Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Personal local settings must not sync to origin (they carry per-user
permission overrides). Remove from tracking and ignore going forward.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Add a CI job running `go fix -diff ./...` (Go 1.26 built-in modernizers,
fails on non-empty diff) so the tree stays modernized. Repo was already
near-clean; only ec2 AttachVerifiedAccessTrustProvider had a stale
suppressed loop, now slices.Contains.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…validation, response overrides

Deep parity audit of the s3 service against aws-sdk-go-v2. Twelve genuine
correctness defects fixed (no cosmetic churn):

- SSE data loss on restart: StoredObjectVersion.EncryptionDEK/Nonce and
  StoredMultipartUpload.SSE were json:"-" while the ciphertext (Data) was
  persisted, so every SSE-S3/SSE-KMS object became undecryptable after a
  snapshot/restore, and in-flight multipart uploads silently completed
  unencrypted. Now persisted (SSE-C customer key stays request-scoped).
- GetObject/HeadObject: implement the response-* header override query params
  (response-content-type/-disposition/-encoding/-language, response-expires,
  response-cache-control) — previously ignored; heavily used via presigned URLs.
- PutBucketAcl: reject object-only canned ACLs (bucket-owner-read /
  bucket-owner-full-control) with 400 InvalidArgument; read and honour an
  AccessControlPolicy XML body (was silently ignored); pass it through on GET.
- PutBucketReplication: require versioning=Enabled (InvalidRequest 400), as AWS.
- Presigned URLs: reject X-Amz-Expires > 604800 s (7 days) with 400
  AuthorizationQueryParametersError.
- x-amz-storage-class: omit the header for STANDARD objects (AWS omits it).
- GetObjectAttributes: return Last-Modified header; drop omitempty on ObjectSize
  so a 0-byte object still emits <ObjectSize>0</ObjectSize>.
- PostObject response: XML-escape bucket/key via encoding/xml instead of raw
  string concatenation (keys may contain & < >).
- ListMultipartUploads: echo UploadIdMarker in the response.

Tests updated to match real AWS behaviour (STANDARD storage-class header
omission; replication requires versioning) and regression tests added for the
SSE snapshot/restore round-trip, canned-ACL rejection, presign expiry cap, and
response-header overrides.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ifecycle accuracy

Deep AWS-parity audit of the ec2 service (gopherstack-r0h), focused on Tags
and the instance attribute/lifecycle family:

- CreateTags/DeleteTags/DescribeTags previously only recognised ~9 resource
  types (instance, sg, vpc, subnet, volume, igw, route-table, natgateway,
  elastic-ip) via resourceExistsLocked/resourceTypeByID, so tagging AMIs,
  snapshots, network ACLs, transit gateways, VPN/customer gateways, VPC
  endpoints, launch templates, IPAM objects, and ~80 other resource types
  this backend models incorrectly failed with InvalidParameterValue even
  though the resource existed. Replaced with a comprehensive, AWS
  ResourceType-accurate prefix table and per-family existence checks
  (backend_resource_types.go), covering every independently-taggable
  resource type the backend implements.

- ModifyInstanceAttribute silently discarded disableApiTermination,
  disableApiStop, ebsOptimized, instanceInitiatedShutdownBehavior, and
  sourceDestCheck ("accepted but not modelled beyond acknowledgment") — a
  disguised stub. DescribeInstanceAttribute then hardcoded all of them back
  to fixed values (sourceDestCheck wrongly defaulted false; AWS defaults
  true). Now persisted for real: booleans land on the Instance struct,
  sourceDestCheck is proxied to the primary ENI (its true AWS owner), and
  RunInstances' own DisableApiTermination/InstanceInitiatedShutdownBehavior/
  EbsOptimized launch-time parameters are wired the same way.

- TerminateInstances/StopInstances never enforced disableApiTermination/
  disableApiStop, so a protected instance could always be torn down —
  added the OperationNotPermitted error AWS returns in that case.

- Instance carried no StateReason/StateTransitionReason, so DescribeInstances
  never surfaced why an instance stopped/terminated. Added <stateReason>
  and legacy <reason> wire fields, populated on user-initiated stop/
  terminate and cleared on start, matching AWS's Instance shape.

Found but not fixed (follow-up): DeleteVpc/DeleteSubnet (backend.go
DeleteVpc, DeleteSubnet) force-cascade-delete all dependents instead of
returning DependencyViolation like real AWS; changing this has a large
blast radius on existing cascade-delete test assumptions and is left for a
dedicated pass.

