@@ -176,8 +176,21 @@ both and clears the dev deployments.
 
 ## Removal
 
-Not implemented. An instance that leaves the composition currently leaves the
+No tombstone is rendered. An instance that leaves the composition leaves the
 tree, and core is explicit that removal is a generation and never an absence —
-so a host keeps the binding until a tombstone arrives. That is core's design
-failing safe rather than a host deleting what it can no longer see, but a
-solution genuinely withdrawn is not yet withdrawable through delivery.
+so a host must keep the binding until a tombstone arrives, and a solution
+genuinely withdrawn is not yet withdrawable through delivery.
+
+**The document does not merely stop being refreshed — Argo deletes it.** When no
+binding is rendered the inventory records no binding path, so the promotion
+emits no ApplicationSet element for it; dropping an element deletes its
+Application, and the Application template carries
+`finalizers: [resources-finalizer.argocd.argoproj.io]` with
+`syncPolicy.automated.prune: true`. The delivered ConfigMaps are cascade-deleted
+from the cluster.
+
+So a reconciler cannot treat "the document is gone" as "nothing to do". It has
+to hold the binding across the document's disappearance, or removing a `host`
+declaration — or a module ceasing to be a solution — silently withdraws every
+binding it delivered. That is a requirement delivery places on the host, not
+something the host can infer from what it observes.
@@ -89,11 +89,19 @@ const (
 	moduleResourcesWave = "-1"
 	bootstrapUnitWave   = "0"
 	consumerUnitWave    = "1"
-	// Declared presence lands last: a SolutionHostBinding pins the digests of
-	// the artifacts this generation rendered, so declaring it before those
-	// artifacts are healthy would declare a presence the delivery has not yet
-	// produced.
-	solutionHostBindingWave = "2"
+	// Declared presence lands with the module's own resources, before any unit.
+	//
+	// It was briefly placed last, on the reasoning that a binding pins the
+	// digests of this generation's artifacts and should not be declared before
+	// they are healthy. That reasoning is wrong twice over. The digests are
+	// taken over rendered bytes in the delivery repository, which exist at
+	// delivery time whatever the cluster is doing, so nothing about them needs
+	// the workload running first. And Argo only starts a wave once the previous
+	// one is healthy, so a solution whose Deployment crashloops would never
+	// have its binding applied — withholding the declaration of desired state
+	// exactly when actual state has diverged from it, which is when a host most
+	// needs it.
+	solutionHostBindingWave = moduleResourcesWave
 )
 
 func unitWave(unit *InventoryUnit) string {
 
@@ -104,9 +104,7 @@ func RenderOwnedTree(ctx context.Context, opts *RenderOptions, generate func(con
 	if err != nil {
 		return RenderResult{}, err
 	}
-	if len(bindings) > 0 {
-		opts.SolutionHostBindingPath = solutionHostBindingDir
-	}
+	opts.SolutionHostBindingPath = deliveredBindingPath(bindings)
 	manifests, err := validateTree(owned, opts)
 	if err != nil {
 		return RenderResult{}, err
 
@@ -78,12 +78,20 @@ const (
 	kindConfigMap = "ConfigMap"
 )
 
-// routeAliasPattern is narrower than core's namePattern on purpose. core admits
-// a dotted or slashed alias; a host keys its registry on the alias as a single
-// URL path segment, and a slashed alias cannot be one. Rendering an alias the
-// host would have to map is worse than refusing it here, where the composition
-// that authored it is in hand.
-var routeAliasPattern = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`)
+// rfc1123Label is one lowercase DNS label. Two different things in this file
+// must each be one, for two different reasons, and both are narrower than what
+// core accepts:
+//
+//   - A route alias, because a host keys its registry on it as a single URL
+//     path segment, and core's namePattern admits dots and slashes.
+//   - Every part of a binding ID, because the ID becomes a Kubernetes object
+//     name, and core's bindingPattern deliberately admits uppercase and
+//     underscores so that a ULID or a UUID can be a binding ID.
+//
+// Refusing here is the whole point: both would otherwise sail through the
+// render and the publish and fail only when ArgoCD applies the manifest — the
+// late, opaque error solutionNamespace exists to prevent for namespaces.
+var rfc1123Label = regexp.MustCompile(`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`)
 
