diff --git a/CHANGELOG.md b/CHANGELOG.md
index ac89647..9dc07b7 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 - **Release-time bench workflow** (`.github/workflows/bench.yml`). Manually triggered (`workflow_dispatch`) against a release tag, branch, or SHA; runs the full 8-profile bench matrix on a self-hosted runner (label `bench-runner`) and persists the resulting JSON to the `bench-history` orphan branch under `bench-history/<label>.json`. The orphan branch is self-bootstrapped on first run. A markdown table of source-update / self-heal / ns-flip p99 latencies by profile is rendered into the workflow's step summary, and the bench JSON is uploaded as an artifact. `pull_request` triggers are deliberately omitted — self-hosted runners on public repos are exposed to fork-PR malicious code, so this workflow is operator-driven only. Per-PR shape-break smoke coverage continues to run on `ubuntu-22.04` via `bench-smoke.yml`.
 
+### Changed
+
+- `spec.source.version` is now optional for the core group. Reference core sources by `kind` alone (e.g. `kind: ConfigMap`); the operator resolves the preferred served version via the RESTMapper. Existing manifests with explicit `version: v1` continue to work unchanged. ([#97](https://github.com/projection-operator/projection/pull/97))
+- Renamed the `Destination` print column to `Destination-Name` on both `Projection` and `ClusterProjection`. Symmetric with `Source-Name`, matches the underlying JSONPath (`.status.destinationName`), and removes the where-vs-what ambiguity on `ClusterProjection` (where `Destination` sat next to the `Targets` namespace count). Scripts that parse `kubectl get projection` table output by column name need to be updated. ([#97](https://github.com/projection-operator/projection/pull/97))
+
 ### Fixed
 
 - A `Projection` or `ClusterProjection` whose source object was never created now reports `SourceResolved=False, reason=SourceNotFound, message="source X/Y not found"`. Previously every source-NotFound case was bucketed as `reason=SourceDeleted` with the message `"source X/Y has been deleted"` — accurate when the source had previously existed and was deleted, but a lie when the source never existed in the first place. The two cases are now distinguished by `status.destinationName`: empty (never resolved) → `SourceNotFound`; populated (we previously projected it) → `SourceDeleted`. The `SourceDeleted` reason value is unchanged for the genuine deletion case; alerts on `Ready=False` continue to fire for both reasons.
diff --git a/CLAUDE.md b/CLAUDE.md
index f3f715d..b010cd2 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -9,7 +9,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 - `Projection` — namespaced, single-target. Mirrors one Kubernetes object identified by `(group, version, kind, namespace, name)` into the Projection's own `metadata.namespace`. `spec.destination.name` is optional (defaults to `source.name`); there is no `destination.namespace` field. Use this for "tenant in namespace X needs a copy of object Y".
 - `ClusterProjection` — cluster-scoped, fan-out. Mirrors one source object into either an explicit list `destination.namespaces: [a, b, c]` (with `minItems=1`) OR a `destination.namespaceSelector` matching namespaces by label. CEL admission enforces XOR + at-least-one. Use this for "every namespace matching X needs a copy of Y".
 
-Both CRDs share the same `SourceRef{Group, Version, Kind, Namespace, Name}` (all required, all pattern-validated at admission). CEL on SourceRef requires `version` when `group` is empty (i.e. core kinds must specify v1). Non-core groups can omit `version` for preferred-version lookup via the RESTMapper. Both CRDs accept an optional `spec.overlay{Labels, Annotations}` that merges on top of the source with overlay winning on conflicts.
+Both CRDs share the same `SourceRef{Group, Version, Kind, Namespace, Name}` (only `Kind`/`Namespace`/`Name` required; `Group` and `Version` optional, all pattern-validated at admission). When `version` is empty the controller resolves the RESTMapper's preferred served version on every reconcile (for the core group, currently `v1`); set `version` explicitly to pin. Both CRDs accept an optional `spec.overlay{Labels, Annotations}` that merges on top of the source with overlay winning on conflicts.
 
 The controller fully implements the write side: it fetches the source via the dynamic client, strips server-owned metadata and `.status`, applies the overlay, stamps a per-CRD-scope ownership annotation, and creates or updates the destination. ClusterProjection iterates target namespaces in parallel (cap `--selector-write-concurrency`, default 16), tracks per-namespace success/failure into `status.namespacesWritten` / `status.namespacesFailed`, rolls up `DestinationWritten`, and cleans up stale destinations when namespaces stop matching the selector or get removed from the list. Distinct finalizers (`projection.sh/finalizer` for Projection, `projection.sh/cluster-finalizer` for ClusterProjection) clean up every owned destination on CR deletion. Source edits propagate via dynamic watches (`ensureSourceWatch`); manual `kubectl delete` of a destination triggers immediate re-creation via a label-filtered watch on the destination GVK (`ensureDestWatch`).
 
@@ -43,7 +43,7 @@ Tool binaries (kustomize, controller-gen, setup-envtest, golangci-lint, crd-ref-
 
 **CRDs (`api/v1/`)** — three files:
 
-- `source_types.go` defines the shared `SourceRef{Group, Version, Kind, Namespace, Name}` (DNS-1123 namespace, PascalCase Kind, regex-validated group/version/name). CEL: `size(self.group) != 0 || size(self.version) != 0`.
+- `source_types.go` defines the shared `SourceRef{Group, Version, Kind, Namespace, Name}` (DNS-1123 namespace, PascalCase Kind, regex-validated group/version/name). Both `group` and `version` are optional; empty `version` resolves to the RESTMapper's preferred served version (for the core group, currently `v1`).
 - `projection_types.go` defines `Projection` (scope: Namespaced) with `Spec{Source, Destination ProjectionDestination{Name string}, Overlay}` and `Status{DestinationName string, Conditions []Condition}` (Ready, SourceResolved, DestinationWritten). Printcolumns: Source, Destination, Ready, Age.
 - `clusterprojection_types.go` defines `ClusterProjection` (scope: Cluster) with `Spec{Source, Destination ClusterDestination{Namespaces []string +listType=set +minItems=1, NamespaceSelector LabelSelector}, Overlay}` plus two CEL admission rules on `ClusterProjectionDestination`: `!(has(self.namespaces) && has(self.namespaceSelector))` (mutex) and `has(self.namespaces) || has(self.namespaceSelector)` (at-least-one). `Status{DestinationName string, NamespacesWritten int32, NamespacesFailed int32, Conditions []Condition}`. Printcolumns: Source, Destination, Written, Failed, Ready, Age.
 
