Variable scope: child modules only see values passed in; outputs are read as `module.NAME.OUTPUT`

Modules are sealed boxes. A child module cannot see the variables, locals, resources or data sources of the module that calls it, and the caller cannot reach inside the child to read its resources directly. The only way in is through input variables, and the only way out is through outputs. This strict scoping is what makes a module predictable and reusable, because its behavior depends only on the values it is given.