diff --git a/access/.tflint.d/policies/security.rego b/access/.tflint.d/policies/security.rego
index 6d39036..75aa626 100644
--- a/access/.tflint.d/policies/security.rego
+++ b/access/.tflint.d/policies/security.rego
@@ -159,8 +159,29 @@ deny_boundary_required contains issue if {
 	)
 }
 
-# Warning, because the estate declares no security groups yet, so the rule has
-# no live coverage to ratchet against.
+# Warning, because the estate declares no security groups of its own, so the
+# rule has no live coverage to ratchet against. The second clause reads the
+# inline ingress blocks of an aws_security_group, which is the shape
+# terraform plan -generate-config-out writes for an adopted group (lesson
+# 15), so an adopted group with an open port gets the warning the rule was
+# written for rather than slipping past it on shape alone.
+warn_no_open_ingress contains issue if {
+	some r in terraform.resources("aws_security_group", {"ingress": {"cidr_blocks": "list(string)", "ipv6_cidr_blocks": "list(string)", "from_port": "number", "to_port": "number"}}, {"expand_mode": "none"})
+	some ing in r.config.ingress
+	some key in ["cidr_blocks", "ipv6_cidr_blocks"]
+	attr := ing.config[key]
+	not attr.unknown
+	some cidr in attr.value
+	cidr in open_cidrs
+	issue := tflint.issue(
+		sprintf(
+			"aws_security_group.%s opens %v to %s in an inline ingress block. Name the source security group, and declare the rule as its own aws_vpc_security_group_ingress_rule so it has an address a review can point at.",
+			[r.name, ing.config.from_port.value, cidr],
+		),
+		attr.range,
+	)
+}
+
 warn_no_open_ingress contains issue if {
 	some r in terraform.resources("aws_vpc_security_group_ingress_rule", {"cidr_ipv4": "string", "cidr_ipv6": "string"}, {"expand_mode": "none"})
 	some key in ["cidr_ipv4", "cidr_ipv6"]
diff --git a/access/README.md b/access/README.md
index f5e8ff1..5cc2fad 100644
--- a/access/README.md
+++ b/access/README.md
@@ -24,7 +24,7 @@ access/
   modules/
     persona/     the four archetypes a principal file instantiates
   backends/      the two backend files, one of which is copied into an env
-  scripts/       backend, check, and the lesson 6 to 11 scripts below
+  scripts/       backend, check, and the lesson 6 to 15 scripts below
   codeowners.map team name to GitHub handle, the one place the two meet
   .tflint.d/
     policies/    the rule pack, as Rego
@@ -149,7 +149,7 @@ are Rego like the rest rather than a side script.
 | `no-iam-user-or-group` | error | any IAM user, group, access key or attachment to one |
 | `tag-owner-required` | error | a role, policy, bucket, registry or permission set with no `owner` tag |
 | `boundary-required` | error | a role, or a principal file that makes one, with no `permissions_boundary` |
-| `no-open-ingress` | warning | an ingress rule naming `0.0.0.0/0` or `::/0` |
+| `no-open-ingress` | warning | an ingress rule, or an inline `ingress` block on a group, naming `0.0.0.0/0` or `::/0` |
 | `sg-reference-not-cidr` | warning | an ingress rule naming a raw CIDR instead of a source group |
 | `trust-subject-pinned` | error | a federated trust with no subject condition, a subject matched by pattern, or a subject carrying a wildcard |
 | `trust-audience-pinned` | error | a federated trust with no `StringEquals` audience, or an OIDC provider that lists no client id or is not https |
@@ -931,3 +931,61 @@ declared because Identity Center is read only live, folds in the rotation
 check, and closes with what it did not see. `access-review.yml` runs it
 quarterly against a Floci the job filled itself, which proves the shape and
 not a real account, and uploads the artifact for four hundred days.
+
+## Lesson 15, adopt in place
+
+A resource that existed before the repo comes under management one file at
+a time, and nothing about it changes except the estate's own tags.
+
+```
+access/
+  envs/prod/
+    provider.tf               ec2 joins the endpoint overrides for the first security group
+    <type>.<label>.tf         an import block and the reviewed resource, one file each, on a laptop and never here
+  .tflint.d/policies/
+    security.rego             no-open-ingress reads inline ingress blocks too
+  scripts/
+    adopt-check               every import in a root, tags only or fail
+```
+
+### The shape
+
+An adopted resource's file holds its `import` block and its resource block
+together. The resource block is `terraform plan -generate-config-out`
+reviewed by hand, with `region`, `tags_all`, every null and every provider
+default dropped, so the file says what the account holds and nothing the
+provider invented. One resource at a time (decision 38).
+
+### The one change
+
+The provider's `default_tags` put `managed_by`, `repo` and `env` on
+everything the estate owns, so the plan for an import is never empty here.
+`adopt-check` reads the plan JSON for every importing resource and passes
+one whose only differing attribute is `tags_all`, and fails one that would
+change anything else, naming the attribute, because an apply would then edit
+the account rather than adopt it (decision 62).
+
+```sh
+access/scripts/adopt-check
+access/scripts/adopt-check satellites/waterpark-runner
+```
+
+### Adoption exempts nothing
+
+An adopted role with no boundary and no owner tag fails `boundary-required`
+and `tag-owner-required` like a written one, and an adopted group with an
+open port gets `no-open-ingress`, which now reads the inline `ingress`
+shape generated config writes. The failing check after an adoption is day
+two's list.
+
+### Backing out
+
+A `removed` block with `lifecycle { destroy = false }` takes a resource
+out of state and leaves it in the account. It is applied once and then
+deleted from the repo.
+
+### Never in this tree
+
+The adopted files import resources that exist only where a hand made them,
+so they live on the laptop that adopted them and the lesson's compare
+excludes them. The reference tree carries the mechanism and no adoption.
diff --git a/access/envs/prod/provider.tf b/access/envs/prod/provider.tf
index 7556b2a..4eedb48 100644
--- a/access/envs/prod/provider.tf
+++ b/access/envs/prod/provider.tf
@@ -20,6 +20,7 @@ provider "aws" {
       iam = endpoints.value
       sts = endpoints.value
       s3  = endpoints.value
+      ec2 = endpoints.value
     }
   }
 
diff --git a/access/scripts/README.md b/access/scripts/README.md
index 1b5b2c1..72a76d8 100644
--- a/access/scripts/README.md
+++ b/access/scripts/README.md
@@ -24,6 +24,7 @@ jobs are thin wrappers around these rather than shell embedded in YAML.
 | `expiring` | every dated grant, soonest first, read from the account | 11 |
 | `offboard` | remove a principal and every reference, with a preview that reads the account | 11 |
 | `access-review` | the quarterly artifact, every principal and what it can reach, read from the account | 11 |
+| `adopt-check` | every import in a root, passing only the ones that change nothing but the estate's tags | 15 |
 
