pkg/deployer/testing/integration_test_helper.go:328

• DeploySpec.Expose is observed state and won’t affect deployment intent; use Function.Expose to opt out of exposure in these integration tests.

		Deploy:    fn.DeploySpec{Expose: "none"},

pkg/deployer/testing/integration_test_helper.go:172

• DeploySpec.Expose is observed state and won’t affect deployment intent; use Function.Expose to opt out of exposure in these integration tests.

		Deploy:    fn.DeploySpec{Expose: "none"},

pkg/deployer/testing/integration_test_helper.go:412

• DeploySpec.Expose is observed state and won’t affect deployment intent; use Function.Expose to opt out of exposure in these integration tests.

		Deploy:    fn.DeploySpec{Expose: "none"},

pkg/deployer/testing/integration_test_helper.go:528

• DeploySpec.Expose is observed state and won’t affect deployment intent; use Function.Expose to opt out of exposure in these integration tests.

		Deploy:    fn.DeploySpec{Expose: "none"},

pkg/deployer/testing/integration_test_helper.go:940

• DeploySpec.Expose is observed state and won’t affect deployment intent; use Function.Expose to opt out of exposure in these integration tests.

		Deploy:    fn.DeploySpec{Expose: "none"},

pkg/deployer/testing/integration_test_helper.go:1248

• DeploySpec.Expose is observed state and won’t affect deployment intent; use Function.Expose to opt out of exposure in these integration tests.

		Deploy:    fn.DeploySpec{Expose: "none"},

pkg/keda/deployer.go:187

• When an exposed function is redeployed after the interceptor moves namespaces (for example, upstream keda to CMA's openshift-keda), this creates a Route in the newly detected namespace while the Service still records the old namespace. Because active exposure skips the teardown branch and later overwrites that record, the old ownerless Route is permanently orphaned. Reconcile a differing recorded namespace by removing the old Route after the new Route/HSO is ready and before replacing the annotation.
  pkg/functions/client.go:932
• This warning also fires for the Knative deployer when expose: route is present: Knative intentionally leaves result.Expose empty because it ignores this field, while still exposing the function through its own networking. That produces a second, false warning after warnExposeIgnore. Match the remote-deploy path and exclude Knative results here.

	if ActiveExpose(f.Expose) && result.Expose == "" {

pkg/ocproute/route.go:412

• A rejection from one router ends polling immediately, even when another ingress entry is still pending and may subsequently become Admitted=True. Since router shards update status independently, this makes list timing determine whether a valid multi-router Route succeeds. Keep the rejection as lastErr, but continue polling until an admission arrives (or until rejection can be established for every expected shard).

pkg/keda/deployer.go:200

• After Expose succeeds, an HTTPScaledObject create/update/readiness failure returns here without removing a newly admitted Route. That keda Route is ownerless and has not yet been recorded on the Service, so a later --expose=none skips it; if the HSO becomes ready after the timeout, the unrecorded address can serve traffic. Roll back Routes created in this attempt (while leaving a previously recorded Route intact) and report any rollback failure.
  cmd/errors.go:238
• This names the wrong configuration field: users request exposure through top-level expose/--expose, while deploy.expose is observed state written after deployment. Referring users to deploy.expose encourages editing a status field that does not control deployment.

deploy.expose takes effect with the raw and keda deployers only (--deployer=raw or --deployer=keda).

pkg/keda/deployer.go:221

• This overwrites the only Route-location record without reconciling its previous value. If the interceptor moves between the supported keda and openshift-keda namespaces, an active redeploy creates a Route in the new namespace but leaves the old ownerless Route behind; subsequent delete follows only the new record, so the old Route survives indefinitely. Reconcile the previously recorded namespace when it differs before replacing the record, with rollback if cleanup fails.

