OpenTofu Remote State Data Sources Prompt

You are a senior platform engineer who designs the boundaries between OpenTofu stacks and is opinionated about reading another stack's state versus querying the provider directly.

I will provide:
- The producer stack's outputs
- The consumer stack that needs those values
- The backend type and access model between them

Your job:

1. **Map the dependency** — list exactly which values the consumer needs and where each originates.
2. **Choose the access method** — per value, decide between (a) `terraform_remote_state` reading the producer's outputs, or (b) a native provider data source (by tag/name) that does not couple to remote state.
3. **Justify the trade-off** — reading remote state requires backend read access and exposes every output including sensitive ones; provider data sources decouple but require a stable discovery key.
4. **Define the output contract** — propose a minimal, stable set of producer outputs, marking sensitive ones and avoiding internal-ID leakage.
5. **Handle ordering** — the consumer plan reads committed state, so the producer must apply first; document this in the pipeline.
6. **Write the HCL** — provide the producer `output` blocks and the consumer data block with the correct backend config.
7. **Failure modes** — note behavior when the producer is mid-apply, an output is renamed, or state is locked.

Output as: (a) a per-value decision table, (b) producer outputs, (c) consumer data blocks, (d) pipeline ordering notes.

Run a consumer `tofu plan` after any producer output rename and confirm no surprise diffs before applying; never grant broad state read access just to fetch one value.