test(integ): cover the #1430 EventBridgeEnabled pair in the s3-lifecycle fixture

The unit tests pin the translation; this proves it against real AWS, and the
expected values are CloudFormation ground truth rather than a guess - a real
CFn A/B of this exact shape (stack Cdkd1430EbProbe, us-east-1) returned an
EMPTY body for `EventBridgeEnabled: false` and `{"EventBridgeConfiguration":
{}}` for `true`.

`s3-lifecycle` is the right home: it already carries an L1 `CfnBucket` for
precisely this class - CFn spellings the L2 cannot emit that cdkd dropped -
and it has no custom resource in the path. L1 is required rather than
stylistic, because the L2's `eventBridgeEnabled` routes through a
Custom::S3BucketNotifications custom resource that never reaches
`S3BucketProvider`'s own NotificationConfiguration handling.

The `false` half rides on the existing LegacyBucket; the `true` half is its
own bucket, and it is asserted FIRST as the vacuity guard - asserting only
that the `false` bucket lacks the block would pass just as happily if cdkd
stopped applying NotificationConfiguration altogether.

A `cdkd drift` call on the clean stack covers the read side: pre-fix,
`readCurrentState` returned the SDK's `{}` against a CFn-shaped state
baseline, so the boolean read back as permanently missing.

Both captures normalize an empty response body to `{}` before jq sees it. An
unconfigured bucket returns an EMPTY body, not `{}` - the exact shape
CloudFormation produces for the `false` case - and jq given empty input emits
nothing, so the assertion failed on cdkd's CORRECT output. The first real run
of this fixture did exactly that.

Run: PASS, 3 phases, destroy 3 deleted / 0 errors / 0 orphans.

Author: go-to-k

docs/_generated/integ-last-run.tsv

@@ -230,7 +230,7 @@ s3-asset-deploy	2026-07-26T19:45:58Z	PASS	58	verify.sh	0727b sweep-b12 staleness
 s3-cloudfront	2026-08-08T17:42:05Z	PASS	228	verify.sh	1373 OriginCustomHeaders create+update-survive asserts green; destroy 0 errors 0 orphans
 s3-directory-bucket	2026-08-02T15:38:47Z	PASS	50	verify.sh	re-run for #1347 wontdo-comment PR; guard + clean destroy, 0 orphans
 s3-event-notification	2026-07-21T05:28:05Z	PASS	79	verify.sh	rc ok, orph clean
-s3-lifecycle	2026-08-09T13:59:22Z	PASS	57	verify.sh	post-delta-review re-run (#1388/#1424); rule-level keys asserted live; 2 del/0 err, 0 orphans
+s3-lifecycle	2026-08-09T15:54:29Z	PASS	150	verify.sh	#1430 EventBridgeEnabled true/false + clean-drift asserts added; destroy 0 err, 0 orph
 s3-object-lock	2026-07-21T14:42:20Z	PASS	53	verify.sh	rc ok, orph clean
 s3-replication-and-filter	2026-07-21T14:43:45Z	PASS	63	verify.sh	rc ok, orph clean
 s3-tables	2026-07-27T16:53:47Z	PASS	45	verify.sh	issue #1270/#1272 post-review re-run; 5 del 0 err, 0 orphans