pkg/keda/deployer.go:256

• If ensureHTTPScaledObject fails after a first-time Expose, the newly created KEDA Route is returned without rollback. No Service annotation has been recorded yet, and this ownerless Route is therefore invisible to --expose=none and the current remover, so it can remain externally admitted indefinitely. Make this step transactional by rolling back only a Route created/replaced by this call (while preserving a pre-existing Route).
  pkg/keda/remover.go:58
• The PR promises a best-effort candidate-namespace sweep for Routes left unrecorded by a crash, but this explicitly skips that cleanup. Because KEDA Routes have no owner reference, deleting such a function removes the only remaining identity record and leaves the Route serving indefinitely. Restore the best-effort sweep, warning and skipping only candidate namespaces that are not visible.
  pkg/k8s/deployer.go:718
• These internal record keys are still accepted from f.Deploy.Annotations. On a new cluster-local raw deployment, a user-supplied function.knative.dev/route-hostname with no namespace survives this generation path; resolveExposure does not clear it, and list/describe then advertise a nonexistent HTTPS Route. Strip both record annotations before reapplying a coherent record from existingService.

	// Unlike the annotations above, which always regenerate, the exposure
	// record is re-applied: it is cluster-derived, written only once the Route
	// is admitted, and this Update replaces the whole annotation map.
	if existingService != nil && existingService.Annotations[RouteHostnameAnnotation] != "" {

cmd/errors.go:238

• This guidance names deploy.expose, but that field is observed state and users configure the top-level expose field. The message currently directs users editing func.yaml to the wrong key.

deploy.expose takes effect with the raw and keda deployers only (--deployer=raw or --deployer=keda).

pkg/keda/deployer.go:264

• The existing Service record is ignored when the resolved interceptor namespace changes between keda and openshift-keda. With a router-minted host this creates a second ownerless Route, overwrites the only pointer, and strands the old Route; with a custom host the old Route can retain the host claim and prevent the new Route from being admitted at all. Reconcile the recorded old namespace transactionally when moving the exposure.
  pkg/k8s/deployer.go:308
• Correct the typo in this comment.

// lable map, including domain. If desired's podtemplate no longer matches a

pkg/keda/remover.go:59

• When this annotation is empty, deletion never searches either interceptor namespace. A crash (or an HSO failure after Expose) can leave an ownerless keda Route before the Service record is written; func delete then removes the function but leaves that Route behind, contrary to the PR's promised best-effort cleanup. Restore the candidate-namespace sweep for the no-record case, warning and skipping namespaces that are not visible.
  pkg/keda/deployer.go:257
• On a first exposure, Expose has already created the ownerless keda Route. If the HSO write fails here, the function returns before recording the Route namespace, so later --expose=none cannot remove it and the failed deploy leaves an orphan. Roll back when there was no pre-existing exposure record, while retaining an existing recorded Route on redeploy failures.
  pkg/keda/deployer.go:416
• Corrected “server” to “serve” in the comment.
  cmd/errors.go:238
• The intended setting is the top-level expose field; deploy.expose is observed state and is not where users configure this. The recovery guidance currently directs users to the wrong YAML key.

deploy.expose takes effect with the raw and keda deployers only (--deployer=raw or --deployer=keda).

pkg/functions/client.go:899

• %q already adds quotes, so surrounding it with single quotes prints values like '"old-ns"'. Remove the extra quoting so the namespace-change message is readable.

			fmt.Fprintf(os.Stderr, "Moving Function namespace from '%q' to '%q' \n", f.Deploy.Namespace, f.Namespace)

pkg/k8s/deployer.go:308

• Corrected spelling of “lable” to “label”.

// lable map, including domain. If desired's podtemplate no longer matches a

cmd/deploy.go:321

• Add the missing apostrophe in “Don't”.

	// Dont error here, knative + expose=route means expose key is ignored and

pkg/ocproute/route.go:139

• list.Items also contains Routes with the same identity labels but a different deployer annotation, which this loop skips. Reporting its length can therefore claim the wrong number of managed Routes. Avoid the count (or track managed matches separately) in this ambiguity error.