diff --git a/README.md b/README.md
index bad2987..046c4ac 100644
--- a/README.md
+++ b/README.md
@@ -71,8 +71,6 @@ metadata:
   namespace: tenant-a            # destination namespace = this
 spec:
   source:
-    group: ""                    # core API
-    version: v1
     kind: ConfigMap
     name: app-config
     namespace: platform
@@ -83,8 +81,8 @@ spec:
 
 ```console
 $ kubectl get projections -A
-NAMESPACE   NAME                KIND        SOURCE-NAMESPACE   SOURCE-NAME   DESTINATION   READY   AGE
-tenant-a    app-config-mirror   ConfigMap   platform           app-config    app-config    True    2s
+NAMESPACE   NAME                KIND        SOURCE-NAMESPACE   SOURCE-NAME   DESTINATION-NAME   READY   AGE
+tenant-a    app-config-mirror   ConfigMap   platform           app-config    app-config         True    2s
 
 $ kubectl get configmap -n tenant-a app-config -o jsonpath='{.metadata.annotations.projection\.sh/owned-by-projection}'
 tenant-a/app-config-mirror
@@ -99,14 +97,14 @@ Need to mirror into many namespaces from one source? Use `ClusterProjection` (cl
 ## Features
 
 - **Two CRDs, two RBAC tiers** — namespaced `Projection` for in-namespace single-target mirrors (destination namespace is structurally the Projection's own), cluster-scoped `ClusterProjection` for fan-out (`destination.namespaces: [a, b, c]` or `destination.namespaceSelector`). Tenants can self-serve `Projection` via the chart's `rbac.aggregate=true` default; `ClusterProjection` requires an explicit cluster-admin binding.
-- **Any Kind** — `RESTMapper`-driven GVR resolution. Works on built-in resources, your CRDs, anything the apiserver knows about. Source uses split `group` + `version` fields; for non-core groups, omitting `version` triggers preferred-version lookup that follows CRD promotions.
+- **Any Kind** — `RESTMapper`-driven GVR resolution. Works on built-in resources, your CRDs, anything the apiserver knows about. Source uses split `group` + `version` fields; omitting `version` triggers preferred-version lookup for any group, so the projection follows version promotions automatically.
 - **Watch-driven** — dynamic informer registration per source GVK on first reference. Edits propagate in ~100ms; no periodic polling. A label-filtered destination-side watch (`ensureDestWatch`) makes manual `kubectl delete` of a destination trigger an immediate reconcile.
 - **Fan-out across namespaces** — one `ClusterProjection` mirrors its source into every namespace listed in `destination.namespaces` or matching a `destination.namespaceSelector`. Destinations are added and removed as namespaces gain or lose the matching label. Bounded fan-out concurrency keeps the apiserver healthy at scale.
 - **Source-owner consent** — default `sourceMode=allowlist` requires sources to carry `projection.sh/projectable="true"`. Source owners can also veto with `="false"` regardless of mode.
 - **Conflict-safe** — `projection.sh/owned-by-projection` (or `projection.sh/owned-by-cluster-projection`) annotation marks our destinations. We refuse to overwrite objects we don't own and report `DestinationConflict` on status. Source deletion (404) automatically cleans up every owned destination.
 - **Clean deletion** — finalizers remove destinations on CR deletion. The cluster CRD's finalizer sweeps every owned destination across the cluster; the namespaced CRD's finalizer cleans up its single in-namespace destination. If ownership has been stripped, we leave the object alone.
 - **Observable** — three status conditions (`SourceResolved`, `DestinationWritten`, `Ready`), `events.k8s.io/v1` Events with `action` verbs (Create/Update/Delete/Get/Validate/Resolve/Write), per-fan-out counters (`status.namespacesWritten`, `status.namespacesFailed`), and Prometheus metrics (`projection_reconcile_total{kind,result}`, `projection_watched_gvks`, `projection_watched_dest_gvks`).
-- **Validated at admission** — `Source` fields are pattern-validated (DNS-1123 names, PascalCase Kinds) so typos fail at `kubectl apply`, not at runtime. CEL enforces `version` required when `group` is empty, and `namespaces` ⊕ `namespaceSelector` mutual exclusion on `ClusterProjection.destination`.
+- **Validated at admission** — `Source` fields are pattern-validated (DNS-1123 names, PascalCase Kinds) so typos fail at `kubectl apply`, not at runtime. CEL enforces `namespaces` ⊕ `namespaceSelector` mutual exclusion (and at-least-one) on `ClusterProjection.destination`.
 - **Smart copy** — strips server-owned metadata, drops `.status`, removes `kubectl.kubernetes.io/last-applied-configuration`, strips Kind-specific apiserver-allocated spec fields (Service `clusterIP`/`clusterIPs`, PVC `volumeName`, Pod `nodeName`, Job `selector`+controller-uid labels), and preserves them on update.
 - **Production-grade Helm chart** — opt-in `ServiceMonitor`, `NetworkPolicy` (egress lockdown), and `PodDisruptionBudget` templates. Three ClusterRoles for tenant self-service vs cluster-tier authority. Operational tuning via `requeueInterval`, `leaderElection.leaseDuration`, and `selectorWriteConcurrency`. RBAC scope narrowable via `supportedKinds`.
 - **Small** — two CRDs, one Deployment, one container. Distroless image, multi-arch (amd64, arm64).
diff --git a/api/v1/clusterprojection_types.go b/api/v1/clusterprojection_types.go
index 04368f9..46de00c 100644
--- a/api/v1/clusterprojection_types.go
+++ b/api/v1/clusterprojection_types.go
@@ -100,7 +100,7 @@ type ClusterProjectionStatus struct {
 // +kubebuilder:printcolumn:name="Source-Group",type=string,JSONPath=`.spec.source.group`,priority=1
 // +kubebuilder:printcolumn:name="Source-Namespace",type=string,JSONPath=`.spec.source.namespace`
 // +kubebuilder:printcolumn:name="Source-Name",type=string,JSONPath=`.spec.source.name`
-// +kubebuilder:printcolumn:name="Destination",type=string,JSONPath=`.status.destinationName`
+// +kubebuilder:printcolumn:name="Destination-Name",type=string,JSONPath=`.status.destinationName`
 // +kubebuilder:printcolumn:name="Targets",type=integer,JSONPath=`.status.namespacesWritten`
 // +kubebuilder:printcolumn:name="Failed",type=integer,JSONPath=`.status.namespacesFailed`,priority=1
 // +kubebuilder:printcolumn:name="Selector",type=string,JSONPath=`.spec.destination.namespaceSelector.matchLabels`,priority=1
diff --git a/api/v1/projection_types.go b/api/v1/projection_types.go
index 0d43766..41a51f3 100644
--- a/api/v1/projection_types.go
+++ b/api/v1/projection_types.go
@@ -72,7 +72,7 @@ type ProjectionStatus struct {
 // +kubebuilder:printcolumn:name="Source-Group",type=string,JSONPath=`.spec.source.group`,priority=1
 // +kubebuilder:printcolumn:name="Source-Namespace",type=string,JSONPath=`.spec.source.namespace`
 // +kubebuilder:printcolumn:name="Source-Name",type=string,JSONPath=`.spec.source.name`
-// +kubebuilder:printcolumn:name="Destination",type=string,JSONPath=`.status.destinationName`
+// +kubebuilder:printcolumn:name="Destination-Name",type=string,JSONPath=`.status.destinationName`
 // +kubebuilder:printcolumn:name="Ready",type=string,JSONPath=`.status.conditions[?(@.type=='Ready')].status`
 // +kubebuilder:printcolumn:name="Age",type=date,JSONPath=`.metadata.creationTimestamp`
 
diff --git a/api/v1/source_types.go b/api/v1/source_types.go
index f4407de..675e249 100644
--- a/api/v1/source_types.go
+++ b/api/v1/source_types.go
@@ -20,12 +20,12 @@ package v1
 //
 // Group + Version + Kind name the GVK; Namespace + Name name the object.
 //
-// `version` may be omitted for non-core groups, in which case the operator
-// resolves the preferred served version via the RESTMapper on every
-// reconcile. The core group has only `v1` as a stable form, so `version`
-// MUST be set when `group` is empty — enforced by the CEL rule below.
-//
-// +kubebuilder:validation:XValidation:rule="size(self.group) != 0 || size(self.version) != 0",message="version is required when group is empty (no unpinned form for core)"
+// Both `group` and `version` may be omitted. Empty `group` means the core
+// group (e.g. ConfigMap, Secret, Service). Empty `version` means the
+// operator resolves the preferred served version via the RESTMapper on
+// every reconcile, so the source automatically follows version promotions
+// (e.g. CRD `v1beta1 → v1`; or, hypothetically, core `v1 → v2`). Set
+// `version` explicitly to pin.
 type SourceRef struct {
 	// Group is the API group of the source object. Empty string means the
 	// core group (e.g. ConfigMap, Secret, Service).
@@ -34,10 +34,10 @@ type SourceRef struct {
 	Group string `json:"group,omitempty"`
 
 	// Version is the API version of the source object within its Group. Omit
-	// for non-core groups to use the RESTMapper's preferred served version
-	// (the source automatically follows CRD version promotions). When set,
-	// must match Kubernetes' canonical version-string shape (`vN`,
-	// `vNalphaM`, `vNbetaM`).
+	// to use the RESTMapper's preferred served version (the source
+	// automatically follows version promotions). When set, must match
+	// Kubernetes' canonical version-string shape (`vN`, `vNalphaM`,
+	// `vNbetaM`).
 	// +optional
 	// +kubebuilder:validation:Pattern=`^$|^v[0-9]+((alpha|beta)[0-9]+)?$`
 	Version string `json:"version,omitempty"`
diff --git a/api/v1/testdata/clusterprojection.crd.golden.yaml b/api/v1/testdata/clusterprojection.crd.golden.yaml
index 409583c..be8c6d0 100644
--- a/api/v1/testdata/clusterprojection.crd.golden.yaml
+++ b/api/v1/testdata/clusterprojection.crd.golden.yaml
@@ -31,7 +31,7 @@ spec:
       name: Source-Name
       type: string
     - jsonPath: .status.destinationName
-      name: Destination
+      name: Destination-Name
       type: string
     - jsonPath: .status.namespacesWritten
       name: Targets
@@ -205,10 +205,10 @@ spec:
                   version:
                     description: |-
                       Version is the API version of the source object within its Group. Omit
-                      for non-core groups to use the RESTMapper's preferred served version
-                      (the source automatically follows CRD version promotions). When set,
-                      must match Kubernetes' canonical version-string shape (`vN`,
-                      `vNalphaM`, `vNbetaM`).
+                      to use the RESTMapper's preferred served version (the source
+                      automatically follows version promotions). When set, must match
+                      Kubernetes' canonical version-string shape (`vN`, `vNalphaM`,
+                      `vNbetaM`).
                     pattern: ^$|^v[0-9]+((alpha|beta)[0-9]+)?$
                     type: string
                 required:
@@ -216,10 +216,6 @@ spec:
                 - name
                 - namespace
                 type: object
-                x-kubernetes-validations:
-                - message: version is required when group is empty (no unpinned form
-                    for core)
-                  rule: size(self.group) != 0 || size(self.version) != 0
             required:
             - destination
             - source
diff --git a/api/v1/testdata/crd.golden.yaml b/api/v1/testdata/crd.golden.yaml
index f50e61f..2a249ee 100644
--- a/api/v1/testdata/crd.golden.yaml
+++ b/api/v1/testdata/crd.golden.yaml
@@ -31,7 +31,7 @@ spec:
       name: Source-Name
       type: string
     - jsonPath: .status.destinationName
-      name: Destination
+      name: Destination-Name
       type: string
     - jsonPath: .status.conditions[?(@.type=='Ready')].status
       name: Ready
@@ -131,10 +131,10 @@ spec:
                   version:
                     description: |-
                       Version is the API version of the source object within its Group. Omit
-                      for non-core groups to use the RESTMapper's preferred served version
-                      (the source automatically follows CRD version promotions). When set,
-                      must match Kubernetes' canonical version-string shape (`vN`,
-                      `vNalphaM`, `vNbetaM`).
+                      to use the RESTMapper's preferred served version (the source
+                      automatically follows version promotions). When set, must match
+                      Kubernetes' canonical version-string shape (`vN`, `vNalphaM`,
+                      `vNbetaM`).
                     pattern: ^$|^v[0-9]+((alpha|beta)[0-9]+)?$
                     type: string
                 required:
@@ -142,10 +142,6 @@ spec:
                 - name
                 - namespace
                 type: object
-                x-kubernetes-validations:
-                - message: version is required when group is empty (no unpinned form
-                    for core)
-                  rule: size(self.group) != 0 || size(self.version) != 0