Gate: go build ./..., go vet ./services/ec2/..., go fix -diff ./services/ec2/...,
go test ./services/ec2/..., golangci-lint run ./services/ec2/... all green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…nsact-update key-mutation gaps

Deep parity re-audit of a previously-swept, mature dynamodb service (op-by-op
against aws-sdk-go-v2 dynamodb types). Found and fixed three genuine defect
families rather than padding an already-solid implementation:

1. Query/Scan Select parameter: the emulator never enforced AWS's documented
   restriction that Select can only combine with ProjectionExpression/
   AttributesToGet when Select=SPECIFIC_ATTRIBUTES, never rejected
   SPECIFIC_ATTRIBUTES without a projection, and never rejected
   ALL_PROJECTED_ATTRIBUTES on a bare table scan/query. It also always
   returned full Items for Select=COUNT, when AWS returns Count/ScannedCount
   only ("Returns the number of matching items, rather than the matching
   items themselves").

2. BatchWriteItem had no duplicate-key validation across a table's
   WriteRequest list (BatchGetItem already had this for its Keys list). Real
   AWS rejects a batch that targets the same primary key twice — via two
   Puts, two Deletes, or a Put+Delete pair — with ValidationException
   "Provided list of item keys contains duplicates". An existing test
   (TestBatchWriteItem_ValidRequests_NotAffectedByValidation) asserted the
   opposite for a Put(k1)+Delete(k1) batch; fixed the test to use disjoint
   keys and added a dedicated regression test for the rejection.

3. TransactWriteItems' Update action never validated that its
   UpdateExpression avoids key attributes, unlike plain UpdateItem. Since
   updateIndexes() only ever adds/overwrites the new key's index slot and
   never removes a stale one, an unvalidated key-mutating transactional
   update would silently corrupt pkIndex/pkskIndex (leaving a dangling entry
   under the old key pointing at the item's new state) — a real state
   corruption bug, not just a missing validation.

Gates: go build ./..., go vet ./services/dynamodb/..., go fix -diff (empty),
go test ./services/dynamodb/... (all pass), golangci-lint run
./services/dynamodb/... (0 issues).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Keeps the spa dir tracked when built output is absent/gitignored.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…root

SNS backend.go already implements deliverToLambdaSubscriptions and
deliverToFirehoseSubscriptions (called from Publish), gated on
b.lambdaBackend/b.firehoseBackend being non-nil, but SetLambdaBackend/
SetFirehoseBackend were only ever called from tests -- never from cli.go.
In the running binary, subscribing a Lambda function or Firehose delivery
stream to an SNS topic and publishing silently no-opped.

Add wireSNSToLambdaFirehose, called alongside wireSNSToSQS in
initializeServices, wiring:
- SNS.SetLambdaBackend(lambdaBk) directly (lambda's InvokeFunction already
  satisfies sns.LambdaInvoker since InvocationType is a string alias).
- SNS.SetFirehoseBackend via a new snsFirehosePutterAdapter, since
  firehose.PutRecordBatch takes a context but sns.FirehosePutter does not.
- SNS.SetSQSSender via the existing sqsSenderAdapter, so failed Lambda/
  Firehose deliveries with a RedrivePolicy reach the real subscription DLQ.
  This is separate from wireSNSToSQS, which wires the SNS->SQS subscription
  delivery path via a publish emitter; sqsSender only serves DLQ redelivery
  on failed Lambda/Firehose invocations, so there is no double-wiring.

Add TestWireSNSToLambdaFirehose_EndToEndDelivery, which builds real SNS,
Lambda, Firehose, and SQS in-memory backends, calls the same
wireSNSToLambdaFirehose used by cli.go, and proves genuine delivery:
a Firehose subscription's published message is flushed to S3, and a
Lambda subscription's invocation failure (no Docker runtime in test) is
redirected to the real SQS dead-letter queue via the wired SQS sender.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…permission persistence

RemovePermission read StatementId from query string; real SDK sends it as
URI path segment (/policy/{StatementId}) — route never matched, a disguised
stub no client could call. Fix ESM function-ARN parsing that dropped the
function name (kept only qualifier). Snapshot permissions map + rebuild
versionIndex/esmByFunctionARN on Restore (were lost across persistence).
Add Qualifier scoping, EventSourceToken/PrincipalOrgID fields.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…rsistence leaks

