[satyakigh]

Summary

Fixes property-presence handling for retention and schema validation when resource properties are conditional, intrinsic, or macro-owned.

The change makes SemanticModel::property_absence_scenarios the shared source of truth for reachable top-level property absence:

• Fn::Transform branches are unknown rather than absent because a macro can supply the property.
• Explicit dynamic values such as parameter references count as present.
• Whole-Properties Fn::If branches are evaluated independently.
• Absence branches that conflict with the resource's Condition or are unsatisfiable are ignored.
• Concrete missing values and reachable property-level AWS::NoValue branches still produce I3013.
• A direct Properties: !Ref AWS::NoValue is rejected with F3012 because Properties must be an object; it does not cascade into I3013 or required-property findings.
• A resource-level macro remains authoritative and can replace an authored non-object Properties value, so that case stays unknown rather than producing F3012.
• CEL and Rego consume the same model result; the documented Rego property_can_be_absent builtin keeps its existing signature and missing-resource behavior.

Related issue

None.

Validation behavior changes

Before this change, DynamicQueue in good/E3505_unresolved_dynamic_and_covering.yaml produced I3013 even though its entire Properties object comes from AWS::Include. CloudFormation evaluates the included object during processing, so offline validation cannot prove that MessageRetentionPeriod is absent. See the AWS::Include transform documentation.

After this change:

• The invalid DynamicQueue I3013 finding is removed.
• Two missing F3012 findings are added for direct whole-Properties AWS::NoValue references in integration/ref-no-value.yaml (IamRole2 and CloudFront1).
• The corpus changes by three diagnostics: one informational diagnostic removed and two fatal diagnostics added.
• Reachable concrete and conditional missing-retention cases continue to fire.
• Focused coverage includes resource-, property-set-, sibling-, nested-, and conditional transforms; explicit dynamic values; all-present conditional branches; reachable and impossible condition combinations; resource conditions; direct and conditional AWS::NoValue; and a resource-level macro counterexample.

Checklist

• Expected behavior is supported by CloudFormation syntax, macro semantics, and focused valid/invalid examples.
• All three engine selectors agree on diagnostics, severity, path, location, and message.
• My code adheres to the CONTRIBUTING GUIDE and repository code-quality conventions.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license.