             required:
             - source
             type: object
diff --git a/charts/projection/crds/clusterprojections.projection.sh.yaml b/charts/projection/crds/clusterprojections.projection.sh.yaml
index 409583c..be8c6d0 100644
--- a/charts/projection/crds/clusterprojections.projection.sh.yaml
+++ b/charts/projection/crds/clusterprojections.projection.sh.yaml
@@ -31,7 +31,7 @@ spec:
       name: Source-Name
       type: string
     - jsonPath: .status.destinationName
-      name: Destination
+      name: Destination-Name
       type: string
     - jsonPath: .status.namespacesWritten
       name: Targets
@@ -205,10 +205,10 @@ spec:
                   version:
                     description: |-
                       Version is the API version of the source object within its Group. Omit
-                      for non-core groups to use the RESTMapper's preferred served version
-                      (the source automatically follows CRD version promotions). When set,
-                      must match Kubernetes' canonical version-string shape (`vN`,
-                      `vNalphaM`, `vNbetaM`).
+                      to use the RESTMapper's preferred served version (the source
+                      automatically follows version promotions). When set, must match
+                      Kubernetes' canonical version-string shape (`vN`, `vNalphaM`,
+                      `vNbetaM`).
                     pattern: ^$|^v[0-9]+((alpha|beta)[0-9]+)?$
                     type: string
                 required:
@@ -216,10 +216,6 @@ spec:
                 - name
                 - namespace
                 type: object
-                x-kubernetes-validations:
-                - message: version is required when group is empty (no unpinned form
-                    for core)
-                  rule: size(self.group) != 0 || size(self.version) != 0
             required:
             - destination
             - source
diff --git a/charts/projection/crds/projections.projection.sh.yaml b/charts/projection/crds/projections.projection.sh.yaml
index f50e61f..2a249ee 100644
--- a/charts/projection/crds/projections.projection.sh.yaml
+++ b/charts/projection/crds/projections.projection.sh.yaml
@@ -31,7 +31,7 @@ spec:
       name: Source-Name
       type: string
     - jsonPath: .status.destinationName
-      name: Destination
+      name: Destination-Name
       type: string
     - jsonPath: .status.conditions[?(@.type=='Ready')].status
       name: Ready
@@ -131,10 +131,10 @@ spec:
                   version:
                     description: |-
                       Version is the API version of the source object within its Group. Omit
-                      for non-core groups to use the RESTMapper's preferred served version
-                      (the source automatically follows CRD version promotions). When set,
-                      must match Kubernetes' canonical version-string shape (`vN`,
-                      `vNalphaM`, `vNbetaM`).
+                      to use the RESTMapper's preferred served version (the source
+                      automatically follows version promotions). When set, must match
+                      Kubernetes' canonical version-string shape (`vN`, `vNalphaM`,
+                      `vNbetaM`).
                     pattern: ^$|^v[0-9]+((alpha|beta)[0-9]+)?$
                     type: string
                 required:
@@ -142,10 +142,6 @@ spec:
                 - name
                 - namespace
                 type: object
-                x-kubernetes-validations:
-                - message: version is required when group is empty (no unpinned form
-                    for core)
-                  rule: size(self.group) != 0 || size(self.version) != 0
             required:
             - source
             type: object
diff --git a/config/crd/bases/projection.sh_clusterprojections.yaml b/config/crd/bases/projection.sh_clusterprojections.yaml
index 409583c..be8c6d0 100644
--- a/config/crd/bases/projection.sh_clusterprojections.yaml
+++ b/config/crd/bases/projection.sh_clusterprojections.yaml
@@ -31,7 +31,7 @@ spec:
       name: Source-Name
       type: string
     - jsonPath: .status.destinationName
-      name: Destination
+      name: Destination-Name
       type: string
     - jsonPath: .status.namespacesWritten
       name: Targets
@@ -205,10 +205,10 @@ spec:
                   version:
                     description: |-
                       Version is the API version of the source object within its Group. Omit
-                      for non-core groups to use the RESTMapper's preferred served version
-                      (the source automatically follows CRD version promotions). When set,
-                      must match Kubernetes' canonical version-string shape (`vN`,
-                      `vNalphaM`, `vNbetaM`).
+                      to use the RESTMapper's preferred served version (the source
+                      automatically follows version promotions). When set, must match
+                      Kubernetes' canonical version-string shape (`vN`, `vNalphaM`,
+                      `vNbetaM`).
                     pattern: ^$|^v[0-9]+((alpha|beta)[0-9]+)?$
                     type: string
                 required:
@@ -216,10 +216,6 @@ spec:
                 - name
                 - namespace
                 type: object
-                x-kubernetes-validations:
-                - message: version is required when group is empty (no unpinned form
-                    for core)
-                  rule: size(self.group) != 0 || size(self.version) != 0
             required:
             - destination
             - source
diff --git a/config/crd/bases/projection.sh_projections.yaml b/config/crd/bases/projection.sh_projections.yaml
index f50e61f..2a249ee 100644
--- a/config/crd/bases/projection.sh_projections.yaml
+++ b/config/crd/bases/projection.sh_projections.yaml
@@ -31,7 +31,7 @@ spec:
       name: Source-Name
       type: string
     - jsonPath: .status.destinationName
-      name: Destination
+      name: Destination-Name
       type: string
     - jsonPath: .status.conditions[?(@.type=='Ready')].status
       name: Ready
@@ -131,10 +131,10 @@ spec:
                   version:
                     description: |-
                       Version is the API version of the source object within its Group. Omit
-                      for non-core groups to use the RESTMapper's preferred served version
-                      (the source automatically follows CRD version promotions). When set,
-                      must match Kubernetes' canonical version-string shape (`vN`,
-                      `vNalphaM`, `vNbetaM`).
+                      to use the RESTMapper's preferred served version (the source
+                      automatically follows version promotions). When set, must match
+                      Kubernetes' canonical version-string shape (`vN`, `vNalphaM`,
+                      `vNbetaM`).
                     pattern: ^$|^v[0-9]+((alpha|beta)[0-9]+)?$
                     type: string
                 required:
@@ -142,10 +142,6 @@ spec:
                 - name
                 - namespace
                 type: object
-                x-kubernetes-validations:
-                - message: version is required when group is empty (no unpinned form
-                    for core)
-                  rule: size(self.group) != 0 || size(self.version) != 0
             required:
             - source
             type: object
diff --git a/config/samples/projection_v1_clusterprojection.yaml b/config/samples/projection_v1_clusterprojection.yaml
index 5fe17d9..3770716 100644
--- a/config/samples/projection_v1_clusterprojection.yaml
+++ b/config/samples/projection_v1_clusterprojection.yaml
@@ -7,8 +7,6 @@ metadata:
   name: clusterprojection-sample
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: shared-config
     namespace: config-source
diff --git a/config/samples/projection_v1_projection.yaml b/config/samples/projection_v1_projection.yaml
index f7e4c0f..0cc5cbd 100644
--- a/config/samples/projection_v1_projection.yaml
+++ b/config/samples/projection_v1_projection.yaml
@@ -7,8 +7,6 @@ metadata:
   name: projection-sample
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: cm-1
     namespace: ns-1
diff --git a/docs/api-reference.md b/docs/api-reference.md
index 5dff6a8..1de8ca9 100644
--- a/docs/api-reference.md
+++ b/docs/api-reference.md
@@ -248,10 +248,12 @@ SourceRef identifies the object to project.
 
 Group + Version + Kind name the GVK; Namespace + Name name the object.
 
-`version` may be omitted for non-core groups, in which case the operator
-resolves the preferred served version via the RESTMapper on every
-reconcile. The core group has only `v1` as a stable form, so `version`
-MUST be set when `group` is empty — enforced by the CEL rule below.
+Both `group` and `version` may be omitted. Empty `group` means the core
+group (e.g. ConfigMap, Secret, Service). Empty `version` means the
+operator resolves the preferred served version via the RESTMapper on
+every reconcile, so the source automatically follows version promotions
+(e.g. CRD `v1beta1 → v1`; or, hypothetically, core `v1 → v2`). Set
+`version` explicitly to pin.
 
 
 
@@ -262,7 +264,7 @@ _Appears in:_
 | Field | Description | Default | Validation |
 | --- | --- | --- | --- |
 | `group` _string_ | Group is the API group of the source object. Empty string means the<br />core group (e.g. ConfigMap, Secret, Service). |  | Pattern: `^$\|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$` <br />Optional: \{\} <br /> |
-| `version` _string_ | Version is the API version of the source object within its Group. Omit<br />for non-core groups to use the RESTMapper's preferred served version<br />(the source automatically follows CRD version promotions). When set,<br />must match Kubernetes' canonical version-string shape (`vN`,<br />`vNalphaM`, `vNbetaM`). |  | Pattern: `^$\|^v[0-9]+((alpha\|beta)[0-9]+)?$` <br />Optional: \{\} <br /> |
+| `version` _string_ | Version is the API version of the source object within its Group. Omit<br />to use the RESTMapper's preferred served version (the source<br />automatically follows version promotions). When set, must match<br />Kubernetes' canonical version-string shape (`vN`, `vNalphaM`,<br />`vNbetaM`). |  | Pattern: `^$\|^v[0-9]+((alpha\|beta)[0-9]+)?$` <br />Optional: \{\} <br /> |
 | `kind` _string_ | Kind is the API Kind of the source object (PascalCase). |  | Pattern: `^[A-Z][a-zA-Z0-9]*$` <br /> |
 | `namespace` _string_ | Namespace where the source object lives. |  | MaxLength: 63 <br />Pattern: `^[a-z0-9]([-a-z0-9]*[a-z0-9])?$` <br /> |
 | `name` _string_ | Name of the source object (DNS-1123 subdomain). |  | MaxLength: 253 <br />Pattern: `^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$` <br /> |
diff --git a/docs/api-stability.md b/docs/api-stability.md
index 9e656ee..4722900 100644
--- a/docs/api-stability.md
+++ b/docs/api-stability.md
@@ -24,7 +24,14 @@ The list of "what is covered" below describes the post-v1.0 surface — the surf
 
 Two CRDs at `projection.sh/v1`: `Projection` (namespaced, single-target) and `ClusterProjection` (cluster-scoped, fan-out). The fields of each CRD's `.spec` and `.status` listed in [`crd-reference.md`](crd-reference.md) are permanent. New optional fields may be added; existing fields are not removed or renamed.
 
-The shared `SourceRef` shape (`group`, `version`, `kind`, `namespace`, `name`) is part of both CRDs and equally permanent. The CEL admission rules (`size(self.group) != 0 || size(self.version) != 0` on SourceRef; the `namespaces` ⊕ `namespaceSelector` mutex on `ClusterProjection.destination`) are stable.
+The shared `SourceRef` shape (`group`, `version`, `kind`, `namespace`, `name`) is part of both CRDs and equally permanent. Within that shape:
+
+- `spec.source.group` — optional. Empty means the core group.
+- `spec.source.version` — optional for any group. Empty means the operator resolves the preferred served version via the RESTMapper on every reconcile (for the core group, currently always `v1`). Set explicitly to pin.
+
+These two fields' optionality is a v1.0 commitment: tightening either back to required would be a breaking change and is forbidden post-v1.0. Existing manifests with explicit `version: v1` for any group continue to work unchanged.
+
+The remaining CEL admission rule (`namespaces` ⊕ `namespaceSelector` mutex on `ClusterProjection.destination`) is stable.
 
 ### Annotation and label keys
 
@@ -123,6 +130,7 @@ This is the standing record of breaking changes between minor pre-v1.0 releases.
 
