);
 			await this.s3Client.send(new DeleteObjectCommand({
@@ -5868,7 +5946,7 @@ var S3StateBackend = class S3StateBackend {
 			});
 			throw new StateError(`Failed to delete state for stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}`, normalized);
 		} finally {
-			await this.deleteRollbackJournal(stackName, region);
+			await Promise.all([this.deleteRollbackJournal(stackName, region), this.purgeNoncurrentVersions([this.getStackInstanceKey(stackName, region)], { objectDescription: STACK_INSTANCE_OBJECT_DESCRIPTION })]);
 		}
 	}
 	async purgeDeletedStateHistory(stackName, region) {
@@ -6413,6 +6491,102 @@ var S3StateBackend = class S3StateBackend {
 			throw new StateError(`Failed to delete the create-token ledger for stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}. The state record was left in place; re-run once the ledger can be deleted.`, normalized);
 		}
 	}
+	async stackInstanceIdForFirstWrite(stackName, region, options) {
+		const key = this.getStackInstanceKey(stackName, region);
+		const read = async () => this.readSiblingId(key, stackName, region);
+		try {
+			const existing = await read();
+			if (existing !== null) {
+				this.pendingStackInstanceSiblings.set(key, existing);
+				this.logger.debug(safeMsg`Reusing the write-ahead stack instance id of ${displayStackName(stackName)}`);
+				return existing;
+			}
+			const minted = randomUUID();
+			if (!options.writeAhead) return minted;
+			await this.ensureClientForBucket();
+			const body = stackInstanceSiblingBody(minted);
+			const put = async () => this.s3Client.send(new PutObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key,
+				Body: body,
+				ContentLength: Buffer.byteLength(body),
+				ContentType: "application/json",
+				IfNoneMatch: "*"
+			}));
+			try {
+				try {
+					await put();
+				} catch (error) {
+					if (!isConditionalConflict(error)) throw error;
+					await put();
+				}
+			} catch (error) {
+				if (isNotImplemented(error)) {
+					await this.putRawObject(key, body);
+					this.pendingStackInstanceSiblings.set(key, minted);
+					return minted;
+				}
+				if (!isConditionFailure(error)) throw error;
+				const winner = await read();
+				if (winner === null) throw error;
+				this.pendingStackInstanceSiblings.set(key, winner);
+				return winner;
+			}
+			this.pendingStackInstanceSiblings.set(key, minted);
+			return minted;
+		} catch (error) {
+			if (error instanceof StateError) throw error;
+			throw this.stackInstanceSiblingError(stackName, region, error, "write");
+		}
+	}
+	stackInstanceSiblingError(stackName, region, error, access) {
+		const normalized = normalizeAwsError(error, { bucket: this.config.bucket });
+		return new StateError(`Failed to ${access === "write" ? "read or write" : "read"} the write-ahead stack instance id of stack ${this.stackRef(stackName, region)} (${STACK_INSTANCE_SIBLING_FILE} beside its state.json): ${errorDetail$2(normalized)}. ` + (access === "write" ? "Nothing was created; re-run once the state bucket can be written." : "Nothing was changed; re-run once the state bucket can be read."), normalized);
+	}
+	async readSiblingId(key, stackName, region) {
+		const body = await this.getRawObject(key);
+		if (body === null) return null;
+		const id = parseStackInstanceSibling(body);
+		if (id === null) throw new StateError(`The write-ahead stack instance id of stack ${this.stackRef(stackName, region)} (${STACK_INSTANCE_SIBLING_FILE} beside its state.json) is in a format this cdkd version cannot read; upgrade cdkd, or delete that object if it is damaged`);
+		return id;
+	}
+	async readStackInstanceSibling(stackName, region) {
+		try {
+			return await this.readSiblingId(this.getStackInstanceKey(stackName, region), stackName, region) ?? void 0;
+		} catch (error) {
+			if (error instanceof StateError) throw error;
+			throw this.stackInstanceSiblingError(stackName, region, error, "read");
+		}
+	}
+	async deleteStackInstanceSibling(stackName, region) {
+		await this.ensureClientForBucket();
+		const key = this.getStackInstanceKey(stackName, region);
+		this.pendingStackInstanceSiblings.delete(key);
+		try {
+			await this.s3Client.send(new DeleteObjectCommand({
+				Bucket: this.config.bucket,
+				...await this.ownerParam(),
+				Key: key
+			}));
+		} catch (error) {
+			if (isNoSuchKey(error) || error.name === "NotFound") return;
+			const normalized = normalizeAwsError(error, {
+				bucket: this.config.bucket,
+				operation: "DeleteObject"
+			});
+			throw new StateError(`Failed to delete the write-ahead stack instance id for stack ${this.stackRef(stackName, region)}: ${errorDetail$2(normalized)}. The state record was left in place; re-run once that object can be deleted.`, normalized);
+		}
+	}
+	async dropStackInstanceSiblingAfterSave(stackName, region) {
+		try {
+			await this.deleteStackInstanceSibling(stackName, region);
+		} catch (error) {
+			this.logger.debug(safeMsg`Could not delete the write-ahead stack instance id of ${displayStackName(stackName)}: ${describeAwsFailure(error).summary}`);
+			return;
+		}
+		await this.purgeNoncurrentVersions([this.getStackInstanceKey(stackName, region)], { objectDescription: STACK_INSTANCE_OBJECT_DESCRIPTION });
+	}
 	async loadRollbackJournal(stackName, region) {
 		const key = this.rollbackJournalKey(stackName, region);
 		const touches = this.journalTouches.get(key) ?? 0;
@@ -6611,6 +6785,7 @@ var S3StateBackend = class S3StateBackend {
 		if (raw === region) return { state };
 		if (raw === void 0) return { state: {
 			...state,
+			...stackInstanceIdCarriedFrom(state),
 			region
 		} };
 		const kind = describeRegionValueKind(raw);
@@ -6619,6 +6794,7 @@ var S3StateBackend = class S3StateBackend {
 		return {
 			state: {
 				...state,
+				...stackInstanceIdCarriedFrom(state),
 				region
 			},
 			divergentBodyRegion: raw
@@ -13577,62 +13753,21 @@ function sentIdentifierIs(requested, recorded, observed, physicalId) {
 		return sent !== void 0 && heldAt(recorded, observed, [key]).value === sent;
 	});
 }
+const derivedEntry = (resourceType, file) => ({
+	file,
+	source: `generatedNameFor('${resourceType}', logicalId)`,
+	derive: (id) => generatedNameFor(resourceType, id)
+});
 const DERIVED_GENERATED_NAMES = {
-	"AWS::AutoScaling::AutoScalingGroup": {
-		file: "asg-provider.ts",
-		source: "generateResourceName(logicalId, { maxLength: 255 })",
-		derive: (id) => generateResourceName(id, { maxLength: 255 })
-	},
-	"AWS::CodeCommit::Repository": {
-		file: "codecommit-repository-provider.ts",
-		source: "generateResourceName(logicalId, { maxLength: 100 })",
-		derive: (id) => generateResourceName(id, { maxLength: 100 })
-	},
-	"AWS::DynamoDB::GlobalTable": {
-		file: "dynamodb-globaltable-provider.ts",
-		source: "generateResourceName(logicalId, { maxLength: 255 })",
-		derive: (id) => generateResourceName(id, { maxLength: 255 })
-	},
-	"AWS::Logs::LogGroup": {
-		file: "logs-loggroup-provider.ts",
-		source: "`/cdkd/${generateResourceName(logicalId, { maxLength: 506, allowedPattern: /[^a-zA-Z0-9-/_]/g })}`",
-		derive: (id) => `/cdkd/${generateResourceName(id, {
-			maxLength: 506,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		})}`
-	},
-	"AWS::RDS::DBProxy": {
-		file: "rds-dbproxy-provider.ts",
-		source: "generateResourceName(logicalId, { maxLength: 64 })",
-		derive: (id) => generateResourceName(id, { maxLength: 64 })
-	},
-	"AWS::RDS::DBProxyEndpoint": {
-		file: "rds-dbproxy-endpoint-provider.ts",
-		source: "generateResourceName(logicalId, { maxLength: 64 })",
-		derive: (id) => generateResourceName(id, { maxLength: 64 })
-	},
-	"AWS::S3::Bucket": {
-		file: "s3-bucket-provider.ts",
-		source: "generateResourceName(logicalId, {\n      maxLength: 63,\n      lowercase: true,\n      allowedPattern: /[^a-z0-9.-]/g,\n    })",
-		derive: (id) => generateResourceName(id, {
-			maxLength: 63,
-			lowercase: true,
-			allowedPattern: /[^a-z0-9.-]/g
-		})
-	},
-	"AWS::Scheduler::Schedule": {
-		file: "scheduler-schedule-provider.ts",
-		source: "generateResourceName(logicalId, { maxLength: 64 })",
-		derive: (id) => generateResourceName(id, { maxLength: 64 })
-	},
-	"AWS::SSM::Parameter": {
-		file: "ssm-parameter-provider.ts",
-		source: "`/${generateResourceName(logicalId, { maxLength: 1023, allowedPattern: /[^a-zA-Z0-9-/_]/g })}`",
-		derive: (id) => `/${generateResourceName(id, {
-			maxLength: 1023,
-			allowedPattern: /[^a-zA-Z0-9-/_]/g
-		})}`
-	}
+	"AWS::AutoScaling::AutoScalingGroup": derivedEntry("AWS::AutoScaling::AutoScalingGroup", "asg-provider.ts"),
+	"AWS::CodeCommit::Repository": derivedEntry("AWS::CodeCommit::Repository", "codecommit-repository-provider.ts"),
+	"AWS::DynamoDB::GlobalTable": derivedEntry("AWS::DynamoDB::GlobalTable", "dynamodb-globaltable-provider.ts"),
+	"AWS::Logs::LogGroup": derivedEntry("AWS::Logs::LogGroup", "logs-loggroup-provider.ts"),
+	"AWS::RDS::DBProxy": derivedEntry("AWS::RDS::DBProxy", "rds-dbproxy-provider.ts"),
+	"AWS::RDS::DBProxyEndpoint": derivedEntry("AWS::RDS::DBProxyEndpoint", "rds-dbproxy-endpoint-provider.ts"),
+	"AWS::S3::Bucket": derivedEntry("AWS::S3::Bucket", "s3-bucket-provider.ts"),
+	"AWS::Scheduler::Schedule": derivedEntry("AWS::Scheduler::Schedule", "scheduler-schedule-provider.ts"),
+	"AWS::SSM::Parameter": derivedEntry("AWS::SSM::Parameter", "ssm-parameter-provider.ts")
 };
 
 //#endregion
@@ -13720,6 +13855,52 @@ function replacementSentNameMoves(input) {
 		physicalId: input.physicalId
 	};
 }
+function generatedReplacementName(resourceType, createdVia, desired, logicalId) {
+	const declared = (property) => {
+		const value = desired?.[property];
+		return value !== void 0 && value !== null && value !== "";
+	};
+	const fallbackProperty = fallbackNamePropertyFor(resourceType);
+	if (createdVia === "cc-api" || GENERATED_NAME_VERBATIM.has(resourceType)) {
+		if (fallbackProperty === void 0 || declared(fallbackProperty)) return void 0;
+		const name = applyDefaultNameForFallback(logicalId, resourceType, desired ?? {}, "omit")[fallbackProperty];
+		return typeof name === "string" ? {
+			property: fallbackProperty,
+			name
+		} : void 0;
+	}
+	const rewrite = ownEntry$1(SENT_NAME_REWRITTEN, resourceType);
+	if (rewrite !== void 0) {
+		if (declared(rewrite.property)) return void 0;
+		return {
+			property: rewrite.property,
+			name: generateResourceNameWithFallback(void 0, logicalId, { maxLength: rewrite.maxLength })
+		};
+	}
+	const derived = ownEntry$1(DERIVED_GENERATED_NAMES, resourceType);
+	const property = explicitNamePropertyFor(resourceType);
+	if (derived === void 0 || property === void 0 || declared(property)) return void 0;
+	return {
+		property,
+		name: derived.derive(logicalId)
+	};
+}
+function replacementGeneratedNameMoves(input) {
+	if (getCurrentStackInstanceId() === void 0) return void 0;
+	if (input.oldResourceType !== input.newResourceType) return void 0;
+	const generated = generatedReplacementName(input.newResourceType, input.createdVia, input.desiredProperties, input.logicalId);
+	if (generated === void 0 || generated.name === "") return void 0;
+	const fold = CASE_INSENSITIVE_NAME_TYPES.has(input.newResourceType) ? (value) => value.toLowerCase() : (value) => value;
+	if (input.physicalId === "" || holderIdNames(fold(input.physicalId), fold(generated.name))) return;
+	return {
+		property: generated.property,
+		desiredName: generated.name,
+		heldName: void 0,
+		heldProperty: void 0,
+		physicalId: input.physicalId,
+		generated: true
+	};
+}
 function maskRewrittenSentName(resourceType, properties, logicalId, base) {
 	const sent = sentRewrittenName(resourceType, properties, logicalId);
 	if (sent === void 0) return base;
@@ -27247,7 +27428,7 @@ var CloudControlProvider = class {
 		const indeterminateGuard = await this.confirmDeleteTargetIdentity(logicalId, resourceType, physicalId, context);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-ClDYCUia.js");
+			const { ASGProvider } = await import("./asg-provider-BpRcm_UB.js");
 			const delegateRegion = ambientRegion();
 			let asgProvider = this.asgDeleteDelegates.get(delegateRegion);
 			if (asgProvider === void 0) {
@@ -27353,7 +27534,7 @@ var CloudControlProvider = class {
 		const family = SDK_DELETE_FAMILIES.get(resourceType);
 		const cached = this.sdkDeleteDelegates.get(family);
 		if (cached !== void 0 && cached.region === ccRegion) return cached.provider;
-		const provider = family === "rds" ? new (await (import("./rds-provider-BMQvQTTS.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-CtnwSAGM.js"))).NeptuneProvider({ region: ccRegion });
+		const provider = family === "rds" ? new (await (import("./rds-provider-CmKbYAvr.js"))).RDSProvider({ region: ccRegion }) : new (await (import("./neptune-provider-DzTl6-74.js"))).NeptuneProvider({ region: ccRegion });
 		this.sdkDeleteDelegates.set(family, {
 			region: ccRegion,
 			provider
@@ -32050,245 +32231,682 @@ function isRefusedByName(error) {
 }
 
 //#endregion
-//#region src/provisioning/providers/idempotency-token.ts
-const PROCESS_NONCE = randomUUID();
-const inFlight$1 = /* @__PURE__ */ new Map();
-const generations = /* @__PURE__ */ new Map();
-const MAX_TRACKED_GENERATIONS = 1e5;
-const tokenKey = (scope, logicalId, maxLength, charset) => injectiveKey(scope, ambientRegion() ?? "", getCurrentStackName() ?? "", logicalId, maxLength, charset);
-const derive = (key, generation, maxLength, charset) => {
-	const digest = createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex");
-	return `cdkd${charset === "alphanumeric" ? "" : "-"}${digest}`.slice(0, maxLength);
-};
-function acquireIdempotencyToken(options) {
-	const { scope, logicalId, maxLength = 64, charset = "default" } = options;
-	const key = tokenKey(scope, logicalId, maxLength, charset);
-	const existing = inFlight$1.get(key);
-	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength, charset);
-	if (existing === void 0) inFlight$1.set(key, value);
-	return {
-		value,
-		release: () => {
-			if (!inFlight$1.has(key)) return;
-			inFlight$1.delete(key);
-			const generation = (generations.get(key) ?? 0) + 1;
-			if (!generations.has(key) && generations.size >= MAX_TRACKED_GENERATIONS) {
-				const oldest = generations.keys().next();
-				if (!oldest.done) generations.delete(oldest.value);
-			}
-			generations.set(key, generation);
-		}
+//#region src/types/deployment-events.ts
+function extractDeploymentEventError(err) {
+	if (!(err instanceof Error)) return {
+		name: "UnknownError",
+		message: safeStringify$1(err)
 	};
-}
-let unscopedCreateTokensAllowed = false;
-const STACK_SCOPED_DIGEST_LENGTH = 12;
-function stackScopedCreateToken(options) {
-	const { logicalId, immutableInputs, maxLength } = options;
-	const stackName = getCurrentStackName();
-	if (stackName === void 0 && !unscopedCreateTokensAllowed) throw new Error(`cdkd internal error: a create token for ${logicalId} was requested outside a stack scope (withStackName), so it cannot be scoped to its stack`);
-	const digest = createHash("sha256").update(injectiveKey(stackName ?? "", ambientRegion() ?? "", logicalId, ...immutableInputs.map((v) => JSON.stringify(v ?? null)))).digest("hex").slice(0, STACK_SCOPED_DIGEST_LENGTH);
-	const prefixLength = maxLength - 5 - 1 - STACK_SCOPED_DIGEST_LENGTH;
-	return `cdkd-${logicalId.slice(0, prefixLength)}-${digest}`;
+	const result = {
+		name: err.name || "Error",
+		message: err.message
+	};
+	let current = err;
+	for (let depth = 0; depth < 10 && current instanceof Error; depth++) {
+		const maybeAws = current;
+		if (maybeAws.$metadata !== void 0) {
+			const code = maybeAws.Code ?? maybeAws.name;
+			if (code) result.awsErrorCode = code;
+			if (maybeAws.$metadata.requestId) result.requestId = maybeAws.$metadata.requestId;
+		}
+		current = current.cause;
+	}
+	return result;
 }
 
 //#endregion
-//#region src/provisioning/providers/create-token-ledger.ts
-var CreateTokenLedger = class {
-	doc;
-	loadedAbsent = false;
-	stale = false;
-	startedThisDeploy = false;
-	replaceRecordedLedger = false;
-	stateRecorded = false;
-	stateRecordedPersisted = false;
-	unrecordedLetGo = /* @__PURE__ */ new Map();
-	chain = Promise.resolve();
-	logger = getLogger().child("CreateTokenLedger");
-	store;
-	stack;
-	constructor(store, stack) {
-		this.store = store;
-		this.stack = stack;
+//#region src/state/deployment-events-store.ts
+const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
+const FLUSH_INTERVAL_MS = 2e3;
+const FLUSH_EVENT_THRESHOLD = 50;
+function newDeploymentRunId(now = /* @__PURE__ */ new Date()) {
+	return `${now.toISOString().replace(/[-:.]/g, "")}-${randomUUID().slice(0, 8)}`;
+}
+function deploymentEventsKey(prefix, stackName, region, runId) {
+	return `${prefix}/${stackName}/${region}/deployments/${runId}.jsonl`;
+}
+function deploymentEventsIndexKey(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/index.json`;
+}
+function deploymentsDirPrefix(prefix, stackName, region) {
+	return `${prefix}/${stackName}/${region}/deployments/`;
+}
+const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
+async function deleteAndPurgeEventObjects(backend, keys, dirPrefix, scope = "deleted-keys") {
+	if (keys.length === 0) return void 0;
+	let swept;
+	try {
+		await backend.deleteRawObjects(keys);
+	} finally {
+		if (scope === "whole-dir") swept = await backend.purgeNoncurrentVersionsUnderPrefix(dirPrefix, { objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION });
+		else await backend.purgeNoncurrentVersions(keys, {
+			...keys.length > 1 && { listPrefix: dirPrefix },
+			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
+		});
 	}
-	serialized(fn) {
-		const next = this.chain.then(fn, fn);
-		this.chain = next.catch(() => void 0);
-		return next;
+	return swept;
+}
+function runIdTimestampMs(runId) {
+	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
+	if (!m) return null;
+	const iso = `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`;
+	const ms = Date.parse(iso);
+	return Number.isNaN(ms) ? null : ms;
+}
+function runIdFromJsonlKey(key, dirPrefix) {
+	if (!key.startsWith(dirPrefix) || !key.endsWith(".jsonl")) return null;
+	return key.slice(dirPrefix.length, -6);
+}
+var DeploymentEventsStore = class {
+	logger = getLogger().child("DeploymentEvents");
+	backend;
+	stackName;
+	region;
+	command;
+	runId;
+	cdkdVersion;
+	startedAt;
+	events = [];
+	persistedCount = 0;
+	flushTimer;
+	writeChain = Promise.resolve();
+	warnedOnce = false;
+	finalized = false;
+	constructor(backend, options) {
+		this.backend = backend;
+		this.stackName = options.stackName;
+		this.region = options.region;
+		this.command = options.command;
+		this.runId = options.runId ?? newDeploymentRunId();
+		this.cdkdVersion = options.cdkdVersion ?? getCdkdVersion();
+		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
 	}
-	beginDeploy(exists) {
-		this.stateRecorded = exists;
-		this.replaceRecordedLedger = !exists;
+	record(event) {
+		try {
+			if (this.finalized) return;
+			this.events.push({
+				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+				...event
+			});
+			if (this.events.length - this.persistedCount >= FLUSH_EVENT_THRESHOLD) this.scheduleFlush(0);
+			else this.scheduleFlush(FLUSH_INTERVAL_MS);
+		} catch {}
 	}
-	async current() {
-		if (this.doc !== void 0 && !this.stale) return this.doc;
-		if (this.loadedAbsent && !this.stale) return null;
-		const loaded = await this.store.load();
-		this.stale = false;
-		this.loadedAbsent = loaded === null;
-		if (loaded !== null && this.replaceRecordedLedger && loaded.stateRecorded === true) {
-			this.logger.info("This stack has no state record but its create-token ledger outlived an earlier one; starting a fresh ledger, so this deploy does not take over resources that deployment left.");
-			this.doc = emptyCreateTokenLedger(randomUUID());
-			this.startedThisDeploy = true;
-			return this.doc;
+	async finalize(result) {
+		if (this.finalized) return;
+		this.finalized = true;
+		if (this.flushTimer) {
+			clearTimeout(this.flushTimer);
+			this.flushTimer = void 0;
 		}
-		this.doc = loaded ?? void 0;
-		return loaded;
+		if (this.events.length === 0) return;
+		await this.enqueueWrite(async () => {
+			const indexRead = this.readIndexRuns();
+			indexRead.catch(() => {});
+			await this.doFlush();
+			await this.writeIndexAndPrune(result, await indexRead);
+		});
 	}
-	async persist(doc) {
-		if (this.stateRecorded) doc.stateRecorded = true;
-		await this.store.save(doc);
-		this.replaceRecordedLedger = false;
-		if (doc.stateRecorded === true) this.stateRecordedPersisted = true;
+	async writeIndexAndPrune(result, existingRuns) {
+		const { key, file, runs } = this.buildIndexUpdate(result, existingRuns);
+		const keptRunIds = runs.map((r) => r.runId);
+		const willPrune = keptRunIds.length >= 20;
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
+		const staleKeysRead = willPrune ? this.backend.listRawKeys(dirPrefix) : void 0;
+		staleKeysRead?.catch(() => {});
+		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
+		if (!staleKeysRead) return;
+		await this.pruneSupersededRunFiles(keptRunIds, dirPrefix, await staleKeysRead);
 	}
-	reserve(logicalId, base, derive, firstSentAt) {
-		return this.serialized(async () => {
-			if (this.unrecordedLetGo.has(logicalId)) throw this.wrapLedgerError(logicalId, this.unrecordedLetGo.get(logicalId));
-			const earlier = this.doc?.sent[logicalId];
-			if (earlier !== void 0 && earlier.base === base) return {
-				value: earlier.token,
-				earlierFirstSentAt: earlier.firstSentAt,
-				ledgerStartedThisDeploy: false
-			};
-			let doc;
-			try {
-				const loaded = await this.current();
-				if (loaded === null) {
-					doc = emptyCreateTokenLedger(randomUUID());
-					this.doc = doc;
-					this.startedThisDeploy = true;
-				} else {
-					doc = loaded;
-					const recorded = doc.sent[logicalId];
-					if (recorded !== void 0 && recorded.base === base) return {
-						value: recorded.token,
-						earlierFirstSentAt: recorded.firstSentAt,
-						ledgerStartedThisDeploy: false
-					};
-				}
-			} catch (error) {
-				this.stale = true;
-				throw this.wrapLedgerError(logicalId, error);
-			}
-			const value = derive(doc.nonce);
-			const previous = doc.sent[logicalId];
-			doc.sent[logicalId] = {
-				base,
-				token: value,
-				firstSentAt
-			};
-			try {
-				await this.persist(doc);
-			} catch (error) {
-				if (previous === void 0) delete doc.sent[logicalId];
-				else doc.sent[logicalId] = previous;
-				this.stale = true;
-				throw this.wrapLedgerError(logicalId, error);
-			}
-			return {
-				value,
-				earlierFirstSentAt: void 0,
-				ledgerStartedThisDeploy: this.startedThisDeploy
-			};
-		});
+	async drain() {
+		await this.writeChain;
 	}
-	wrapLedgerError(logicalId, error) {
-		const stack = this.stack === void 0 ? "this stack" : `stack ${displayStackName(this.stack.stackName)} (${displayIdent(this.stack.region)})`;
-		return new Error(safeMsg`Could not read or write the create-token ledger of ${stack} (${describeAwsFailure(error).summary}), so the create of ${logicalId} was not sent: the token it would send without the ledger is not the one a later deploy would send, and the resource could leak. Re-run the deploy once the ledger can be read and written.`, { cause: error });
+	scheduleFlush(delayMs) {
+		if (this.flushTimer) {
+			if (delayMs > 0) return;
+			clearTimeout(this.flushTimer);
+		}
+		this.flushTimer = setTimeout(() => {
+			this.flushTimer = void 0;
+			this.enqueueWrite(() => this.doFlush());
+		}, delayMs);
+		this.flushTimer.unref?.();
 	}
-	rotate(logicalId) {
-		return this.serialized(async () => {
-			try {
-				const doc = await this.current();
-				if (doc === null) return;
-				doc.nonce = randomUUID();
-				delete doc.sent[logicalId];
-				await this.persist(doc);
-				this.unrecordedLetGo.delete(logicalId);
-			} catch (error) {
-				this.stale = true;
-				this.unrecordedLetGo.set(logicalId, error);
-				this.logger.warn(safeMsg`Could not record in this stack's create-token ledger that ${logicalId} was kept (${describeAwsFailure(error).summary}). A create of ${logicalId} in this deploy is refused; a later deploy's create of it may be handed the kept resource back, so check the resource it records against the one this deploy kept.`);
-			}
+	enqueueWrite(op) {
+		const next = this.writeChain.then(op).catch((err) => {
+			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
 		});
+		this.writeChain = next;
+		return next;
 	}
-	sentEntries() {
-		return this.serialized(async () => {
-			try {
-				return { ...(await this.current())?.sent ?? {} };
-			} catch (error) {
-				this.stale = true;
-				throw error;
-			}
-		});
+	async doFlush() {
+		if (this.events.length === 0 || this.events.length === this.persistedCount) return;
+		const snapshotCount = this.events.length;
+		const body = this.events.slice(0, snapshotCount).map((e) => JSON.stringify(e)).join("\n");
+		await this.backend.putRawObject(deploymentEventsKey(this.backend.prefix, this.stackName, this.region, this.runId), body + "\n", "application/x-ndjson");
+		this.persistedCount = snapshotCount;
 	}
-	recordSent(entries, firstSentAt) {
-		return this.serialized(async () => {
-			try {
-				let doc = await this.current();
-				if (doc === null) {
-					doc = emptyCreateTokenLedger(randomUUID());
-					this.doc = doc;
-					this.startedThisDeploy = true;
-				}
-				let changed = false;
-				for (const entry of entries) {
-					const recorded = doc.sent[entry.logicalId];
-					if (recorded?.base === entry.base && recorded.token === entry.token) continue;
-					doc.sent[entry.logicalId] = {
-						base: entry.base,
-						token: entry.token,
-						firstSentAt
-					};
-					changed = true;
-				}
-				if (changed) await this.persist(doc);
-			} catch (error) {
-				this.stale = true;
-				throw error;
+	async readIndexRuns() {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
+		try {
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) return parsed.runs;
 			}
-		});
+		} catch (err) {
+			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
+		}
+		return [];
 	}
-	abandonedAt() {
-		return this.serialized(async () => (await this.current())?.abandonedAt);
+	buildIndexUpdate(result, existingRuns) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
+		const runs = [{
+			runId: this.runId,
+			command: this.command,
+			cdkdVersion: this.cdkdVersion,
+			startedAt: this.startedAt,
+			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			result,
+			eventCount: this.persistedCount
+		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
+		return {
+			key,
+			file: {
+				indexVersion: 1,
+				stackName: this.stackName,
+				region: this.region,
+				runs,
+				lastModified: Date.now()
+			},
+			runs
+		};
 	}
-	noteAbandoned(at) {
-		return this.serialized(async () => {
-			try {
-				const doc = await this.current();
-				if (doc === null) return;
-				if (!Object.values(doc.sent).some((e) => e.base.startsWith("adopt-by-name:")) || doc.abandonedAt !== void 0 && doc.abandonedAt >= at) return;
-				doc.abandonedAt = at;
-				await this.persist(doc);
-			} catch (error) {
-				this.stale = true;
-				throw error;
-			}
+	async pruneSupersededRunFiles(keptRunIds, dirPrefix, keys) {
+		if (keptRunIds.length < 20) return;
+		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
+		const stale = keys.filter((k) => {
+			const runId = runIdFromJsonlKey(k, dirPrefix);
+			return runId !== null && runId < cutoff;
 		});
+		if (stale.length === 0) return;
+		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
+		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
 	}
-	settleAdoptingCreates(drop, failedAt) {
-		return this.serialized(async () => {
-			try {
-				const doc = await this.current();
-				if (doc === null) return;
-				const adopting = (id) => doc.sent[id]?.base.startsWith(ADOPTING_CREATE_BASE) === true;
-				let changed = false;
-				for (const id of drop) {
-					if (!adopting(id)) continue;
-					delete doc.sent[id];
-					changed = true;
-				}
-				for (const [id, at] of failedAt) {
-					const entry = adopting(id) ? doc.sent[id] : void 0;
-					if (entry === void 0 || entry.failedAt !== void 0) continue;
-					entry.failedAt = at;
-					changed = true;
-				}
-				if (changed) await this.persist(doc);
-			} catch (error) {
-				this.stale = true;
-				throw error;
-			}
-		});
+	warnOnce(message) {
+		if (this.warnedOnce) {
+			this.logger.debug(message);
+			return;
+		}
+		this.warnedOnce = true;
+		this.logger.warn(`${message} — continuing; deployment events are best-effort and never block the run.`);
+	}
+};
+var DeploymentEventsReader = class {
+	backend;
+	constructor(backend) {
+		this.backend = backend;
+	}
+	async listRegions(stackName) {
+		const prefix = `${this.backend.prefix}/${stackName}/`;
+		const keys = await this.backend.listRawKeys(prefix);
+		const regions = /* @__PURE__ */ new Set();
+		for (const key of keys) {
+			const segments = key.slice(prefix.length).split("/");
+			if (segments.length === 3 && segments[1] === "deployments" && segments[0]) regions.add(segments[0]);
+		}
+		return [...regions].sort();
+	}
+	async listRuns(stackName, region) {
+		const key = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		try {
+			const raw = await this.backend.getRawObject(key);
+			if (raw !== null) {
+				const parsed = JSON.parse(raw);
+				if (Array.isArray(parsed.runs)) return parsed.runs;
+			}
+		} catch {}
+		const dirPrefix = `${this.backend.prefix}/${stackName}/${region}/deployments/`;
+		const runIds = (await this.backend.listRawKeys(dirPrefix)).filter((k) => k.endsWith(".jsonl")).map((k) => k.slice(dirPrefix.length, -6)).sort().reverse();
+		return Promise.all(runIds.map((runId) => this.summarizeRunFromJsonl(stackName, region, runId)));
+	}
+	async summarizeRunFromJsonl(stackName, region, runId) {
+		const fallback = {
+			runId,
+			command: "deploy",
+			cdkdVersion: "unknown",
+			startedAt: "",
+			finishedAt: "",
+			result: "UNKNOWN",
+			eventCount: 0
+		};
+		let events = null;
+		try {
+			events = await this.readRunEvents(stackName, region, runId);
+		} catch {
+			return fallback;
+		}
+		if (events === null || events.length === 0) return fallback;
+		const started = events.find((e) => e.eventType === "RUN_STARTED");
+		let finished;
+		for (const e of events) if (e.eventType === "RUN_FINISHED") finished = e;
+		return {
+			runId,
+			command: started?.command ?? fallback.command,
+			cdkdVersion: started?.cdkdVersion ?? fallback.cdkdVersion,
+			startedAt: started?.timestamp ?? fallback.startedAt,
+			finishedAt: finished?.timestamp ?? fallback.finishedAt,
+			result: finished?.result ?? "UNKNOWN",
+			eventCount: events.length
+		};
+	}
+	async readRunEvents(stackName, region, runId) {
+		const key = deploymentEventsKey(this.backend.prefix, stackName, region, runId);
+		const raw = await this.backend.getRawObject(key);
+		if (raw === null) return null;
+		const events = [];
+		for (const line of raw.split("\n")) {
+			const trimmed = line.trim();
+			if (!trimmed) continue;
+			try {
+				events.push(JSON.parse(trimmed));
+			} catch {}
+		}
+		return events;
+	}
+	async pruneRuns(stackName, region, opts = {}) {
+		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, stackName, region);
+		const keys = await this.backend.listRawKeys(dirPrefix);
+		const runIdsDesc = keys.map((k) => runIdFromJsonlKey(k, dirPrefix)).filter((id) => id !== null).sort().reverse();
+		const indexKey = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
+		const indexExisted = keys.includes(indexKey);
+		if (opts.all === true) {
+			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+			const earlierVersions = await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix, "whole-dir");
+			return {
+				deletedRunIds: runIdsDesc,
+				remainingRunIds: [],
+				indexDeleted: indexExisted,
+				...earlierVersions !== void 0 && { earlierVersions }
+			};
+		}
+		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
+		const keep = opts.keep ?? (noGuards ? 20 : void 0);
+		const protectedByCount = keep === void 0 ? /* @__PURE__ */ new Set() : new Set(runIdsDesc.slice(0, keep));
+		let candidates = runIdsDesc.filter((id) => !protectedByCount.has(id));
+		if (opts.olderThanMs !== void 0) {
+			const cutoff = (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.olderThanMs;
+			candidates = candidates.filter((id) => {
+				const t = runIdTimestampMs(id);
+				return t !== null && t < cutoff;
+			});
+		}
+		if (candidates.length === 0) return {
+			deletedRunIds: [],
+			remainingRunIds: runIdsDesc,
+			indexDeleted: false
+		};
+		const deletedSet = new Set(candidates);
+		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
+		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
+		if (remainingRunIds.length === 0) {
+			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
+			return {
+				deletedRunIds: candidates,
+				remainingRunIds,
+				indexDeleted: indexExisted
+			};
+		}
+		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
+		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
+		return {
+			deletedRunIds: candidates,
+			remainingRunIds,
+			indexDeleted: false
+		};
+	}
+	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
+		let raw;
+		try {
+			raw = await this.backend.getRawObject(indexKey);
+		} catch {
+			return;
+		}
+		if (raw === null) return;
+		let parsed;
+		try {
+			parsed = JSON.parse(raw);
+		} catch {
+			return;
+		}
+		if (!Array.isArray(parsed.runs)) return;
+		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
+		if (remaining.length === parsed.runs.length) return;
+		const file = {
+			indexVersion: 1,
+			stackName,
+			region,
+			runs: remaining,
+			lastModified: Date.now()
+		};
+		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
+	}
+};
+
+//#endregion
+//#region src/deployment/kept-in-history.ts
+function keptInEarlierRecords(records) {
+	const out = [];
+	for (const record of records) for (const [logicalId, raw] of Object.entries(record.resources)) {
+		if (raw === null || typeof raw !== "object") continue;
+		const r = raw;
+		if (typeof r.resourceType !== "string" || typeof r.physicalId !== "string") continue;
+		if (r.physicalId === "") continue;
+		if (!shouldRetainResource(r.deletionPolicy)) continue;
+		out.push({
+			logicalId,
+			resourceType: r.resourceType,
+			physicalId: r.physicalId,
+			...record.writtenAt !== void 0 && { keptAt: record.writtenAt }
+		});
+	}
+	return out;
+}
+function keptInEventHistory(runs, stackName) {
+	const made = /* @__PURE__ */ new Map();
+	const out = [];
+	for (const events of runs) for (const e of events) {
+		if (e.stackName !== stackName || typeof e.logicalId !== "string") continue;
+		if (typeof e.resourceType !== "string") continue;
+		if (e.eventType === "RESOURCE_SUCCEEDED" && (e.operation === "CREATE" || e.operation === "UPDATE") && typeof e.physicalId === "string" && e.physicalId !== "") made.set(e.logicalId, {
+			resourceType: e.resourceType,
+			physicalId: e.physicalId
+		});
+		else if (e.eventType === "RESOURCE_RETAINED") {
+			const m = made.get(e.logicalId);
+			if (m !== void 0 && m.resourceType === e.resourceType) {
+				const keptAt = Date.parse(e.timestamp);
+				out.push({
+					logicalId: e.logicalId,
+					...m,
+					...Number.isFinite(keptAt) && { keptAt }
+				});
+			}
+		}
+	}
+	return out;
+}
+async function loadKeptInHistory(sources, stackName, region) {
+	const [records, runs] = await Promise.all([sources.earlierStateResources(stackName, region).catch(() => []), readRecentRuns(sources, stackName, region)]);
+	return [...keptInEarlierRecords(records), ...keptInEventHistory(runs, stackName)];
+}
+async function readRecentRuns(sources, stackName, region) {
+	const runsOf = stackName.split("~")[0];
+	return (async () => {
+		const listed = (await sources.listRuns(runsOf, region)).slice(0, 20);
+		return (await Promise.all(listed.map((r) => sources.readRunEvents(runsOf, region, r.runId).catch(() => null)))).filter((e) => e !== null).reverse();
+	})().catch(() => []);
+}
+const RETAINED_SURVIVOR_REASON_PREFIX = "UpdateReplacePolicy: Retain kept the replacement's new";
+function rollbackRetainedInEventHistory(runs, stackName) {
+	const out = [];
+	for (const events of runs) for (const e of events) {
+		if (e.stackName !== stackName || e.eventType !== "ROLLBACK_RESOURCE_SUCCEEDED") continue;
+		if (typeof e.logicalId !== "string" || typeof e.resourceType !== "string") continue;
+		if (typeof e.physicalId !== "string" || e.physicalId === "") continue;
+		if (typeof e.reason !== "string" || !e.reason.startsWith("UpdateReplacePolicy: Retain kept the replacement's new")) continue;
+		out.push({
+			logicalId: e.logicalId,
+			resourceType: e.resourceType,
+			physicalId: e.physicalId
+		});
+	}
+	return out;
+}
+async function loadRollbackRetainedCopies(sources, stackName, region) {
+	return rollbackRetainedInEventHistory(await readRecentRuns(sources, stackName, region), stackName);
+}
+
+//#endregion
+//#region src/provisioning/providers/idempotency-token.ts
+const PROCESS_NONCE = randomUUID();
+const inFlight$1 = /* @__PURE__ */ new Map();
+const generations = /* @__PURE__ */ new Map();
+const MAX_TRACKED_GENERATIONS = 1e5;
+const tokenKey = (scope, logicalId, maxLength, charset) => injectiveKey(scope, ambientRegion() ?? "", getCurrentStackName() ?? "", logicalId, maxLength, charset);
+const derive = (key, generation, maxLength, charset) => {
+	const digest = createHash("sha256").update(`${PROCESS_NONCE}\u0000${key}\u0000${generation}`).digest("hex");
+	return `cdkd${charset === "alphanumeric" ? "" : "-"}${digest}`.slice(0, maxLength);
+};
+function acquireIdempotencyToken(options) {
+	const { scope, logicalId, maxLength = 64, charset = "default" } = options;
+	const key = tokenKey(scope, logicalId, maxLength, charset);
+	const existing = inFlight$1.get(key);
+	const value = existing ?? derive(key, generations.get(key) ?? 0, maxLength, charset);
+	if (existing === void 0) inFlight$1.set(key, value);
+	return {
+		value,
+		release: () => {
+			if (!inFlight$1.has(key)) return;
+			inFlight$1.delete(key);
+			const generation = (generations.get(key) ?? 0) + 1;
+			if (!generations.has(key) && generations.size >= MAX_TRACKED_GENERATIONS) {
+				const oldest = generations.keys().next();
+				if (!oldest.done) generations.delete(oldest.value);
+			}
+			generations.set(key, generation);
+		}
+	};
+}
+let unscopedCreateTokensAllowed = false;
+const STACK_SCOPED_DIGEST_LENGTH = 12;
+function stackScopedCreateToken(options) {
+	const { logicalId, immutableInputs, maxLength } = options;
+	const stackName = getCurrentStackName();
+	if (stackName === void 0 && !unscopedCreateTokensAllowed) throw new Error(`cdkd internal error: a create token for ${logicalId} was requested outside a stack scope (withStackScope), so it cannot be scoped to its stack`);
+	const digest = createHash("sha256").update(injectiveKey(stackName ?? "", ambientRegion() ?? "", logicalId, ...immutableInputs.map((v) => JSON.stringify(v ?? null)))).digest("hex").slice(0, STACK_SCOPED_DIGEST_LENGTH);
+	const prefixLength = maxLength - 5 - 1 - STACK_SCOPED_DIGEST_LENGTH;
+	return `cdkd-${logicalId.slice(0, prefixLength)}-${digest}`;
+}
+
+//#endregion
+//#region src/provisioning/providers/create-token-ledger.ts
+var CreateTokenLedger = class {
+	doc;
+	loadedAbsent = false;
+	stale = false;
+	startedThisDeploy = false;
+	replaceRecordedLedger = false;
+	stateRecorded = false;
+	stateRecordedPersisted = false;
+	unrecordedLetGo = /* @__PURE__ */ new Map();
+	chain = Promise.resolve();
+	logger = getLogger().child("CreateTokenLedger");
+	store;
+	stack;
+	constructor(store, stack) {
+		this.store = store;
+		this.stack = stack;
+	}
+	serialized(fn) {
+		const next = this.chain.then(fn, fn);
+		this.chain = next.catch(() => void 0);
+		return next;
+	}
+	beginDeploy(exists) {
+		this.stateRecorded = exists;
+		this.replaceRecordedLedger = !exists;
+	}
+	async current() {
+		if (this.doc !== void 0 && !this.stale) return this.doc;
+		if (this.loadedAbsent && !this.stale) return null;
+		const loaded = await this.store.load();
+		this.stale = false;
+		this.loadedAbsent = loaded === null;
+		if (loaded !== null && this.replaceRecordedLedger && loaded.stateRecorded === true) {
+			this.logger.info("This stack has no state record but its create-token ledger outlived an earlier one; starting a fresh ledger, so this deploy does not take over resources that deployment left.");
+			this.doc = emptyCreateTokenLedger(randomUUID());
+			this.startedThisDeploy = true;
+			return this.doc;
+		}
+		this.doc = loaded ?? void 0;
+		return loaded;
+	}
+	async persist(doc) {
+		if (this.stateRecorded) doc.stateRecorded = true;
+		await this.store.save(doc);
+		this.replaceRecordedLedger = false;
+		if (doc.stateRecorded === true) this.stateRecordedPersisted = true;
+	}
+	reserve(logicalId, base, derive, firstSentAt) {
+		return this.serialized(async () => {
+			if (this.unrecordedLetGo.has(logicalId)) throw this.wrapLedgerError(logicalId, this.unrecordedLetGo.get(logicalId));
+			const earlier = this.doc?.sent[logicalId];
+			if (earlier !== void 0 && earlier.base === base) return {
+				value: earlier.token,
+				earlierFirstSentAt: earlier.firstSentAt,
+				ledgerStartedThisDeploy: false
+			};
+			let doc;
+			try {
+				const loaded = await this.current();
+				if (loaded === null) {
+					doc = emptyCreateTokenLedger(randomUUID());
+					this.doc = doc;
+					this.startedThisDeploy = true;
+				} else {
+					doc = loaded;
+					const recorded = doc.sent[logicalId];
+					if (recorded !== void 0 && recorded.base === base) return {
+						value: recorded.token,
+						earlierFirstSentAt: recorded.firstSentAt,
+						ledgerStartedThisDeploy: false
+					};
+				}
+			} catch (error) {
+				this.stale = true;
+				throw this.wrapLedgerError(logicalId, error);
+			}
+			const value = derive(doc.nonce);
+			const previous = doc.sent[logicalId];
+			doc.sent[logicalId] = {
+				base,
+				token: value,
+				firstSentAt
+			};
+			try {
+				await this.persist(doc);
+			} catch (error) {
+				if (previous === void 0) delete doc.sent[logicalId];
+				else doc.sent[logicalId] = previous;
+				this.stale = true;
+				throw this.wrapLedgerError(logicalId, error);
+			}
+			return {
+				value,
+				earlierFirstSentAt: void 0,
+				ledgerStartedThisDeploy: this.startedThisDeploy
+			};
+		});
+	}
+	wrapLedgerError(logicalId, error) {
+		const stack = this.stack === void 0 ? "this stack" : `stack ${displayStackName(this.stack.stackName)} (${displayIdent(this.stack.region)})`;
+		return new Error(safeMsg`Could not read or write the create-token ledger of ${stack} (${describeAwsFailure(error).summary}), so the create of ${logicalId} was not sent: the token it would send without the ledger is not the one a later deploy would send, and the resource could leak. Re-run the deploy once the ledger can be read and written.`, { cause: error });
+	}
+	rotate(logicalId) {
+		return this.serialized(async () => {
+			try {
+				const doc = await this.current();
+				if (doc === null) return;
+				doc.nonce = randomUUID();
+				delete doc.sent[logicalId];
+				await this.persist(doc);
+				this.unrecordedLetGo.delete(logicalId);
+			} catch (error) {
+				this.stale = true;
+				this.unrecordedLetGo.set(logicalId, error);
+				this.logger.warn(safeMsg`Could not record in this stack's create-token ledger that ${logicalId} was kept (${describeAwsFailure(error).summary}). A create of ${logicalId} in this deploy is refused; a later deploy's create of it may be handed the kept resource back, so check the resource it records against the one this deploy kept.`);
+			}
+		});
+	}
+	sentEntries() {
+		return this.serialized(async () => {
+			try {
+				return { ...(await this.current())?.sent ?? {} };
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
+	recordSent(entries, firstSentAt) {
+		return this.serialized(async () => {
+			try {
+				let doc = await this.current();
+				if (doc === null) {
+					doc = emptyCreateTokenLedger(randomUUID());
+					this.doc = doc;
+					this.startedThisDeploy = true;
+				}
+				let changed = false;
+				for (const entry of entries) {
+					const recorded = doc.sent[entry.logicalId];
+					if (recorded?.base === entry.base && recorded.token === entry.token) continue;
+					doc.sent[entry.logicalId] = {
+						base: entry.base,
+						token: entry.token,
+						firstSentAt
+					};
+					changed = true;
+				}
+				if (changed) await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
+	abandonedAt() {
+		return this.serialized(async () => (await this.current())?.abandonedAt);
+	}
+	noteAbandoned(at) {
+		return this.serialized(async () => {
+			try {
+				const doc = await this.current();
+				if (doc === null) return;
+				if (!Object.values(doc.sent).some((e) => e.base.startsWith("adopt-by-name:")) || doc.abandonedAt !== void 0 && doc.abandonedAt >= at) return;
+				doc.abandonedAt = at;
+				await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
+	}
+	settleAdoptingCreates(drop, failedAt) {
+		return this.serialized(async () => {
+			try {
+				const doc = await this.current();
+				if (doc === null) return;
+				const adopting = (id) => doc.sent[id]?.base.startsWith(ADOPTING_CREATE_BASE) === true;
+				let changed = false;
+				for (const id of drop) {
+					if (!adopting(id)) continue;
+					delete doc.sent[id];
+					changed = true;
+				}
+				for (const [id, at] of failedAt) {
+					const entry = adopting(id) ? doc.sent[id] : void 0;
+					if (entry === void 0 || entry.failedAt !== void 0) continue;
+					entry.failedAt = at;
+					changed = true;
+				}
+				if (changed) await this.persist(doc);
+			} catch (error) {
+				this.stale = true;
+				throw error;
+			}
+		});
 	}
 	prefetch() {
 		return this.serialized(async () => {
@@ -32914,30 +33532,6 @@ async function createReplicationGroupFinalSnapshot(client, replicationGroupId, l
 	});
 }
 
