Reproduction steps for TFC data-only changes failing to be applied.

tfc-data-only-changes.log

$ echo -en "data \"null_data_source\" \"this\" {}\n" > data.tf

$ echo -en "resource \"null_resource\" \"this\" {}\n" > resources.tf

$ echo -en "terraform {\n  cloud {}\n}\n" > versions.tf

$ tail *.tf
==> data.tf <==
data "null_data_source" "this" {}

==> resources.tf <==
resource "null_resource" "this" {}

==> versions.tf <==
terraform {
  cloud {}
}

$ terraform init
Initializing HCP Terraform...
Initializing provider plugins...
- Finding latest version of hashicorp/null...
- Installing hashicorp/null v3.2.2...
- Installed hashicorp/null v3.2.2 (signed by HashiCorp)
Terraform has created a lock file .terraform.lock.hcl to record the provider
selections it made above. Include this file in your version control repository
so that Terraform can guarantee to make the same selections by default when
you run "terraform init" in the future.
HCP Terraform has been successfully initialized!
You may now begin working with HCP Terraform. Try running "terraform plan" to
see any changes that are required for your infrastructure.
If you ever set or change modules or Terraform Settings, run "terraform init"
again to reinitialize your working directory.

$ terraform apply -auto-approve
Running apply in HCP Terraform. Output will stream here. Pressing Ctrl-C
will cancel the remote apply if it's still pending. If the apply started it
will stop streaming the logs, but will not stop the apply running remotely.
Preparing the remote apply...
The remote workspace is configured to work with configuration at
my-ws relative to the target repository.
Terraform will upload the contents of the following directory,
excluding files or directories as defined by a .terraformignore file
at /builds/path/to/my-ws/.terraformignore (if it is present),
in order to capture the filesystem context the remote workspace expects:
    /builds/path/to/my-ws
To view this run in a browser, visit:
https://app.terraform.io/app/acme-org/my-ws/runs/run-abcdef012345
Waiting for the plan to start...
Terraform v1.8.4
on linux_amd64
Initializing plugins and modules...
data.null_data_source.this: Refreshing...
data.null_data_source.this: Refresh complete after 0s [id=static]
╷
│ Warning: Deprecated
│ 
│   with data.null_data_source.this,
│   on data.tf line 1, in data "null_data_source" "this":
│    1: data "null_data_source" "this" {}
│ 
│ The null_data_source was historically used to construct intermediate values
│ to re-use elsewhere in configuration, the same can now be achieved using
│ locals or the terraform_data resource type in Terraform 1.4 and later.
╵
╷
│ Warning: Deprecated
│ 
│   with data.null_data_source.this,
│   on data.tf line 1, in data "null_data_source" "this":
│    1: data "null_data_source" "this" {}
│ 
│ The null_data_source was historically used to construct intermediate values
│ to re-use elsewhere in configuration, the same can now be achieved using
│ locals or the terraform_data resource type in Terraform 1.4 and later.
╵
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create
Terraform will perform the following actions:
  # null_resource.this will be created
  + resource "null_resource" "this" {
      + id = (known after apply)
    }
Plan: 1 to add, 0 to change, 0 to destroy.
------------------------------------------------------------------------
Cost Estimation:
Resources: 0 of 0 estimated
           $0.0/mo +$0.0
------------------------------------------------------------------------
null_resource.this: Creating...
null_resource.this: Creation complete after 0s [id=3139227642543454109]
Apply complete! Resources: 1 added, 0 changed, 0 destroyed.

$ terraform show -json    # State should contain `data.null_data_source.this` and `null_resource.this`.
{"format_version":"1.0","terraform_version":"1.8.4","values":{"root_module":{"resources":[{"address":"data.null_data_source.this","mode":"data","type":"null_data_source","name":"this","provider_name":"registry.terraform.io/hashicorp/null","schema_version":0,"values":{"has_computed_default":"default","id":"static","inputs":null,"outputs":null,"random":"4110703147949038937"},"sensitive_values":{}},{"address":"null_resource.this","mode":"managed","type":"null_resource","name":"this","provider_name":"registry.terraform.io/hashicorp/null","schema_version":0,"values":{"id":"3139227642543454109","triggers":null},"sensitive_values":{}}]}}}

