typekro 0.28.1 → 0.29.0

package/dist/core/deployment/kro-factory.js

@@ -8,8 +8,10 @@ import { compile as compileExpression } from 'angular-expressions';
 import * as yaml from 'js-yaml';
 import { createAlchemyResourceId } from '../../alchemy/utilities.js';
 import { preserveNonEnumerableProperties } from '../../utils/helpers.js';
+import { shortStableHash, toCamelCase } from '../../utils/string.js';
 import { isKubernetesRef } from '../../utils/type-guards.js';
 import { applyAspects } from '../aspects/apply.js';
+import { copyCompositionAnalysisMetadata } from '../composition/analysis-metadata.js';
 import { createCompositionContext, runWithCompositionContext } from '../composition/context.js';
 import { buildNestedCompositionAliasTargets } from '../composition/nested-status-cel.js';
 import { DEFAULT_DEPLOYMENT_TIMEOUT, DEFAULT_KRO_INSTANCE_TIMEOUT, DEFAULT_RGD_TIMEOUT, } from '../config/defaults.js';
@@ -19,31 +21,33 @@ import { isStrictCelDiagnosticsEnabled } from '../expressions/analysis/strict-ce
 import { applyAnalysisToResources } from '../expressions/composition/composition-analyzer.js';
 import { createBunCompatibleKubernetesObjectApi } from '../kubernetes/index.js';
 import { getComponentLogger } from '../logging/index.js';
-import { namespace as namespaceResource } from '../../factories/kubernetes/core/namespace.js';
-import { shortStableHash, toCamelCase } from '../../utils/string.js';
 // Dependency inversion: kroCustomResource, resourceGraphDefinition, and
 // alchemy bridge are injected via FactoryOptions providers (Phase 3.5)
 // instead of dynamic import() from higher layers.
-import { copyResourceMetadata, getMetadataField, getReadinessEvaluator, getResourceScope, setMetadataField, setReadinessEvaluator, } from '../metadata/index.js';
-import { createAlwaysReadyEvaluator, ensureReadinessEvaluator } from '../readiness/index.js';
+import { copyResourceMetadata, getMetadataField, getReadinessEvaluator, getResourceScope, setMetadataField, setReadinessEvaluator, setResourceId, } from '../metadata/index.js';
+import { assertAdapterCapabilitiesSupported, canonicalStringify, collectArtifactOutputUses, collectPlanValueSensitiveBindings, compileKroArtifactPlan, createKroArtifactBundle, decodeKroArtifactBundle, encodeKroArtifactBundle, KRO_ARTIFACT_BINDINGS_SPEC_FIELD, kroArtifactOutputField, kroArtifactPlanToGraphResources, kroArtifactPlanToInstanceResource, kroArtifactPlanToSupportingResources, kroArtifactRequirementField, lowerPlanValue, mapPlanValueSensitiveBindings, materializeKroArtifactBundleOperation, materializePlanValue, mergeKroArtifactBundleOperations, orderKroArtifactBundleOperations, planValueSensitiveBindingNames, resolveStaticYamlSensitiveBindings, schemaToIR, } from '../planning/index.js';
+import { createAlwaysReadyEvaluator, createCustomResourceDefinitionReadinessEvaluator, ensureReadinessEvaluator, getPortableReadinessStrategy, resolvePortableReadinessStrategy, } from '../readiness/index.js';
 import { createSchemaProxy, DeploymentMode } from '../references/index.js';
+import { runStandaloneOperation } from '../runtime/standalone-operation.js';
 import { isStaticExpression } from '../serialization/cel-references.js';
 import { applyTernaryConditionalsToResources } from '../serialization/kro-post-processing.js';
 import { generateKroSchemaFromArktype } from '../serialization/schema.js';
-import { serializeResourceGraphToYaml } from '../serialization/yaml.js';
+import { serializeResourceGraphDefinitionToYaml, serializeResourceGraphToManifest, } from '../serialization/yaml.js';
 import { getSingletonResourceId } from '../singleton/singleton.js';
 import { validateStatusCelExpressions } from '../validation/cel-validator.js';
 import { KubernetesClientManager } from './client-provider-manager.js';
+import { blockerForRemainingResource, createDeletionResultState, deletionTarget, finishDeletionResult, readDeletionResourceIdentity, } from './deletion-result.js';
 import { DirectDeploymentEngine } from './engine.js';
 import { logHandleSnapshot } from './handle-tracing.js';
 import { isNotFoundError } from './k8s-helpers.js';
-import { assertKroInstanceNamespaceOwnershipSafe, assertNoHoistWeakenedStatusFields, assertSingletonOwnerNamespaceOwnershipSafe, concreteActiveOwnedResources, concreteOwnedNamespaceResources, findDanglingHoistedReference, resolveConcreteMetadataValue, resolveNamespaceName, rewriteHoistedNamespaceReferences, rewriteHoistedNamespaceRefsInValue, selectHoistedNamespaces, } from './kro-instance-safety.js';
+import { assertKroInstanceSpecPreserved } from './kro-instance-admission.js';
+import { assertKroInstanceNamespaceOwnershipSafe, assertNoHoistWeakenedStatusFields, concreteActiveOwnedResources, concreteOwnedNamespaceResources, findDanglingHoistedReference, resolveConcreteMetadataValue, resolveNamespaceName, rewriteHoistedNamespaceReferences, rewriteHoistedNamespaceRefsInValue, selectHoistedNamespaces, } from './kro-instance-safety.js';
 import { decideNamespaceOwnershipCreateFirst, deleteNamespaceIfEmpty, HOISTED_NAMESPACES_ANNOTATION, listNamespacesOwnedByRgd, NAMESPACE_OWNER_ANNOTATION, parseHoistedNamespacesAnnotation, readHoistedNamespacesRecord, } from './kro-namespace-teardown.js';
-import { createRollbackManager } from './rollback-manager.js';
 import { waitForKroInstanceReady as waitForKroInstanceReadyShared } from './kro-readiness.js';
+import { createRollbackManager } from './rollback-manager.js';
 import { evaluateSchemaCelExpression } from './schema-cel-evaluator.js';
 import { convertToKubernetesName, extractSerializableKubeConfigOptions, generateInstanceName, getSingletonInstanceName, pluralizeKind, validateSpec, } from './shared-utilities.js';
-import { joinYamlDocuments, singletonOwnerInstanceYamls, singletonRgdYamls, } from './singleton-gitops.js';
+import { joinYamlDocuments, singletonOwnerInstanceManifests, singletonRgdYamls, } from './singleton-gitops.js';
 import { assertNoDeployedSingletonSpecDrift, singletonSpecFingerprintAnnotationValue, } from './singleton-owner-drift.js';
 /**
  * Label stamped on every KRO instance CR this factory creates, keyed to the
@@ -51,6 +55,48 @@ import { assertNoDeployedSingletonSpecDrift, singletonSpecFingerprintAnnotationV
  * to decide whether other instances still share the RGD.
  */
 const INSTANCE_RGD_LABEL = 'typekro.io/rgd';
+function uniqueArtifactRequirements(requirements) {
+    const byId = new Map();
+    for (const requirement of requirements) {
+        const prior = byId.get(requirement.id);
+        if (prior && canonicalStringify(prior) !== canonicalStringify(requirement)) {
+            throw new TypeKroError(`Artifact requirement ${requirement.id} has conflicting definitions across KRO bundle members.`, 'KRO_ARTIFACT_REQUIREMENT_CONFLICT', { requirementId: requirement.id });
+        }
+        byId.set(requirement.id, requirement);
+    }
+    return [...byId.values()].sort((left, right) => left.id.localeCompare(right.id));
+}
+function uniqueCapabilityRequirements(requirements) {
+    return [
+        ...new Map(requirements.map((requirement) => [canonicalStringify(requirement), requirement])).values(),
+    ].sort((left, right) => canonicalStringify(left).localeCompare(canonicalStringify(right)));
+}
+function kroBundleOperationId(resource) {
+    const name = resource.metadata?.name;
+    if (typeof resource.apiVersion !== 'string' || typeof resource.kind !== 'string' || !name) {
+        throw new TypeKroError('Cannot identify KRO bundle operation without a complete Kubernetes identity.', 'KRO_ARTIFACT_BUNDLE_IDENTITY_MISSING', { apiVersion: resource.apiVersion, kind: resource.kind, name });
+    }
+    return [
+        'k8s',
+        resource.apiVersion,
+        resource.kind,
+        resource.metadata?.namespace ?? '_cluster',
+        name,
+    ]
+        .map((part) => encodeURIComponent(part))
+        .join(':');
+}
+function kroMemberSensitiveBinding(memberId, binding) {
+    return binding.startsWith('spec/') ? `kro/${encodeURIComponent(memberId)}/${binding}` : binding;
+}
+function mergeSensitiveBindingEnvelopes(target, incoming) {
+    for (const [binding, value] of Object.entries(incoming)) {
+        if (Object.hasOwn(target, binding) && !Object.is(target[binding], value)) {
+            throw new TypeKroError(`Sensitive binding ${binding} resolved to conflicting values across KRO bundle members.`, 'KRO_SENSITIVE_BINDING_CONFLICT', { binding });
+        }
+        target[binding] = value;
+    }
+}
 /**
  * Decide whether the RGD/CRD should be preserved after a `deleteInstance`
  * call, i.e., whether other instances still depend on it.
@@ -92,6 +138,100 @@ instances, targetName, instanceDeleted, targetNamespace) {
         : instances;
     return others.length > 0;
 }
+function recordNamespaceDeletionOutcome(state, namespace, outcome) {
+    const resource = deletionTarget('v1', 'Namespace', namespace);
+    if (outcome.status === 'deleted' || outcome.status === 'absent') {
+        // A bounded descendant-drain retry may first observe the Namespace as occupied and then
+        // confirm it gone. Keep the final DTO truthful by removing interim retention/blocker evidence.
+        const replaceWithFilteredEntries = (entries, keep) => {
+            entries.splice(0, entries.length, ...entries.filter(keep));
+        };
+        replaceWithFilteredEntries(state.retained, (entry) => !(entry.resource.kind === 'Namespace' && entry.resource.name === namespace));
+        replaceWithFilteredEntries(state.remaining, (entry) => !(entry.kind === 'Namespace' && entry.name === namespace));
+        replaceWithFilteredEntries(state.blockers, (entry) => !(entry.resource?.kind === 'Namespace' && entry.resource.name === namespace));
+        state.deleted.push(resource);
+        return;
+    }
+    if (outcome.cause === 'not-owned') {
+        state.retained.push({ resource, policy: 'adopted-resource', reason: outcome.reason });
+        return;
+    }
+    if (outcome.cause === 'occupied') {
+        state.retained.push({ resource, policy: 'occupied-namespace', reason: outcome.reason });
+        return;
+    }
+    state.retained.push({
+        resource,
+        policy: 'safety-proof-unavailable',
+        reason: outcome.reason,
+    });
+    state.remaining.push(resource);
+    state.blockers.push({
+        code: outcome.cause === 'read-failed' ? 'OWNERSHIP_UNPROVEN' : 'DISCOVERY_FAILED',
+        message: outcome.reason,
+        resource,
+        retryable: true,
+        retryGuidance: 'Retry after Kubernetes discovery and namespace reads are available; TypeKro retained the namespace to avoid destructive cleanup.',
+    });
+}
+const DESCENDANT_PRODUCING_KINDS = new Set([
+    'CronJob',
+    'DaemonSet',
+    'Deployment',
+    'HelmRelease',
+    'Job',
+    'Kustomization',
+    'ReplicaSet',
+    'ReplicationController',
+    'StatefulSet',
+]);
+/**
+ * Capture dependents that Kubernetes may orphan when KRO removes their direct
+ * controller before garbage collection completes. The UID match is the
+ * ownership proof: a same-named Pod from a replacement Job is never adopted.
+ */
+async function captureKnownControllerDescendants(k8sApi, childTargets, defaultNamespace) {
+    const descendants = [];
+    for (const target of childTargets) {
+        if (target.kind !== 'Job')
+            continue;
+        const namespace = target.namespace ?? defaultNamespace;
+        let live;
+        try {
+            live = await k8sApi.read({
+                apiVersion: target.apiVersion,
+                kind: target.kind,
+                metadata: { name: target.name, namespace },
+            });
+        }
+        catch (error) {
+            const statusCode = error.statusCode ??
+                error.body?.code;
+            if (statusCode === 404)
+                continue;
+            throw error;
+        }
+        const uid = live.metadata?.uid;
+        if (!uid) {
+            throw new Error(`Cannot prove descendant ownership for Job/${target.name}: UID is missing`);
+        }
+        const pods = await k8sApi.list('v1', 'Pod', namespace, undefined, undefined, undefined, undefined, `batch.kubernetes.io/controller-uid=${uid}`);
+        for (const pod of pods.items) {
+            const podName = pod.metadata?.name;
+            const controlledByJob = pod.metadata?.ownerReferences?.some((owner) => owner.uid === uid && owner.kind === 'Job' && owner.controller !== false);
+            if (!podName || !controlledByJob)
+                continue;
+            descendants.push({
+                apiVersion: 'v1',
+                kind: 'Pod',
+                name: podName,
+                namespace,
+                owner: { ...target, namespace, uid },
+            });
+        }
+    }
+    return descendants;
+}
 function deepMergeStatusPlaceholders(staticFields, dynamicFields) {
     const merged = { ...staticFields };
     for (const [key, dynamicValue] of Object.entries(dynamicFields)) {
@@ -167,6 +307,16 @@ export class KroResourceFactoryImpl {
         this.singletonDefinitions = options.singletonDefinitions ?? [];
         this.factoryOptions = options;
         this.clientManager = new KubernetesClientManager(options);
+        const specSchema = schemaToIR(schemaDefinition.spec);
+        if (specSchema.root.kind === 'object' &&
+            specSchema.root.properties.some((property) => property.name === KRO_ARTIFACT_BINDINGS_SPEC_FIELD)) {
+            throw new TypeKroError(`Spec field ${KRO_ARTIFACT_BINDINGS_SPEC_FIELD} is reserved for TypeKro KRO provider bindings.`, 'KRO_RESERVED_SPEC_FIELD', {
+                field: KRO_ARTIFACT_BINDINGS_SPEC_FIELD,
+                surface: 'schema',
+                factory: name,
+                policyVersion: 1,
+            });
+        }
         // Pass the Arktype JSON so the proxy is shape-aware: spread
         // (`{ ...schema.spec.X }`) enumerates declared fields and
         // `Object.keys(schema.spec.X)` returns them. See the docstring on
@@ -180,7 +330,9 @@ export class KroResourceFactoryImpl {
     }
     /** Extract nested composition status CEL mappings from the raw status object. */
     getNestedStatusCel() {
-        return this.statusMappings?.__nestedStatusCel;
+        if (!this.statusMappings)
+            return undefined;
+        return Object.getOwnPropertyDescriptor(this.statusMappings, '__nestedStatusCel')?.value;
     }
     getSchemaVersion() {
         return this.schemaDefinition.apiVersion.includes('/')
@@ -197,6 +349,19 @@ export class KroResourceFactoryImpl {
     getInstanceApiVersion() {
         return `${this.getSchemaGroup()}/${this.getSchemaVersion()}`;
     }
+    assertNoReservedKroSpecField(spec) {
+        if (!spec ||
+            typeof spec !== 'object' ||
+            !Object.hasOwn(spec, KRO_ARTIFACT_BINDINGS_SPEC_FIELD)) {
+            return;
+        }
+        throw new TypeKroError(`Spec field ${KRO_ARTIFACT_BINDINGS_SPEC_FIELD} is reserved for TypeKro KRO provider bindings.`, 'KRO_RESERVED_SPEC_FIELD', {
+            field: KRO_ARTIFACT_BINDINGS_SPEC_FIELD,
+            surface: 'instance-spec',
+            factory: this.name,
+            policyVersion: 1,
+        });
+    }
     /**
      * Resolve the namespace the KRO instance CR lives in for this call.
      *
@@ -310,6 +475,302 @@ export class KroResourceFactoryImpl {
         const remaining = Object.fromEntries(Object.entries(resources).filter(([id]) => !hoistIds.has(id)));
         return rewriteHoistedNamespaceReferences(remaining, hoistIds);
     }
+    /**
+     * Compile captured symbolic intent back into the established serializer input.
+     * Legacy resources remain a fallback for factories created outside the
+     * composition capture frontend.
+     */
+    plannedResources() {
+        const capture = this.factoryOptions.semanticCapture;
+        if (!capture) {
+            return this.resources;
+        }
+        const configuredPlan = this.factoryOptions.plan ?? {};
+        const plan = capture.planTemplate({
+            ...configuredPlan,
+            aspects: configuredPlan.aspects ?? this.factoryOptions.aspects ?? [],
+        });
+        const outerInputs = this.outerArtifactCompilationInputs();
+        const artifacts = compileKroArtifactPlan(plan, {
+            strict: true,
+            rgdName: this.rgdName,
+            ...outerInputs,
+            ...(this.factoryOptions.applyPolicy
+                ? { outerApplyPolicy: this.factoryOptions.applyPolicy }
+                : {}),
+        });
+        return kroArtifactPlanToGraphResources(artifacts);
+    }
+    /** Compile this factory's local graph and directly managed outer artifacts once. */
+    compiledKroArtifactPlan(spec, options = {}) {
+        const capture = this.factoryOptions.semanticCapture;
+        if (!capture)
+            return undefined;
+        const configuredPlan = this.factoryOptions.plan ?? {};
+        const planOptions = {
+            ...configuredPlan,
+            aspects: configuredPlan.aspects ?? this.factoryOptions.aspects ?? [],
+        };
+        const plan = capture.planTemplate(planOptions);
+        const concretePlan = spec === undefined ? undefined : capture.planSymbolic(spec, planOptions);
+        const memberId = options.memberId ?? 'root';
+        const instanceSpec = concretePlan
+            ? mapPlanValueSensitiveBindings(concretePlan.spec, (binding) => kroMemberSensitiveBinding(memberId, binding))
+            : undefined;
+        const sensitiveBindings = spec !== undefined && instanceSpec
+            ? collectPlanValueSensitiveBindings(instanceSpec, spec, `$.members.${memberId}.instance.spec`)
+            : {};
+        const instanceName = spec === undefined
+            ? undefined
+            : (options.instanceNameOverride ?? generateInstanceName(spec, this.name));
+        const metadata = spec === undefined
+            ? undefined
+            : this.instanceManifestMetadata(spec, options.singletonSpecFingerprint);
+        const artifacts = compileKroArtifactPlan(plan, {
+            strict: true,
+            rgdName: this.rgdName,
+            ...this.outerArtifactCompilationInputs(spec),
+            ...(this.factoryOptions.applyPolicy
+                ? { outerApplyPolicy: this.factoryOptions.applyPolicy }
+                : {}),
+            ...(spec !== undefined && instanceName && metadata && instanceSpec
+                ? {
+                    instance: {
+                        name: lowerPlanValue(instanceName).value,
+                        namespace: lowerPlanValue(this.resolveInstanceNamespace(spec)).value,
+                        apiVersion: this.getInstanceApiVersion(),
+                        kind: this.schemaDefinition.kind,
+                        spec: instanceSpec,
+                        labels: lowerPlanValue(metadata.labels).value,
+                        annotations: lowerPlanValue(metadata.annotations).value,
+                    },
+                }
+                : {}),
+        });
+        return { artifacts, sensitiveBindings };
+    }
+    /**
+     * Recursively compile local plans into physical outer operations. Cross-member
+     * singleton edges resolve to the owner's concrete instance operation.