-//#endregion
-//#region src/types/deployment-events.ts
-function extractDeploymentEventError(err) {
-	if (!(err instanceof Error)) return {
-		name: "UnknownError",
-		message: safeStringify$1(err)
-	};
-	const result = {
-		name: err.name || "Error",
-		message: err.message
-	};
-	let current = err;
-	for (let depth = 0; depth < 10 && current instanceof Error; depth++) {
-		const maybeAws = current;
-		if (maybeAws.$metadata !== void 0) {
-			const code = maybeAws.Code ?? maybeAws.name;
-			if (code) result.awsErrorCode = code;
-			if (maybeAws.$metadata.requestId) result.requestId = maybeAws.$metadata.requestId;
-		}
-		current = current.cause;
-	}
-	return result;
-}
-
 //#endregion
 //#region src/deployment/rollback-executor/types.ts
 const NESTED_STACK_RESOURCE_TYPE$1 = "AWS::CloudFormation::Stack";
@@ -33133,15 +33727,20 @@ function retainedSurvivorMessages(logicalId, resourceType, survivorPhysicalId, s
 	const clause = mask(stateClause);
 	return {
 		warn: `  ⚠ ${safe(logicalId)} (${safe(resourceType)}) has UpdateReplacePolicy: Retain — the replacement's new physical resource (${displaySafe(survivorId)}) is RETAINED by this rollback and is no longer tracked by cdkd: it keeps running and incurring cost, and destroying the stack will not remove it. Delete it yourself once you no longer need it. ${displaySafe(clause)}`,
-		reason: `UpdateReplacePolicy: Retain kept the replacement's new ${resourceType} (${survivorId}); it is live, still billing, and no longer tracked by cdkd. ${clause}`
+		reason: `${RETAINED_SURVIVOR_REASON_PREFIX} ${resourceType} (${survivorId}); it is live, still billing, and no longer tracked by cdkd. ${clause}`
 	};
 }
 
 //#endregion
 //#region src/deployment/rollback-executor/names.ts
 function replayPrefixScope(input, logger, mask, restoring) {
+	const generation = input.nameGeneration;
+	const inGeneration = (fn) => generation === void 0 ? fn() : withNameGeneration({
+		logicalId: input.logicalId,
+		generation
+	}, fn);
 	const choice = replayPrefixChoice(input);
-	if (choice.kind === "not-applicable") return (fn) => fn();
+	if (choice.kind === "not-applicable") return (fn) => inGeneration(fn);
 	const setting = (skip) => skip ? "SKIPPED" : "KEPT";
 	const subject = `${safe(input.logicalId)} (${safe(input.resourceType)})`;
 	const declared = choice.declared;
@@ -33161,7 +33760,7 @@ function replayPrefixScope(input, logger, mask, restoring) {
 		logger.warn(mask(`  ⚠ ${subject}: cdkd cannot tell which user-supplied-name prefix setting created the old resource (` + (withheld ? `its physical id is withheld, as its name is secret-derived or unreadable` : shown(input.physicalId)) + `) — ` + (choice.names === void 0 ? unreadable !== void 0 ? `cdkd cannot read ${unreadable} to compare` : `cdkd cannot derive the names its ${prop} takes to compare` : secretDerived ? `its ${prop} is secret-derived, and neither name it derives matches` : `its ${prop} derives to ${quoted(choice.names.skipped)} (prefix skipped) or ${quoted(choice.names.kept)} (prefix kept), and it is neither`) + `; re-creating it with the stack-name prefix ${setting(choice.skipPrefix)}, as the failed deploy ran, so it may come back under a different physical name.`));
 	}
 	const skip = choice.skipPrefix;
-	return (fn) => withSkipPrefix(skip, fn);
+	return (fn) => withSkipPrefix(skip, () => inGeneration(fn));
 }
 function createOpMasker(logger, secrets, deployBag) {
 	const base = createMaskedLogSinks(logger, deployBag === void 0 ? (text) => maskSecretsInText(text, secrets) : createUnionSecretMasker([secrets, deployBag]));
@@ -34257,6 +34856,149 @@ function maskedRecordRemedyFor(reads, resources, causeScoped = false) {
 	return [parts.join(" "), ...commandLines].join("\n");
 }
 
+//#endregion
+//#region src/deployment/delete-guard-scope.ts
+const storage$1 = new AsyncLocalStorage();
+function collectDeleteGuards(sink, fn) {
+	return storage$1.run(sink, fn);
+}
+function reportDeleteGuards(result, target) {
+	const sink = storage$1.getStore();
+	if (!sink) return;
+	for (const guard of deleteIndeterminateGuards(result)) sink.push({
+		guard: guard.guard,
+		reason: guard.reason,
+		physicalId: target.physicalId,
+		resourceType: target.resourceType,
+		...target.provisionedBy && { provisionedBy: target.provisionedBy }
+	});
+}
+
+//#endregion
+//#region src/deployment/superseded-resources.ts
+function supersededResourcesOf(state) {
+	const rows = state?.supersededResources;
+	if (!Array.isArray(rows)) return [];
+	return rows.filter(isSupersededResourceRecord);
+}
+function isSupersededResourceRecord(row) {
+	if (typeof row !== "object" || row === null) return false;
+	const entry = row;
+	const record = entry["state"];
+	if (typeof entry["logicalId"] !== "string") return false;
+	if (typeof record !== "object" || record === null) return false;
+	const { physicalId, resourceType, properties } = record;
+	return typeof physicalId === "string" && physicalId !== "" && typeof resourceType === "string" && resourceType !== "" && typeof properties === "object" && properties !== null && !Array.isArray(properties);
+}
+function supersededHolderOf(entry, resources) {
+	const holders = Object.values(resources).filter((record) => typeof record === "object" && record !== null && record.physicalId === entry.state.physicalId);
+	return holders.find((record) => record.resourceType === entry.state.resourceType) ?? holders[0];
+}
+function isSupersededHeldBySameType(entry, resources) {
+	return Object.values(resources).some((record) => typeof record === "object" && record !== null && record.physicalId === entry.state.physicalId && record.resourceType === entry.state.resourceType);
+}
+function supersededHeldByOtherTypeWarning(entry, holderType) {
+	return `the superseded ${entry.state.resourceType} of ${entry.logicalId} (${entry.state.physicalId}) was not deleted: a ${holderType} record of this stack has the same physical id, and cdkd never deletes an id a record names. If the ${entry.state.resourceType} still exists, delete it by hand; it is no longer tracked in state.`;
+}
+function addSuperseded(host, entry) {
+	host.supersededResources = [...(Array.isArray(host.supersededResources) ? host.supersededResources : []).filter((row) => !isSupersededResourceRecord(row) || row.state.physicalId !== entry.state.physicalId || row.state.resourceType !== entry.state.resourceType), entry];
+}
+function canRecordSuperseded(record, deleteContext) {
+	if (deleteContext.noEchoDeleteValues !== void 0) return false;
+	if (deleteContext.inlinePolicyClaimed !== void 0) return false;
+	if (Array.isArray(record.noEchoLeaves) && record.noEchoLeaves.length > 0) return false;
+	return !INLINE_POLICY_TYPES.has(record.resourceType);
+}
+const INLINE_POLICY_TYPES = /* @__PURE__ */ new Set([
+	"AWS::IAM::Policy",
+	"AWS::IAM::RolePolicy",
+	"AWS::IAM::UserPolicy",
+	"AWS::IAM::GroupPolicy"
+]);
+function removeSuperseded(host, entry) {
+	if (!Array.isArray(host.supersededResources)) return;
+	const remaining = host.supersededResources.filter((row) => row !== entry);
+	if (remaining.length === 0) delete host.supersededResources;
+	else host.supersededResources = remaining;
+}
+function supersededAfterRollback(base, pending) {
+	const added = Array.isArray(pending.supersededResources) ? pending.supersededResources : [];
+	if (added.length === 0) return {};
+	return { supersededResources: [...Array.isArray(base.supersededResources) ? base.supersededResources : [], ...added] };
+}
+const SUPERSEDED_KEPT_REMEDY = "cdkd keeps it in state: the next `cdkd deploy` of this stack retries the delete, and `cdkd destroy` deletes it";
+function withoutSuperseded(state) {
+	const { supersededResources: _dropped, ...rest } = state;
+	return rest;
+}
+async function deleteSupersededEntry(entry, input) {
+	const record = entry.state;
+	let result;
+	try {
+		const send = () => input.provider.delete(entry.logicalId, record.physicalId, record.resourceType, record.properties, {
+			expectedRegion: input.region,
+			...entry.forceDataDelete === true && { forceDataDelete: true },
+			...entry.finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier: entry.finalSnapshotIdentifier },
+			deletionPolicy: replacementDeletePolicy(entry.updateReplacePolicy),
+			...entry.skipFinalSnapshot === true && { skipFinalSnapshot: true },
+			...input.removeProtection === true && { removeProtection: true },
+			...input.stackDestroy === true && { stackDestroy: true },
+			recordedAttributes: record.attributes,
+			recordedNoEchoLeaves: record.noEchoLeaves,
+			maskSecrets: input.maskSecrets
+		});
+		result = input.once === true ? await send() : await retryWhileInUse(send, input.stop);
+	} catch (error) {
+		return {
+			kind: "failed",
+			error
+		};
+	}
+	reportDeleteGuards(result, {
+		physicalId: record.physicalId,
+		resourceType: record.resourceType,
+		provisionedBy: record.provisionedBy
+	});
+	const reason = deleteSkipReason(result);
+	return reason === void 0 ? { kind: "deleted" } : {
+		kind: "notDeleted",
+		reason
+	};
+}
+const supersededInUseRetry = {
+	attempts: 6,
+	delayMs: 1e4
+};
+const IN_USE_ERROR_NAMES = /* @__PURE__ */ new Set([
+	"ResourceInUseException",
+	"ResourceInUse",
+	"DependencyViolation"
+]);
+const IN_USE_CONFLICT = /\bare using it\b/;
+function isInUseRefusal(error) {
+	for (let current = error, depth = 0; current !== void 0 && depth < 8; depth++) {
+		if (typeof current !== "object" || current === null) return false;
+		const { name, message } = current;
+		if (typeof name === "string" && IN_USE_ERROR_NAMES.has(name)) return true;
+		if (name === "ConflictException" && typeof message === "string" && IN_USE_CONFLICT.test(message)) return true;
+		current = current.cause;
+	}
+	return false;
+}
+async function retryWhileInUse(send, stop) {
+	for (let attempt = 1;; attempt++) try {
+		return await send();
+	} catch (error) {
+		if (attempt >= supersededInUseRetry.attempts || stop() || !isInUseRefusal(error)) throw error;
+		await new Promise((resolve) => setTimeout(resolve, supersededInUseRetry.delayMs));
+		if (stop()) throw error;
+	}
+}
+function holdsSupersededResources(record) {
+	const rows = record.supersededResources;
+	return rows !== void 0 && (!Array.isArray(rows) || rows.length > 0);
+}
+
 //#endregion
 //#region src/utils/colors.ts
 const codes = {
@@ -34283,6 +35025,16 @@ function withReplayDeletePrinting(scope, fn) {
 	const deployBag = scope.ctx.logOnlyNeedlesFor?.(scope.op.logicalId);
 	return withPrintingSecrets(scope.secrets, () => deployBag === void 0 ? fn() : withPrintingSecrets(deployBag, fn));
 }
+function noteRolledBackCreate(scope, op, record) {
+	if (op.changeType !== "CREATE") return;
+	const create = {
+		logicalId: op.logicalId,
+		record,
+		...op.nameGeneration !== void 0 && { nameGeneration: op.nameGeneration }
+	};
+	scope.result.rolledBackCreates.push(create);
+	scope.onRolledBackCreate?.(create);
+}
 
 //#endregion
 //#region src/deployment/rollback-executor/replaced-survivor.ts
@@ -34332,24 +35084,6 @@ async function readSurvivor(s, oldType) {
 	}
 }
 
-//#endregion
-//#region src/deployment/delete-guard-scope.ts
-const storage$1 = new AsyncLocalStorage();
-function collectDeleteGuards(sink, fn) {
-	return storage$1.run(sink, fn);
-}
-function reportDeleteGuards(result, target) {
-	const sink = storage$1.getStore();
-	if (!sink) return;
-	for (const guard of deleteIndeterminateGuards(result)) sink.push({
-		guard: guard.guard,
-		reason: guard.reason,
-		physicalId: target.physicalId,
-		resourceType: target.resourceType,
-		...target.provisionedBy && { provisionedBy: target.provisionedBy }
-	});
-}
-
 //#endregion
 //#region src/deployment/stack-records-scope.ts
 async function awaitInFlightSibling(view, self, sibling) {
@@ -34394,11 +35128,92 @@ function replayStackRecordsView(records, orphanLogicalIds = /* @__PURE__ */ new
 	};
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/name-collision.ts
+function replacementNameOrigin(logicalId, physicalId) {
+	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName(), getCurrentStackInstanceId())) return {
+		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
+		remedy: "Either give the resource an explicit physical name in your CDK code, or rename the CONSTRUCT (its id feeds the generated name — note that this replaces the resource rather than renaming it in place)"
+	};
+	return {
+		descriptor: `The resource has a user-supplied physical name (${physicalId})`,
+		remedy: "Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed)"
+	};
+}
+function generatedReplacementHolderAdvice(input) {
+	if (input.change?.generated !== true) return "";
+	const name = displaySafe(input.mask(input.change.desiredName), { asciiOnly: true });
+	const old = displaySafe(input.mask(input.oldPhysicalId), { asciiOnly: true });
+	const lead = ` The colliding name ${isInertUnquoted(name) ? name : "the generated name"} is the one this replacement generates for its next name generation, so its holder is most likely the new resource an interrupted earlier attempt of this replacement created. If it is, `;
+	const tail = `, or delete it and re-run the deploy.`;
+	if (input.stackName.includes("~")) return lead + `adopt it through the top-level stack with \`cdkd import\` (then delete ${old} by hand)` + tail;
+	const adopt = pasteableCommand("cdkd import", [{
+		value: input.stackName,
+		hole: "stack"
+	}, {
+		flag: "--resource",
+		value: `${input.logicalId}=${input.change.desiredName}`,
+		hole: "logicalId=physicalId"
+	}]);
+	const command = input.mask(adopt.command) === adopt.command ? adopt.command : void 0;
+	return lead + (command === void 0 ? `adopt it with \`cdkd import\`` : `adopt it with \`${command}\` (using its physical id where the type records another)`) + ` and then delete ${old} by hand` + tail;
+}
+function orphanedNameCollisionAdvice(providerRegistry, changeType, logicalId, error) {
+	if (changeType !== "CREATE") return void 0;
+	if (!(error instanceof ProvisioningError)) return void 0;
+	const physicalId = error.physicalId;
+	if (!physicalId) return void 0;
+	const replayed = isReplayedNameCollisionFrom(error, logicalId, (link) => isAuxiliaryMarkOf(link, RETRY_AUXILIARY_OWNER));
+	if (!replayed && !isNameCollisionErrorFrom(error, logicalId)) return void 0;
+	const stackName = getCurrentStackName();
+	if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName, getCurrentStackInstanceId())) return;
+	if (!stackName) return void 0;
+	const safeId = displaySafe(physicalId, { asciiOnly: true });
+	const safeStack = displaySafe(stackName, { asciiOnly: true });
+	const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
+	const idShown = isInertUnquoted(safeId);
+	const shownId = idShown ? safeId : "a name that cannot be shown safely here";
+	const shownLogicalId = isInertUnquoted(safeLogicalId) ? safeLogicalId : "A resource whose logical id cannot be shown safely here";
+	const diagnosis = replayed ? `${shownLogicalId}: the name AWS reports as taken (${shownId}) is most likely held by a resource THIS create made. An earlier attempt of it ended without a clear verdict (a server error, a dropped connection or a timeout, or a failure after the create call itself may have succeeded), and the retry then found the name taken. A dropped connection can also happen before the request reached AWS, so the holder may be another resource: confirm it is yours before deleting or importing it. cdkd records a resource only once its create succeeds, so this one is in no state file: no rollback or cdkd destroy will remove it, and re-running collides with it again.` : `${shownLogicalId}: the name AWS reports as taken (${shownId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
+	const deleteArm = `If it is not a resource you want to keep, delete ${idShown ? safeId : "it"} in AWS — after confirming it holds nothing you need${replayed ? "" : ", since Retain is what kept it"} — and re-deploy.`;
+	let canImport;
+	try {
+		canImport = typeof providerRegistry.getProvider(error.resourceType).import === "function";
+	} catch {
+		canImport = false;
+	}
+	const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
+	const importableTarget = !stackName.includes("~");
+	if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
+	const adopt = pasteableCommand("cdkd import", [{
+		value: stackName,
+		hole: "stack"
+	}, {
+		flag: "--resource",
+		value: `${logicalId}=${physicalId}`,
+		hole: "logicalId=physicalId"
+	}]);
+	return `${diagnosis} To recover, adopt it back into state instead of re-creating it, with the command below (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}${adopt.withheld.length === 0 ? "" : " The command below prints a quoted hole in place of a value cdkd will not name on a command line; replace it whole, quotes included, with your stack name or '<logicalId>=<name>', shell-quoted."}\nAdopt with: ${adopt.command}`;
+}
+function isReplacementNameRefusal(error, logicalId) {
+	let current = error;
+	for (let depth = 0; depth < 10 && current != null; depth++) {
+		if (typeof current !== "object") return false;
+		const linkId = current.logicalId;
+		if (typeof linkId === "string" && linkId !== logicalId) return false;
+		if (current instanceof CdkdError && current.code === "NAMED_REPLACEMENT_COLLISION") return true;
+		current = current.cause;
+	}
+	return false;
+}
+
 //#endregion
 //#region src/deployment/deploy-engine/replacement.ts
 var ReplacementRunState = class {
 	replacedDeleteSkips = /* @__PURE__ */ new Map();
 	deferredReplacedDeletes = void 0;
+	supersededHost = void 0;
+	supersededEntries = /* @__PURE__ */ new Map();
 	retainedOldOnReplacement = /* @__PURE__ */ new Set();
 	replacedOldMaySurvive = /* @__PURE__ */ new Map();
 	recreatedUnderSameId = /* @__PURE__ */ new Set();
@@ -34407,6 +35222,7 @@ var ReplacementRunState = class {
 	updateWasReplaced = /* @__PURE__ */ new Map();
 	inPlaceCreateOnlyPaths = /* @__PURE__ */ new Map();
 	oldDeletedBeforeCreate = /* @__PURE__ */ new Set();
+	attemptedNameGeneration = /* @__PURE__ */ new Map();
 };
 function replacementDeleteContext(deps, updateReplacePolicy) {
 	return {
@@ -34452,15 +35268,19 @@ async function replaceDeleteFirstAndRecreate(run, deps, logicalId, resourceType,
 	if (replaceSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, replaceSkipReason, "during the --replace delete-first fallback"));
 	deps.logger.info(safeMsg`  ${green("✓")} Old resource deleted`);
 	run.oldDeletedBeforeCreate.add(logicalId);
+	await oldDeleteProvider.waitForNameReleased?.(logicalId, currentResource.physicalId, oldResourceType, {
+		isInterrupted: () => deps.userInterrupted(),
+		maskSecrets: (text) => maskSecretsInText(text, secrets)
+	});
 	deps.logger.info(safeMsg`  Re-creating ${logicalId}...`);
 	try {
-		return await withRetry(() => deps.withRetry(() => withCurrentResourceSecrets(secrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, createContext)), logicalId, void 0, void 0, replaceProvider), logicalId, {
+		return await withRetry(() => deps.withRetry(() => withCurrentResourceSecrets(secrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, createContext)), logicalId, void 0, void 0, replaceProvider, true), logicalId, {
 			maxRetries: 8,
 			initialDelayMs: 2e3,
 			maxDelayMs: 1e4,
 			logger: deps.maskingRetryLoggerFor(secrets),
-			isInterrupted: () => deps.interrupted(),
-			onInterrupted: () => new InterruptedError(deps.interruptCause() ?? "user"),
+			isInterrupted: () => deps.userInterrupted(),
+			onInterrupted: () => new InterruptedError("user"),
 			isRetryable: isRecreateRetryableError
 		});
 	} catch (recreateError) {
@@ -34494,6 +35314,14 @@ async function checkedReplacementNameChange(deps, input) {
 	};
 	const adopts = replacementCreateAdoptsName(resourceType, input.createdVia);
 	const typeChanged = input.oldResourceType !== resourceType;
+	const generatedMove = replacementGeneratedNameMoves({
+		oldResourceType: input.oldResourceType,
+		newResourceType: resourceType,
+		createdVia: input.createdVia,
+		desiredProperties: input.desiredProperties,
+		physicalId: currentResource.physicalId,
+		logicalId
+	});
 	const change = replacementRequestsDifferentName(question) ?? (adopts || replacementOrderIsCaseSensitive(resourceType) ? replacementRequestsDifferentName({
 		...question,
 		caseSensitive: true
@@ -34504,8 +35332,9 @@ async function checkedReplacementNameChange(deps, input) {
 		desiredProperties: input.desiredProperties,
 		physicalId: currentResource.physicalId,
 		logicalId
-	}) ?? (adopts && typeChanged ? typeChangeNameQuestion(resourceType, input) : void 0);
+	}) ?? (adopts && typeChanged ? typeChangeNameQuestion(resourceType, input) : void 0) ?? generatedMove;
 	if (change === void 0) return void 0;
+	if (change === generatedMove && deps.generatedNameGuarded(logicalId)) return change;
 	const probe = replacementNameProbe({
 		resourceType,
 		createdVia: input.createdVia,
@@ -34535,7 +35364,8 @@ async function checkedReplacementNameChange(deps, input) {
 	}
 	if (found === null) return change;
 	if (!typeChanged && probeFoundSameId(resourceType, found.physicalId, currentResource.physicalId)) return;
-	throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement, and another existing resource (${displaySafe(found.physicalId)}) already holds the name it asks for. ${renderReplacementNameChange(change, input.createProps)}. Since ${adoptsText}, creating the replacement would take that resource over and record it as this stack's. Nothing was created or deleted. Choose a name no other resource holds, or delete the resource holding it if it is yours.`), "NAMED_REPLACEMENT_COLLISION"));
+	const remedy = (await deps.rollbackRetainedCopies?.(input.stackName).catch(() => []) ?? []).some((copy) => copy.logicalId === logicalId && copy.resourceType === resourceType && probeFoundSameId(resourceType, copy.physicalId, found.physicalId)) ? `This stack's event history records that a rolled-back deploy kept ${displaySafe(logicalId)}'s replacement under this name because of UpdateReplacePolicy: Retain, as CloudFormation also does, untracked by cdkd. If the holder is that copy and you no longer need it, delete it; otherwise choose another name.` : `Choose a name no other resource holds, or delete the resource holding it if it is yours.`;
+	throw markNonRetryable(new CdkdError(maskName(`${subject} requires replacement, and another existing resource (${displaySafe(found.physicalId)}) already holds the name it asks for. ${renderReplacementNameChange(change, input.createProps)}. Since ${adoptsText}, creating the replacement would take that resource over and record it as this stack's. Nothing was created or deleted. ${remedy}`), "NAMED_REPLACEMENT_COLLISION"));
 }
 async function createFirstThenDeleteOld(run, deps, input) {
 	const { logicalId, resourceType, currentResource, secrets } = input;
@@ -34545,11 +35375,23 @@ async function createFirstThenDeleteOld(run, deps, input) {
 	const maskName = maskRewrittenSentName(resourceType, input.createProps, logicalId, (text) => maskSecretsInText(text, secrets));
 	let createResult;
 	try {
-		createResult = await deps.withRetry(() => withCurrentResourceSecrets(secrets, () => input.createProvider.create(logicalId, resourceType, input.createProps, { maskSecrets: createSecretMasker(secrets) })), logicalId, void 0, void 0, input.createProvider);
+		createResult = await deps.guardedReplacementCreate({
+			logicalId,
+			resourceType,
+			stackName: input.stackName,
+			createdVia: input.createdVia,
+			resolvedProps: input.resolvedProps
+		}, () => deps.withRetry(() => withCurrentResourceSecrets(secrets, () => input.createProvider.create(logicalId, resourceType, input.createProps, { maskSecrets: createSecretMasker(secrets) })), logicalId, void 0, void 0, input.createProvider));
 	} catch (createError) {
 		if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
 		const createMsg = displayAwsMessage(maskName(describeAwsFailure(createError).detail));
-		throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}), and cdkd created the new resource first because its name differs, but the create collided: ${createMsg}. If the collision is on the requested name: ${renderReplacementNameChange(input.change, input.createProps)}. Nothing was deleted` + (retainOld ? ` (UpdateReplacePolicy: Retain keeps the old resource in place)` : "") + ". Choose a name no other resource holds, or delete the resource holding it if it is yours."), "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+		throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}), and cdkd created the new resource first because its name differs, but the create collided: ${createMsg}. If the collision is on the requested name: ${renderReplacementNameChange(input.change, input.createProps)}. Nothing was deleted` + (retainOld ? ` (UpdateReplacePolicy: Retain keeps the old resource in place)` : "") + ". Choose a name no other resource holds, or delete the resource holding it if it is yours." + generatedReplacementHolderAdvice({
+			stackName: input.stackName,
+			logicalId,
+			change: input.change,
+			oldPhysicalId: currentResource.physicalId,
+			mask: (text) => maskName(maskSecretsInText(text, unionOfSecretBags([secrets, printingSecretsFor(deps.secretsRun(), logicalId)])))
+		})), "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 	}
 	if (input.equalIdIsSameResource && createResult.physicalId === currentResource.physicalId) throw markNonRetryable(new CdkdError(maskName(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement (${input.trigger}) under a new name, but the create returned the resource being replaced (${displaySafe(currentResource.physicalId)}) instead of a new one, so cdkd cannot tell which name it holds. Nothing was deleted. Delete that resource by hand if it is yours, then re-run the deploy.`), "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
 	if (retainOld) return createResult;
@@ -34562,7 +35404,7 @@ async function deleteReplacedAfterCreate(run, deps, logicalId, oldResourceType,
 	let deleteFailed = false;
 	const inlinePolicyClaimed = isStandaloneInlinePolicyType(oldResourceType) ? deps.inlinePolicyClaimedFor(oldResourceType, logicalId, deps.deployStateResources()) : void 0;
 	try {
-		deleteResult = await withPrintingSecrets(secrets, () => deleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, deleteProperties, {
+		const sendDelete = () => deleteProvider.delete(logicalId, currentResource.physicalId, oldResourceType, deleteProperties, {
 			expectedRegion: deps.stackRegion,
 			forceDataDelete: deps.options.forceStatefulRecreation === true,
 			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
@@ -34572,7 +35414,8 @@ async function deleteReplacedAfterCreate(run, deps, logicalId, oldResourceType,
 			...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
 			...inlinePolicyClaimed && { inlinePolicyClaimed },
 			maskSecrets: createUnionSecretMasker([secrets, secretNameBagFor(deps.secretsRun(), logicalId)])
-		}));
+		});
+		deleteResult = await withPrintingSecrets(secrets, () => isRetry ? retryWhileInUse(sendDelete, () => deps.interrupted()) : sendDelete());
 	} catch (deleteError) {
 		const deleteMsg = maskSecretsInText(describeAwsFailure(deleteError).detail, secrets);
 		deleteFailed = true;
@@ -34580,6 +35423,23 @@ async function deleteReplacedAfterCreate(run, deps, logicalId, oldResourceType,
 		const deferred = run.deferredReplacedDeletes;
 		if (!isRetry && deferred !== void 0) {
 			deps.logger.info(safeMsg`  Could not delete old ${logicalId} (${currentResource.physicalId}) yet: ${deleteMsg}. Retrying after the rest of the deploy.`);
+			const host = run.supersededHost;
+			if (host !== void 0 && canRecordSuperseded(currentResource, {
+				noEchoDeleteValues,
+				inlinePolicyClaimed
+			}) && !Object.entries(deps.deployStateResources()).some(([id, record]) => id !== logicalId && record?.physicalId === currentResource.physicalId)) {
+				const entry = {
+					logicalId,
+					supersededAt: Date.now(),
+					state: currentResource,
+					...updateReplacePolicy !== void 0 && { updateReplacePolicy },
+					...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
+					...deps.options.forceStatefulRecreation === true && { forceDataDelete: true },
+					...deps.options.skipFinalSnapshot === true && { skipFinalSnapshot: true }
+				};
+				addSuperseded(host, entry);
+				run.supersededEntries.set(logicalId, entry);
+			}
 			deferred.set(logicalId, {
 				physicalId: currentResource.physicalId,
 				resourceType: oldResourceType,
@@ -34589,7 +35449,13 @@ async function deleteReplacedAfterCreate(run, deps, logicalId, oldResourceType,
 			});
 			return;
 		}
-		deps.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteMsg}`);
+		const kept = isRetry && run.supersededEntries.has(logicalId);
+		deps.logger.warn(kept ? safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteMsg}. ${SUPERSEDED_KEPT_REMEDY}.` : safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${currentResource.physicalId}): ${deleteMsg}`);
+	}
+	const recorded = isRetry ? run.supersededEntries.get(logicalId) : void 0;
+	if (recorded !== void 0 && !deleteFailed && run.supersededHost !== void 0) {
+		removeSuperseded(run.supersededHost, recorded);
+		run.supersededEntries.delete(logicalId);
 	}
 	reportDeleteGuards(deleteResult, {
 		physicalId: currentResource.physicalId,
@@ -34662,8 +35528,9 @@ async function retryDeferredReplacedDeletes(run, deps, stackName, counts) {
 function warnUnretriedReplacedDeletes(run, deps, why) {
 	const deferred = run.deferredReplacedDeletes;
 	run.deferredReplacedDeletes = void 0;
-	const note = why === "failed" ? "not retried: the deploy failed first" : "not retried: the deploy was interrupted";
-	for (const [logicalId, entry] of deferred ?? []) withPrintingSecrets(secretNameBagFor(deps.secretsRun(), logicalId), () => deps.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${entry.physicalId}): ${entry.failureMessage} (${note})`));
+	const cause = why === "failed" ? "the deploy failed first" : "the deploy was interrupted";
+	const noteFor = (logicalId) => run.supersededEntries.has(logicalId) ? `not retried: ${cause}; cdkd keeps it in state, and the next deploy retries the delete` : `not retried: ${cause}; it is no longer tracked in state, so delete it manually`;
+	for (const [logicalId, entry] of deferred ?? []) withPrintingSecrets(secretNameBagFor(deps.secretsRun(), logicalId), () => deps.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${entry.physicalId}): ${entry.failureMessage} (${noteFor(logicalId)})`));
 }
 
