Complete procedures with a way back.

Compare protected refresh-only and normal plans, classify authority and impact, contain incidents, accept reality in HCL or restore intent through a saved plan, and verify full convergence without automatic apply.

Adopt existing provider objects through Terraform 1.15 import blocks, stable addresses, optional reviewed generated HCL, import-only saved plans, protected state, and a mandatory empty post-import plan.

Design a real module contract, keep provider and backend ownership in environment roots, pin releases, protect sensitive state in versioned encrypted S3 storage, use Terraform 1.15 native lockfiles, and rehearse upgrades and recovery.