Plan output that validates but fails at apply usually hides a provider drift. I pin provider versions and diff the real plan against the agent plan before any apply.