 None of them holds a credential of its own. The ones that talk to an account
 take the throwaway `test` key pair against Floci by default, `LIVE=true`
diff --git a/access/scripts/adopt-check b/access/scripts/adopt-check
new file mode 100755
index 0000000..080dd80
--- /dev/null
+++ b/access/scripts/adopt-check
@@ -0,0 +1,133 @@
+#!/usr/bin/env bash
+# Adopt in place, checked. Every resource an import block brings under
+# management must arrive with nothing changed but the estate's own tags.
+#
+#   access/scripts/adopt-check              over envs/prod
+#   access/scripts/adopt-check <root>       over another root
+#   access/scripts/adopt-check --json ...   the same as JSON
+#
+# The mechanism is terraform plan -json, read for every resource change the
+# plan marks as importing. An import that plans no change is the ideal. An
+# import whose only change is tags_all is the estate's provider putting its
+# default tags, managed_by, repo and env, on a resource it now owns, which
+# is the one day-one change adoption makes here and the plan names it. Any
+# other attribute in the change means the file does not say what the account
+# holds, the review out of -generate-config-out missed something, and this
+# script fails with the attribute named so the file is fixed before the
+# apply rather than the account being edited by the apply (decision 62).
+#
+# Exit 0 when every import is clean or tags only. Exit 2 when one is not.
+# Exit 1 when the plan itself failed.
+set -uo pipefail
+
+access_root="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+cd "$access_root" || exit 1
+
+as_json=false
+root="envs/prod"
+while [ $# -gt 0 ]; do
+	case "$1" in
+	--json)
+		as_json=true
+		shift
+		;;
+	*)
+		root="$1"
+		shift
+		;;
+	esac
+done
+[ -d "$root" ] || {
+	echo "adopt-check: no such root: access/$root" >&2
+	exit 1
+}
+
+work="$(mktemp -d -t wp-adopt)"
+trap 'rm -rf "$work"' EXIT
+
+export AWS_ACCESS_KEY_ID="${AWS_ACCESS_KEY_ID:-test}"
+export AWS_SECRET_ACCESS_KEY="${AWS_SECRET_ACCESS_KEY:-test}"
+export AWS_DEFAULT_REGION="${AWS_DEFAULT_REGION:-us-east-1}"
+
+terraform -chdir="$root" init -input=false -no-color >"$work/init.log" 2>&1 || {
+	echo "adopt-check: terraform init failed in access/$root" >&2
+	tail -5 "$work/init.log" >&2
+	exit 1
+}
+terraform -chdir="$root" plan -input=false -no-color -out="$work/tfplan" >"$work/plan.log" 2>&1 || {
+	echo "adopt-check: terraform plan failed in access/$root" >&2
+	tail -8 "$work/plan.log" >&2
+	exit 1
+}
+terraform -chdir="$root" show -json "$work/tfplan" >"$work/plan.json" 2>/dev/null
+
+# One row per importing resource, with the attributes that differ between
+# what the account holds and what the file says, tags_all set aside.
+rows="$(jq -c '[
+  (.resource_changes // [])[]
+  | select(.change.importing != null)
+  | . as $c
+  | ($c.change.before // {}) as $b
+  | ($c.change.after // {}) as $a
+  | ([ (($b | keys? // []) + ($a | keys? // []) | unique)[]
+      | . as $k
+      | select(($b[$k] // null) != ($a[$k] // null))
+    ]) as $diff
+  | { address: $c.address, type: $c.type, id: $c.change.importing.id,
+      actions: $c.change.actions,
+      tags_only: (($diff | map(select(. != "tags_all"))) | length == 0),
+      other: ($diff | map(select(. != "tags_all"))),
+      tags_added: (if ($diff | index("tags_all")) != null then (($a.tags_all // {}) | to_entries | map(select(($b.tags_all // {})[.key] == null) | .key)) else [] end) }
+]' "$work/plan.json")"
+
+# Import blocks whose resource is already in state make no importing change
+# in the plan, so they are read off the files and reported as such, and a
+# plan that would still change one of them is read the same way as above.
+declared="$(grep -h -A1 '^import {' "$root"/*.tf 2>/dev/null | sed -n 's/^[[:space:]]*to[[:space:]]*=[[:space:]]*//p' | sort -u)"
+while IFS= read -r addr; do
+	[ -n "$addr" ] || continue
+	if jq -e --arg a "$addr" '.[] | select(.address == $a)' <<<"$rows" >/dev/null; then
+		continue
+	fi
+	change="$(jq -c --arg a "$addr" '
+    (.resource_changes // [])[] | select(.address == $a)
+    | . as $c | ($c.change.before // {}) as $b | ($c.change.after // {}) as $a2
+    | { actions: $c.change.actions,
+        other: ([ (($b | keys? // []) + ($a2 | keys? // []) | unique)[] | . as $k
+                  | select(($b[$k] // null) != ($a2[$k] // null)) ] | map(select(. != "tags_all"))) }' "$work/plan.json")"
+	if [ -z "$change" ] || [ "$(jq -r '.actions | join(",")' <<<"$change")" = "no-op" ]; then
+		rows="$(jq -c --arg a "$addr" '. + [{address: $a, type: "", id: "", actions: ["no-op"], tags_only: true, other: [], tags_added: [], in_state: true}]' <<<"$rows")"
+	else
+		rows="$(jq -c --arg a "$addr" --argjson ch "$change" '. + [{address: $a, type: "", id: "", actions: $ch.actions, tags_only: (($ch.other | length) == 0), other: $ch.other, tags_added: [], in_state: true}]' <<<"$rows")"
+	fi
+done <<EOT
+$declared
+EOT
+rows="$(jq -c 'sort_by(.address)' <<<"$rows")"
+
+count="$(jq 'length' <<<"$rows")"
+bad="$(jq '[.[] | select(.tags_only | not)] | length' <<<"$rows")"
+
+if [ "$as_json" = true ]; then
+	jq -n --argjson r "$rows" --arg root "$root" '{root: $root, imports: $r}'
+else
+	echo "adopt check, access/$root"
+	echo
+	if [ "$count" -eq 0 ]; then
+		echo "  no import block in this root, so nothing is being adopted"
+	else
+		jq -r '.[] | "  [" + (if .tags_only then "ok" else "FAIL" end) + "] " + .address + (if .id != "" then "  from " + .id else "  already in state" end)
+      + (if (.actions | index("no-op")) != null then "\n      nothing changes" else "" end)
+      + (if (.tags_added | length) > 0 then "\n      the estate adds its tags: " + (.tags_added | join(", ")) else "" end)
+      + (if (.other | length) > 0 then "\n      the file differs from the account on: " + (.other | join(", ")) + "\n      fix the file, because an apply would edit the account" else "" end)' <<<"$rows"
+	fi
+	echo
+	if [ "$bad" -eq 0 ]; then
+		echo "  $count adoption(s), and none changes anything but the estate's own tags."
+	else
+		echo "  $bad of $count adoption(s) would change the account. Adopt in place means the file says what is there."
+	fi
+fi
+
+[ "$bad" -eq 0 ] && exit 0
+exit 2
diff --git a/access/tests/fixtures/no-open-ingress/fail/security_group.legacy_open.tf b/access/tests/fixtures/no-open-ingress/fail/security_group.legacy_open.tf
new file mode 100644
index 0000000..9130d94
--- /dev/null
+++ b/access/tests/fixtures/no-open-ingress/fail/security_group.legacy_open.tf
@@ -0,0 +1,19 @@
+# Fails no-open-ingress on the inline shape. This is what an adopted group
+# looks like straight out of -generate-config-out, and the open port is the
+# same open port whichever shape declares it.
+resource "aws_security_group" "legacy_open" {
+  name        = "legacy-open"
+  description = "ssh from anywhere"
+  vpc_id      = "vpc-default-us-east-1"
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  tags = {
+    owner = "platform"
+  }
+}
diff --git a/access/tests/fixtures/no-open-ingress/pass/security_group.legacy_private.tf b/access/tests/fixtures/no-open-ingress/pass/security_group.legacy_private.tf
new file mode 100644
index 0000000..fa1b690
--- /dev/null
+++ b/access/tests/fixtures/no-open-ingress/pass/security_group.legacy_private.tf
@@ -0,0 +1,18 @@
+# Passes. An inline ingress from a private range is not the rule's concern,
+# even if the sibling rule would still rather it named a source group.
+resource "aws_security_group" "legacy_private" {
+  name        = "legacy-private"
+  description = "ssh from the office"
+  vpc_id      = "vpc-default-us-east-1"
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["10.0.0.0/8"]
+  }
+
+  tags = {
+    owner = "platform"
+  }
+}
diff --git a/content/courses/iam/15-adopt-in-place.md b/content/courses/iam/15-adopt-in-place.md
index ba6c822..c82b379 100644
--- a/content/courses/iam/15-adopt-in-place.md
+++ b/content/courses/iam/15-adopt-in-place.md
@@ -3,56 +3,467 @@ title: "Adopt in place"
 id: "I15"
 lesson: 15
 weight: 15
-summary: "Existing resources come under management by import with nothing touched."
+summary: "An import block brings what already exists under management, one file at a time, and changes nothing about it."
 # skill. a directory in this repo with a SKILL.md that drives the lesson. empty renders nothing
-skill: ""
+skill: "skills/i15-adopt-in-place"
 # card. empty renders as TODO
-goal: ""
-done_when: ""
-restart_from: "lesson 6"
+goal: "Make three things the way a console would, a role, a bucket and a security group with an open port, and watch the drift watch not see them. Then bring each under management with an `import` block and a resource block reviewed out of generated config, prove with a script that the only thing the apply changes is the tags the estate puts on what it owns, watch the rule pack refuse the adopted role the same way it would refuse a written one, back the group out with a `removed` block and find it still in the account, and say what walking away costs, which is nothing."
+done_when: >-
+  `access/scripts/adopt-check` reports three adoptions each changing nothing
+  but the estate's own tags and fails one whose file misstates the account
+  by naming the attribute, the apply reports `3 imported, 0 added, 3
+  changed` and the replan exits 0, `aws iam list-role-tags` on
+  `legacy-reporter` shows `managed_by`, `repo` and `env` beside the one tag
+  it had, `access/scripts/check lint` fails on the adopted role's missing
+  boundary and owner tag and warns on the group's open port, and after a
+  `removed` block is applied `legacy-ssh` is still in the account and the
+  replan still exits 0.
+restart_from: "checkpoint/i11"
 properties: ["I", "XII"]
-# media. provider is youtube, vimeo, file or todo
-video:
-  provider: todo
-  title: ""
-  length: ""
 # activity. kind is hands-on, watch-along or discuss
 activity:
   kind: hands-on
-  time: "20 min"
-  needs: []
-  solo: true
-  live: true
+  time: "35 min"
+  needs:
+    - "a water park checkout with the tags fetched"
+    - "Docker running, or the Start-here stack up, whose Floci this lesson can use as it is"
+    - "the patched Floci image ghcr.io/lex00/floci:iam-boundary"
+    - "terraform 1.9 or newer"
+    - "tflint from terraform-linters/tap/tflint"
+    - "jq"
+    - "just access-init run once per clone"
+    - "lesson 11 finished or at least read"
 ---
 