 // bindingIDMaxLength bounds a binding ID to one Kubernetes label value, which
 // is stricter than core's 128. The ID is stamped as a label so a host can find
@@ -217,7 +225,7 @@ func solutionHostBinding(owned string, opts *RenderOptions, instance *SolutionIn
 	if err != nil {
 		return nil, fmt.Errorf("solution %s: %w", instance.Name, err)
 	}
-	if !routeAliasPattern.MatchString(instance.Alias) {
+	if !rfc1123Label.MatchString(instance.Alias) {
 		return nil, fmt.Errorf(
 			"solution %s claims the route alias %q; a host keys its registry on the alias as one URL path segment, so it must be lowercase letters, digits and dashes, starting and ending alphanumeric",
 			instance.Name, instance.Alias)
@@ -295,8 +303,17 @@ func bindingID(workspace, environment, instance string) (string, error) {
 		if part.value == "" {
 			return "", fmt.Errorf("solution host binding ID needs the %s name", part.label)
 		}
-		if strings.ContainsAny(part.value, "./ ") {
-			return "", fmt.Errorf("solution host binding ID cannot be built from %s %q: it joins its parts on \".\"", part.label, part.value)
+		// Each part must be one lowercase DNS label. core's bindingPattern is
+		// wider — it admits uppercase and underscores so a ULID or UUID can be
+		// a binding ID — so core's own Validate accepts "My_Workspace.prod.crm"
+		// and the render would deliver a ConfigMap named
+		// "solution-host-binding-My_Workspace.prod.crm", which is not a legal
+		// Kubernetes object name. Nothing downstream refuses that: the tree
+		// validates, the publish succeeds, and ArgoCD fails at sync.
+		if !rfc1123Label.MatchString(part.value) {
+			return "", fmt.Errorf(
+				"solution host binding ID cannot be built from %s %q: the ID names a Kubernetes object, so each part must be lowercase letters, digits and dashes, starting and ending alphanumeric",
+				part.label, part.value)
 		}
 	}
 	id := strings.Join([]string{workspace, environment, instance}, ".")
@@ -538,6 +555,23 @@ func writeSolutionHostBindingKustomization(owned, environment string, names []st
 	return nil
 }
 
+// deliveredBindingPath is the render subdirectory the inventory records, derived
+// from what this render actually wrote.
+//
+// It is computed unconditionally, and that is the point. Setting the field only
+// when a binding was written leaves a previous render's value in place on a
+// reused RenderOptions, and the inventory then claims a delivery path the tree
+// does not have. Both readers of that field — generateArgoBootstrap and
+// snapshotAuthority — kustomize-build "<path>/overlays/<environment>", so a
+// stale value does not degrade to the old behaviour: it refuses the whole
+// publication with "build promotion source ...: must build at directory".
+func deliveredBindingPath(bindings []DeclaredSolutionHostBinding) string {
+	if len(bindings) == 0 {
+		return ""
+	}
+	return solutionHostBindingDir
+}
+
 // undeclaredSolutions names the solution instances this render delivered
 // workloads for without declaring a binding, because the environment names no
 // host. An empty SolutionHostBindings list alone cannot say that: a composition
 