+     */
+    compileKroBundleAssembly(spec, options) {
+        const compilation = this.compiledKroArtifactPlan(spec, options);
+        if (!compilation)
+            return undefined;
+        const { artifacts } = compilation;
+        const sensitiveBindings = {
+            ...compilation.sensitiveBindings,
+        };
+        const childOperations = [];
+        const requiredCapabilities = [...artifacts.requiredCapabilities];
+        const artifactRequirements = [...artifacts.artifactRequirements];
+        const singletonOperationByPhysicalId = new Map();
+        const definitions = spec === undefined ? this.singletonDefinitions : this.discoverSingletonDefinitions(spec);
+        for (const definition of definitions) {
+            if (options.singletonStack.includes(definition.key)) {
+                throw new TypeKroError(`Singleton dependency cycle detected: ${[...options.singletonStack, definition.key].join(' -> ')}`, 'KRO_SINGLETON_DEPENDENCY_CYCLE', { singletonKey: definition.key });
+            }
+            const singletonFactory = this.singletonFactoryFor(definition);
+            const child = singletonFactory.compileKroBundleAssembly(definition.spec, {
+                memberId: `singleton:${definition.key}`,
+                root: false,
+                instanceNameOverride: getSingletonInstanceName(definition.id),
+                singletonSpecFingerprint: singletonSpecFingerprintAnnotationValue(definition.specFingerprint),
+                singletonStack: [...options.singletonStack, definition.key],
+            });
+            if (!child?.instanceOperationId) {
+                throw new TypeKroError(`Singleton owner ${definition.key} did not compile a concrete instance operation.`, 'KRO_SINGLETON_OWNER_ARTIFACT_MISSING', { singletonKey: definition.key });
+            }
+            mergeSensitiveBindingEnvelopes(sensitiveBindings, child.sensitiveBindings);
+            childOperations.push(...child.operations);
+            requiredCapabilities.push(...child.requiredCapabilities);
+            artifactRequirements.push(...child.artifactRequirements);
+            const ownerOperation = child.operations.find((operation) => operation.id === child.instanceOperationId);
+            if (!ownerOperation) {
+                throw new TypeKroError(`Singleton owner ${definition.key} instance operation is absent from its bundle.`, 'KRO_SINGLETON_OWNER_ARTIFACT_MISSING', { singletonKey: definition.key, operationId: child.instanceOperationId });
+            }
+            singletonOperationByPhysicalId.set(ownerOperation.id, ownerOperation.id);
+        }
+        const source = {
+            memberId: options.memberId,
+            planIdentityDigest: artifacts.planIdentityDigest,
+            compiledArtifactDigest: artifacts.compiledArtifactDigest,
+        };
+        const operations = [...childOperations];
+        const operationIdByArtifactId = new Map();
+        for (const artifact of artifacts.resources.filter((candidate) => candidate.role === 'singleton-owner')) {
+            if (!artifact.identity) {
+                throw new TypeKroError(`Singleton artifact ${artifact.id} has no physical identity.`, 'KRO_ARTIFACT_BUNDLE_IDENTITY_MISSING', { artifactId: artifact.id });
+            }
+            const name = materializePlanValue(artifact.identity.name, {
+                sensitive: sensitiveBindings,
+            });
+            const namespace = artifact.identity.namespace
+                ? materializePlanValue(artifact.identity.namespace, {
+                    sensitive: sensitiveBindings,
+                })
+                : undefined;
+            if (typeof name !== 'string' || (namespace !== undefined && typeof namespace !== 'string')) {
+                throw new TypeKroError(`Singleton artifact ${artifact.id} has a non-concrete physical identity.`, 'KRO_ARTIFACT_BUNDLE_IDENTITY_MISSING', { artifactId: artifact.id, name, namespace });
+            }
+            const physicalId = kroBundleOperationId({
+                apiVersion: artifact.identity.apiVersion,
+                kind: artifact.identity.kind,
+                metadata: { name, ...(namespace ? { namespace } : {}) },
+            });
+            const ownerOperationId = singletonOperationByPhysicalId.get(physicalId);
+            if (!ownerOperationId) {
+                throw new TypeKroError(`Singleton artifact ${artifact.id} has no compiled owner member.`, 'KRO_SINGLETON_OWNER_ARTIFACT_MISSING', { artifactId: artifact.id, physicalId });
+            }
+            operationIdByArtifactId.set(artifact.id, ownerOperationId);
+        }
+        const nonSingletonArtifacts = {
+            ...artifacts,
+            resources: artifacts.resources.filter((artifact) => artifact.role !== 'singleton-owner'),
+        };
+        for (const { artifact, resource } of kroArtifactPlanToSupportingResources(nonSingletonArtifacts, {
+            readinessEvaluators: this.prerequisiteRuntimeReadinessEvaluators(),
+            resolveReadinessStrategy: resolvePortableReadinessStrategy,
+        })) {
+            if (artifact.role === 'singleton-owner') {
+                throw new TypeKroError(`Singleton artifact ${artifact.id} bypassed identity-only bundle lowering.`, 'KRO_SINGLETON_OWNER_ARTIFACT_INVALID', { artifactId: artifact.id });
+            }
+            const physicalId = kroBundleOperationId(resource);
+            operationIdByArtifactId.set(artifact.id, physicalId);
+            operations.push({
+                id: physicalId,
+                role: artifact.role,
+                sources: [source],
+                artifact,
+                manifest: lowerPlanValue(resource).value,
+                dependencies: [],
+            });
+        }
+        const rgdArtifact = artifacts.resources.find((artifact) => artifact.role === 'resource-graph-definition');
+        if (!rgdArtifact || rgdArtifact.role !== 'resource-graph-definition') {
+            throw new TypeKroError(`KRO plan ${artifacts.compiledArtifactDigest} has no RGD artifact.`, 'KRO_RGD_ARTIFACT_MISSING');
+        }
+        const rgdManifest = this.buildRgdManifest();
+        const rgdOperationId = kroBundleOperationId(rgdManifest);
+        operationIdByArtifactId.set(rgdArtifact.id, rgdOperationId);
+        operations.push({
+            id: rgdOperationId,
+            role: options.root ? 'resource-graph-definition' : 'singleton-owner-rgd',
+            sources: [source],
+            artifact: rgdArtifact,
+            manifest: lowerPlanValue(rgdManifest).value,
+            dependencies: [],
+        });
+        let instanceOperationId;
+        if (spec !== undefined) {
+            const instanceArtifact = artifacts.resources.find((artifact) => artifact.role === 'instance');
+            if (!instanceArtifact || instanceArtifact.role !== 'instance') {
+                throw new TypeKroError(`KRO plan ${artifacts.compiledArtifactDigest} has no instance artifact.`, 'KRO_INSTANCE_ARTIFACT_MISSING');
+            }
+            if (!instanceArtifact.identity) {
+                throw new TypeKroError(`KRO instance artifact ${instanceArtifact.id} has no physical identity.`, 'KRO_ARTIFACT_BUNDLE_IDENTITY_MISSING', { artifactId: instanceArtifact.id });
+            }
+            const instanceName = materializePlanValue(instanceArtifact.identity.name, {
+                sensitive: sensitiveBindings,
+            });
+            const instanceNamespace = instanceArtifact.identity.namespace
+                ? materializePlanValue(instanceArtifact.identity.namespace, {
+                    sensitive: sensitiveBindings,
+                })
+                : undefined;
+            if (typeof instanceName !== 'string' ||
+                (instanceNamespace !== undefined && typeof instanceNamespace !== 'string')) {
+                throw new TypeKroError(`KRO instance artifact ${instanceArtifact.id} has a non-concrete physical identity.`, 'KRO_ARTIFACT_BUNDLE_IDENTITY_MISSING', { artifactId: instanceArtifact.id, instanceName, instanceNamespace });
+            }
+            instanceOperationId = kroBundleOperationId({
+                apiVersion: instanceArtifact.identity.apiVersion,
+                kind: instanceArtifact.identity.kind,
+                metadata: {
+                    name: instanceName,
+                    ...(instanceNamespace ? { namespace: instanceNamespace } : {}),
+                },
+            });
+            operationIdByArtifactId.set(instanceArtifact.id, instanceOperationId);
+            operations.push({
+                id: instanceOperationId,
+                role: options.root ? 'instance' : 'singleton-owner-instance',
+                sources: [source],
+                artifact: instanceArtifact,
+                manifest: instanceArtifact.desired,
+                dependencies: [],
+            });
+        }
+        const dependencies = new Map();
+        for (const edge of artifacts.edges) {
+            let prerequisite;
+            let dependent;
+            switch (edge.kind) {
+                case 'output':
+                    prerequisite = operationIdByArtifactId.get(edge.producer);
+                    dependent = operationIdByArtifactId.get(edge.consumer);
+                    break;
+                case 'existence':
+                case 'ready':
+                    prerequisite = operationIdByArtifactId.get(edge.prerequisite);
+                    dependent = operationIdByArtifactId.get(edge.dependent);
+                    break;
+                case 'ownership':
+                    prerequisite = operationIdByArtifactId.get(edge.owner);
+                    dependent = operationIdByArtifactId.get(edge.child);
+                    break;
+                case 'delete-after':
+                    break;
+            }
+            if (!prerequisite || !dependent || prerequisite === dependent)
+                continue;
+            const incoming = dependencies.get(dependent) ?? new Set();
+            incoming.add(prerequisite);
+            dependencies.set(dependent, incoming);
+        }
+        return {
+            operations: mergeKroArtifactBundleOperations(operations.map((operation) => ({
+                ...operation,
+                dependencies: [
+                    ...new Set([
+                        ...operation.dependencies,
+                        ...(dependencies.get(operation.id) ?? new Set()),
+                    ]),
+                ],
+            }))),
+            requiredCapabilities: uniqueCapabilityRequirements(requiredCapabilities),
+            artifactRequirements: uniqueArtifactRequirements(artifactRequirements),
+            rgdOperationId,
+            ...(instanceOperationId ? { instanceOperationId } : {}),
+            sensitiveBindings,
+        };
+    }
+    /** Compile, canonicalize, and decode the complete KRO outer bundle. */
+    compiledKroArtifactBundle(spec, options = {}) {
+        const assembly = this.compileKroBundleAssembly(spec, {
+            memberId: 'root',
+            root: true,
+            ...options,
+            singletonStack: [],
+        });
+        if (!assembly)
+            return undefined;
+        const bundle = createKroArtifactBundle({
+            root: {
+                memberId: 'root',
+                rgdOperationId: assembly.rgdOperationId,
+                ...(assembly.instanceOperationId
+                    ? { instanceOperationId: assembly.instanceOperationId }
+                    : {}),
+            },
+            operations: assembly.operations,
+            requiredCapabilities: assembly.requiredCapabilities,
+            artifactRequirements: assembly.artifactRequirements,
+        });
+        return {
+            bundle: decodeKroArtifactBundle(encodeKroArtifactBundle(bundle)),
+            sensitiveBindings: assembly.sensitiveBindings,
+        };
+    }
     /**
      * Idempotently create the factory's target namespace if it doesn't
      * exist. KRO does not auto-create the CR's containing namespace, and
@@ -320,13 +781,15 @@ export class KroResourceFactoryImpl {
      * tolerance — ignored if the namespace already exists so concurrent
      * callers don't collide.
      */
-    async ensureTargetNamespace(namespace = this.namespace) {
+    async ensureTargetNamespace(namespace = this.namespace, abortSignal) {
         try {
+            abortSignal?.throwIfAborted();
             const { createBunCompatibleKubernetesObjectApi } = await import('../kubernetes/bun-api-client.js');
             const k8sApi = createBunCompatibleKubernetesObjectApi(this.getKubeConfig());
             const waitForNamespaceDeletion = async () => {
                 const start = Date.now();
                 while (Date.now() - start < 120000) {
+                    abortSignal?.throwIfAborted();
                     try {
                         const existing = (await k8sApi.read({
                             apiVersion: 'v1',
@@ -345,7 +808,25 @@ export class KroResourceFactoryImpl {
                         }
                         throw pollError;
                     }
-                    await new Promise((resolve) => setTimeout(resolve, 1000));
+                    await new Promise((resolve, reject) => {
+                        if (!abortSignal) {
+                            setTimeout(resolve, 1000);
+                            return;
+                        }
+                        const onAbort = () => {
+                            clearTimeout(timeout);
+                            reject(abortSignal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+                        };
+                        const timeout = setTimeout(() => {
+                            abortSignal.removeEventListener('abort', onAbort);
+                            resolve();
+                        }, 1000);
+                        if (abortSignal.aborted) {
+                            onAbort();
+                            return;
+                        }
+                        abortSignal.addEventListener('abort', onAbort, { once: true });
+                    });
                 }
                 throw new Error(`Namespace ${namespace} is still terminating after 120000ms`);
             };
@@ -559,20 +1040,40 @@ export class KroResourceFactoryImpl {
      * Deploy a new instance by creating a custom resource
      */
     async deploy(spec, opts) {
+        if (opts?.operationSignal) {
+            return this.deployWithinOperation(spec, opts, opts.operationSignal);
+        }
+        return runStandaloneOperation((abortSignal) => this.deployWithinOperation(spec, { ...opts, operationSignal: abortSignal }, abortSignal), { abortSignals: [this.factoryOptions.abortSignal, opts?.abortSignal] });
+    }
+    async deployWithinOperation(spec, opts, abortSignal) {
         if (opts?.targetScopes !== undefined) {
             throw new TypeKroError('Scope-targeted deployment is not supported in KRO mode. KRO manages resource lifecycle via its own controller. Use direct mode for scope-targeted deploys.', 'UNSUPPORTED_OPTION', { targetScopes: opts.targetScopes, mode: 'kro' });
         }
+        this.assertNoReservedKroSpecField(spec);
         // Validate spec against ArkType schema
         validateSpec(spec, this.schemaDefinition, {
             kind: this.schemaDefinition.kind,
             name: this.name,
         });
         this.assertInstanceNamespaceOwnershipSafe(spec);
-        this.assertSingletonOwnersNamespaceOwnershipSafe(spec);
-        // Execute closures before RGD creation (Kro mode requirement)
-        await this.executeClosuresBeforeRGD(spec);
-        await this.ensureSingletonOwners(spec);
-        return this.deployDirect(spec, opts?.instanceNameOverride, opts?.singletonSpecFingerprint);
+        const compiledBundle = this.compiledKroArtifactBundle(spec, {
+            ...(opts?.instanceNameOverride ? { instanceNameOverride: opts.instanceNameOverride } : {}),
+            ...(opts?.singletonSpecFingerprint
+                ? { singletonSpecFingerprint: opts.singletonSpecFingerprint }
+                : {}),
+        });
+        this.assertBundleCapabilities(compiledBundle?.bundle, {
+            host: 'standalone',
+            output: 'live',
+        });
+        // Execute compatibility closures only after the complete semantic bundle
+        // has passed host/output capability negotiation, but before RGD creation.
+        await this.executeClosuresBeforeRGD(spec, abortSignal);
+        if (compiledBundle) {
+            return this.deployKroArtifactBundle(compiledBundle.bundle, spec, compiledBundle.sensitiveBindings, abortSignal);
+        }
+        await this.ensureSingletonOwners(spec, abortSignal);
+        return this.deployDirect(spec, opts?.instanceNameOverride, opts?.singletonSpecFingerprint, abortSignal);
     }
     /**
      * Discover the singleton-owner definitions this composition depends on (deduped by key): from
@@ -596,6 +1097,58 @@ export class KroResourceFactoryImpl {
         }
         return Array.from(discovered.values());
     }
+    /**
+     * Recreate only the runtime member contexts needed to execute a decoded KRO
+     * bundle. Desired state and ordering remain authoritative in the bundle;
+     * these contexts provide existing operational hooks, clients, and status
+     * hydration for each compiled member.
+     */
+    collectKroBundleRuntimeMembers(spec) {
+        const rootFactory = this;
+        const members = new Map([
+            [
+                'root',
+                {
+                    memberId: 'root',
+                    factory: rootFactory,
+                    spec,
+                    consumers: [],
+                    dispose: false,
+                },
+            ],
+        ]);
+        const visit = (member, stack) => {
+            for (const definition of member.factory.discoverSingletonDefinitions(member.spec)) {
+                if (stack.includes(definition.key)) {
+                    throw new TypeKroError(`Singleton dependency cycle detected: ${[...stack, definition.key].join(' -> ')}`, 'KRO_SINGLETON_DEPENDENCY_CYCLE', { singletonKey: definition.key });
+                }
+                const memberId = `singleton:${definition.key}`;
+                const consumer = { factory: member.factory, definition };
+                const existing = members.get(memberId);
+                if (existing) {
+                    existing.consumers.push(consumer);
+                    continue;
+                }
+                const childFactory = member.factory.singletonFactoryFor(definition);
+                const child = {
+                    memberId,
+                    factory: childFactory,
+                    spec: definition.spec,
+                    definition,
+                    consumers: [consumer],
+                    dispose: true,
+                };
+                members.set(memberId, child);
+                visit(child, [...stack, definition.key]);
+            }
+        };
+        const root = members.get('root');
+        if (!root) {
+            throw new TypeKroError('KRO bundle runtime member collection lost the root member.', 'KRO_ARTIFACT_BUNDLE_MEMBER_MISSING');
+        }
+        visit(root, []);
+        return members;
+    }
     /** Build the KRO factory that owns a singleton's RGD + instance (its registry namespace). */
     singletonFactoryFor(definition) {
         return definition.composition.factory('kro', {
@@ -617,10 +1170,9 @@ export class KroResourceFactoryImpl {
                 : {}),
         });
     }
-    async ensureSingletonOwners(spec) {
+    async ensureSingletonOwners(spec, operationSignal) {
         for (const definition of this.discoverSingletonDefinitions(spec)) {
-            assertSingletonOwnerNamespaceOwnershipSafe(definition);
-            await this.ensureTargetNamespace(definition.registryNamespace);
+            await this.ensureTargetNamespace(definition.registryNamespace, operationSignal);
             const singletonInstanceName = getSingletonInstanceName(definition.id);
             const singletonFactory = this.singletonFactoryFor(definition);
             try {
@@ -629,11 +1181,12 @@ export class KroResourceFactoryImpl {
                     singletonKey: definition.key,
                     registryNamespace: definition.registryNamespace,
                 });
-                const existingInstances = await this.getSingletonOwnerInstancesForDriftCheck(singletonFactory, definition);
+                const existingInstances = await this.getSingletonOwnerInstancesForDriftCheck(singletonFactory, definition, operationSignal);
                 assertNoDeployedSingletonSpecDrift(definition, singletonInstanceName, existingInstances);
                 const singletonDeployOptions = {
                     instanceNameOverride: singletonInstanceName,
                     singletonSpecFingerprint: singletonSpecFingerprintAnnotationValue(definition.specFingerprint),
+                    ...(operationSignal ? { operationSignal } : {}),
                 };
                 const deployedSingleton = await singletonFactory.deploy(definition.spec, singletonDeployOptions);
                 const singletonStatus = deployedSingleton.status;
@@ -648,9 +1201,9 @@ export class KroResourceFactoryImpl {
             }
         }
     }
-    async getSingletonOwnerInstancesForDriftCheck(singletonFactory, definition) {
+    async getSingletonOwnerInstancesForDriftCheck(singletonFactory, definition, operationSignal) {
         try {
-            return await singletonFactory.getInstances();
+            return await singletonFactory.getInstances(operationSignal ? { operationSignal } : undefined);
         }
         catch (error) {
             if (this.isMissingSingletonOwnerCrdError(error)) {
@@ -680,7 +1233,7 @@ export class KroResourceFactoryImpl {
      * Execute closures before RGD creation (Kro mode requirement)
      * Closures must execute before ResourceGraphDefinition is created
      */
-    async executeClosuresBeforeRGD(_spec) {
+    async executeClosuresBeforeRGD(_spec, abortSignal) {
         if (Object.keys(this.closures).length === 0) {
             return []; // No closures to execute
         }
@@ -693,6 +1246,7 @@ export class KroResourceFactoryImpl {
         const mockDeploymentContext = {
             // kubernetesApi intentionally omitted - not needed for validation
             validationOnly: true,
+            ...(abortSignal ? { abortSignal } : {}),
             namespace: this.namespace,
             deployedResources: new Map(),
             resolveReference: async (ref) => {
@@ -701,6 +1255,7 @@ export class KroResourceFactoryImpl {
         };
         for (const [closureName, closure] of Object.entries(this.closures)) {
             try {
+                abortSignal?.throwIfAborted();
                 // Execute the deployment closure with mock context to trigger validation
                 await closure(mockDeploymentContext);
             }
@@ -721,6 +1276,7 @@ export class KroResourceFactoryImpl {
         const deploymentContext = {
             kubernetesApi: createBunCompatibleKubernetesObjectApi(kubeConfig),
             kubeConfig: kubeConfig,
+            ...(abortSignal ? { abortSignal } : {}),
             namespace: this.namespace,
             deployedResources: new Map(), // Empty for pre-RGD execution
             resolveReference: async (ref) => {
@@ -730,6 +1286,7 @@ export class KroResourceFactoryImpl {
         // Execute closures sequentially to maintain order
         for (const [closureName, closure] of Object.entries(this.closures)) {
             try {
+                abortSignal?.throwIfAborted();
                 this.logger.debug('Executing closure', { name: closureName });
                 // Note: We can't validate closure arguments here because we don't have access to them
                 // The validation happens inside the closure when it processes its config
@@ -762,13 +1319,222 @@ export class KroResourceFactoryImpl {
         });
         return allResults;
     }
+    assertBundleCapabilities(bundle, context) {
+        const compatibilityRequirements = bundle?.requiredCapabilities ??
