Pulled upstream origin/main; this checkout is current at e299b5104.

Yes—there’s an Atmos bug in concurrent streaming: pkg/io/line_prefix_writer.go:109 preserves raw \r while injecting

prefixes, and the Terraform adapter uses separate stdout/stderr locks (pkg/scheduler/adapters/terraform.go:1291). That

explains the overwritten/shifted fragments.

Immediate workaround, retaining concurrency:

atmos terraform apply ... --max-concurrency 3 --log-order grouped -auto-approve

That avoids live prefixed streams. No code changed.

The tests verify

SuppressSpinners()

and its nested cleanup behavior, but they do not verify that

ExecuteTerraform

activates suppression when

MaxConcurrency > 1

and restores it after completion. I recommend adding that adapter-level regression test. It will protect the policy that parallel execution must downgrade transient UI.

!terraform.state

rds_sensitive_properties = <sensitive>

justastring

<MASKED>

hooks:
        store-outputs:
          outputs:
            rds_properties: .rds_properties

"db_name" = "justastring"

rds_properties

justastring

rds_sensitive_properties

output "rds_sensitive_properties" {
  sensitive   = true
  description = <<-EOF
  RDS Sensitive Properties:

    db_instance_username: "The master username for the database"
    db_instance_password: "The password for the master user (null if AWS-managed)"
  EOF
  value = {
    db_instance_username = var.rds_requirements.username
    db_instance_password = var.rds_options.manage_master_user_password ? null : random_password.rds_password[0].result
  }
}

db_instance_username

The Recommended Next Step
Check every output on the component, not only rds_properties, for the sensitive = true marker. Run this command:

atmos terraform output <component> -s <stack> --json | jq 'to_entries[] | select(.value.sensitive)'
Or, search the module file <http://outputs.tf|outputs.tf> for the text sensitive = true.

If a sensitive output's value shares text with the stack name, that output is the source of the masked text. The store, the variable, and rds_properties are not the source.