 ## Context
 
-- An `import` block brings a pre-existing role and security group under management, one resource at a time. You write the file and plan, or let `terraform plan -generate-config-out` write the first draft, which you then review by hand into the one-file-per-resource layout. Nothing changes on day one, and the plan proves it by showing no changes. A `removed` block backs a resource out of management without destroying it.
-- One at a time is the documented path, not a bulk import, because the repo manages what it declares and a bulk import declares a pile nobody has read (decision 38). Greenfield is the course's own path and needs no adoption story.
-- The estate stays in native form, so walking away means keeping the HCL and dropping everything else. There is no export bundle to build because there is nothing proprietary to export from.
+- Adopt in place is import from live, one resource at a time (decision 38). An `import` block names the resource and its id, `terraform plan -generate-config-out` writes a first draft of the resource block from what the account holds, and you review that draft by hand into the one-file-per-resource layout, with `region`, `tags_all`, every null and every provider default dropped. The import block and the resource block share the file, because the file is the resource's whole story.
+- Nothing about the resource changes on day one, and on this estate that sentence has one exception, which the lesson turns into a check. The provider's `default_tags` put `managed_by`, `repo` and `env` on everything the estate owns, so the plan for an import is never empty here. `access/scripts/adopt-check` reads the plan and passes an import whose only change is `tags_all`, and fails one that would change anything else, naming the attribute, because an apply would then edit the account rather than adopt it (decision 62).
+- Adoption exempts nothing. An adopted role with no boundary and no owner tag fails the same rules a written one would, and the failing check after an adoption is day two's list. This is what one at a time buys. A bulk import declares a pile nobody has read, and the checks would refuse the pile all at once with nobody to answer for any of it.
+- The drift watch cannot see a resource the repo does not declare. Lesson 7 said restoring is automatic and adopting is not, and this lesson is the other half of that sentence. Adopting is a file somebody wrote, planned and had reviewed, which is Accessible Ops XIII read from the outside in.
+- A `removed` block with `lifecycle { destroy = false }` takes a resource out of state and leaves it in the account. It is applied once and then deleted from the repo, because after the apply it has nothing left to say.
+- The estate stays in native form, so walking away means keeping the HCL and dropping everything else. There is no export bundle because there is nothing proprietary to export from, which is decision 2 and Accessible Ops I, and this lesson is the test of both.
+- The adopted files are yours and never the repo's. The resources they import exist only where your hand made them, so they stay on your laptop, the reference tree carries the mechanism and no adoption, and the compare at the end excludes them.
+- The group is the first `ec2` resource the estate has touched, so the provider gains an `ec2` endpoint for the emulator, the way lesson 8's satellite gained `ecr`. The inline `ingress` shape generated config writes is one the rule pack did not read until this lesson, and now `no-open-ingress` does.
 
-## Watch
+## Do
 
-{{< todo "Video script or link. Optional." >}}
+Fourteen lessons wrote an estate from nothing. This one starts from what is already there, which is where every real estate starts.
 
