Replace integer-only selection with a tracked exact release digest pin while preserving harness version and forward-migration compatibility metadata.
Implement one ResolvedOverlay state machine for add, replace, tombstone, revoke, expiry, source disappearance, multiple-claim rejection, upgrade, downgrade, failed activation, and rollback revalidation.
Require override receipts keyed by category/name with reason, compatibility range, expected digest, identity, scope, expiry, and explicit reconfirmation when the base becomes incompatible.
Define migration descriptors and an applied-migration ledger recording ID, mutation domain, reversibility, reverse operation, intent, completion, and retained project-data compatibility.
Stage the completed provider_projection API output and pin under a project activation lock; journal migrations and fault boundaries before atomically switching the generation without modifying project-owned state.
Make activation the transactional coordinator across domains: stage and verify instruction projections, establish required graph readiness for the project namespace, then switch the generation atomically; a failure in any domain leaves the prior generation active.
Define rollback across domains: re-render instruction projections compatible with the target release and reconcile or rebuild namespace-scoped graph state under the third-domain rules, never pretending to reverse a one-way project-data migration.
Verification
Write failing positive, negative, interruption, concurrency, and idempotency cases before implementation.
Pin the consumer-visible outcome through the real CLI/runtime entry point.
Run focused pytest and the owning runtime self-test with a 150-second test timeout.
Run python -m scripts.harness_dist verify --root . when distributed artifact classification changes.