 //#endregion
@@ -35556,6 +36423,136 @@ function recaptureMaskedBaseline(args) {
 	return changed ? result : void 0;
 }
 
+//#endregion
+//#region src/state/name-generation.ts
+var MalformedNameGenerationError = class extends Error {
+	constructor(where, reason = "malformed") {
+		super(`The state record holds a name generation for ${displayIdent(where)} that is ` + (reason === "exhausted" ? "too large to derive the next one from (the next is not a safe integer). " : "not a non-negative integer. ") + "cdkd does not guess which name the resource was given, since the next replacement's name derives from it; restore the field from an earlier version of state.json.");
+		this.name = "MalformedNameGenerationError";
+	}
+};
+function generationAfter(generation, logicalId) {
+	const next = generation + 1;
+	if (!isNameGeneration(next)) throw new MalformedNameGenerationError(logicalId, "exhausted");
+	return next;
+}
+function nameGenerationOf(record, logicalId) {
+	const value = record.nameGeneration;
+	if (value === void 0) return 0;
+	if (!isNameGeneration(value)) throw new MalformedNameGenerationError(logicalId);
+	return value;
+}
+function nameGenerationHighWaterOf(record, logicalId) {
+	const generation = nameGenerationOf(record, logicalId);
+	const high = record.nameGenerationHigh;
+	if (high === void 0) return generation;
+	if (!isNameGeneration(high)) throw new MalformedNameGenerationError(logicalId);
+	return Math.max(generation, high);
+}
+function retiredNameGenerationsOf(state) {
+	const raw = state.retiredNameGenerations;
+	const out = /* @__PURE__ */ new Map();
+	if (raw === void 0) return out;
+	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) throw new MalformedNameGenerationError("retiredNameGenerations");
+	for (const [logicalId, value] of Object.entries(raw)) {
+		if (!isNameGeneration(value)) throw new MalformedNameGenerationError(logicalId);
+		out.set(logicalId, value);
+	}
+	return out;
+}
+function nameGenerationsOf(state) {
+	const out = /* @__PURE__ */ new Map();
+	for (const [logicalId, retired] of retiredNameGenerationsOf(state)) out.set(logicalId, generationAfter(retired, logicalId));
+	for (const [logicalId, record] of Object.entries(state.resources ?? {})) {
+		if (record === null || typeof record !== "object") continue;
+		out.set(logicalId, nameGenerationOf(record, logicalId));
+	}
+	return out;
+}
+function nextNameGeneration(record, logicalId, stackInstanceId) {
+	let next = generationAfter(nameGenerationHighWaterOf(record, logicalId), logicalId);
+	const physicalId = typeof record.physicalId === "string" ? record.physicalId.toLowerCase() : "";
+	while (physicalId.includes(stackInstanceNameSuffix(stackInstanceId, logicalId, next))) next = generationAfter(next, logicalId);
+	return next;
+}
+function replacementNameGeneration(record, logicalId, stackInstanceId, keepsName) {
+	if (stackInstanceId === void 0 || keepsName) return {
+		generation: void 0,
+		fields: nameGenerationCarriedFrom(record)
+	};
+	const generation = nextNameGeneration(record, logicalId, stackInstanceId);
+	return {
+		generation,
+		fields: nameGenerationField(generation)
+	};
+}
+function nameGenerationField(generation) {
+	return generation === 0 ? {} : { nameGeneration: generation };
+}
+function nameGenerationCarriedFrom(previous) {
+	return {
+		...previous?.nameGeneration !== void 0 && { nameGeneration: previous.nameGeneration },
+		...previous?.nameGenerationHigh !== void 0 && { nameGenerationHigh: previous.nameGenerationHigh }
+	};
+}
+function withNameGenerationReached(record, logicalId, reached) {
+	if (reached === void 0 || !isNameGeneration(reached)) return record;
+	if (reached <= nameGenerationHighWaterOf(record, logicalId)) return record;
+	return {
+		...record,
+		nameGenerationHigh: reached
+	};
+}
+function retiredNameGenerationsAfter(state, leaving) {
+	if (state.stackInstanceId === void 0) return {};
+	const retired = new Map(retiredNameGenerationsOf(state));
+	let changed = false;
+	for (const { logicalId, record } of leaving) {
+		const reached = nameGenerationHighWaterOf(record, logicalId);
+		const before = retired.get(logicalId);
+		if (before !== void 0 && before >= reached) continue;
+		retired.set(logicalId, reached);
+		changed = true;
+	}
+	if (!changed) return state.retiredNameGenerations === void 0 ? {} : { retiredNameGenerations: state.retiredNameGenerations };
+	return { retiredNameGenerations: Object.fromEntries(retired) };
+}
+function nameScopeOf(stackName, stackInstanceId, state) {
+	return {
+		stackName,
+		stackInstanceId,
+		nameGenerations: stackInstanceId === void 0 ? void 0 : nameGenerationsOf(state ?? { resources: {} })
+	};
+}
+function rolledBackCreateReached(create) {
+	let reached = 0;
+	for (const value of [
+		create.record?.nameGeneration,
+		create.record?.nameGenerationHigh,
+		create.nameGeneration
+	]) if (isNameGeneration(value)) reached = Math.max(reached, value);
+	return reached;
+}
+function retiredAfterRollback(state, orphaned, rolledBackCreates = []) {
+	return retiredNameGenerationsAfter(state, [...orphaned.map((o) => ({
+		logicalId: o.logicalId,
+		record: o.state
+	})), ...rolledBackCreates.map((c) => ({
+		logicalId: c.logicalId,
+		record: { nameGenerationHigh: rolledBackCreateReached(c) }
+	}))]);
+}
+function retiredNameGenerationsLeaving(state, remaining) {
+	try {
+		return retiredNameGenerationsAfter(state, Object.entries(state.resources ?? {}).filter(([logicalId, record]) => !Object.hasOwn(remaining, logicalId) && record !== null && typeof record === "object").map(([logicalId, record]) => ({
+			logicalId,
+			record
+		})));
+	} catch {
+		return state.retiredNameGenerations === void 0 ? {} : { retiredNameGenerations: state.retiredNameGenerations };
+	}
+}
+
 //#endregion
 //#region src/deployment/update-outcome.ts
 function updatePartialReason(result) {
@@ -35816,6 +36813,7 @@ function isPlainRecord$1(value) {
 //#endregion
 //#region src/deployment/type-change-guard.ts
 function equalIdNamesDifferentResources(input) {
+	if (input.resourceType === "AWS::Lambda::Permission") return permissionsOnDifferentFunctions(input.oldProperties, input.newProperties);
 	if (input.resourceType !== "AWS::Glue::Table" || input.physicalId === void 0) return false;
 	const oldDb = input.oldProperties?.["DatabaseName"];
 	const newDb = input.newProperties?.["DatabaseName"];
@@ -35824,6 +36822,15 @@ function equalIdNamesDifferentResources(input) {
 	if (segmentAfterAnchor(input.physicalId, oldDb) === void 0 || segmentAfterAnchor(input.physicalId, newDb) === void 0) return false;
 	return oldDb !== newDb;
 }
+function permissionsOnDifferentFunctions(oldProperties, newProperties) {
+	const oldFn = oldProperties?.["FunctionName"];
+	const newFn = newProperties?.["FunctionName"];
+	if (typeof oldFn !== "string" || typeof newFn !== "string") return false;
+	if (carriesSecretMask(oldFn) || carriesSecretMask(newFn)) return false;
+	const oldName = parseLambdaFunctionAddress(oldFn)?.name;
+	const newName = parseLambdaFunctionAddress(newFn)?.name;
+	return oldName !== void 0 && newName !== void 0 && oldName !== newName;
+}
 function equalIdNamesSameResource(input) {
 	if (input.oldType === input.newType) return !equalIdNamesDifferentResources({
 		resourceType: input.oldType,
@@ -36243,6 +37250,30 @@ function planRollback(operations, stateResources, orphanLogicalIds = /* @__PURE_
 		};
 	});
 }
+function renamedReverseReplacement(op, stateResources, orphanLogicalIds, pendingNewIds = /* @__PURE__ */ new Set()) {
+	if (op.changeType !== "UPDATE") return false;
+	if (op.oldDeletedBeforeCreate === true || op.oldResourceMaySurvive !== void 0) return false;
+	const current = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+	const oldId = op.previousState?.physicalId;
+	if (typeof oldId !== "string" || typeof current?.physicalId !== "string") return false;
+	if (current.physicalId === oldId) return false;
+	if (pendingNewIds.has(oldId)) return false;
+	const oldType = op.previousState?.resourceType ?? op.resourceType;
+	for (const [logicalId, other] of Object.entries(stateResources)) {
+		if (logicalId === op.logicalId || typeof other?.physicalId !== "string") continue;
+		if (other.physicalId === oldId || other.resourceType === oldType && samePhysicalId(oldType, other.physicalId, oldId)) return false;
+	}
+	return classifyRollbackOp(op, stateResources, orphanLogicalIds) === "reverse-replacement";
+}
+function revertReferences(op, stateResources) {
+	const current = Object.hasOwn(stateResources, op.logicalId) ? stateResources[op.logicalId] : void 0;
+	const refs = /* @__PURE__ */ new Set();
+	for (const record of [op.previousState, current]) {
+		if (!Array.isArray(record?.dependencies)) continue;
+		for (const id of record.dependencies) if (typeof id === "string") refs.add(id);
+	}
+	return refs;
+}
 function partitionOps(operations) {
 	const createOps = [];
 	const otherOps = [];
@@ -36706,6 +37737,7 @@ async function replayOrphanFlag(s) {
 		const orphanFlagProvisionedBy = effectiveProvisionedBy(record, op.provisionedBy);
 		s.createRollbackRoute = orphanFlagProvisionedBy;
 		delete stateResources[op.logicalId];
+		if (record) noteRolledBackCreate(s, op, record);
 		await noteRetainedResource(op.resourceType, op.logicalId);
 		logger.info(`  Rollback: Orphaning created resource ${safe(op.logicalId)} (--orphan)`);
 		await afterOp?.(op.logicalId);
@@ -36738,6 +37770,7 @@ async function replayOrphanRetain(s) {
 		onOrphan?.(orphaned);
 	}
 	delete stateResources[op.logicalId];
+	noteRolledBackCreate(s, op, record);
 	await noteRetainedResource(op.resourceType, op.logicalId);
 	logger.info(`  Rollback: Leaving ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain) — removed from state`);
 	await afterOp?.(op.logicalId);
@@ -36799,7 +37832,9 @@ async function replayDelete(s) {
 		provisionedBy: deleteRoutedVia,
 		mask
 	});
+	const deletedRecord = stateResources[op.logicalId];
 	delete stateResources[op.logicalId];
+	noteRolledBackCreate(s, op, deletedRecord);
 	logger.info(`  Rollback: ${safe(op.logicalId)} deleted successfully`);
 	await afterOp?.(op.logicalId);
 	ctx.recordEvent?.({
@@ -36864,7 +37899,7 @@ async function replayReadopt(s, survivor) {
 			mask
 		});
 	}
-	stateResources[op.logicalId] = prev;
+	stateResources[op.logicalId] = withNameGenerationReached(prev, op.logicalId, op.nameGeneration);
 	logger.info(`  Rollback: ${safe(op.logicalId)} restored to the ${oldKind} old resource`);
 	await afterOp?.(op.logicalId);
 	const survivorProvisionedBy = current.provisionedBy;
@@ -36947,7 +37982,8 @@ async function replayRevert(s) {
 		properties: desiredProps,
 		logicalId: op.logicalId,
 		physicalId: current.physicalId,
-		via: revertVia
+		via: revertVia,
+		nameGeneration: nameGenerationOf(current, op.logicalId)
 	}, logger, mask, false)(() => updateWithRollbackRetry(provider, [
 		op.logicalId,
 		current.physicalId,
@@ -37059,7 +38095,8 @@ async function replayReverseReplacement(s) {
 		properties: resolvedPrevProps,
 		logicalId: op.logicalId,
 		physicalId: prev.physicalId,
-		via: createProvisionedBy
+		via: createProvisionedBy,
+		nameGeneration: nameGenerationOf(prev, op.logicalId)
 	}, logger, mask, true);
 	const resolveNewDeleteRoute = () => ctx.providerRegistry.getProviderFor({
 		resourceType: op.resourceType,
@@ -37101,6 +38138,10 @@ async function replayReverseReplacement(s) {
 		throwIfDeleteSkipped(deleteNewFirst, op.logicalId, current.physicalId, purpose, newDeleteGuardScope(deleteNewFirstRoute.provisionedBy));
 		delete stateResources[op.logicalId];
 		await afterOp?.(op.logicalId);
+		await deleteNewFirstRoute.provider.waitForNameReleased?.(op.logicalId, current.physicalId, current.resourceType, {
+			isInterrupted: () => isInterrupted?.() === true,
+			maskSecrets: mask
+		});
 	};
 	const recreateAfterNewDeleted = async () => {
 		try {
@@ -37133,7 +38174,7 @@ async function replayReverseReplacement(s) {
 			oldResourceType: oldType,
 			newResourceType: op.resourceType,
 			requested: replayCreateProps(),
-			generated: typeof op.logicalId === "string" ? applyDefaultNameForFallback(op.logicalId, oldType, resolvedPrevProps) : void 0,
+			generated: typeof op.logicalId === "string" ? applyDefaultNameForFallback(op.logicalId, oldType, resolvedPrevProps, "omit") : void 0,
 			logicalId: op.logicalId,
 			createdVia: createProvisionedBy,
 			mask,
@@ -37192,56 +38233,125 @@ async function replayReverseReplacement(s) {
 	const { observedProperties: _staleObserved, ...prevRecord } = prev;
 	recordNoEchoAttributeValues(createResult, secrets, resolvedPrevProps);
 	stateResources[op.logicalId] = redactRollbackRecord({
-		...prevRecord,
+		...withNameGenerationReached(prevRecord, op.logicalId, op.nameGeneration),
 		physicalId: createResult.physicalId,
 		attributes: createResult.attributes ?? {},
 		properties: recordedPropertiesAfterReplayCreate(prevRecord, createResult)
 	}, secrets, prevRecord.properties, prevRecord.attributes);
 	if (!adoptedLiveNewResource) inlinePolicyWriters.record(op.logicalId, "create", stateResources[op.logicalId], false, createProvisionedBy);
+	const deferral = s.deferral !== void 0 && !deletedNewFirst && !adoptedLiveNewResource && !rollbackRetainsNewResource(current) ? s.deferral : void 0;
+	const supersededFinalSnapshot = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
+	const supersededPolicy = current.updateReplacePolicy;
+	const superseded = {
+		logicalId: op.logicalId,
+		supersededAt: Date.now(),
+		state: current,
+		...(supersededPolicy === "Delete" || supersededPolicy === "Snapshot" || supersededPolicy === "RetainExceptOnCreate") && { updateReplacePolicy: supersededPolicy },
+		...supersededFinalSnapshot !== void 0 && { finalSnapshotIdentifier: supersededFinalSnapshot }
+	};
+	const recordSuperseded = deferral?.onSuperseded !== void 0 && canRecordSuperseded(current, {});
+	if (recordSuperseded) deferral?.onSuperseded?.(superseded);
 	await afterOp?.(op.logicalId);
-	let survivorReason;
-	const survivorId = retainedSurvivorId(current, op);
-	if (!deletedNewFirst && !adoptedLiveNewResource && rollbackRetainsNewResource(current)) {
-		const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, survivorId ?? "no recorded id", `State records the re-created old resource (${stateResources[op.logicalId]?.physicalId ?? prev.physicalId}).`, mask);
-		logger.warn(survivorMessages.warn);
-		survivorReason = survivorMessages.reason;
-		result.warnings++;
-		await noteRetainedResource(op.resourceType, op.logicalId);
-	} else if (!deletedNewFirst && !adoptedLiveNewResource) try {
-		const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
-		const deleteNewAfterRecreateRoute = resolveNewDeleteRoute();
-		const deleteNewAfterRecreate = await withReplayDeletePrinting(s, () => deleteNewAfterRecreateRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
-			expectedRegion: ctx.region,
-			...newCopyClaimed && { inlinePolicyClaimed: newCopyClaimed },
-			...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
-			deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
-			recordedAttributes: current.attributes,
-			recordedNoEchoLeaves: current.noEchoLeaves,
-			maskSecrets: mask
-		}));
-		throwIfDeleteSkipped(deleteNewAfterRecreate, op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one", newDeleteGuardScope(deleteNewAfterRecreateRoute.provisionedBy));
-	} catch (deleteError) {
-		logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(mask(current.physicalId))}) failed: ${displaySafe(describeAwsFailure(deleteError).detail)}. Delete it manually — it is no longer tracked in state.`));
-		survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${describeAwsFailure(deleteError).detail}. It is live, still billing, and no longer tracked by cdkd — delete it yourself.`;
+	const finish = async () => {
+		let survivorReason;
+		const survivorId = retainedSurvivorId(current, op);
+		if (!deletedNewFirst && !adoptedLiveNewResource && rollbackRetainsNewResource(current)) {
+			const survivorMessages = retainedSurvivorMessages(op.logicalId, op.resourceType, survivorId ?? "no recorded id", `State records the re-created old resource (${stateResources[op.logicalId]?.physicalId ?? prev.physicalId}).`, mask);
+			logger.warn(survivorMessages.warn);
+			survivorReason = survivorMessages.reason;
+			result.warnings++;
+			await noteRetainedResource(op.resourceType, op.logicalId);
+		} else if (!deletedNewFirst && !adoptedLiveNewResource) try {
+			const finalSnapshotIdentifier = rollbackFinalSnapshotId(op.resourceType, current, op.provisionedBy);
+			const deleteNewAfterRecreateRoute = resolveNewDeleteRoute();
+			const deleteNewAfterRecreate = await withReplayDeletePrinting(s, () => deleteNewAfterRecreateRoute.provider.delete(op.logicalId, current.physicalId, op.resourceType, current.properties, {
+				expectedRegion: ctx.region,
+				...newCopyClaimed && { inlinePolicyClaimed: newCopyClaimed },
+				...finalSnapshotIdentifier !== void 0 && { finalSnapshotIdentifier },
+				deletionPolicy: replacementDeletePolicy(current.updateReplacePolicy),
+				recordedAttributes: current.attributes,
+				recordedNoEchoLeaves: current.noEchoLeaves,
+				maskSecrets: mask
+			}));
+			throwIfDeleteSkipped(deleteNewAfterRecreate, op.logicalId, current.physicalId, "while deleting the new resource after re-creating the old one", newDeleteGuardScope(deleteNewAfterRecreateRoute.provisionedBy));
+		} catch (deleteError) {
+			logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but deleting the new resource (${displaySafe(mask(current.physicalId))}) failed: ${displaySafe(describeAwsFailure(deleteError).detail)}. ` + (recordSuperseded ? `${SUPERSEDED_KEPT_REMEDY}.` : `Delete it manually — it is no longer tracked in state.`)));
+			survivorReason = `The replacement's new ${op.resourceType} (${current.physicalId}) could not be deleted after the old resource was re-created: ${describeAwsFailure(deleteError).detail}. ` + (recordSuperseded ? `It is live and still billing; ${SUPERSEDED_KEPT_REMEDY}.` : `It is live, still billing, and no longer tracked by cdkd — delete it yourself.`);
+			result.warnings++;
+		}
+		const recreatedId = displaySafe(mask(String(createResult.physicalId)));
+		logger.info(mask(adoptedLiveNewResource ? `  Rollback: ${safe(op.logicalId)} adopted the live resource (${recreatedId}) — replacement NOT fully reversed (name-idempotent Create API)` : `  Rollback: ${safe(op.logicalId)} replacement reversed (old resource re-created as ${recreatedId})`));
+		const survivorProvisionedBy = current.provisionedBy;
+		ctx.recordEvent?.({
+			eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+			stackName,
+			operation: "UPDATE",
+			logicalId: op.logicalId,
+			resourceType: op.resourceType,
+			...op.provisionedBy && { provisionedBy: op.provisionedBy },
+			...survivorReason !== void 0 && {
+				...survivorId !== void 0 && { physicalId: survivorId },
+				reason: mask(survivorReason),
+				...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
+			},
+			...adoptedLiveNewResource && { reason: mask("The re-create returned the live new resource instead of re-creating the old one (its Create API is name-idempotent), so the replacement was NOT fully reversed: the old resource's original properties may not have been re-applied. Inspect it with `cdkd drift` and run `cdkd deploy` to reconcile.") }
+		});
+		return survivorReason === void 0;
+	};
+	const keep = (reason) => {
+		logger.warn(mask(`  Rollback: old ${safe(op.logicalId)} re-created, but the new resource (${displaySafe(mask(current.physicalId))}) was not deleted: ${reason}. ${SUPERSEDED_KEPT_REMEDY}.`));
 		result.warnings++;
+		ctx.recordEvent?.({
+			eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+			stackName,
+			operation: "UPDATE",
+			logicalId: op.logicalId,
+			resourceType: op.resourceType,
+			...current.provisionedBy && { provisionedBy: current.provisionedBy },
+			physicalId: current.physicalId,
+			reason: mask(`The old resource was re-created; the new one (${current.physicalId}) was not deleted: ${reason}. ${SUPERSEDED_KEPT_REMEDY}.`)
+		});
+	};
+	if (deferral !== void 0) {
+		logger.info(safeMsg`  Rollback: old ${safe(op.logicalId)} re-created first; the new resource ` + safeMsg`(${mask(current.physicalId)}) is deleted once the resources that reference it ` + `are reverted`);
+		deferral.defer(async () => {
+			let gone = false;
+			try {
+				if (supersededHolderOf(superseded, stateResources) !== void 0) {
+					logger.warn(safeMsg`  Rollback: not deleting the new ${shownLogicalId(op.logicalId)} ` + safeMsg`(${mask(current.physicalId)}): a record of this stack now holds its ` + `physical id. Check it with cdkd drift.`);
+					result.warnings++;
+					ctx.recordEvent?.({
+						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
+						stackName,
+						operation: "UPDATE",
+						logicalId: op.logicalId,
+						resourceType: op.resourceType,
+						...op.provisionedBy && { provisionedBy: op.provisionedBy },
+						reason: mask(`The old resource was re-created; the new one (${current.physicalId}) was not deleted because a record of this stack now holds its physical id.`)
+					});
+					gone = true;
+				} else gone = await finish();
+			} catch (finishError) {
+				logger.warn(maskedFailureText(`  Rollback failed for ${shownLogicalId(op.logicalId)} (UPDATE): `, finishError, mask));
+				result.failures++;
+				ctx.recordEvent?.({
+					eventType: "ROLLBACK_RESOURCE_FAILED",
+					stackName,
+					operation: op.changeType,
+					logicalId: op.logicalId,
+					resourceType: op.resourceType,
+					...op.provisionedBy && { provisionedBy: op.provisionedBy },
+					error: maskedRollbackEventError(finishError, mask)
+				});
+			}
+			if (recordSuperseded && gone) {
+				deferral.onSupersededSettled?.(superseded);
+				await afterOp?.(op.logicalId);
+			}
+		}, recordSuperseded ? keep : void 0);
+		return;
 	}
-	const recreatedId = displaySafe(mask(String(createResult.physicalId)));
-	logger.info(mask(adoptedLiveNewResource ? `  Rollback: ${safe(op.logicalId)} adopted the live resource (${recreatedId}) — replacement NOT fully reversed (name-idempotent Create API)` : `  Rollback: ${safe(op.logicalId)} replacement reversed (old resource re-created as ${recreatedId})`));
-	const survivorProvisionedBy = current.provisionedBy;
-	ctx.recordEvent?.({
-		eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
-		stackName,
-		operation: "UPDATE",
-		logicalId: op.logicalId,
-		resourceType: op.resourceType,
-		...op.provisionedBy && { provisionedBy: op.provisionedBy },
-		...survivorReason !== void 0 && {
-			...survivorId !== void 0 && { physicalId: survivorId },
-			reason: mask(survivorReason),
-			...survivorProvisionedBy && { provisionedBy: survivorProvisionedBy }
-		},
-		...adoptedLiveNewResource && { reason: mask("The re-create returned the live new resource instead of re-creating the old one (its Create API is name-idempotent), so the replacement was NOT fully reversed: the old resource's original properties may not have been re-applied. Inspect it with `cdkd drift` and run `cdkd deploy` to reconcile.") }
-	});
+	await finish();
 }
 async function deleteMarkedRecreate(error, s) {
 	const madeId = createdBeforeFailure(error, s.op.logicalId, s.oldType);
@@ -37318,7 +38428,8 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 		warnings: 0,
 		skipped: 0,
 		interrupted: false,
-		orphaned: []
+		orphaned: [],
+		rolledBackCreates: []
 	};
 	if (operations.length === 0) {
 		ctx.logger.info("No completed operations to roll back.");
@@ -37335,13 +38446,77 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 	markDeleteFirstBlocked(operations, options.failedOperations);
 	const { createOps, otherOps } = partitionOps(operations);
 	const createdInSegment = new Set(createOps.map((o) => o.logicalId));
-	for (const op of orderInlinePolicyReversals([...otherOps].reverse(), stateResources)) {
+	const stepOne = orderInlinePolicyReversals([...otherOps].reverse(), stateResources);
+	const stepOneIds = /* @__PURE__ */ new Map();
+	const stepOneIndex = /* @__PURE__ */ new Map();
+	stepOne.forEach((op, at) => {
+		if (!stepOneIds.has(op.logicalId)) stepOneIds.set(op.logicalId, op);
+		stepOneIndex.set(op, at);
+	});
+	const started = /* @__PURE__ */ new Set();
+	const pendingNewDeletes = /* @__PURE__ */ new Map();
+	const failedOps = /* @__PURE__ */ new Set();
+	const usedByFailedRevert = (target) => [...failedOps].some((failed) => failed !== target && revertReferences(failed, stateResources).has(target.logicalId));
+	const pendingNewIds = /* @__PURE__ */ new Set();
+	const runOp = async (op, deferral) => {
+		const failuresBefore = result.failures;
+		const skippedBefore = result.skipped;
+		await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted, createdInSegment, options.onRolledBackCreate, deferral);
+		if (result.failures > failuresBefore || result.skipped > skippedBefore) failedOps.add(op);
+	};
+	const recreateAhead = async (refs) => {
+		for (const target of [...refs].map((id) => stepOneIds.get(id))) {
+			if (target === void 0 || started.has(target)) continue;
+			if (!renamedReverseReplacement(target, stateResources, orphanLogicalIds, pendingNewIds)) continue;
+			const ownRefs = revertReferences(target, stateResources);
+			if ([...ownRefs].some((id) => {
+				const named = stepOneIds.get(id);
+				return named !== void 0 && !started.has(named) && stepOneIndex.get(named) < stepOneIndex.get(target) && !renamedReverseReplacement(named, stateResources, orphanLogicalIds, pendingNewIds);
+			})) continue;
+			if (options.isInterrupted?.()) return;
+			started.add(target);
+			await recreateAhead(ownRefs);
+			if (options.isInterrupted?.()) return;
+			const newId = stateResources[target.logicalId]?.physicalId;
+			await runOp(target, {
+				defer: (finish, keep) => {
+					pendingNewDeletes.set(target, {
+						finish: async () => {
+							await finish();
+							if (typeof newId === "string") pendingNewIds.delete(newId);
+						},
+						keep
+					});
+					if (typeof newId === "string") pendingNewIds.add(newId);
+				},
+				onSuperseded: options.onSuperseded,
+				onSupersededSettled: options.onSupersededSettled
+			});
+		}
+	};
+	for (const op of stepOne) {
 		if (options.isInterrupted?.()) {
 			result.interrupted = true;
 			break;
 		}
-		await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted, createdInSegment);
+		if (!started.has(op)) await recreateAhead(revertReferences(op, stateResources));
+		if (options.isInterrupted?.()) {
+			result.interrupted = true;
+			break;
+		}
+		if (started.has(op)) {
+			const pending = pendingNewDeletes.get(op);
+			pendingNewDeletes.delete(op);
+			if (pending?.keep !== void 0 && usedByFailedRevert(op)) pending.keep("a resource that references it did not revert");
+			else await pending?.finish();
+			continue;
+		}
+		started.add(op);
+		await runOp(op);
 	}
+	for (const pending of pendingNewDeletes.values()) if (pending.keep !== void 0) pending.keep("the rollback was interrupted");
+	else await pending.finish();
+	pendingNewDeletes.clear();
 	if (!result.interrupted && createOps.length > 0) {
 		const sorted = sortRollbackCreates(createOps, stateResources);
 		for (const op of sorted) {
@@ -37349,7 +38524,7 @@ async function replayRollbackUnbound(operations, stateResources, stackName, ctx,
 				result.interrupted = true;
 				break;
 			}
-			await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted, createdInSegment);
+			await replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, options.onOrphan, inlinePolicyWriters, options.afterOp, options.isInterrupted, createdInSegment, options.onRolledBackCreate);
 		}
 	}
 	await restoreHeldInlinePolicies(inlinePolicyWriters, stateResources, stackName, ctx, result);
@@ -37379,7 +38554,7 @@ async function journaledOrphanKeepReason(op, foreignHolder, ctx) {
 		return typeof journaled === "string" && journaled !== "" ? { retry: "its live identity could not be read, so nothing proves the resource now under that id is the one it created" } : { keep: "nothing proves the resource now under that id is the one it created (the journal recorded no identity for it; it may have been deleted and its name reused)" };
 	}
 }
-async function replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, onOrphan, inlinePolicyWriters, afterOp, isInterrupted, createdInSegment = /* @__PURE__ */ new Set()) {
+async function replaySingle(op, stateResources, stackName, ctx, resolver, orphanLogicalIds, result, onOrphan, inlinePolicyWriters, afterOp, isInterrupted, createdInSegment = /* @__PURE__ */ new Set(), onRolledBackCreate, deferral) {
 	const action = classifyRollbackOp(op, stateResources, orphanLogicalIds);
 	const { logger } = ctx;
 	const secrets = /* @__PURE__ */ new Map();
@@ -37396,6 +38571,7 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 		orphanLogicalIds,
 		result,
 		onOrphan,
+		onRolledBackCreate,
 		inlinePolicyWriters,
 		afterOp,
 		isInterrupted,
@@ -37405,7 +38581,8 @@ async function replaySingle(op, stateResources, stackName, ctx, resolver, orphan
 		opMasker,
 		mask,
 		createdInSegment,
-		createRollbackRoute: void 0
+		createRollbackRoute: void 0,
+		deferral
 	};
 	const recordBefore = ownRecord(stateResources, op.logicalId);
 	try {
@@ -37469,9 +38646,14 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 		remainingFailedOps: [],
 		skippedOps: [],
 		orphaned: [],
+		rolledBackCreates: [],
 		leftInPlace: 0
 	};
 	const { logger } = ctx;
+	const rolledBack = {
+		result,
+		onRolledBackCreate: options.onRolledBackCreate
+	};
 	const resolver = new ReplayResolvers(ctx.region);
 	const emitEnvelope = options.emitEnvelope === true && failedOps.length > 0;
 	if (emitEnvelope) ctx.recordEvent?.({
@@ -37548,7 +38730,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						result.orphaned.push(orphaned);
 						options.onOrphan?.(orphaned);
 					}
-					if (!recordUnderIdIsNotOwn(op, stateResources)) delete stateResources[op.logicalId];
+					if (!recordUnderIdIsNotOwn(op, stateResources)) {
+						delete stateResources[op.logicalId];
+						noteRolledBackCreate(rolledBack, op, failedCreateRecord);
+					}
 					await noteRetainedResource(op.resourceType, op.logicalId);
 					logger.info(`  Rollback: leaving partially-created ${safe(op.logicalId)} (${safe(op.resourceType)}) in AWS (DeletionPolicy: Retain)` + (failedCreateRecord ? " — removed from state" : " — it was never in state"));
 					await options.afterOp?.(op.logicalId);
@@ -37582,7 +38767,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						}, ctx.foreignHolder, ctx);
 						if (verdict === "gone") {
 							logger.info(safeMsg`  Rollback: partially-created ${shownLogicalId(op.logicalId)} (${refusalResourceType(op.resourceType)}) is already gone — nothing to delete`);
-							if (!recordUnderIdIsNotOwn(op, stateResources)) delete stateResources[op.logicalId];
+							if (!recordUnderIdIsNotOwn(op, stateResources)) {
+								delete stateResources[op.logicalId];
+								noteRolledBackCreate(rolledBack, op, failedCreateRecord);
+							}
 							await options.afterOp?.(op.logicalId);
 							ctx.recordEvent?.({
 								eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -37649,7 +38837,10 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						result.warnings++;
 						result.leftInPlace++;
 					}
-					if (!recordUnderIdIsNotOwn(op, stateResources)) delete stateResources[op.logicalId];
+					if (!recordUnderIdIsNotOwn(op, stateResources)) {
+						delete stateResources[op.logicalId];
+						noteRolledBackCreate(rolledBack, op, failedCreateRecord);
+					}
 					await options.afterOp?.(op.logicalId);
 					ctx.recordEvent?.({
 						eventType: "ROLLBACK_RESOURCE_SUCCEEDED",
@@ -37714,7 +38905,8 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						properties: desiredProps,
 						logicalId: op.logicalId,
 						physicalId: current.physicalId,
-						via: revertVia
+						via: revertVia,
+						nameGeneration: nameGenerationOf(current, op.logicalId)
 					}, logger, mask, false)(() => updateWithRollbackRetry(provider, [
 						op.logicalId,
 						current.physicalId,
@@ -37730,7 +38922,7 @@ async function replayFailedOperationsUnbound(failedOps, stateResources, stackNam
 						}
 					], op.logicalId, logger, options.isInterrupted, secrets, mask));
 					if (revertFailedResult) recordNoEchoAttributeValues(revertFailedResult, secrets, desiredProps);
-					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(recordAfterRollbackUpdate(prev, revertFailedResult), secrets, prev.properties, prev.attributes), prev, noEcho.substituted);
+					stateResources[op.logicalId] = maskRestoredNoEchoRecord(redactRollbackRecord(withNameGenerationReached(recordAfterRollbackUpdate(prev, revertFailedResult), op.logicalId, op.nameGeneration), secrets, prev.properties, prev.attributes), prev, noEcho.substituted);
 					if (updatePartialReason(revertFailedResult) === void 0) inlinePolicyWriters.record(op.logicalId, "update", stateResources[op.logicalId], !deepEqual$1(prev.properties?.["Policies"], (op.attemptedProperties ?? current.properties)?.["Policies"]), revertVia);
 					const revertFailedPartial = updatePartialReason(revertFailedResult);
 					if (revertFailedPartial !== void 0) logger.warn(mask(`  Rollback: ${safe(op.logicalId)} reverted, ${updatePartialMessage(revertFailedPartial)}`));
@@ -38095,6 +39287,69 @@ function healPrintingBag(baseline, logicalId, resource, namingSecrets) {
 	return hit.judge(logicalId);
 }
 