+            (Object.keys(this.closures).length > 0
+                ? [
+                    {
+                        id: 'typekro.runtime-closure',
+                        version: 1,
+                        host: 'standalone',
+                        output: 'live',
+                    },
+                ]
+                : []);
+        assertAdapterCapabilitiesSupported(compatibilityRequirements, {
+            target: 'kro',
+            ...context,
+        });
+    }
+    materializeKroBundleRuntimeResource(operation, member, sensitiveBindings) {
+        const resource = materializeKroArtifactBundleOperation(operation, {
+            sensitive: sensitiveBindings,
+        });
+        Object.defineProperty(resource, 'id', {
+            value: operation.id,
+            configurable: true,
+            enumerable: false,
+        });
+        setResourceId(resource, operation.artifact.id);
+        if (operation.artifact.identity?.scope) {
+            setMetadataField(resource, 'scope', operation.artifact.identity.scope);
+        }
+        setMetadataField(resource, 'applyPolicy', operation.artifact.apply);
+        const strategy = operation.artifact.readiness.strategy;
+        if (strategy?.kind === 'runtime-binding') {
+            const evaluator = member.factory.prerequisiteRuntimeReadinessEvaluators()[strategy.binding];
+            if (!evaluator) {
+                throw new TypeKroError(`KRO readiness binding ${strategy.binding} is unavailable for operation ${operation.id}.`, 'KRO_ARTIFACT_READINESS_UNAVAILABLE', { operationId: operation.id, binding: strategy.binding });
+            }
+            setReadinessEvaluator(resource, evaluator);
+        }
+        else if (strategy?.kind === 'registered') {
+            const evaluator = resolvePortableReadinessStrategy(strategy);
+            if (!evaluator) {
+                throw new TypeKroError(`Registered readiness strategy ${strategy.id}@${strategy.revision} is unavailable.`, 'KRO_ARTIFACT_READINESS_UNAVAILABLE', { operationId: operation.id, strategy: strategy.id });
+            }
+            setReadinessEvaluator(resource, evaluator);
+        }
+        return resource;
+    }
+    /** Execute every directly managed KRO operation from one decoded artifact bundle. */
+    async deployKroArtifactBundle(bundle, spec, sensitiveBindings, abortSignal) {
+        const members = this.collectKroBundleRuntimeMembers(spec);
+        const childMembers = [...members.values()].filter((member) => member.dispose);
+        const deploymentEngine = new DirectDeploymentEngine(this.getKubeConfig(), undefined, undefined, DeploymentMode.KRO);
+        let rootResult;
+        const memberFor = (operation) => {
+            for (const source of operation.sources) {
+                const member = members.get(source.memberId);
+                if (member)
+                    return member;
+            }
+            throw new TypeKroError(`KRO bundle operation ${operation.id} has no runtime member context.`, 'KRO_ARTIFACT_BUNDLE_MEMBER_MISSING', { operationId: operation.id });
+        };
+        try {
+            abortSignal?.throwIfAborted();
+            // Preserve singleton operational checks and compatibility closures while
+            // taking desired state and ordering exclusively from the decoded bundle.
+            for (const member of childMembers) {
+                const definition = member.definition;
+                if (!definition) {
+                    throw new TypeKroError(`KRO bundle member ${member.memberId} has no singleton definition.`, 'KRO_ARTIFACT_BUNDLE_MEMBER_MISSING', { memberId: member.memberId });
+                }
+                await member.factory.ensureTargetNamespace(definition.registryNamespace, abortSignal);
+                const existing = await member.factory.getSingletonOwnerInstancesForDriftCheck(member.factory, definition, abortSignal);
+                assertNoDeployedSingletonSpecDrift(definition, getSingletonInstanceName(definition.id), existing);
+                await member.factory.executeClosuresBeforeRGD(member.spec, abortSignal);
+            }
+            // Fail closed on pre-hoist upgrades before mutating any RGD, then ensure
+            // every CR placement namespace not represented by a hoisted artifact.
+            for (const member of members.values()) {
+                abortSignal?.throwIfAborted();
+                const hoistedNames = bundle.operations
+                    .filter((operation) => operation.role === 'hoisted-namespace' &&
+                    operation.sources.some((source) => source.memberId === member.memberId))
+                    .map((operation) => materializeKroArtifactBundleOperation(operation, {
+                    sensitive: sensitiveBindings,
+                }).metadata.name)
+                    .filter((name) => typeof name === 'string');
+                await member.factory.assertNoPreHoistNamespaceConflict(hoistedNames);
+                const instanceOperation = bundle.operations.find((operation) => (operation.role === 'instance' || operation.role === 'singleton-owner-instance') &&
+                    operation.sources.some((source) => source.memberId === member.memberId));
+                if (instanceOperation) {
+                    const instance = materializeKroArtifactBundleOperation(instanceOperation, {
+                        sensitive: sensitiveBindings,
+                    });
+                    const namespace = instance.metadata.namespace ?? member.factory.namespace;
+                    if (!hoistedNames.includes(namespace)) {
+                        await member.factory.ensureTargetNamespace(namespace, abortSignal);
+                    }
+                }
+            }
+            for (const operation of orderKroArtifactBundleOperations(bundle)) {
+                abortSignal?.throwIfAborted();
+                const member = memberFor(operation);
+                const resource = this.materializeKroBundleRuntimeResource(operation, member, sensitiveBindings);
+                const namespace = resource.metadata.namespace ?? member.factory.namespace;
+                if (operation.role === 'kro-prerequisite') {
+                    const waitForReady = getReadinessEvaluator(resource) !== undefined;
+                    const deployable = waitForReady
+                        ? ensureReadinessEvaluator(resource)
+                        : resource;
+                    await deploymentEngine.deployResource(deployable, {
+                        mode: 'direct',
+                        namespace,
+                        waitForReady,
+                        timeout: member.factory.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT,
+                        ...(abortSignal ? { abortSignal } : {}),
+                    });
+                    const crdName = member.factory.prerequisiteCRDName(resource);
+                    if (crdName) {
+                        await deploymentEngine.waitForCRDReady(crdName, member.factory.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT, abortSignal);
+                    }
+                    continue;
+                }
+                if (operation.role === 'hoisted-namespace') {
+                    await member.factory.applyRetainedHoistedNamespace(resource, operation.artifact, abortSignal);
+                    continue;
+                }
+                if (operation.role === 'resource-graph-definition' ||
+                    operation.role === 'singleton-owner-rgd') {
+                    await member.factory.runKroPrerequisiteHook(deploymentEngine, undefined, abortSignal);
+                    await member.factory.addRgdSchemaStatusPruneMarkers(resource);
+                    const rgdFactory = member.factory.rgdProvider ??
+                        (await import('../../factories/kro/resource-graph-definition.js'))
+                            .resourceGraphDefinition;
+                    const enhanced = rgdFactory(resource);
+                    copyResourceMetadata(resource, enhanced);
+                    const deployable = {
+                        ...enhanced,
+                        id: operation.id,
+                    };
+                    copyResourceMetadata(enhanced, deployable);
+                    await deploymentEngine.deployResource(deployable, {
+                        mode: 'direct',
+                        namespace: member.factory.namespace,
+                        waitForReady: true,
+                        timeout: member.factory.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT,
+                        ...(abortSignal ? { abortSignal } : {}),
+                    });
+                    await member.factory.waitForCRDReadyWithEngine(deploymentEngine, abortSignal);
+                    continue;
+                }
+                const kroCustomResource = member.factory.kroCustomResourceProvider ??
+                    (await import('../../factories/kro/kro-custom-resource.js')).kroCustomResource;
+                const resourceName = resource.metadata.name;
+                if (typeof resourceName !== 'string' || resourceName.length === 0) {
+                    throw new TypeKroError(`KRO instance operation ${operation.id} has no concrete metadata.name.`, 'KRO_ARTIFACT_BUNDLE_IDENTITY_MISSING', { operationId: operation.id });
+                }
+                const enhanced = kroCustomResource({
+                    apiVersion: resource.apiVersion,
+                    kind: resource.kind,
+                    metadata: { ...resource.metadata, name: resourceName },
+                    spec: resource.spec,
+                });
+                copyResourceMetadata(resource, enhanced);
+                const deployable = {
+                    ...enhanced,
+                    id: operation.id,
+                    metadata: { ...enhanced.metadata, name: resourceName, namespace },
+                    spec: resource.spec,
+                };
+                copyResourceMetadata(enhanced, deployable);
+                const deployed = await deploymentEngine.deployResource(deployable, {
+                    mode: 'kro',
+                    namespace,
+                    waitForReady: false,
+                    timeout: member.factory.factoryOptions.timeout || DEFAULT_DEPLOYMENT_TIMEOUT,
+                    ...(abortSignal ? { abortSignal } : {}),
+                });
+                assertKroInstanceSpecPreserved(deployable, deployed.liveManifest ?? deployed.manifest);
+                const shouldWait = operation.role === 'singleton-owner-instance' ||
+                    (member.factory.factoryOptions.waitForReady ?? true);
+                if (shouldWait) {
+                    await member.factory.waitForKroInstanceReady(resourceName, member.factory.factoryOptions.timeout || DEFAULT_KRO_INSTANCE_TIMEOUT, namespace, abortSignal);
+                }
+                const result = await member.factory.createEnhancedProxy(member.spec, resourceName);
+                if (operation.role === 'instance') {
+                    rootResult = result;
+                }
+                else {
+                    const status = result.status;
+                    if (status && typeof status === 'object' && !Array.isArray(status)) {
+                        for (const consumer of member.consumers) {
+                            consumer.factory.singletonOwnerStatuses.set(getSingletonResourceId(consumer.definition.key), status);
+                        }
+                    }
+                }
+            }
+            if (!rootResult) {
+                throw new TypeKroError('KRO artifact bundle completed without producing the root instance.', 'KRO_ARTIFACT_BUNDLE_ROOT_RESULT_MISSING', { bundleDigest: bundle.bundleDigest });
+            }
+            return rootResult;
+        }
+        finally {
+            await deploymentEngine.dispose();
+            for (const member of childMembers.reverse()) {
+                await member.factory.dispose();
+            }
+        }
+    }
     /**
      * Deploy directly to Kubernetes using DirectDeploymentEngine
      */
-    async deployDirect(spec, instanceNameOverride, singletonSpecFingerprint) {
+    async deployDirect(spec, instanceNameOverride, singletonSpecFingerprint, abortSignal) {
         const instanceNamespace = this.resolveInstanceNamespace(spec);
         const instanceName = instanceNameOverride ?? generateInstanceName(spec, this.name);
-        const hoistedNamespaces = this.concreteHoistedNamespaces(spec);
+        const hoistedNamespaces = this.materializedHoistedNamespaces(spec);
         // FINDING #2: fail closed on a PRE-HOIST upgrade BEFORE touching the RGD. If a
         // namespace this factory now hoists is currently a KRO ApplySet member (a namespace
         // a pre-hoist RGD owned as a graph child), rolling the new hoisted RGD over the old
@@ -781,7 +1547,7 @@ export class KroResourceFactoryImpl {
         // owns a namespace and deleting the instance can never garbage-collect the
         // namespace holding its own finalizer. The hoist is STRUCTURAL, so the shared RGD
         // shape is the same for every instance (finding #4).
-        await this.ensureRGDDeployed(spec);
+        await this.ensureRGDDeployed(spec, abortSignal);
         // Ensure the namespace that will hold the CR exists before posting it. KRO
         // reconciles resources from the RGD into their own namespaces, but the CR
         // instance itself must live in a namespace the user can write to. If the
@@ -794,10 +1560,10 @@ export class KroResourceFactoryImpl {
         // (all labels incl. Pod Security + spec) plus retention markers; a non-hoisted
         // instance namespace just needs to exist.
         if (!hoistedNamespaces.has(instanceNamespace)) {
-            await this.ensureTargetNamespace(instanceNamespace);
+            await this.ensureTargetNamespace(instanceNamespace, abortSignal);
         }
-        for (const [name, original] of hoistedNamespaces) {
-            await this.applyRetainedHoistedNamespace(name, original, spec);
+        for (const { artifact, resource } of hoistedNamespaces.values()) {
+            await this.applyRetainedHoistedNamespace(resource, artifact, abortSignal);
         }
         // Create DirectDeploymentEngine with KRO mode for CEL string conversion
         const deploymentEngine = new DirectDeploymentEngine(this.getKubeConfig(), undefined, undefined, DeploymentMode.KRO);
@@ -830,19 +1596,21 @@ export class KroResourceFactoryImpl {
         // Deploy without waiting for readiness - we'll handle that ourselves
         this.logger.info('Deploying Kro instance', { instanceName, rgdName: this.rgdName });
         try {
-            await deploymentEngine.deployResource(deployableResource, {
+            const deployed = await deploymentEngine.deployResource(deployableResource, {
                 mode: 'kro',
                 namespace: instanceNamespace,
                 waitForReady: false, // We'll handle Kro-specific readiness ourselves
                 timeout: this.factoryOptions.timeout || DEFAULT_DEPLOYMENT_TIMEOUT,
+                ...(abortSignal ? { abortSignal } : {}),
             });
+            assertKroInstanceSpecPreserved(deployableResource, deployed.liveManifest ?? deployed.manifest);
             this.logger.info('Instance deployed, checking readiness', {
                 instanceName,
                 rgdName: this.rgdName,
             });
             // Handle Kro-specific readiness checking if requested
             if (this.factoryOptions.waitForReady ?? true) {
-                await this.waitForKroInstanceReady(instanceName, this.factoryOptions.timeout || DEFAULT_KRO_INSTANCE_TIMEOUT, instanceNamespace); // 10 minutes
+                await this.waitForKroInstanceReady(instanceName, this.factoryOptions.timeout || DEFAULT_KRO_INSTANCE_TIMEOUT, instanceNamespace, abortSignal); // 10 minutes
             }
             this.logger.info('Instance ready, creating enhanced proxy', {
                 instanceName,
@@ -867,23 +1635,41 @@ export class KroResourceFactoryImpl {
      * silently degrading to a bare `ensureTargetNamespace` that would drop Pod
      * Security + other declared configuration.
      */
-    async applyRetainedHoistedNamespace(name, original, spec) {
-        const merged = KroResourceFactoryImpl.mergedHoistedNamespaceMetadata(name, original, spec);
+    async applyRetainedHoistedNamespace(resource, artifact, abortSignal) {
+        abortSignal?.throwIfAborted();
+        const name = String(resource.metadata.name);
+        const annotations = Object.fromEntries(Object.entries(resource.metadata.annotations ?? {}).map(([key, value]) => [
+            key,
+            String(value),
+        ]));
+        const applyPolicy = artifact?.apply ?? {
+            strategy: 'server-side-apply',
+            fieldManager: 'typekro',
+            fieldConflictPolicy: 'force-owned-fields',
+            immutableFieldPolicy: 'fail',
+        };
+        if (applyPolicy.strategy !== 'server-side-apply') {
+            throw new TypeKroError(`Hoisted Namespace artifact ${artifact?.id ?? name} requires server-side apply.`, 'INVALID_ARTIFACT_APPLY_POLICY', { artifactId: artifact?.id ?? name, strategy: applyPolicy.strategy });
+        }
         const k8sApi = createBunCompatibleKubernetesObjectApi(this.getKubeConfig());
         const baseMetadata = {
-            name: merged.name,
-            labels: merged.labels,
-            ...(merged.finalizers !== undefined ? { finalizers: merged.finalizers } : {}),
-            ...(merged.ownerReferences !== undefined ? { ownerReferences: merged.ownerReferences } : {}),
+            name,
+            ...(resource.metadata.labels !== undefined ? { labels: resource.metadata.labels } : {}),
+            ...(resource.metadata.finalizers !== undefined
+                ? { finalizers: resource.metadata.finalizers }
+                : {}),
+            ...(resource.metadata.ownerReferences !== undefined
+                ? { ownerReferences: resource.metadata.ownerReferences }
+                : {}),
         };
-        const buildManifest = (annotations) => ({
+        const buildManifest = (manifestAnnotations) => ({
             apiVersion: 'v1',
             kind: 'Namespace',
-            metadata: { ...baseMetadata, annotations },
-            ...(merged.spec !== undefined ? { spec: merged.spec } : {}),
+            metadata: { ...baseMetadata, annotations: manifestAnnotations },
+            ...(resource.spec !== undefined ? { spec: resource.spec } : {}),
         });
         const annotationsWithStamp = {
-            ...merged.annotations,
+            ...annotations,
             [NAMESPACE_OWNER_ANNOTATION]: this.rgdName,
         };
         // CREATE-FIRST ownership (finding #3): attempt to CREATE the namespace WITH the
@@ -895,6 +1681,7 @@ export class KroResourceFactoryImpl {
         let decision;
         try {
             decision = await decideNamespaceOwnershipCreateFirst(k8sApi, buildManifest(annotationsWithStamp), this.rgdName);
+            abortSignal?.throwIfAborted();
         }
         catch (error) {
             // A non-conflict CREATE failure (or a failed conflict-read) — do NOT fall back to a
@@ -907,11 +1694,9 @@ export class KroResourceFactoryImpl {
             return;
         // 409: the namespace already existed. Apply the retained config via SSA, keeping the
         // ownership stamp ONLY if we already own it (adoption must NOT be stamped).
