fix(dynamodb): merge the on-demand reset so a PARTIAL removal is not still dropped

Review blocker on the first version: the reset lived in an else-if, so it only fired when the new side had NO OnDemandThroughput at all. The read limit comes from Replicas[local].GlobalSecondaryIndexes[].ReadOnDemandThroughputSettings and the write limit from GSI.WriteOnDemandThroughputSettings - two INDEPENDENT CDK props - so removing just one left the other live in AWS forever. That is the #1423 bug itself, in the likelier user edit, shipped as fixed.

Now merges: start from the desired side and fill -1 for every member the template dropped. Live-probed the MIXED payload before adopting it, since only {-1,-1} had been verified: UpdateTable accepted { MaxReadRequestUnits: 50, MaxWriteRequestUnits: -1 } and DescribeTable read back { MaxReadRequestUnits: 50 } - dropped member cleared, kept member preserved.

The integ fixture now drops ONLY the write limit (the harder case) and verify.sh asserts write is absent while read is still 50. It also asserts the index EXISTS first: a '| [0]' query against a missing index also answers None, so the absence check alone would pass if byOwner had vanished.

The first integ run of that assertion FAILED because the rewritten queries lost the Table. prefix and length() received null - caught by the integ, fixed, re-run clean (182s, 3 deleted / 0 errors / 0 orphans).

Table-level and cross-region-replica on-demand ceilings have the same class and are filed as #1434; each needs its own live probe and the table-level one touches a different code path.

Author: go-to-k

docs/_generated/integ-last-run.tsv

@@ -77,7 +77,7 @@ drift-revert-arrays	2026-08-01T09:36:05Z	PASS	110	verify.sh	0801 regression swee
 drift-revert-vpc	2026-07-30T16:18:56Z	PASS	480	verify.sh	post-rebase final for PR #1307 (#1299/#1300): 6/6 reverted, 21 del 0 err 0 orphans
 dsql	2026-07-30T18:11:24Z	PASS	540	verify.sh	4-phase incl. destroy --remove-protection CC flip (#1312); orph clean
 dynamodb-autoscaling	2026-07-21T14:33:57Z	PASS	77	verify.sh	rc ok, orph clean
-dynamodb-globaltable	2026-08-09T14:14:39Z	PASS	279	verify.sh	issue #1423 per-GSI on-demand limit RESET asserted live (reads back absent); 3 del/0 err, 0 orphans
+dynamodb-globaltable	2026-08-09T14:33:56Z	PASS	182	verify.sh	#1423 PARTIAL removal asserted live (write reset absent, read kept 50); 3 del/0 err, 0 orphans
 dynamodb-gsi-update	2026-07-20T08:09:23Z	PASS	579	verify.sh	rc ok, orph clean
 dynamodb-ondemand	2026-08-01T10:07:21Z	PASS	81	verify.sh	0801 regression sweep; ondemand+policy+kinesis backfills ok, 0 orphans
 dynamodb-sse	2026-08-01T10:07:21Z	PASS	40	verify.sh	0801 regression sweep; SSE mapping ok, 0 orphans