+//#endregion
+//#region src/deployment/deploy-engine/superseded-retry.ts
+async function retryCarriedSupersededResources(engine, host, carried, resources, options = {}) {
+	let changed = false;
+	if (carried.length === 0) return changed;
+	const view = {
+		live: () => Object.entries(resources),
+		survivors: () => Object.entries(resources)
+	};
+	for (const entry of carried) {
+		if (engine.interrupted) break;
+		const { logicalId } = entry;
+		const { physicalId, resourceType } = entry.state;
+		const bag = unionOfSecretBags([secretNameBagFor(engine.secretsRun, logicalId), orphanRecordsPrintingBag([entry])]);
+		const holder = supersededHolderOf(entry, resources);
+		if (holder !== void 0) {
+			removeSuperseded(host, entry);
+			changed = true;
+			if (holder.resourceType !== resourceType) {
+				withPrintingSecrets(bag, () => engine.logger.warn(safeMsg`  ⚠ ${supersededHeldByOtherTypeWarning(entry, holder.resourceType)}`));
+				continue;
+			}
+			withPrintingSecrets(bag, () => engine.logger.debug(safeMsg`Superseded ${logicalId} (${physicalId}) is held by a record again; not deleting it`));
+			continue;
+		}
+		await withPrintingSecrets(bag, () => withStackRecords(view, async () => {
+			engine.logger.info(safeMsg`  Deleting old ${logicalId} (${physicalId}), superseded by an earlier deploy...`);
+			let outcome;
+			try {
+				const route = engine.providerRegistry.getProviderFor({
+					resourceType,
+					...entry.state.provisionedBy !== void 0 && { provisionedBy: entry.state.provisionedBy }
+				});
+				outcome = await deleteSupersededEntry(entry, {
+					provider: route.provider,
+					region: engine.stackRegion,
+					maskSecrets: createSecretMasker(bag),
+					stop: () => engine.interrupted,
+					once: options.waitInUse !== true
+				});
+			} catch (error) {
+				outcome = {
+					kind: "failed",
+					error
+				};
+			}
+			if (outcome.kind === "failed") {
+				const detail = maskSecretsInText(describeAwsFailure(outcome.error).detail, bag);
+				engine.logger.warn(safeMsg`  ⚠ Failed to delete old resource ${logicalId} (${physicalId}): ${detail}. ${SUPERSEDED_KEPT_REMEDY}.`);
+				return;
+			}
+			removeSuperseded(host, entry);
+			changed = true;
+			if (outcome.kind === "notDeleted") {
+				engine.logger.warn(safeMsg`  ⚠ ${deleteSkippedMessage(logicalId, physicalId, outcome.reason, "while cleaning up the superseded resource", { commandFreeLine: true })}. Delete it manually — it is no longer tracked in state.`);
+				return;
+			}
+			engine.logger.info(safeMsg`  ${green("✓")} Old ${logicalId} (${physicalId}) deleted`);
+		}));
+	}
+	return changed;
+}
+
 //#endregion
 //#region src/provisioning/name-lookup.ts
 const inFlight = /* @__PURE__ */ new Map();
@@ -38193,7 +39448,8 @@ var GeneratedNameGuard = class GeneratedNameGuard {
 	static start(input) {
 		const candidates = [];
 		for (const change of input.changes) {
-			if (change.changeType !== "CREATE") continue;
+			const generation = change.changeType === "UPDATE" ? input.replacementGeneration?.(change) : void 0;
+			if (change.changeType !== "CREATE" && generation === void 0) continue;
 			const properties = change.desiredProperties ?? {};
 			let decision;
 			let name;
@@ -38204,7 +39460,11 @@ var GeneratedNameGuard = class GeneratedNameGuard {
 					properties
 				});
 				if (!replacementCreateAdoptsName(change.resourceType, decision.provisionedBy)) continue;
-				name = decision.provider.generatedCreateName?.(change.resourceType, change.logicalId, properties);
+				const derive = () => decision.provider.generatedCreateName?.(change.resourceType, change.logicalId, properties);
+				name = generation === void 0 ? derive() : withNameGeneration({
+					logicalId: change.logicalId,
+					generation
+				}, derive);
 				deferred = decision.provider.lookupNeedsResolvedProperties?.(change.resourceType, properties) === true;
 			} catch {
 				continue;
@@ -38504,7 +39764,7 @@ var GeneratedNameGuard = class GeneratedNameGuard {
 			});
 			unlicensed.push(c);
 		}
-		if (unlicensed.length > 0 && input.loadKeptInHistory !== void 0 && evidence !== void 0 && !("error" in evidence) && evidence.retainedAbsent) {
+		if (unlicensed.length > 0 && input.newScheme !== true && input.loadKeptInHistory !== void 0 && evidence !== void 0 && !("error" in evidence) && evidence.retainedAbsent) {
 			let kept;
 			try {
 				this.historyRead ??= input.loadKeptInHistory();
@@ -38667,14 +39927,15 @@ async function lookupAll(input, candidates) {
 	};
 }
 async function loadEvidence(input) {
-	const [journal, retained] = await Promise.all([input.loadJournal(), input.loadRetained()]);
+	const kept = input.newScheme !== true;
+	const [journal, retained] = await Promise.all([input.loadJournal(), kept ? input.loadRetained() : Promise.resolve([])]);
 	const sources = [];
 	for (const record of Object.values(input.records)) if (typeof record?.physicalId === "string") sources.push({
 		via: "record",
 		type: record.resourceType,
 		id: record.physicalId
 	});
-	for (const orphan of input.orphans ?? []) {
+	for (const orphan of kept ? input.orphans ?? [] : []) {
 		const s = orphan.state;
 		if (typeof s?.physicalId === "string") sources.push({
 			via: "orphan",
@@ -38853,7 +40114,7 @@ function warnDropFailed(logger, stackName, region, logicalIds) {
 	logger.warn(safeMsg`${hint.intro}`);
 	for (const command of hint.commands) logger.warn(safeMsg`Drop with: ${command}`);
 }
-async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, options = {}) {
+async function deleteJournaledOrphans(orphans, stateResources, stackName, stackInstanceId, ctx, options = {}) {
 	const total = {
 		failures: 0,
 		warnings: 0,
@@ -38877,7 +40138,10 @@ async function deleteJournaledOrphans(orphans, stateResources, stackName, ctx, o
 			break;
 		}
 		const ops = [...companions ?? [], ...orphanOps];
-		const replay = () => withPrintingSecrets(printing, () => withStackName(stackName, () => replayFailedOperations(ops, stateResources, stackName, maskedCtx, {
+		const replay = () => withPrintingSecrets(printing, () => withStackScope(nameScopeOf(stackName, stackInstanceId, {
+			resources: stateResources,
+			...options.retiredNameGenerations !== void 0 && { retiredNameGenerations: options.retiredNameGenerations }
+		}), () => replayFailedOperations(ops, stateResources, stackName, maskedCtx, {
 			emitEnvelope: false,
 			inlinePolicyWriters,
 			forDestroy: true,
@@ -38963,14 +40227,15 @@ async function settleJournaledOrphansOnSuccess(args) {
 				count: orphans.count - unreadable.size - tracked.size
 			};
 			const writtenThisRun = [...orphans.deployLogicalIds ?? []].filter((id) => Object.prototype.hasOwnProperty.call(stateResources, id)).map((id) => stateResources[id]).filter((r) => r !== void 0 && r !== null && typeof r === "object");
-			const outcome = await deleteJournaledOrphans(acting, { ...stateResources }, stackName, {
+			const outcome = await deleteJournaledOrphans(acting, { ...stateResources }, stackName, args.stackInstanceId, {
 				...ctx,
 				writtenThisRun,
 				foreignHolder: args.foreignHolder,
 				orphanDeleteProven: proven
 			}, {
 				pointAtDrop: false,
-				...args.isInterrupted && { isInterrupted: args.isInterrupted }
+				...args.isInterrupted && { isInterrupted: args.isInterrupted },
+				retiredNameGenerations: args.retiredNameGenerations
 			});
 			leftInPlace = outcome.leftInPlace;
 			failedDeletes = outcome.failedLogicalIds;
@@ -39425,10 +40690,13 @@ async function revertNestedChildFromJournal(args) {
 		refuseMalformedState(base, childStackName, region, refusalRecovery);
 		refuseMalformedOrphans(base, childStackName, region, refusalRecovery);
 		refuseMalformedOrphanRecords(base, childStackName, region, refusalRecovery);
+		const childNamingScope = nameScopeOf(childStackName, stackInstanceIdOf(base, displayStackName(childStackName)), base);
 		const segments = ((await ctx.stateBackend.loadRollbackJournal(childStackName, region))?.segments ?? []).filter((segment) => segment.runId === runId);
 		if (segments.length === 0) refuse("its rollback journal holds no segment for this deploy run, so there is no record of what it held before.");
 		const stateResources = { ...base.resources };
 		const mintedOrphans = [];
+		const rolledBackCreates = [];
+		const supersededHost = {};
 		const restoredOutputs = segments.find((s) => s.previousOutputs)?.previousOutputs;
 		const restoredReads = segments.find((s) => s.previousCrossStackReads)?.previousCrossStackReads;
 		let currentEtag = stateData.etag;
@@ -39437,10 +40705,13 @@ async function revertNestedChildFromJournal(args) {
 		const { skippedOutputs: _dropped, ...carried } = base;
 		const next = () => ({
 			...carried,
-			version: 12,
+			...stackInstanceIdCarriedFrom(base),
+			...supersededAfterRollback(base, supersededHost),
+			version: 13,
 			region,
 			resources: { ...stateResources },
 			...orphansAfterRollback(base, mintedOrphans),
+			...retiredAfterRollback(base, mintedOrphans, rolledBackCreates),
 			...restoring && restoredOutputs && { outputs: { ...restoredOutputs.outputs } },
 			...restoring && restoredReads && {
 				...restoredReads.imports && { imports: [...restoredReads.imports] },
@@ -39509,12 +40780,15 @@ async function revertNestedChildFromJournal(args) {
 			const segment = segments[s];
 			const skipPrefix = segment.skipPrefix ?? getCurrentSkipPrefix();
 			const split = splitImportedOps(segment.operations, segment);
-			const result = await withNestedStackContext(childCtx, () => withSkipPrefix(skipPrefix, () => withStackName(childStackName, () => withCreateTokenLedger(ledgerForStack(ctx.stateBackend, childStackName, region), () => withNestedRevertRun(runId, async (inner) => {
+			const result = await withNestedStackContext(childCtx, () => withSkipPrefix(skipPrefix, () => withStackScope(childNamingScope, () => withCreateTokenLedger(ledgerForStack(ctx.stateBackend, childStackName, region), () => withNestedRevertRun(runId, async (inner) => {
 				const replayed = await withPrintingSecrets(journaledOrphanPrintingBag(completedReplayEntries(split.replay), stateResources), () => replayRollback(split.replay, stateResources, childStackName, execCtx, {
 					afterOp: save,
 					onOrphan: (record) => mintedOrphans.push(record),
+					onRolledBackCreate: (create) => rolledBackCreates.push(create),
 					inlinePolicyWriters,
-					failedOperations: segment.failedOperations
+					failedOperations: segment.failedOperations,
+					onSuperseded: (entry) => addSuperseded(supersededHost, entry),
+					onSupersededSettled: (entry) => removeSuperseded(supersededHost, entry)
 				}));
 				for (const [id, below] of inner.settled) settledBelow.set(id, below);
 				return {
@@ -39544,13 +40818,18 @@ async function revertNestedChildFromJournal(args) {
 
 //#endregion
 //#region src/deployment/retained-readoption.ts
-function keptForReadoption(resource) {
-	if (!replacementCreateAdoptsName(resource.resourceType, resource.provisionedBy)) return false;
+function keptUnderGeneratedName(resource) {
 	if (typeof resource.physicalId !== "string" || resource.physicalId === "") return false;
 	const property = explicitNamePropertyFor(resource.resourceType);
 	const properties = resource.properties;
 	return property === void 0 || !properties?.[property];
 }
+function keptForRetainedRecord(resource) {
+	return replacementCreateAdoptsName(resource.resourceType, "sdk") ? keptForReadoption(resource) : keptUnderGeneratedName(resource);
+}
+function keptForReadoption(resource) {
+	return replacementCreateAdoptsName(resource.resourceType, resource.provisionedBy) && keptUnderGeneratedName(resource);
+}
 async function recordRetainedForReadoption(backend, stackName, region, kept, logger, earlier) {
 	if (kept.length === 0) {
 		try {
@@ -39566,10 +40845,10 @@ async function recordRetainedForReadoption(backend, stackName, region, kept, log
 		await backend.saveRetainedResources(stackName, region, [...before.filter((e) => !keptIds.has(e.logicalId)), ...kept]);
 	} catch (error) {
 		if (error instanceof RetainedTimeUnconfirmedError) {
-			logger.warn(safeMsg`Recorded the ${String(kept.length)} kept resource(s) of ${displayStackName(stackName)} ` + safeMsg`a later deploy takes back by name, but their time could not be confirmed from S3 ` + safeMsg`(${describeAwsFailure(error.cause).summary}); they carry this machine's clock instead.`);
+			logger.warn(safeMsg`Recorded the ${String(kept.length)} kept resource(s) of ${displayStackName(stackName)}, ` + safeMsg`but their time could not be confirmed from S3 ` + safeMsg`(${describeAwsFailure(error.cause).summary}); they carry this machine's clock instead.`);
 			return;
 		}
-		logger.warn(safeMsg`Could not record the ${String(kept.length)} kept resource(s) of ${displayStackName(stackName)} ` + safeMsg`a later deploy takes back by name (${describeAwsFailure(error).summary}). That deploy ` + `refuses to create them over the kept ones; adopt them with 'cdkd import' then.`);
+		logger.warn(safeMsg`Could not record the ${String(kept.length)} kept resource(s) of ${displayStackName(stackName)} ` + safeMsg`(${describeAwsFailure(error).summary}). A later deploy may refuse to create one over ` + `its kept copy, or not name them; adopt a kept one with 'cdkd import'.`);
 	}
 }
 var KeptForReadoption = class {
@@ -39630,7 +40909,7 @@ async function provisionDelete(deps, logicalId, change, stateResources, stackNam
 		deps.logger.info(safeMsg`Retaining ${logicalId} (${resourceType}) - DeletionPolicy: ${deletionPolicy}`);
 		delete stateResources[logicalId];
 		await noteRetainedResource(resourceType, logicalId);
-		if (keptForReadoption(currentResource)) {
+		if (getCurrentStackInstanceId() !== void 0 ? keptForRetainedRecord(currentResource) : keptForReadoption(currentResource)) {
 			let kept = keptByEngine.get(deps.owner);
 			if (kept === void 0) {
 				kept = new KeptForReadoption(deps.stateBackend, stackName, deps.stackRegion, deps.logger);
@@ -39809,6 +41088,9 @@ async function settlePending(params, pending) {
 	const reader = params.reader();
 	const isUnique = params.identifierUnique ?? ccIdentifierIsUnique;
 	const stackShown = displayStackName(stackName);
+	const source = params.stackInstanceId;
+	let resolvedId;
+	const stackInstanceId = () => resolvedId ??= typeof source === "function" ? source() : Promise.resolve(source);
 	const settlements = /* @__PURE__ */ new Map();
 	const unresolved = [];
 	for (const [token, op] of pending) {
@@ -39840,7 +41122,9 @@ async function settlePending(params, pending) {
 					identifier: made,
 					attemptedProperties: op.attemptedProperties,
 					logicalId: op.logicalId,
-					stackName
+					stackName,
+					stackInstanceId: await stackInstanceId(),
+					nameGenerationsThrough: generationsThrough(op, held)
 				});
 				const ended = outcome.status === "succeeded" ? "completed" : outcome.status === "cancelled" ? "was cancelled" : "failed";
 				if (outcome.status === "succeeded" && unique && held === void 0 && params.resume?.(op, made)) {
@@ -39894,7 +41178,7 @@ function holdsSecretReference(properties) {
 	if (properties === void 0) return false;
 	return carriesSecretMask(properties) || JSON.stringify(properties).includes("{{resolve:");
 }
-const ccIdentifierIsUnique = async ({ resourceType, identifier, attemptedProperties, logicalId, stackName }) => {
+const ccIdentifierIsUnique = async ({ resourceType, identifier, attemptedProperties, logicalId, stackName, stackInstanceId, nameGenerationsThrough }) => {
 	if (attemptedProperties === void 0 || holdsSecretReference(attemptedProperties)) return false;
 	const [fields, readOnly] = await Promise.all([getPrimaryIdentifierFields(resourceType), getTopLevelReadOnlyProperties(resourceType)]);
 	if (fields === void 0 || readOnly === void 0) return false;
@@ -39909,9 +41193,15 @@ const ccIdentifierIsUnique = async ({ resourceType, identifier, attemptedPropert
 	collect(attemptedProperties);
 	return parts.some((part, i) => {
 		if (part === "" || !readOnly.has(fields[i])) return false;
-		return !nameSegments(part).some((segment) => sent.has(segment) || looksLikeCdkdGeneratedName(segment, logicalId, stackName));
+		return !nameSegments(part).some((segment) => sent.has(segment) || looksLikeCdkdGeneratedName(segment, logicalId, stackName, stackInstanceId, nameGenerationsThrough === void 0 ? void 0 : { through: nameGenerationsThrough }));
 	});
 };
+function generationsThrough(op, held) {
+	const own = isNameGeneration(op.nameGeneration) ? op.nameGeneration : 0;
+	let recorded = 0;
+	for (const value of [held?.nameGeneration, held?.nameGenerationHigh]) if (isNameGeneration(value)) recorded = Math.max(recorded, value);
+	return Math.max(own, recorded) + 1;
+}
 function nameSegments(value) {
 	const text = value.toLowerCase();
 	const arn = /^arn:[^:]*:[^:]*:[^:]*:[^:]*:(.*)$/.exec(text);
@@ -39927,345 +41217,6 @@ function withoutPendingRequest(op) {
 	return rest;
 }
 
