Terraform needs a lock around applies because it lacks resource-level concurrency. The apply boundary is at the state file, so everything in it gets locked together.

choudoufu moves the boundary to each resource. This change prevents state corruption without a lock.

Apply A changes db and apply B changes subnet. Under Terraform B waits for A’s lock on the whole state file; under choudoufu, with the resources in two estates, both land and a stale saved plan on db is refused

Each resource’s estate comes from the live block of the directory that declares it. See concurrency and locks.

Across roots

Teams split state into roots to shrink what one lock covers. Across roots, a changed value is planned on its last applied version, and Terragrunt and Atmos plan a new ID on a mock.

Scorecard of one plan, changed values, new IDs, approved plans and applies across roots, on stock backends and on the choudoufu live backend

Two changes across network and app. On a stock backend the pull request shows app with no change or a mocked subnet ID, and the apply does something else. On the choudoufu live backend the pull request shows the real change and that plan applies

Keep Terragrunt, Atmos or terragucci. On the live backend, the saved plan you review is the plan that applies.

The demos

Each one builds network, app and edge and runs its pipeline on a local Forgejo.

Prove it to yourself with your own agent

Paste into a coding agent · read only · emulator only 
Read https://lex00.github.io/posts/resource-level-concurrency-for-terraform/

Check every mark in this post's scorecard against the current docs and source of each tool, including https://intentius.io/terragucci/ and https://intentius.io/choudoufu/. Quote the supporting passage with a link and the date read, or mark it unsupported.

Use a local AWS emulator, never a real account. Make three Terragrunt units where app reads a new subnet from network through a `dependency` block. Run `terragrunt run --all --out-dir plans` to plan and then apply, once with OpenTofu and again with `terraform_binary = "choudoufu"`. Report the subnet id in app's saved plan and the one it applied.

Read more

Sources