src/provisioning/providers/dynamodb-globaltable-provider.ts

@@ -1298,38 +1298,46 @@ export class DynamoDBGlobalTableProvider implements ResourceProvider {
         // a flip to on-demand — the same silent-drop class #1387 exists to close.
         const billingFlipped = oldBilling !== newBilling;
         const update: UpdateGlobalSecondaryIndexAction = { IndexName: gsi.IndexName };
-        if (gsi.OnDemandThroughput) {
-          update.OnDemandThroughput = gsi.OnDemandThroughput;
-        } else if (!billingFlipped) {
-          // REMOVING a per-GSI on-demand limit from the template has to be sent
-          // as an explicit reset. Omitting the member leaves the old ceiling
-          // live in AWS forever while cdkd reports success — the
-          // absent-field-reset silent-drop class (#1160), one level down inside
-          // a nested block (#1225). CloudFormation resets it.
-          //
-          // `-1` is the reset sentinel, and that is LIVE-VERIFIED rather than
-          // inferred from the table-level field's docs (issue #1423): a real
-          // UpdateTable with `{-1, -1}` on the per-GSI Update action was
-          // ACCEPTED, and DescribeTable afterwards reported the member as
-          // ABSENT — i.e. genuinely cleared, not stored as -1. Reset semantics
-          // are field-specific, so this was probed, never assumed.
-          //
-          // Only the members that were actually SET before are reset: blanket
-          // `{-1, -1}` would clear a sibling limit the template still declares.
-          // Skipped on a billing flip, where "no on-demand fields" is just the
-          // translation of a PROVISIONED side, not a template removal.
-          const previousOnDemand = previousSdkByName.get(gsi.IndexName)?.OnDemandThroughput;
-          if (previousOnDemand) {
-            const reset: OnDemandThroughput = {};
-            if (previousOnDemand.MaxReadRequestUnits !== undefined) {
-              reset.MaxReadRequestUnits = ON_DEMAND_LIMIT_RESET;
-            }
-            if (previousOnDemand.MaxWriteRequestUnits !== undefined) {
-              reset.MaxWriteRequestUnits = ON_DEMAND_LIMIT_RESET;
-            }
-            if (Object.keys(reset).length > 0) update.OnDemandThroughput = reset;
+        // On-demand limits: MERGE the desired side with an explicit reset for
+        // every member the template DROPPED. Omitting a removed member leaves
+        // the old ceiling live in AWS forever while cdkd reports success — the
+        // absent-field-reset silent-drop class (#1160), one level down inside a
+        // nested block (#1225). CloudFormation resets it.
+        //
+        // Merging rather than branching is load-bearing: the read limit comes
+        // from `Replicas[local].GlobalSecondaryIndexes[].ReadOnDemandThroughput-
+        // Settings` and the write limit from `GSI.WriteOnDemandThroughputSettings`
+        // — two INDEPENDENT CDK props. An `else if` that only fired when the new
+        // side had no on-demand block at all would still silently drop the
+        // single-member removal, which is the likelier user edit.
+        //
+        // `-1` is the reset sentinel, LIVE-VERIFIED rather than inferred from
+        // the table-level field's docs (issue #1423). Both payload shapes were
+        // probed against real AWS: `{-1, -1}` cleared both members, and the
+        // MIXED `{MaxReadRequestUnits: 50, MaxWriteRequestUnits: -1}` was
+        // accepted and read back as `{MaxReadRequestUnits: 50}` — the dropped
+        // member cleared, the kept one preserved. In both cases the reset reads
+        // back as ABSENCE, never as -1, so drift comparisons must expect that.
+        //
+        // Skipped on a billing flip, where "no on-demand fields" is just the
+        // translation of a PROVISIONED side rather than a template removal.
+        const previousOnDemand = previousSdkByName.get(gsi.IndexName)?.OnDemandThroughput;
+        const onDemand: OnDemandThroughput = { ...gsi.OnDemandThroughput };
+        if (!billingFlipped && previousOnDemand) {
+          if (
+            previousOnDemand.MaxReadRequestUnits !== undefined &&
+            onDemand.MaxReadRequestUnits === undefined
+          ) {
+            onDemand.MaxReadRequestUnits = ON_DEMAND_LIMIT_RESET;
+          }
+          if (
+            previousOnDemand.MaxWriteRequestUnits !== undefined &&
+            onDemand.MaxWriteRequestUnits === undefined
+          ) {
+            onDemand.MaxWriteRequestUnits = ON_DEMAND_LIMIT_RESET;
           }
         }
+        if (Object.keys(onDemand).length > 0) update.OnDemandThroughput = onDemand;
         // Provisioned capacity on a flip is step 4's job, so only a real
         // same-billing-mode edit sends it from here.
         if (!billingFlipped && gsi.ProvisionedThroughput) {

tests/integration/dynamodb-globaltable/lib/dynamodb-globaltable-stack.ts

@@ -202,19 +202,19 @@ export class DynamoDBGlobalTableStack extends cdk.Stack {
         {
           indexName: 'byOwner',
           partitionKey: { name: 'owner', type: ddb.AttributeType.STRING },
-          // Issue #1423: REMOVING these from the template must reset the live
-          // ceiling, not silently no-op. Under `drop-gsi-ondemand-limits` both
-          // are omitted, and verify.sh asserts DescribeTable reports the
-          // member ABSENT afterwards (the reset reads back as absence, never
-          // as -1).
+          // -> Replicas[local].GlobalSecondaryIndexes[].ReadOnDemandThroughputSettings
+          maxReadRequestUnits: 50,
+          // Issue #1423: REMOVING this from the template must RESET the live
+          // ceiling, not silently no-op. `drop-gsi-ondemand-limits` drops ONLY
+          // the write limit and keeps the read one, which is the harder case:
+          // the two are independent CDK props, so a fix that only reset when
+          // the whole on-demand block disappeared would still drop this edit.
+          // verify.sh asserts the write member is ABSENT while read is still
+          // 50 (the reset reads back as absence, never as -1).
+          // -> GlobalSecondaryIndexes[].WriteOnDemandThroughputSettings
           ...(updateMode.includes('drop-gsi-ondemand-limits')
             ? {}
-            : {
-                // -> Replicas[local].GlobalSecondaryIndexes[].ReadOnDemandThroughputSettings
-                maxReadRequestUnits: 50,
-                // -> GlobalSecondaryIndexes[].WriteOnDemandThroughputSettings
-                maxWriteRequestUnits: 60,
-              }),
+            : { maxWriteRequestUnits: 60 }),
         },
       ],
       removalPolicy: cdk.RemovalPolicy.DESTROY,

tests/integration/dynamodb-globaltable/verify.sh

@@ -411,15 +411,29 @@ echo "[verify] step 13b: cdkd deploy with drop-gsi-ondemand-limits (issue #1423
 CDKD_TEST_UPDATE=ttl,tags,drop-gsi-ondemand-limits ${CLI} deploy "${STACK}" --state-bucket "${STATE_BUCKET}" --verbose
 
