For (1) "Add option to lock on apply instead of plan" is something I've been eying as a possible solution for that. We're having the same problem, and depending on my work priorities, I might work on it in late Q2 or early Q3. What we've done so far is to use --disable-autoplay-label and have the label be added "on creation" and have folks manually plan with a specific

-p

flag while working - it's certainly not perfect. Still, it reduced congestion significantly compared to the default experience. (useful combined with --disable-unlock-label) For (2), we're rolling out Atlantis per project (coming from a monolithic instance before) and will end up with +100 of them. The cost isn't too bad, and it allows us to "seed" new Atlantis versions/images without blast radius and different levels of configuration tailored to teams. It also helps ensure very strong security isolation (Container role per Atlantis) and doesn't depend on Atlantis or Provider configuration to nail that down. We plan to add some automation that allows us to scale Atlantis to zero in off-hours and, just in time, scale it up if a WebHook event is triggered to improve efficiency even further. We are currently experimenting with an "Atlantis" K8s Controller to manage all of it (health checking, seeding + rollout images, scaling up/down, and all that jazz). If it works nicely, we plan to OSS it later in the year.