 | Version  | Breaking changes                                                                                                                                                                                                                       |
 | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Unreleased | **Rescinded:** the SourceRef `XValidation` rule `size(self.group) != 0 || size(self.version) != 0` (introduced in PR #76 with the message "version is required when group is empty"). `spec.source.version` is now optional for any group, including core. Pure permission grant — manifests with explicit `version: v1` continue to validate. |
 | `v0.3.0` | Single CRD split into `Projection` (namespaced, single-target) and `ClusterProjection` (cluster-scoped, fan-out). `SourceRef.apiVersion` replaced with separate `group` + `version` fields (CEL admission requires `version` when `group` is empty). Ownership annotation renamed from `projection.sh/owned-by` to `projection.sh/owned-by-projection` (namespaced) and `projection.sh/owned-by-cluster-projection` (cluster). New UID labels stamped on every destination (`projection.sh/owned-by-projection-uid` and `projection.sh/owned-by-cluster-projection-uid`). New cluster finalizer (`projection.sh/cluster-finalizer`) on `ClusterProjection`. `projection_reconcile_total` gained a `kind` label; new `projection_watched_dest_gvks` gauge and `projection_e2e_seconds` histogram added. |
 | `v0.2.0` | Ownership annotation renamed and source-projectability policy introduced (`projection.sh/projectable` annotation, `--source-mode=allowlist|permissive`). Default mode is `allowlist`. Events moved from `core/v1` to `events.k8s.io/v1`.                  |
 | `v0.1.0` | Initial public release. Single CRD `projections.projection.sh/v1` with `destination.namespace` and `destination.namespaceSelector` fields on the same CRD.                                                                              |
@@ -131,5 +139,5 @@ The full per-release log lives in the [CHANGELOG](https://github.com/projection-
 
 ## How we enforce this
 
-- **Schema golden test** (`api/v1/projection_types_golden_test.go`, `api/v1/clusterprojection_types_golden_test.go`) compares the rendered CRDs against committed `api/v1/testdata/*.golden.yaml`. Any change to `api/v1/*.go` that affects either CRD schema fails this test until the golden is consciously regenerated. Regenerate via `make update-crd-golden`.
+- **Schema golden test** (`api/v1/projection_types_golden_test.go` covers both CRDs via a table) compares the rendered CRDs against committed `api/v1/testdata/*.golden.yaml`. Any change to `api/v1/*.go` that affects either CRD schema fails this test until the golden is consciously regenerated. Regenerate via `make update-crd-golden`.
 - **This page is the record.** Anything not listed here is not promised.
diff --git a/docs/assets/demo.cast b/docs/assets/demo.cast
index a625239..1f02672 100644
--- a/docs/assets/demo.cast
+++ b/docs/assets/demo.cast
@@ -1,39 +1,40 @@
-{"version":3,"term":{"cols":80,"rows":24},"timestamp":1778186292,"command":"bash hack/demo.sh","title":"projection — namespace-tier and cluster-tier mirroring","env":{"SHELL":"/bin/zsh"}}
-[6.521, "o", "\u001b[3J\u001b[H\u001b[2J"]
+{"version":3,"term":{"cols":80,"rows":24},"timestamp":1778441454,"command":"bash hack/demo.sh","title":"projection — namespace-tier and cluster-tier mirroring","env":{"SHELL":"/bin/zsh"}}
+[0.324, "o", "\u001b[3J\u001b[H\u001b[2J"]
 [0.001, "o", "\u001b[1;36m# projection — namespace-tier and cluster-tier mirroring\u001b[0m\r\n"]
-[2.506, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl apply -f hack/demo-manifest.yaml\r\n"]
-[0.694, "o", "namespace/staging created\r\n"]
-[0.106, "o", "namespace/production created\r\n"]
-[0.011, "o", "configmap/app-config created\r\n"]
-[0.010, "o", "projection.projection.sh/app-config-mirror created\r\n"]
-[0.080, "o", "namespace/platform created\r\n"]
-[0.096, "o", "namespace/tenant-a created\r\n"]
-[0.106, "o", "namespace/tenant-b created\r\n"]
-[0.102, "o", "namespace/tenant-c created\r\n"]
+[2.507, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl apply -f hack/demo-manifest.yaml\r\n"]
+[0.702, "o", "namespace/staging created\r\n"]
+[0.099, "o", "namespace/production created\r\n"]
+[0.005, "o", "configmap/app-config created\r\n"]
+[0.003, "o", "projection.projection.sh/app-config-mirror created\r\n"]
+[0.091, "o", "namespace/platform created\r\n"]
+[0.105, "o", "namespace/tenant-a created\r\n"]
+[0.099, "o", "namespace/tenant-b created\r\n"]
+[0.103, "o", "namespace/tenant-c created\r\n"]
 [0.009, "o", "configmap/ca-bundle created\r\n"]
-[0.003, "o", "clusterprojection.projection.sh/ca-bundle-fanout created\r\n"]
+[0.004, "o", "clusterprojection.projection.sh/ca-bundle-fanout created\r\n"]
 [2.009, "o", "\r\n\u001b[1;36m# Act 1 — namespace-tier: a Projection mirrors one source into one namespace\u001b[0m\r\n"]
-[2.008, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl wait --for=condition=Ready --timeout=30s -n production projection/app-config-mirror\r\n"]
-[0.776, "o", "projection.projection.sh/app-config-mirror condition met\r\n"]
-[2.008, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl get cm -n production app-config -o jsonpath='{.data}' && echo\r\n"]
-[0.644, "o", "{\"feature_flag\":\"enabled\",\"version\":\"v1\"}"]
+[2.007, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl wait --for=condition=Ready --timeout=30s -n production projection/app-config-mirror\r\n"]
+[0.800, "o", "projection.projection.sh/app-config-mirror condition met\r\n"]
+[2.009, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl get cm -n production app-config -o jsonpath='{.data}' && echo\r\n"]
+[0.646, "o", "{\"feature_flag\":\"enabled\",\"version\":\"v1\"}"]
 [0.001, "o", "\r\n"]
-[3.507, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl patch cm -n staging app-config --type=merge -p '{\"data\":{\"version\":\"v2\"}}'\r\n"]
-[0.668, "o", "configmap/app-config patched\r\n"]
+[3.508, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl patch cm -n staging app-config --type=merge -p '{\"data\":{\"version\":\"v2\"}}'\r\n"]
+[0.672, "o", "configmap/app-config patched\r\n"]
 [2.508, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl get cm -n production app-config -o jsonpath='{.data}' && echo\r\n"]
-[0.644, "o", "{\"feature_flag\":\"enabled\",\"version\":\"v2\"}"]
+[0.643, "o", "{\"feature_flag\":\"enabled\",\"version\":\"v2\"}"]
 [0.001, "o", "\r\n"]
 [3.507, "o", "\r\n\u001b[1;36m# Act 2 — cluster-tier: a ClusterProjection fans one source out to many namespaces\u001b[0m\r\n"]
-[2.003, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl wait --for=condition=Ready --timeout=30s clusterprojection/ca-bundle-fanout\r\n"]
-[0.759, "o", "clusterprojection.projection.sh/ca-bundle-fanout condition met\r\n"]
+[2.008, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl wait --for=condition=Ready --timeout=30s clusterprojection/ca-bundle-fanout\r\n"]
+[0.770, "o", "clusterprojection.projection.sh/ca-bundle-fanout condition met\r\n"]
 [2.008, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl get cm -A | grep -E 'NAMESPACE|ca-bundle'\r\n"]
-[0.647, "o", "NAMESPACE            NAME                                                   DATA   AGE\r\nplatform             ca-bundle                                              1      24s\r\n"]
-[0.000, "o", "tenant-a             ca-bundle                                              1      24s\r\ntenant-b             ca-bundle                                              1      24s\r\ntenant-c             ca-bundle                                              1      24s\r\n"]
+[0.648, "o", "NAMESPACE            NAME                                                   DATA   AGE\r\n"]
+[0.000, "o", "platform             ca-bundle                                              1      23s\r\n"]
+[0.000, "o", "tenant-a             ca-bundle                                              1      23s\r\ntenant-b             ca-bundle                                              1      23s\r\ntenant-c             ca-bundle                                              1      23s\r\n"]
 [4.508, "o", "\r\n\u001b[1;36m# Act 3 — self-heal: kubectl-delete a destination, watch it come back\u001b[0m\r\n"]
-[2.013, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl delete cm ca-bundle -n tenant-a\r\n"]
-[0.667, "o", "configmap \"ca-bundle\" deleted from tenant-a namespace\r\n"]
-[1.110, "o", "\r\n\u001b[1;33m  ensureDestWatch fired — recovered in 52 ms\u001b[0m\r\n"]
-[2.512, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl get cm ca-bundle -n tenant-a\r\n"]
-[0.652, "o", "NAME        DATA   AGE\r\nca-bundle   1      4s\r\n"]
-[4.011, "o", "\r\n\u001b[1;36m# Two CRDs, one operator. Self-healing watches keep destinations honest.\u001b[0m\r\n"]
-[3.513, "x", "0"]
+[2.008, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl delete cm ca-bundle -n tenant-a\r\n"]
+[0.685, "o", "configmap \"ca-bundle\" deleted from tenant-a namespace\r\n"]
+[1.092, "o", "\r\n\u001b[1;33m  ensureDestWatch fired — recovered in 55 ms\u001b[0m\r\n"]
+[2.503, "o", "\r\n\u001b[1;32m$\u001b[0m kubectl get cm ca-bundle -n tenant-a\r\n"]
+[0.644, "o", "NAME        DATA   AGE\r\nca-bundle   1      5s\r\n"]
+[4.009, "o", "\r\n\u001b[1;36m# Two CRDs, one operator. Self-healing watches keep destinations honest.\u001b[0m\r\n"]
+[3.505, "x", "0"]
diff --git a/docs/assets/demo.gif b/docs/assets/demo.gif
index 40063f5..066ccd2 100644
Binary files a/docs/assets/demo.gif and b/docs/assets/demo.gif differ
diff --git a/docs/comparison.md b/docs/comparison.md
index ff5e2ea..20c6726 100644
--- a/docs/comparison.md
+++ b/docs/comparison.md
@@ -18,7 +18,7 @@ There are two mature tools that overlap with `projection`: [emberstack/Reflector
 | **Kubernetes Events per outcome**        | `Projected`, `Updated`, `DestinationConflict`, `SourceFetchFailed`, ... (per-namespace for ClusterProjection fan-out) | Limited | Policy-engine events |
 | **Conflict semantics**                   | Refuses to overwrite unowned objects; reports `DestinationConflict` | Overwrites | Configurable via `synchronize`, generally overwrites |
 | **Watch-driven propagation**             | Yes, dynamic per-GVK metadata-only watch on sources; label-filtered watch on destinations | Yes | Yes |
-| **Admission-time source validation**     | Yes (pattern-validated source fields, CEL on `SourceRef` and `ClusterProjection.destination`) | n/a | Yes |
+| **Admission-time source validation**     | Yes (pattern-validated source fields, CEL on `ClusterProjection.destination`) | n/a | Yes |
 | **Prometheus metrics**                   | `projection_reconcile_total{kind,result}`, `projection_watched_gvks`, `projection_watched_dest_gvks` | Partial | Rich policy-engine metrics |
 | **Operational footprint**                | Two CRDs + Deployment                   | One CRD + Deployment                        | Full Kyverno control plane (several controllers)     |
 | **Cluster-wide RBAC surface**            | `*/*` by default; narrowable per-Kind via Helm `supportedKinds` | Namespace-restrictable (scope narrower) | `*/*` (policy engine) |
@@ -115,7 +115,7 @@ The flip side of the section above. There are real cases where the right answer
 
 - **Per-destination conditions you can `kubectl wait` on independently.** `ClusterProjection` rolls up its target-set status into a single `DestinationWritten` condition with `namespacesWritten`/`namespacesFailed` counters — you cannot `kubectl wait` on "tenant-a got the destination" specifically without also waiting on the other targets. Kyverno reports per-policy and per-rule status, which is closer to per-destination than `ClusterProjection` is today. The `Projection`-per-destination pattern (above) gets you per-destination conditions at the cost of more YAML.
 
-- **You're on a cluster older than Kubernetes 1.32.** Both CRDs use CEL `XValidation` rules that require apiserver ≥ 1.32 to evaluate `optional` fields correctly (the `SourceRef` empty-group-requires-version rule, the `ClusterProjection.destination` mutex rules). The reconciler enforces the same invariants as defense-in-depth, so older clusters work — but the better admission UX (early `kubectl apply` rejection instead of a runtime status flip) needs the version floor. Reflector and Kyverno don't have this constraint.
+- **You're on a cluster older than Kubernetes 1.32.** `ClusterProjection` uses CEL `XValidation` rules that require apiserver ≥ 1.32 to evaluate `optional` fields correctly (the `ClusterProjection.destination` mutex rules). The reconciler enforces the same invariants as defense-in-depth, so older clusters work — but the better admission UX (early `kubectl apply` rejection instead of a runtime status flip) needs the version floor. Reflector and Kyverno don't have this constraint.
 