ListInstanceProfilesForRole ignored RoleName + returned hardcoded empty;
GetAccountAuthorizationDetails fabricated a fake v1 policy version. Fix HTTP
status codes (NoSuchEntity 404, EntityAlreadyExists/DeleteConflict/Limit 409,
were all 400). Percent-encode policy documents at wire boundary. Snapshot
handler tags + comprehensive backend state (SSH keys, MFA links, access-advisor)
that were dropped on restore. Apply tags-at-creation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

YAML-frontmatter parity manifests record audit state (last_audit_commit,
sdk_version, per-op/family wire/errors/state/persist status, gaps, leaks) so
the next audit diffs the delta instead of rescanning. Template at
services/_PARITY_TEMPLATE.md. Backfilled s3/ec2/dynamodb/lambda/iam from
their sweep reports.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…fan-out, delivery leaks

PublishBatch dropped per-entry MessageAttributes (wrong form-field prefix vs
SDK serializer) — broke FilterPolicy matching. Lambda/Firehose/SQS now share
one real signed envelope (was fabricated Signature); Firehose honors
RawMessageDelivery. ReplayPolicy fans out to all protocols (was HTTP/SQS only).
Persist + clean up topicMessageArchive; cap delivery observability buffers;
lock the signer cert URL; fix copy-paste KMSOptInRequired error message.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…cy enforcement, persistence

Query-protocol responses emitted two XML prologs (manual header + XMLBlob) —
malformed XML masked by lenient parsing. FIFO messages requeued on visibility
change/expiry appended to tail, letting newer same-group messages jump ahead —
now reinserted by SequenceNumber. Enforce RedriveAllowPolicy (was validated,
never checked). Persist fifoSeqCounter/hasActivity/lastPurgedAt. Export
NoVisibilityTimeout sentinel. Centralize VisibilityTimeout range check.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…ter extraction, RejectedLogEventsInfo shape

PutLogEvents no longer validates sequenceToken / returns InvalidSequenceToken /
DataAlreadyAccepted — AWS deprecated tokens and never errors on them. Real
per-event field extraction for $-referenced MetricValue (was fabricating 1.0);
TestMetricFilter now computes ExtractedValues (was empty stub). Fix
RejectedLogEventsInfo: TooOldLogEventEndIndex name + exclusive-end off-by-one.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…missing comparison operator

PutMetricDataOutput fabricated UnprocessedMetricData + partial-success — real
op has no such model; now validate-then-commit atomically. Parse MetricDatum
Values/Counts weighted arrays (were silently dropped) w/ percentile expansion.
Reject NaN/Inf/out-of-range values. Add missing LessThanLowerThreshold
comparison (those alarms never fired). Thread real alarm type into action
history; honor ListMetrics RecentlyActive=PT3H.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…leak, tag-before-create

Sign/Verify/GetPublicKey/DeriveSharedSecret/GenerateDataKeyPair(+WithoutPlaintext)/
GenerateMac/VerifyMac had no GrantTokens field — silently dropped, grant validity
never enforced (disguised stub). Unrecognized KeySpec now 400 ValidationException
(was 500). purgeKey drops leaked grantsByKey submap. Validate tags BEFORE creating
key/replica (was leaving orphaned untagged keys); ReplicateKey bypassed validation.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…t, change-set exec gates, event pagination

DeleteStack now idempotent no-op for missing stack (AWS models no not-found error).
Block DeleteStack/UpdateStack that would drop an export still imported via
Fn::ImportValue. ExecuteChangeSet gates on ExecutionStatus + deletes all stack
change sets. Fix ChangeSetNotFound wire code (was ChangeSetNotFoundException).
AUTO_EXPAND no longer satisfies IAM capability. DescribeStackEvents honors
NextToken via pkgs/page. Emit UPDATE_FAILED event on template parse failure.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… service deployments

Restore never rebuilt serviceIndex (reconciler's only feed) — every service went
invisible to deployment/scaling after restart. resourceTags side map absent from
snapshot (tag data loss). DescribeServiceDeployments/List/Stop were disguised stubs
(only test-seeded); now recorded by real CreateService/UpdateService/rollback + a
map-key leak fixed on cluster/service delete. CreateCluster now honors
capacityProviders/defaultStrategy/tags. Implement ContinueServiceDeployment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

cloudwatch sweep (ede7169) changed PutMetricData to return only error
(dropped the fabricated UnprocessedMetricData). Update the two cli.go
composition-root call sites from `_, err :=` to `err :=`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…fication