tests/integration/s3-lifecycle/lib/s3-lifecycle-stack.ts

@@ -112,6 +112,23 @@ export class S3LifecycleStack extends cdk.Stack {
     new s3.CfnBucket(this, 'LegacyBucket', {
       bucketName: `cdkd-lifecycle-legacy-${cdk.Stack.of(this).account}`,
       versioningConfiguration: { status: 'Enabled' },
+      // Issue #1430, same class as the lifecycle shapes below: a CFn spelling
+      // with no SDK member behind it. CFn's `EventBridgeConfiguration` carries
+      // a REQUIRED boolean, while the SDK's block is an EMPTY structure whose
+      // PRESENCE enables delivery — so the boolean has nothing to map onto and
+      // has to be translated into presence/absence. cdkd emitted the SDK block
+      // whenever the CFn block existed, so this `false` came up with
+      // EventBridge notifications ON: the inverse of the template.
+      //
+      // Ground truth is a real CloudFormation A/B of this exact shape (stack
+      // Cdkd1430EbProbe, us-east-1, 2026-08-10): `false` -> no EventBridge
+      // block; `true` -> `{}`. `EbEnabledBucket` below is the `true` half, and
+      // it is what keeps the `false` assertion from passing vacuously.
+      //
+      // L1 is required, not a stylistic choice: the L2's `eventBridgeEnabled`
+      // routes through a Custom::S3BucketNotifications custom resource, which
+      // never reaches `S3BucketProvider`'s own NotificationConfiguration path.
+      notificationConfiguration: { eventBridgeConfiguration: { eventBridgeEnabled: false } },
       lifecycleConfiguration: {
         rules: [
           {
@@ -131,5 +148,15 @@ export class S3LifecycleStack extends cdk.Stack {
         ],
       },
     });
+
+    // The `true` half of the issue #1430 pair. Kept as its own bucket rather
+    // than folded into LegacyBucket because the two values are mutually
+    // exclusive on one bucket, and asserting only the `false` side would pass
+    // just as happily if cdkd stopped applying NotificationConfiguration
+    // altogether — this bucket is the vacuity guard for that assertion.
+    new s3.CfnBucket(this, 'EbEnabledBucket', {
+      bucketName: `cdkd-lifecycle-ebtrue-${cdk.Stack.of(this).account}`,
+      notificationConfiguration: { eventBridgeConfiguration: { eventBridgeEnabled: true } },
+    });
   }
 }

tests/integration/s3-lifecycle/verify.sh

@@ -83,6 +83,9 @@ STATE_KEY="cdkd/${STACK}/${REGION}/state.json"
 ACCOUNT_ID="$(aws sts get-caller-identity --query Account --output text)"
 BUCKET_NAME="cdkd-lifecycle-test-${ACCOUNT_ID}"
 LEGACY_BUCKET="cdkd-lifecycle-legacy-${ACCOUNT_ID}"
+# The EventBridgeEnabled: true half of the issue #1430 pair (the `false` half
+# rides on LEGACY_BUCKET).
+EB_TRUE_BUCKET="cdkd-lifecycle-ebtrue-${ACCOUNT_ID}"
 
 # Resolve the built CLI path without a `cd` into dist/ that fails cryptically
 # (aborting under `set -e`) when dist/ is unbuilt -- the friendly guard below
@@ -97,6 +100,7 @@ cleanup() {
   fi
   aws s3api delete-bucket --bucket "${BUCKET_NAME}" --region "${REGION}" >/dev/null 2>&1 || true
   aws s3api delete-bucket --bucket "${LEGACY_BUCKET}" --region "${REGION}" >/dev/null 2>&1 || true
+  aws s3api delete-bucket --bucket "${EB_TRUE_BUCKET}" --region "${REGION}" >/dev/null 2>&1 || true
   if [ -n "${STATE_BUCKET:-}" ]; then
     aws s3 rm "s3://${STATE_BUCKET}/${STATE_KEY}" >/dev/null 2>&1 || true
     aws s3 rm "s3://${STATE_BUCKET}/cdkd/${STACK}/${REGION}/lock.json" >/dev/null 2>&1 || true
@@ -204,6 +208,62 @@ if [ "${LEG_RULES}" != "2" ] || [ "${LEG_T}" != "90" ] || [ "${LEG_NVT}" != "30"
 fi
 echo "    legacy singular Transition + NoncurrentVersionTransition + NoncurrentVersionExpirationInDays + rule-level ExpiredObjectDeleteMarker all applied"
 