 - **You're allergic to a per-resource CR per mirror.** `projection`'s shape is "one CR per mirror" — a namespaced `Projection` per single-target mirror, a `ClusterProjection` per fan-out. If you're mirroring 200 Secrets across 50 namespaces and you don't want to template a few hundred CRs, Reflector's annotate-the-source UX is genuinely less ceremony.
 
diff --git a/docs/concepts.md b/docs/concepts.md
index 516773e..f4f23e7 100644
--- a/docs/concepts.md
+++ b/docs/concepts.md
@@ -18,39 +18,41 @@ The source uniquely identifies the Kubernetes object to mirror:
 ```yaml
 spec:
   source:
-    group: ""               # "" for the core API; otherwise a DNS-subdomain group name
-    version: v1             # required when group is empty
     kind: ConfigMap         # required, PascalCase
     namespace: platform     # required, DNS-1123
     name: app-config        # required, DNS-1123
+    # group and version are optional — see SourceRef fields below
 ```
 
-`group` and `version` together identify a `GroupVersionKind`. `kind`, `namespace`, and `name` are required and pattern-validated at admission time — typos fail at `kubectl apply`, not at runtime. The combination is resolved through the apiserver's `RESTMapper`, so anything the cluster knows about works: built-ins, aggregated APIs, CRDs.
+The five SourceRef fields:
 
-`projection` only mirrors **namespaced resources**. Pointing the source at a cluster-scoped Kind (`Namespace`, `ClusterRole`, `StorageClass`, `CustomResourceDefinition`, `PriorityClass`, …) is rejected at reconcile time with `SourceResolved=False reason=SourceResolutionFailed` and a message identifying the Kind as cluster-scoped. There can only be one `Namespace` named `foo` in a cluster, so mirroring it has no meaning; the rejection prevents a malformed dynamic-client URL from surfacing as a confusing 404.
+- `group` — API group of the source object. Optional; empty means the core group (`ConfigMap`, `Secret`, `Service`, ...).
+- `version` — API version of the source object within its group. Optional; empty means the operator resolves the preferred served version via the RESTMapper on every reconcile. Set explicitly to pin.
+- `kind` — API Kind, PascalCase. Required.
+- `namespace` — Source namespace. Required.
+- `name` — Source object name. Required.
 
-### Empty group requires a version
+`group`, `version`, and `kind` together identify a `GroupVersionKind`. All five fields are pattern-validated at admission time — typos fail at `kubectl apply`, not at runtime. The combination is resolved through the apiserver's `RESTMapper`, so anything the cluster knows about works: built-ins, aggregated APIs, CRDs.
 
-For core API sources (`group: ""`), `version` is required. CEL admission enforces this with the rule `size(self.group) != 0 || size(self.version) != 0`: if the group is empty, the version field must be set. Setting `group: ""` and leaving `version` empty fails at `kubectl apply` with a CEL violation message, not at reconcile time.
+`projection` only mirrors **namespaced resources**. Pointing the source at a cluster-scoped Kind (`Namespace`, `ClusterRole`, `StorageClass`, `CustomResourceDefinition`, `PriorityClass`, …) is rejected at reconcile time with `SourceResolved=False reason=SourceResolutionFailed` and a message identifying the Kind as cluster-scoped. There can only be one `Namespace` named `foo` in a cluster, so mirroring it has no meaning; the rejection prevents a malformed dynamic-client URL from surfacing as a confusing 404.
 
 ### Pinned vs. preferred version
 
-For non-core groups, `version` is optional. Two forms are supported:
+`version` is optional for any group, including core. Four forms are supported:
 
-| Form                                 | Semantics                                                                          |
-| ------------------------------------ | ---------------------------------------------------------------------------------- |
-| `group: apps`, `version: v1`         | Named group, pinned to v1.                                                         |
-| `group: apps` (version omitted)      | Named group, RESTMapper-preferred served version.                                  |
-| `group: ""`, `version: v1`           | Core group. Pinned (the only form for core).                                       |
+| Form                                        | Semantics                                                                          |
+| ------------------------------------------- | ---------------------------------------------------------------------------------- |
+| `kind: ConfigMap` (group + version omitted) | Core group, RESTMapper-preferred served version (`v1` today).                      |
+| `group: ""`, `version: v1`                  | Core group, pinned to v1.                                                          |
+| `group: apps`, `version: v1`                | Named group, pinned to v1.                                                         |
+| `group: apps` (`version` omitted)           | Named group, RESTMapper-preferred served version.                                  |
 
 **Pinned** is an explicit stability anchor: useful when you're mid-migration and want to lock the projection to a specific version while you validate behavior, or when you intentionally need to fall behind a CRD upgrade.
 
-**Preferred** (no `version`) is the default recommendation for sources outside the core group, and especially valuable for CRD sources. It follows the cluster: when a CRD author promotes `v1beta1` → `v1` and stops serving `v1beta1`, projection picks up the new preferred version on the next reconcile rather than failing with `SourceResolutionFailed` and garbage-collecting your destinations. The same form works for any named group — `apps`, `networking.k8s.io`, `example.com`.
+**Preferred** (no `version`) follows the cluster: when a CRD author promotes `v1beta1` → `v1` and stops serving `v1beta1`, projection picks up the new preferred version on the next reconcile rather than failing with `SourceResolutionFailed` and garbage-collecting your destinations. The same form works for any group — core, `apps`, `networking.k8s.io`, `example.com`. For core sources the preferred version is always `v1`, so the resolved GVR is stable in practice.
 
 The resolved version is reported in the `SourceResolved` condition message (`kubectl describe projection`), so you can always answer "which version is this currently on?" without operator log access.
 
-The core group does not have an unpinned form — its versions are stable, and the CEL rule above forbids leaving both fields empty.
-
 ## 2. Destination
 
 The destination says where to write the copy. The shape depends on which CRD you're using.
@@ -67,8 +69,6 @@ metadata:
   namespace: tenant-a       # ← destination namespace = this
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     namespace: platform
     name: app-config
@@ -93,8 +93,6 @@ metadata:
   name: shared-config-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     namespace: platform
     name: app-config
@@ -116,8 +114,6 @@ metadata:
   name: shared-config-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     namespace: platform
     name: app-config
@@ -250,7 +246,7 @@ flowchart TD
 
 Each step in plain prose:
 
-1. **Resolve GVR.** Combine `spec.source.{group, version, kind}` and run it through the `RESTMapper`. If `version` is omitted (non-core groups only), look up the preferred served version. If the cluster doesn't know the Kind, fail with `SourceResolutionFailed`.
+1. **Resolve GVR.** Combine `spec.source.{group, version, kind}` and run it through the `RESTMapper`. If `version` is omitted, look up the preferred served version. If the cluster doesn't know the Kind, fail with `SourceResolutionFailed`.
 2. **Register source watch.** On the first time we see a given GVK, register a metadata-only watch against the cache so future edits to *any* source of that Kind are fanned out to the referencing Projections via a field-indexed lookup.
 3. **Fetch the source** via the dynamic client using the resolved GVR.
 4. **Build the destination object.** Deep-copy the source, strip server-owned metadata (`resourceVersion`, `uid`, `managedFields`, `ownerReferences`, etc.), drop `.status`, remove `kubectl.kubernetes.io/last-applied-configuration`, strip Kind-specific apiserver-allocated spec fields (`Service.spec.{clusterIP, clusterIPs, ipFamilies, ipFamilyPolicy}`, `PersistentVolumeClaim.spec.volumeName`, `Pod.spec.nodeName`, `Job.spec.selector` plus the auto-generated `controller-uid` / `batch.kubernetes.io/controller-uid` / `batch.kubernetes.io/job-name` labels on `spec.template.metadata.labels`), apply the overlay, stamp the ownership annotation and UID label, set destination namespace and name. Jobs created with `spec.manualSelector: true` are a known limitation — the controller's stripping logic assumes the apiserver-managed selector path.
diff --git a/docs/crd-reference.md b/docs/crd-reference.md
index c21caf7..a0c07e5 100644
--- a/docs/crd-reference.md
+++ b/docs/crd-reference.md
@@ -17,30 +17,20 @@ The `SourceRef` struct is the same for both CRDs:
 
 | Field               | Type   | Required | Notes                                                                              |
 | ------------------- | ------ | -------- | ---------------------------------------------------------------------------------- |
-| `source.group`      | string | yes (may be empty) | `""` for the core API; otherwise a DNS-subdomain group name.            |
-| `source.version`    | string | conditional       | Required when `source.group == ""`. Optional otherwise.                  |
+| `source.group`      | string | no       | `""` (or omitted) for the core API; otherwise a DNS-subdomain group name.          |
+| `source.version`    | string | no       | Optional. Empty resolves to the RESTMapper's preferred served version (for the core group, currently `v1`). Set explicitly to pin. |
 | `source.kind`       | string | yes      | PascalCase. Pattern-validated.                                                     |
 | `source.namespace`  | string | yes      | DNS-1123. Source must be a namespaced object.                                      |
 | `source.name`       | string | yes      | DNS-1123.                                                                          |
 
-### `source` CEL rule
-
-```
-size(self.group) != 0 || size(self.version) != 0
-```
-
-If the group is empty (core API), the version field must be set. Setting `group: ""` and leaving `version` empty fails at `kubectl apply` with a CEL violation.
-
-For non-core groups, omitting `version` triggers preferred-version lookup via the `RESTMapper`. Pinning a specific version (`group: apps`, `version: v1`) locks the projection to that version regardless of CRD promotions in the cluster.
-
 ### `source.version` semantics
 
-| Form                                | Resolution                                                                     |
-| ----------------------------------- | ------------------------------------------------------------------------------ |
-| `group: ""`, `version: v1`          | Core group, pinned to v1. (Only form for core.)                                |
-| `group: apps`, `version: v1`        | Named group, pinned to v1.                                                     |
-| `group: apps` (`version` omitted)   | Named group, RESTMapper-preferred served version. Follows CRD promotions.      |
-| `group: ""` (`version` omitted)     | Rejected by CEL admission.                                                     |
+| Form                                        | Resolution                                                                     |
+| ------------------------------------------- | ------------------------------------------------------------------------------ |
+| `kind: ConfigMap` (group + version omitted) | Core group, RESTMapper-preferred served version (`v1` today).                  |
+| `group: ""`, `version: v1`                  | Core group, pinned to v1.                                                      |
+| `group: apps`, `version: v1`                | Named group, pinned to v1.                                                     |
+| `group: apps` (`version` omitted)           | Named group, RESTMapper-preferred served version. Follows CRD promotions.      |
 
 The resolved version is surfaced in the `SourceResolved` condition message:
 
@@ -49,7 +39,7 @@ kubectl get projection <name> -o jsonpath='{.status.conditions[?(@.type=="Source
 # → resolved apps/Deployment to preferred version v1
 ```
 
