fix(deploy): a reader of a resource replaced in the deploy is sent, not skipped, when a secret rewrote its values (#4838)

changelog.d/entries/2026-10-13-4838-rotated-secret-reader-generation.md

@@ -0,0 +1 @@
+- **A reader that spells a secret is no longer skipped, left on a deleted resource's ID, when the secret-named resource it reads is replaced under the rotated secret (issue [#4838](https://github.com/go-to-k/cdkd/issues/4838))** -- `src/deployment/deploy-engine/update.ts`. When a secret rotated and a create-only change replaced a resource named from it (an SQS queue renamed `sdin-q-1` -> `sdin-q-2`), a reader that also spells the same `{{resolve:...}}` reference (a tag beside `Value: Fn::GetAtt Queue.Arn`) recorded the new name against that reference, so the new ARN redacted to the same `arn:...:{{resolve:...}}` it had stored for the old queue. The no-change re-check compared equal, the reader was not updated, and it kept the deleted queue's ARN in AWS. A resource that reads a resource whose physical ID changed in this deploy is now sent, rather than skipped, whenever the redaction rewrote any of its values. A create-only property the redaction rewrote counts as changed, so a reader such as an event source mapping is replaced rather than updated in place. A reader whose values no secret rewrote, or of a resource replaced under the same physical ID, is still skipped. A reader left stale by an interrupted earlier deploy, a nested child fed by a parameter, and a cross-stack consumer are not covered (issue [#4852](https://github.com/go-to-k/cdkd/issues/4852)).

docs/_generated/integ-coverage.json

@@ -6341,6 +6341,7 @@
       "resourceType": "AWS::SNS::Subscription",
       "integs": [
         "composite-stack",
+        "secret-derived-immutable-names",
         "sns-event-source",
         "sns-inline-subscription",
         "sns-sqs-event",
@@ -6351,6 +6352,10 @@
         "composite-stack": [
           "literal"
         ],
+        "secret-derived-immutable-names": [
+          "l1",
+          "literal"
+        ],
         "sns-event-source": [
           "literal"
         ],
@@ -6408,6 +6413,7 @@
         "s3-lifecycle",
         "scheduled-task",
         "schema-v10-to-v11-migration",
+        "secret-derived-immutable-names",
         "serverless-api",
         "sns-event-source",
         "sns-inline-subscription",
@@ -6541,6 +6547,10 @@
         "schema-v10-to-v11-migration": [
           "l1"
         ],
+        "secret-derived-immutable-names": [
+          "l1",
+          "literal"
+        ],
         "serverless-api": [
           "l2"
         ],