-## Do
+1. Start from the checkpoint lesson 11 left, get an emulator, and apply central and then the satellite.
+
+   ```sh
+   git fetch origin --tags
+   git worktree add ../waterpark-i15 checkpoint/i11
+   cd ../waterpark-i15
+   just access-init
+   ```
+
+   If the Start-here stack is up, its Floci already answers on port 4566
+   and this lesson can use it as it is, so skip the `docker run` below. It
+   runs with IAM enforcement off, which this lesson never needs, and it
+   holds whatever earlier Fountain lessons left, which is nothing this
+   lesson names. If the stack is down, start the container the earlier
+   lessons started.
+
+   ```sh
+   docker run -d --name wp-i15-floci -p 4566:4566 \
+     -e FLOCI_SERVICES_IAM_ENFORCEMENT_ENABLED=true \
+     ghcr.io/lex00/floci:iam-boundary
+   ```
+
+   Either way, then
+
+   ```sh
+   curl -s --retry 15 --retry-all-errors --retry-delay 1 \
+     -o /dev/null -w '%{http_code}\n' http://localhost:4566/
+
+   terraform -chdir=access/envs/prod init
+   terraform -chdir=access/envs/prod apply -auto-approve
+   terraform -chdir=access/satellites/waterpark-runner init
+   terraform -chdir=access/satellites/waterpark-runner apply -auto-approve
+   ```
+
+   `200`, then `Resources: 18 added` and `8 added`.
+
+2. Make three things the way a console would. A role for a reporting job somebody set up in 2024, a bucket it writes to, and a security group with port 22 open to the world. None of them goes through a pull request, and that is the point.
+
+   ```sh
+   export AWS_ACCESS_KEY_ID=test AWS_SECRET_ACCESS_KEY=test AWS_DEFAULT_REGION=us-east-1
+
+   aws --endpoint-url http://localhost:4566 iam create-role --role-name legacy-reporter \
+     --description "Made in the console in 2024." \
+     --assume-role-policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"lambda.amazonaws.com"},"Action":"sts:AssumeRole"}]}' \
+     --tags Key=team,Value=analytics --query Role.Arn --output text
+
+   aws --endpoint-url http://localhost:4566 s3 mb s3://legacy-uploads
+
+   SG=$(aws --endpoint-url http://localhost:4566 ec2 create-security-group \
+     --group-name legacy-ssh --description "ssh from anywhere" --query GroupId --output text)
+   aws --endpoint-url http://localhost:4566 ec2 authorize-security-group-ingress \
+     --group-id $SG --protocol tcp --port 22 --cidr 0.0.0.0/0 --query Return
+   echo $SG
+   ```
+
+   The ARN, `make_bucket: legacy-uploads`, `true`, and a group id like
+   `sg-4ebfc472f9999f8c2`. Keep the id, two files below need it. The
+   ingress call takes the id rather than the name, because the emulator
+   does not resolve a group by name on that call.
+
+   Now ask the watch.
+
+   ```sh
+   access/scripts/drift | tail -1
+   ```
+
+   `every watched root matches the account`. Three things the estate knows
+   nothing about, and the watch is right to say nothing, because it compares
+   what the repo declares against what the account holds and the repo
+   declares none of them. Lesson 7 called this the asymmetry. Restoring is
+   automatic, adopting is a file, and here are three files to write.
+
+3. Adopt the role. Give the provider its first `ec2` endpoint while you are in `envs/prod`, since the group needs it. Open `access/envs/prod/provider.tf` and add one line inside the `content` block after `s3`.
+
+   ```hcl
+       content {
+         iam = endpoints.value
+         sts = endpoints.value
+         s3  = endpoints.value
+         ec2 = endpoints.value
+       }
+   ```
+
+   Then write `access/envs/prod/iam_role.legacy_reporter.tf` with only the
+   import block in it, and let Terraform draft the rest.
+
+   ```hcl
+   import {
+     to = aws_iam_role.legacy_reporter
+     id = "legacy-reporter"
+   }
+   ```
+
+   ```sh
+   terraform -chdir=access/envs/prod init
+   terraform -chdir=access/envs/prod plan -generate-config-out=generated.tf
+   cat access/envs/prod/generated.tf
+   ```
+
+   `Plan: 1 to import, 0 to add, 1 to change, 0 to destroy.`, and the
+   draft, under a two-line header asking you to review it.
+
+   ```hcl
+   # __generated__ by Terraform from "legacy-reporter"
+   resource "aws_iam_role" "legacy_reporter" {
+     assume_role_policy = jsonencode({
+       Statement = [{
+         Action = "sts:AssumeRole"
+         Effect = "Allow"
+         Principal = {
+           Service = "lambda.amazonaws.com"
+         }
+       }]
+       Version = "2012-10-17"
+     })
+     description           = "Made in the console in 2024."
+     force_detach_policies = false
+     max_session_duration  = 3600
+     name                  = "legacy-reporter"
+     path                  = "/"
+     permissions_boundary  = null
+     tags = {
+       team = "analytics"
+     }
+     tags_all = {
+       team = "analytics"
+     }
+   }
+   ```
+
+   Read it against the role you made. The trust policy, the description,
+   the name and the tag are yours. `force_detach_policies`,
+   `max_session_duration` and `path` are the provider's defaults written
+   out, `permissions_boundary = null` is an absence spelled as a value, and
+   `tags_all` is what the provider computes and must never be declared. The
+   review is dropping all of that. Replace the file with this, which is the
+   import block and what the account actually holds.
+
+   ```hcl
+   # Adopted in lesson 15. This role existed before the repo did, made in a
+   # console, and the import block below is what brought it under management.
+   # Everything under the block is what the account held on the day, reviewed
+   # out of terraform plan -generate-config-out and nothing else.
+   import {
+     to = aws_iam_role.legacy_reporter
+     id = "legacy-reporter"
+   }
+
+   resource "aws_iam_role" "legacy_reporter" {
+     name        = "legacy-reporter"
+     description = "Made in the console in 2024."
+
+     assume_role_policy = jsonencode({
+       Version = "2012-10-17"
+       Statement = [{
+         Effect    = "Allow"
+         Principal = { Service = "lambda.amazonaws.com" }
+         Action    = "sts:AssumeRole"
+       }]
+     })
+
+     tags = {
+       team = "analytics"
+     }
+   }
+   ```
+
+   ```sh
+   rm access/envs/prod/generated.tf
+   ```
+
+   `generated.tf` is in `.gitignore` already, because a draft is never the
+   file.
+
+4. Bring in the check, and run it before and after breaking the file on purpose.
+
+   ```sh
+   git checkout checkpoint/i15 -- \
+     access/scripts/adopt-check \
+     access/.tflint.d/policies/security.rego \
+     access/tests/fixtures/no-open-ingress
+   access/scripts/adopt-check
+   ```
+
+   ```
+   adopt check, access/envs/prod
+
+     [ok] aws_iam_role.legacy_reporter  from legacy-reporter
+         the estate adds its tags: env, managed_by, repo
+
+     1 adoption(s), and none changes anything but the estate's own tags.
+   ```
 
-{{< todo "Numbered steps. Imperative. One job." >}}
+   That is the plan, read for you. One import, and the one change is three
+   tags the provider's `default_tags` put on everything the estate owns,
+   which is the estate's mark and nothing the role had. Now misstate the
+   account. Change `2024` to `2023` in the description, and run it again.
 
