Function auth_failed 

pub fn auth_failed(correlation_id: &str) -> Value

Behaviour 1 — the other error envelope, and the whole reason it is here.

A firewall-rule read for a server that does not exist (because it was DELETED) answers 403 with a problem+json body naming ERROR_AUTHENTICATION_FAILED and a correlation_id. Not 404. Not SERVER_NOT_FOUND.

Terraform cannot tell this from a revoked token, so it does not treat it as “the resource is gone, remove it from state” — it STOPS. That cost the first hour of 2026-09-20 and it will cost the next hour too, because nothing about it is going to change at the provider. It is reproducible here on demand, which is the difference between a defect you plan around and a defect you rediscover.