-        const annotations = decision.owned ? annotationsWithStamp : merged.annotations;
+        const appliedAnnotations = decision.owned ? annotationsWithStamp : annotations;
         try {
-            await k8sApi.patch(buildManifest(annotations), undefined, undefined, 'typekro', // fieldManager — typekro's, NOT kro's
-            true, // force (own the retention fields)
-            'application/apply-patch+yaml' // server-side apply
+            await k8sApi.patch(buildManifest(appliedAnnotations), undefined, undefined, applyPolicy.fieldManager, applyPolicy.fieldConflictPolicy === 'force-owned-fields', 'application/apply-patch+yaml' // server-side apply
             );
         }
         catch (error) {
@@ -1114,7 +1899,16 @@ export class KroResourceFactoryImpl {
     /**
      * Get all deployed instances
      */
-    async getInstances() {
+    async getInstances(opts) {
+        if (opts?.operationSignal) {
+            return this.getInstancesWithinOperation(opts.operationSignal);
+        }
+        return runStandaloneOperation((abortSignal) => this.getInstancesWithinOperation(abortSignal), {
+            abortSignals: [this.factoryOptions.abortSignal, opts?.abortSignal],
+        });
+    }
+    async getInstancesWithinOperation(abortSignal) {
+        abortSignal.throwIfAborted();
         const customApi = await this.createCustomObjectsApi();
         try {
             const version = this.getSchemaVersion();
@@ -1128,6 +1922,7 @@ export class KroResourceFactoryImpl {
             if (!this.discoveredPlural) {
                 this.discoveredPlural = await this.lookupCRDPlural();
             }
+            abortSignal.throwIfAborted();
             const plural = this.discoveredPlural ?? pluralizeKind(this.schemaDefinition.kind);
             // The instance CR lives in the namespace {@link resolveInstanceNamespace}
             // resolves to — the SAME shared resolver `deploy()`/`toYaml()` use, so a
@@ -1140,9 +1935,11 @@ export class KroResourceFactoryImpl {
                 namespace: this.resolveInstanceNamespace(),
                 plural,
             });
+            abortSignal.throwIfAborted();
             const listResult = listResponse;
             const instances = listResult.items || [];
             return await Promise.all(instances.map(async (instance) => {
+                abortSignal.throwIfAborted();
                 const enhanced = await this.createEnhancedProxy(instance.spec, instance.metadata?.name || 'unknown');
                 if (instance.metadata?.annotations) {
                     const mutableEnhanced = enhanced;
@@ -1162,6 +1959,7 @@ export class KroResourceFactoryImpl {
             }));
         }
         catch (error) {
+            abortSignal.throwIfAborted();
             const k8sError = error;
             // If the CRD doesn't exist yet or there are no instances, return empty array
             const bodyString = typeof k8sError.body === 'string' ? k8sError.body : JSON.stringify(k8sError.body || '');
@@ -1206,6 +2004,11 @@ export class KroResourceFactoryImpl {
      * Delete a specific instance by name
      */
     async deleteInstance(name, opts) {
+        return runStandaloneOperation((abortSignal) => this.deleteInstanceWithinOperation(name, opts, abortSignal), { abortSignals: [this.factoryOptions.abortSignal, opts?.abortSignal] });
+    }
+    async deleteInstanceWithinOperation(name, opts, abortSignal) {
+        const deletion = createDeletionResultState('kro', this.name, name);
+        abortSignal.throwIfAborted();
         if (opts?.scopes?.length) {
             throw new TypeKroError('Scope-filtered deletion is not supported in KRO mode. KRO manages resource lifecycle via its own controller. Use direct mode for scope-filtered deletes.', 'UNSUPPORTED_OPTION', { scopes: opts.scopes, instanceName: name, mode: 'kro' });
         }
@@ -1215,7 +2018,7 @@ export class KroResourceFactoryImpl {
         // and THROWS DeploymentTimeoutError on timeout — never a silent return that lets a
         // later step run behind a still-Terminating resource.
         const rollback = createRollbackManager(k8sApi);
-        const timeout = this.factoryOptions.timeout ?? 300000;
+        const timeout = opts?.timeout ?? this.factoryOptions.timeout ?? 300000;
         const apiVersion = this.getInstanceApiVersion();
         let definitionsAlreadyAbsent = false;
         try {
@@ -1231,6 +2034,7 @@ export class KroResourceFactoryImpl {
         // SAME shared resolver `deploy()` created it with (finding #2), so we never look in
         // the wrong namespace and mistake a 404 there for "already gone".
         const instanceNamespace = this.resolveInstanceNamespace();
+        const instanceTarget = deletionTarget(apiVersion, this.schemaDefinition.kind, name, instanceNamespace);
         // Capture the CR's durable RECORD of which namespaces THIS instance hoisted BEFORE
         // deleting it (finding #4). deleteInstance has no caller spec, so the live CR is the
         // only source of the declared set. PREFER the recorded `typekro.io/hoisted-namespaces`
@@ -1265,31 +2069,53 @@ export class KroResourceFactoryImpl {
             : crSpec
                 ? [...this.concreteHoistedNamespaces(crSpec).keys()]
                 : [];
-        // 1. Delete the CR and GATE on its 404 — KRO cleared `kro.run/finalizer` after
-        // graph-deleting every child (findings #1 + #2). On timeout the gate THROWS, so we
-        // NEVER proceed to delete the RGD while KRO is mid-finalizer (which would orphan
-        // cleanup). A pre-existing 404 on delete is treated as already-deleted.
-        let instanceDeleted = false;
-        try {
-            if (!definitionsAlreadyAbsent) {
-                await rollback.deleteResourceAndWait({ apiVersion, kind: this.schemaDefinition.kind, name, namespace: instanceNamespace }, { timeout });
+        const permanentlyRetainedOwnedNamespaces = new Set();
+        let graphMayHaveDrainingDescendants = false;
+        const deleteOwnedNamespace = async (namespace) => {
+            const target = deletionTarget('v1', 'Namespace', namespace);
+            try {
+                const outcome = await deleteNamespaceIfEmpty(this.getKubeConfig(), namespace, {
+                    logger: this.logger,
+                    k8sApi,
+                    ownedByRgd: this.rgdName,
+                    timeoutMs: timeout,
+                    abortSignal,
+                    context: { rgdName: this.rgdName },
+                });
+                recordNamespaceDeletionOutcome(deletion, namespace, outcome);
+                if (outcome.status === 'retained' &&
+                    outcome.cause === 'occupied' &&
+                    !graphMayHaveDrainingDescendants) {
+                    permanentlyRetainedOwnedNamespaces.add(namespace);
+                }
+                return undefined;
             }
-            instanceDeleted = true;
-        }
-        catch (error) {
-            if (error instanceof DeploymentTimeoutError) {
-                // KRO is still processing the finalizer. The RGD/CRD/namespace are LEFT ALONE
-                // (we throw before reaching them) so KRO can finish cleanup in the background.
-                throw new CRDInstanceError(`KRO instance ${name} deletion did not complete within ${timeout}ms`, this.schemaDefinition.apiVersion, this.schemaDefinition.kind, name, 'deletion', ensureError(error));
+            catch (error) {
+                if (abortSignal.aborted)
+                    throw abortSignal.reason ?? error;
+                let live = target;
+                try {
+                    live = (await readDeletionResourceIdentity(k8sApi, target)) ?? target;
+                }
+                catch (readError) {
+                    deletion.blockers.push({
+                        code: 'CLEANUP_ERROR',
+                        message: `Namespace cleanup failed and blocker inspection also failed: ${ensureError(readError).message}`,
+                        resource: target,
+                        retryable: true,
+                        retryGuidance: 'Restore Kubernetes API access, then retry the deletion operation.',
+                    });
+                }
+                deletion.remaining.push(live);
+                deletion.blockers.push(blockerForRemainingResource(live, `Namespace ${namespace} did not complete deletion: ${ensureError(error).message}`));
+                return finishDeletionResult(deletion, live.deletionTimestamp ? 'progressing' : 'blocked', {
+                    safe: true,
+                    afterMs: 2_000,
+                    guidance: 'Retry after the listed namespace finalizers or occupants have drained; the RGD and generated CRD were retained.',
+                });
             }
-            throw new CRDInstanceError(`Failed to delete instance ${name}: ${ensureError(error).message}`, this.schemaDefinition.apiVersion, this.schemaDefinition.kind, name, 'deletion', ensureError(error));
-        }
-        // KRO's owner CR reaching 404 proves that its finalizer issued child
-        // deletions; it does not prove that controller-owned child finalizers have
-        // completed. Gate on every concrete owned child before touching the RGD or
-        // reporting successful cleanup. External refs and hoisted Namespaces are
-        // deliberately excluded: this instance never owns the former and TypeKro
-        // tears down the latter in the namespace phase below.
+        };
+        const childTargets = [];
         if (crSpec) {
             const compositionFn = this.factoryOptions.compositionFn;
             const ownedChildren = concreteActiveOwnedResources({
@@ -1298,14 +2124,22 @@ export class KroResourceFactoryImpl {
                 resources: this.resources,
                 ...(compositionFn ? { compositionFn } : {}),
             });
-            const childTargets = [];
             for (const [resourceId, resource] of ownedChildren) {
                 if (resource.kind === 'Namespace')
                     continue;
                 const childName = resolveNamespaceName(resource.metadata?.name, crSpec);
                 const childNamespace = resolveNamespaceName(resource.metadata?.namespace, crSpec);
                 if (!childName) {
-                    throw new CRDInstanceError(`Cannot prove KRO child cleanup: resource ${resourceId} (${resource.kind}) has an unresolved concrete name`, this.schemaDefinition.apiVersion, this.schemaDefinition.kind, name, 'deletion');
+                    deletion.blockers.push({
+                        code: 'OWNERSHIP_UNPROVEN',
+                        message: `Cannot prove KRO child cleanup: resource ${resourceId} (${resource.kind}) has an unresolved concrete name.`,
+                        retryable: false,
+                        retryGuidance: 'Give every KRO-owned child a concretely resolvable metadata.name so TypeKro can prove teardown completion.',
+                    });
+                    return finishDeletionResult(deletion, 'blocked', {
+                        safe: false,
+                        guidance: 'Correct the unresolved child identity before retrying; the instance was retained.',
+                    });
                 }
                 childTargets.push({
                     apiVersion: resource.apiVersion,
@@ -1314,11 +2148,154 @@ export class KroResourceFactoryImpl {
                     ...(childNamespace ? { namespace: childNamespace } : {}),
                 });
             }
+            graphMayHaveDrainingDescendants = childTargets.some((target) => DESCENDANT_PRODUCING_KINDS.has(target.kind));
+        }
+        let capturedDescendants = [];
+        try {
+            capturedDescendants = await captureKnownControllerDescendants(k8sApi, childTargets, instanceNamespace);
+        }
+        catch (error) {
+            deletion.blockers.push({
+                code: 'DISCOVERY_FAILED',
+                message: `Cannot capture KRO-owned controller descendants before deletion: ${ensureError(error).message}`,
+                retryable: true,
+                retryGuidance: 'Restore read/list access to KRO-owned children and their dependents, then retry deletion.',
+            });
+            return finishDeletionResult(deletion, 'blocked', {
+                safe: true,
+                guidance: 'TypeKro retained the instance because descendant ownership could not be proven safely.',
+            });
+        }
+        // 1. Delete the CR and GATE on its 404 — KRO cleared `kro.run/finalizer` after
+        // graph-deleting every child (findings #1 + #2). On timeout the gate THROWS, so we
+        // NEVER proceed to delete the RGD while KRO is mid-finalizer (which would orphan
+        // cleanup). A pre-existing 404 on delete is treated as already-deleted.
+        let instanceDeleted = false;
+        try {
+            if (!definitionsAlreadyAbsent) {
+                await rollback.deleteResourceAndWait({ apiVersion, kind: this.schemaDefinition.kind, name, namespace: instanceNamespace }, { timeout, abortSignal });
+            }
+            instanceDeleted = true;
+            deletion.deleted.push(instanceTarget);
+        }
+        catch (error) {
+            if (abortSignal.aborted)
+                throw abortSignal.reason ?? error;
+            if (error instanceof DeploymentTimeoutError) {
+                // KRO is still processing the finalizer. The RGD/CRD/namespace are LEFT ALONE
+                // so KRO can finish cleanup in the background, and the caller receives the exact
+                // live finalizer/owner state instead of a success-shaped void return.
+                let live = instanceTarget;
+                try {
+                    live = (await readDeletionResourceIdentity(k8sApi, instanceTarget)) ?? instanceTarget;
+                }
+                catch (readError) {
+                    deletion.blockers.push({
+                        code: 'CLEANUP_ERROR',
+                        message: `KRO instance deletion timed out and its live blocker state could not be read: ${ensureError(readError).message}`,
+                        resource: instanceTarget,
+                        retryable: true,
+                        retryGuidance: 'Retry when the Kubernetes API is readable; keep the RGD installed so KRO can continue finalizer processing.',
+                    });
+                }
+                deletion.remaining.push(live);
+                deletion.blockers.push(blockerForRemainingResource(live, `KRO instance ${name} deletion did not complete within ${timeout}ms.`));
+                return finishDeletionResult(deletion, live.deletionTimestamp ? 'progressing' : 'blocked', {
+                    safe: true,
+                    afterMs: 2_000,
+                    guidance: 'Retry deletion after KRO and the listed owners have had time to clear the remaining finalizers.',
+                });
+            }
+            deletion.remaining.push(instanceTarget);
+            deletion.blockers.push({
+                code: 'CLEANUP_ERROR',
+                message: `Failed to delete instance ${name}: ${ensureError(error).message}`,
+                resource: instanceTarget,
+                retryable: true,
+                retryGuidance: 'Resolve the reported Kubernetes API error, then retry. TypeKro has preserved the RGD and generated CRD.',
+            });
+            return finishDeletionResult(deletion, 'blocked', {
+                safe: true,
+                guidance: 'Retry after resolving the reported Kubernetes API error.',
+            });
+        }
+        // KRO's owner CR reaching 404 proves that its finalizer issued child
+        // deletions; it does not prove that controller-owned child finalizers have
+        // completed. Gate on every concrete owned child before touching the RGD or
+        // reporting successful cleanup. External refs and hoisted Namespaces are
+        // deliberately excluded: this instance never owns the former and TypeKro
+        // tears down the latter in the namespace phase below.
+        if (childTargets.length > 0) {
             try {
-                await Promise.all(childTargets.map((target) => rollback.waitForResourceGone(target, { timeout })));
+                await Promise.all(childTargets.map((target) => rollback.waitForResourceGone(target, { timeout, abortSignal })));
+                deletion.deleted.push(...childTargets.map((target) => deletionTarget(target.apiVersion, target.kind, target.name, target.namespace)));
             }
             catch (error) {
-                throw new CRDInstanceError(`KRO instance ${name} disappeared but one or more owned children did not finish deleting within ${timeout}ms`, this.schemaDefinition.apiVersion, this.schemaDefinition.kind, name, 'deletion', ensureError(error));
+                if (abortSignal.aborted)
+                    throw abortSignal.reason ?? error;
+                for (const target of childTargets) {
+                    const identity = deletionTarget(target.apiVersion, target.kind, target.name, target.namespace);
+                    try {
+                        const live = await readDeletionResourceIdentity(k8sApi, identity);
+                        if (!live) {
+                            deletion.deleted.push(identity);
+                            continue;
+                        }
+                        deletion.remaining.push(live);
+                        deletion.blockers.push(blockerForRemainingResource(live));
+                    }
+                    catch (readError) {
+                        deletion.remaining.push(identity);
+                        deletion.blockers.push({
+                            code: 'CLEANUP_ERROR',
+                            message: `Could not inspect remaining child ${target.kind}/${target.name}: ${ensureError(readError).message}`,
+                            resource: identity,
+                            retryable: true,
+                            retryGuidance: 'Retry after the Kubernetes API is readable; TypeKro retained the RGD and generated CRD.',
+                        });
+                    }
+                }
+                const progressing = deletion.remaining.length > 0 &&
+                    deletion.remaining.every((resource) => resource.deletionTimestamp !== undefined);
+                return finishDeletionResult(deletion, progressing ? 'progressing' : 'blocked', {
+                    safe: true,
+                    afterMs: 2_000,
+                    guidance: 'Retry after the listed child resources and finalizers have drained; TypeKro retained the RGD and generated CRD.',
+                });
+            }
+        }
+        // KRO 0.9 can remove a completed Job before Kubernetes garbage collection
+        // removes its Pod. Delete only the dependents captured before instance
+        // deletion whose controller UID matched the KRO-owned Job exactly.
+        for (const descendant of capturedDescendants) {
+            const identity = deletionTarget(descendant.apiVersion, descendant.kind, descendant.name, descendant.namespace);
+            try {
+                await rollback.deleteResourceAndWait(identity, { timeout, abortSignal });
+                deletion.deleted.push(identity);
+            }
+            catch (error) {
+                if (abortSignal.aborted)
+                    throw abortSignal.reason ?? error;
+                let live = identity;
+                try {
+                    live = (await readDeletionResourceIdentity(k8sApi, identity)) ?? identity;
+                }
+                catch (readError) {
+                    deletion.blockers.push({
+                        code: 'CLEANUP_ERROR',
+                        message: `Could not inspect captured descendant ${descendant.kind}/${descendant.name}: ${ensureError(readError).message}`,
+                        resource: identity,
+                        retryable: true,
+                        retryGuidance: 'Restore Kubernetes API access, then retry deletion.',
+                    });
+                }
+                deletion.remaining.push(live);
+                deletion.blockers.push(blockerForRemainingResource(live, `${descendant.kind}/${descendant.name}, owned by ${descendant.owner.kind}/${descendant.owner.name} (${descendant.owner.uid}), did not complete deletion: ${ensureError(error).message}`));
+                return finishDeletionResult(deletion, live.deletionTimestamp ? 'progressing' : 'blocked', {
+                    safe: true,
+                    afterMs: 2_000,
+                    guidance: 'Retry after the listed controller-owned descendants and finalizers have drained.',
+                });
             }
         }
         // 2. LIST REMAINING INSTANCES FIRST — BEFORE deleting any namespace (finding #2, v7).