-//#endregion
-//#region src/state/deployment-events-store.ts
-const DEPLOYMENT_EVENTS_MAX_INDEX_RUNS = 20;
-const FLUSH_INTERVAL_MS = 2e3;
-const FLUSH_EVENT_THRESHOLD = 50;
-function newDeploymentRunId(now = /* @__PURE__ */ new Date()) {
-	return `${now.toISOString().replace(/[-:.]/g, "")}-${randomUUID().slice(0, 8)}`;
-}
-function deploymentEventsKey(prefix, stackName, region, runId) {
-	return `${prefix}/${stackName}/${region}/deployments/${runId}.jsonl`;
-}
-function deploymentEventsIndexKey(prefix, stackName, region) {
-	return `${prefix}/${stackName}/${region}/deployments/index.json`;
-}
-function deploymentsDirPrefix(prefix, stackName, region) {
-	return `${prefix}/${stackName}/${region}/deployments/`;
-}
-const DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION = "deployment-event streams and their index, whose recorded error messages can quote values the secret mask does not catch";
-async function deleteAndPurgeEventObjects(backend, keys, dirPrefix, scope = "deleted-keys") {
-	if (keys.length === 0) return void 0;
-	let swept;
-	try {
-		await backend.deleteRawObjects(keys);
-	} finally {
-		if (scope === "whole-dir") swept = await backend.purgeNoncurrentVersionsUnderPrefix(dirPrefix, { objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION });
-		else await backend.purgeNoncurrentVersions(keys, {
-			...keys.length > 1 && { listPrefix: dirPrefix },
-			objectDescription: DEPLOYMENT_EVENTS_OBJECT_DESCRIPTION
-		});
-	}
-	return swept;
-}
-function runIdTimestampMs(runId) {
-	const m = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z/.exec(runId);
-	if (!m) return null;
-	const iso = `${m[1]}-${m[2]}-${m[3]}T${m[4]}:${m[5]}:${m[6]}.${m[7]}Z`;
-	const ms = Date.parse(iso);
-	return Number.isNaN(ms) ? null : ms;
-}
-function runIdFromJsonlKey(key, dirPrefix) {
-	if (!key.startsWith(dirPrefix) || !key.endsWith(".jsonl")) return null;
-	return key.slice(dirPrefix.length, -6);
-}
-var DeploymentEventsStore = class {
-	logger = getLogger().child("DeploymentEvents");
-	backend;
-	stackName;
-	region;
-	command;
-	runId;
-	cdkdVersion;
-	startedAt;
-	events = [];
-	persistedCount = 0;
-	flushTimer;
-	writeChain = Promise.resolve();
-	warnedOnce = false;
-	finalized = false;
-	constructor(backend, options) {
-		this.backend = backend;
-		this.stackName = options.stackName;
-		this.region = options.region;
-		this.command = options.command;
-		this.runId = options.runId ?? newDeploymentRunId();
-		this.cdkdVersion = options.cdkdVersion ?? getCdkdVersion();
-		this.startedAt = (/* @__PURE__ */ new Date()).toISOString();
-	}
-	record(event) {
-		try {
-			if (this.finalized) return;
-			this.events.push({
-				timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-				...event
-			});
-			if (this.events.length - this.persistedCount >= FLUSH_EVENT_THRESHOLD) this.scheduleFlush(0);
-			else this.scheduleFlush(FLUSH_INTERVAL_MS);
-		} catch {}
-	}
-	async finalize(result) {
-		if (this.finalized) return;
-		this.finalized = true;
-		if (this.flushTimer) {
-			clearTimeout(this.flushTimer);
-			this.flushTimer = void 0;
-		}
-		if (this.events.length === 0) return;
-		await this.enqueueWrite(async () => {
-			const indexRead = this.readIndexRuns();
-			indexRead.catch(() => {});
-			await this.doFlush();
-			await this.writeIndexAndPrune(result, await indexRead);
-		});
-	}
-	async writeIndexAndPrune(result, existingRuns) {
-		const { key, file, runs } = this.buildIndexUpdate(result, existingRuns);
-		const keptRunIds = runs.map((r) => r.runId);
-		const willPrune = keptRunIds.length >= 20;
-		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, this.stackName, this.region);
-		const staleKeysRead = willPrune ? this.backend.listRawKeys(dirPrefix) : void 0;
-		staleKeysRead?.catch(() => {});
-		await this.backend.putRawObject(key, JSON.stringify(file, null, 2));
-		if (!staleKeysRead) return;
-		await this.pruneSupersededRunFiles(keptRunIds, dirPrefix, await staleKeysRead);
-	}
-	async drain() {
-		await this.writeChain;
-	}
-	scheduleFlush(delayMs) {
-		if (this.flushTimer) {
-			if (delayMs > 0) return;
-			clearTimeout(this.flushTimer);
-		}
-		this.flushTimer = setTimeout(() => {
-			this.flushTimer = void 0;
-			this.enqueueWrite(() => this.doFlush());
-		}, delayMs);
-		this.flushTimer.unref?.();
-	}
-	enqueueWrite(op) {
-		const next = this.writeChain.then(op).catch((err) => {
-			this.warnOnce(`Failed to persist deployment events for run ${this.runId}: ${describeAwsFailure(err).detail}`);
-		});
-		this.writeChain = next;
-		return next;
-	}
-	async doFlush() {
-		if (this.events.length === 0 || this.events.length === this.persistedCount) return;
-		const snapshotCount = this.events.length;
-		const body = this.events.slice(0, snapshotCount).map((e) => JSON.stringify(e)).join("\n");
-		await this.backend.putRawObject(deploymentEventsKey(this.backend.prefix, this.stackName, this.region, this.runId), body + "\n", "application/x-ndjson");
-		this.persistedCount = snapshotCount;
-	}
-	async readIndexRuns() {
-		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
-		try {
-			const raw = await this.backend.getRawObject(key);
-			if (raw !== null) {
-				const parsed = JSON.parse(raw);
-				if (Array.isArray(parsed.runs)) return parsed.runs;
-			}
-		} catch (err) {
-			this.logger.debug(`Deployment-events index unreadable, rewriting: ${describeAwsFailure(err).detail}`);
-		}
-		return [];
-	}
-	buildIndexUpdate(result, existingRuns) {
-		const key = deploymentEventsIndexKey(this.backend.prefix, this.stackName, this.region);
-		const runs = [{
-			runId: this.runId,
-			command: this.command,
-			cdkdVersion: this.cdkdVersion,
-			startedAt: this.startedAt,
-			finishedAt: (/* @__PURE__ */ new Date()).toISOString(),
-			result,
-			eventCount: this.persistedCount
-		}, ...existingRuns.filter((r) => r.runId !== this.runId)].slice(0, 20);
-		return {
-			key,
-			file: {
-				indexVersion: 1,
-				stackName: this.stackName,
-				region: this.region,
-				runs,
-				lastModified: Date.now()
-			},
-			runs
-		};
-	}
-	async pruneSupersededRunFiles(keptRunIds, dirPrefix, keys) {
-		if (keptRunIds.length < 20) return;
-		const cutoff = keptRunIds.reduce((min, id) => id < min ? id : min, keptRunIds[0]);
-		const stale = keys.filter((k) => {
-			const runId = runIdFromJsonlKey(k, dirPrefix);
-			return runId !== null && runId < cutoff;
-		});
-		if (stale.length === 0) return;
-		await deleteAndPurgeEventObjects(this.backend, stale, dirPrefix);
-		this.logger.debug(`Pruned ${stale.length} superseded deployment-event stream(s) for ${this.stackName} (${this.region})`);
-	}
-	warnOnce(message) {
-		if (this.warnedOnce) {
-			this.logger.debug(message);
-			return;
-		}
-		this.warnedOnce = true;
-		this.logger.warn(`${message} — continuing; deployment events are best-effort and never block the run.`);
-	}
-};
-var DeploymentEventsReader = class {
-	backend;
-	constructor(backend) {
-		this.backend = backend;
-	}
-	async listRegions(stackName) {
-		const prefix = `${this.backend.prefix}/${stackName}/`;
-		const keys = await this.backend.listRawKeys(prefix);
-		const regions = /* @__PURE__ */ new Set();
-		for (const key of keys) {
-			const segments = key.slice(prefix.length).split("/");
-			if (segments.length === 3 && segments[1] === "deployments" && segments[0]) regions.add(segments[0]);
-		}
-		return [...regions].sort();
-	}
-	async listRuns(stackName, region) {
-		const key = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
-		try {
-			const raw = await this.backend.getRawObject(key);
-			if (raw !== null) {
-				const parsed = JSON.parse(raw);
-				if (Array.isArray(parsed.runs)) return parsed.runs;
-			}
-		} catch {}
-		const dirPrefix = `${this.backend.prefix}/${stackName}/${region}/deployments/`;
-		const runIds = (await this.backend.listRawKeys(dirPrefix)).filter((k) => k.endsWith(".jsonl")).map((k) => k.slice(dirPrefix.length, -6)).sort().reverse();
-		return Promise.all(runIds.map((runId) => this.summarizeRunFromJsonl(stackName, region, runId)));
-	}
-	async summarizeRunFromJsonl(stackName, region, runId) {
-		const fallback = {
-			runId,
-			command: "deploy",
-			cdkdVersion: "unknown",
-			startedAt: "",
-			finishedAt: "",
-			result: "UNKNOWN",
-			eventCount: 0
-		};
-		let events = null;
-		try {
-			events = await this.readRunEvents(stackName, region, runId);
-		} catch {
-			return fallback;
-		}
-		if (events === null || events.length === 0) return fallback;
-		const started = events.find((e) => e.eventType === "RUN_STARTED");
-		let finished;
-		for (const e of events) if (e.eventType === "RUN_FINISHED") finished = e;
-		return {
-			runId,
-			command: started?.command ?? fallback.command,
-			cdkdVersion: started?.cdkdVersion ?? fallback.cdkdVersion,
-			startedAt: started?.timestamp ?? fallback.startedAt,
-			finishedAt: finished?.timestamp ?? fallback.finishedAt,
-			result: finished?.result ?? "UNKNOWN",
-			eventCount: events.length
-		};
-	}
-	async readRunEvents(stackName, region, runId) {
-		const key = deploymentEventsKey(this.backend.prefix, stackName, region, runId);
-		const raw = await this.backend.getRawObject(key);
-		if (raw === null) return null;
-		const events = [];
-		for (const line of raw.split("\n")) {
-			const trimmed = line.trim();
-			if (!trimmed) continue;
-			try {
-				events.push(JSON.parse(trimmed));
-			} catch {}
-		}
-		return events;
-	}
-	async pruneRuns(stackName, region, opts = {}) {
-		const dirPrefix = deploymentsDirPrefix(this.backend.prefix, stackName, region);
-		const keys = await this.backend.listRawKeys(dirPrefix);
-		const runIdsDesc = keys.map((k) => runIdFromJsonlKey(k, dirPrefix)).filter((id) => id !== null).sort().reverse();
-		const indexKey = deploymentEventsIndexKey(this.backend.prefix, stackName, region);
-		const indexExisted = keys.includes(indexKey);
-		if (opts.all === true) {
-			const toDelete = runIdsDesc.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-			const earlierVersions = await deleteAndPurgeEventObjects(this.backend, [...toDelete, indexKey], dirPrefix, "whole-dir");
-			return {
-				deletedRunIds: runIdsDesc,
-				remainingRunIds: [],
-				indexDeleted: indexExisted,
-				...earlierVersions !== void 0 && { earlierVersions }
-			};
-		}
-		const noGuards = opts.keep === void 0 && opts.olderThanMs === void 0;
-		const keep = opts.keep ?? (noGuards ? 20 : void 0);
-		const protectedByCount = keep === void 0 ? /* @__PURE__ */ new Set() : new Set(runIdsDesc.slice(0, keep));
-		let candidates = runIdsDesc.filter((id) => !protectedByCount.has(id));
-		if (opts.olderThanMs !== void 0) {
-			const cutoff = (opts.now ?? /* @__PURE__ */ new Date()).getTime() - opts.olderThanMs;
-			candidates = candidates.filter((id) => {
-				const t = runIdTimestampMs(id);
-				return t !== null && t < cutoff;
-			});
-		}
-		if (candidates.length === 0) return {
-			deletedRunIds: [],
-			remainingRunIds: runIdsDesc,
-			indexDeleted: false
-		};
-		const deletedSet = new Set(candidates);
-		const deleteKeys = candidates.map((id) => deploymentEventsKey(this.backend.prefix, stackName, region, id));
-		const remainingRunIds = runIdsDesc.filter((id) => !deletedSet.has(id));
-		if (remainingRunIds.length === 0) {
-			await deleteAndPurgeEventObjects(this.backend, [...deleteKeys, indexKey], dirPrefix);
-			return {
-				deletedRunIds: candidates,
-				remainingRunIds,
-				indexDeleted: indexExisted
-			};
-		}
-		await this.rewriteIndexAfterPrune(indexKey, stackName, region, deletedSet);
-		await deleteAndPurgeEventObjects(this.backend, deleteKeys, dirPrefix);
-		return {
-			deletedRunIds: candidates,
-			remainingRunIds,
-			indexDeleted: false
-		};
-	}
-	async rewriteIndexAfterPrune(indexKey, stackName, region, deletedRunIds) {
-		let raw;
-		try {
-			raw = await this.backend.getRawObject(indexKey);
-		} catch {
-			return;
-		}
-		if (raw === null) return;
-		let parsed;
-		try {
-			parsed = JSON.parse(raw);
-		} catch {
-			return;
-		}
-		if (!Array.isArray(parsed.runs)) return;
-		const remaining = parsed.runs.filter((r) => !deletedRunIds.has(r.runId));
-		if (remaining.length === parsed.runs.length) return;
-		const file = {
-			indexVersion: 1,
-			stackName,
-			region,
-			runs: remaining,
-			lastModified: Date.now()
-		};
-		await this.backend.putRawObject(indexKey, JSON.stringify(file, null, 2));
-	}
-};
-
 //#endregion
 //#region src/deployment/orphan-adoption.ts
 function templateStillDeclares(template, record, nameProperties) {
@@ -40281,9 +41232,19 @@ async function planOrphanAdoption(params) {
 		adopted: {},
 		remaining: [],
 		refusals: [],
-		notices: []
+		notices: [],
+		warnings: []
 	};
 	if (params.records.length === 0) return outcome;
+	if (params.newScheme === true) {
+		for (const record of params.records) {
+			if (params.managedLogicalIds.has(record.logicalId)) continue;
+			outcome.remaining.push(record);
+			if ((params.template.Resources?.[record.logicalId])?.Type !== record.state.resourceType) continue;
+			outcome.warnings.push(`${displayIdent(record.logicalId)} (${displayIdent(record.state.resourceType)}) was left in AWS by an earlier rollback as ${displaySafe(record.state.physicalId)} (DeletionPolicy: Retain). This deploy does not take it back: it creates a new resource under a new name, as CloudFormation does. To manage the kept resource again, adopt it with 'cdkd import'.`);
+		}
+		return outcome;
+	}
 	let siblingClaims;
 	const claims = async () => siblingClaims ??= await params.readSiblingClaims();
 	for (const record of params.records) {
@@ -40473,9 +41434,11 @@ async function adoptRollbackOrphans(deps, currentState, effectiveTemplate) {
 			selfRegion: deps.stackRegion,
 			logger: deps.logger
 		}),
-		logger: { debug: (m) => deps.logger.debug(m) }
+		logger: { debug: (m) => deps.logger.debug(m) },
+		newScheme: currentState.stackInstanceId !== void 0
 	}));
 	for (const notice of plan.notices) deps.logger.info(maskSecretsInText(notice, named));
+	for (const warning of plan.warnings) deps.logger.warn(maskSecretsInText(warning, named));
 	const adoptedFrom = /* @__PURE__ */ new Map();
 	adoptedOrphanRecords.set(deps.owner, adoptedFrom);
 	if (plan.refusals.length > 0) throw new Error(safeMsg`Deploy refused — cdkd left ${plan.refusals.length} resource(s) in AWS that it cannot ` + "safely re-adopt:" + plan.refusals.map((r) => safeMsg`\n  ${maskSecretsInText(r, named)}`).join(""));
@@ -40534,6 +41497,7 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 		createdResourceHolder: crossPrefixHolder === void 0 ? void 0 : () => crossPrefixAnswer ??= crossPrefixHolder(stackName)
 	};
 	const inlinePolicyWriters = new RollbackInlinePolicyWriters();
+	const supersededHost = {};
 	const runId = deps.options.eventRecorder?.runId;
 	const { result, failed, run } = await withNestedRevertRun(runId, async (scope) => {
 		return {
@@ -40546,7 +41510,10 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 			})) : void 0,
 			result: await withPrintingSecrets(replayPrintingBag(deps, completedReplayEntries(completedOperations), stateResources), () => replayRollback(completedOperations, stateResources, stackName, ctx, {
 				inlinePolicyWriters,
-				failedOperations
+				failedOperations,
+				isInterrupted: () => deps.userInterrupted(),
+				onSuperseded: (entry) => addSuperseded(supersededHost, entry),
+				onSupersededSettled: (entry) => removeSuperseded(supersededHost, entry)
 			})),
 			run: scope
 		};
@@ -40557,7 +41524,10 @@ async function performRollback(deps, completedOperations, stateResources, stackN
 		failures: result.failures + (failed?.failures ?? 0),
 		warnings: result.warnings + run.warnings + (failed?.warnings ?? 0),
 		skipped: result.skipped + (failed?.skipped ?? 0),
+		interrupted: result.interrupted,
 		orphaned: [...failed?.orphaned ?? [], ...result.orphaned],
+		rolledBackCreates: [...failed?.rolledBackCreates ?? [], ...result.rolledBackCreates],
+		superseded: supersededHost.supersededResources ?? [],
 		settledNested: run.settled,
 		remainingFailedOps: failedOperations.filter((_, i) => !handled.has(i))
 	};
@@ -40600,9 +41570,11 @@ async function settleJournalAfterSuccess(deps, stackName, completedOperations, p
 		const own = await settleJournaledOrphansOnSuccess({
 			stateBackend: deps.stateBackend,
 			stackName,
+			stackInstanceId: stackInstanceIdOf(previousState, displayStackName(stackName)),
 			region: deps.stackRegion,
 			stateResources: finalResources,
 			rollbackOrphans: previousState.orphans,
+			retiredNameGenerations: previousState.retiredNameGenerations,
 			newerOperations: completedOperations,
 			...deployRunId !== void 0 && { deployRunId },
 			foreignHolder: foreignHolderFor({
@@ -40628,9 +41600,11 @@ async function settleJournalAfterSuccess(deps, stackName, completedOperations, p
 			const settled = await settleJournaledOrphansOnSuccess({
 				stateBackend: deps.stateBackend,
 				stackName: child,
+				stackInstanceId: stackInstanceIdOf(childState, displayStackName(child)),
 				region: deps.stackRegion,
 				stateResources: childState?.resources,
 				rollbackOrphans: childState?.orphans,
+				retiredNameGenerations: childState?.retiredNameGenerations,
 				newerOperations: [],
 				...deployRunId !== void 0 && { deployRunId },
 				foreignHolder: foreignHolderFor({
@@ -40786,58 +41760,6 @@ async function orphanUntakenResumes(deps, stackName, finalResources) {
 	}
 }
 
-//#endregion
-//#region src/deployment/kept-in-history.ts
-function keptInEarlierRecords(records) {
-	const out = [];
-	for (const record of records) for (const [logicalId, raw] of Object.entries(record.resources)) {
-		if (raw === null || typeof raw !== "object") continue;
-		const r = raw;
-		if (typeof r.resourceType !== "string" || typeof r.physicalId !== "string") continue;
-		if (r.physicalId === "") continue;
-		if (!shouldRetainResource(r.deletionPolicy)) continue;
-		out.push({
-			logicalId,
-			resourceType: r.resourceType,
-			physicalId: r.physicalId,
-			...record.writtenAt !== void 0 && { keptAt: record.writtenAt }
-		});
-	}
-	return out;
-}
-function keptInEventHistory(runs, stackName) {
-	const made = /* @__PURE__ */ new Map();
-	const out = [];
-	for (const events of runs) for (const e of events) {
-		if (e.stackName !== stackName || typeof e.logicalId !== "string") continue;
-		if (typeof e.resourceType !== "string") continue;
-		if (e.eventType === "RESOURCE_SUCCEEDED" && (e.operation === "CREATE" || e.operation === "UPDATE") && typeof e.physicalId === "string" && e.physicalId !== "") made.set(e.logicalId, {
-			resourceType: e.resourceType,
-			physicalId: e.physicalId
-		});
-		else if (e.eventType === "RESOURCE_RETAINED") {
-			const m = made.get(e.logicalId);
-			if (m !== void 0 && m.resourceType === e.resourceType) {
-				const keptAt = Date.parse(e.timestamp);
-				out.push({
-					logicalId: e.logicalId,
-					...m,
-					...Number.isFinite(keptAt) && { keptAt }
-				});
-			}
-		}
-	}
-	return out;
-}
-async function loadKeptInHistory(sources, stackName, region) {
-	const runsOf = stackName.split("~")[0];
-	const [records, runs] = await Promise.all([sources.earlierStateResources(stackName, region).catch(() => []), (async () => {
-		const listed = (await sources.listRuns(runsOf, region)).slice(0, 20);
-		return (await Promise.all(listed.map((r) => sources.readRunEvents(runsOf, region, r.runId).catch(() => null)))).filter((e) => e !== null).reverse();
-	})().catch(() => [])]);
-	return [...keptInEarlierRecords(records), ...keptInEventHistory(runs, stackName)];
-}
-
 //#endregion
 //#region src/provisioning/canonicalize-properties.ts
 function makeCanonicalizePropertiesFn(registry) {
@@ -42219,7 +43141,7 @@ async function requireDeploymentApproval(args) {
 	} catch (error) {
 		throw error instanceof Error ? markNonRetryable(error) : error;
 	}
-	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+	if (!approved) throw markNonRetryable(new DeploymentNotApprovedError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=${level}). Nothing was changed.`));
 	return approve.autoApproves !== true;
 }
 async function checkDestructivePlan(args) {
@@ -42276,7 +43198,7 @@ async function requireOutputsOnlyApproval(args) {
 	} catch (error) {
 		throw error instanceof Error ? markNonRetryable(error) : error;
 	}
-	if (!approved) throw markNonRetryable(new CdkdError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`, "DEPLOY_NOT_APPROVED"));
+	if (!approved) throw markNonRetryable(new DeploymentNotApprovedError(safeMsg`Deployment of stack ${args.stackName} was not approved (--require-approval=any-change). Nothing was changed.`));
 }
 function isNoEchoPromotionOnly(change) {
 	return change.changeType === "UPDATE" && (change.attributeChanges?.length ?? 0) === 0 && (change.propertyChanges?.length ?? 0) > 0 && change.propertyChanges.every((pc) => pc.noEchoPromoted === true);
@@ -43280,60 +44202,10 @@ function peekRoutingForLabel(providerRegistry, options, change, existingState, s
 	}
 	return deriveLabelRouting(change, existingState, providerRegistry, isPinnedToCcApi(options, stackName, logicalId));
 }
-function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps, logicalId) {
+function preparePropertiesForCcApi(providerRegistry, resourceType, resolvedProps, logicalId, underivable = "refuse") {
 	const sdkProvider = providerRegistry.getRegisteredTypes().includes(resourceType) ? providerRegistry.getProvider(resourceType) : void 0;
 	if (sdkProvider?.preparePropertiesForFallback) return sdkProvider.preparePropertiesForFallback(logicalId, resourceType, resolvedProps);
-	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps);
-}
-
-//#endregion
-//#region src/deployment/deploy-engine/name-collision.ts
-function replacementNameOrigin(logicalId, physicalId) {
-	if (looksLikeCdkdGeneratedName(physicalId, logicalId, getCurrentStackName())) return {
-		descriptor: `The physical name (${physicalId}) was GENERATED by cdkd from the construct's logical id rather than declared in your template, and that derivation has no random component — so the new resource asks for exactly the name the existing one still holds`,
-		remedy: "Either give the resource an explicit physical name in your CDK code, or rename the CONSTRUCT (its id feeds the generated name — note that this replaces the resource rather than renaming it in place)"
-	};
-	return {
-		descriptor: `The resource has a user-supplied physical name (${physicalId})`,
-		remedy: "Either rename the resource in your CDK code (a fresh name lets the safe create-first order proceed)"
-	};
-}
-function orphanedNameCollisionAdvice(providerRegistry, changeType, logicalId, error) {
-	if (changeType !== "CREATE") return void 0;
-	if (!(error instanceof ProvisioningError)) return void 0;
-	const physicalId = error.physicalId;
-	if (!physicalId) return void 0;
-	const replayed = isReplayedNameCollisionFrom(error, logicalId, (link) => isAuxiliaryMarkOf(link, RETRY_AUXILIARY_OWNER));
-	if (!replayed && !isNameCollisionErrorFrom(error, logicalId)) return void 0;
-	const stackName = getCurrentStackName();
-	if (!looksLikeCdkdGeneratedName(physicalId, logicalId, stackName)) return void 0;
-	if (!stackName) return void 0;
-	const safeId = displaySafe(physicalId, { asciiOnly: true });
-	const safeStack = displaySafe(stackName, { asciiOnly: true });
-	const safeLogicalId = displaySafe(logicalId, { asciiOnly: true });
-	const idShown = isInertUnquoted(safeId);
-	const shownId = idShown ? safeId : "a name that cannot be shown safely here";
-	const shownLogicalId = isInertUnquoted(safeLogicalId) ? safeLogicalId : "A resource whose logical id cannot be shown safely here";
-	const diagnosis = replayed ? `${shownLogicalId}: the name AWS reports as taken (${shownId}) is most likely held by a resource THIS create made. An earlier attempt of it ended without a clear verdict (a server error, a dropped connection or a timeout, or a failure after the create call itself may have succeeded), and the retry then found the name taken. A dropped connection can also happen before the request reached AWS, so the holder may be another resource: confirm it is yours before deleting or importing it. cdkd records a resource only once its create succeeds, so this one is in no state file: no rollback or cdkd destroy will remove it, and re-running collides with it again.` : `${shownLogicalId}: the name AWS reports as taken (${shownId}) is one cdkd DERIVED from the logical id, and that derivation has no random component — so this is most likely a resource an earlier cdkd run left behind. A rollback leaves a resource carrying DeletionPolicy: Retain in AWS and drops it from state, as CloudFormation does; what differs is the name. CloudFormation would generate a fresh one for an unnamed resource and redeploy clean, whereas cdkd asks again for the name the orphan still holds — so re-running does not clear this.`;
-	const deleteArm = `If it is not a resource you want to keep, delete ${idShown ? safeId : "it"} in AWS — after confirming it holds nothing you need${replayed ? "" : ", since Retain is what kept it"} — and re-deploy.`;
-	let canImport;
-	try {
-		canImport = typeof providerRegistry.getProvider(error.resourceType).import === "function";
-	} catch {
-		canImport = false;
-	}
-	const commandNamesTheRightResource = safeId === physicalId && safeStack === stackName && safeLogicalId === logicalId;
-	const importableTarget = !stackName.includes("~");
-	if (!canImport || !commandNamesTheRightResource || !importableTarget) return `${diagnosis} ${!canImport ? `cdkd cannot adopt ${displaySafe(error.resourceType, { asciiOnly: true })} back into state (its provider implements no import)` : !importableTarget ? `this is a nested-stack child, whose stack name cdkd import cannot resolve` : `cdkd cannot render an import command that provably names this resource`}, so the way forward is to delete it. ${deleteArm}`;
-	const adopt = pasteableCommand("cdkd import", [{
-		value: stackName,
-		hole: "stack"
-	}, {
-		flag: "--resource",
-		value: `${logicalId}=${physicalId}`,
-		hole: "logicalId=physicalId"
-	}]);
-	return `${diagnosis} To recover, adopt it back into state instead of re-creating it, with the command below (a selective import merges into existing state and needs no --force while the resource is absent from it). CONFIRM IT IS YOURS FIRST — a name cdkd derives is predictable, so for a globally-namespaced type it can belong to another account, and the same stack deployed in another region derives the same name. ${deleteArm}${adopt.withheld.length === 0 ? "" : " The command below prints a quoted hole in place of a value cdkd will not name on a command line; replace it whole, quotes included, with your stack name or '<logicalId>=<name>', shell-quoted."}\nAdopt with: ${adopt.command}`;
+	return applyDefaultNameForFallback(logicalId, resourceType, resolvedProps, underivable);
 }
 
 //#endregion
@@ -43510,6 +44382,7 @@ async function provisionCreate(engine, logicalId, change, stateResources, stackN
 	const recordedProperties = propertiesToRecord(resolvedProps, result, resourceType, createDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
+		...getCurrentStackInstanceId() !== void 0 && nameGenerationField(currentNameGeneration(logicalId) ?? 0),
 		resourceType,
 		properties: recordedProperties,
 		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, createDecision.provisionedBy, "new-resource"),
@@ -43536,6 +44409,21 @@ async function provisionCreate(engine, logicalId, change, stateResources, stackN
 	renderer.removeTask(logicalId);
 	engine.logger.info(safeMsg`${createPrefix}${formatResourceLine("created", logicalId, resourceType)}`);
 }
+async function guardedReplacementCreate(engine, input, create) {
+	const guard = engine.generatedNameGuard;
+	if (input.keepsName === true || guard?.candidate(input.logicalId) === void 0) return create();
+	await refuseUnlicensedGeneratedName(engine, input);
+	guard.noteSent(input.logicalId);
+	let result;
+	try {
+		result = await create();
+	} catch (error) {
+		guard.noteFailed(input.logicalId, error);
+		throw error;
+	}
+	guard.noteReturned(input.logicalId);
+	return result;
+}
 async function refuseUnlicensedGeneratedName(engine, input) {
 	const { logicalId, resourceType } = input;
 	const asked = engine.generatedNameGuard?.candidate(logicalId);
@@ -44021,7 +44909,7 @@ var DynamoDBGlobalTableProvider = class {
 		const warn = log.warn;
 		log.debug(`Creating DynamoDB GlobalTable ${logicalId}`);
 		const desiredReplicaTags = refuseMalformedReplicaTags(properties, resourceType, logicalId);
-		const tableName = properties["TableName"] || generateResourceName(logicalId, { maxLength: 255 });
+		const tableName = properties["TableName"] || generatedNameFor("AWS::DynamoDB::GlobalTable", logicalId);
 		const keySchema = properties["KeySchema"];
 		const attributeDefinitions = properties["AttributeDefinitions"];
 		if (!keySchema) throw new ProvisioningError(`KeySchema is required for DynamoDB GlobalTable ${logicalId}`, resourceType, logicalId);
@@ -46465,7 +47353,7 @@ function recordedProtectionNote(evidence, flags) {
 
 //#endregion
 //#region src/deployment/deploy-engine/update-replace.ts
-async function updateByReplacement(engine, { change, counts, currentProps, currentResource, dependencies, logicalId, oldResourceType, progress, propertyDrivenReplacement, recreateFlagged, recreateViaCcApi, recreateViaSdkProvider, renderer, resolvedProps, resourceType, stackName, stateResources, template, typeChanged, updateReplacePolicy, updateSecrets, lostWithParent }) {
+async function updateByReplacement(engine, { change, counts, currentProps, currentResource, dependencies, logicalId, oldResourceType, progress, propertyDrivenReplacement, recreateFlagged, recreateViaCcApi, recreateViaSdkProvider, renderer, resolvedProps, resourceType, stackName, stateResources, template, typeChanged, updateReplacePolicy, updateSecrets, lostWithParent, nameGenerationFields }) {
 	const noEchoDeleteValues = await noEchoDeleteValuesFromResolved({
 		record: currentResource,
 		templateResource: template?.Resources?.[logicalId],
@@ -46540,6 +47428,9 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 		}
 		createResult = await createFirstThenDeleteOld(engine.replacementRun, engine.replacementDeps(), {
 			retainOld,
+			stackName,
+			createdVia: replaceDecision.provisionedBy,
+			resolvedProps,
 			logicalId,
 			resourceType,
 			oldResourceType,
@@ -46591,17 +47482,27 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 			if (recreateSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, recreateSkipReason, `during ${recreateFlagName}`));
 			engine.logger.info(safeMsg`  ${green("✓")} Old resource deleted`);
 			engine.replacementRun.oldDeletedBeforeCreate.add(logicalId);
+			await oldDeleteProvider.waitForNameReleased?.(logicalId, currentResource.physicalId, oldResourceType, {
+				isInterrupted: () => engine.userInterrupted,
+				maskSecrets: createSecretMasker(updateSecrets)
+			});
 		}
 		engine.logger.info(safeMsg`  Creating new ${logicalId}...`);
-		createResult = await withRetry(() => engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider), logicalId, {
+		createResult = await guardedReplacementCreate(engine, {
+			logicalId,
+			resourceType,
+			stackName,
+			createdVia: replaceDecision.provisionedBy,
+			resolvedProps
+		}, () => withRetry(() => engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider, true), logicalId, {
 			maxRetries: 8,
 			initialDelayMs: 2e3,
 			maxDelayMs: 1e4,
 			logger: engine.maskingRetryLoggerFor(updateSecrets),
-			isInterrupted: () => engine.interrupted,
-			onInterrupted: () => new InterruptedError(engine.interruptCause ?? "user"),
+			isInterrupted: () => engine.userInterrupted,
+			onInterrupted: () => new InterruptedError("user"),
 			isRetryable: isRecreateRetryableError
-		});
+		}));
 		if (equalIdIsSameResource && updateReplacePolicy === "Retain" && createResult.physicalId === currentResource.physicalId) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) recreate returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one — its Create ` + "API is name-idempotent — and UpdateReplacePolicy: Retain means the old resource was never destroyed, so the new properties were not applied. Rename the resource in your CDK code (or remove the explicit physical name) so the recreate can produce a genuinely new resource.", "NAMED_REPLACEMENT_IDEMPOTENT_CREATE");
 	} else {
 		engine.logger.info(safeMsg`  Creating new ${logicalId}...`);
@@ -46611,7 +47512,14 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 			engine.logger.info(safeMsg`  ${logicalId} went with ${lostWithParent}, which was destroyed and re-created under the same id: re-creating it`);
 		}
 		try {
-			createResult = await engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider);
+			createResult = await guardedReplacementCreate(engine, {
+				logicalId,
+				resourceType,
+				stackName,
+				createdVia: replaceDecision.provisionedBy,
+				resolvedProps,
+				keepsName: lostWithParent !== void 0
+			}, () => engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replaceProvider.create(logicalId, resourceType, replaceProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replaceProvider, lostWithParent !== void 0));
 		} catch (createError) {
 			const createMsg = displayAwsMessage(maskSecretsInText(describeAwsFailure(createError).detail, updateSecrets));
 			const createSentence = createMsg.endsWith(".") ? createMsg.slice(0, -1) : createMsg;
@@ -46630,7 +47538,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 				createType: resourceType,
 				holderType: oldResourceType,
 				requested: replaceProps,
-				generated: applyDefaultNameForFallback(logicalId, resourceType, resolvedProps),
+				generated: applyDefaultNameForFallback(logicalId, resourceType, resolvedProps, "omit"),
 				recorded: currentResource.properties,
 				observed: currentResource.observedProperties,
 				physicalId: currentResource.physicalId,
@@ -46641,7 +47549,13 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 			});
 			if (!holder.holds) {
 				const flagClause = engine.options.replace === true ? ` --replace was NOT applied and nothing was deleted.` : updateReplacePolicy === "Retain" ? " Nothing was deleted. UpdateReplacePolicy: Retain keeps the resource being replaced in place; removing it and re-running with `cdkd deploy --replace` would refuse the same way rather than delete it." : " Nothing was deleted, and `cdkd deploy --replace` would refuse the same way rather than delete it.";
-				throw markNonRetryable(new CdkdError(maskSecretsInText(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement, but the create-first attempt collided: ${holder.diagnosis} — ` + (holder.known ? "so another resource holds the colliding name (an orphan of an earlier attempt, or one made outside this stack), and deleting the resource being replaced would destroy it and collide again." + flagClause + " Remove or rename the resource holding that name if it is yours, then re-run the deploy." : "so if another resource holds it (an orphan of an earlier attempt, or one made outside this stack), deleting the resource being replaced would destroy it and collide again." + flagClause + " Remove or rename whatever holds that name if it is yours — if that is the resource being replaced itself, delete it by hand — then re-run the deploy.") + ` Underlying collision: ${createMsg}`, updateSecrets), "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+				throw markNonRetryable(new CdkdError(maskSecretsInText(`${displaySafe(logicalId)} (${displaySafe(resourceType)}) requires replacement, but the create-first attempt collided: ${holder.diagnosis} — ` + (holder.known ? "so another resource holds the colliding name (an orphan of an earlier attempt, or one made outside this stack), and deleting the resource being replaced would destroy it and collide again." + flagClause + " Remove or rename the resource holding that name if it is yours, then re-run the deploy." : "so if another resource holds it (an orphan of an earlier attempt, or one made outside this stack), deleting the resource being replaced would destroy it and collide again." + flagClause + " Remove or rename whatever holds that name if it is yours — if that is the resource being replaced itself, delete it by hand — then re-run the deploy.") + generatedReplacementHolderAdvice({
+					stackName,
+					logicalId,
+					change: nameChange,
+					oldPhysicalId: currentResource.physicalId,
+					mask: (value) => maskSecretsInText(value, unionOfSecretBags([updateSecrets, printingSecretsFor(engine.secretsRun, logicalId)]))
+				}) + ` Underlying collision: ${createMsg}`, updateSecrets), "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
 			}
 			if (updateReplacePolicy === "Retain") throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its physical name ` + `is still held by the existing resource AND UpdateReplacePolicy: Retain ` + safeMsg`pins that resource in place. ${nameOrigin.descriptor}. ` + safeMsg`${nameOrigin.remedy} — with Retain, the old resource keeps the name, so a ` + `same-name replacement can never proceed.`, "NAMED_REPLACEMENT_COLLISION");
 			if (engine.options.replace !== true) throw new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but the create-first ` + safeMsg`attempt collided with the existing resource: ${createSentence}. ` + safeMsg`${nameOrigin.descriptor}, so the CloudFormation-style safe replacement ` + "order (create the new resource before deleting the old) cannot reuse the occupied name — CloudFormation refuses this shape with \"cannot update a stack when a custom-named resource requires replacing\". " + safeMsg`${nameOrigin.remedy}, or re-run with \`cdkd deploy --replace\` to delete ` + "the old resource FIRST and recreate it under the same name (the resource is briefly unavailable while it is recreated).", "NAMED_REPLACEMENT_COLLISION");
@@ -46681,6 +47595,7 @@ async function updateByReplacement(engine, { change, counts, currentProps, curre
 	const recordedReplacementProperties = propertiesToRecord(resolvedProps, createResult, resourceType, replaceDecision.provisionedBy);
 	stateResources[logicalId] = {
 		physicalId: createResult.physicalId,
+		...nameGenerationFields,
 		resourceType,
 		properties: recordedReplacementProperties,
 		...acceptedCreateOnlyDropsField(recordedReplacementProperties, resourceType, replaceDecision.provisionedBy, "new-resource"),
@@ -46724,7 +47639,7 @@ function ccAutoRouteUpdateFailureRemedy(logicalId, resourceType, autoRoutedPrope
 
