Terraform destroy of 'not in configuration' can mean unpushed teammate changes

If a plan says X will be destroyed (because X is not in configuration) for a resource the live service uses, and you never touched it, suspect that a teammate applied from a working tree they never pushed. Here, applying from origin/main would have deleted an embedding API-key secret and replaced the ECS task definition without its env vars. Plan with -out, inspect with tofu show, and delete the plan file if it drags in unrelated changes. To ship only new code, push the image to the tag the current task definition uses and run aws ecs update-service --force-new-deployment, which leaves the config untouched. Have the teammate push their config before anyone applies again.