 # The reset reads back as ABSENCE, never as -1 (live-probed on #1423). Pre-fix
-# the template removal emitted nothing at all, so the 50/60 ceiling stayed live
-# in AWS forever while cdkd reported success.
-OD_AFTER="$(aws dynamodb describe-table --table-name "${GSI_OD_TABLE}" --region "${REGION}" \
-  --query "Table.GlobalSecondaryIndexes[?IndexName=='byOwner'].OnDemandThroughput | [0]" --output text)"
-if [ "${OD_AFTER}" != "None" ]; then
-  echo "FAIL: issue #1423 — byOwner still carries OnDemandThroughput after the template removed it: ${OD_AFTER}" >&2
+# the template removal emitted nothing at all, so the 60 write ceiling stayed
+# live in AWS forever while cdkd reported success.
+#
+# Assert the index still EXISTS first: a `| [0]` query against a MISSING index
+# also answers "None", so the absence check alone would pass if `byOwner` had
+# vanished entirely.
+OD_IDX="$(aws dynamodb describe-table --table-name "${GSI_OD_TABLE}" --region "${REGION}" \
+  --query "length(Table.GlobalSecondaryIndexes[?IndexName=='byOwner'])" --output text)"
+if [ "${OD_IDX}" != "1" ]; then
+  echo "FAIL: byOwner index missing after the drop-limits update (count=${OD_IDX})" >&2
+  exit 1
+fi
+# The DROPPED member must be gone...
+OD_WRITE="$(aws dynamodb describe-table --table-name "${GSI_OD_TABLE}" --region "${REGION}" \
+  --query "Table.GlobalSecondaryIndexes[?IndexName=='byOwner'].OnDemandThroughput.MaxWriteRequestUnits | [0]" --output text)"
+# ...while the one the template STILL declares must survive untouched.
+OD_READ="$(aws dynamodb describe-table --table-name "${GSI_OD_TABLE}" --region "${REGION}" \
+  --query "Table.GlobalSecondaryIndexes[?IndexName=='byOwner'].OnDemandThroughput.MaxReadRequestUnits | [0]" --output text)"
+if [ "${OD_WRITE}" != "None" ] || [ "${OD_READ}" != "50" ]; then
+  echo "FAIL: issue #1423 — expected write=None (reset) / read=50 (kept), got write=${OD_WRITE} / read=${OD_READ}" >&2
   exit 1
 fi
-echo "    per-GSI on-demand limits reset (OnDemandThroughput absent), issue #1423 closed"
+echo "    per-GSI write limit reset (absent) and read limit kept at 50, issue #1423 closed"
 
 echo "[verify] step 14a: assert DeletionProtectionEnabled flipped back to false on AWS"
 DP_FINAL="$(aws dynamodb describe-table --table-name "${TABLE_NAME}" --region "${REGION}" \

tests/unit/provisioning/dynamodb-globaltable-provider-gsi-throughput.test.ts

@@ -556,6 +556,36 @@ describe('DynamoDBGlobalTable GSI throughput translation (issue #1387)', () => {
       ]);
     });
 
+    it('resets the DROPPED member while KEEPING the one still declared (partial removal)', async () => {
+      // The likeliest user edit: read and write limits are two independent CDK
+      // props (read via the local replica, write on the GSI), so removing ONE
+      // is common. A branch that only reset when the new side had NO on-demand
+      // block at all would silently leave the other ceiling live — the very
+      // #1423 bug, shipped as fixed. Live-probed: the MIXED payload
+      // {MaxReadRequestUnits: 50, MaxWriteRequestUnits: -1} is accepted and
+      // reads back as {MaxReadRequestUnits: 50}.
+      const previous = structuredClone(ON_DEMAND_TABLE_PROPS) as Record<string, unknown>;
+      const next = structuredClone(ON_DEMAND_TABLE_PROPS) as Record<string, unknown>;
+      // Drop ONLY the write limit; the replica-side read limit (50) stays.
+      delete (next['GlobalSecondaryIndexes'] as Record<string, unknown>[])[0]![
+        'WriteOnDemandThroughputSettings'
+      ];
+
+      await provider.update('OnDemand', 'od-table', RESOURCE_TYPE, next, previous);
+
+      const gsiUpdates = mockSend.mock.calls
+        .map((c) => c[0])
+        .filter(
+          (c): c is UpdateTableCommand =>
+            c instanceof UpdateTableCommand &&
+            (c.input.GlobalSecondaryIndexUpdates ?? []).some((u) => u.Update !== undefined)
+        );
+      expect(gsiUpdates).toHaveLength(1);
+      expect(
+        gsiUpdates[0]!.input.GlobalSecondaryIndexUpdates?.[0]?.Update?.OnDemandThroughput
+      ).toEqual({ MaxReadRequestUnits: 50, MaxWriteRequestUnits: -1 });
+    });
+
     it('resets ONLY the member that was actually set before', async () => {
       // A blanket {-1, -1} would clear a sibling limit the template still
       // declares.