-1. {{< todo >}}
-2. {{< todo >}}
-3. {{< todo >}}
+   ```
+     [FAIL] aws_iam_role.legacy_reporter  from legacy-reporter
+         the estate adds its tags: env, managed_by, repo
+         the file differs from the account on: description
+         fix the file, because an apply would edit the account
+
+     1 of 1 adoption(s) would change the account. Adopt in place means the file says what is there.
+   ```
+
+   Exit `2`. An import whose file is wrong is not an adoption, it is an edit
+   nobody asked for, dressed as one, and the check names the attribute so
+   you fix the file rather than the account. Put `2024` back, see `[ok]`
+   again, and apply.
+
+   ```sh
+   terraform -chdir=access/envs/prod apply -auto-approve
+   terraform -chdir=access/envs/prod plan -detailed-exitcode
+   echo $?
+   aws --endpoint-url http://localhost:4566 iam list-role-tags --role-name legacy-reporter \
+     --query 'Tags[].[Key,Value]' --output text
+   ```
+
+   `aws_iam_role.legacy_reporter: Import complete [id=legacy-reporter]`,
+   `Resources: 1 imported, 0 added, 1 changed, 0 destroyed.`, then `0`, then
+   four tags, `team analytics` as it was and the estate's three beside it.
+   The role's trust, name and description did not move, and the account
+   says so. Run the check once more and the role's row reads `already in
+   state`, because an import that has landed makes no importing change in
+   the plan and the check reads the block off the file instead.
+
+5. Adopt the other two, in one apply. Write `access/envs/prod/s3_bucket.legacy_uploads.tf`.
+
+   ```hcl
+   # Adopted in lesson 15. See iam_role.legacy_reporter.tf.
+   import {
+     to = aws_s3_bucket.legacy_uploads
+     id = "legacy-uploads"
+   }
+
+   resource "aws_s3_bucket" "legacy_uploads" {
+     bucket = "legacy-uploads"
+   }
+   ```
+
+   And `access/envs/prod/security_group.legacy_ssh.tf`, with your group id
+   from step 2 in the import block.
+
+   ```hcl
+   # Adopted in lesson 15. See iam_role.legacy_reporter.tf.
+   import {
+     to = aws_security_group.legacy_ssh
+     id = "sg-4ebfc472f9999f8c2"
+   }
+
+   resource "aws_security_group" "legacy_ssh" {
+     name        = "legacy-ssh"
+     description = "ssh from anywhere"
+     vpc_id      = "vpc-default-us-east-1"
+
+     ingress {
+       from_port   = 22
+       to_port     = 22
+       protocol    = "tcp"
+       cidr_blocks = ["0.0.0.0/0"]
+     }
+
+     egress {
+       from_port   = 0
+       to_port     = 0
+       protocol    = "-1"
+       cidr_blocks = ["0.0.0.0/0"]
+     }
+   }
+   ```
+
+   Both are the generated draft reviewed the same way, and you can prove
+   that by running `-generate-config-out` again first if you like. The
+   bucket's draft carries `bucket_namespace`, `force_destroy`,
+   `object_lock_enabled` and `region`, all defaults, and the group's
+   carries the same `tags_all` and `region`, a
+   `revoke_rules_on_delete = null`, and an egress rule the account made for
+   it. The egress stays, because the account holds it.
+
+   ```sh
+   access/scripts/adopt-check
+   terraform -chdir=access/envs/prod apply -auto-approve
+   terraform -chdir=access/envs/prod plan -detailed-exitcode
+   echo $?
+   ```
+
+   Three `[ok]` rows, the role's reading `already in state` and `nothing
+   changes` because step 4 brought it in, the other two `from` their ids
+   with the estate's tags to add, then `Resources: 2 imported, 0 added,
+   2 changed`, and `0`.
+
+6. Run the check stack, and read the refusal as a list.
+
+   ```sh
+   just access-check
+   ```
+
+   ```
+   envs/prod/iam_role.legacy_reporter.tf:10:1: Error - aws_iam_role.legacy_reporter carries no owner tag. Add tags = { owner = local.owner }, or pass owner to modules/persona. (opa_deny_tag_owner_required)
+   envs/prod/s3_bucket.legacy_uploads.tf:7:1: Error - aws_s3_bucket.legacy_uploads carries no owner tag. Add tags = { owner = local.owner }, or pass owner to modules/persona. (opa_deny_tag_owner_required)
+   envs/prod/iam_role.legacy_reporter.tf:10:1: Error - aws_iam_role.legacy_reporter carries no permissions_boundary. Every role water park emits sits inside the estate boundary from access/baseline. (opa_deny_boundary_required)
+   envs/prod/security_group.legacy_ssh.tf:16:19: Warning - aws_security_group.legacy_ssh opens 22 to 0.0.0.0/0 in an inline ingress block. Name the source security group, and declare the rule as its own aws_vpc_security_group_ingress_rule so it has an address a review can point at. (opa_warn_no_open_ingress)
+   FAIL  tflint in access/envs/prod
+   == generated CODEOWNERS
+   gen-codeowners: envs/prod/iam_role.legacy_reporter.tf names no team. Add a teams list, or the file routes to nobody
+   FAIL  .github/CODEOWNERS was hand edited or a principal file moved
+   ```
+
+   Two errors on the role, one on the bucket, a warning on the group, a
+   principal file that routes to nobody, and `check failed, 2 problem(s)`.
+   Nothing about being adopted exempts a resource from the rules, and that
+   is what one at a time is for. This list is day two. A boundary on the
+   role, an owner on both, a source group instead of the world, and a team
+   on the role so its review has an owner, each its own pull request with
+   the plan showing exactly that change. The warning is new in this lesson. `no-open-ingress` read only
+   the standalone rule shape until now, and the inline shape is what
+   generated config writes, so an adopted group with an open port would
+   have slipped past a rule written to catch it. Step 4 brought the widened
+   rule and its fixtures in.
+
+7. Back the group out without destroying it. Delete its file and write `access/envs/prod/removed.legacy_ssh.tf`.
+
+   ```sh
+   rm access/envs/prod/security_group.legacy_ssh.tf
+   ```
+
+   ```hcl
+   # Back the group out of management without destroying it. The block is
+   # applied once and then deleted from the repo, because there is nothing left
+   # for it to say.
+   removed {
+     from = aws_security_group.legacy_ssh
+
+     lifecycle {
+       destroy = false
+     }
+   }
+   ```
+
+   ```sh
+   terraform -chdir=access/envs/prod plan
+   terraform -chdir=access/envs/prod apply -auto-approve
+   aws --endpoint-url http://localhost:4566 ec2 describe-security-groups --group-ids $SG \
+     --query 'SecurityGroups[0].GroupName' --output text
+   rm access/envs/prod/removed.legacy_ssh.tf
+   terraform -chdir=access/envs/prod plan -detailed-exitcode
+   echo $?
+   ```
+
+   `# aws_security_group.legacy_ssh will no longer be managed by Terraform, but will not be destroyed`
+   and `Plan: 0 to add, 0 to change, 0 to destroy.`, then the apply, then
+   `legacy-ssh` from the account, then `0` with the block gone. The group is
+   exactly where it was, the repo has stopped claiming it, and the watch has
+   stopped watching it. That is the reverse of step 5 and it cost the account
+   nothing either way.
+
+8. Say what walking away costs.
+
+   ```sh
+   ls access/envs/prod/*.tf
+   ```
+
+   That listing is the handover. Every file is HCL the provider applies
+   directly, the import blocks are Terraform's own syntax, and nothing in
+   the directory is a format this course invented. A team that stops using
+   water park keeps the directory and drops the checks, the scripts and the
+   workflow, and the estate is exactly as manageable as it was, which is
+   decision 2's whole claim and the reason there is no export bundle to
+   build.
+
+9. Compare with the reference repo, then tear down. The three adopted files are yours and not the repo's, because the resources they import exist only where your hand made them, so the compare leaves them out.
+
+   ```sh
+   git add -A access .github
+   git diff --cached --stat checkpoint/i15 -- access .github ':!*README.md' ':!access/envs/prod/*legacy*'
+
+   terraform -chdir=access/satellites/waterpark-runner destroy -auto-approve
+   terraform -chdir=access/envs/prod destroy -auto-approve
+   aws --endpoint-url http://localhost:4566 ec2 delete-security-group --group-id $SG
+   ```
+
+   Nothing printed means the provider line, the rule and the check are the
+   reference's. The destroy reads `20 destroyed`, the estate's eighteen and
+   the two adopted, because `legacy-reporter` and `legacy-uploads` are
+   managed now and that is what managed means, and it leaves `legacy-ssh`,
+   because step 7 gave it back, so the last line removes it by hand. If you started your own container in step 1,
+   `docker rm -f wp-i15-floci` as well.
 
 ## Self-paced
 
-{{< todo "What Floci or your own machine can and cannot show." >}}
+The whole lesson runs on the emulator, and it runs on the Start-here stack's Floci without enforcement, because nothing here is a refusal by IAM. Every import, every plan and the `removed` block behave on Floci as they do on a real account, which plan phase 0 verified before any IAM lesson was written and this lesson leans on.
+
+Two things a real account adds. Real resources carry more than a console fixture does, so the generated draft is longer and the review is more work, and that is the honest cost of one at a time. And on a real account the three default tags land on resources other teams can see, which is why adopting is a pull request somebody reviews rather than a script somebody runs.
+
+The adopted files never join the reference tree. The compare excludes them and the checkpoint carries none, because a checked-in import of a resource that exists only on one laptop would fail every other laptop's plan and the CI job's too.
 
 ## Live
 
-{{< todo "What the room sees. Timing. The line to say." >}}
+Twenty minutes, and the room needs steps 2, 4 and 6.
+
+Open on step 2 with the three console fixtures already made, and run `drift` in front of the room. The line to say is that the watch is right to say nothing, because it watches what the repo declares and the repo does not know these exist. Then step 4 whole, with the `2023` edit typed live. The check names the attribute, and the line to say is that an import whose file is wrong is an edit nobody asked for, and the only defence is a check that reads the plan rather than a reviewer who trusts the word adopt.
+
+Then step 6, and let the room read the four lines. The honesty line is that adopting a resource earns it nothing, that the checks fail it exactly as they would fail a new file, and that the failing list is the work, one pull request each, which is the only way a real estate has ever been brought to conform.
+
+Live, the same files import from a real sandbox account, the generated drafts are longer, and the room can watch a role that predates the repo acquire the repo's tags and nothing else.
 
