Optionalplanthe provider's instance id (e.g. the D1 uuid, the KV namespace id).
the binding outputs captured at provision/bind time (so downstream refs resolve without re-calling the provider).
a stable fingerprint of (name + plan + params), to detect drift → an update step.
Optionalprotectedcarried from the spec so teardown/prune (which work off the journal) honour the destroy guard.
The live record of a provisioned instance (the journal
plandiffs against — like drizzle's migration meta).