CompleteLayerUpload missing RepositoryNotFound FK check + silently overwrote an
already-registered layer (now LayerAlreadyExistsException). UploadLayerPart
discarded partFirstByte — no sequencing check (now InvalidLayerPartException).
PutImage trusted client imageDigest verbatim; now verified against manifest hash
(ImageDigestDoesNotMatchException).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…; drop tracked junk

DeleteDBInstance/DeleteDBCluster ignored SkipFinalSnapshot/FinalDBSnapshotIdentifier
— never validated the combo or took a final snapshot (disguised stub). Added
DeleteDBInstanceWithOptions/DeleteDBClusterWithOptions (additive — old signatures
preserved for cloudformation callers). DescribeDBInstances now honors Filters.
Remove stale tracked batch3_test.go.rej / batch3_test_pi.patch artifacts.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…on-stage move, idempotency

Fix concurrent map write: List/Describe/GetResourcePolicy held RLock but the
lazy *Store(region) helper writes b.secrets[region] on first touch. Rename
IncludeDeleted->IncludePlannedDeletion and owned-by-me->owning-service (wrong
wire keys, filters silently ignored). UpdateSecretVersionStage now requires
RemoveFromVersionId to name the current holder. Add CreateSecret
ClientRequestToken idempotency, NextRotationDate/SortBy. Route all timestamps
through injectable clock.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… + version selector

Intelligent-Tiering now auto-upgrades to Advanced for >4KiB/policies (was hard
reject). Parameter Policies require Advanced tier. Enforce 100-version cap
(ParameterMaxVersionLimitExceeded, was silently evicting labeled versions) + fix
parameterLabels leak. Enforce 15-level hierarchy limit. DescribeDocument no longer
embeds full Content (real DocumentDescription has none). Resolve $DEFAULT vs $LATEST.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…issing wire fields

Integration TimeoutInMillis ceiling/default was hardcoded 29000ms for all
protocols — HTTP APIs allow up to 30000ms (valid values were rejected).
Tag handlers now map ErrStageNotFound to 404 (was 500). Add absent wire fields:
Integration TlsConfig + ConnectionType (default INTERNET + VPC_LINK validation),
Stage ClientCertificateId + Tags (nested stage ARN), DomainName MutualTls +
DomainNameArn.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

… coercion, remove/copy

All PATCH ops shared a flatten function handling only single-segment add/replace
with verbatim string copy — AWS always sends PatchOperation.Value as a JSON string,
so every bool/int field (tracingEnabled, minimumCompressionSize, apiKeyRequired)
failed to unmarshal, and multi-segment paths (/variables/{name}, /binaryMediaTypes,
/apiStages, throttle) were silently dropped — setting one stage variable never worked.
New patch.go with JSON-Pointer paths, value coercion, remove/copy. Fix
UpdateGatewayResponse full-replace-on-patch; add UpdateAccount CloudwatchRoleArn,
Stage cache-cluster fields.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…AND shards

CreateStream(Tags)/AddTagsToStream/RemoveTags/ListTags used a parallel
unpersisted Handler.tags map — tags vanished on restart. Routed all 6 ops
through backend stream.Tags (persisted, single source). PutRecords on a missing
stream returned 200 w/ per-record InternalFailure — now top-level
ResourceNotFoundException; reject empty batch. ON_DEMAND streams get 4 shards
(was 1, caller ShardCount ignored). DescribeStream shard pagination
(Limit/ExclusiveStartShardId/HasMoreShards). Consumer 20-cap; persist account limit.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…RESS async, retry/catch