 //#endregion
 //#region src/deployment/deploy-engine/update-in-place.ts
-async function updateInPlace(engine, { conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
+async function updateInPlace(engine, { changedProperties, conditions, counts, currentProps, currentPropsAsWritten, currentResource, dependencies, desiredForSkipCheckAsWritten, logicalId, noEchoHeldPaths, parameterValues, progress, renderer, resolvedProps, resourceType, stackName, stateResources, template, updateReplacePolicy, updateSecrets, reattach }) {
 	engine.logger.debug(safeMsg`Updating ${logicalId} (${resourceType})`);
 	const updateDecision = engine.providerRegistry.getProviderFor({
 		resourceType,
@@ -46749,11 +47664,12 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 		engine.logger.info(message);
 	}
 	const updateProvider = updateDecision.provider;
-	const updateProps = updateDecision.provisionedBy === "cc-api" ? withoutGeneratedFallbackName(resourceType, resolvedProps, preparePropertiesForCcApi(engine.providerRegistry, resourceType, resolvedProps, logicalId)) : resolvedProps;
-	const { previous: previousWithSecretsDropped, dropped: droppedPrincipalKinds } = withUnchangedSecretPrincipalLists(resourceType, currentResource.physicalId, noEchoHeldPaths.size === 0 ? currentPropsAsWritten : {
+	const updateProps = updateDecision.provisionedBy === "cc-api" ? withoutGeneratedFallbackName(resourceType, resolvedProps, preparePropertiesForCcApi(engine.providerRegistry, resourceType, resolvedProps, logicalId, "omit")) : resolvedProps;
+	const previousWithNoEchoHeld = noEchoHeldPaths.size === 0 ? currentPropsAsWritten : {
 		...currentPropsAsWritten,
 		...Object.fromEntries([...noEchoHeldPaths].filter((path) => Object.prototype.hasOwnProperty.call(updateProps, path)).map((path) => [path, updateProps[path]]))
-	}, desiredForSkipCheckAsWritten);
+	};
+	const { previous: previousWithSecretsDropped, dropped: droppedPrincipalKinds } = withUnchangedSecretPrincipalLists(resourceType, currentResource.physicalId, previousWithNoEchoHeld, desiredForSkipCheckAsWritten);
 	const reattached = reattach === true ? withRecreatedAttachmentsDropped({
 		resourceType,
 		templateProperties: template?.Resources?.[logicalId]?.Properties,
@@ -46763,6 +47679,9 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 		conditions
 	}) : void 0;
 	const previousForUpdate = reattached?.previous ?? previousWithSecretsDropped;
+	const changedForProvider = new Set(changedProperties);
+	for (const key of /* @__PURE__ */ new Set([...Object.keys(previousWithNoEchoHeld), ...Object.keys(previousForUpdate)])) if (keyOrderFreeJson(previousForUpdate[key]) !== keyOrderFreeJson(previousWithNoEchoHeld[key])) changedForProvider.add(key);
+	if (changedForProvider.size === 0) for (const key of /* @__PURE__ */ new Set([...Object.keys(updateProps), ...Object.keys(previousForUpdate)])) changedForProvider.add(key);
 	if (reattached !== void 0) engine.logger.info(safeMsg`  ${logicalId} (${resourceType}) lost its attachment to ${reattached.parents.join(", ")}, which this deploy re-created under the same name: attaching it again`);
 	if (droppedPrincipalKinds.length > 0) {
 		const kinds = droppedPrincipalKinds.join(" / ");
@@ -46772,6 +47691,7 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 	let result;
 	let resultProvisionedBy = updateDecision.provisionedBy;
 	let captureProvider = updateProvider;
+	let replacedAtGeneration;
 	const inlinePolicyClaimed = engine.inlinePolicyClaimedFor(resourceType, logicalId, stateResources);
 	try {
 		result = await engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => updateProvider.update(logicalId, currentResource.physicalId, resourceType, removal.properties, previousForUpdate, {
@@ -46779,7 +47699,8 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 			expectedRegion: engine.stackRegion,
 			recordedAttributes: currentResource.attributes,
 			...inlinePolicyClaimed && { inlinePolicyClaimed },
-			...removal.context
+			...removal.context,
+			changedProperties: changedForProvider
 		})), logicalId, void 0, void 0, updateProvider);
 		if (result.sentNothing === true) engine.replacementRun.updatesThatSentNothing.add(logicalId);
 		if (result.wasReplaced === true && result.outcome === "partial") engine.replacementRun.replacedOldMaySurvive.set(logicalId, result.oldResourceSurvivor === "kept" ? "kept" : "unconfirmed");
@@ -46789,153 +47710,181 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 		const ccUnsupported = isUpdateUnsupportedError(updateError, logicalId);
 		const replaceOptIn = updateError instanceof ResourceUpdateNotSupportedError && engine.options.replace === true;
 		if (ccUnsupported || replaceOptIn) {
-			const retainOldOnReplace = updateReplacePolicy === "Retain";
-			const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
-			if (statefulReason && engine.options.forceStatefulRecreation !== true) {
-				const protection = recordedProtectionEvidence(resourceType, currentProps, currentResource.observedProperties, engine.stackRegion);
-				throw markNonRetryable(new CdkdError(replaceOptIn ? safeMsg`--replace would DELETE + CREATE the stateful resource ${logicalId} ` + safeMsg`(${resourceType}) — ${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--replace --force-stateful-recreation")} ` + `Or change the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.") : safeMsg`${logicalId} (${resourceType}) cannot be updated in place by the ` + "provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: " + safeMsg`${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--force-stateful-recreation")} ` + `Or change the resource's definition to avoid the update.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update."), "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
-			}
-			const replDecision = engine.providerRegistry.getProviderFor({
-				resourceType,
-				properties: resolvedProps,
-				previousProperties: currentResource.properties
-			});
-			const replProvider = replDecision.provider;
-			const replProps = replDecision.provisionedBy === "cc-api" ? preparePropertiesForCcApi(engine.providerRegistry, resourceType, resolvedProps, logicalId) : resolvedProps;
-			const fallbackNameChange = await checkedReplacementNameChange(engine.replacementDeps(), {
-				logicalId,
-				resourceType,
-				oldResourceType: resourceType,
-				stackName,
-				currentResource,
-				desiredProperties: resolvedProps,
-				createProvider: replProvider,
-				createdVia: replDecision.provisionedBy,
-				createProps: replProps,
-				secrets: updateSecrets
-			});
-			const createFirst = !retainOldOnReplace && fallbackNameChange !== void 0;
-			const noEchoDeleteValues = await noEchoDeleteValuesFromResolved({
-				record: currentResource,
-				templateResource: template?.Resources?.[logicalId],
-				resolvedProperties: resolvedProps,
-				noEchoParameters: noEchoPositionSources(engine.noEchoRun, stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
-				conditions: engine.noEchoRun.noEchoConditions,
-				secrets: updateSecrets,
-				inputSources: template && maskedInputSources(engine.resolverContextDeps(), template, stateResources, engine.noEchoRun.noEchoConditions, stackName)
-			});
-			engine.logger.info(retainOldOnReplace ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing ` + `(CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
-			if (retainOldOnReplace) await noteRetainedResource(resourceType, logicalId);
-			if (!retainOldOnReplace && !createFirst) {
-				const fallbackUpdateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy;
-				const fallbackFinalSnapshotId = await prepareFinalSnapshotForDelete(engine.replacementDeps(), logicalId, resourceType, currentResource, fallbackUpdateReplacePolicy);
-				let fallbackDeleteResult = void 0;
-				try {
-					fallbackDeleteResult = await withPrintingSecrets(updateSecrets, () => updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
-						expectedRegion: engine.stackRegion,
-						forceDataDelete: engine.options.forceStatefulRecreation === true,
-						...fallbackFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: fallbackFinalSnapshotId },
-						...replacementDeleteContext(engine.replacementDeps(), fallbackUpdateReplacePolicy),
-						recordedAttributes: currentResource.attributes,
-						recordedNoEchoLeaves: currentResource.noEchoLeaves,
-						...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
-						maskSecrets: createUnionSecretMasker([updateSecrets, secretNameBagFor(engine.secretsRun, logicalId)])
-					}));
-				} catch (deleteError) {
-					const deleteMsg = describeAwsFailure(deleteError).detail;
-					if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) engine.logger.debug(safeMsg`Old resource ${logicalId} already gone, proceeding with CREATE`);
-					else throw deleteError;
+			const fallbackStackInstanceId = getCurrentStackInstanceId();
+			const fallbackGeneration = fallbackStackInstanceId === void 0 ? void 0 : nextNameGeneration(currentResource, logicalId, fallbackStackInstanceId);
+			if (fallbackGeneration !== void 0) engine.replacementRun.attemptedNameGeneration.set(logicalId, fallbackGeneration);
+			const replaceFallback = async () => {
+				const retainOldOnReplace = updateReplacePolicy === "Retain";
+				const statefulReason = retainOldOnReplace ? null : isStatefulRecreateTargetForReplace(resourceType, currentProps, currentResource.observedProperties);
+				if (statefulReason && engine.options.forceStatefulRecreation !== true) {
+					const protection = recordedProtectionEvidence(resourceType, currentProps, currentResource.observedProperties, engine.stackRegion);
+					throw markNonRetryable(new CdkdError(replaceOptIn ? safeMsg`--replace would DELETE + CREATE the stateful resource ${logicalId} ` + safeMsg`(${resourceType}) — ${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--replace --force-stateful-recreation")} ` + `Or change the resource's definition to avoid the immutable-property change.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the immutable-property change.") : safeMsg`${logicalId} (${resourceType}) cannot be updated in place by the ` + "provisioning layer it routes through, so applying this change would DELETE + CREATE it — but it is a stateful resource: " + safeMsg`${renderStatefulReason(statefulReason)}. ` + (protection ? safeMsg`${recordedProtectionNote(protection, "--force-stateful-recreation")} ` + `Or change the resource's definition to avoid the update.` : "Re-run with --force-stateful-recreation to confirm the data loss, or change the resource definition to avoid the update."), "STATEFUL_REPLACE_BLOCKED", updateError instanceof Error ? updateError : void 0));
 				}
-				reportDeleteGuards(fallbackDeleteResult, {
-					physicalId: currentResource.physicalId,
+				const replDecision = engine.providerRegistry.getProviderFor({
 					resourceType,
-					provisionedBy: updateDecision.provisionedBy
+					properties: resolvedProps,
+					previousProperties: currentResource.properties
 				});
-				const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
-				if (fallbackSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, fallbackSkipReason, "during the UPDATE-not-supported replacement"));
-				engine.replacementRun.oldDeletedBeforeCreate.add(logicalId);
-			}
-			let retainedSurvivorReason;
-			let createResult;
-			try {
-				createResult = createFirst && fallbackNameChange !== void 0 ? await createFirstThenDeleteOld(engine.replacementRun, engine.replacementDeps(), {
+				const replProvider = replDecision.provider;
+				const replProps = replDecision.provisionedBy === "cc-api" ? preparePropertiesForCcApi(engine.providerRegistry, resourceType, resolvedProps, logicalId) : resolvedProps;
+				const fallbackNameChange = await checkedReplacementNameChange(engine.replacementDeps(), {
 					logicalId,
 					resourceType,
 					oldResourceType: resourceType,
+					stackName,
 					currentResource,
+					desiredProperties: resolvedProps,
 					createProvider: replProvider,
+					createdVia: replDecision.provisionedBy,
 					createProps: replProps,
-					deleteProvider: updateProvider,
-					deleteProvisionedBy: updateDecision.provisionedBy,
-					deleteProperties: currentProps,
+					secrets: updateSecrets
+				});
+				const createFirst = !retainOldOnReplace && fallbackNameChange !== void 0;
+				const noEchoDeleteValues = await noEchoDeleteValuesFromResolved({
+					record: currentResource,
+					templateResource: template?.Resources?.[logicalId],
+					resolvedProperties: resolvedProps,
+					noEchoParameters: noEchoPositionSources(engine.noEchoRun, stateResources, template)?.parameters ?? /* @__PURE__ */ new Set(),
+					conditions: engine.noEchoRun.noEchoConditions,
 					secrets: updateSecrets,
-					change: fallbackNameChange,
-					equalIdIsSameResource: !equalIdNamesDifferentResources({
-						resourceType,
+					inputSources: template && maskedInputSources(engine.resolverContextDeps(), template, stateResources, engine.noEchoRun.noEchoConditions, stackName)
+				});
+				engine.logger.info(retainOldOnReplace ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing ` + `(CREATE only — UpdateReplacePolicy: Retain keeps the old resource)` : createFirst ? safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (CREATE → DELETE — the new name differs from the old resource's)` : safeMsg`UPDATE not supported for ${logicalId} (${resourceType}), replacing (DELETE → CREATE)`);
+				if (retainOldOnReplace) await noteRetainedResource(resourceType, logicalId);
+				if (!retainOldOnReplace && !createFirst) {
+					const fallbackUpdateReplacePolicy = template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy;
+					const fallbackFinalSnapshotId = await prepareFinalSnapshotForDelete(engine.replacementDeps(), logicalId, resourceType, currentResource, fallbackUpdateReplacePolicy);
+					let fallbackDeleteResult = void 0;
+					try {
+						fallbackDeleteResult = await withPrintingSecrets(updateSecrets, () => updateProvider.delete(logicalId, currentResource.physicalId, resourceType, currentProps, {
+							expectedRegion: engine.stackRegion,
+							forceDataDelete: engine.options.forceStatefulRecreation === true,
+							...fallbackFinalSnapshotId !== void 0 && { finalSnapshotIdentifier: fallbackFinalSnapshotId },
+							...replacementDeleteContext(engine.replacementDeps(), fallbackUpdateReplacePolicy),
+							recordedAttributes: currentResource.attributes,
+							recordedNoEchoLeaves: currentResource.noEchoLeaves,
+							...noEchoDeleteValues !== void 0 && { noEchoDeleteValues },
+							maskSecrets: createUnionSecretMasker([updateSecrets, secretNameBagFor(engine.secretsRun, logicalId)])
+						}));
+					} catch (deleteError) {
+						const deleteMsg = describeAwsFailure(deleteError).detail;
+						if (!isWaitAbandonedError(deleteError) && !isInterruptedWaitError(deleteError) && !isMarkedNonRetryable(deleteError) && (deleteMsg.includes("does not exist") || deleteMsg.includes("not found") || deleteMsg.includes("NotFound"))) engine.logger.debug(safeMsg`Old resource ${logicalId} already gone, proceeding with CREATE`);
+						else throw deleteError;
+					}
+					reportDeleteGuards(fallbackDeleteResult, {
 						physicalId: currentResource.physicalId,
-						oldProperties: currentResource.properties,
-						newProperties: resolvedProps
-					}),
-					snapshotPolicy: template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy,
-					deletePolicy: template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy,
-					trigger: "the provisioning layer cannot update it in place",
-					noEchoDeleteValues
-				}) : await engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider);
-			} catch (createError) {
-				if (createFirst) throw createError;
-				if (!retainOldOnReplace) {
-					const shownSecrets = unionOfSecretBags([updateSecrets, printingSecretsFor(engine.secretsRun, logicalId)]);
-					throw new Error(safeMsg`Failed to create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`UPDATE-not-supported replacement: the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + safeMsg`is now gone. Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(describeAwsFailure(createError).detail, shownSecrets))}`, { cause: createError instanceof Error ? createError : void 0 });
+						resourceType,
+						provisionedBy: updateDecision.provisionedBy
+					});
+					const fallbackSkipReason = deleteSkipReason(fallbackDeleteResult);
+					if (fallbackSkipReason !== void 0) throw new Error(deleteSkippedMessage(logicalId, currentResource.physicalId, fallbackSkipReason, "during the UPDATE-not-supported replacement"));
+					engine.replacementRun.oldDeletedBeforeCreate.add(logicalId);
+					await updateProvider.waitForNameReleased?.(logicalId, currentResource.physicalId, resourceType, {
+						isInterrupted: () => engine.userInterrupted,
+						maskSecrets: createSecretMasker(updateSecrets)
+					});
 				}
-				if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
-				const nameHeldElsewhere = replacementRequestsDifferentName({
-					oldResourceType: resourceType,
-					newResourceType: resourceType,
-					desiredProperties: resolvedProps,
-					recorded: currentResource.properties,
-					observed: currentResource.observedProperties,
-					physicalId: currentResource.physicalId
-				});
-				if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + `provisioning layer cannot update it in place, but the create collided. ` + safeMsg`${renderNameHeldElsewhere(nameHeldElsewhere)} — so removing ` + "UpdateReplacePolicy: Retain would delete this resource and still collide. Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
-				const nameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
-				throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + "provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. " + safeMsg`${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old ` + "resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
-			}
-			if (!retainOldOnReplace && !createFirst && createResult.physicalId === currentResource.physicalId && !equalIdNamesDifferentResources({
-				resourceType,
-				physicalId: currentResource.physicalId,
-				oldProperties: currentResource.properties,
-				newProperties: resolvedProps
-			})) engine.replacementRun.recreatedUnderSameId.add(logicalId);
-			if (retainOldOnReplace) {
-				if (createResult.physicalId === currentResource.physicalId && !equalIdNamesDifferentResources({
+				let retainedSurvivorReason;
+				let createResult;
+				try {
+					createResult = createFirst && fallbackNameChange !== void 0 ? await createFirstThenDeleteOld(engine.replacementRun, engine.replacementDeps(), {
+						stackName,
+						createdVia: replDecision.provisionedBy,
+						resolvedProps,
+						logicalId,
+						resourceType,
+						oldResourceType: resourceType,
+						currentResource,
+						createProvider: replProvider,
+						createProps: replProps,
+						deleteProvider: updateProvider,
+						deleteProvisionedBy: updateDecision.provisionedBy,
+						deleteProperties: currentProps,
+						secrets: updateSecrets,
+						change: fallbackNameChange,
+						equalIdIsSameResource: !equalIdNamesDifferentResources({
+							resourceType,
+							physicalId: currentResource.physicalId,
+							oldProperties: currentResource.properties,
+							newProperties: resolvedProps
+						}),
+						snapshotPolicy: template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy,
+						deletePolicy: template?.Resources?.[logicalId]?.UpdateReplacePolicy ?? currentResource.updateReplacePolicy,
+						trigger: "the provisioning layer cannot update it in place",
+						noEchoDeleteValues
+					}) : await guardedReplacementCreate(engine, {
+						logicalId,
+						resourceType,
+						stackName,
+						createdVia: replDecision.provisionedBy,
+						resolvedProps
+					}, () => engine.withRetry(() => withCurrentResourceSecrets(updateSecrets, () => replProvider.create(logicalId, resourceType, replProps, { maskSecrets: createSecretMasker(updateSecrets) })), logicalId, void 0, void 0, replProvider, !retainOldOnReplace));
+				} catch (createError) {
+					if (createFirst) throw createError;
+					if (!retainOldOnReplace) {
+						const shownSecrets = unionOfSecretBags([updateSecrets, printingSecretsFor(engine.secretsRun, logicalId)]);
+						throw new Error(safeMsg`Failed to create ${maskSecretsInText(logicalId, shownSecrets)} after the ` + safeMsg`UPDATE-not-supported replacement: the old resource (${maskSecretsInText(currentResource.physicalId, shownSecrets)}) ` + safeMsg`is now gone. Re-run the deploy to create it fresh. Cause: ${asIsMessage(maskSecretsInText(describeAwsFailure(createError).detail, shownSecrets))}`, { cause: createError instanceof Error ? createError : void 0 });
+					}
+					if (!isNameCollisionErrorFrom(createError, logicalId)) throw createError;
+					const nameHeldElsewhere = replacementRequestsDifferentName({
+						oldResourceType: resourceType,
+						newResourceType: resourceType,
+						desiredProperties: resolvedProps,
+						recorded: currentResource.properties,
+						observed: currentResource.observedProperties,
+						physicalId: currentResource.physicalId
+					});
+					if (nameHeldElsewhere !== void 0) throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + `provisioning layer cannot update it in place, but the create collided. ` + safeMsg`${renderNameHeldElsewhere(nameHeldElsewhere)} — so removing ` + "UpdateReplacePolicy: Retain would delete this resource and still collide. Choose a name no other resource holds, or delete the resource holding it if it is yours.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+					const nameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
+					throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement because the ` + "provisioning layer cannot update it in place — but its physical name is still held by the existing resource AND UpdateReplacePolicy: Retain pins that resource in place. " + safeMsg`${nameOrigin.descriptor}. ${nameOrigin.remedy} — with Retain, the old ` + "resource keeps the name, so a same-name replacement can never proceed. Removing UpdateReplacePolicy: Retain lets cdkd delete the old resource first, which destroys it and any data it holds.", "NAMED_REPLACEMENT_COLLISION", createError instanceof Error ? createError : void 0));
+				}
+				if (!retainOldOnReplace && !createFirst && createResult.physicalId === currentResource.physicalId && !equalIdNamesDifferentResources({
 					resourceType,
 					physicalId: currentResource.physicalId,
 					oldProperties: currentResource.properties,
 					newProperties: resolvedProps
-				})) {
-					const idempotentNameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
-					throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create ` + `API is name-idempotent: the create returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place, so the new ` + safeMsg`properties were not applied. ${idempotentNameOrigin.descriptor}. ` + safeMsg`${idempotentNameOrigin.remedy} — with Retain, the old resource keeps ` + `the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
+				})) engine.replacementRun.recreatedUnderSameId.add(logicalId);
+				if (retainOldOnReplace) {
+					if (createResult.physicalId === currentResource.physicalId && !equalIdNamesDifferentResources({
+						resourceType,
+						physicalId: currentResource.physicalId,
+						oldProperties: currentResource.properties,
+						newProperties: resolvedProps
+					})) {
+						const idempotentNameOrigin = replacementNameOrigin(logicalId, currentResource.physicalId);
+						throw markNonRetryable(new CdkdError(safeMsg`${logicalId} (${resourceType}) requires replacement, but its Create ` + `API is name-idempotent: the create returned the existing resource ` + safeMsg`(${currentResource.physicalId}) instead of creating a new one, and ` + `UpdateReplacePolicy: Retain pins that resource in place, so the new ` + safeMsg`properties were not applied. ${idempotentNameOrigin.descriptor}. ` + safeMsg`${idempotentNameOrigin.remedy} — with Retain, the old resource keeps ` + `the name, so a same-name replacement can never proceed.`, "NAMED_REPLACEMENT_IDEMPOTENT_CREATE"));
+					}
+					engine.replacementRun.retainedOldOnReplacement.add(logicalId);
+					engine.logger.warn(safeMsg`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical ` + safeMsg`resource (${currentResource.physicalId}) is RETAINED and is no longer ` + "tracked by cdkd: it keeps running and incurring cost, and `cdkd destroy` will not remove it. Delete it yourself once you no longer need its data.");
+					retainedSurvivorReason = `UpdateReplacePolicy: Retain kept the old ${resourceType} (${currentResource.physicalId}), now untracked by cdkd`;
 				}
-				engine.replacementRun.retainedOldOnReplacement.add(logicalId);
-				engine.logger.warn(safeMsg`  ⚠ ${logicalId} has UpdateReplacePolicy: Retain — the old physical ` + safeMsg`resource (${currentResource.physicalId}) is RETAINED and is no longer ` + "tracked by cdkd: it keeps running and incurring cost, and `cdkd destroy` will not remove it. Delete it yourself once you no longer need its data.");
-				retainedSurvivorReason = `UpdateReplacePolicy: Retain kept the old ${resourceType} (${currentResource.physicalId}), now untracked by cdkd`;
-			}
-			const replacementResult = {
-				physicalId: createResult.physicalId,
-				wasReplaced: true,
-				...createResult.attributes && { attributes: createResult.attributes },
-				...createResult.noEchoAttributes === true && { noEchoAttributes: true },
-				...createResult.noEchoAttributeNames && { noEchoAttributeNames: createResult.noEchoAttributeNames },
-				...createResult.secretNamedAttributeNames && { secretNamedAttributeNames: createResult.secretNamedAttributeNames },
-				...retainedSurvivorReason !== void 0 ? {
-					outcome: "partial",
-					reason: retainedSurvivorReason
-				} : { outcome: "updated" }
+				const replacementResult = {
+					physicalId: createResult.physicalId,
+					wasReplaced: true,
+					...createResult.attributes && { attributes: createResult.attributes },
+					...createResult.noEchoAttributes === true && { noEchoAttributes: true },
+					...createResult.noEchoAttributeNames && { noEchoAttributeNames: createResult.noEchoAttributeNames },
+					...createResult.secretNamedAttributeNames && { secretNamedAttributeNames: createResult.secretNamedAttributeNames },
+					...retainedSurvivorReason !== void 0 ? {
+						outcome: "partial",
+						reason: retainedSurvivorReason
+					} : { outcome: "updated" }
+				};
+				if (createResult.effectiveProperties) replacementResult.effectiveProperties = createResult.effectiveProperties;
+				return {
+					result: replacementResult,
+					provisionedBy: replDecision.provisionedBy,
+					captureProvider: replProvider
+				};
 			};
-			if (createResult.effectiveProperties) replacementResult.effectiveProperties = createResult.effectiveProperties;
-			result = replacementResult;
-			resultProvisionedBy = replDecision.provisionedBy;
-			captureProvider = replProvider;
+			const fallbackOutcome = await (fallbackGeneration === void 0 ? replaceFallback() : withNameGeneration({
+				logicalId,
+				generation: fallbackGeneration
+			}, replaceFallback));
+			result = fallbackOutcome.result;
+			resultProvisionedBy = fallbackOutcome.provisionedBy;
+			captureProvider = fallbackOutcome.captureProvider;
+			replacedAtGeneration = fallbackGeneration;
 		} else {
 			if (currentResource.provisionedBy !== "cc-api" && updateDecision.ccRouteReason !== void 0 && updateError instanceof Error && !isInterruptedWaitError(updateError) && !isWaitAbandonedError(updateError)) updateError.message += ccAutoRouteUpdateFailureRemedy(logicalId, resourceType, updateDecision.ccRouteReason.properties, engine.options.parentStackInfo !== void 0);
 			throw updateError;
@@ -46966,6 +47915,7 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 	if (result.wasReplaced) engine.noEchoRun.noEchoExactEchoes.delete(logicalId);
 	stateResources[logicalId] = {
 		physicalId: result.physicalId,
+		...replacedAtGeneration === void 0 ? nameGenerationCarriedFrom(currentResource) : nameGenerationField(replacedAtGeneration),
 		resourceType,
 		properties: recordedProperties,
 		...acceptedCreateOnlyDropsField(recordedProperties, resourceType, resultProvisionedBy, dischargedByReplacement ? "new-resource" : "in-place", currentResource),
@@ -47010,6 +47960,10 @@ async function updateInPlace(engine, { conditions, counts, currentProps, current
 	engine.logger.info(safeMsg`${updatePrefix}${formatResourceLine("updated", logicalId, resourceType)}`);
 }
 