-The unpinned form is the recommended default for sources outside the core group, especially valuable for CRDs: when an author promotes `v1beta1` → `v1` and stops serving `v1beta1`, projection picks up the new preferred version on the next reconcile rather than reporting `SourceResolutionFailed` and garbage-collecting destinations.
+The unpinned form is the recommended default for sources whose CRD versions evolve over time: when an author promotes `v1beta1` → `v1` and stops serving `v1beta1`, projection picks up the new preferred version on the next reconcile rather than reporting `SourceResolutionFailed` and garbage-collecting destinations.
 
 ---
 
@@ -91,11 +81,11 @@ Note: there is no `spec.destination.namespace` and no `spec.destination.namespac
 | `Source-Group`     | `.spec.source.group`                                              | with `-o wide` (priority=1) |
 | `Source-Namespace` | `.spec.source.namespace`                                          | yes      |
 | `Source-Name`      | `.spec.source.name`                                               | yes      |
-| `Destination`      | `.status.destinationName`                                         | yes      |
+| `Destination-Name` | `.status.destinationName`                                         | yes      |
 | `Ready`            | `.status.conditions[?(@.type=='Ready')].status`                   | yes      |
 | `Age`              | `.metadata.creationTimestamp`                                     | yes      |
 
-`Destination` reflects the **resolved** destination name from status — the rename applied (or the source name when no rename is set), populated after the first successful write.
+`Destination-Name` reflects the **resolved** destination name from status — the rename applied (or the source name when no rename is set), populated after the first successful write.
 
 ## Worked example
 
@@ -200,7 +190,7 @@ At least one must be set — empty `destination` is rejected.
 | `Source-Group`     | `.spec.source.group`                                                          | with `-o wide` (priority=1) |
 | `Source-Namespace` | `.spec.source.namespace`                                                      | yes      |
 | `Source-Name`      | `.spec.source.name`                                                           | yes      |
-| `Destination`      | `.status.destinationName`                                                     | yes      |
+| `Destination-Name` | `.status.destinationName`                                                     | yes      |
 | `Targets`          | `.status.namespacesWritten`                                                   | yes      |
 | `Failed`           | `.status.namespacesFailed`                                                    | with `-o wide` (priority=1) |
 | `Selector`         | `.spec.destination.namespaceSelector.matchLabels`                             | with `-o wide` (priority=1) |
diff --git a/docs/getting-started.md b/docs/getting-started.md
index 7680c35..b1276eb 100644
--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -102,8 +102,6 @@ metadata:
   namespace: tenant-a            # destination namespace = this
 spec:
   source:
-    group: ""                    # core API
-    version: v1
     kind: ConfigMap
     namespace: default
     name: app-config
@@ -111,6 +109,14 @@ spec:
   #   name: shared-app-config    # optional rename; defaults to source.name
 ```
 
+> **Why no `apiVersion`, `group`, or `version`?** `spec.source.kind` alone
+> is enough for core-group resources (`ConfigMap`, `Secret`, `Service`,
+> ...). Omitting `version` asks the operator to resolve the preferred
+> served version via the RESTMapper on every reconcile — for core that's
+> always `v1`. For CRDs that go through a `v1beta1 → v1` promotion,
+> omitting `version` lets the source automatically follow the promotion.
+> Set `version` explicitly when you want to pin.
+
 ```bash
 kubectl apply -f tenant-a-projection.yaml
 ```
@@ -122,8 +128,8 @@ kubectl get projections -A
 ```
 
 ```console
-NAMESPACE   NAME                KIND        SOURCE-NAMESPACE   SOURCE-NAME   DESTINATION   READY   AGE
-tenant-a    app-config-mirror   ConfigMap   default            app-config    app-config    True    3s
+NAMESPACE   NAME                KIND        SOURCE-NAMESPACE   SOURCE-NAME   DESTINATION-NAME   READY   AGE
+tenant-a    app-config-mirror   ConfigMap   default            app-config    app-config         True    3s
 ```
 
 `Destination` reflects `status.destinationName` — the resolved name after any rename, populated after the first successful write.
@@ -167,8 +173,6 @@ metadata:
   name: shared-config-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     namespace: default
     name: app-config
@@ -190,7 +194,7 @@ kubectl get clusterprojections
 ```
 
 ```console
-NAME                   KIND        SOURCE-NAMESPACE   SOURCE-NAME   DESTINATION         TARGETS   READY   AGE
+NAME                   KIND        SOURCE-NAMESPACE   SOURCE-NAME   DESTINATION-NAME    TARGETS   READY   AGE
 shared-config-fanout   ConfigMap   default            app-config    shared-app-config   2         True    4s
 ```
 
@@ -206,8 +210,6 @@ metadata:
   name: shared-config-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     namespace: default
     name: app-config
@@ -235,7 +237,7 @@ Adding the label to a new namespace triggers an immediate reconcile and the dest
 
 ## Sources outside the core group
 
-The examples above use `group: ""` + `version: v1` — the core API. For sources in any **named group** — built-ins like `apps`, `networking.k8s.io`, or your own CRDs at `example.com` — `version` is optional. Two forms work:
+The examples above use bare `kind: ConfigMap` — core-group sources resolved via the RESTMapper. For sources in any **named group** — built-ins like `apps`, `networking.k8s.io`, or your own CRDs at `example.com` — set `group` to the named group; `version` remains optional. Two forms work:
 
 ### Pinned named-group source
 
@@ -277,7 +279,7 @@ spec:
 
 The benefit is most visible against **CRD sources**: when a CRD author promotes `v1beta1` → `v1` and stops serving `v1beta1`, the projection picks up the new version automatically on the next reconcile rather than failing with `SourceResolutionFailed` and garbage-collecting the destination.
 
-For the core group (`group: ""`), `version` is required — CEL admission enforces this with the rule `size(self.group) != 0 || size(self.version) != 0`. Setting `group: ""` and leaving `version` empty fails at `kubectl apply` with a CEL violation message.
+The same preferred-version lookup is what powers the bare `kind: ConfigMap` form for core sources — for the core group, the preferred version is always `v1`, so the resolved GVR is stable. Set `version` explicitly when you want to pin to a specific served version.
 
 As with the ConfigMap example above, the source object must carry
 `projection.sh/projectable: "true"` if the controller is running in
diff --git a/docs/index.md b/docs/index.md
index 4c52772..18d583d 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -44,8 +44,6 @@ metadata:
   namespace: tenant-a
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     namespace: platform
     name: app-config
@@ -56,8 +54,8 @@ spec:
 
 ```console
 $ kubectl get projections -n tenant-a
-NAME                KIND        SOURCE-NAMESPACE   SOURCE-NAME   DESTINATION   READY
-app-config-mirror   ConfigMap   platform           app-config    app-config    True
+NAME                KIND        SOURCE-NAMESPACE   SOURCE-NAME   DESTINATION-NAME   READY
+app-config-mirror   ConfigMap   platform           app-config    app-config         True
 
 $ kubectl get configmap -n tenant-a app-config \
     -o jsonpath='{.metadata.annotations.projection\.sh/owned-by-projection}'
@@ -78,8 +76,6 @@ metadata:
   name: app-config-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     namespace: platform
     name: app-config
@@ -94,7 +90,7 @@ Cluster admins bind the `<release>-projection-cluster-admin` ClusterRole explici
 ## Features at a glance
 
