terraform {
  required_version = ">= 1.5.0"

  required_providers {
    # Probe machines (overseas reference points, doc/04 §1) run on a small,
    # privacy-friendly cloud. Hetzner Cloud is used as the reference example;
    # swap the provider per the identity-isolation register.
    hcloud = {
      source  = "hetznercloud/hcloud"
      version = "~> 1.45"
    }
  }

  # State holds ONLY low-frequency baseline resources (probes, control-plane
  # env). Disposable data-plane nodes are NEVER in state — they are cattle,
  # managed by the provision service via vendor APIs (doc/04 §4).
  #
  # Configure a remote, access-restricted backend out-of-band (e.g. an S3-
  # compatible bucket on the management account). Left as local here so the
  # module stays runnable for `terraform validate`.
  # backend "s3" { ... }
}