@@ -1334,10 +2311,37 @@ export class KroResourceFactoryImpl {
         let remainingItems;
         try {
             remainingItems = definitionsAlreadyAbsent ? [] : await this.listInstancesForCleanup();
+            abortSignal.throwIfAborted();
         }
         catch (listError) {
+            const reason = `Cannot list KRO instances to prove shared ownership: ${ensureError(listError).message}`;
             this.logger.warn('Cannot list instances — preserving ALL namespaces + the RGD/CRD (fail closed; retry to complete)', { rgdName: this.rgdName, error: ensureError(listError).message });
-            return;
+            const rgd = deletionTarget('kro.run/v1alpha1', 'ResourceGraphDefinition', this.rgdName);
+            deletion.retained.push({
+                resource: rgd,
+                policy: 'safety-proof-unavailable',
+                reason,
+            });
+            for (const namespace of declaredHoistedNamespaceNames) {
+                const resource = deletionTarget('v1', 'Namespace', namespace);
+                deletion.retained.push({
+                    resource,
+                    policy: 'safety-proof-unavailable',
+                    reason,
+                });
+                deletion.remaining.push(resource);
+            }
+            deletion.blockers.push({
+                code: 'DISCOVERY_FAILED',
+                message: reason,
+                resource: rgd,
+                retryable: true,
+                retryGuidance: 'Restore cluster-wide list access for the generated custom resource, then retry deletion.',
+            });
+            return finishDeletionResult(deletion, 'blocked', {
+                safe: true,
+                guidance: 'Retry after cluster-wide instance discovery is available; TypeKro retained shared resources fail-closed.',
+            });
         }
         // The decision to keep the RGD is a pure function of (listed instances, target name,
         // instanceDeleted flag) — see {@link shouldPreserveRgd} for the rules.
@@ -1388,36 +2392,72 @@ export class KroResourceFactoryImpl {
                     preserved.add(ns);
             }
             if (!allRemainingResolvable) {
+                const reason = 'A remaining KRO instance has no valid hoisted-namespace ownership record, so shared namespace safety cannot be proven.';
                 this.logger.warn("A remaining instance has no resolvable namespace record — preserving ALL of this instance's " +
                     'namespaces (fail closed) to avoid deleting one a remaining instance shares', { rgdName: this.rgdName, instance: name });
+                for (const ns of declaredHoistedNamespaceNames) {
+                    const resource = deletionTarget('v1', 'Namespace', ns);
+                    deletion.retained.push({
+                        resource,
+                        policy: 'safety-proof-unavailable',
+                        reason,
+                    });
+                    deletion.remaining.push(resource);
+                }
+                deletion.blockers.push({
+                    code: 'OWNERSHIP_UNPROVEN',
+                    message: reason,
+                    retryable: true,
+                    retryGuidance: 'Repair or migrate the remaining instance hoisted-namespace annotation, then retry deletion.',
+                });
             }
             else {
                 for (const ns of declaredHoistedNamespaceNames) {
+                    abortSignal.throwIfAborted();
                     if (preserved.has(ns)) {
                         this.logger.debug('Namespace recorded by a remaining instance — preserving', {
                             namespace: ns,
                             rgdName: this.rgdName,
                         });
+                        deletion.retained.push({
+                            resource: deletionTarget('v1', 'Namespace', ns),
+                            policy: 'shared-instance',
+                            reason: 'A remaining KRO instance records this namespace as shared state.',
+                        });
                         continue;
                     }
-                    await deleteNamespaceIfEmpty(this.getKubeConfig(), ns, {
-                        logger: this.logger,
-                        // Reuse the SAME (mockable) object API so discovery/delete is unit-testable.
-                        k8sApi,
-                        ownedByRgd: this.rgdName,
-                        timeoutMs: timeout,
-                        context: { rgdName: this.rgdName },
-                    });
+                    const incomplete = await deleteOwnedNamespace(ns);
+                    if (incomplete)
+                        return incomplete;
                 }
             }
         }
         // Only delete the RGD and CRD if no other instances remain. Multiple instances can share
         // one RGD — deleting it would break the others.
         if (hasRemainingInstances) {
+            const rgd = deletionTarget('kro.run/v1alpha1', 'ResourceGraphDefinition', this.rgdName);
+            deletion.retained.push({
+                resource: rgd,
+                policy: 'shared-instance',
+                reason: 'Other KRO instances still depend on this ResourceGraphDefinition.',
+            });
+            if (this.discoveredPlural) {
+                deletion.retained.push({
+                    resource: deletionTarget('apiextensions.k8s.io/v1', 'CustomResourceDefinition', `${this.discoveredPlural}.${this.getSchemaGroup()}`),
+                    policy: 'generated-crd',
+                    reason: 'The generated CRD is retained while shared instances exist.',
+                });
+            }
             this.logger.debug('Skipping RGD/CRD deletion — other instances still exist', {
                 rgdName: this.rgdName,
             });
-            return;
+            const blocked = deletion.blockers.length > 0;
+            return finishDeletionResult(deletion, blocked ? 'blocked' : 'complete', {
+                safe: true,
+                guidance: blocked
+                    ? 'Retry after repairing the missing namespace ownership evidence.'
+                    : 'The requested instance is gone. Shared definitions and namespaces were retained intentionally.',
+            });
         }
         // 2b. RETRY-SAFE owned-namespace sweep (finding #2). The per-instance cleanup above
         // reads the names off the CR's `typekro.io/hoisted-namespaces` annotation — but that
@@ -1434,20 +2474,35 @@ export class KroResourceFactoryImpl {
             ownedNamespaces = await listNamespacesOwnedByRgd(this.getKubeConfig(), this.rgdName, {
                 k8sApi,
                 logger: this.logger,
+                abortSignal,
             });
         }
         catch (listError) {
+            const reason = `Cannot list namespaces owned by RGD ${this.rgdName}: ${ensureError(listError).message}`;
             this.logger.warn('Cannot list owned namespaces to confirm cleanup — preserving RGD/CRD (retry to complete)', { rgdName: this.rgdName, error: ensureError(listError).message });
-            return;
+            const rgd = deletionTarget('kro.run/v1alpha1', 'ResourceGraphDefinition', this.rgdName);
+            deletion.retained.push({
+                resource: rgd,
+                policy: 'safety-proof-unavailable',
+                reason,
+            });
+            deletion.blockers.push({
+                code: 'DISCOVERY_FAILED',
+                message: reason,
+                resource: rgd,
+                retryable: true,
+                retryGuidance: 'Restore Namespace list access and retry; TypeKro retained the RGD and generated CRD.',
+            });
+            return finishDeletionResult(deletion, 'blocked', {
+                safe: true,
+                guidance: 'Retry after Namespace ownership discovery is available.',
+            });
         }
         for (const ns of ownedNamespaces) {
-            await deleteNamespaceIfEmpty(this.getKubeConfig(), ns, {
-                logger: this.logger,
-                k8sApi,
-                ownedByRgd: this.rgdName,
-                timeoutMs: timeout,
-                context: { rgdName: this.rgdName },
-            });
+            abortSignal.throwIfAborted();
+            const incomplete = await deleteOwnedNamespace(ns);
+            if (incomplete)
+                return incomplete;
         }
         // 2c. CONFIRM owned-namespace cleanup BEFORE removing the definitions (finding #2): do
         // NOT delete the RGD/CRD while any owned namespace still exists or cannot be confirmed
@@ -1460,11 +2515,29 @@ export class KroResourceFactoryImpl {
             remainingOwned = await listNamespacesOwnedByRgd(this.getKubeConfig(), this.rgdName, {
                 k8sApi,
                 logger: this.logger,
+                abortSignal,
             });
         }
         catch (listError) {
+            const reason = `Cannot confirm cleanup of namespaces owned by RGD ${this.rgdName}: ${ensureError(listError).message}`;
             this.logger.warn('Cannot confirm owned-namespace cleanup — preserving RGD/CRD (retry to complete)', { rgdName: this.rgdName, error: ensureError(listError).message });
-            return;
+            const rgd = deletionTarget('kro.run/v1alpha1', 'ResourceGraphDefinition', this.rgdName);
+            deletion.retained.push({
+                resource: rgd,
+                policy: 'safety-proof-unavailable',
+                reason,
+            });
+            deletion.blockers.push({
+                code: 'DISCOVERY_FAILED',
+                message: reason,
+                resource: rgd,
+                retryable: true,
+                retryGuidance: 'Restore Namespace list access and retry; TypeKro retained the RGD and generated CRD.',
+            });
+            return finishDeletionResult(deletion, 'blocked', {
+                safe: true,
+                guidance: 'Retry after Namespace cleanup can be confirmed.',
+            });
         }
         // A graph child reaching 404 only proves its controller accepted deletion;
         // grandchildren such as Helm-managed Pods or Rook RGW Deployments may need
@@ -1473,40 +2546,126 @@ export class KroResourceFactoryImpl {
         // before returning the durable "preserved for retry" state. This prevents a
         // successful deleteInstance() from racing immediately into teardown of a
         // storage prerequisite while owned descendants are still draining.
-        if (crSpec && remainingOwned.length > 0) {
-            const drainDeadline = Date.now() + Math.min(timeout, 300_000);
-            while (remainingOwned.length > 0 && Date.now() < drainDeadline) {
-                await new Promise((resolve) => setTimeout(resolve, 2_000));
-                for (const ns of remainingOwned) {
-                    await deleteNamespaceIfEmpty(this.getKubeConfig(), ns, {
-                        logger: this.logger,
-                        k8sApi,
-                        ownedByRgd: this.rgdName,
-                        timeoutMs: Math.max(1, drainDeadline - Date.now()),
-                        context: { rgdName: this.rgdName },
-                    });
+        const namespacesStillDraining = () => remainingOwned.filter((namespace) => !permanentlyRetainedOwnedNamespaces.has(namespace));
+        if (crSpec && namespacesStillDraining().length > 0) {
+            const drainDeadline = Date.now() + Math.min(timeout, 60_000);
+            while (namespacesStillDraining().length > 0 && Date.now() < drainDeadline) {
+                await new Promise((resolve, reject) => {
+                    const onAbort = () => {
+                        clearTimeout(delay);
+                        reject(abortSignal.reason ?? new DOMException('The operation was aborted', 'AbortError'));
+                    };
+                    const delay = setTimeout(() => {
+                        abortSignal.removeEventListener('abort', onAbort);
+                        resolve();
+                    }, 2_000);
+                    if (abortSignal.aborted) {
+                        onAbort();
+                        return;
+                    }
+                    abortSignal.addEventListener('abort', onAbort, { once: true });
+                });
+                for (const ns of namespacesStillDraining()) {
+                    abortSignal.throwIfAborted();
+                    const incomplete = await deleteOwnedNamespace(ns);
+                    if (incomplete)
+                        return incomplete;
                 }
                 try {
                     remainingOwned = await listNamespacesOwnedByRgd(this.getKubeConfig(), this.rgdName, {
                         k8sApi,
                         logger: this.logger,
+                        abortSignal,
                     });
                 }
                 catch (listError) {
+                    const reason = `Cannot confirm descendant drain for namespaces owned by RGD ${this.rgdName}: ${ensureError(listError).message}`;
                     this.logger.warn('Cannot confirm owned-namespace descendant drain — preserving RGD/CRD for retry', { rgdName: this.rgdName, error: ensureError(listError).message });
-                    return;
+                    const rgd = deletionTarget('kro.run/v1alpha1', 'ResourceGraphDefinition', this.rgdName);
+                    deletion.retained.push({
+                        resource: rgd,
+                        policy: 'safety-proof-unavailable',
+                        reason,
+                    });
+                    deletion.blockers.push({
+                        code: 'DISCOVERY_FAILED',
+                        message: reason,
+                        resource: rgd,
+                        retryable: true,
+                        retryGuidance: 'Restore Namespace list access, then retry deletion.',
+                    });
+                    return finishDeletionResult(deletion, 'blocked', {
+                        safe: true,
+                        guidance: 'Retry after Namespace descendant cleanup can be confirmed.',
+                    });
                 }
             }
         }
         if (remainingOwned.length > 0) {
             this.logger.info('Owned namespace(s) still present after cleanup — preserving RGD/CRD until they are gone', { rgdName: this.rgdName, remaining: remainingOwned });
-            return;
+            for (const namespace of remainingOwned) {
+                const resource = deletionTarget('v1', 'Namespace', namespace);
+                if (!deletion.retained.some((entry) => entry.resource.kind === 'Namespace' && entry.resource.name === namespace)) {
+                    deletion.retained.push({
+                        resource,
+                        policy: 'occupied-namespace',
+                        reason: 'The namespace remains owned by this RGD but contains resources that TypeKro will not delete implicitly.',
+                    });
+                }
+            }
+            const rgd = deletionTarget('kro.run/v1alpha1', 'ResourceGraphDefinition', this.rgdName);
+            deletion.retained.push({
+                resource: rgd,
+                policy: deletion.blockers.length > 0 ? 'safety-proof-unavailable' : 'occupied-namespace',
+                reason: 'The RGD is retained while an owned namespace remains, preventing orphaned lifecycle state.',
+            });
+            if (this.discoveredPlural) {
+                deletion.retained.push({
+                    resource: deletionTarget('apiextensions.k8s.io/v1', 'CustomResourceDefinition', `${this.discoveredPlural}.${this.getSchemaGroup()}`),
+                    policy: 'generated-crd',
+                    reason: 'The generated CRD is retained Active while owned namespaces remain.',
+                });
+            }
+            return finishDeletionResult(deletion, deletion.blockers.length > 0 ? 'blocked' : 'complete', {
+                safe: true,
+                guidance: deletion.blockers.length > 0
+                    ? 'Resolve the listed discovery or ownership blockers, then retry.'
+                    : 'The instance graph is gone. Occupied or adopted namespaces and their definitions were retained explicitly.',
+            });
         }
         // 3. Delete the RGD and GATE on its 404 (findings #1 + #2). The RGD carries a KRO
         // finalizer; while KRO processes it, KRO's per-RGD dynamic controller is still
         // WATCHING the generated CRD's resources. Waiting for the RGD 404 first lets KRO
         // tear its controller down cleanly. The gate THROWS on timeout (no silent proceed).
-        await rollback.deleteResourceAndWait({ apiVersion: 'kro.run/v1alpha1', kind: 'ResourceGraphDefinition', name: this.rgdName }, { timeout });
+        const rgdTarget = deletionTarget('kro.run/v1alpha1', 'ResourceGraphDefinition', this.rgdName);
+        try {
+            await rollback.deleteResourceAndWait(rgdTarget, { timeout, abortSignal });
+            deletion.deleted.push(rgdTarget);
+        }
+        catch (error) {
+            if (abortSignal.aborted)
+                throw abortSignal.reason ?? error;
+            let live = rgdTarget;
+            try {
+                live = (await readDeletionResourceIdentity(k8sApi, rgdTarget)) ?? rgdTarget;
+            }
+            catch (readError) {
+                deletion.blockers.push({
+                    code: 'CLEANUP_ERROR',
+                    message: `RGD deletion failed and blocker inspection also failed: ${ensureError(readError).message}`,
+                    resource: rgdTarget,
+                    retryable: true,
+                    retryGuidance: 'Restore Kubernetes API access, then retry deletion.',
+                });
+            }
+            deletion.remaining.push(live);
+            deletion.blockers.push(blockerForRemainingResource(live, `ResourceGraphDefinition ${this.rgdName} did not complete deletion: ${ensureError(error).message}`));
+            return finishDeletionResult(deletion, live.deletionTimestamp ? 'progressing' : 'blocked', {
+                safe: true,
+                afterMs: 2_000,
+                guidance: 'Retry after KRO clears the listed RGD finalizers.',
+            });
+        }
         this.logger.debug('RGD deleted and fully gone', { rgdName: this.rgdName });
         // 4. RETAIN the generated CRD. This matches the Alchemy path and KRO's own
         // `allowCRDDeletion=false` default. Initiating a best-effort delete is not harmless:
@@ -1522,6 +2681,17 @@ export class KroResourceFactoryImpl {
                 ? { crdName: `${this.discoveredPlural}.${this.getSchemaGroup()}` }
                 : {}),
         });
+        if (this.discoveredPlural) {
+            deletion.retained.push({
+                resource: deletionTarget('apiextensions.k8s.io/v1', 'CustomResourceDefinition', `${this.discoveredPlural}.${this.getSchemaGroup()}`),
+                policy: 'generated-crd',
+                reason: 'Generated CRDs are retained Active by policy after the final instance is removed; administrative GC may delete them after proving they are unused.',
+            });
+        }
+        return finishDeletionResult(deletion, 'complete', {
+            safe: true,
+            guidance: 'The instance graph and RGD are gone. The generated CRD was retained Active under the documented zero-instance policy.',
+        });
     }
     /**
      * Emit this factory's KRO deployment as declarative alchemy **v2** resources — the v2
@@ -1545,6 +2715,7 @@ export class KroResourceFactoryImpl {
      */
     async toAlchemyResources(spec, opts) {
         this.assertNoKroPrerequisiteHookForDeclarative('toAlchemyResources()');
+        this.assertNoReservedKroSpecField(spec);
         validateSpec(spec, this.schemaDefinition, {
             kind: this.schemaDefinition.kind,
             name: this.name,
@@ -1552,6 +2723,32 @@ export class KroResourceFactoryImpl {
         this.assertInstanceNamespaceOwnershipSafe(spec);
         const instanceNamespace = this.resolveInstanceNamespace(spec);
         const kubeConfigOptions = this.extractKubeConfigOptionsForAlchemy();
+        const compiledBundle = this.compiledKroArtifactBundle(spec, opts);
+        if (compiledBundle) {
+            this.assertBundleCapabilities(compiledBundle.bundle, {
+                host: 'alchemy',
+                output: 'live',
+            });
+            const runtimeBindings = compiledBundle.bundle.operations.flatMap((operation) => {
+                const strategy = operation.artifact.readiness.strategy;
+                return strategy?.kind === 'runtime-binding'
+                    ? [
+                        {
+                            operationId: operation.id,
+                            binding: strategy.binding,
+                            classification: strategy.classification ?? {
+                                reason: 'unclassified-evaluator',
+                            },
+                        },
+                    ]
+                    : [];
+            });
+            if (runtimeBindings.length > 0) {
+                throw new TypeKroError('KRO Alchemy declarations cannot persist runtime-only readiness functions. Register a portable readiness strategy or use standalone deployment.', 'KRO_ALCHEMY_RUNTIME_BINDING_UNSUPPORTED', { runtimeBindings });
+            }
+            return this.alchemyDeclarationsFromKroArtifactBundle(compiledBundle.bundle, kubeConfigOptions, compiledBundle.sensitiveBindings);
+        }
+        this.assertBundleCapabilities(undefined, { host: 'alchemy', output: 'live' });
         const kroDeletion = this.createAlchemyKroDeletionOptions(instanceNamespace);
         const prerequisiteDeclarations = this.prerequisiteAlchemyDeclarations(kubeConfigOptions);
         const prerequisiteIds = prerequisiteDeclarations.map((decl) => decl.id);
@@ -1570,8 +2767,12 @@ export class KroResourceFactoryImpl {
         // occupies it (no cross-stack refcount needed).
         const instanceNamespaceDeclarations = [];
         const instanceNamespaceIds = [];
-        for (const [hoistedNs, original] of this.concreteHoistedNamespaces(spec)) {
-            const decl = this.hoistedNamespaceAlchemyDeclaration(hoistedNs, this.buildHoistedNamespaceResource(hoistedNs, original, spec), kubeConfigOptions, prerequisiteIds);
+        for (const [hoistedNs, { artifact, resource }] of this.materializedHoistedNamespaces(spec)) {
+            resource.metadata.annotations = {
+                ...resource.metadata.annotations,
+                [NAMESPACE_OWNER_ANNOTATION]: this.rgdName,
+            };
+            const decl = this.hoistedNamespaceAlchemyDeclaration(hoistedNs, resource, artifact, kubeConfigOptions, prerequisiteIds);
             instanceNamespaceDeclarations.push(decl);
             instanceNamespaceIds.push(decl.id);
         }
@@ -1585,7 +2786,6 @@ export class KroResourceFactoryImpl {
         const singletonDeclarations = [];
         const singletonInstanceIds = [];
         for (const definition of this.discoverSingletonDefinitions(spec)) {
-            assertSingletonOwnerNamespaceOwnershipSafe(definition);
             const singletonFactory = this.singletonFactoryFor(definition);
             try {
                 const decls = await singletonFactory.toAlchemyResources(definition.spec, {
@@ -1604,18 +2804,10 @@ export class KroResourceFactoryImpl {
                 await singletonFactory.dispose?.();
             }
         }
-        // 1. RGD declaration (deployed once per factory; shared by all instances). Reuse the normal
-        // serializer so externalRef/forEach/includeWhen/readyWhen + singleton boundaries match
-        // non-alchemy KRO deploys.