@@ -558,10 +558,15 @@ func TestDeclaredBindingsReachArgo(t *testing.T) {
 	if !strings.Contains(set, "overlay: "+overlay) {
 		t.Fatalf("no Argo Application delivers the declared bindings:\n%s", set)
 	}
-	// Last: a binding pins the digests of artifacts this generation rendered,
-	// so it is declared after they are healthy, never before.
+	// With the module's own resources, before any unit. Argo starts a wave only
+	// once the previous is healthy, so a later wave would withhold the
+	// declaration of desired state from a solution whose workload is unhealthy
+	// — exactly when a host needs it.
 	if !strings.Contains(set, "wave: \""+solutionHostBindingWave+"\"") {
-		t.Fatalf("the bindings do not land in the last wave:\n%s", set)
+		t.Fatalf("the bindings do not land in the module-resources wave:\n%s", set)
+	}
+	if solutionHostBindingWave != moduleResourcesWave {
+		t.Fatalf("declared presence is gated behind the units it describes (wave %q)", solutionHostBindingWave)
 	}
 	cluster, namespaced, err := snapshotAuthority(root, inventory, "prod")
 	if err != nil {
@@ -704,3 +709,90 @@ func TestRenderingAnotherEnvironmentResetsTheGeneration(t *testing.T) {
 		t.Fatalf("the render did not report the generation it declared: %+v", result.SolutionHostBindings)
 	}
 }
+
+// TestBindingIDRefusesAPartThatCannotNameAKubernetesObject is the guard whose
+// absence let an invalid ConfigMap name reach ArgoCD.
+//
+// core's bindingPattern deliberately admits uppercase and underscores so a ULID
+// or a UUID can be a binding ID, so core's own Validate accepts
+// "My_Workspace.prod.crm" — and the render would then deliver a ConfigMap named
+// "solution-host-binding-My_Workspace.prod.crm", which Kubernetes refuses as an
+// object name. Nothing downstream catches it: the tree validates and the
+// publish succeeds, so the first refusal is ArgoCD at sync, far from here.
+func TestBindingIDRefusesAPartThatCannotNameAKubernetesObject(t *testing.T) {
+	for name, part := range map[string]struct{ workspace, environment, instance string }{
+		"uppercase workspace":   {"My_Workspace", "prod", "crm"},
+		"capitalised":           {"Obin", "prod", "crm"},
+		"underscore":            {"obin_prod", "prod", "crm"},
+		"uppercase instance":    {"obin", "prod", "CRM"},
+		"leading dash":          {"obin", "prod", "-crm"},
+		"trailing dash":         {"obin", "prod", "crm-"},
+		"uppercase environment": {"obin", "Prod", "crm"},
+	} {
+		t.Run(name, func(t *testing.T) {
+			id, err := bindingID(part.workspace, part.environment, part.instance)
+			if err == nil {
+				t.Fatalf("binding ID %q was accepted; it would name the ConfigMap %q", id, solutionHostBindingKind+"-"+id)
+			}
+			if !strings.Contains(err.Error(), "Kubernetes object") {
+				t.Fatalf("refused for the wrong reason: %v", err)
+			}
+		})
+	}
+	if _, err := bindingID("obin", "prod", "crm-eu-1"); err != nil {
+		t.Fatalf("a legal binding ID was refused: %v", err)
+	}
+}
+
+// TestRenderRefusesAWorkspaceThatCannotNameAKubernetesObject drives the same
+// refusal through the render, so the guard is exercised where it matters and
+// not only in the helper.
+func TestRenderRefusesAWorkspaceThatCannotNameAKubernetesObject(t *testing.T) {
+	destination := filepath.Join(t.TempDir(), "modules", "crm")
+	options := solutionRenderOptions(destination)
+	options.Workspace = "My_Workspace"
+	_, err := RenderOwnedTree(context.Background(), options, renderWorkload(pinnedDeployment))
+	if err == nil || !strings.Contains(err.Error(), "Kubernetes object") {
+		t.Fatalf("the render delivered a document ArgoCD would refuse: %v", err)
+	}
+}
+
+// TestARenderThatDeclaresNothingClearsTheDeliveryPath is the guard whose
+// absence refused an entire publication.
+//
+// The inventory field is what points publish at the binding overlay. Writing it
+// only when a binding was written leaves a previous render's value in place on
+// a reused RenderOptions, and both readers of the field kustomize-build
+// "<path>/overlays/<environment>" — so a stale value is not a cosmetic
+// inaccuracy, it fails generateArgoBootstrap and refuses the whole publication.
+func TestARenderThatDeclaresNothingClearsTheDeliveryPath(t *testing.T) {
+	destination := filepath.Join(t.TempDir(), "modules", "crm")
+	options := solutionRenderOptions(destination)
+	first, err := RenderOwnedTree(context.Background(), options, renderWorkload(pinnedDeployment))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if first.Inventory.SolutionHostBindingPath != solutionHostBindingDir {
+		t.Fatalf("the first render recorded no delivery path: %q", first.Inventory.SolutionHostBindingPath)
+	}
+	// The operator removes the host declaration and re-renders with the same
+	// options, as a caller that holds one render's options would.
+	options.Host = nil
+	second, err := RenderOwnedTree(context.Background(), options, renderWorkload(pinnedDeployment))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if second.Inventory.SolutionHostBindingPath != "" {
+		t.Fatalf("the inventory still claims %q; the tree has no such directory, and publish builds it",
+			second.Inventory.SolutionHostBindingPath)
+	}
+	// The field and the tree must agree: the directory really is gone, so a
+	// non-empty field would point publish at nothing. (What publish then does
+	// with a path that is present is covered by TestDeclaredBindingsReachArgo.)
+	if _, statErr := os.Stat(filepath.Join(destination, solutionHostBindingDir)); !os.IsNotExist(statErr) {
+		t.Fatalf("the binding directory survived a render that declared none: %v", statErr)
+	}
+	if len(second.UndeclaredSolutions) != 1 || second.UndeclaredSolutions[0] != "crm" {
+		t.Fatalf("the render did not report what it could not declare: %v", second.UndeclaredSolutions)
+	}
+}