+# --- issue #1430: NotificationConfiguration.EventBridgeConfiguration --------
+# Same class as the legacy lifecycle keys above -- a CFn spelling with no SDK
+# member behind it. CFn carries a REQUIRED boolean `EventBridgeEnabled`; the
+# SDK's block is an EMPTY structure whose PRESENCE enables delivery. cdkd
+# emitted the block whenever the CFn block existed, so an explicit `false`
+# ENABLED notifications.
+#
+# Expected values are CloudFormation ground truth, not a guess: a real CFn A/B
+# of this exact shape (stack Cdkd1430EbProbe, us-east-1, 2026-08-10) returned
+# an EMPTY body for `false` and `{"EventBridgeConfiguration": {}}` for `true`.
+#
+# An unconfigured bucket returns an EMPTY body, not `{}`, so both captures are
+# normalized before jq sees them -- without that the `false` assertion fails on
+# cdkd's CORRECT output. (The first real run of this assertion did exactly
+# that.) The captures are unguarded on purpose: `set -e` aborts on a genuine
+# API failure, so reaching the normalization with an empty string means a
+# successful call on an unconfigured bucket.
+EB_TRUE_JSON="$(aws s3api get-bucket-notification-configuration \
+  --bucket "${EB_TRUE_BUCKET}" --region "${REGION}" --output json)"
+EB_FALSE_JSON="$(aws s3api get-bucket-notification-configuration \
+  --bucket "${LEGACY_BUCKET}" --region "${REGION}" --output json)"
+[ -n "${EB_TRUE_JSON//[[:space:]]/}" ] || EB_TRUE_JSON='{}'
+[ -n "${EB_FALSE_JSON//[[:space:]]/}" ] || EB_FALSE_JSON='{}'
+
+EB_TRUE_HAS="$(printf '%s' "${EB_TRUE_JSON}" | jq -r 'has("EventBridgeConfiguration")')"
+EB_FALSE_HAS="$(printf '%s' "${EB_FALSE_JSON}" | jq -r 'has("EventBridgeConfiguration")')"
+
+# The `true` side runs FIRST and is the vacuity guard: asserting only that the
+# `false` bucket lacks the block would pass just as happily if cdkd stopped
+# applying NotificationConfiguration altogether.
+if [ "${EB_TRUE_HAS}" != "true" ]; then
+  echo "FAIL: ${EB_TRUE_BUCKET} (EventBridgeEnabled: true) has NO EventBridgeConfiguration" >&2
+  echo "      response: ${EB_TRUE_JSON}" >&2
+  exit 1
+fi
+if [ "${EB_FALSE_HAS}" != "false" ]; then
+  echo "FAIL: ${LEGACY_BUCKET} (EventBridgeEnabled: false) HAS an EventBridgeConfiguration" >&2
+  echo "      this is the issue #1430 inversion: an explicit false enabled delivery" >&2
+  echo "      response: ${EB_FALSE_JSON}" >&2
+  exit 1
+fi
+echo "    EventBridgeEnabled true -> block present, false -> block absent (matches CloudFormation)"
+
+# Read side: `readCurrentState` must return the CFn shape
+# (`{EventBridgeEnabled: <bool>}`), not the SDK's `{}` -- the state baseline
+# holds the CFn spelling and drift-calculator only descends into keys present
+# in state, so the SDK shape reported permanent phantom drift on every
+# EventBridge-enabled bucket. `cdkd drift` exits 0 only when it finds none.
+if ! node "${LOCAL_DIST}" drift "${STACK}" \
+  --state-bucket "${STATE_BUCKET}" --region "${REGION}"; then
+  echo "FAIL: cdkd drift reported drift on a clean, freshly-deployed stack" >&2
+  echo "      (pre-#1430 the EventBridge boolean read back as permanently missing)" >&2
+  exit 1
+fi
+echo "    no drift on a clean stack (#1430 read side)"
+
 CREATION_P1="$(aws s3api list-buckets \
   --query "Buckets[?Name=='${BUCKET_NAME}'].CreationDate | [0]" --output text)"
 echo "    baseline bucket CreationDate=${CREATION_P1}"
@@ -241,6 +301,7 @@ assert_gone_eventually "bucket ${BUCKET_NAME} still exists after destroy" aws s3
 echo "    bucket deleted"
 
 assert_gone_eventually "legacy bucket ${LEGACY_BUCKET} still exists after destroy" aws s3api head-bucket --bucket "${LEGACY_BUCKET}" --region "${REGION}"
+assert_gone_eventually "EventBridge bucket ${EB_TRUE_BUCKET} still exists after destroy" aws s3api head-bucket --bucket "${EB_TRUE_BUCKET}" --region "${REGION}"
 echo "    legacy bucket deleted"
 
 assert_gone "state file ${STATE_KEY} still exists after destroy" aws s3api head-object --bucket "${STATE_BUCKET}" --key "${STATE_KEY}"