-        //
-        // Load with JSON_SCHEMA to MATCH `serializeResourceGraphToYaml`'s dump schema. The dump uses
-        // JSON_SCHEMA (no YAML timestamp/`!!timestamp` type), so a string value that merely LOOKS like a
-        // date — e.g. an env var `"2026-06-01"` — is emitted UNQUOTED. Loading it back with js-yaml's
-        // DEFAULT schema (timestamp-aware) would coerce that scalar to a `Date` OBJECT, and the applied
-        // RGD would then carry an object where a string belongs — KRO rejects the whole graph
-        // (`GraphAccepted=False: expected string type ..., got object`) and it never reconciles. Matching
-        // the load schema to the dump makes the round-trip lossless (the scalar stays the string it was).
-        const rgdManifest = yaml.load(this.buildRgdYaml(spec), { schema: yaml.JSON_SCHEMA });
+        // 1. RGD declaration (deployed once per factory; shared by all instances). The serializer
+        // exposes the manifest directly, so Alchemy consumes the same representation without a
+        // YAML dump/load round trip or timestamp-like scalar coercion.
+        const rgdManifest = this.buildRgdManifest(spec);
         const rgdFactory = this.rgdProvider ??
             (await import('../../factories/kro/resource-graph-definition.js')).resourceGraphDefinition;
         const rgdEnhanced = rgdFactory(rgdManifest);
@@ -1695,7 +2887,15 @@ export class KroResourceFactoryImpl {
     }
     /** Serialize the factory's cluster connection so an alchemy resource can reconnect after rehydration. */
     extractKubeConfigOptionsForAlchemy() {
-        return extractSerializableKubeConfigOptions(this.getKubeConfig(), this.factoryOptions.skipTLSVerify === true ? true : undefined);
+        const persistence = this.factoryOptions.alchemyKubeConfig ??
+            (this.factoryOptions.kubeConfig === undefined
+                ? { source: { kind: 'default' } }
+                : undefined);
+        const kubeConfig = this.factoryOptions.kubeConfig ?? (persistence?.source ? undefined : this.getKubeConfig());
+        return extractSerializableKubeConfigOptions(kubeConfig, {
+            ...(this.factoryOptions.skipTLSVerify === true ? { skipTLSVerifyOverride: true } : {}),
+            ...(persistence ? { persistence } : {}),
+        });
     }
     /** Build the finalizer-safe, shared-RGD-aware deletion metadata for this factory's instances. */
     createAlchemyKroDeletionOptions(instanceNamespace = this.namespace) {
@@ -1709,12 +2909,201 @@ export class KroResourceFactoryImpl {
             timeout: this.factoryOptions.timeout ?? 300000,
         };
     }
+    kroDeletionForBundleOperation(bundle, operation) {
+        if (operation.role !== 'resource-graph-definition' &&
+            operation.role !== 'singleton-owner-rgd' &&
+            operation.role !== 'instance' &&
+            operation.role !== 'singleton-owner-instance') {
+            return undefined;
+        }
+        const memberId = operation.sources[0]?.memberId;
+        if (!memberId)
+            return undefined;
+        const rgdOperation = bundle.operations.find((candidate) => (candidate.role === 'resource-graph-definition' ||
+            candidate.role === 'singleton-owner-rgd') &&
+            candidate.sources.some((source) => source.memberId === memberId));
+        const instanceOperation = bundle.operations.find((candidate) => (candidate.role === 'instance' || candidate.role === 'singleton-owner-instance') &&
+            candidate.sources.some((source) => source.memberId === memberId));
+        if (!rgdOperation || !instanceOperation)
+            return undefined;
+        const rgdIdentity = rgdOperation.artifact.identity;
+        const instanceIdentity = instanceOperation.artifact.identity;
+        if (!rgdIdentity || !instanceIdentity)
+            return undefined;
+        const apiVersion = instanceIdentity.apiVersion;
+        const group = apiVersion.includes('/') ? apiVersion.split('/')[0] : undefined;
+        return {
+            apiVersion,
+            kind: instanceIdentity.kind,
+            namespace: instanceIdentity.namespace
+                ? String(materializePlanValue(instanceIdentity.namespace))
+                : this.namespace,
+            rgdName: String(materializePlanValue(rgdIdentity.name)),
+            ...(group ? { group } : {}),
+            timeout: this.factoryOptions.timeout ?? 300000,
+        };
+    }
+    async alchemyDeclarationsFromKroArtifactBundle(bundle, kubeConfigOptions, sensitiveBindings) {
+        const encodedBundle = encodeKroArtifactBundle(bundle);
+        const ordered = orderKroArtifactBundleOperations(bundle);
+        const Redacted = Object.keys(sensitiveBindings).length > 0 ? await import('effect/Redacted') : undefined;
+        const rgdFactory = this.rgdProvider ??
+            (await import('../../factories/kro/resource-graph-definition.js')).resourceGraphDefinition;
+        const resources = new Map();
+        const operationSensitiveBindings = new Map();
+        const operationArtifactUses = new Map();
+        const declarationIds = new Map();
+        for (const operation of ordered) {
+            const bindingNames = planValueSensitiveBindingNames(operation.manifest);
+            const missingBindings = bindingNames.filter((binding) => !Object.hasOwn(sensitiveBindings, binding));
+            if (missingBindings.length > 0) {
+                throw new TypeKroError(`KRO operation ${operation.id} has unresolved sensitive bindings: ${missingBindings.join(', ')}.`, 'KRO_SENSITIVE_BINDING_UNRESOLVED', { operationId: operation.id, bindings: missingBindings });
+            }
+            const redactedBindings = Redacted && bindingNames.length > 0
+                ? Object.fromEntries(bindingNames.map((binding) => [binding, Redacted.make(sensitiveBindings[binding])]))
+                : {};
+            operationSensitiveBindings.set(operation.id, redactedBindings);
+            const artifactOutputUses = collectArtifactOutputUses(operation.manifest);
+            operationArtifactUses.set(operation.id, artifactOutputUses);
+            const declarationArtifactOutputs = Object.fromEntries(bundle.artifactRequirements.map((requirement) => [
+                requirement.id,
+                Object.fromEntries(requirement.outputs.map((output) => [
+                    output,
+                    `__typekro_artifact_${encodeURIComponent(requirement.id)}_${encodeURIComponent(output)}__`,
+                ])),
+            ]));
+            const manifest = materializeKroArtifactBundleOperation(operation, {
+                sensitive: redactedBindings,
+                ...(artifactOutputUses.length > 0 ? { artifactOutputs: declarationArtifactOutputs } : {}),
+            });
+            const artifact = operation.artifact;
+            if (artifact.identity?.scope)
+                setMetadataField(manifest, 'scope', artifact.identity.scope);
+            setMetadataField(manifest, 'applyPolicy', artifact.apply);
+            setResourceId(manifest, artifact.id);
+            const strategy = artifact.readiness.strategy;
+            if (strategy?.kind === 'registered') {
+                const evaluator = resolvePortableReadinessStrategy(strategy);
+                if (!evaluator) {
+                    throw new TypeKroError(`Registered readiness strategy ${strategy.id}@${strategy.revision} is unavailable.`, 'KRO_ARTIFACT_READINESS_UNAVAILABLE', { operationId: operation.id, artifactId: artifact.id });
+                }
+                setReadinessEvaluator(manifest, evaluator);
+            }
+            if (operation.role === 'hoisted-namespace') {
+                const evidence = artifact.lifecycle.unusedEvidence;
+                const evidenceInputs = evidence
+                    ? materializePlanValue(evidence.inputs)
+                    : undefined;
+                manifest.metadata.annotations = {
+                    ...manifest.metadata.annotations,
+                    [NAMESPACE_OWNER_ANNOTATION]: String(evidenceInputs?.rgdName ?? this.rgdName),
+                };
+            }
+            const enhanced = operation.role === 'resource-graph-definition' || operation.role === 'singleton-owner-rgd'
+                ? rgdFactory(manifest)
+                : manifest;
+            setMetadataField(enhanced, 'applyPolicy', artifact.apply);
+            resources.set(operation.id, enhanced);
+            const declarationId = operation.role === 'hoisted-namespace'
+                ? KroResourceFactoryImpl.hoistedNamespaceId(String(manifest.metadata.name))
+                : operation.role === 'instance' || operation.role === 'singleton-owner-instance'
+                    ? this.instanceAlchemyId(enhanced)
+                    : createAlchemyResourceId(enhanced, artifact.identity?.scope === 'cluster'
+                        ? undefined
+                        : (manifest.metadata.namespace ?? this.namespace));
+            if ([...declarationIds.values()].includes(declarationId)) {
+                throw new TypeKroError(`KRO bundle operations collapse to duplicate Alchemy id ${declarationId}.`, 'KRO_ALCHEMY_DECLARATION_ID_COLLISION', { operationId: operation.id, declarationId });
+            }
+            declarationIds.set(operation.id, declarationId);
+        }
+        return ordered.map((operation) => {
+            const resource = resources.get(operation.id);
+            const declarationId = declarationIds.get(operation.id);
+            if (!resource || !declarationId) {
+                throw new TypeKroError(`KRO operation ${operation.id} was not prepared for Alchemy declaration emission.`, 'KRO_ALCHEMY_DECLARATION_MISSING', { operationId: operation.id });
+            }
+            const artifact = operation.artifact;
+            const operationBindings = operationSensitiveBindings.get(operation.id);
+            const artifactOutputUses = operationArtifactUses.get(operation.id) ?? [];
+            const artifactRequirementIds = new Set(artifactOutputUses.map((use) => use.requirementId));
+            const artifactRequirements = bundle.artifactRequirements.filter((requirement) => artifactRequirementIds.has(requirement.id));
+            const manifest = resource;
+            const direct = operation.role === 'kro-prerequisite' || operation.role === 'hoisted-namespace';
+            const kroDeletion = this.kroDeletionForBundleOperation(bundle, operation);
+            const evidence = artifact.lifecycle.unusedEvidence;
+            const evidenceInputs = evidence
+                ? materializePlanValue(evidence.inputs)
+                : undefined;
+            const namespace = operation.role === 'hoisted-namespace'
+                ? String(manifest.metadata.name)
+                : (manifest.metadata.namespace ?? this.namespace);
+            return {
+                id: declarationId,
+                dependsOn: operation.dependencies.map((dependency) => {
+                    const declarationId = declarationIds.get(dependency);
+                    if (!declarationId) {
+                        throw new TypeKroError(`KRO operation ${operation.id} references an unemitted dependency ${dependency}.`, 'KRO_ALCHEMY_DEPENDENCY_MISSING', { operationId: operation.id, dependency });
+                    }
+                    return declarationId;
+                }),
+                ...(artifactRequirements.length > 0 ? { artifactRequirements } : {}),
+                ...(artifactOutputUses.length > 0 ? { artifactOutputUses } : {}),
+                props: {
+                    resource,
+                    resourceId: artifact.id,
+                    namespace,
+                    deploymentStrategy: direct ? 'direct' : 'kro',
+                    kubeConfigOptions,
+                    kroArtifactBundle: encodedBundle,
+                    kroArtifactOperationId: operation.id,
+                    ...(artifactRequirements.length > 0 ? { artifactRequirements } : {}),
+                    ...(artifactOutputUses.length > 0 ? { artifactOutputUses } : {}),
+                    ...(operationBindings && Object.keys(operationBindings).length > 0
+                        ? { sensitiveBindings: operationBindings }
+                        : {}),
+                    ...(kroDeletion ? { kroDeletion } : {}),
+                    ...(operation.role === 'hoisted-namespace'
+                        ? {
+                            namespaceEmptyGate: true,
+                            namespaceOwnerRgd: String(evidenceInputs?.rgdName ?? this.rgdName),
+                            namespacePreHoistQuery: {
+                                group: String(evidenceInputs?.group ?? this.getSchemaGroup()),
+                                version: String(evidenceInputs?.version ?? this.getSchemaVersion()),
+                                kind: String(evidenceInputs?.kind ?? this.schemaDefinition.kind),
+                            },
+                        }
+                        : {}),
+                    options: {
+                        waitForReady: operation.role === 'resource-graph-definition' ||
+                            operation.role === 'singleton-owner-rgd' ||
+                            operation.role === 'singleton-owner-instance' ||
+                            (operation.role === 'instance'
+                                ? (this.factoryOptions.waitForReady ?? true)
+                                : artifact.readiness.strategy !== undefined),
+                        timeout: this.factoryOptions.timeout ??
+                            (operation.role === 'resource-graph-definition' ||
+                                operation.role === 'singleton-owner-rgd'
+                                ? DEFAULT_RGD_TIMEOUT
+                                : DEFAULT_DEPLOYMENT_TIMEOUT),
+                    },
+                },
+            };
+        });
+    }
     /**
      * Get factory status
      */
-    async getStatus() {
-        const instances = await this.getInstances();
-        const rgdStatus = await this.getRGDStatus();
+    async getStatus(opts) {
+        if (opts?.operationSignal) {
+            return this.getStatusWithinOperation(opts.operationSignal);
+        }
+        return runStandaloneOperation((abortSignal) => this.getStatusWithinOperation(abortSignal), {
+            abortSignals: [this.factoryOptions.abortSignal, opts?.abortSignal],
+        });
+    }
+    async getStatusWithinOperation(abortSignal) {
+        const instances = await this.getInstancesWithinOperation(abortSignal);
+        const rgdStatus = await this.getRGDStatusWithinOperation(abortSignal);
         return {
             name: this.name,
             mode: this.mode,
@@ -1726,7 +3115,16 @@ export class KroResourceFactoryImpl {
     /**
      * Get ResourceGraphDefinition status
      */
-    async getRGDStatus() {
+    async getRGDStatus(opts) {
+        if (opts?.operationSignal) {
+            return this.getRGDStatusWithinOperation(opts.operationSignal);
+        }
+        return runStandaloneOperation((abortSignal) => this.getRGDStatusWithinOperation(abortSignal), {
+            abortSignals: [this.factoryOptions.abortSignal, opts?.abortSignal],
+        });
+    }
+    async getRGDStatusWithinOperation(abortSignal) {
+        abortSignal.throwIfAborted();
         const kubeConfig = this.getKubeConfig();
         const k8sApi = createBunCompatibleKubernetesObjectApi(kubeConfig);
         try {
@@ -1738,6 +3136,7 @@ export class KroResourceFactoryImpl {
                     name: this.rgdName,
                 },
             });
+            abortSignal.throwIfAborted();
             const rgd = response;
             // Map Kro's state to our phase enum
             let phase = 'pending';
@@ -1757,6 +3156,7 @@ export class KroResourceFactoryImpl {
             };
         }
         catch (error) {
+            abortSignal.throwIfAborted();
             const k8sError = error;
             // Check for 404 in multiple ways since different API clients report it differently
             const bodyString = typeof k8sError.body === 'string' ? k8sError.body : JSON.stringify(k8sError.body || '');
@@ -1781,14 +3181,35 @@ export class KroResourceFactoryImpl {
     /**
      * Implementation of overloaded toYaml method
      */
-    toYaml(spec) {
+    toYaml(spec, options) {
         this.assertNoKroPrerequisiteHookForDeclarative('toYaml()');
         if (spec) {
+            this.assertNoReservedKroSpecField(spec);
             validateSpec(spec, this.schemaDefinition, {
                 kind: this.schemaDefinition.kind,
                 name: this.name,
             });
             this.assertInstanceNamespaceOwnershipSafe(spec);
+            const compiledBundle = this.compiledKroArtifactBundle(spec);
+            if (compiledBundle) {
+                this.assertBundleCapabilities(compiledBundle.bundle, { host: null, output: 'static' });
+                const operations = orderKroArtifactBundleOperations(compiledBundle.bundle).filter((operation) => operation.role === 'hoisted-namespace' ||
+                    operation.role === 'singleton-owner-instance' ||
+                    operation.role === 'instance');
+                const requiredBindings = operations.flatMap((operation) => planValueSensitiveBindingNames(operation.manifest));
+                const sensitiveBindings = resolveStaticYamlSensitiveBindings(requiredBindings, compiledBundle.sensitiveBindings, options, `KRO factory ${this.name} YAML`);
+                const documents = operations.map((operation) => yaml
+                    .dump(materializeKroArtifactBundleOperation(operation, {
+                    sensitive: sensitiveBindings,
+                }), {
+                    lineWidth: -1,
+                    noRefs: true,
+                    sortKeys: false,
+                })
+                    .trimEnd());
+                return joinYamlDocuments(documents.slice(0, -1), documents.at(-1) ?? '');
+            }
+            this.assertBundleCapabilities(undefined, { host: null, output: 'static' });
             // Generate CRD instance YAML
             const instanceName = generateInstanceName(spec, this.name);
             const customResource = this.createCustomResourceInstance(instanceName, spec);
@@ -1800,15 +3221,46 @@ export class KroResourceFactoryImpl {
             // so the consuming RGD's externalRef resolves. No-op without singletons.
             // Any owned workload Namespace hoisted out of the RGD graph leads, so the CR
             // always has a namespace to apply into and KRO never garbage-collects it.