+//#endregion
+//#region src/provisioning/changed-properties-consumers.ts
+const CHANGED_PROPERTIES_CONSUMER_TYPES = /* @__PURE__ */ new Set(["AWS::ServiceDiscovery::Service"]);
+
 //#endregion
 //#region src/deployment/deploy-engine/read-provenance-moved.ts
 function occurrences(value, token) {
@@ -47380,6 +48334,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	for (const path of provenanceMoved.paths) rewrittenPaths.add(path);
 	if (provenanceMoved.paths.size > 0) engine.logger.info(safeMsg`${logicalId} is sent: ${[...provenanceMoved.paths].sort().join(", ")} read a secret-derived value at a newer version than ${logicalId} was deployed with (its upstream changed since then)`);
 	const recordMatchesDesired = movedMasked.size === 0 && rewrittenPaths.size === 0 && keyOrderFreeJson(desiredForSkipCheckAsWritten) === keyOrderFreeJson(currentPropsAsWritten);
+	const movedAsWritten = (key) => movedMasked.has(key) || rewrittenPaths.has(key) || keyOrderFreeJson(desiredForSkipCheckAsWritten[key]) !== keyOrderFreeJson(currentPropsAsWritten[key]);
 	const applyAttributeOnlyUpdate = (attributeChanges) => {
 		const attrSummary = attributeChanges.map((a) => `${a.attribute}: ${a.oldValue ?? "(unset)"} → ${a.newValue ?? "(unset)"}`).join(", ");
 		engine.logger.info(safeMsg`  ↻ ${logicalId} (${resourceType}) attribute update: ${attrSummary}`);
@@ -47484,7 +48439,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 				lowered.push(pc);
 				continue;
 			}
-			const moved = movedMasked.has(pc.path) || rewrittenPaths.has(pc.path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[pc.path]) !== keyOrderFreeJson(currentPropsAsWritten[pc.path]);
+			const moved = movedAsWritten(pc.path);
 			const conditionalVerdict = moved && !typeChanged && isReplacementCeiling(pc) ? engine.diffCalculator.conditionalReplacementVerdict?.(resourceType, pc.path, currentPropsAsWritten[pc.path], desiredForSkipCheckAsWritten[pc.path]) : void 0;
 			if (moved && conditionalVerdict !== false) {
 				warnWitnessReplacement(pc.path);
@@ -47530,7 +48485,8 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 	const parameterHeldKeys = /* @__PURE__ */ new Set();
 	const parameterUnreadablePaths = [];
 	if (pendingParameterLeaves.size > 0 && !typeChanged) {
-		const read = parameterCreateOnlyPaths.size > 0 || recordMatchesDesired ? await readOnce() : void 0;
+		const consumerReadsBack = CHANGED_PROPERTIES_CONSUMER_TYPES.has(resourceType) && currentResource.provisionedBy !== "cc-api" && [...pendingParameterLeaves.keys()].some((key) => !parameterCreateOnlyPaths.has(key) && otherFreshAt(key).length === 0);
+		const read = parameterCreateOnlyPaths.size > 0 || recordMatchesDesired || consumerReadsBack ? await readOnce() : void 0;
 		const verdictAt = (key) => {
 			if (read === void 0) return "not-readable";
 			if ("failure" in read) return read.failure;
@@ -47538,14 +48494,13 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 			return liveHoldsFreshLeaves(read.live[key], pendingParameterLeaves.get(key) ?? []) ? "held" : "differs";
 		};
 		const lowered = [];
-		const movedAt = (path) => movedMasked.has(path) || rewrittenPaths.has(path) || keyOrderFreeJson(desiredForSkipCheckAsWritten[path]) !== keyOrderFreeJson(currentPropsAsWritten[path]);
-		replacedAnyway = recreateDirectionFor(engine.options, stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAt(other.path)));
+		replacedAnyway = recreateDirectionFor(engine.options, stackName, logicalId) !== void 0 || lostWithParent !== void 0 || (change.propertyChanges ?? []).some((other) => other.requiresReplacement && (!parameterCreateOnlyPaths.has(other.path) || movedAsWritten(other.path)));
 		for (const pc of change.propertyChanges ?? []) {
 			if (!parameterCreateOnlyPaths.has(pc.path)) {
 				lowered.push(pc);
 				continue;
 			}
-			if (movedAt(pc.path)) {
+			if (movedAsWritten(pc.path)) {
 				if (pc.requiresReplacement) warnWitnessReplacement(pc.path);
 				lowered.push(pc);
 				continue;
@@ -47656,30 +48611,39 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 		engine.replacementRun.restoredLostChildren.add(logicalId);
 		return outcome;
 	};
-	if (needsReplacement) return markRestored(await updateByReplacement(engine, {
-		change,
-		counts,
-		currentProps,
-		currentResource,
-		dependencies,
-		logicalId,
-		oldResourceType,
-		progress,
-		propertyDrivenReplacement,
-		recreateFlagged,
-		recreateViaCcApi,
-		recreateViaSdkProvider,
-		renderer,
-		resolvedProps,
-		resourceType,
-		stackName,
-		stateResources,
-		template,
-		typeChanged,
-		updateReplacePolicy,
-		updateSecrets,
-		lostWithParent
-	}));
+	if (needsReplacement) {
+		const { generation: nextGeneration, fields: nameGenerationFields } = replacementNameGeneration(currentResource, logicalId, getCurrentStackInstanceId(), lostWithParent !== void 0);
+		if (nextGeneration !== void 0) engine.replacementRun.attemptedNameGeneration.set(logicalId, nextGeneration);
+		const replace = () => updateByReplacement(engine, {
+			change,
+			counts,
+			currentProps,
+			currentResource,
+			dependencies,
+			logicalId,
+			oldResourceType,
+			progress,
+			propertyDrivenReplacement,
+			recreateFlagged,
+			recreateViaCcApi,
+			recreateViaSdkProvider,
+			renderer,
+			resolvedProps,
+			resourceType,
+			stackName,
+			stateResources,
+			template,
+			typeChanged,
+			updateReplacePolicy,
+			updateSecrets,
+			lostWithParent,
+			nameGenerationFields
+		});
+		return markRestored(await (nextGeneration === void 0 ? replace() : withNameGeneration({
+			logicalId,
+			generation: nextGeneration
+		}, replace)));
+	}
 	const serviceTokenRefusal = serviceTokenUpdateRefusal({
 		logicalId,
 		resourceType,
@@ -47689,6 +48653,11 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 		diffSawTokenChange: diffMovedServiceToken(change)
 	});
 	if (serviceTokenRefusal !== void 0) throw markRefusedBeforeApplying(markNonRetryable(new CdkdError(renderServiceTokenRefusal([serviceTokenRefusal], stackName, createSecretMasker(updateSecrets)), SERVICE_TOKEN_CHANGE_REFUSED)));
+	const changedProperties = new Set([.../* @__PURE__ */ new Set([
+		...Object.keys(desiredForSkipCheckAsWritten),
+		...Object.keys(currentPropsAsWritten),
+		...Object.keys(resolvedProps)
+	])].filter((key) => movedAsWritten(key) || !confirmedPaths.has(key) && (pendingParameterLeaves.has(key) || otherFreshAt(key).length > 0)));
 	let previousForProvider = currentPropsAsWritten;
 	for (const coordinate of witness?.confirmed ?? []) {
 		const value = valueAtCoordinate(resolvedProps, coordinate);
@@ -47699,6 +48668,7 @@ async function provisionUpdate(engine, logicalId, change, stateResources, stackN
 		counts,
 		currentProps,
 		currentPropsAsWritten: previousForProvider,
+		changedProperties,
 		currentResource,
 		dependencies,
 		desiredForSkipCheckAsWritten,
@@ -47963,7 +48933,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 		saveChain = saveChain.then(async () => {
 			try {
 				const partialState = {
-					version: 12,
+					version: 13,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -47971,6 +48941,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					...exportNamesCarriedFrom(currentState),
 					...skippedOutputsCarriedFrom(currentState),
 					...orphansCarriedFrom(currentState),
+					...stackInstanceIdCarriedFrom(currentState),
 					...crossStackReadsForPartialSave(currentState, engine.recordedImports, engine.recordedOutputReads, engine.crossStackReadKeyNormalizer()),
 					lastModified: Date.now()
 				};
@@ -47993,6 +48964,12 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 	const inFlightWrites = /* @__PURE__ */ new Map();
 	engine.stackRecordsView = deployStackRecordsView(newResources, currentState.resources, deleteChanges, (logicalId) => startedUpdates.has(logicalId) && !settledUpdates.has(logicalId), () => [...inFlightWrites.values()].map(({ write }) => write));
 	engine.replacementRun.deferredReplacedDeletes = /* @__PURE__ */ new Map();
+	engine.replacementRun.supersededHost = currentState;
+	const carriedSuperseded = supersededResourcesOf(currentState).filter((entry) => {
+		if (!isSupersededHeldBySameType(entry, currentState.resources)) return true;
+		removeSuperseded(currentState, entry);
+		return false;
+	});
 	try {
 		const createUpdateIds = [];
 		for (const [id, change] of changes.entries()) {
@@ -48086,6 +49063,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					engine.interrupted = true;
 					engine.interruptCause ??= "sibling-failure";
 					const refused = isRefusedBeforeApplying(provisionError, logicalId);
+					const attemptedGeneration = change.changeType === "UPDATE" && !refused && !isReplacementNameRefusal(provisionError, logicalId) ? engine.replacementRun.attemptedNameGeneration.get(logicalId) : void 0;
 					const statePhysicalId = newResources[logicalId]?.physicalId ?? previousState?.physicalId;
 					if (refused && change.changeType === "CREATE" && statePhysicalId === void 0) throw provisionError;
 					const createdId = change.changeType === "CREATE" && statePhysicalId === void 0 ? createdBeforeFailure(provisionError, logicalId, change.resourceType) : void 0;
@@ -48117,10 +49095,14 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 							deletionPolicy: journaledOrphanPolicy(extractTemplateAttributes(template, logicalId).deletionPolicy)
 						},
 						...change.changeType === "UPDATE" && engine.replacementRun.oldDeletedBeforeCreate.has(logicalId) && { oldDeletedBeforeCreate: true },
+						...attemptedGeneration !== void 0 && { nameGeneration: attemptedGeneration },
+						...change.changeType === "CREATE" && getCurrentStackInstanceId() !== void 0 && { nameGeneration: currentNameGeneration(logicalId) ?? 0 },
 						...orphanedBy !== void 0 && { replacementOrphaned: engine.replacementRun.oldDeletedBeforeCreate.has(logicalId) ? "delete-first" : "create-first" },
 						...!refused && { attemptedProperties: engine.attemptedResolvedProps.get(logicalId) }
 					};
 					failedOperations.push(failedOp);
+					const heldNow = newResources[logicalId];
+					if (attemptedGeneration !== void 0 && heldNow !== void 0) newResources[logicalId] = withNameGenerationReached(heldNow, logicalId, attemptedGeneration);
 					let replacementOrphanOp;
 					if (orphanedBy !== void 0) {
 						replacementOrphanOp = {
@@ -48167,7 +49149,8 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					},
 					...change.changeType === "UPDATE" && engine.replacementRun.replacedOldMaySurvive.has(logicalId) && { oldResourceMaySurvive: engine.replacementRun.replacedOldMaySurvive.get(logicalId) },
 					...change.changeType === "UPDATE" && engine.replacementRun.updateWasReplaced.has(logicalId) && { wasReplaced: engine.replacementRun.updateWasReplaced.get(logicalId) },
-					...change.changeType === "UPDATE" && previousState !== void 0 && { previousResourceType: previousState.resourceType }
+					...change.changeType === "UPDATE" && previousState !== void 0 && { previousResourceType: previousState.resourceType },
+					...change.changeType === "UPDATE" && engine.replacementRun.attemptedNameGeneration.has(logicalId) && newResources[logicalId]?.nameGeneration !== void 0 && { nameGeneration: newResources[logicalId].nameGeneration }
 				});
 				saveStateAfterResource(logicalId);
 				if (engine.replacementRun.recreatedUnderSameId.has(logicalId)) enqueueLostChildren(createUpdateExecutor);
@@ -48218,6 +49201,10 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 						provisionedBy: previousState?.provisionedBy,
 						previousState
 					});
+					if (previousState !== void 0 && newResources[logicalId] === void 0) Object.assign(currentState, retiredNameGenerationsAfter(currentState, [{
+						logicalId,
+						record: previousState
+					}]));
 					saveStateAfterResource(logicalId);
 				}, () => engine.interrupted);
 			} finally {
@@ -48226,15 +49213,19 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			if (engine.interrupted && hasPending(deleteExecutor)) throw new InterruptedError(engine.interruptCause ?? "user");
 		}
 		if (engine.interrupted) warnUnretriedReplacedDeletes(engine.replacementRun, engine.replacementDeps(), "interrupted");
-		else try {
-			await retryDeferredReplacedDeletes(engine.replacementRun, engine.replacementDeps(), stackName, actualCounts);
-		} finally {
-			for (const op of completedOperations) {
-				if (op.changeType !== "UPDATE") continue;
-				const verdict = engine.replacementRun.replacedOldMaySurvive.get(op.logicalId);
-				if (verdict !== void 0) op.oldResourceMaySurvive = verdict;
-				else delete op.oldResourceMaySurvive;
+		else {
+			try {
+				await retryDeferredReplacedDeletes(engine.replacementRun, engine.replacementDeps(), stackName, actualCounts);
+			} finally {
+				for (const op of completedOperations) {
+					if (op.changeType !== "UPDATE") continue;
+					const verdict = engine.replacementRun.replacedOldMaySurvive.get(op.logicalId);
+					if (verdict !== void 0) op.oldResourceMaySurvive = verdict;
+					else delete op.oldResourceMaySurvive;
+				}
 			}
+			const releasedSomething = deleteChanges.size > 0 || completedOperations.some((op) => op.changeType === "UPDATE" && op.previousState !== void 0 && op.physicalId !== void 0 && op.physicalId !== op.previousState.physicalId);
+			await retryCarriedSupersededResources(engine, currentState, carriedSuperseded, newResources, { waitInUse: releasedSomething });
 		}
 	} catch (error) {
 		warnUnretriedReplacedDeletes(engine.replacementRun, engine.replacementDeps(), engine.interruptCause === "user" ? "interrupted" : "failed");
@@ -48293,7 +49284,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 		}
 		try {
 			const preRollbackState = {
-				version: 12,
+				version: 13,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -48301,6 +49292,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				...exportNamesCarriedFrom(currentState),
 				...skippedOutputsCarriedFrom(currentState),
 				...orphansCarriedFrom(currentState),
+				...stackInstanceIdCarriedFrom(currentState),
 				...crossStackReadsForPartialSave(currentState, engine.recordedImports, engine.recordedOutputReads, engine.crossStackReadKeyNormalizer()),
 				lastModified: Date.now()
 			};
@@ -48318,6 +49310,8 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 		let autoRollbackClean = false;
 		let autoRollbackJournaled = false;
 		let rollbackOrphans = [];
+		let rollbackCreates = [];
+		let rollbackSuperseded = [];
 		let rollbackSettledNested = /* @__PURE__ */ new Map();
 		let rollbackRemainingFailedOps = failedOperations;
 		if (error instanceof InterruptedError || isInterruptedWaitError(error) || engine.interruptCause === "user") {
@@ -48332,7 +49326,14 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 		} else {
 			autoRollbackJournaled = await writeRollbackJournalSegment(engine.rollbackDeps(), stackName, completedOperations, failedOperations, "auto-rollback-started", initialDeploy);
 			const rollbackResult = await performRollback(engine.rollbackDeps(), completedOperations, newResources, stackName, currentState, failedOperations, currentState.orphans ?? []);
-			autoRollbackClean = autoRollbackJournaled && rollbackResult.failures === 0 && rollbackResult.skipped === 0;
+			autoRollbackClean = autoRollbackJournaled && rollbackResult.failures === 0 && rollbackResult.skipped === 0 && !rollbackResult.interrupted;
+			if (rollbackResult.interrupted && rollbackResult.failures === 0 && rollbackResult.skipped === 0) {
+				const remedy = autoRollbackJournaled ? recoveryHint(engine.rollbackDeps(), "The rollback journal keeps them; finish the rollback with: " + pasteableCommand("cdkd rollback", [{
+					value: stackName,
+					hole: "stack"
+				}]).command) : "";
+				engine.logger.warn(safeMsg`The automatic rollback was interrupted before it reverted every operation. ${remedy}`);
+			}
 			if (rollbackResult.failures === 0 && rollbackResult.skipped > 0) {
 				engine.logger.warn(safeMsg`The automatic rollback could not revert ${rollbackResult.skipped} operation(s) ` + `(see the warnings above; each is recorded as a ROLLBACK_RESOURCE_SKIPPED event).` + (autoRollbackJournaled ? ` The rollback journal keeps them.` : ""));
 				if (autoRollbackJournaled && engine.options.parentStackInfo === void 0 && rollbackResult.remainingFailedOps.some((op) => op.changeType !== "DELETE")) engine.logger.warn(safeMsg`The record of the operation that failed is kept too. Revert it with: ${pasteableCommand("cdkd rollback", [{
@@ -48341,12 +49342,14 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				}, { literal: "--revert-failed" }]).command}`);
 			}
 			rollbackOrphans = rollbackResult.orphaned;
+			rollbackCreates = rollbackResult.rolledBackCreates;
+			rollbackSuperseded = rollbackResult.superseded;
 			rollbackSettledNested = rollbackResult.settledNested;
 			rollbackRemainingFailedOps = rollbackResult.remainingFailedOps;
 		}
 		try {
 			const postRollbackState = {
-				version: 12,
+				version: 13,
 				region: engine.stackRegion,
 				stackName: currentState.stackName,
 				resources: newResources,
@@ -48354,6 +49357,9 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				...exportNamesCarriedFrom(currentState),
 				...skippedOutputsCarriedFrom(currentState),
 				...orphansAfterRollback(currentState, rollbackOrphans),
+				...stackInstanceIdCarriedFrom(currentState),
+				...supersededAfterRollback(currentState, { supersededResources: rollbackSuperseded }),
+				...retiredAfterRollback(currentState, rollbackOrphans, rollbackCreates),
 				...crossStackReadsForPartialSave(currentState, engine.recordedImports, engine.recordedOutputReads, engine.crossStackReadKeyNormalizer()),
 				lastModified: Date.now()
 			};
@@ -48365,7 +49371,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 			try {
 				const freshEtag = (await engine.stateBackend.getState(stackName, engine.stackRegion))?.etag;
 				const postRollbackState = {
-					version: 12,
+					version: 13,
 					region: engine.stackRegion,
 					stackName: currentState.stackName,
 					resources: newResources,
@@ -48373,6 +49379,9 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 					...exportNamesCarriedFrom(currentState),
 					...skippedOutputsCarriedFrom(currentState),
 					...orphansAfterRollback(currentState, rollbackOrphans),
+					...stackInstanceIdCarriedFrom(currentState),
+					...supersededAfterRollback(currentState, { supersededResources: rollbackSuperseded }),
+					...retiredAfterRollback(currentState, rollbackOrphans, rollbackCreates),
 					...crossStackReadsForPartialSave(currentState, engine.recordedImports, engine.recordedOutputReads, engine.crossStackReadKeyNormalizer()),
 					lastModified: Date.now()
 				};
@@ -48381,6 +49390,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 				if (autoRollbackClean) await settleNestedChildrenAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackSettledNested, await settleJournalAfterCleanRollback(engine.rollbackDeps(), stackName, rollbackRemainingFailedOps, initialDeploy));
 			} catch (retryError) {
 				engine.logger.warn(safeMsg`Failed to save state after rollback: ${asIsMessage(describeAwsFailure(retryError).detail)}`);
+				for (const entry of rollbackSuperseded) withPrintingSecrets(unionOfSecretBags([secretNameBagFor(engine.secretsRun, entry.logicalId), orphanRecordsPrintingBag([entry])]), () => engine.logger.warn(safeMsg`  ${entry.logicalId}'s new ${entry.state.resourceType} ` + safeMsg`(${entry.state.physicalId}) the rollback left to delete is NOT recorded: ` + "delete it manually."));
 			}
 		}
 		throw error;
@@ -48398,11 +49408,12 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 	}
 	return {
 		state: {
-			version: 12,
+			version: 13,
 			region: engine.stackRegion,
 			stackName: currentState.stackName,
 			resources: newResources,
 			...orphansCarriedFrom(currentState),
+			...stackInstanceIdCarriedFrom(currentState),
 			outputs,
 			exportNames: [...engine.outputsRun.resolvedExportNames],
 			...engine.outputsRun.skippedOutputs && { skippedOutputs: { ...engine.outputsRun.skippedOutputs } },
@@ -48416,7 +49427,7 @@ async function executeDeployment(engine, template, currentState, changes, dag, e
 }
 async function persistStateAfterOutputFailure(engine, stackName, currentState, newResources, currentEtag, pendingMigration) {
 	const buildState = () => ({
-		version: 12,
+		version: 13,
 		region: engine.stackRegion,
 		stackName: currentState.stackName,
 		resources: newResources,
@@ -48424,6 +49435,7 @@ async function persistStateAfterOutputFailure(engine, stackName, currentState, n
 		...exportNamesCarriedFrom(currentState),
 		...skippedOutputsCarriedFrom(currentState),
 		...orphansCarriedFrom(currentState),
+		...stackInstanceIdCarriedFrom(currentState),
 		...crossStackReadsForPartialSave(currentState, engine.recordedImports, engine.recordedOutputReads, engine.crossStackReadKeyNormalizer()),
 		lastModified: Date.now()
 	});
@@ -48459,12 +49471,14 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 	const renderer = getLiveRenderer();
 	engine.interrupted = false;
 	engine.interruptCause = null;
+	engine.userInterrupted = false;
 	const sigintHandler = () => {
 		renderer.printAbove(() => {
 			process.stderr.write("\nInterrupted — saving partial state after current operations complete...\n");
 		});
 		engine.interrupted = true;
 		engine.interruptCause ??= "user";
+		engine.userInterrupted = true;
 	};
 	process.on("SIGINT", sigintHandler);
 	try {
@@ -48482,7 +49496,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 		const currentStateData = await engine.stateBackend.getState(stackName, engine.stackRegion);
 		noteDeployStateRecord(currentStateData?.state !== void 0);
 		const currentState = currentStateData?.state ?? {
-			version: 12,
+			version: 13,
 			region: engine.stackRegion,
 			stackName,
 			resources: {},
@@ -48491,6 +49505,19 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 			lastModified: Date.now()
 		};
 		const currentEtag = currentStateData?.etag;
+		stackInstanceIdOf(currentState, displayStackName(stackName));
+		const loadedNameGenerations = nameGenerationsOf(currentState);
+		const nameScope = () => {
+			const stackInstanceId = stackInstanceIdOf(currentState, displayStackName(stackName));
+			return {
+				stackName,
+				stackInstanceId,
+				nameGenerations: stackInstanceId === void 0 ? void 0 : loadedNameGenerations
+			};
+		};
+		const idArrivesLater = (currentStateData === null || currentStateData === void 0) && currentState.stackInstanceId === void 0;
+		const retainedAtFirstDeploy = idArrivesLater && !engine.options.dryRun ? Promise.resolve().then(() => engine.stateBackend.loadRetainedRecord(stackName, engine.stackRegion)) : void 0;
+		const retainedForWarning = retainedAtFirstDeploy?.catch(() => null);
 		engine.rebaseline(currentState.resources ?? {});
 		engine.runProducerRegionEvidence = () => producerRegionEvidence(engine.rollbackDeps(), currentState);
 		refuseMalformedOutputs(currentState, stackName, engine.stackRegion, engine.options.refusalRecovery);
@@ -48534,6 +49561,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 			command: "deploy",
 			logger: engine.logger,
 			stateResources: currentState.resources,
+			stackInstanceId: currentStateData?.state === void 0 ? () => engine.stateBackend.readStackInstanceSibling(stackName, engine.stackRegion) : nameScope().stackInstanceId,
 			resume: (op, identifier) => {
 				const attempted = op.attemptedProperties;
 				if (template.Resources?.[op.logicalId]?.Type !== op.resourceType || attempted === void 0 || carriesSecretMask(attempted) || op.pendingCloudControlRequest === void 0 || Object.values(currentState.resources).some((r) => r.physicalId === identifier && r.resourceType === op.resourceType)) return false;
@@ -48695,6 +49723,11 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 			firstDeployStateGate = void 0;
 			await gate;
 		}
+		const resolveStackInstanceId = async () => {
+			if (currentStateData !== null && currentStateData !== void 0) return;
+			if (engine.options.dryRun || currentState.stackInstanceId !== void 0) return;
+			currentState.stackInstanceId = await engine.stateBackend.stackInstanceIdForFirstWrite(stackName, engine.stackRegion, { writeAhead: true });
+		};
 		const startProvenanceCapture = () => {
 			if (engine.options.dryRun || isKnownTokenFreeState(currentStateData?.state)) return;
 			engine.provenanceCapture.kickOffProvenanceCapture({
@@ -48709,6 +49742,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 		if (!engine.diffCalculator.hasChanges(changes)) {
 			engine.logger.info("No changes detected. Stack is up to date.");
 			startProvenanceCapture();
+			const supersededChanged = engine.options.dryRun ? false : await retryCarriedSupersededResources(engine, currentState, supersededResourcesOf(currentState), currentState.resources);
 			let persistedOutputs = currentState.outputs ?? {};
 			if (!engine.options.dryRun) {
 				const resolvedOutputs = redactOutputs(engine.maskingDeps(), await withSharedDrainBudget(() => resolveOutputs(engine.outputsRun, engine.outputsDeps(), effectiveTemplate, currentState.resources, stackName, outputsDigestSource, parameterValues, conditions)));
@@ -48747,37 +49781,41 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 					stackName
 				});
 				const outputProvenanceBackfill = !outputsChanged && currentState.outputReferenceProvenance === void 0 && engine.provenanceBaseline?.tokenFree === false && engine.outputReferenceProvenanceFor(persistedOutputs, redactOutputs(engine.maskingDeps(), persistedOutputs)) !== void 0;
-				if (observedRefresh || outputProvenanceBackfill || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || healedAttributesPending) try {
-					const refreshedState = {
-						version: 12,
-						region: engine.stackRegion,
-						stackName: currentState.stackName,
-						resources: currentState.resources,
-						...orphansCarriedFrom(currentState),
-						outputs: outputsChanged ? outputsToPersist : persistedOutputs,
-						...exportNamesToPersist === void 0 ? exportNamesCarriedFrom(currentState) : { exportNames: [...exportNamesToPersist] },
-						...engine.outputsRun.skippedOutputs && { skippedOutputs: { ...engine.outputsRun.skippedOutputs } },
-						...crossStackReadsForPartialSave(currentState, engine.recordedImports, engine.recordedOutputReads, engine.crossStackReadKeyNormalizer()),
-						...conditionVerdicts && { conditionVerdicts },
-						lastModified: Date.now()
-					};
-					const saveOptions = {};
-					if (currentEtag !== void 0) saveOptions.expectedEtag = currentEtag;
-					if (migrationPending) saveOptions.migrateLegacy = true;
-					await engine.stateBackend.saveState(stackName, engine.stackRegion, engine.withParentInfo(refreshedState), saveOptions);
-					if (outputsChanged || exportSetChanged) {
-						persistedOutputs = refreshedState.outputs;
-						if (outputsChanged) engine.logger.info("Persisted Outputs-only change (no resource diff).");
-						else engine.logger.debug("Persisted export-set change (no outputs-value diff, no-change path)");
-						if (engine.exportIndexStore) await engine.exportIndexStore.updateForStack(stackName, engine.stackRegion, importableOutputs({
-							...refreshedState,
-							outputs: redactOutputs(engine.maskingDeps(), refreshedState.outputs)
-						}));
-					} else if (observedRefresh) engine.logger.debug("Persisted refreshed observedProperties (no-change path)");
-					else if (healedAttributesPending) engine.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path)");
-					else engine.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path)");
-				} catch (saveError) {
-					engine.logger.warn(safeMsg`Failed to persist no-change state update: ${asIsMessage(describeAwsFailure(saveError).detail)} — drift baseline / outputs will be re-resolved on next deploy.`);
+				if (observedRefresh || outputProvenanceBackfill || maskedFingerprintsBackfilled || conditionVerdictsChanged || outputsChanged || exportSetChanged || skippedOutputsChanged || orphansChanged || supersededChanged || healedAttributesPending) {
+					await resolveStackInstanceId();
+					try {
+						const refreshedState = {
+							version: 13,
+							region: engine.stackRegion,
+							stackName: currentState.stackName,
+							resources: currentState.resources,
+							...orphansCarriedFrom(currentState),
+							...stackInstanceIdCarriedFrom(currentState),
+							outputs: outputsChanged ? outputsToPersist : persistedOutputs,
+							...exportNamesToPersist === void 0 ? exportNamesCarriedFrom(currentState) : { exportNames: [...exportNamesToPersist] },
+							...engine.outputsRun.skippedOutputs && { skippedOutputs: { ...engine.outputsRun.skippedOutputs } },
+							...crossStackReadsForPartialSave(currentState, engine.recordedImports, engine.recordedOutputReads, engine.crossStackReadKeyNormalizer()),
+							...conditionVerdicts && { conditionVerdicts },
+							lastModified: Date.now()
+						};
+						const saveOptions = {};
+						if (currentEtag !== void 0) saveOptions.expectedEtag = currentEtag;
+						if (migrationPending) saveOptions.migrateLegacy = true;
+						await engine.stateBackend.saveState(stackName, engine.stackRegion, engine.withParentInfo(refreshedState), saveOptions);
+						if (outputsChanged || exportSetChanged) {
+							persistedOutputs = refreshedState.outputs;
+							if (outputsChanged) engine.logger.info("Persisted Outputs-only change (no resource diff).");
+							else engine.logger.debug("Persisted export-set change (no outputs-value diff, no-change path)");
+							if (engine.exportIndexStore) await engine.exportIndexStore.updateForStack(stackName, engine.stackRegion, importableOutputs({
+								...refreshedState,
+								outputs: redactOutputs(engine.maskingDeps(), refreshedState.outputs)
+							}));
+						} else if (observedRefresh) engine.logger.debug("Persisted refreshed observedProperties (no-change path)");
+						else if (healedAttributesPending) engine.logger.debug("Persisted attributes re-read from AWS for a stale record (no-change path)");
+						else engine.logger.debug("Persisted skipped-outputs record (no outputs-value diff, no-change path)");
+					} catch (saveError) {
+						engine.logger.warn(safeMsg`Failed to persist no-change state update: ${asIsMessage(describeAwsFailure(saveError).detail)} — drift baseline / outputs will be re-resolved on next deploy.`);
+					}
 				}
 			}
 			return {
@@ -48817,7 +49855,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 		}
 		const abandonedRunAt = engine.lockManager.abandonedRunEndedBy?.(stackName, engine.stackRegion);
 		if (abandonedRunAt !== void 0) await noteAbandonedRun(abandonedRunAt);
-		engine.generatedNameGuard = GeneratedNameGuard.start({
+		const generatedNameGuardInput = {
 			stackName,
 			region: engine.stackRegion,
 			changes: changes.values(),
@@ -48828,7 +49866,7 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 			records: currentState.resources,
 			orphans: currentState.orphans,
 			loadJournal: () => engine.stateBackend.loadRollbackJournal(stackName, engine.stackRegion),
-			loadRetained: () => engine.stateBackend.loadRetainedRecord(stackName, engine.stackRegion),
+			loadRetained: () => retainedAtFirstDeploy ?? engine.stateBackend.loadRetainedRecord(stackName, engine.stackRegion),
 			loadKeptInHistory: () => {
 				const reader = new DeploymentEventsReader(engine.stateBackend);
 				return loadKeptInHistory({
@@ -48840,8 +49878,24 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 			accountInfo: () => getAccountInfo(engine.stackRegion),
 			warn: (message) => engine.logger.warn(message),
 			...abandonedRunAt !== void 0 && { abandonedRunAt }
-		});
-		if (engine.generatedNameGuard !== void 0) engine.logger.debug(safeMsg`Generated-name check: looking up ${String(engine.generatedNameGuard.size)} planned create(s)`);
+		};
+		const startGeneratedNameGuard = () => {
+			const scope = nameScope();
+			const lifetimeId = scope.stackInstanceId;
+			engine.generatedNameGuard = withStackScope(scope, () => GeneratedNameGuard.start({
+				...generatedNameGuardInput,
+				...lifetimeId !== void 0 && {
+					newScheme: true,
+					replacementGeneration: (change) => {
+						const record = currentState.resources[change.logicalId];
+						if (record === void 0 || record.resourceType !== change.resourceType || !((change.propertyChanges ?? []).some((pc) => pc.requiresReplacement) || recreateTargetIdsFor(engine.options.recreateTargets, stackName)?.has(change.logicalId) === true)) return;
+						return nextNameGeneration(record, change.logicalId, lifetimeId);
+					}
+				}
+			}));
+			if (engine.generatedNameGuard !== void 0) engine.logger.debug(safeMsg`Generated-name check: looking up ${String(engine.generatedNameGuard.size)} planned create(s)`);
+		};
+		if (!idArrivesLater) startGeneratedNameGuard();
 		await checkDestructivePlan({
 			options: engine.options,
 			stackName,
@@ -48860,13 +49914,19 @@ async function doDeployWithPrefetch(engine, stackName, template, createOnlyPrefe
 			secretMask: () => diffLogMasker(engine.secretsRun, engine.maskingDeps(), diffResolverContext.recordedSecretValues, effectiveTemplate, parameterValues, currentState.resources)
 		})) engine.generatedNameGuard?.noteApprovalPrompted();
 		startProvenanceCapture();
-		engine.generatedNameGuard?.recordPlannedIntents();
 		engine.resolver.resetPhysicalIdFallbackCount();
+		await resolveStackInstanceId();
+		if (idArrivesLater) {
+			startGeneratedNameGuard();
+			const kept = await retainedForWarning ?? [];
+			if (kept.length > 0) engine.logger.warn(safeMsg`An earlier deployment of ${displayStackName(stackName)} kept ${String(kept.length)} ` + "resource(s) here (DeletionPolicy: Retain). This deploy does not take them back: it creates new resources under new names, as CloudFormation does. To manage a kept resource again, adopt it with 'cdkd import'.");
+		}
+		engine.generatedNameGuard?.recordPlannedIntents();
 		const progress = {
 			current: 0,
 			total: createChanges.length + updateChanges.length + deleteChanges.length
 		};
-		const { state: newState, actualCounts, completedOperations } = await withProducerRegions(() => producerRegionEvidence(engine.rollbackDeps(), currentState), () => executeDeployment(engine, effectiveTemplate, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending));
+		const { state: newState, actualCounts, completedOperations } = await withProducerRegions(() => producerRegionEvidence(engine.rollbackDeps(), currentState), () => withStackScope(nameScope(), () => executeDeployment(engine, effectiveTemplate, currentState, changes, dag, executionLevels, stackName, outputsDigestSource, parameterValues, conditions, currentEtag, progress, migrationPending)));
 		try {
 			engine.stateBackend.warmConnections(stackName, engine.stackRegion, TAIL_WARM_CONNECTIONS);
 		} catch {}
@@ -48977,6 +50037,7 @@ var DeployEngine = class {
 	resolver;
 	interrupted = false;
 	interruptCause = null;
+	userInterrupted = false;
 	absentJournalVersionPurge;
 	noEchoCeilingReadbackTimeoutMs = 3e4;
 	observedCapture;
@@ -49109,10 +50170,20 @@ var DeployEngine = class {
 			deployStateResources: () => this.deployStateResources,
 			interrupted: () => this.interrupted,
 			interruptCause: () => this.interruptCause,
+			userInterrupted: () => this.userInterrupted,
 			withRetry: (...args) => this.withRetry(...args),
 			maskingRetryLoggerFor: (...args) => this.maskingRetryLoggerFor(...args),
 			inlinePolicyClaimedFor: (...args) => this.inlinePolicyClaimedFor(...args),
-			recordEvent: (...args) => this.recordEvent(...args)
+			recordEvent: (...args) => this.recordEvent(...args),
+			guardedReplacementCreate: (input, create) => guardedReplacementCreate(this, input, create),
+			generatedNameGuarded: (logicalId) => this.generatedNameGuard?.candidate(logicalId) !== void 0,
+			rollbackRetainedCopies: (stackName) => {
+				const reader = new DeploymentEventsReader(this.stateBackend);
+				return loadRollbackRetainedCopies({
+					listRuns: (s, r) => reader.listRuns(s, r),
+					readRunEvents: (s, r, id) => reader.readRunEvents(s, r, id)
+				}, stackName, this.stackRegion);
+			}
 		};
 	}
 	resolverContextDeps() {
@@ -49164,6 +50235,7 @@ var DeployEngine = class {
 			},
 			absentJournalVersionPurge: () => this.absentJournalVersionPurge,
 			interrupted: () => this.interrupted,
+			userInterrupted: () => this.userInterrupted,
 			noEchoDeps: () => this.noEchoDeps(),
 			recordEvent: (...args) => this.recordEvent(...args),
 			crossStackReadKeyNormalizer: (...args) => this.crossStackReadKeyNormalizer(...args)
@@ -49190,7 +50262,7 @@ var DeployEngine = class {
 		this.inlinePolicyWriters = /* @__PURE__ */ new Map();
 		this.resolver.resetPhysicalIdFallbackCount();
 		const ledger = ledgerForStack(this.stateBackend, stackName, this.stackRegion);
-		return withStackName(stackName, () => this.options.dryRun ? this.doDeploy(stackName, template) : withCreateTokenLedger(ledger, () => this.doDeploy(stackName, template)));
+		return withStackScopeBeforeStateRead(stackName, () => this.options.dryRun ? this.doDeploy(stackName, template) : withCreateTokenLedger(ledger, () => this.doDeploy(stackName, template)));
 	}
 	static maskedRecordRemedyFor = maskedRecordRemedyFor;
 	redactStateForPersist(state) {
@@ -49203,23 +50275,35 @@ var DeployEngine = class {
 			const noEchoScrubbed = applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), logicalId, record, withNoEchoExactEchoes(this.noEchoRun, logicalId, scrubbed), templateProps, state.resources, secrets);
 			resources[logicalId] = withReferenceProvenance(withConstructPath(withMaskedPropertyFingerprints(noEchoScrubbed, record.properties, templateProps, secrets, this.secretsRun.fingerprintNoEchoValues, this.secretsRun.perResourceInputFingerprints.get(logicalId)), constructPathOf(this.noEchoRun.constructPathTemplate, logicalId)), this.referenceProvenanceToPersist(logicalId, record, noEchoScrubbed, secrets));
 		}
-		const orphans = state.orphans?.map((entry) => {
+		const orphanEntries = state.orphans;
+		const scrubDroppedRecord = (entry) => {
 			const sameResource = this.secretsRun.perResourceResolvedType.get(entry.logicalId) === entry.state.resourceType;
 			const orphanTemplateProps = sameResource ? this.secretsRun.perResourceTemplateProps.get(entry.logicalId) : void 0;
-			return {
+			return withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps, void 0, sameGenerationClaimsOf(entry.state)), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.secretsRun.fingerprintNoEchoValues : void 0, sameResource ? this.secretsRun.perResourceInputFingerprints.get(entry.logicalId) : void 0);
+		};
+		const orphans = orphanEntries?.map((entry) => ({
+			...entry,
+			state: scrubDroppedRecord(entry)
+		}));
+		const superseded = Array.isArray(state.supersededResources) ? state.supersededResources.flatMap((entry) => {
+			if (!isSupersededResourceRecord(entry)) return [entry];
+			if (isSupersededHeldBySameType(entry, state.resources)) return [];
+			return [{
 				...entry,
-				state: withMaskedPropertyFingerprints(applyNoEchoPersist(this.noEchoRun, this.noEchoDeps(), entry.logicalId, entry.state, scrubResourceRecord(entry.state, (sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0) ?? /* @__PURE__ */ new Map(), orphanTemplateProps, void 0, sameGenerationClaimsOf(entry.state)), orphanTemplateProps, state.resources), entry.state.properties, orphanTemplateProps, sameResource ? this.secretsRun.perResourceSecrets.get(entry.logicalId) : void 0, sameResource ? this.secretsRun.fingerprintNoEchoValues : void 0, sameResource ? this.secretsRun.perResourceInputFingerprints.get(entry.logicalId) : void 0)
-			};
-		});
+				state: scrubDroppedRecord(entry)
+			}];
+		}) : void 0;
 		const outputs = redactOutputs(this.maskingDeps(), state.outputs);
 		const crossStackReads = this.redactCrossStackReads(state);
-		const { outputReferenceProvenance: _incoming, ...rest } = state;
+		const { outputReferenceProvenance: _incoming, supersededResources: _superseded, ...rest } = state;
 		const outputReferenceProvenance = this.outputReferenceProvenanceFor(state.outputs, outputs);
 		return {
 			...rest,
+			...stackInstanceIdCarriedFrom(withoutSuperseded(state)),
 			resources,
 			outputs,
 			...orphans === void 0 ? {} : { orphans },
+			...superseded === void 0 ? _superseded !== void 0 && { supersededResources: _superseded } : superseded.length > 0 && { supersededResources: superseded },
 			...crossStackReads,
 			...outputReferenceProvenance !== void 0 && { outputReferenceProvenance }
 		};
@@ -49292,6 +50376,7 @@ var DeployEngine = class {
 		const { parentStack, parentLogicalId, parentRegion } = this.options.parentStackInfo;
 		return {
 			...redacted,
+			...stackInstanceIdCarriedFrom(redacted),
 			parentStack,
 			parentLogicalId,
 			parentRegion
@@ -49339,14 +50424,14 @@ var DeployEngine = class {
 			}
 		};
 	}
-	async withRetry(operation, logicalId, maxRetries, initialDelayMs, provider) {
+	async withRetry(operation, logicalId, maxRetries, initialDelayMs, provider, interruptOnlyByUser) {
 		if (provider?.disableOuterRetry) return operation();
 		return withRetry(operation, logicalId, {
 			...maxRetries !== void 0 && { maxRetries },
 			...initialDelayMs !== void 0 && { initialDelayMs },
 			logger: this.maskingRetryLogger(logicalId),
-			isInterrupted: () => this.interrupted,
-			onInterrupted: () => new InterruptedError(this.interruptCause ?? "user")
+			isInterrupted: () => interruptOnlyByUser === true ? this.userInterrupted : this.interrupted,
+			onInterrupted: () => new InterruptedError(interruptOnlyByUser === true ? "user" : this.interruptCause ?? "user")
 		});
 	}
 	maskingRetryLogger(logicalId) {
@@ -49367,5 +50452,5 @@ function sameGenerationClaimsOf(record) {
 }
 