 ## Further reading
 
+- [access/README.md](https://github.com/INTENTIUS/waterpark/blob/main/access/README.md), "Lesson 15, adopt in place"
+- [access/scripts](https://github.com/INTENTIUS/waterpark/blob/main/access/scripts/README.md), `adopt-check`
+- [Lesson 7, drift](07-drift.md), the asymmetry this lesson completes
+- [Decisions](../../docs/decisions.md), 2, 3, 38 and 62
+- [Upstream](https://github.com/INTENTIUS/waterpark/blob/main/project/upstream.md), plan phase 0's import verification
 - [Issues](https://github.com/INTENTIUS/waterpark/blob/main/project/archive/issues.md) A14 and A21
-- Decision 2
 - [Landscape](https://github.com/INTENTIUS/waterpark/blob/main/project/archive/landscape.md), IAMbic
diff --git a/content/docs/decisions.md b/content/docs/decisions.md
index ea6b712..27a3bff 100644
--- a/content/docs/decisions.md
+++ b/content/docs/decisions.md
@@ -591,3 +591,24 @@ it. Reversing one requires editing this file in the same PR.
     current as its last read and knows nothing about a read it was
     refused, and the artifact says so.
     ([design/agentic](design/agentic.md), [IAM, lesson 11](../courses/iam/11-offboard-and-access-review.md))
+62. **Adoption's one day-one change is the estate's own tags, and the
+    check says so.** An adopted resource is an `import` block and a
+    resource block in one file, reviewed by hand out of `terraform plan
+    -generate-config-out` with `region`, `tags_all`, nulls and provider
+    defaults dropped. On this estate the plan for that import is never
+    empty, because the provider's `default_tags` put `managed_by`, `repo`
+    and `env` on everything it owns, so `access/scripts/adopt-check`
+    reads the plan and passes an import whose only change is `tags_all`
+    and fails one that would change anything else, naming the attribute,
+    which is decision 38's "nothing changes on day one" stated exactly.
+    Adoption exempts nothing. An adopted role without a boundary or an
+    owner tag fails the same rules as a written one, and that failing
+    check is day two's list. `no-open-ingress` reads the inline `ingress`
+    blocks of an `aws_security_group`, which is the shape generated config
+    writes, so an adopted group's open port gets the warning. The adopted
+    files are a laptop's and never in the reference tree, because the
+    resources they import exist only where a hand made them, and the
+    provider gains its `ec2` endpoint for the first security group. The
+    cost is that an estate whose provider carries no default tags gets an
+    empty plan instead, and the check passes that too.
+    ([IAM, lesson 15](../courses/iam/15-adopt-in-place.md))
diff --git a/content/status.md b/content/status.md
index 4ad9c46..047384f 100644
--- a/content/status.md
+++ b/content/status.md
@@ -35,6 +35,7 @@ not built by this workflow.
 | 2026-09-05 | IAM lessons 1 to 5 written against `checkpoint/i0` to `checkpoint/i5` and taken end to end by an agent playing the student from a fresh clone with only the pages, the skills and the tags. Lessons 3, 4 and 5 passed their done-when as written, 1 and 2 failed on a checkpoint compare that could not be silent. Nineteen stumbles filed and fixed, the changed steps re-run clean. |
 | 2026-09-05 | IAM lessons 6 to 8 written against `checkpoint/i5` to `checkpoint/i8` and taken end to end by an agent playing the student from a fresh clone. All three done-whens passed as written and every promised compare was silent. Sixteen stumbles filed, fifteen fixed in text, one left as a script finding. The access workflow's PR job and apply job each ran for real on PR 71 and its merge, the apply job matching the approved plan digest and applying. |
 | 2026-09-06 | Fountain lesson 3, the egress allowlist, written and taken end to end by an agent playing the student from a fresh clone. The done-when passed as written. The class stack's runner holds no egress policy, so Fountain refuses a `limited` environment rather than running it open, and the lesson teaches that refusal. It needs no inference key, since the refusal comes before the model is called. |
+| 2026-09-10 | IAM lesson 15, adopt in place, written against `checkpoint/i11` to `checkpoint/i15` and taken end to end by an agent playing the student from a fresh clone, on the class stack's own Floci. All five done-when clauses passed as written and the checkpoint compare was silent. A role, a bucket and an open security group made by hand come under management one file at a time with `import` blocks reviewed out of generated config, `adopt-check` passes each because the only change is the estate's three tags and fails a file that misstates the account by naming the attribute, the rule pack refuses the adopted role as it would a written one, and a `removed` block leaves the group in the account. Five stumbles filed, one the check not seeing a landed import, one the adopted role's missing team as a fifth day-two item, three wording, all fixed. |
 | 2026-09-10 | Fountain lesson 11, no approval gate in Fountain, written and taken end to end by an agent playing the student from a fresh clone, two model turns on the class stack. All three done-when clauses passed as written. The runtime's command line read off the runner mid-turn carries `--allow-dangerously-skip-permissions` with its permission prompt wired to stdio, a file write lands with zero `request_permission` messages in the record, and the destructive prompt went both ways across two runs, declined once on the model's judgment and complied with once, deleting the sandbox's own runtime install with the same zero in the record, which the page now teaches as the point. Seven stumbles filed, all fixed. |
 | 2026-09-10 | Fountain lesson 10, the self-hosted runner, written and taken end to end by an agent playing the student from a fresh clone, three model turns on the class stack. All four done-when clauses passed as written. The runner reads as one process and one user holding the API key, a `limited` environment refuses with `provider: runner`, a second sandbox lists its sibling and both directories are one owner's, a stopped container gives a new run a 409 naming the fix and a parked conversation a `runner_offline` failure, and the restart brings the same conversation back. Five stumbles filed, all wording, all fixed. |
 | 2026-09-10 | Fountain lesson 6, schedules, written and taken end to end by an agent playing the student from a fresh clone, three model turns on the class stack. All four done-when clauses passed as written and every status code, count and label matched. `@reboot` is refused, a schedule made before its teammate exists records `agent is not on the team` when run, an every-minute schedule fires on the whole minute into the teammate's own thread with the scheduler's stamp, disabled it goes quiet and still runs by hand, a one-off opens a fresh conversation with no channel, and removing the teammate deletes its schedules. Four stumbles filed, all wording, all fixed. |
@@ -47,9 +48,9 @@ not built by this workflow.
 