$ rm resources.tf

$ terraform apply -auto-approve
Running apply in HCP Terraform. Output will stream here. Pressing Ctrl-C
will cancel the remote apply if it's still pending. If the apply started it
will stop streaming the logs, but will not stop the apply running remotely.
Preparing the remote apply...
The remote workspace is configured to work with configuration at
my-ws relative to the target repository.
Terraform will upload the contents of the following directory,
excluding files or directories as defined by a .terraformignore file
at /builds/path/to/my-ws/.terraformignore (if it is present),
in order to capture the filesystem context the remote workspace expects:
    /builds/path/to/my-ws
To view this run in a browser, visit:
https://app.terraform.io/app/acme-org/my-ws/runs/run-abcdef012345
Waiting for the plan to start...
Terraform v1.8.4
on linux_amd64
Initializing plugins and modules...
data.null_data_source.this: Refreshing...
null_resource.this: Refreshing state... [id=3139227642543454109]
data.null_data_source.this: Refresh complete after 0s [id=static]
╷
│ Warning: Deprecated
│ 
│   with data.null_data_source.this,
│   on data.tf line 1, in data "null_data_source" "this":
│    1: data "null_data_source" "this" {}
│ 
│ The null_data_source was historically used to construct intermediate values
│ to re-use elsewhere in configuration, the same can now be achieved using
│ locals or the terraform_data resource type in Terraform 1.4 and later.
╵
╷
│ Warning: Deprecated
│ 
│   with data.null_data_source.this,
│   on data.tf line 1, in data "null_data_source" "this":
│    1: data "null_data_source" "this" {}
│ 
│ The null_data_source was historically used to construct intermediate values
│ to re-use elsewhere in configuration, the same can now be achieved using
│ locals or the terraform_data resource type in Terraform 1.4 and later.
╵
Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  - destroy
Terraform will perform the following actions:
  # null_resource.this will be destroyed
  - resource "null_resource" "this" {
      - id = "3139227642543454109" -> null
    }
Plan: 0 to add, 0 to change, 1 to destroy.
------------------------------------------------------------------------
Cost Estimation:
Resources: 0 of 0 estimated
           $0.0/mo +$0.0
------------------------------------------------------------------------
null_resource.this: Destroying... [id=3139227642543454109]
null_resource.this: Destruction complete after 0s
Apply complete! Resources: 0 added, 0 changed, 1 destroyed.

$ terraform show -json    # State should contain `data.null_data_source.this` only.
{"format_version":"1.0","terraform_version":"1.8.4","values":{"root_module":{"resources":[{"address":"data.null_data_source.this","mode":"data","type":"null_data_source","name":"this","provider_name":"registry.terraform.io/hashicorp/null","schema_version":0,"values":{"has_computed_default":"default","id":"static","inputs":null,"outputs":null,"random":"8065605076674281321"},"sensitive_values":{}}]}}}

$ rm data.tf

$ terraform apply -auto-approve
Running apply in HCP Terraform. Output will stream here. Pressing Ctrl-C
will cancel the remote apply if it's still pending. If the apply started it
will stop streaming the logs, but will not stop the apply running remotely.
Preparing the remote apply...
The remote workspace is configured to work with configuration at
my-ws relative to the target repository.
Terraform will upload the contents of the following directory,
excluding files or directories as defined by a .terraformignore file
at /builds/path/to/my-ws/.terraformignore (if it is present),
in order to capture the filesystem context the remote workspace expects:
    /builds/path/to/my-ws
To view this run in a browser, visit:
https://app.terraform.io/app/acme-org/my-ws/runs/run-abcdef012345
Waiting for the plan to start...
Terraform v1.8.4
on linux_amd64
Initializing plugins and modules...
No changes. Your infrastructure matches the configuration.
Terraform has compared your real infrastructure against your configuration
and found no differences, so no changes are needed.
------------------------------------------------------------------------
Cost Estimation:
Resources: 0 of 0 estimated
           $0.0/mo +$0.0

$ terraform show -json    # State should contain nothing, but in practice...
{"format_version":"1.0","terraform_version":"1.8.4","values":{"root_module":{"resources":[{"address":"data.null_data_source.this","mode":"data","type":"null_data_source","name":"this","provider_name":"registry.terraform.io/hashicorp/null","schema_version":0,"values":{"has_computed_default":"default","id":"static","inputs":null,"outputs":null,"random":"8065605076674281321"},"sensitive_values":{}}]}}}

$ ls *.tf
versions.tf