-            const ownerYamls = singletonOwnerInstanceYamls(this.discoverSingletonDefinitions(spec));
+            const ownerYamls = this.materializedSingletonOwnerInstances(spec).map((resource) => yaml
+                .dump(JSON.parse(JSON.stringify(resource)), {
+                lineWidth: -1,
+                noRefs: true,
+                sortKeys: false,
+            })
+                .trimEnd());
             const leadingInstanceYamls = [
-                ...[...this.concreteHoistedNamespaces(spec)].map(([ns, original]) => this.hoistedNamespaceYaml(ns, original, spec)),
+                ...[...this.materializedHoistedNamespaces(spec).values()].map(({ resource }) => yaml
+                    .dump(JSON.parse(JSON.stringify(resource)), {
+                    lineWidth: -1,
+                    noRefs: true,
+                    sortKeys: false,
+                })
+                    .trimEnd()),
                 ...ownerYamls,
             ];
             return leadingInstanceYamls.length === 0
                 ? instanceYaml
                 : joinYamlDocuments(leadingInstanceYamls, instanceYaml);
         }
+        const compiledBundle = this.compiledKroArtifactBundle();
+        if (compiledBundle) {
+            this.assertBundleCapabilities(compiledBundle.bundle, { host: null, output: 'static' });
+            const documents = orderKroArtifactBundleOperations(compiledBundle.bundle)
+                .filter((operation) => operation.role === 'kro-prerequisite' ||
+                operation.role === 'singleton-owner-rgd' ||
+                operation.role === 'resource-graph-definition')
+                .map((operation) => yaml
+                .dump(materializeKroArtifactBundleOperation(operation, {
+                sensitive: compiledBundle.sensitiveBindings,
+            }), {
+                lineWidth: -1,
+                noRefs: true,
+                sortKeys: false,
+            })
+                .trimEnd());
+            return joinYamlDocuments(documents.slice(0, -1), documents.at(-1) ?? '');
+        }
+        this.assertBundleCapabilities(undefined, { host: null, output: 'static' });
         const rgdYaml = this.buildRgdYaml();
         const prerequisiteYamls = this.prerequisiteResourceYamls();
         const leadingYamls = [...prerequisiteYamls, ...singletonRgdYamls(this.singletonDefinitions)];
@@ -1832,7 +3284,7 @@ export class KroResourceFactoryImpl {
      * symmetry with the callers and is deliberately NOT used to decide hoisting — see
      * {@link hoistedNamespaceRefs} / {@link resourcesForRgd}.
      */
-    buildRgdYaml(_spec) {
+    buildRgdManifest(_spec) {
         if (this.factoryOptions.compositionAnalysis && !this.compositionAnalysisApplied) {
             this.compositionAnalysisApplied = true;
             applyAnalysisToResources(this.resources, this.factoryOptions.compositionAnalysis);
@@ -1842,13 +3294,15 @@ export class KroResourceFactoryImpl {
         // to it. typekro NEVER emits a Namespace into RGD YAML; each is applied as a
         // sibling (toYaml/toAlchemyResources/imperative deploy), so deleting the instance
         // can never garbage-collect the namespace holding its own finalizer.
-        const hoistIds = this.hoistedNamespaceRefs(this.resources);
-        const graphResources = this.resourcesForRgd(this.resources);
+        const plannedResources = this.plannedResources();
+        const hoistIds = this.hoistedNamespaceRefs(plannedResources);
+        const graphResources = this.resourcesForRgd(plannedResources);
         // Rewrite references to a hoisted Namespace in the STATUS mappings too
         // (finding #6): a status CEL like `ns-${string(ownedNamespace.metadata.name)}`
         // would otherwise reference a resource removed from the graph and KRO would
         // reject the RGD. Each becomes the referenced Namespace's own name expression.
         const statusMappings = rewriteHoistedNamespaceRefsInValue(this.statusMappings, hoistIds);
+        copyCompositionAnalysisMetadata(this.statusMappings, statusMappings);
         const nestedCel = rewriteHoistedNamespaceRefsInValue(this.getNestedStatusCel(), hoistIds);
         // #6 — REJECT (throw) HONESTLY, never silently drop: a status field whose only
         // reference was a hoisted Namespace becomes a schema-only expression
@@ -1857,10 +3311,12 @@ export class KroResourceFactoryImpl {
         // the declared one (the old warn-and-drop), fail loudly naming the field(s).
         // Resource-derived sibling fields are unaffected.
         assertNoHoistWeakenedStatusFields(this.statusMappings, hoistIds, this.name);
-        const aspectResources = applyAspects(graphResources, {
-            mode: 'kro',
-            aspects: this.factoryOptions.aspects ?? [],
-        });
+        const aspectResources = this.factoryOptions.semanticCapture
+            ? graphResources
+            : applyAspects(graphResources, {
+                mode: 'kro',
+                aspects: this.factoryOptions.aspects ?? [],
+            });
         // Strict CEL diagnostics gate: fail fast if the status CEL that is about
         // to be emitted references resources that are not part of this graph,
         // instead of shipping an RGD that KRO will mark Inactive on the cluster.
@@ -1869,6 +3325,19 @@ export class KroResourceFactoryImpl {
         }
         const kroSchema = generateKroSchemaFromArktype(this.name, this.schemaDefinition, aspectResources, statusMappings, nestedCel, this.factoryOptions.compositionOptions
             ?.schemaFieldValidations);
+        const artifactOutputUses = this.kroArtifactOutputUses();
+        if (artifactOutputUses.length > 0) {
+            const byRequirement = new Map();
+            for (const use of artifactOutputUses) {
+                const current = byRequirement.get(use.requirementId) ?? [];
+                current.push(use);
+                byRequirement.set(use.requirementId, current);
+            }
+            kroSchema.spec[KRO_ARTIFACT_BINDINGS_SPEC_FIELD] = Object.fromEntries([...byRequirement.entries()].map(([requirementId, uses]) => [
+                kroArtifactRequirementField(requirementId),
+                Object.fromEntries(uses.map((use) => [kroArtifactOutputField(use.output), 'string'])),
+            ]));
+        }
         // Attach nested status CEL mappings as non-enumerable property so
         // serializeResourceGraphToYaml can inline virtual composition IDs.
         if (nestedCel && Object.keys(nestedCel).length > 0) {
@@ -1907,13 +3376,34 @@ export class KroResourceFactoryImpl {
                 applyTernaryConditionalsToResources(aspectResources, kroSchema.__ternaryConditionals, kroSchema.__nestedStatusCel);
             }
         }
-        const rgdYaml = serializeResourceGraphToYaml(this.rgdName, aspectResources, { namespace: this.namespace }, kroSchema);
+        const rgdManifest = serializeResourceGraphToManifest(this.rgdName, aspectResources, {
+            ...this.factoryOptions.compositionOptions,
+            namespace: this.namespace,
+        }, kroSchema);
         // VALIDATE (finding #6): after hoisting, NO reference to any removed resource id
         // may remain anywhere in the emitted RGD. If one slipped through (a form the
         // rewrite didn't structurally cover), fail LOUDLY here rather than shipping an
         // RGD KRO will reject at runtime with a dangling `${...}` reference.
-        this.assertNoDanglingHoistedReferences(rgdYaml, new Set(hoistIds.keys()));
-        return rgdYaml;
+        this.assertNoDanglingHoistedReferences(JSON.stringify(rgdManifest), new Set(hoistIds.keys()));
+        return rgdManifest;
+    }
+    kroArtifactOutputUses() {
+        const capture = this.factoryOptions.semanticCapture;
+        if (!capture)
+            return [];
+        const configuredPlan = this.factoryOptions.plan ?? {};
+        const plan = capture.planTemplate({
+            ...configuredPlan,
+            aspects: configuredPlan.aspects ?? this.factoryOptions.aspects ?? [],
+        });
+        return collectArtifactOutputUses({
+            nodes: plan.nodes,
+            outputs: plan.outputs,
+            representationRequirements: plan.representationRequirements,
+        });
+    }
+    buildRgdYaml(spec) {
+        return serializeResourceGraphDefinitionToYaml(this.buildRgdManifest(spec), this.factoryOptions.compositionOptions);
     }
     /**
      * Assert the emitted RGD carries NO leftover reference to a hoisted (removed)
@@ -2019,7 +3509,8 @@ export class KroResourceFactoryImpl {
      * The `spec` (when the caller has one) lets the RGD hoist the composition's own
      * workload Namespace out of the graph with its schema-driven name resolved.
      */
-    async ensureRGDDeployed(spec) {
+    async ensureRGDDeployed(spec, abortSignal) {
+        abortSignal?.throwIfAborted();
         // Create DirectDeploymentEngine instance with KRO mode for CEL string generation
         const deploymentEngine = new DirectDeploymentEngine(this.getKubeConfig(), undefined, undefined, DeploymentMode.KRO);
         // Build the RGD YAML — shared with toYaml() so both call sites emit
@@ -2061,7 +3552,7 @@ export class KroResourceFactoryImpl {
             rgdManifest: JSON.stringify(rgdWithMetadata, null, 2),
         });
         try {
-            await this.applyKroPrerequisites(deploymentEngine);
+            await this.applyKroPrerequisites(deploymentEngine, abortSignal);
             // Deploy RGD using DirectDeploymentEngine with readiness checking
             this.logger.info('Deploying RGD via engine', { rgdName: this.rgdName });
             await deploymentEngine.deployResource(deployableRGD, {
@@ -2069,10 +3560,11 @@ export class KroResourceFactoryImpl {
                 namespace: this.namespace,
                 waitForReady: true,
                 timeout: this.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT,
+                ...(abortSignal ? { abortSignal } : {}),
             });
             this.logger.info('RGD accepted, waiting for CRD', { rgdName: this.rgdName });
             // Wait for the CRD to be created by Kro using DirectDeploymentEngine
-            await this.waitForCRDReadyWithEngine(deploymentEngine);
+            await this.waitForCRDReadyWithEngine(deploymentEngine, abortSignal);
             this.logger.info('CRD ready', { rgdName: this.rgdName });
         }
         catch (error) {
@@ -2102,13 +3594,22 @@ export class KroResourceFactoryImpl {
             await deploymentEngine.dispose();
         }
     }
-    async applyKroPrerequisites(deploymentEngine) {
+    async applyKroPrerequisites(deploymentEngine, abortSignal) {
         const prerequisites = this.factoryOptions.kroPrerequisites;
         if (!prerequisites?.resources?.length && !prerequisites?.beforeResourceGraphDefinition) {
             return;
         }
+        const deployResource = this.kroPrerequisiteDeployResource(deploymentEngine, abortSignal);
+        for (const resource of prerequisites.resources ?? []) {
+            abortSignal?.throwIfAborted();
+            await deployResource(resource);
+        }
+        await this.runKroPrerequisiteHook(deploymentEngine, deployResource, abortSignal);
+    }
+    kroPrerequisiteDeployResource(deploymentEngine, abortSignal) {
         const timeout = this.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT;
-        const deployResource = async (resource, options = {}) => {
+        return async (resource, options = {}) => {
+            abortSignal?.throwIfAborted();
             const deployable = this.normalizePrerequisiteResource(resource, {
                 ensureReadiness: options.waitForReady ?? false,
             });
@@ -2120,27 +3621,32 @@ export class KroResourceFactoryImpl {
                 namespace: this.namespace,
                 waitForReady: options.waitForReady ?? false,
                 timeout,
+                ...(abortSignal ? { abortSignal } : {}),
             });
             const crdName = this.prerequisiteCRDName(resource);
             if (crdName) {
-                await deploymentEngine.waitForCRDReady(crdName, timeout);
+                await deploymentEngine.waitForCRDReady(crdName, timeout, abortSignal);
             }
             return deployed;
         };
-        for (const resource of prerequisites.resources ?? []) {
-            await deployResource(resource);
-        }
-        if (prerequisites.beforeResourceGraphDefinition) {
-            const context = {
-                kubernetesApi: deploymentEngine.getKubernetesApi(),
-                kubeConfig: this.getKubeConfig(),
-                namespace: this.namespace,
-                timeout,
-                deployResource,
-                waitForCRDReady: (crdName, waitTimeout = timeout) => deploymentEngine.waitForCRDReady(crdName, waitTimeout),
-            };
-            await prerequisites.beforeResourceGraphDefinition(context);
-        }
+    }
+    async runKroPrerequisiteHook(deploymentEngine, deployResource, abortSignal) {
+        const hook = this.factoryOptions.kroPrerequisites?.beforeResourceGraphDefinition;
+        if (!hook)
+            return;
+        abortSignal?.throwIfAborted();
+        const timeout = this.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT;
+        const deploy = deployResource ?? this.kroPrerequisiteDeployResource(deploymentEngine, abortSignal);
+        const context = {
+            kubernetesApi: deploymentEngine.getKubernetesApi(),
+            kubeConfig: this.getKubeConfig(),
+            namespace: this.namespace,
+            timeout,
+            ...(abortSignal ? { abortSignal } : {}),
+            deployResource: deploy,
+            waitForCRDReady: (crdName, waitTimeout = timeout) => deploymentEngine.waitForCRDReady(crdName, waitTimeout, abortSignal),
+        };
+        await hook(context);
     }
     normalizePrerequisiteResource(resource, options = {}) {
         const name = resource.metadata?.name ?? 'unnamed';
@@ -2171,24 +3677,7 @@ export class KroResourceFactoryImpl {
             deployable.metadata.namespace = this.namespace;
         }
         if (this.prerequisiteCRDName(resource) && !getReadinessEvaluator(deployable)) {
-            setReadinessEvaluator(deployable, (liveResource) => {
-                const conditions = liveResource
-                    .status?.conditions ?? [];
-                const established = conditions.find((condition) => condition.type === 'Established');
-                const namesAccepted = conditions.find((condition) => condition.type === 'NamesAccepted');
-                const ready = established?.status === 'True' && namesAccepted?.status === 'True';
-                return ready
-                    ? {
-                        ready: true,
-                        message: 'CustomResourceDefinition is established and names are accepted',
-                    }
-                    : {
-                        ready: false,
-                        reason: 'ConditionsNotMet',
-                        message: 'CustomResourceDefinition is not established and names accepted yet',
-                        details: { conditions },
-                    };
-            });
+            setReadinessEvaluator(deployable, createCustomResourceDefinitionReadinessEvaluator());
         }
         else if (options.attachFallbackReadiness && !getReadinessEvaluator(deployable)) {
             setReadinessEvaluator(deployable, createAlwaysReadyEvaluator(resource.kind));
@@ -2199,6 +3688,34 @@ export class KroResourceFactoryImpl {
         return deployable;
     }
     prerequisiteResourceYamls() {
+        const capture = this.factoryOptions.semanticCapture;
+        if (capture) {
+            const configuredPlan = this.factoryOptions.plan ?? {};
+            const plan = capture.planTemplate({
+                ...configuredPlan,
+                aspects: configuredPlan.aspects ?? this.factoryOptions.aspects ?? [],
+            });
+            const artifacts = compileKroArtifactPlan(plan, {
+                strict: true,
+                rgdName: this.rgdName,
+                ...this.prerequisiteArtifactCompilationInputs(),
+                ...(this.factoryOptions.applyPolicy
+                    ? { outerApplyPolicy: this.factoryOptions.applyPolicy }
+                    : {}),
+            });
+            return kroArtifactPlanToSupportingResources(artifacts, {
+                readinessEvaluators: this.prerequisiteRuntimeReadinessEvaluators(),
+                resolveReadinessStrategy: resolvePortableReadinessStrategy,
+            })
+                .filter(({ artifact }) => artifact.role === 'kro-prerequisite')
+                .map(({ resource }) => yaml
+                .dump(JSON.parse(JSON.stringify(resource)), {
+                lineWidth: -1,
+                noRefs: true,
+                sortKeys: false,
+            })
+                .trimEnd());
+        }
         return (this.factoryOptions.kroPrerequisites?.resources ?? []).map((resource) => yaml
             .dump(this.toSerializablePrerequisiteResource(resource), {
             lineWidth: -1,
@@ -2207,6 +3724,196 @@ export class KroResourceFactoryImpl {
         })
             .trimEnd());
     }
+    prerequisiteArtifactCompilationInputs() {
+        const supportingArtifacts = [];
+        const outerEdges = [];
+        let previousId;
+        for (const prerequisite of this.factoryOptions.kroPrerequisites?.resources ?? []) {
+            const normalized = this.normalizePrerequisiteResource(prerequisite, {
+                attachFallbackReadiness: true,
+            });
+            const id = normalized.id;
+            const serialized = this.toSerializablePrerequisiteResource(prerequisite);
+            const scope = getMetadataField(normalized, 'scope') === 'cluster' ? 'cluster' : 'namespaced';
+            const namespace = scope === 'namespaced' && typeof normalized.metadata.namespace === 'string'
+                ? lowerPlanValue(normalized.metadata.namespace).value
+                : undefined;
+            const evaluator = getReadinessEvaluator(normalized);
+            const portableStrategy = evaluator ? getPortableReadinessStrategy(evaluator) : undefined;
+            const runtimeBinding = `readiness:kro-prerequisite:${id}`;
+            supportingArtifacts.push({
+                id,
+                role: 'kro-prerequisite',
+                desired: lowerPlanValue(serialized).value,
+                identity: {
+                    apiVersion: normalized.apiVersion,
+                    kind: normalized.kind,
+                    name: lowerPlanValue(normalized.metadata.name).value,
+                    ...(namespace ? { namespace } : {}),
+                    scope,
+                },
+                lifecycle: {
+                    creation: 'adopt',
+                    management: 'authoritative',
+                    deletion: 'delete',
+                    instancing: { kind: 'per-cluster' },
+                    sharing: 'exclusive',
+                },
+                readiness: {
+                    activation: [],
+                    readyWhen: [],
+                    ...(portableStrategy
+                        ? { strategy: portableStrategy }
+                        : evaluator
+                            ? {
+                                strategy: {
+                                    kind: 'runtime-binding',
+                                    binding: runtimeBinding,
+                                    version: 1,
+                                },
+                            }
+                            : {}),
+                },
+            });
+            if (previousId) {
+                outerEdges.push({ kind: 'existence', prerequisite: previousId, dependent: id });
+            }
+            previousId = id;
+        }
+        if (previousId) {
+            outerEdges.push({
+                kind: 'existence',
+                prerequisite: previousId,
+                dependent: '__typekro_rgd__',
+            });
+        }
+        return { supportingArtifacts, outerEdges };
+    }
+    outerArtifactCompilationInputs(spec) {
+        const prerequisiteInputs = this.prerequisiteArtifactCompilationInputs();
+        if (spec === undefined)
+            return prerequisiteInputs;
+        const supportingArtifacts = [...prerequisiteInputs.supportingArtifacts];
+        const outerEdges = [...prerequisiteInputs.outerEdges];
+        const lastPrerequisite = prerequisiteInputs.supportingArtifacts.at(-1)?.id;
+        for (const [name, original] of this.concreteHoistedNamespaces(spec)) {
+            const id = KroResourceFactoryImpl.hoistedNamespaceId(name);
+            const manifest = this.hoistedNamespaceManifest(name, original, spec);
+            supportingArtifacts.push({
+                id,
+                role: 'hoisted-namespace',
+                desired: lowerPlanValue(manifest).value,
+                identity: {
+                    apiVersion: 'v1',
+                    kind: 'Namespace',
+                    name: lowerPlanValue(name).value,
+                    scope: 'cluster',
+                },
+                lifecycle: {
+                    creation: 'adopt',
+                    management: 'authoritative',