docs/_generated/integ-last-run.tsv

@@ -92,9 +92,9 @@ dlm-lifecycle-policy	2026-10-08T06:25:38Z	PASS	110	verify.sh	PR #4697 (#4687 rep
 docdb-fix-forward-orphan	2026-10-11T09:33:22Z	PASS	1778	verify.sh	PR #4720 (#4705) final c53f78f real-AWS suite; rc 0, destroy clean, orph clean
 docdb-neptune	2026-10-07T20:26:24Z	PASS	5214	verify.sh	PR #4654 rebased on #4662/#4664 (#4639 database slice create client); rc 0, destroy clean, orph clean
 docker-image-asset	2026-09-25T09:36:54Z	PASS	88	verify.sh	PR 3725 lane: identifier tail display boundaries; rc ok, orph clean
-drift-revert	2026-10-12T22:04:43Z	PASS	371	verify.sh	rc ok, orph clean; PR #4846 92a354a39 broad set for the deploy-engine/intrinsic-resolver change
+drift-revert	2026-10-13T02:04:17Z	PASS	381	verify.sh	rc ok, orph clean; PR #4851 0c5911c59 broad set for the deploy-engine update.ts change
 drift-revert-arrays	2026-10-11T09:33:22Z	PASS	221	verify.sh	PR #4720 (#4705) final c53f78f real-AWS suite; rc 0, destroy clean, orph clean
-drift-revert-vpc	2026-10-12T22:04:43Z	PASS	391	verify.sh	rc ok, orph clean; PR #4846 92a354a39 broad set for the deploy-engine/intrinsic-resolver change
+drift-revert-vpc	2026-10-13T02:04:17Z	PASS	401	verify.sh	rc ok, orph clean; PR #4851 0c5911c59 broad set for the deploy-engine update.ts change
 dsql	2026-10-01T14:55:31Z	PASS	211	verify.sh	rc ok, orph clean (#4290)
 dynamic-ref-cross-region	2026-10-05T15:21:15Z	PASS	221	verify.sh	rc ok, orph clean (#2868 PR #4588)
 dynamodb-autoscaling	2026-10-08T01:35:53Z	PASS	0	verify.sh	#4701 Phase 3: table rename replaces both ScalableTargets and both ScalingPolicies through ScalingTargetId, no NotFound; destroy 0 errors, 0 orphans
@@ -135,7 +135,7 @@ eventbridge-pipes	2026-10-11T09:33:22Z	PASS	171	verify.sh	PR #4720 (#4705) final
 eventbridge-scheduler	2026-09-30T18:16:33Z	PASS	95	verify.sh	rc ok, orph clean (#4242)
 eventbus-policy	2026-09-25T13:23:17Z	PASS	65	verify.sh	rc ok, orph clean; sha 762342a2a (#3718)
 eventsourcemapping-race	2026-10-11T09:33:22Z	PASS	115	verify.sh	PR #4720 (#4705) final c53f78f real-AWS suite; rc 0, destroy clean, orph clean
-export	2026-10-12T22:04:43Z	PASS	240	verify.sh	rc ok, orph clean; PR #4846 92a354a39 broad set for the deploy-engine/intrinsic-resolver change
+export	2026-10-13T02:04:17Z	PASS	225	verify.sh	rc ok, orph clean; PR #4851 0c5911c59 broad set for the deploy-engine update.ts change
 export-nested-stack	2026-10-12T05:32:07Z	PASS	185	verify.sh	PR #4823, #2925 on rebased sha 9ed27ba08, rc ok, destroy 0 errors, orph clean
 fallback-recreate-children	2026-10-11T09:33:22Z	PASS	115	verify.sh	PR #4720 (#4705) final c53f78f real-AWS suite; rc 0, destroy clean, orph clean
 fifo-sqs-event-source	2026-10-11T09:33:22Z	PASS	116	verify.sh	PR #4720 (#4705) final c53f78f real-AWS suite; rc 0, destroy clean, orph clean
@@ -184,7 +184,7 @@ intrinsics-torture-2	2026-10-11T09:33:22Z	PASS	65	verify.sh	PR #4720 (#4705) fin
 kinesis-esm-filter	2026-10-03T04:26:36Z	PASS	78	verify.sh	rc ok, orph clean (#4283 PR #4449)
 kinesis-stream-mode-switch	2026-10-07T21:11:42Z	PASS	95	verify.sh	PR #4683 (#4639 reset/timeout replay stamp in withoutServerErrorRetries); rc 0, destroy clean, orph clean
 kms-encryption	2026-07-26T18:20:27Z	PASS	25	standard	0727b sweep-b3 staleness re-run (rc=0); account clean
-lambda	2026-10-12T22:04:43Z	PASS	146	verify.sh	rc ok, orph clean; PR #4846 92a354a39 broad set for the deploy-engine/intrinsic-resolver change
+lambda	2026-10-13T02:04:17Z	PASS	120	verify.sh	rc ok, orph clean; PR #4851 0c5911c59 broad set for the deploy-engine update.ts change
 lambda-alias-provisioned-concurrency	2026-07-26T19:16:39Z	PASS	262	verify.sh	0727b sweep-b9 staleness re-run (rc=0); account clean
 lambda-arch-switch	2026-10-01T04:01:28Z	PASS	121	verify.sh	rc ok, orph clean (#4241)
 lambda-capacity-provider-default-name	2026-10-02T18:18:34Z	PASS	541	verify.sh	rc ok, orph clean (#4455)
@@ -282,7 +282,7 @@ recreate-via-cc-api	2026-10-12T13:04:36Z	PASS	126	verify.sh	PR #4828, #4821 on r
 recreate-via-sdk-provider	2026-10-07T07:15:44Z	PASS	110	verify.sh	PR #4646 on #4650 (#1889); rc 0, destroy clean, orph clean
 redacted-delete-address	2026-10-11T15:30:01Z	PASS	105	verify.sh	rc ok, orph clean (#4738 PR #4792)
 redshift-cluster-getatt	2026-10-03T06:39:46Z	PASS	315	verify.sh	rc ok, orph clean (#4497)
-remove-protection	2026-10-12T22:04:43Z	PASS	2150	verify.sh	rc ok, orph clean; PR #4846 92a354a39 broad set for the deploy-engine/intrinsic-resolver change
+remove-protection	2026-10-13T02:04:17Z	PASS	2139	verify.sh	rc ok, orph clean; PR #4851 0c5911c59 broad set for the deploy-engine update.ts change
 remove-protection-compensation	2026-10-03T00:35:27Z	PASS	326	verify.sh	rc ok, orph clean (#4318 attempt-cap compensation)
 remove-protection-journaled-orphan	2026-10-11T15:30:01Z	PASS	661	verify.sh	rc ok, orph clean (#4738 PR #4792)
 rename-refactor	2026-10-11T09:33:22Z	PASS	120	verify.sh	PR #4720 (#4705) final c53f78f real-AWS suite; rc 0, destroy clean, orph clean
@@ -328,7 +328,7 @@ schema-v9-to-v10-migration	2026-10-12T00:02:47Z	PASS	157	verify.sh	PR #4820 (#34
 scrub-nested-child	2026-10-05T15:20:25Z	PASS	171	verify.sh	rc ok, orph clean (#2868 PR #4588)
 sdk-ccapi-crossref	2026-10-12T05:09:48Z	PASS	110	verify.sh	PR #4823, #2925 on rebased sha 9ed27ba08, rc ok, destroy 0 errors, orph clean
 sdk-to-cc-autoroute	2026-10-11T09:33:22Z	PASS	231	verify.sh	PR #4720 (#4705) final c53f78f real-AWS suite; rc 0, destroy clean, orph clean
-secret-derived-immutable-names	2026-10-12T22:04:43Z	PASS	546	verify.sh	rc ok, orph clean; PR #4846 92a354a39 region-evidence re-resolve of a recorded reference; pre-fix arm red at step 4 (AssembledQueueReader update, #4805)
+secret-derived-immutable-names	2026-10-13T02:04:17Z	PASS	586	verify.sh	rc ok, orph clean; PR #4851 0c5911c59 reader of a producer replaced this run is updated, create-only reader replaced; pre-fix arm red at step 5g (reader kept the deleted queue ARN, #4838)
 secrets-array-nested	2026-10-12T00:02:47Z	PASS	393	verify.sh	PR #4820 (#3466) b48362d; rc 0, destroy clean, 0 state versions, orph clean
 secrets-dynamic-ref	2026-10-12T00:02:47Z	PASS	733	verify.sh	PR #4820 (#3466) b48362d; rc 0, destroy clean, 0 state versions, orph clean
 secrets-rotation-schedule	2026-10-03T04:27:48Z	PASS	72	verify.sh	rc ok, orph clean (#4283 PR #4449)