ephemeral: after plan set ephemeral values to null

we got the marks from the proposed value, the provider gets the value without the marks

we then reapply the marks and need to also remove the write-only values by setting the values to null

internal/terraform/node_resource_abstract_instance.go

@@ -1046,6 +1046,10 @@ func (n *NodeAbstractResourceInstance) plan(
 		plannedNewVal = marks.MarkPaths(plannedNewVal, marks.Sensitive, sensitivePaths)
 	}
 
+	// From the point of view of the provider ephemeral value marks have been removed before plan
+	// and are reapplied now so we now need to set the values at these marks to null again.
+	plannedNewVal = ephemeral.RemoveEphemeralValues(plannedNewVal)
+
 	reqRep, reqRepDiags := getRequiredReplaces(unmarkedPriorVal, unmarkedPlannedNewVal, resp.RequiresReplace, n.ResolvedProvider.Provider, n.Addr)
 	diags = diags.Append(reqRepDiags)
 	if diags.HasErrors() {
@@ -1181,18 +1185,6 @@ func (n *NodeAbstractResourceInstance) plan(
 		}
 	}
 
-	ephemeralValuePaths, _ := marks.PathsWithMark(unmarkedPaths, marks.Ephemeral)
-	if len(ephemeralValuePaths) > 0 {
-		for _, path := range ephemeralValuePaths {
-			diags = diags.Append(tfdiags.AttributeValue(
-				tfdiags.Error,
-				"Provider set ephemeral value during plan",
-				"The provider set an ephemeral value during plan, this is not allowed. This is most likely a bug in the provider, please file an issue on the providers issue tracker.",
-				path,
-			))
-		}
-	}
-
 	// Call post-refresh hook
 	diags = diags.Append(ctx.Hook(func(h Hook) (HookAction, error) {
 		return h.PostDiff(n.HookResourceIdentity(), addrs.NotDeposed, action, priorVal, plannedNewVal)