TypeSet detailed diff falls back to whole-set UPDATE on deeply nested set blocks (WAFv2 WebACL rules) #3495

Summary

After pulumi import of WAFv2 WebACL resources, pulumi preview shows phantom diffs on the rules property — the entire set is shown as UPDATE rather than element-level diffs, even when no changes exist. This is caused by the bridge's detailed diff algorithm failing to match nested TypeSet elements.

Discovered during a Pulumi Professional Services migration of ~700 resources from Terraform.

Root Cause

The bridge's validInputsFromPlan function explicitly documents this limitation:

detailed_diff.go:166:

"nested sets will only get matched if they are exactly the same"

detailed_diff.go:197-198:

"nested sets will likely get their elements reordered. This means that nested sets will not be matched correctly but that should be a rare case."

When matchPlanElementsToInputs fails to match all elements, makeSetDiff falls back to a whole-set UPDATE.

WAFv2 WebACL rules is a real-world case where this "rare case" is the common case, because the schema has multiple levels of nested TypeSet blocks:

rules (TypeSet)
  ├─ action (TypeSet)
  ├─ visibility_config (TypeSet)
  └─ statement (TypeSet)
       ├─ byte_match_statement (TypeSet)
       │    ├─ field_to_match (TypeSet)
       │    └─ text_transformation (TypeSet)
       ├─ and_statement (TypeSet)
       │    └─ statement (TypeSet)  ← recursive nesting
       ├─ or_statement (TypeSet)
       ├─ not_statement (TypeSet)
       └─ ... (10+ statement types, all TypeSet)

The nested TypeSet elements get reordered during planning, validInputsFromPlan returns false for the mismatched elements, and the fallback triggers.

Observed Behavior

After pulumi import of a WAFv2 WebACL:

pulumi preview
...
  ~ rules: [
      ... (entire set shown as UPDATE)
    ]

Expected Behavior

Either element-level diffs (if actual changes exist) or no diff (if the rules are unchanged).