 ## Written, not yet verified
 
-- 7 of the 26 lesson bodies are skeletons with TODO markers. Written
-  and student-run: Fountain lessons 1 to 6, 10 and 11, and IAM lessons 1 to 11.
-  `just todos` counts 55 today.
+- 6 of the 26 lesson bodies are skeletons with TODO markers. Written
+  and student-run: Fountain lessons 1 to 6, 10 and 11, and IAM lessons 1 to 11 and 15.
+  `just todos` counts 48 today.
 - The access repo exists under `access/` for what IAM lessons 1 to 8
   need (layout, personas, the check stack, the Floci deploy, the
   boundary, the PR and apply jobs, drift and reconcile, the satellite and
diff --git a/skills/README.md b/skills/README.md
index 5f96982..fedc30d 100644
--- a/skills/README.md
+++ b/skills/README.md
@@ -100,3 +100,4 @@ that it is `student run`.
 | `i9-federation-trust` | IAM lesson 9, Federation trust. Worktree at `checkpoint/i8`, federates `site-publisher` through the GitHub Actions anchor with the `github-pages` environment as the exact subject, refuses a wildcard at validate, writes `trust.rego` and the subject fixtures, brings in the audience fixtures and the rotation machinery, pages on a hand-edited trust policy and a widened anchor, runs `rotation` clean and then against a hand-made key under a zero window, forges a token to show the emulator failing open, and closes the workflow-level gap in `check workflow`. Reuses `skills/start/check.sh`. | student run |
 | `i10-break-glass` | IAM lesson 10, Break-glass. Worktree at `checkpoint/i9`, brings in the grant shape and the TTL rule, writes the `on-call` stand-in, grants prod write for two minutes with `access/scripts/break-glass`, reads the `DateLessThan` condition and the tags back, gets a three-hour grant refused by the script, the rule pack and `plan`, leaves the cleanup unrun past the expiry, watches `drift` report the leftover, sweeps and revokes, and reads the apply job's approver stamp. Reuses `skills/start/check.sh`. | student run |
 | `i11-offboard-and-access-review` | IAM lesson 11, Offboard and the access review. Worktree at `checkpoint/i10`, brings in the four read-side scripts and the quarterly workflow, asks `whocan` and `expiring` against the account and watches a console-attached policy appear, reads the review artifact, offboards `course-author` with the preview reading nothing live and the grep reading zero, offboards `desk-operator` with a five-resource destroy and a `NoSuchEntity` read back, and restores both from the checkpoint. Reuses `skills/start/check.sh`. | student run |
+| `i15-adopt-in-place` | IAM lesson 15, Adopt in place. Worktree at `checkpoint/i11`, makes a role, a bucket and an open security group by hand, watches `drift` not see them, adopts the role with an import block and a resource block reviewed out of `-generate-config-out`, proves with `adopt-check` that only the estate's tags change and watches it fail a misstated file, adopts the other two, watches the rule pack fail the adopted role and warn on the group, backs the group out with a `removed` block, and says what walking away costs. Reuses `skills/start/check.sh`. | student run |
diff --git a/skills/i15-adopt-in-place/SKILL.md b/skills/i15-adopt-in-place/SKILL.md
new file mode 100644
index 0000000..655e9b2
--- /dev/null
+++ b/skills/i15-adopt-in-place/SKILL.md
@@ -0,0 +1,344 @@
+---
+name: waterpark-i15-adopt-in-place
+description: Walk a student through IAM lesson 15, Adopt in place. Use when they finished IAM lesson 11, or lesson 7, and want lesson 15, or when they ask how an existing resource comes under the repo. Makes a role, a bucket and an open security group by hand, watches drift not see them, adopts each with an import block and a resource block reviewed out of generated config, proves with adopt-check that only the estate's tags change, watches the rule pack fail the adopted role, backs the group out with a removed block, and says what walking away costs.
+---
+
+# water park, IAM lesson 15, Adopt in place
+
+You are walking a student through IAM lesson 15, Adopt in place
+(https://intentius.io/waterpark/courses/iam/15-adopt-in-place/). The
+outcome is three resources that predate the repo brought under management
+one file at a time with nothing about them changed but the estate's own
+tags, the rule pack refusing the adopted role as it would a written one,
+and one resource backed out with a `removed` block and still in the
+account. About 35 minutes.
+
+This lesson never touches a real AWS account. Every command points at
+`http://localhost:4566`, `floci` stays at its default of true, and the
+`AWS_ACCESS_KEY_ID=test` pair is the throwaway the provider already uses
+rather than a credential. If the student wants to run this against a real
+account, say that is the live path, that it needs `-var floci=false` and
+the S3 backend, and that a facilitator runs it.
+
+Confirm with the student before creating the worktree, before starting a
+Floci container, before the three console commands in step 5b, before
+editing `provider.tf`, before writing any file under `access/`, before the
+`git checkout` that brings in the check, before each apply and destroy,
+and before the teardown. Those steps are marked **confirm**. Reads run
+freely, which is every `plan`, `adopt-check`, `drift`, `check` stage,
+`list-role-tags`, `describe-security-groups` and `git diff`.
+
+## 1. Say what this is
+
+In two or three sentences say this is lesson 15 of the IAM course, that
+fourteen lessons wrote an estate from nothing and this one starts from what
+is already there, which is where every real estate starts. Say the
+mechanism, an `import` block per resource, a resource block reviewed by
+hand out of `terraform plan -generate-config-out`, and a plan that changes
+nothing but the tags the estate puts on what it owns, checked by a script.
+Link the lesson page above.
+
+## 2. Check the ground
+
+Run the same check Start here uses.
+
+```sh
+bash skills/start/check.sh
+```
+
+Also read `.waterpark/profile.json` at the checkout root if it exists. A
+profile file is a claim from a previous run and the check's live calls are
+the truth, so when they disagree believe the check. If `completed` does not
+carry `"i11"`, say that the checkpoint carries lesson 11's work anyway and
+offer to run this. If it does not carry `"i7"` either, say lesson 7 is
+where the drift watch comes from and this lesson opens by asking it a
+question, and offer to run this anyway.
+
+Require `waterpark.checkout` true and `tools.docker.installed` true. The
+check does not report `terraform`, `tflint` or `jq`, so ask for those
+directly.
+
+```sh
+terraform version
+tflint --version
+jq --version
+```
+
+Terraform 1.9 or newer, any tflint, and any jq. The OPA plugin the rules
+run on is what `just access-init` installs in section 3, so `tflint
+--version` from the checkout root lists only the bundled ruleset and that
+is fine. If tflint is missing, the install line is
+`brew install terraform-linters/tap/tflint` on macOS, and the release
+binary from https://github.com/terraform-linters/tflint on Linux and
+Windows. `jq` is `brew install jq`, `apt install jq` or
+`winget install jqlang.jq`, and `adopt-check` and `drift` need it.
+
+Note the check's `floci.reachable`. If it is true, the Start-here stack's
+Floci is up on 4566 and this lesson uses it as it is, with IAM enforcement
+off, which this lesson never needs. Say so, and skip the container in
+section 3. If it is false, section 3 starts one.
+
+## 3. The starting point
+
+**confirm**, then
+
+```sh
+git fetch origin --tags
+git worktree add ../waterpark-i15 checkpoint/i11
+cd ../waterpark-i15
+just access-init
+```
+
+Every command after this runs from `../waterpark-i15`. If `just
+access-init` prints `All plugins are already installed`, that is tflint's
+plugin cache and it is fine.
+
+If `floci.reachable` was false, **confirm** and start Floci.
+
+```sh
+docker run -d --name wp-i15-floci -p 4566:4566 \
+  -e FLOCI_SERVICES_IAM_ENFORCEMENT_ENABLED=true \
+  ghcr.io/lex00/floci:iam-boundary
+```
+
+Either way,
+
+```sh
+curl -s --retry 15 --retry-all-errors --retry-delay 1 \
+  -o /dev/null -w '%{http_code}\n' http://localhost:4566/
+```
+
+`200`.
+
+## 4. Apply the estate
+
+**confirm**, then central first, then the satellite.
+
+```sh
+terraform -chdir=access/envs/prod init
+terraform -chdir=access/envs/prod apply -auto-approve
+terraform -chdir=access/satellites/waterpark-runner init
+terraform -chdir=access/satellites/waterpark-runner apply -auto-approve
+```
+
+`Resources: 18 added` for central and `8 added` for the satellite. If the
+stack's Floci already held an estate from an earlier IAM lesson run in the
+same session, the counts are lower and the plan is what matters.
