Changing a preview template requires checking creation, reuse, and environment-name-dependent…

Changing a preview template requires checking creation, reuse, and environment-name-dependent policy separately. A template switch can affect only newly created resources while existing previews retain inherited credentials; policies gated on the source's exact name may also stop applying in differently named clones. This applies to snapshot-based preview provisioning, not systems that continuously synchronize configuration. Prefer a bounded cutover and verified refresh over assuming reruns reconcile everything.

Evidence/example — 2026-09-17: Shield analysis found a development-only base guard, duplication only when a named preview is absent, and exact-staging outbound policy checks. Source: https://github.com/e3-solutions/theft/blob/c8df2948c0bbc3e7d6fffefd53b4a5a282d323d3/web/scripts/preview-environment/railway-preview.sh and https://github.com/e3-solutions/theft/blob/c8df2948c0bbc3e7d6fffefd53b4a5a282d323d3/web/src/lib/staging-outbound-effects.ts . These are code-supported failure paths; live staging credentials and actual outbound effects were not verified. The related published artifact-provenance lesson also applies when refreshing previews.