runMapItem checked only the Go error, not res.Error — failing Map iterations
were silently swallowed (nil holes, Map always succeeded). History recorder
discarded all event detail (Input/Output/Resource/Error) — every event body was
an empty shell. Allow async StartExecution on EXPRESS; StartSyncExecution on
STANDARD now returns StateMachineTypeNotSupported. Separate Error/Cause in Catch.
Add state-level Retry/Catch on Map+Parallel, Retry MaxDelaySeconds/JitterStrategy,
Map ToleratedFailureCount/Percentage.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert functions/functionURLConfigs/eventSourceMappings/aliases/permissions to
store.Table (+aliasesByFunction/permissionsByTarget indexes); ephemeral-registry
split for never-persisted maps (codeSigning/capacityProviders/provisionedConcurrency).
16 maps left raw (no-identity/derived/live docker+OS handles — documented). 1 DTO
(permissions: json:"-" key fields). Preserves parity-sweep persistence fixes
(permissions snapshotted, versionIndex/esmByFunctionARN rebuilt). Full-state
round-trip test. Exported API unchanged; lambda -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert users/roles/policies/groups/accessKeys/instanceProfiles/providers/etc.
to store.Table via store_setup.go. 14 raw kept (secondary indexes + relation maps,
no pure key — all persistence-audited y/y). 0 DTOs. Rename ops use Delete(old)+Put.
comprehensiveBackend untouched (separate issue gjp). Snapshot version guard +
full-state round-trip test; tags/comprehensive persistence preserved. Store's
pure-key contract corrects a latent loginProfiles rename bug (flagged). Exported
API unchanged; iam -race (442 tests) + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert databases/tables/partitions/crawlers/jobs/triggers/connections/etc. to
store.Table via store_setup.go (persistence.go 445->210). 15 raw kept
(no-identity/one-to-many-history/ephemeral timers — persistence-audited). 0 DTOs.
Snapshot version guard + full-state round-trip test. Registry design also fixes 6
pre-existing persistence gaps (catalogImports/schemaVersionMetadata/integration
props/mlTaskRuns/customConnectionTypes were lost on restart, now persisted).
Exported API unchanged; glue -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert clusters/services/tasks/containerInstances/taskSets/capacityProviders/
daemons/etc. to store.Table (+per-cluster/service indexes). 10 raw kept
(slice-valued/reverse-index/struct-key/no-identity — persistence-audited).
0 DTOs. Preserves serviceIndex-rebuild, resourceTags, real serviceDeployments.
Snapshot version guard + full-state round-trip test. Exported API unchanged;
ecs -race (420 tests) + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert instances/clusters/snapshots/parameterGroups/subnetGroups/proxies/
globalClusters/etc. to store.Table (composite keys for proxyTargetGroups/
customEngineVersions/tenantDatabases). 12 raw kept (mixed-key/slice/ephemeral —
persistence-audited: automatedBackups excluded for mixed keying like ec2
addressTransfers). Preserves DeleteDBInstanceWithOptions + filter fixes. Snapshot
version guard + full-state round-trip test. Exported API unchanged; rds -race +
build + vet green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert parameters/documents/commands/sessions/patch-baselines/etc. to store.Table.
Multi-region backend handled via per-region lazy Table registration under
'<resource>/<region>' keys; Restore pre-registers regions from snapshot. 19 raw
kept (one-to-many/no-identity/slice-logs — all persistence-audited y/y). 0 DTOs.
Snapshot version guard + re-seed defaults on discard + full-state round-trip test.
Exported API unchanged; ssm -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert things/thingTypes/thingGroups/certificates/policies/rules/jobs/etc. to
store.Table via store_setup.go (net -445 LOC; auditExtraSnapshot group deleted).
23 raw kept (no-identity/non-pointer/slice/nested — persistence-audited).
1 DTO (topicRuleDestinations: ConfirmationToken json:-). shadows left raw to
preserve a pre-existing Reset quirk. Snapshot version guard. Exported API
unchanged; iot -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert dashboards/analyses/datasets/dataSources/templates/themes/users/groups/
folders/etc. to store.Table via store_setup.go. 18 raw kept (no-identity/bool/
string/slice — persistence-audited). 0 DTOs. Snapshot version guard + full-state
round-trip test. Exported API unchanged; quicksight -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert restApis/resources/deployments/stages/authorizers/apiKeys/usagePlans/etc.
to store.Table. Flatten nested per-API maps to composite-key flat tables +
secondary indexes; add explicit cascade-delete for DeleteRestAPI. 9 direct + 9 DTO
tables (composite key on json:- field). 3 raw kept (persistence-audited).
Preserves patch.go PATCH semantics. Snapshot version guard + round-trip test.
Exported API unchanged; apigateway -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…te 3 index maps (Phase 3.3)