+                    deletion: 'delete-when-unused',
+                    instancing: { kind: 'per-scope', key: lowerPlanValue(name).value },
+                    sharing: 'shareable',
+                    unusedEvidence: {
+                        provider: 'typekro.hoisted-namespace-empty-owned',
+                        version: 1,
+                        inputs: lowerPlanValue({
+                            rgdName: this.rgdName,
+                            group: this.getSchemaGroup(),
+                            version: this.getSchemaVersion(),
+                            kind: this.schemaDefinition.kind,
+                        }).value,
+                    },
+                },
+                apply: {
+                    strategy: 'server-side-apply',
+                    fieldManager: 'typekro',
+                    fieldConflictPolicy: 'force-owned-fields',
+                    immutableFieldPolicy: 'fail',
+                },
+            });
+            if (lastPrerequisite) {
+                outerEdges.push({
+                    kind: 'existence',
+                    prerequisite: lastPrerequisite,
+                    dependent: id,
+                });
+            }
+            outerEdges.push({
+                kind: 'existence',
+                prerequisite: id,
+                dependent: '__typekro_rgd__',
+            });
+        }
+        return { supportingArtifacts, outerEdges };
+    }
+    materializedHoistedNamespaces(spec) {
+        const capture = this.factoryOptions.semanticCapture;
+        if (!capture) {
+            return new Map([...this.concreteHoistedNamespaces(spec)].map(([name, original]) => [
+                name,
+                { resource: this.hoistedNamespaceManifest(name, original, spec) },
+            ]));
+        }
+        const configuredPlan = this.factoryOptions.plan ?? {};
+        const plan = capture.planTemplate({
+            ...configuredPlan,
+            aspects: configuredPlan.aspects ?? this.factoryOptions.aspects ?? [],
+        });
+        const artifacts = compileKroArtifactPlan(plan, {
+            strict: true,
+            rgdName: this.rgdName,
+            ...this.outerArtifactCompilationInputs(spec),
+            ...(this.factoryOptions.applyPolicy
+                ? { outerApplyPolicy: this.factoryOptions.applyPolicy }
+                : {}),
+        });
+        return new Map(kroArtifactPlanToSupportingResources(artifacts, {
+            readinessEvaluators: this.prerequisiteRuntimeReadinessEvaluators(),
+            resolveReadinessStrategy: resolvePortableReadinessStrategy,
+        })
+            .filter(({ artifact }) => artifact.role === 'hoisted-namespace')
+            .map(({ artifact, resource }) => [String(resource.metadata.name), { artifact, resource }]));
+    }
+    materializedSingletonOwnerInstances(spec) {
+        const capture = this.factoryOptions.semanticCapture;
+        if (!capture) {
+            return singletonOwnerInstanceManifests(this.discoverSingletonDefinitions(spec));
+        }
+        const configuredPlan = this.factoryOptions.plan ?? {};
+        const plan = capture.planTemplate({
+            ...configuredPlan,
+            aspects: configuredPlan.aspects ?? this.factoryOptions.aspects ?? [],
+        });
+        const artifacts = compileKroArtifactPlan(plan, {
+            strict: true,
+            rgdName: this.rgdName,
+            ...this.outerArtifactCompilationInputs(spec),
+            ...(this.factoryOptions.applyPolicy
+                ? { outerApplyPolicy: this.factoryOptions.applyPolicy }
+                : {}),
+        });
+        return kroArtifactPlanToSupportingResources(artifacts, {
+            readinessEvaluators: this.prerequisiteRuntimeReadinessEvaluators(),
+            resolveReadinessStrategy: resolvePortableReadinessStrategy,
+        })
+            .filter(({ artifact }) => artifact.role === 'singleton-owner')
+            .map(({ resource }) => resource);
+    }
+    prerequisiteRuntimeReadinessEvaluators() {
+        const bindings = {};
+        for (const prerequisite of this.factoryOptions.kroPrerequisites?.resources ?? []) {
+            const normalized = this.normalizePrerequisiteResource(prerequisite, {
+                attachFallbackReadiness: true,
+            });
+            const evaluator = getReadinessEvaluator(normalized);
+            if (evaluator && !getPortableReadinessStrategy(evaluator)) {
+                bindings[`readiness:kro-prerequisite:${normalized.id}`] = evaluator;
+            }
+        }
+        return bindings;
+    }
     toSerializablePrerequisiteResource(resource) {
         const normalized = this.normalizePrerequisiteResource(resource);
         const toJSON = normalized.toJSON;
@@ -2218,6 +3925,60 @@ export class KroResourceFactoryImpl {
     }
     prerequisiteAlchemyDeclarations(kubeConfigOptions) {
         const timeout = this.factoryOptions.timeout;
+        const capture = this.factoryOptions.semanticCapture;
+        if (capture) {
+            const configuredPlan = this.factoryOptions.plan ?? {};
+            const plan = capture.planTemplate({
+                ...configuredPlan,
+                aspects: configuredPlan.aspects ?? this.factoryOptions.aspects ?? [],
+            });
+            const artifacts = compileKroArtifactPlan(plan, {
+                strict: true,
+                rgdName: this.rgdName,
+                ...this.prerequisiteArtifactCompilationInputs(),
+                ...(this.factoryOptions.applyPolicy
+                    ? { outerApplyPolicy: this.factoryOptions.applyPolicy }
+                    : {}),
+            });
+            const materialized = kroArtifactPlanToSupportingResources(artifacts, {
+                readinessEvaluators: this.prerequisiteRuntimeReadinessEvaluators(),
+                resolveReadinessStrategy: resolvePortableReadinessStrategy,
+            }).filter(({ artifact }) => artifact.role === 'kro-prerequisite');
+            const declarationIdByArtifactId = new Map(materialized.map(({ artifact, resource }) => {
+                const namespaceForId = artifact.identity?.scope === 'cluster' ? undefined : this.namespace;
+                return [artifact.id, createAlchemyResourceId(resource, namespaceForId)];
+            }));
+            return materialized.map(({ artifact, resource }) => {
+                const declarationId = declarationIdByArtifactId.get(artifact.id);
+                if (!declarationId) {
+                    throw new TypeKroError(`KRO prerequisite ${artifact.id} has no Alchemy declaration identity.`, 'KRO_ALCHEMY_DECLARATION_MISSING', { artifactId: artifact.id });
+                }
+                const dependsOn = artifacts.edges.flatMap((edge) => {
+                    if ((edge.kind !== 'existence' && edge.kind !== 'ready') ||
+                        edge.dependent !== artifact.id) {
+                        return [];
+                    }
+                    const dependencyId = declarationIdByArtifactId.get(edge.prerequisite);
+                    return dependencyId ? [dependencyId] : [];
+                });
+                return {
+                    id: declarationId,
+                    dependsOn,
+                    props: {
+                        resource: resource,
+                        resourceId: artifact.id,
+                        namespace: this.namespace,
+                        deploymentStrategy: 'direct',
+                        kubeConfigOptions,
+                        options: {
+                            waitForReady: resource.apiVersion === 'apiextensions.k8s.io/v1' &&
+                                resource.kind === 'CustomResourceDefinition',
+                            ...(timeout !== undefined && { timeout }),
+                        },
+                    },
+                };
+            });
+        }
         const declarations = [];
         for (const resource of this.factoryOptions.kroPrerequisites?.resources ?? []) {
             const normalized = this.normalizePrerequisiteResource(resource, {
@@ -2262,7 +4023,10 @@ export class KroResourceFactoryImpl {
         return getResourceScope(resource);
     }
     canDefaultPrerequisiteNamespace(resource) {
-        return this.prerequisiteScope(resource) === 'namespaced';
+        if (Reflect.get(resource, 'scope') === 'namespaced')
+            return true;
+        return (this.prerequisiteScope(resource) === 'namespaced' &&
+            getMetadataField(resource, 'scopeProvenance') === 'explicit');
     }
     /**
      * Wait for the CRD to be created by Kro using DirectDeploymentEngine.
@@ -2272,11 +4036,11 @@ export class KroResourceFactoryImpl {
      * is authoritative, and client-side heuristics cannot handle all cases
      * (e.g., already-plural kind names that shouldn't get an extra "s").
      */
-    async waitForCRDReadyWithEngine(deploymentEngine) {
+    async waitForCRDReadyWithEngine(deploymentEngine, abortSignal) {
         if (typeof deploymentEngine.waitForCRDByKindAndGroup !== 'function') {
             throw new ResourceGraphFactoryError(`deploymentEngine.waitForCRDByKindAndGroup is not a function. Available methods: ${Object.getOwnPropertyNames(Object.getPrototypeOf(deploymentEngine)).join(', ')}`, this.name, 'deployment');
         }
-        const { plural } = await deploymentEngine.waitForCRDByKindAndGroup(this.schemaDefinition.kind, this.getSchemaGroup(), this.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT);
+        const { plural } = await deploymentEngine.waitForCRDByKindAndGroup(this.schemaDefinition.kind, this.getSchemaGroup(), this.factoryOptions.timeout || DEFAULT_RGD_TIMEOUT, abortSignal);
         this.discoveredPlural = plural;
     }
     /**
@@ -2512,6 +4276,22 @@ export class KroResourceFactoryImpl {
     /**
      * Create custom resource instance
      */
+    instanceManifestMetadata(spec, singletonSpecFingerprint) {
+        const hoistedNamespaceNames = [...this.concreteHoistedNamespaces(spec).keys()];
+        return {
+            labels: {
+                'typekro.io/factory': this.name,
+                'typekro.io/mode': this.mode,
+                [INSTANCE_RGD_LABEL]: this.rgdName,
+            },
+            annotations: {
+                ...(singletonSpecFingerprint
+                    ? { 'typekro.io/singleton-spec-fingerprint': singletonSpecFingerprint }
+                    : {}),
+                [HOISTED_NAMESPACES_ANNOTATION]: JSON.stringify(hoistedNamespaceNames),
+            },
+        };
+    }
     createCustomResourceInstance(instanceName, spec, singletonSpecFingerprint) {
         const apiVersion = this.getInstanceApiVersion();
         // DURABLE RECORD (finding #4): stamp the CONCRETE hoisted-namespace names on the CR so
@@ -2521,28 +4301,27 @@ export class KroResourceFactoryImpl {
         // empty [] — so the pre-hoist guard can distinguish "this instance hoists zero namespaces"
         // (a valid, safe record) from a genuinely-legacy CR that predates the annotation (missing →
         // fail closed). Omitting [] made an ordinary namespace-less composition's 2nd deploy throw.
-        const hoistedNamespaceNames = [...this.concreteHoistedNamespaces(spec).keys()];
-        const annotations = {
-            ...(singletonSpecFingerprint
-                ? { 'typekro.io/singleton-spec-fingerprint': singletonSpecFingerprint }
-                : {}),
-            [HOISTED_NAMESPACES_ANNOTATION]: JSON.stringify(hoistedNamespaceNames),
-        };
-        return {
+        const { labels, annotations } = this.instanceManifestMetadata(spec, singletonSpecFingerprint);
+        const legacyManifest = {
             apiVersion,
             kind: this.schemaDefinition.kind,
             metadata: {
                 name: instanceName,
                 namespace: this.resolveInstanceNamespace(spec),
-                labels: {
-                    'typekro.io/factory': this.name,
-                    'typekro.io/mode': this.mode,
-                    [INSTANCE_RGD_LABEL]: this.rgdName,
-                },
+                labels,
                 ...(Object.keys(annotations).length > 0 ? { annotations } : {}),
             },
             spec,
         };
+        const compilation = this.compiledKroArtifactPlan(spec, {
+            instanceNameOverride: instanceName,
+            ...(singletonSpecFingerprint ? { singletonSpecFingerprint } : {}),
+        });
+        if (!compilation)
+            return legacyManifest;
+        return kroArtifactPlanToInstanceResource(compilation.artifacts, {
+            sensitive: compilation.sensitiveBindings,
+        });
     }
     /**
      * Labels/annotations marking a hoisted workload Namespace as SHARED, RETAINED
@@ -2670,34 +4449,16 @@ export class KroResourceFactoryImpl {
             ...(originalSpec !== undefined && originalSpec !== null ? { spec: originalSpec } : {}),
         };
     }
-    /**
-     * A workload Namespace this composition owns, HOISTED out of the RGD graph and
-     * emitted as a retained resource instead. It is created OUTSIDE the KRO graph —
-     * deps-first in GitOps/alchemy, and applied directly in the imperative path — so
-     * KRO never garbage-collects it and the instance's finalizer can never be
-     * stranded by its own namespace terminating.
-     *
-     * The COMPLETE original Namespace configuration is preserved (finding #5) — see
-     * {@link mergedHoistedNamespaceMetadata}. It is a SHARED SINGLETON deduped by the
-     * namespace NAME (collision-free id, see {@link hoistedNamespaceId}), so every
-     * consumer/stack targeting the SAME workload namespace emits the SAME declaration
-     * — alchemy dedupes them to one retained owner rather than N fighting copies.
-     */
-    buildHoistedNamespaceResource(workloadNamespace, original, spec) {
+    /** Host-neutral desired state for one hoisted Namespace. */
+    hoistedNamespaceManifest(workloadNamespace, original, spec) {
         const merged = KroResourceFactoryImpl.mergedHoistedNamespaceMetadata(workloadNamespace, original, spec);
-        return namespaceResource({
+        return {
+            apiVersion: 'v1',
+            kind: 'Namespace',
             metadata: {
                 name: merged.name,
                 labels: merged.labels,
-                // OWNERSHIP RECORD (findings #4b + #2): the declarative alchemy path stamps this
-                // namespace as owned by THIS composition's RGD (the annotation the empty-gated
-                // teardown checks). This build step is cluster-free, so it cannot yet distinguish
-                // create-vs-adopt — that is resolved at DEPLOY time by
-                // `_preserveHoistedNamespaceAdoption` (resource-registration.ts), which reads the
-                // live namespace and STRIPS this stamp when adopting a pre-existing namespace, so
-                // teardown never deletes a namespace typekro merely adopted. Ownership is the
-                // PRIMARY teardown guard; the empty-gate is the secondary one.
-                annotations: { ...merged.annotations, [NAMESPACE_OWNER_ANNOTATION]: this.rgdName },
+                annotations: merged.annotations,
                 ...(merged.finalizers !== undefined ? { finalizers: merged.finalizers } : {}),
                 ...(merged.ownerReferences !== undefined
                     ? {
@@ -2705,24 +4466,29 @@ export class KroResourceFactoryImpl {
                     }
                     : {}),
             },
-            ...(merged.spec !== undefined
-                ? {
-                    spec: merged.spec,
-                }
-                : {}),
-            id: KroResourceFactoryImpl.hoistedNamespaceId(workloadNamespace),
-        });
+            ...(merged.spec !== undefined ? { spec: merged.spec } : {}),
+        };
     }
-    hoistedNamespaceAlchemyDeclaration(workloadNamespace, nsEnhanced, kubeConfigOptions, dependsOn) {
+    hoistedNamespaceAlchemyDeclaration(workloadNamespace, nsResource, artifact, kubeConfigOptions, dependsOn) {
         const timeout = this.factoryOptions.timeout;
-        const resourceId = nsEnhanced.id;
+        const resourceId = artifact?.id ?? nsResource.id;
+        const evidence = artifact?.lifecycle.unusedEvidence;
+        if (artifact &&
+            (artifact.lifecycle.creation !== 'adopt' ||
+                artifact.lifecycle.deletion !== 'delete-when-unused' ||
+                evidence?.provider !== 'typekro.hoisted-namespace-empty-owned')) {
+            throw new TypeKroError(`Hoisted Namespace artifact ${artifact.id} has an unsupported lifecycle contract.`, 'INVALID_ARTIFACT_LIFECYCLE', { artifactId: artifact.id });
+        }
+        const evidenceInputs = evidence
+            ? materializePlanValue(evidence.inputs)
+            : undefined;
         return {
             // Collision-free (finding #7) and cluster-scoped (no namespace segment):
             // distinct workload namespaces → distinct ids; same name → same id (dedup).
             id: KroResourceFactoryImpl.hoistedNamespaceId(workloadNamespace),
             dependsOn,
             props: {
-                resource: nsEnhanced,
+                resource: nsResource,
                 ...(resourceId !== undefined ? { resourceId } : {}),
                 namespace: workloadNamespace,
                 deploymentStrategy: 'direct',
@@ -2733,16 +4499,16 @@ export class KroResourceFactoryImpl {
                 // declaration) are gone — the load-bearing delete-after-RGD ordering (a
                 // namespace deleted while the CR is still inside it re-creates the finalizer
                 // deadlock).
-                namespaceEmptyGate: true,
+                namespaceEmptyGate: artifact?.lifecycle.deletion === 'delete-when-unused' || artifact === undefined,
                 // Ownership record for the empty-gated delete (finding #4): only a namespace
                 // carrying this RGD's `created-by-rgd` annotation is a candidate.
-                namespaceOwnerRgd: this.rgdName,
+                namespaceOwnerRgd: String(evidenceInputs?.rgdName ?? this.rgdName),
                 // CRD coordinates so the alchemy pre-hoist check enumerates EVERY existing
                 // instance of this shared RGD (finding #7), not just the incoming namespace.
                 namespacePreHoistQuery: {
-                    group: this.getSchemaGroup(),
-                    version: this.getSchemaVersion(),
-                    kind: this.schemaDefinition.kind,
+                    group: String(evidenceInputs?.group ?? this.getSchemaGroup()),
+                    version: String(evidenceInputs?.version ?? this.getSchemaVersion()),
+                    kind: String(evidenceInputs?.kind ?? this.schemaDefinition.kind),
                 },
                 kubeConfigOptions,
                 options: {
@@ -2752,25 +4518,6 @@ export class KroResourceFactoryImpl {
             },
         };
     }
-    hoistedNamespaceYaml(workloadNamespace, original, spec) {
-        const merged = KroResourceFactoryImpl.mergedHoistedNamespaceMetadata(workloadNamespace, original, spec);
-        return yaml
-            .dump({
-            apiVersion: 'v1',
-            kind: 'Namespace',
-            metadata: {
-                name: merged.name,
-                labels: merged.labels,
-                annotations: merged.annotations,
-                ...(merged.finalizers !== undefined ? { finalizers: merged.finalizers } : {}),
-                ...(merged.ownerReferences !== undefined
-                    ? { ownerReferences: merged.ownerReferences }
-                    : {}),
-            },
-            ...(merged.spec !== undefined ? { spec: merged.spec } : {}),
-        }, { lineWidth: -1, noRefs: true, sortKeys: false })
-            .trimEnd();
-    }
     assertInstanceNamespaceOwnershipSafe(spec) {
         const compositionFn = this.factoryOptions.compositionFn;
         assertKroInstanceNamespaceOwnershipSafe({
@@ -2786,11 +4533,6 @@ export class KroResourceFactoryImpl {
             ...(compositionFn ? { compositionFn } : {}),
         });
     }
-    assertSingletonOwnersNamespaceOwnershipSafe(spec) {
-        for (const definition of this.discoverSingletonDefinitions(spec)) {
-            assertSingletonOwnerNamespaceOwnershipSafe(definition);
-        }
-    }
     /**
      * Create an Enhanced proxy for the instance with mixed static/dynamic hydration
      */
@@ -3013,7 +4755,7 @@ export class KroResourceFactoryImpl {
      * Wait for Kro instance to be ready with Kro-specific logic.
      * Delegates to the shared `waitForKroInstanceReady` in `kro-readiness.ts`.
      */
-    async waitForKroInstanceReady(instanceName, timeout, instanceNamespace = this.resolveInstanceNamespace()) {
+    async waitForKroInstanceReady(instanceName, timeout, instanceNamespace = this.resolveInstanceNamespace(), abortSignal) {
         const apiVersion = this.getInstanceApiVersion();
         const kubeConfig = this.getKubeConfig();
         const k8sApi = createBunCompatibleKubernetesObjectApi(kubeConfig);
@@ -3027,6 +4769,7 @@ export class KroResourceFactoryImpl {
             kind: this.schemaDefinition.kind,
             rgdName: this.rgdName,
             factoryContext: this.name,
+            ...(abortSignal ? { abortSignal } : {}),
         });
     }
     /**