 //#endregion
-export { DeploymentEventsStore as $, repairMalformedOrphanRecordsForReadOnly as $a, runDockerStreaming as $c, UNREADABLE_ORPHANS_CONTAINER_ROW as $i, ATOMIC_FINAL_SNAPSHOT_TYPES as $n, noEchoOutputsComparison as $o, reDisableInstanceApiTermination as $r, CrossPrefixReadError as $s, updatePartialReason as $t, inheritedProvenanceForChildDiff as A, refuseMalformedNestedChildOutputs as Aa, getBootstrapMarkerKey as Ac, producerRegionsFromState as Ai, StageLoadError as Al, bold as An, configStringRefusal as Ao, TemplateNoEchoReresolver as Ar, pathCrossesDottedKey as As, replayFailedOperations as At, conditionFingerprint as B, refuseMalformedResourceEntriesForDeploy as Ba, describeDockerExecFailure as Bc, keepsSecretReferenceToken as Bi, renderAssemblyPathEscape as Bl, createReadOnlyAttributeHealerFactory as Bn, canonicalLambdaFunctionName as Bo, unchangedBehindSecretReference as Br, provenPublicValue as Bs, recordUnderIdIsNotOwn as Bt, hasCdkAutoDeleteTag as C, malformedResourceEntriesWarning as Ca, createAssetRedirectResolver as Cc, sendableAssumeRoleCommand as Ci, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Cl, findDestructiveChanges as Cn, isWarmThroughputDecrease as Co, stringifyIfAssigned as Cr, maskSecretsInText as Cs, makeForeignHolderScan as Ct, IMPLICIT_DELETE_DEPENDENCIES as D, malformedStateRefusalMessage as Da, BOOTSTRAP_MARKER_PREFIX as Dc, envCredentialsAreAssumedRole as Di, canonicalizeRegion as Dl, getStackRecords as Dn, coerceCfnInteger as Do, isCustomResource as Dr, DYNAMIC_REFERENCE_TOKEN_SCAN as Ds, isAccessDeniedError as Dt, markRefusedBeforeApplying as E, malformedScrubResourceEntriesRefusalMessage as Ea, AssetModeResolver as Ec, callerEnvCredentials as Ei, PARTITION_TABLE as El, destroyStackRecordsView as En, coerceCfnBoolean as Eo, ccBrokenReason as Er, withoutPhysicalNameCopies as Es, chunks as Et, findNestedTemplateTreeDefect as F, refuseMalformedOrphansForOrphan as Fa, validateContainerRepoName as Fc, getAccountInfo as Fi, nullPrototypeRecord as Fl, yellow as Fn, requireConfigString as Fo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Fr, physicalNameCopiesOf as Fs, isJournaledOrphan as Ft, diffSecurity as G, refuseMalformedResourcePropertiesForDestroy as Ga, getDockerCmd as Gc, parseWebACLArn as Gi, resolveBucketRegion as Gl, orphanRecordsPrintingBag as Gn, canonicalCoordinates as Go, deleteSkipReason as Gr, recordProvenPublicExpression as Gs, findNestedStackTypeChanges as Gt, parentSuppliedValues as H, refuseMalformedResourceEntriesForImport as Ha, dockerSpawnEnvWithSensitive as Hc, cfnRefValueFromPhysicalId as Hi, injectAwsRegion as Hl, journaledOrphanPrintingBag as Hn, sameLambdaFunctionAddress as Ho, UNSPECIFIED_SKIP_REASON as Hr, recordMaskOnlyValuesIn as Hs, resolveReplacementOldType as Ht, isAbsoluteAssetPath as I, refuseMalformedOutputs as Ia, buildDenyExternalAccessPolicy as Ic, isImpossibleEmptyStoredAttribute as Ii, ownValue as Il, noEchoAttributeNamesOf as In, prefetchCreateOnlyPropertyPaths as Io, applyCustomResourceResponseExpiration as Ir, recordAttributeIdCopy as Is, isReplacementOrphan as It, mergeNoChangeOutputs as J, refuseMalformedResourcePropertiesForOrphan as Ja, partitionSensitiveEnv as Jc, passedParameterClassesOf as Ji, secretNamedAttributeNamesOf as Jn, maskReadbackAtCoordinates as Jo, markWaitAbandoned as Jr, isSingleDynamicReferenceToken as Js, REDACTED_DELETE_ADDRESS_SKIP_REASON as Jt, isSecretBearingReferenceString as K, refuseMalformedResourcePropertiesForDrift as Ka, isDockerClientEnvKey as Kc, withSharedDrainBudget as Ki, secretNamePrintingBag as Kn, isMarkedCoordinate as Ko, withIndeterminateGuard as Kr, wholeStringLeavesOf as Ks, getCurrentProducerRegions as Kt, listNestedTemplateRows as L, refuseMalformedOutputsForDestroy as La, buildDockerImage as Lc, carriesDynamicReference as Li, absoluteAssemblyPathEscape as Ll, noEchoComparisonForTemplate as Ln, templateResourceTypes as Lo, customResourceResponseExpirationWarning as Lr, recordPhysicalNameCopy as Ls, planFailedOps as Lt, findServiceTokenRefusals as M, refuseMalformedOrphanRecordsForDestroy as Ma, parseBootstrapMarker as Mc, coerceParameterTypedValue as Mi, defineOwnKey as Ml, gray as Mn, replayWarn as Mo, isCustomResourceType as Mr, inheritNestedStackParameterAssociations as Ms, removeProtectionTypeList as Mt, serviceTokenBlockingReason as N, refuseMalformedOrphans as Na, readBootstrapMarkerBody as Nc, isUnboundTemplateParameter as Ni, hasOwnKey as Nl, green as Nn, requireConfigArray as No, getCurrentResourceSecrets as Nr, recordNestedStackParameterExpressions as Ns, recordAfterRollbackUpdate as Nt, computeImplicitDeleteEdges as O, previewableOrphanRecords as Oa, assertAssetBucketRegion as Oc, classifyRecordedSecretRegion as Oi, derivePartitionAndUrlSuffix as Ol, withStackRecords as On, configBooleanRefusal as Oo, wouldReturnToSdkProvider as Or, dynamicReferenceTokens as Os, lookupEachName as Ot, childTemplateLoader as P, refuseMalformedOrphansForDestroy as Pa, validateAssetBucketName as Pc, parameterTypeMayLoseSecretIdentity as Pi, hasPlainPrototype$1 as Pl, red as Pn, requireConfigObject as Po, withPrintingSecrets as Pr, recoverMaskedOutput as Ps, demoteSupersededOrphans as Pt, DeploymentEventsReader as Q, refuseMalformedState as Qa, runDockerForeground as Qc, STATE_RESOURCES_MALFORMED as Qi, extractDeploymentEventError as Qn, noEchoLeavesOf as Qo, observeThenDisableInstanceApiTermination as Qr, rebuildClientForBucketRegion as Qs, updatePartialMessage as Qt, renderNestedTemplateTreeDefect as R, refuseMalformedResourceAttributesForOrphan as Ra, resolveDockerContextDirectory as Rc, carriesFetchableDynamicReference as Ri, describeFileReadFailure as Rl, noEchoExactEchoLeavesOf as Rn, describeTypeWithThrottleRetry as Ro, CloudControlProvider as Rr, splitGetAttStringForm as Rs, planRollback as Rt, S3_AUTO_DELETE_OBJECTS_TAG as S, malformedRenderedContainersWarning as Sa, buildAssetRedirectMap as Sc, isIamRoleArn as Si, uploadCfnTemplate as Sl, constructPathOf as Sn, coerceWarmThroughput as So, definedAttributes as Sr, maskSecretsInError as Ss, loadJournaledOrphans as St, getPriorAttempts as T, malformedResourcesWarning as Ta, rewriteTemplateAssetReferences as Tc, applyCallerIdentityCredentials as Ti, expectedOwnerParam as Tl, awaitInFlightSibling as Tn, toFiniteNumber as To, ProviderRegistry as Tr, withPhysicalNameCopies as Ts, formatResourceLine as Tt, readRecordedConditionVerdicts as U, refuseMalformedResourceEntriesForImportSave as Ua, finchSecretArgvRefusal as Uc, isStalePlaceholderArnAttribute as Ui, injectedAwsRegionValue as Ul, maskEventTextWithBoundBags as Un, DagBuilder as Uo, deleteIndeterminateGuards as Ur, recordNoEchoAttributeValues as Us, seedsDeleteFirstGuard as Ut, conditionInputsFrom as V, refuseMalformedResourceEntriesForDestroy as Va, describeDockerFailure as Vc, AWS_NO_VALUE as Vi, resolveAssemblyPath as Vl, completedReplayEntries as Vn, lambdaFunctionNameForMask as Vo, RollbackInlinePolicyWriters as Vr, recordMaskOnlyValue as Vs, replacementNeverSwapped as Vt, withResourceDeadline as W, refuseMalformedResourceEntriesForOrphan as Wa, formatDockerLoginError as Wc, refStateLookupFromResource as Wi, clearBucketRegionCache as Wl, namingSecretsWithRecordedNoEcho as Wn, TemplateParser as Wo, deleteLeftInPlace as Wr, recordNoEchoParameterFreshValue as Ws, orphanNeedsIdentity as Wt, makeSiblingClaimReader as X, refuseMalformedResourcesForDestroy as Xa, redactedCause as Xc, JSON_LISTING_HOLE_VALUE as Xi, stateSecretNameNeedles as Xn, maskedLeafCoordinatesOf as Xo, ec2InstanceProtectionSite as Xr, isLockInfoExpired as Xs, redactedDeleteAddressFields as Xt, makeCanonicalizePropertiesFn as Y, refuseMalformedResourcesForDeploy as Ya, redactDockerArgvValues as Yc, declaresNoEcho as Yi, secretNamedRecordNeedles as Yn, maskWholeValue as Yo, disableInstanceApiTermination as Yr, LockManager as Ys, isRedactedRecordedValue as Yt, planOrphanAdoption as Z, refuseMalformedResourcesForExport as Za, redactedDockerCause as Zc, STATE_REGION_DIVERGED as Zi, storedSecretNameNeedles as Zn, noEchoCoordinatesOf as Zo, isTerminationProtectionPropagationError as Zr, S3StateBackend as Zs, redactedDeleteAddressSkip as Zt, deleteTableWithIndexBusyRetry as _, malformedOrphanRowsKeptWarning as _a, shouldRetainResource as _c, recordedReferenceRegions as _i, ssmResolvedValueType as _l, isExportAliasCollision as _n, MULTI_REGION_RECREATE_BLOCKED_TYPES as _o, planTagDiff as _r, recordLogOnlyValue as _s, deleteJournaledOrphans as _t, isProtectionValueActive as a, hasReadableOutputs as aa, splitImportedOps as ac, isSettledInstanceState as ai, getDefaultStateBucketName as al, displayTextOrWithheld as an, unpreviewableOrphanRecords as ao, isFinalSnapshotError as ar, liveMatchesUnresolvedTokenFrame as as, displacedOpClause as at, waitForIndexesSettled as b, malformedOutputsRefusalMessage as ba, stringifyValue as bc, assertSendableRoleArn as bi, MIGRATE_TMP_PREFIX as bl, DEFAULT_RESOURCE_WARN_AFTER_MS as bn, renderStatefulReason as bo, tagMapAsList as br, createSecretMasker as bs, isHandledOrphan as bt, DynamoDBGlobalTableProvider as c, isReadableResourceEntry as ca, exportNamesCarriedFrom as cc, s3BucketDualStackDomainName as ci, resolveApp as cl, secretBearingStateKeyWarning as cn, withheldAccountClause as co, earliestDefined as cr, recordReferenceProvenanceEntry as cs, getNestedRevertRun as ct, compensateRemovedDeletionProtection as d, malformedExportSourceWarning as da, hasUnverifiableParameterRefusal as dc, resolveDynamicReferences as di, resolveSkipPrefix as dl, exportNameNoEchoParameters as dn, unwrittenCreateOnlyReplacement as do, withCreateTokenLedger as dr, createUnionSecretMasker as ds, revertNestedChildFromJournal as dt, UNREADABLE_RESOURCES_MAP_ROW as ea, CrossPrefixScanCache as ec, reEnableInstanceApiTermination as ei, warnFinchArgvExposure as el, computeParameterTaint as en, repairMalformedOrphansForReadOnly as eo, PRE_DELETE_SNAPSHOT_TYPES as er, passedNoEchoParametersOf as es, pendingRequestCount as et, deleteBudgetKey as f, malformedLocalOutputsWarning as fa, importableOutputKeys as fc, producerLookupOver as fi, resolveStateBucketWithDefault as fl, exportNameSecretExposure as fn, withoutSilentDropProperties as fo, acquireIdempotencyToken as fr, hasMaskableValues as fs, revertedNestedRowIds as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, malformedOrphanRecordsWarning as ga, orphansCarriedFrom as gc, recordedOutputReferenceRegions as gi, warnDeprecatedNoPrefixCliFlag as gl, collectPublishedOutputNames as gn, shownType as go, DBPROXY_TAG_OPTIONS as gr, recordLogOnlyParameterValue as gs, withNestedStackContext as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, malformedOrphanRecordsRefusalMessage as ha, orphansAfterRollback as hc, outputReferenceProvenanceOf as hi, stateBucketExistenceConfirmed as hl, collectDeclaredOutputNames as hn, findReplacedReadersOfRecreateTargets as ho, DBPROXY_TAGS_WHAT as hr, printingCorpusOf as hs, getCurrentNestedStackContext as ht, PROTECTION_PROPERTY_BY_TYPE as i, hasReadableOrphans as ia, isNotImplemented as ic, poisonRenderedSpellingsCollidingIn as ii, synthesisStatusMessage as il, WITHHELD_NAME_DISPLAY as in, repairMalformedResourcesForReadOnly as io, effectiveDeletionPolicy as ir, valueAtCoordinate as is, NESTED_PENDING_PARENT_REASON as it, deferredServiceTokenWarning as j, refuseMalformedOrphanRecords as ja, isCrossRegionRedirect as jc, regionLessSecretName as ji, processStackMessages as jl, cyan as jn, readConfigString as jo, readsNoEchoDeleteValues as jr, identityKeyFor as js, replayRollback as jt, crossStackOutputProvenanceSource as k, refuseDivergentRecordRegionForDestroy as ka, ensureAssetStorage as kc, classifyReplaySecretRegion as ki, AssemblyReader as kl, replacedDeleteFailureVerdict as kn, configIntegerRefusal as ko, waitForLambdaFunctionActive as kr, isUncertifiedBaselineMaskPosition as ks, withApiLimit as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, malformedDriftResourcePropertiesWarning as la, hasReadableExportSet as lc, s3BucketRegionalDomainName as li, resolveAutoAssetStorage as ll, secretSafeKeyDisplay as ln, findActionableSilentDrops as lo, ledgerForStack as lr, snapshotPassProvenance as ls, nestedChildStackName as lt, resolveDynamoDbDeleteBudgetMs as m, malformedLocalResourcesWarning as ma, isReadableBag as mc, keepHeldTokenProvenance as mi, resolveUseCdkBootstrapAssets as ml, noEchoParameterValueSeed as mn, hasNoCloudControlHandlers as mo, markDeleteStarted as mr, logOnlyValueCount as ms, collectNestedChildUnaddressed as mt, recordedProtectionEvidence as n, deployRefusesOrphanRowsReason as na, crossPrefixDeniedWarning as nc, INTRINSIC_KEYS as ni, getDockerImageBySourceHash as nl, reachableDivergentParameters as nn, repairMalformedResourceEntriesForReadOnly as no, ccRoutedFinalSnapshotError as nr, readsNoEchoSource as ns, keptForReadoption as nt, perType as o, hasReadableResources as oa, acceptedCreateOnlyDropsOf as oc, s3BucketArn as oi, getLegacyStateBucketName as ol, exportAliasCollisionScrubWarning as on, unreadableOrphanRecords as oo, refusesFinalSnapshot as or, markSameGenerationBag as os, displacedPhysicalIdShown as ot, resolveDynamoDbDeleteBudgetClock as p, malformedLocalResourceEntriesWarning as pa, importableOutputs as pc, refuseUnreadableCdkCrossAccountRefs as pi, resolveStateBucketWithDefaultAndSource as pl, isWholeDynamicReferenceValue as pn, NO_CC_HANDLERS_REASON as po, isRefusedByName as pr, literalSplitDelimitersOf as ps, withNestedRevertRun as pt, keptWholeReasonText as q, refuseMalformedResourcePropertiesForExport as qa, isMalformedEnvKey as qc, parameterInputsFor as qi, secretNamePrintingBags as qn, maskAtCoordinates as qo, isWaitAbandonedError as qr, WHOLE_DYNAMIC_REFERENCE_PATTERN as qs, inheritProducerRegions as qt, recordedProtectionNote as r, displayLogicalId as ra, isAccessDenied$1 as rc, IntrinsicFunctionResolver as ri, Synthesizer as rl, resourcesNamingDeclaredParameter as rn, repairMalformedResourcePropertiesForReadOnly as ro, createPreDeleteFinalSnapshot as rr, recordedNoEchoValuesOf as rs, recordRetainedForReadoption as rt, readProtection as s, isReadableOrphanRecord as sa, describeRegionValueKind as sc, s3BucketDomainName as si, loadCdkJson as sl, secretBearing as sn, unreadableResourceEntries as so, unsupportedFinalSnapshotError as sr, redactForState as ss, dropSettledNestedJournals as st, DeployEngine as t, accountArgs as ta, applyCrossPrefixScan as tc, DiffCalculator as ti, AssetManifestLoader as tl, namesAnyDeclaredParameter as tn, repairMalformedOutputsForReadOnly as to, buildFinalSnapshotIdentifier as tr, readbackPathFor as ts, resolvePendingCloudControlRequests as tt, beginDeleteWait as u, malformedExportNamesWarning as ua, hasReasonlessBaselineRefusal as uc, s3BucketWebsiteUrl as ui, resolveCaptureObservedState as ul, carriedExportAliasExposure as un, findSilentDropProperties as uo, reserveStackCreateToken as ur, carryLogOnlyValues as us, recordDisplacedSkips as ut, maskedLogger as v, malformedOrphansRefusalMessage as va, AssetPublisher as vc, applyRoleArnIfSet as vi, CFN_TEMPLATE_BODY_LIMIT as vl, bindingSkippedOutputs as vn, isStatefulRecreateTargetForReplace as vo, readTagList as vr, shareLogOnlyValues as vs, dropFailedCommands as vt, isTruthyCfnBoolean as w, malformedResourcePropertiesWarning as wa, loadPublishableAssetManifest as wc, AWS_CREDENTIAL_ENV_KEYS as wi, decodeListingKey as wl, formatDestructiveChange as wn, toCfnInteger as wo, CC_BROKEN_REASON as wr, scrubResourceRecord as ws, sameJournaledOrphans as wt, ECR_AUTO_DELETE_IMAGES_TAG as x, malformedOutputsWarning as xa, WorkGraph as xc, explicitRoleArnOrThrow as xi, findLargeInlineResources as xl, maskingRetryLogger as xn, WARM_THROUGHPUT_MEMBERS as xo, tagPlanWarning as xr, errorCauseChain as xs, journaledOrphanLines as xt, relayedIndexBusyDelete as y, malformedOrphansWarning as ya, isSensitiveAttributeName as yc, assertFlagRoleArn as yi, CFN_TEMPLATE_URL_LIMIT as yl, DEFAULT_RESOURCE_TIMEOUT_MS as yn, isStatefulRecreateTargetSync as yo, refuseMalformedDesiredTags as yr, unionOfSecretBags as ys, dropFailedHint as yt, templateIdentity as z, refuseMalformedResourceEntries as za, describeDockerCapturedOutput as zc, isNamelessDynamicReferenceError as zi, displayAssemblyPath as zl, noEchoParameterNamesOf as zn, withRetry as zo, slowCcOperationTimeoutMs as zr, carriesSecretMask as zs, recheckFailedPlan as zt };
-//# sourceMappingURL=deploy-engine-Dy7N7-Il.js.map
+export { resolvePendingCloudControlRequests as $, refuseMalformedOutputsForDestroy as $a, validateAssetBucketName as $c, carriesDynamicReference as $i, hasPlainPrototype$1 as $l, noEchoParameterNamesOf as $n, templateResourceTypes as $o, customResourceResponseExpirationWarning as $r, recordPhysicalNameCopy as $s, nameGenerationHighWaterOf as $t, inheritedProvenanceForChildDiff as A, malformedLocalResourcesWarning as Aa, importableOutputKeys as Ac, keepHeldTokenProvenance as Ai, resolveSkipPrefix as Al, destroyStackRecordsView as An, hasNoCloudControlHandlers as Ao, markDeleteStarted as Ar, logOnlyValueCount as As, removeProtectionTypeList as At, conditionFingerprint as B, malformedResourcePropertiesWarning as Ba, WorkGraph as Bc, AWS_CREDENTIAL_ENV_KEYS as Bi, findLargeInlineResources as Bl, addSuperseded as Bn, toCfnInteger as Bo, CC_BROKEN_REASON as Br, scrubResourceRecord as Bs, resolveReplacementOldType as Bt, hasCdkAutoDeleteTag as C, isReadableOrphanRecord as Ca, splitImportedOps as Cc, s3BucketDomainName as Ci, synthesisStatusMessage as Cl, DEFAULT_RESOURCE_TIMEOUT_MS as Cn, unreadableResourceEntries as Co, reserveStackCreateToken as Cr, redactForState as Cs, formatResourceLine as Ct, IMPLICIT_DELETE_DEPENDENCIES as D, malformedExportSourceWarning as Da, hasReadableExportSet as Dc, resolveDynamicReferences as Di, resolveApp as Dl, findDestructiveChanges as Dn, unwrittenCreateOnlyReplacement as Do, DeploymentEventsStore as Dr, createUnionSecretMasker as Ds, withApiLimit as Dt, markRefusedBeforeApplying as E, malformedExportNamesWarning as Ea, exportNamesCarriedFrom as Ec, s3BucketWebsiteUrl as Ei, loadCdkJson as El, constructPathOf as En, findSilentDropProperties as Eo, DeploymentEventsReader as Er, carryLogOnlyValues as Es, lookupEachName as Et, findNestedTemplateTreeDefect as F, malformedOrphansWarning as Fa, shouldRetainResource as Fc, assertFlagRoleArn as Fi, warnDeprecatedNoPrefixCliFlag as Fl, cyan as Fn, isStatefulRecreateTargetSync as Fo, refuseMalformedDesiredTags as Fr, unionOfSecretBags as Fs, planFailedOps as Ft, diffSecurity as G, refuseDivergentRecordRegionForDestroy as Ga, AssetModeResolver as Gc, classifyReplaySecretRegion as Gi, PARTITION_TABLE as Gl, supersededAfterRollback as Gn, configIntegerRefusal as Go, waitForLambdaFunctionActive as Gr, isUncertifiedBaselineMaskPosition as Gs, inheritProducerRegions as Gt, parentSuppliedValues as H, malformedScrubResourceEntriesRefusalMessage as Ha, createAssetRedirectResolver as Hc, callerEnvCredentials as Hi, CUSTOM_RESOURCE_RESPONSE_OBJECT_DESCRIPTION as Hl, holdsSupersededResources as Hn, coerceCfnBoolean as Ho, ccBrokenReason as Hr, withoutPhysicalNameCopies as Hs, orphanNeedsIdentity as Ht, isAbsoluteAssetPath as I, malformedOutputsRefusalMessage as Ia, stackInstanceIdCarriedFrom as Ic, assertSendableRoleArn as Ii, ssmResolvedValueType as Il, gray as In, renderStatefulReason as Io, tagMapAsList as Ir, createSecretMasker as Is, planRollback as It, mergeNoChangeOutputs as J, refuseMalformedOrphanRecordsForDestroy as Ja, ensureAssetStorage as Jc, coerceParameterTypedValue as Ji, AssemblyReader as Jl, supersededResourcesOf as Jn, replayWarn as Jo, isCustomResourceType as Jr, inheritNestedStackParameterAssociations as Js, redactedDeleteAddressFields as Jt, isSecretBearingReferenceString as K, refuseMalformedNestedChildOutputs as Ka, BOOTSTRAP_MARKER_PREFIX as Kc, producerRegionsFromState as Ki, canonicalizeRegion as Kl, supersededHeldByOtherTypeWarning as Kn, configStringRefusal as Ko, TemplateNoEchoReresolver as Kr, pathCrossesDottedKey as Ks, REDACTED_DELETE_ADDRESS_SKIP_REASON as Kt, listNestedTemplateRows as L, malformedOutputsWarning as La, AssetPublisher as Lc, explicitRoleArnOrThrow as Li, CFN_TEMPLATE_BODY_LIMIT as Ll, green as Ln, WARM_THROUGHPUT_MEMBERS as Lo, tagPlanWarning as Lr, errorCauseChain as Ls, recheckFailedPlan as Lt, findServiceTokenRefusals as M, malformedOrphanRecordsWarning as Ma, isReadableBag as Mc, recordedOutputReferenceRegions as Mi, resolveStateBucketWithDefaultAndSource as Ml, withStackRecords as Mn, shownType as Mo, DBPROXY_TAG_OPTIONS as Mr, recordLogOnlyParameterValue as Ms, demoteSupersededOrphans as Mt, serviceTokenBlockingReason as N, malformedOrphanRowsKeptWarning as Na, orphansAfterRollback as Nc, recordedReferenceRegions as Ni, resolveUseCdkBootstrapAssets as Nl, replacedDeleteFailureVerdict as Nn, MULTI_REGION_RECREATE_BLOCKED_TYPES as No, planTagDiff as Nr, recordLogOnlyValue as Ns, isJournaledOrphan as Nt, computeImplicitDeleteEdges as O, malformedLocalOutputsWarning as Oa, hasReasonlessBaselineRefusal as Oc, producerLookupOver as Oi, resolveAutoAssetStorage as Ol, formatDestructiveChange as On, withoutSilentDropProperties as Oo, extractDeploymentEventError as Or, hasMaskableValues as Os, replayFailedOperations as Ot, childTemplateLoader as P, malformedOrphansRefusalMessage as Pa, orphansCarriedFrom as Pc, applyRoleArnIfSet as Pi, stateBucketExistenceConfirmed as Pl, bold as Pn, isStatefulRecreateTargetForReplace as Po, readTagList as Pr, shareLogOnlyValues as Ps, isReplacementOrphan as Pt, pendingRequestCount as Q, refuseMalformedOutputs as Qa, readBootstrapMarkerBody as Qc, isImpossibleEmptyStoredAttribute as Qi, hasOwnKey as Ql, noEchoExactEchoLeavesOf as Qn, prefetchCreateOnlyPropertyPaths as Qo, applyCustomResourceResponseExpiration as Qr, recordAttributeIdCopy as Qs, nameGenerationCarriedFrom as Qt, renderNestedTemplateTreeDefect as R, malformedRenderedContainersWarning as Ra, isSensitiveAttributeName as Rc, isIamRoleArn as Ri, CFN_TEMPLATE_URL_LIMIT as Rl, red as Rn, coerceWarmThroughput as Ro, definedAttributes as Rr, maskSecretsInError as Rs, recordUnderIdIsNotOwn as Rt, S3_AUTO_DELETE_OBJECTS_TAG as S, hasReadableResources as Sa, withStackInstanceIdWithheld as Sc, s3BucketArn as Si, Synthesizer as Sl, bindingSkippedOutputs as Sn, unreadableOrphanRecords as So, ledgerForStack as Sr, markSameGenerationBag as Ss, sameJournaledOrphans as St, getPriorAttempts as T, malformedDriftResourcePropertiesWarning as Ta, describeRegionValueKind as Tc, s3BucketRegionalDomainName as Ti, getLegacyStateBucketName as Tl, maskingRetryLogger as Tn, findActionableSilentDrops as To, acquireIdempotencyToken as Tr, snapshotPassProvenance as Ts, isAccessDeniedError as Tt, readRecordedConditionVerdicts as U, malformedStateRefusalMessage as Ua, loadPublishableAssetManifest as Uc, envCredentialsAreAssumedRole as Ui, decodeListingKey as Ul, isSupersededResourceRecord as Un, coerceCfnInteger as Uo, isCustomResource as Ur, DYNAMIC_REFERENCE_TOKEN_SCAN as Us, findNestedStackTypeChanges as Ut, conditionInputsFrom as V, malformedResourcesWarning as Va, buildAssetRedirectMap as Vc, applyCallerIdentityCredentials as Vi, uploadCfnTemplate as Vl, deleteSupersededEntry as Vn, toFiniteNumber as Vo, ProviderRegistry as Vr, withPhysicalNameCopies as Vs, seedsDeleteFirstGuard as Vt, withResourceDeadline as W, previewableOrphanRecords as Wa, rewriteTemplateAssetReferences as Wc, classifyRecordedSecretRegion as Wi, expectedOwnerParam as Wl, removeSuperseded as Wn, configBooleanRefusal as Wo, wouldReturnToSdkProvider as Wr, dynamicReferenceTokens as Ws, getCurrentProducerRegions as Wt, makeSiblingClaimReader as X, refuseMalformedOrphansForDestroy as Xa, isCrossRegionRedirect as Xc, parameterTypeMayLoseSecretIdentity as Xi, processStackMessages as Xl, noEchoAttributeNamesOf as Xn, requireConfigObject as Xo, withPrintingSecrets as Xr, recoverMaskedOutput as Xs, updatePartialMessage as Xt, makeCanonicalizePropertiesFn as Y, refuseMalformedOrphans as Ya, getBootstrapMarkerKey as Yc, isUnboundTemplateParameter as Yi, StageLoadError as Yl, withoutSuperseded as Yn, requireConfigArray as Yo, getCurrentResourceSecrets as Yr, recordNestedStackParameterExpressions as Ys, redactedDeleteAddressSkip as Yt, planOrphanAdoption as Z, refuseMalformedOrphansForOrphan as Za, parseBootstrapMarker as Zc, getAccountInfo as Zi, defineOwnKey as Zl, noEchoComparisonForTemplate as Zn, requireConfigString as Zo, CUSTOM_RESOURCE_RESPONSE_LIFECYCLE_RULE_ID as Zr, physicalNameCopiesOf as Zs, updatePartialReason as Zt, deleteTableWithIndexBusyRetry as _, accountArgs as _a, applyCrossPrefixScan as _c, DiffCalculator as _i, runDockerForeground as _l, isWholeDynamicReferenceValue as _n, repairMalformedOutputsForReadOnly as _o, effectiveDeletionPolicy as _r, readbackPathFor as _s, dropFailedHint as _t, isProtectionValueActive as a, isStalePlaceholderArnAttribute as aa, recordNoEchoAttributeValues as ac, deleteIndeterminateGuards as ai, describeDockerExecFailure as al, namesAnyDeclaredParameter as an, refuseMalformedResourceEntriesForImportSave as ao, orphanRecordsPrintingBag as ar, DagBuilder as as, dropSettledNestedJournals as at, renderAssemblyPathEscape as au, waitForIndexesSettled as b, hasReadableOrphans as ba, isNotImplemented as bc, poisonRenderedSpellingsCollidingIn as bi, AssetManifestLoader as bl, collectPublishedOutputNames as bn, repairMalformedResourcesForReadOnly as bo, unsupportedFinalSnapshotError as br, valueAtCoordinate as bs, loadJournaledOrphans as bt, DynamoDBGlobalTableProvider as c, withSharedDrainBudget as ca, wholeStringLeavesOf as cc, withIndeterminateGuard as ci, finchSecretArgvRefusal as cl, WITHHELD_NAME_DISPLAY as cn, refuseMalformedResourcePropertiesForDrift as co, secretNamedAttributeNamesOf as cr, isMarkedCoordinate as cs, recordDisplacedSkips as ct, injectedAwsRegionValue as cu, compensateRemovedDeletionProtection as d, declaresNoEcho as da, LockManager as dc, disableInstanceApiTermination as di, isDockerClientEnvKey as dl, secretBearing as dn, refuseMalformedResourcesForDeploy as do, storedSecretNameNeedles as dr, maskWholeValue as ds, withNestedRevertRun as dt, carriesFetchableDynamicReference as ea, splitGetAttStringForm as ec, CloudControlProvider as ei, validateContainerRepoName as el, nameScopeOf as en, refuseMalformedResourceAttributesForOrphan as eo, createReadOnlyAttributeHealerFactory as er, describeTypeWithThrottleRetry as es, keptForRetainedRecord as et, nullPrototypeRecord as eu, deleteBudgetKey as f, JSON_LISTING_HOLE_VALUE as fa, isLockInfoExpired as fc, ec2InstanceProtectionSite as fi, isMalformedEnvKey as fl, secretBearingStateKeyWarning as fn, refuseMalformedResourcesForDestroy as fo, ATOMIC_FINAL_SNAPSHOT_TYPES as fr, maskedLeafCoordinatesOf as fs, collectNestedChildUnaddressed as ft, INDEX_SETTLE_POLL_INTERVAL_MS as g, UNREADABLE_RESOURCES_MAP_ROW as ga, CrossPrefixScanCache as gc, reEnableInstanceApiTermination as gi, redactedDockerCause as gl, exportNameSecretExposure as gn, repairMalformedOrphansForReadOnly as go, createPreDeleteFinalSnapshot as gr, passedNoEchoParametersOf as gs, dropFailedCommands as gt, DELETE_INDEX_WAIT_PROCEED_NOTE as h, UNREADABLE_ORPHANS_CONTAINER_ROW as ha, CrossPrefixReadError as hc, reDisableInstanceApiTermination as hi, redactedCause as hl, exportNameNoEchoParameters as hn, repairMalformedOrphanRecordsForReadOnly as ho, ccRoutedFinalSnapshotError as hr, noEchoOutputsComparison as hs, deleteJournaledOrphans as ht, PROTECTION_PROPERTY_BY_TYPE as i, cfnRefValueFromPhysicalId as ia, recordMaskOnlyValuesIn as ic, UNSPECIFIED_SKIP_REASON as ii, describeDockerCapturedOutput as il, computeParameterTaint as in, refuseMalformedResourceEntriesForImport as io, namingSecretsWithRecordedNoEcho as ir, sameLambdaFunctionAddress as is, displacedPhysicalIdShown as it, displayAssemblyPath as iu, deferredServiceTokenWarning as j, malformedOrphanRecordsRefusalMessage as ja, importableOutputs as jc, outputReferenceProvenanceOf as ji, resolveStateBucketWithDefault as jl, getStackRecords as jn, findReplacedReadersOfRecreateTargets as jo, DBPROXY_TAGS_WHAT as jr, printingCorpusOf as js, recordAfterRollbackUpdate as jt, crossStackOutputProvenanceSource as k, malformedLocalResourceEntriesWarning as ka, hasUnverifiableParameterRefusal as kc, refuseUnreadableCdkCrossAccountRefs as ki, resolveCaptureObservedState as kl, awaitInFlightSibling as kn, NO_CC_HANDLERS_REASON as ko, isRefusedByName as kr, literalSplitDelimitersOf as ks, replayRollback as kt, DYNAMODB_DELETE_MIN_RESOURCE_TIMEOUT_MS as l, parameterInputsFor as la, WHOLE_DYNAMIC_REFERENCE_PATTERN as lc, isWaitAbandonedError as li, formatDockerLoginError as ll, displayTextOrWithheld as ln, refuseMalformedResourcePropertiesForExport as lo, secretNamedRecordNeedles as lr, maskAtCoordinates as ls, revertNestedChildFromJournal as lt, clearBucketRegionCache as lu, resolveDynamoDbDeleteBudgetMs as m, STATE_RESOURCES_MALFORMED as ma, rebuildClientForBucketRegion as mc, observeThenDisableInstanceApiTermination as mi, redactDockerArgvValues as ml, carriedExportAliasExposure as mn, refuseMalformedState as mo, buildFinalSnapshotIdentifier as mr, noEchoLeavesOf as ms, withNestedStackContext as mt, recordedProtectionEvidence as n, keepsSecretReferenceToken as na, provenPublicValue as nc, unchangedBehindSecretReference as ni, buildDockerImage as nl, retiredNameGenerationsAfter as nn, refuseMalformedResourceEntriesForDeploy as no, journaledOrphanPrintingBag as nr, canonicalLambdaFunctionName as ns, NESTED_PENDING_PARENT_REASON as nt, absoluteAssemblyPathEscape as nu, perType as o, refStateLookupFromResource as oa, recordNoEchoParameterFreshValue as oc, deleteLeftInPlace as oi, describeDockerFailure as ol, reachableDivergentParameters as on, refuseMalformedResourceEntriesForOrphan as oo, secretNamePrintingBag as or, TemplateParser as os, getNestedRevertRun as ot, resolveAssemblyPath as ou, resolveDynamoDbDeleteBudgetClock as p, STATE_REGION_DIVERGED as pa, S3StateBackend as pc, isTerminationProtectionPropagationError as pi, partitionSensitiveEnv as pl, secretSafeKeyDisplay as pn, refuseMalformedResourcesForExport as po, PRE_DELETE_SNAPSHOT_TYPES as pr, noEchoCoordinatesOf as ps, getCurrentNestedStackContext as pt, keptWholeReasonText as q, refuseMalformedOrphanRecords as qa, assertAssetBucketRegion as qc, regionLessSecretName as qi, derivePartitionAndUrlSuffix as ql, supersededHolderOf as qn, readConfigString as qo, readsNoEchoDeleteValues as qr, identityKeyFor as qs, isRedactedRecordedValue as qt, recordedProtectionNote as r, AWS_NO_VALUE as ra, recordMaskOnlyValue as rc, RollbackInlinePolicyWriters as ri, resolveDockerContextDirectory as rl, retiredNameGenerationsLeaving as rn, refuseMalformedResourceEntriesForDestroy as ro, maskEventTextWithBoundBags as rr, lambdaFunctionNameForMask as rs, displacedOpClause as rt, describeFileReadFailure as ru, readProtection as s, parseWebACLArn as sa, recordProvenPublicExpression as sc, deleteSkipReason as si, dockerSpawnEnvWithSensitive as sl, resourcesNamingDeclaredParameter as sn, refuseMalformedResourcePropertiesForDestroy as so, secretNamePrintingBags as sr, canonicalCoordinates as ss, nestedChildStackName as st, injectAwsRegion as su, DeployEngine as t, isNamelessDynamicReferenceError as ta, carriesSecretMask as tc, slowCcOperationTimeoutMs as ti, buildDenyExternalAccessPolicy as tl, retiredAfterRollback as tn, refuseMalformedResourceEntries as to, completedReplayEntries as tr, withRetry as ts, recordRetainedForReadoption as tt, ownValue as tu, beginDeleteWait as u, passedParameterClassesOf as ua, isSingleDynamicReferenceToken as uc, markWaitAbandoned as ui, getDockerCmd as ul, exportAliasCollisionScrubWarning as un, refuseMalformedResourcePropertiesForOrphan as uo, stateSecretNameNeedles as ur, maskReadbackAtCoordinates as us, revertedNestedRowIds as ut, resolveBucketRegion as uu, maskedLogger as v, deployRefusesOrphanRowsReason as va, crossPrefixDeniedWarning as vc, INTRINSIC_KEYS as vi, runDockerStreaming as vl, noEchoParameterValueSeed as vn, repairMalformedResourceEntriesForReadOnly as vo, isFinalSnapshotError as vr, readsNoEchoSource as vs, isHandledOrphan as vt, isTruthyCfnBoolean as w, isReadableResourceEntry as wa, acceptedCreateOnlyDropsOf as wc, s3BucketDualStackDomainName as wi, getDefaultStateBucketName as wl, DEFAULT_RESOURCE_WARN_AFTER_MS as wn, withheldAccountClause as wo, withCreateTokenLedger as wr, recordReferenceProvenanceEntry as ws, chunks as wt, ECR_AUTO_DELETE_IMAGES_TAG as x, hasReadableOutputs as xa, stackInstanceIdOf as xc, isSettledInstanceState as xi, getDockerImageBySourceHash as xl, isExportAliasCollision as xn, unpreviewableOrphanRecords as xo, earliestDefined as xr, liveMatchesUnresolvedTokenFrame as xs, makeForeignHolderScan as xt, relayedIndexBusyDelete as y, displayLogicalId as ya, isAccessDenied$1 as yc, IntrinsicFunctionResolver as yi, warnFinchArgvExposure as yl, collectDeclaredOutputNames as yn, repairMalformedResourcePropertiesForReadOnly as yo, refusesFinalSnapshot as yr, recordedNoEchoValuesOf as ys, journaledOrphanLines as yt, templateIdentity as z, malformedResourceEntriesWarning as za, stringifyValue as zc, sendableAssumeRoleCommand as zi, MIGRATE_TMP_PREFIX as zl, yellow as zn, isWarmThroughputDecrease as zo, stringifyIfAssigned as zr, maskSecretsInText as zs, replacementNeverSwapped as zt };
+//# sourceMappingURL=deploy-engine-CYVt2NQR.js.map