Convert pools/clients/users/groups/resourceServers/identityProviders/etc. to
store.Table; flatten nested pool->subkey maps to composite keys. Eliminate
poolsByName/clientsByPool/usersBySub — folded into auto-maintained store.Index
(dozens of dual-write sites removed). 14 raw kept (persistence-audited). 2 DTOs
(pools/users: RSA signing key). Snapshot version guard + round-trip test.
Exported API + JWKS handoff unchanged; cognitoidp -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert distributions/cachePolicies/OAC/functions/keyGroups/etc. to store.Table;
invalidations as composite-key tables + byDist/byTenant indexes. 3 raw kept
(no-identity — persistence-audited). 2 DTOs (invalidations: unexported parent-id
fields). Preserves distSearchInverted token index (rebuilt on Restore). Snapshot
version guard + round-trip test. Exported API unchanged; cloudfront -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert clusters/snapshots/parameterGroups/subnetGroups/eventSubscriptions/
scheduledActions/usageLimits/endpointAccess/etc. to store.Table (persistence.go
296->150). 3 raw kept (no ClusterIdentifier field — persistence-audited y/y).
0 DTOs. Snapshot version guard + full-state round-trip test. Exported API
unchanged; redshift -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert alarms/compositeAlarms/dashboards/anomalyDetectors/insightRules/
metricStreams/alarmMuteRules/metricFilters to store.Table. 2 raw kept: metrics
(hot PutMetricData nested map, left inline like sqs messages) + alarmHistory
(slice) — persistence-audited y/y. 0 DTOs. PutMetricData signature preserved
(cli.go call sites intact). Snapshot version guard + round-trip test. Exported
API unchanged; cloudwatch -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…tri-map (Phase 3.3)

Convert keys/aliases/customKeyStores to per-region store.Table; grants+grantsByToken+
grantsByKey collapse into one Table[Grant] + 2 indexes (deleted rebuildGrantIndexes
+ manual purge cleanup — now structural). 4 raw kept (policies/keyMaterials/
keyMaterialHistory — no-identity/slice, persistence-audited y/y incl. crypto
material round-trip). 0 DTOs. Snapshot version guard. Exported API unchanged;
kms -race + build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…e 3.3)

Convert logGroups/streams/subscriptionFilters/metricFilters (region-qualified
composite keys) + 18 flat tables + 4 ephemeral tables to store.Table/Registry.
Log events stay inline in LogStream. 2 raw kept (compiledPatterns/parsedQueries —
no-identity ephemeral caches). Region accessors replace *Store(region) helpers.
Preserves metric-filter extraction + RejectedLogEventsInfo. Snapshot version
guard + full-state round-trip test. Exported API unchanged; cwl -race + full
build green. (Agent replayed after a concurrent stash disturbed the tree.)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert customModels/guardrails/agents/knowledgeBases/flows/prompts/etc. to
store.Table; 4 parent->child maps via per-parent lazy registration. 24 non-*T-shape
fields left raw (counters/indexes/slices). 0 DTOs. bedrock has no persistence
wiring (not Persistable) — added registry round-trip test. Exported API unchanged;
bedrock -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert apps/campaigns/segments/templates/journeys/endpoints/channels/etc. to
store.Table (composite app-scoped keys). 10 raw kept (interface-valued/no-identity/
slice/counter — persistence-audited). 0 DTOs. Snapshot version guard; persist
registry keeps the same 11 always-persisted tables (4 converted tables stay
unpersisted, round-trip-tested). Exported API unchanged; pinpoint -race +
whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert buses/rules/targets (nested region->bus->rule)/archives/replays/
connections/apiDestinations/pipes/registries/schemas to store.Table. 4 raw kept
(one-to-many/no-identity). 0 DTOs. Two-registry design keeps pipes/registries/
schemas off the persisted registry (never-persisted before — gap preserved).
PutEvents/PutPartnerEvents signature preserved. Snapshot version guard +
round-trip test. Exported API unchanged; eventbridge -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert clusters/replicationGroups/snapshots/parameterGroups/users/userGroups/
serverlessCaches/globalReplicationGroups/etc. to store.Table (per-region tables +
one global via Registry). 1 raw kept (cacheSecurityGroupIngress slice — persistence-
audited). 1 DTO (clusters: unexported miniredis handle + preserved subset shape).
Snapshot version guard + full-state round-trip test. Exported API unchanged;
elasticache -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert topics/subscriptions/platformApplications/platformEndpoints/smsSandbox to
store.Table; nested topicSubscriptions -> auto-maintained store.Index (eliminated
manual index helpers). 5 raw kept (no-identity/bool/string/slice — persistence-
audited incl. topicMessageArchive). 0 DTOs. SetPublishEmitter/SetLambdaBackend/
SetFirehoseBackend/SetSQSSender + signer untouched. Snapshot version guard +
round-trip test. Exported API unchanged; sns -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert loadBalancers/targetGroups/listeners/rules/trustStores to store.Table +
listenersByLB/rulesByListener indexes (targets stay inline in TargetGroup). 3 raw
kept (bare-string/doubly-nested time maps — persistence-audited incl.
targetDrainingUntil parity fix). 0 DTOs. Cascade-delete copies index slices before
delete. Snapshot version guard + round-trip test. Exported API unchanged; elbv2
-race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert apis/schemas/datasources/resolvers/functions/types/domainNames/etc. to
store.Table; nested per-API collections as composite-key tables + byAPI indexes
(chosen over lazy registration since API IDs are unbounded). 1 raw kept (apiKeys —
no parent-id field). 0 DTOs. No persistence wiring — registry round-trip test.
Exported API + lambda/dynamodb setters unchanged; appsync -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