+
+## 5. The lesson
+
+### 5a. Nothing yet
+
+Say that the three things about to be made go through no pull request, and
+that this is the point.
+
+### 5b. Make three things by hand
+
+**confirm**, then the four `aws` commands from step 2 of the lesson page,
+which is `content/courses/iam/15-adopt-in-place.md` in this checkout. Read
+them from there. The role ARN, `make_bucket: legacy-uploads`, `true`, and a
+group id. Have the student keep `$SG`, two files need it. Say that the
+ingress call takes the id rather than the name because the emulator does
+not resolve a group by name there.
+
+Then
+
+```sh
+access/scripts/drift | tail -1
+```
+
+`every watched root matches the account`. Say why the watch is right to say
+nothing, and that lesson 7's asymmetry has a second half, adopting is a
+file somebody writes, and here are three.
+
+### 5c. Adopt the role
+
+**confirm**, then have the student add `ec2 = endpoints.value` to the
+`content` block in `access/envs/prod/provider.tf`, after `s3`, as step 3
+shows. Say that the group is the first `ec2` resource the estate touches.
+
+**confirm**, then have them write `access/envs/prod/iam_role.legacy_reporter.tf`
+with only the import block from step 3, and run
+
+```sh
+terraform -chdir=access/envs/prod init
+terraform -chdir=access/envs/prod plan -generate-config-out=generated.tf
+cat access/envs/prod/generated.tf
+```
+
+`Plan: 1 to import, 0 to add, 1 to change, 0 to destroy.`, and the draft
+under its two-line review header. Walk the draft against the role, from step 3. The
+trust, description, name and tag are the student's. `force_detach_policies`,
+`max_session_duration` and `path` are defaults written out,
+`permissions_boundary = null` is an absence spelled as a value, and
+`tags_all` is computed and never declared. Then have them replace the file
+with the reviewed form from step 3, read from the page, and
+`rm access/envs/prod/generated.tf`.
+
+### 5d. The check, broken on purpose
+
+**confirm**, then
+
+```sh
+git checkout checkpoint/i15 -- \
+  access/scripts/adopt-check \
+  access/.tflint.d/policies/security.rego \
+  access/tests/fixtures/no-open-ingress
+access/scripts/adopt-check
+```
+
+One `[ok]` row, `the estate adds its tags: env, managed_by, repo`, and
+`1 adoption(s), and none changes anything but the estate's own tags.`
+Say that this is the plan read for them, and that the three tags are the
+provider's `default_tags`, the estate's mark and nothing the role had.
+
+**confirm**, then have the student change `2024` to `2023` in the
+description and run the check again. `[FAIL]` with
+`the file differs from the account on: description` and exit `2`. Say that
+an import whose file is wrong is an edit nobody asked for, dressed as an
+adoption. Have them put `2024` back and see `[ok]`.
+
+**confirm**, then
+
+```sh
+terraform -chdir=access/envs/prod apply -auto-approve
+terraform -chdir=access/envs/prod plan -detailed-exitcode
+echo $?
+aws --endpoint-url http://localhost:4566 iam list-role-tags --role-name legacy-reporter \
+  --query 'Tags[].[Key,Value]' --output text
+```
+
+`Import complete`, `1 imported, 0 added, 1 changed`, `0`, and four tags,
+`team analytics` plus the estate's three. Run `adopt-check` once more and
+the role's row reads `already in state`, because a landed import makes no
+importing change in the plan and the check reads the block off the file.
+
+### 5e. The other two
+
+**confirm**, then have the student write the bucket file and the group
+file from step 5 of the page, with their own `$SG` in the group's import
+block. Say what the drafts would have carried and what the review dropped,
+and that the egress rule stays because the account holds it.
+
+```sh
+access/scripts/adopt-check
+```
+
+Three `[ok]` rows, the role's reading `already in state` and `nothing
+changes`, the other two `from` their ids. **confirm**, then the apply and
+the replan. `2 imported, 0 added, 2 changed`, then `0`.
+
+### 5f. The refusal as a list
+
+```sh
+just access-check
+```
+
+Two `Error` lines on `legacy_reporter`, no owner tag and no boundary, one
+on `legacy_uploads`, no owner tag, one `Warning` on `legacy_ssh` opening
+22 to `0.0.0.0/0` in an inline ingress block, then the CODEOWNERS stage
+failing because the adopted role names no team, and `check failed, 2
+problem(s)`. Say that being adopted exempts nothing, that the list is day
+two with one pull request per line, the team included, and that the
+warning is new in this lesson because the rule read only the standalone
+shape until now and the inline shape is what generated config writes. This
+is also the step to verify the fourth done-when clause, because 5g deletes
+the group's file.
+
+### 5g. Back the group out
+
+**confirm**, then `rm access/envs/prod/security_group.legacy_ssh.tf` and
+have the student write `removed.legacy_ssh.tf` from step 7. Then
+
+```sh
+terraform -chdir=access/envs/prod plan
+```
+
+`will no longer be managed by Terraform, but will not be destroyed` and
+`Plan: 0 to add, 0 to change, 0 to destroy.` **confirm**, then the apply,
+the `describe-security-groups` read, which prints `legacy-ssh`, then
+`rm access/envs/prod/removed.legacy_ssh.tf` and the replan, `0`. Say that
+the group is exactly where it was and the repo has stopped claiming it.
+
+### 5h. Walking away
+
+```sh
+ls access/envs/prod/*.tf
+```
+
+Say that the listing is the handover, that every file is HCL the provider
+applies directly, and that a team which stops using water park keeps the
+directory and drops the rest, which is decision 2's claim and why there is
+no export bundle.
+
+### 5i. Compare with the reference repo
+
+```sh
+git add -A access .github
+git diff --cached --stat checkpoint/i15 -- access .github ':!*README.md' ':!access/envs/prod/*legacy*'
+```
+
+Nothing printed means the provider line, the rule and the check are the
+reference's. The three adopted files are excluded on purpose, because the
+resources they import exist only on this laptop. If `provider.tf` is
+named, the `ec2` line is not exactly as step 3 shows it.
+
+## 6. Done when
+
+All five have to be true, and verify each one yourself rather than taking
+earlier output on trust.
+
+- `access/scripts/adopt-check` reported three adoptions each changing
+  nothing but the estate's tags, and reported `[FAIL]` naming
+  `description` when the file misstated the account.
+- The applies reported `1 imported` then `2 imported` with the matching
+  `changed` counts, and the replan exited 0 after each.
+- `list-role-tags` on `legacy-reporter` shows `managed_by`, `repo` and
+  `env` beside `team`.
+- `access/scripts/check lint` failed on the adopted role's boundary and
+  owner tag and warned on the group's open port, read at 5f, before 5g
+  removed the group's file.
+- After the `removed` block was applied, `describe-security-groups`
+  printed `legacy-ssh` and the replan exited 0 with the block deleted.
+
+If `adopt-check` reports `no import block`, no file in the root holds
+one, so the file in 5c is missing its block. A landed import reads
+`already in state` rather than disappearing. If the plan wants to create a resource
+rather than import it, the `id` in the import block does not match the
+account, most often the group id. If the check names an attribute other
+than `description`, the review in 5c or 5e kept a default, and the draft is
+the reference for what the account holds.
+
+## 7. Tear down
+
+**confirm**, then
+
+```sh
+terraform -chdir=access/satellites/waterpark-runner destroy -auto-approve
+terraform -chdir=access/envs/prod destroy -auto-approve
+aws --endpoint-url http://localhost:4566 ec2 delete-security-group --group-id $SG
+```
+
+Say that the destroy takes `legacy-reporter` and `legacy-uploads` with it
+because they are managed now, and leaves `legacy-ssh` because 5g gave it
+back, so the last line removes it by hand. If section 3 started a
+container, `docker rm -f wp-i15-floci` as well. Leave the
+`../waterpark-i15` worktree.
+
+## 8. Record
+
+**confirm**, then update `.waterpark/profile.json` at the checkout root,
+appending `"i15"` to its `completed` array, creating the file and the
+array if either is missing. Leave every other field untouched. Write it in
+the original checkout rather than in the `../waterpark-i15` worktree.
+
+```json
+{"...": "...", "completed": ["start", "i1", "i2", "i3", "i4", "i5", "i6", "i7", "i8", "i9", "i10", "i11", "i15"]}
+```
+
+## 9. Hand off
+
+Say the next step is IAM lesson 14, approve the change not the diff
+(https://intentius.io/waterpark/courses/iam/14-approve-the-change-not-the-diff/),
+where the reviewer approves a plan and its digest and the apply job refuses
+anything that moved.