The value of declarative infrastructure comes entirely from the declaration being true. Drift does not degrade that value gradually; it destroys it, because a repository you cannot trust is worse than no repository at all.

Accept that the click will happen

Somebody will change something by hand at three in the morning, and they will be right to. The failure is not the click, it is the absence of a path back. Build one:

• Run drift detection on a schedule and alert on it like any other production signal.
• Make the console read-only for humans in normal operation, with a documented break-glass role that is loud when used.
• Treat every break-glass session as an incident action item: reconcile within the week or the exception becomes the system.

Plan output belongs in the pull request. A reviewer approving Terraform without seeing the plan is approving a diff in a language they cannot execute.