…3.3)

Eliminate apiData wrapper; nested per-API collections -> composite-key flat tables
+ indexes (5 clean + 12 DTO). 1 raw was unpersisted sharing-policy map, now
persisted (net-positive). Preserves per-protocol timeout + wire-field fixes.
Explicit cascade-delete via slices.Clone. Snapshot version guard + round-trip test.
Exported API unchanged; apigatewayv2 -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert domains/connections/vpcEndpoints/applications/packages/serverless-collections/
policies/etc. to store.Table; eliminate arnIndex/applicationNames into indexes.
7 raw kept (slice/boolean-set — persistence-audited). 13 clean + 4 DTO tables.
Preserved a pre-existing domainPackages persistence asymmetry (not fixed).
Snapshot version guard + round-trip test. Exported API unchanged; opensearch
-race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert clusters/acls/subnetGroups/users/parameterGroups/snapshots/reservedNodes
(per-region) + multiRegionClusters/multiRegionParameterGroups/serviceUpdates
(global) to store.Table. 2 raw kept (arnToResource no-identity, events slice —
persistence-audited). 0 DTOs. Nil-safe table wrappers preserve no-op-on-unseen-
region behavior. Snapshot version guard + full-state round-trip test. Exported API
unchanged; memorydb -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert repos/images/imageScanFindings/pullThroughCacheRules/lifecyclePolicies/
repositoryPolicies/etc. to store.Table; images as composite-key repo@digest +
byRepo index. 6 raw kept (no-identity nested/bare/index — persistence-audited).
7 direct + 3 DTO tables. Preserves layer sequencing + PutImage digest logic.
Snapshot version guard + full-state round-trip test. Exported API unchanged;
ecr -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert zones/healthChecks/keySigningKeys/cidrCollections/queryLoggingConfigs/
delegationSets/trafficPolicyInstances/changes to store.Table + zone-scoped indexes
(records stay inline in zoneData). 4 raw kept (slice/no-identity — persistence-
audited incl. tags). 7 clean + 1 DTO (zones: unexported fields; filtered from
RestoreAll). No index on mutable TrafficPolicyID (avoids staleness). Preserves
tag/CallerReference/CALCULATED-health fixes. Snapshot version guard + round-trip
test. Exported API unchanged; route53 -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert region-nested streams map to flat store.Table (composite region/name key +
streamsByRegion index); added Stream.Region field. shards/records/consumers stay
inline (hot path). 2 raw kept (fisThroughputFaults ephemeral, resourcePolicies
bare-string — persistence-audited). 0 DTOs. Preserves tag/PutRecords/ON_DEMAND/
pagination/OnDemandStreamCountLimit fixes. Snapshot version guard + round-trip
test. Exported API unchanged; kinesis -race + whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Convert region-nested secrets map to store.Table (composite region|name key +
byRegion index); secret versions/stages stay inline. 2 raw kept (resourcePolicies/
replicationConfigs bare-value — persistence-audited). 1 DTO (region + json:- fields).
Data-race fix now structural — tables registered at construction, no lazy-create
under RLock (-race + concurrency test green). Preserves wire-field/idempotency/clock
fixes. Snapshot version guard + full-state round-trip test. Exported API unchanged;
whole-repo build green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>