drawio-aws-referencelisted

# AWS architecture diagrams in draw.io The goal is to hand over a `.drawio` file the user can open and adjust without rebuilding nodes. Most rework comes from four mechanical mistakes, and all four are avoidable by following this spec literally. Mermaid is fine for iterating on the logic inside the conversation. The deliverable is always `.drawio`. ## Source of truth When the user supplies both a prose description and a Mermaid sketch, **the prose wins.** Mermaid is a convenience for reading the shape of the system, and it drops detail: a flow mentioned in the description but missing from the diagram is still a flow. Read both, then check for **orphans**: any resource with no edge in or out. A bucket nothing writes to, a queue nothing reads, a database nobody queries. An orphan is almost always a gap in the source description rather than a real dead end. Ask before drawing it, and say which flow you think is missing. ## Required workflow 1. Settle the logic of the diagram in text or Mermaid, and confirm it with the user before writing any XML. 2. Look up every name: service icons in `reference/resicons.txt`, VPC sub-components and actors in `reference/shapes.txt`, containers in `reference/groups.md`. Never write a stencil name from memory. 3. Write the `.drawio` file. 4. Run `scripts/validate.py` against it and fix everything it reports as an error. 5. Deliver, and close with the handover note below. Step 4 is not optional. A diagram that has not passed th