 - **Two CRDs, one operator** — `Projection` (namespaced, single-target) for tenant self-service; `ClusterProjection` (cluster-scoped, fan-out via list or selector) for cluster-tier mirroring.
-- **Any Kind** — `RESTMapper`-driven GVR resolution. Source `version` may be omitted on non-core groups so the projection follows CRD version promotions automatically.
+- **Any Kind** — `RESTMapper`-driven GVR resolution. Source `version` may be omitted for any group so the projection follows version promotions automatically.
 - **Watch-driven both ways** — dynamic informer registration per source GVK, plus label-filtered watches on destinations so manual deletes self-heal.
 - **Conflict-safe** — `projection.sh/owned-by-projection` (or `…-cluster-projection`) annotations mark our destinations; the controller never overwrites a stranger-owned object.
 - **Clean deletion** — distinct finalizers per tier (`projection.sh/finalizer` and `projection.sh/cluster-finalizer`) clean up every owned destination across every namespace before the CR is removed.
diff --git a/docs/observability.md b/docs/observability.md
index 554255b..31d3447 100644
--- a/docs/observability.md
+++ b/docs/observability.md
@@ -105,7 +105,7 @@ For ClusterProjection, partial failures are emitted as **per-namespace events**:
 | `SourceFetchFailed`       | Warning | `Get`      | Dynamic client `Get` on the source returned an error.                             |
 | `SourceResolutionFailed`  | Warning | `Resolve`  | RESTMapper couldn't resolve the source `{group, version, kind}` triple.           |
 | `SourceOptedOut` / `SourceNotProjectable` | Warning | `Validate` | Source is missing the `projection.sh/projectable=true` annotation (allowlist mode) or explicitly sets it to `false`. |
-| `InvalidSpec`             | Warning | `Validate` | Admission rejected the spec — e.g. SourceRef with empty `group` AND empty `version`, or ClusterProjection.destination with both / neither of `namespaces` and `namespaceSelector` set. See [troubleshooting](troubleshooting.md#invalidspec). |
+| `InvalidSpec`             | Warning | `Validate` | Admission rejected the spec — e.g. ClusterProjection.destination with both / neither of `namespaces` and `namespaceSelector` set. See [troubleshooting](troubleshooting.md#invalidspec). |
 
 ### Querying
 
diff --git a/docs/troubleshooting.md b/docs/troubleshooting.md
index 1f7e051..5032826 100644
--- a/docs/troubleshooting.md
+++ b/docs/troubleshooting.md
@@ -69,11 +69,11 @@ Things that can cause it:
 - **The Kind is not registered in the cluster.** A CRD you project from is not installed, or was uninstalled. Confirm with `kubectl api-resources | grep <kind>`.
 - **The `group`, `version`, or `kind` is mis-spelled.** The pattern validation on the CRD catches obvious typos at admission, but a Kind that happens to look right syntactically but does not exist slips through.
 - **The target Kind is cluster-scoped.** `projection` only mirrors namespaced resources (`Namespace`, `ClusterRole`, `StorageClass`, CRDs themselves, `PriorityClass`, and similar are all rejected). The message will read `<group>/<version>/<kind> is cluster-scoped; projection only mirrors namespaced resources`.
-- **You omitted `source.version` for a non-core group with multiple served versions and no clear preferred.** When `version:` is omitted, the RESTMapper's preferred-version lookup picks one of the served versions; if your CRD declares more than one served version with no explicit preferred, the pick can be surprising. See the sub-entry below for the remedy.
+- **You omitted `source.version` for a CRD with multiple served versions and no clear preferred.** When `version:` is omitted, the RESTMapper's preferred-version lookup picks one of the served versions; if your CRD declares more than one served version with no explicit preferred, the pick can be surprising. See the sub-entry below for the remedy.
 
 #### Sub-cause: unpinned version with multiple served versions
 
-The v0.3.0 SourceRef permits omitting `source.version` for non-core groups (the empty-group + empty-version combination is rejected by CEL admission — see [InvalidSpec](#invalidspec) below — but `group: example.com` with `version` omitted is fine). The RESTMapper resolves the omitted version through `RESTMapping(GroupKind)`, which returns the *preferred* version. If the source CRD has multiple served versions and either declares no preferred or its preferred isn't the one that holds your data, you'll see `SourceResolutionFailed` (no mapping for the picked version) or, more confusingly, a successful resolve onto the wrong version with subsequent `SourceFetchFailed` because the data lives on a different served version.
+The v0.3.0 SourceRef permits omitting `source.version` for any group, including core (`kind: ConfigMap` alone is valid; the operator resolves to `v1` via the RESTMapper). The RESTMapper resolves the omitted version through `RESTMapping(GroupKind)`, which returns the *preferred* version. For core resources the preferred version is always `v1`, so the resolved GVR is stable in practice. The pitfall is on **CRDs with multiple served versions**: if the source CRD has more than one served version and either declares no preferred or its preferred isn't the one that holds your data, you'll see `SourceResolutionFailed` (no mapping for the picked version) or, more confusingly, a successful resolve onto the wrong version with subsequent `SourceFetchFailed` because the data lives on a different served version.
 
 Diagnose:
 
@@ -87,7 +87,7 @@ kubectl get crd <crd-plural>.<group> \
   -o jsonpath='{range .spec.versions[?(@.storage==true)]}{.name}{"\n"}{end}'
 ```
 
-If the served-version list has more than one entry and none is explicitly preferred, **pin `source.version` explicitly** to the version your data lives on. The version-omission shortcut is intended for stable single-version CRDs and core extension groups where the preferred version is unambiguous; multi-version CRDs should always pin.
+If the served-version list has more than one entry and none is explicitly preferred, **pin `source.version` explicitly** to the version your data lives on. The version-omission shortcut is intended for the core group (where preferred is always `v1`) and for stable single-version CRDs where the preferred version is unambiguous; multi-version CRDs should always pin.
 
 **Fix:** Install the missing CRD; correct the `group`/`version`/`kind` spelling; pin `source.version` explicitly when the source CRD has multiple served versions; or, if the Kind is genuinely cluster-scoped, `projection` is not the right tool for the job.
 
@@ -155,35 +155,13 @@ If you see `SourceNotResolved`, the real failure is on the `SourceResolved` cond
 
 ### InvalidSpec
 
-**Applies to:** `Projection` and `ClusterProjection` (admission-time, so the offending CR usually never makes it past `kubectl apply`).
+**Applies to:** `ClusterProjection` only in v0.3 (admission-time, so the offending CR usually never makes it past `kubectl apply`).
 
-The apiserver rejected the spec via CEL validation rules on the CRD. The CR either never created (you'll see this as a `kubectl apply` error) or, in the rare case where CEL validation is bypassed, the controller surfaces it as a runtime `DestinationWritten=False reason=InvalidSpec` event. Either way, the cause is one of three structural mistakes:
+The apiserver rejected the spec via CEL validation rules on the CRD. The CR either never created (you'll see this as a `kubectl apply` error) or, in the rare case where CEL validation is bypassed, the controller surfaces it as a runtime `DestinationWritten=False reason=InvalidSpec` event. Either way, the cause is one of two structural mistakes:
 
-#### 1. SourceRef with empty `group` AND empty `version`
+> Pre-v0.3 SourceRef carried a CEL rule `size(self.group) != 0 || size(self.version) != 0` that rejected `kubectl apply` for any Projection or ClusterProjection with both `source.group` and `source.version` empty. v0.3 drops that rule — `source.version` is now optional for any group, including core. Manifests with explicit `version: v1` continue to validate; `kind: ConfigMap` alone now works too. Old runbooks mentioning an `InvalidSpec` admission error from `source must specify version when group is empty` apply only to pre-v0.3.
 
-**Applies to:** `Projection` and `ClusterProjection`.
-
-The CEL rule `size(self.group) != 0 || size(self.version) != 0` enforces that when the group is empty (i.e. core API), the version must be specified. Mirroring a core-group object with no explicit version isn't supportable — there's no preferred-version lookup for core (it's always `v1`, but the rule forces you to say so). The literal admission error:
-
-```
-The Projection "..." is invalid: spec.source: Invalid value: "object": source must specify version when group is empty
-```
-
-(Or `spec.source` on `ClusterProjection`.)
-
-**Fix:** add `version: v1` to the source. For core Kinds, `v1` is always correct.
-
-```yaml
-spec:
-  source:
-    group: ""        # core API group
-    version: v1      # required when group is empty
-    kind: ConfigMap
-    namespace: shared
-    name: app-config
-```
-
-#### 2. ClusterProjection.destination with both `namespaces` AND `namespaceSelector` set
+#### 1. ClusterProjection.destination with both `namespaces` AND `namespaceSelector` set
 
 **Applies to:** `ClusterProjection` only.
 
@@ -197,7 +175,7 @@ The literal admission error from the apiserver looks like this (the message is f
 
 ```
 The ClusterProjection "..." is invalid: spec.destination: Invalid value: "object":
-destination must specify exactly one of namespaces or namespaceSelector, not both
+namespaces and namespaceSelector are mutually exclusive
 ```
 
 **Fix:** decide which destination shape you want and remove the other field.
@@ -220,7 +198,7 @@ spec:
         tier: tenant
 ```
 
-#### 3. ClusterProjection.destination with NEITHER `namespaces` NOR `namespaceSelector` set
+#### 2. ClusterProjection.destination with NEITHER `namespaces` NOR `namespaceSelector` set
 
 **Applies to:** `ClusterProjection` only.
 
@@ -228,7 +206,7 @@ The mirror image of the previous error: omitting both fields gives the controlle
 
 ```
 The ClusterProjection "..." is invalid: spec.destination: Invalid value: "object":
-destination must specify exactly one of namespaces or namespaceSelector
+one of namespaces or namespaceSelector must be set
 ```
 
