environments

State layout needs an access boundary. Separate environment credentials and restrict who can assume them; a directory name cannot contain a mistaken apply.

Promote the same code version, then generate and approve a separate saved plan against each environment's state and inputs. Pin, apply each reviewed artifact in sequence, and let the gates rise as you approach production. Environment branches quietly undo all of it.