 **Fix:** add one of the two destination shapes, as in the previous example.
diff --git a/docs/use-cases.md b/docs/use-cases.md
index 0eebf75..b43cd1b 100644
--- a/docs/use-cases.md
+++ b/docs/use-cases.md
@@ -32,8 +32,6 @@ metadata:
   name: app-config-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: app-config
     namespace: platform
@@ -65,8 +63,6 @@ metadata:
   name: app-config-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: app-config
     namespace: platform
@@ -97,8 +93,6 @@ metadata:
   namespace: app-prod              # destination namespace = this
 spec:
   source:
-    group: ""
-    version: v1
     kind: Secret
     name: shared-tls
     namespace: cert-manager
@@ -130,19 +124,19 @@ This is also the right shape when the destinations don't share a label predicate
   kind: Projection
   metadata: { name: org-policy, namespace: tenant-a }
   spec:
-    source: { group: "", version: v1, kind: ConfigMap, namespace: platform, name: org-policy }
+    source: { kind: ConfigMap, namespace: platform, name: org-policy }
     overlay: { labels: { tenant: tenant-a } }
 - apiVersion: projection.sh/v1
   kind: Projection
   metadata: { name: org-policy, namespace: tenant-b }
   spec:
-    source: { group: "", version: v1, kind: ConfigMap, namespace: platform, name: org-policy }
+    source: { kind: ConfigMap, namespace: platform, name: org-policy }
     overlay: { labels: { tenant: tenant-b } }
 - apiVersion: projection.sh/v1
   kind: Projection
   metadata: { name: org-policy, namespace: tenant-c }
   spec:
-    source: { group: "", version: v1, kind: ConfigMap, namespace: platform, name: org-policy }
+    source: { kind: ConfigMap, namespace: platform, name: org-policy }
     overlay: { labels: { tenant: tenant-c } }
 ```
 
@@ -171,8 +165,6 @@ metadata:
   namespace: team-a               # destination namespace = this
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: base-config
     namespace: platform
@@ -202,8 +194,6 @@ metadata:
   name: cluster-root-ca-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: Secret
     name: cluster-root-ca
     namespace: cert-manager
@@ -221,8 +211,6 @@ metadata:
   namespace: app-prod
 spec:
   source:
-    group: ""
-    version: v1
     kind: Secret
     name: cluster-root-ca
     namespace: cert-manager
@@ -253,8 +241,6 @@ metadata:
   namespace: team-b                # destination namespace = this
 spec:
   source:
-    group: ""
-    version: v1
     kind: Service
     name: api
     namespace: default
diff --git a/examples/configmap-cross-namespace.yaml b/examples/configmap-cross-namespace.yaml
index ac369ad..e59485f 100644
--- a/examples/configmap-cross-namespace.yaml
+++ b/examples/configmap-cross-namespace.yaml
@@ -10,8 +10,9 @@
 #   kubectl get configmap -n tenant-a app-config -o yaml
 #
 # The destination ConfigMap will carry the same .data as the source plus
-# an ownership annotation `projection.sh/owned-by`. Editing the
-# source propagates to the destination in ~100ms.
+# an ownership annotation `projection.sh/owned-by-projection` (the
+# cluster-scoped CRD stamps `projection.sh/owned-by-cluster-projection`
+# instead). Editing the source propagates to the destination in ~100ms.
 ---
 apiVersion: v1
 kind: Namespace
@@ -39,8 +40,6 @@ metadata:
   namespace: tenant-a
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: app-config
     namespace: default
diff --git a/examples/configmap-fan-out-list.yaml b/examples/configmap-fan-out-list.yaml
index e54fb16..387b65f 100644
--- a/examples/configmap-fan-out-list.yaml
+++ b/examples/configmap-fan-out-list.yaml
@@ -69,8 +69,6 @@ metadata:
   name: app-config-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: app-config
     namespace: default
diff --git a/examples/configmap-fan-out-selector.yaml b/examples/configmap-fan-out-selector.yaml
index 3b43c7c..02e0c39 100644
--- a/examples/configmap-fan-out-selector.yaml
+++ b/examples/configmap-fan-out-selector.yaml
@@ -55,8 +55,6 @@ metadata:
   name: app-config-fanout
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: app-config
     namespace: default
diff --git a/examples/multiple-destinations-from-one-source.yaml b/examples/multiple-destinations-from-one-source.yaml
index 84c927e..63afba2 100644
--- a/examples/multiple-destinations-from-one-source.yaml
+++ b/examples/multiple-destinations-from-one-source.yaml
@@ -44,8 +44,6 @@ metadata:
   namespace: tenant-a
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: org-policy
     namespace: platform
@@ -59,8 +57,6 @@ metadata:
   namespace: tenant-b
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: org-policy
     namespace: platform
@@ -74,8 +70,6 @@ metadata:
   namespace: tenant-c
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: org-policy
     namespace: platform
diff --git a/examples/secret-cross-namespace.yaml b/examples/secret-cross-namespace.yaml
index 4f8977c..773051d 100644
--- a/examples/secret-cross-namespace.yaml
+++ b/examples/secret-cross-namespace.yaml
@@ -40,8 +40,6 @@ metadata:
   namespace: app-prod
 spec:
   source:
-    group: ""
-    version: v1
     kind: Secret
     name: shared-tls
     namespace: cert-manager
diff --git a/examples/service-mirror.yaml b/examples/service-mirror.yaml
index adbc7ac..073daf9 100644
--- a/examples/service-mirror.yaml
+++ b/examples/service-mirror.yaml
@@ -43,8 +43,6 @@ metadata:
   namespace: team-b
 spec:
   source:
-    group: ""
-    version: v1
     kind: Service
     name: api
     namespace: default
diff --git a/examples/with-overlay-annotations.yaml b/examples/with-overlay-annotations.yaml
index ac75a99..a3f114a 100644
--- a/examples/with-overlay-annotations.yaml
+++ b/examples/with-overlay-annotations.yaml
@@ -6,8 +6,10 @@
 #
 # Note: regardless of overlay, projection always stamps:
 #   annotations:
-#     projection.sh/owned-by: <projection-namespace>/<projection-name>
-# This is what the conflict-detection check uses on subsequent reconciles.
+#     projection.sh/owned-by-projection: <projection-namespace>/<projection-name>
+# (ClusterProjection stamps `projection.sh/owned-by-cluster-projection`
+# instead.) This is what the conflict-detection check uses on subsequent
+# reconciles.
 ---
 apiVersion: v1
 kind: Namespace
@@ -32,8 +34,6 @@ metadata:
   namespace: app-staging
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: feature-flags
     namespace: platform
diff --git a/examples/with-overlay-labels.yaml b/examples/with-overlay-labels.yaml
index 2d7c699..422b1a7 100644
--- a/examples/with-overlay-labels.yaml
+++ b/examples/with-overlay-labels.yaml
@@ -37,8 +37,6 @@ metadata:
   namespace: tenant-a
 spec:
   source:
-    group: ""
-    version: v1
     kind: ConfigMap
     name: shared-config
     namespace: platform
diff --git a/internal/controller/projection_controller_test.go b/internal/controller/projection_controller_test.go
index 9c0ecb7..7b5a54d 100644
--- a/internal/controller/projection_controller_test.go
+++ b/internal/controller/projection_controller_test.go
@@ -361,6 +361,58 @@ var _ = Describe("Projection Controller (integration)", func() {
 			Expect(sr.Status).To(Equal(metav1.ConditionTrue))
 			Expect(sr.Message).To(Equal("resolved apps/Deployment to preferred version v1"))
 		})
+
+		It("admits a Projection with only Kind set on the source (no group, no version)", func() {
+			// Regression test for the relaxed admission rule: dropping the
+			// CEL guard "size(self.group) != 0 || size(self.version) != 0"
+			// means a core-group source can be referenced by Kind alone.
+			// resolveGVR should fall through to the preferred-version path
+			// just like the non-core unpinned form above.
+			bareNS := uniqueNS("bare-kind")
+			ensureNamespace(bareNS)
+
+			src := &corev1.ConfigMap{
+				ObjectMeta: metav1.ObjectMeta{
+					Name:        "bare-kind-source",
+					Namespace:   bareNS,
+					Annotations: map[string]string{projectableAnnotation: "true"},
+				},
+				Data: map[string]string{"k": "v"},
+			}
+			Expect(k8sClient.Create(ctx, src)).To(Succeed())
+
+			// Same-namespace source/destination would collide on names, so
+			// pick a destination name distinct from the source.
+			bareKey := types.NamespacedName{Name: "bare-kind-projection", Namespace: bareNS}
+			proj := &projectionv1.Projection{
+				ObjectMeta: metav1.ObjectMeta{Name: bareKey.Name, Namespace: bareKey.Namespace},
+				Spec: projectionv1.ProjectionSpec{
+					Source: projectionv1.SourceRef{
+						// Group AND Version both omitted — this is what we're testing.
+						Kind:      "ConfigMap",
+						Namespace: bareNS,
+						Name:      src.Name,
+					},
+					Destination: projectionv1.ProjectionDestination{Name: "bare-kind-dst"},
+				},
+			}
+			Expect(k8sClient.Create(ctx, proj)).To(Succeed())
+			DeferCleanup(deleteProjection, bareKey)
+
+			reconcileOnce(r, bareKey)
+
+			got := &projectionv1.Projection{}
+			Expect(k8sClient.Get(ctx, bareKey, got)).To(Succeed())
+			ready := apimeta.FindStatusCondition(got.Status.Conditions, "Ready")
+			Expect(ready).ToNot(BeNil())
+			Expect(ready.Status).To(Equal(metav1.ConditionTrue))
+
+			sr := apimeta.FindStatusCondition(got.Status.Conditions, "SourceResolved")
+			Expect(sr).ToNot(BeNil())
+			Expect(sr.Message).To(Equal("resolved /ConfigMap to preferred version v1"),
+				"unpinned core source must surface the RESTMapper-resolved version "+
+					"so a future defaulter that re-pins to v1 can't silently mask the bare-Kind path")
+		})
 	})
 
 	Context("Conflict path", func() {
diff --git a/internal/controller/source.go b/internal/controller/source.go
index f741231..fda142d 100644
--- a/internal/controller/source.go
+++ b/internal/controller/source.go
@@ -70,8 +70,9 @@ func sourceKey(s projectionv1.SourceRef) string {
 // surface the resolved version in the SourceResolved condition message
 // for operator-visibility.
 //
-// SourceRef admission rejects an empty Version when Group is empty (no
-// unpinned form for the core group), so we don't repeat that check here.
+// Admission permits any combination of (Group, Version), including both
+// empty. When Version is empty we ask the RESTMapper for the preferred
+// served version (v1 for core); when set, we pin to it.
 func (d *ControllerDeps) resolveGVR(src projectionv1.SourceRef) (schema.GroupVersionResource, string, error) {
 	gk := schema.GroupKind{Group: src.Group, Kind: src.Kind}