Apply explicit CLI configuration overrides

docs/roadmap/implementation.md

@@ -1301,7 +1301,41 @@ Acceptance:
 
 ## Stage 18 — Apply explicit CLI overrides above profiles
 
-Status: pending.
+Status: complete.
+
+Completion evidence (2026-09-06):
+
+- Activated the existing `Override`/`Options.Overrides` surface through the new
+  parser-neutral implementation in [`override.go`](../../override.go). It accepts
+  only built-in scalar values, `nil`, `[]any`, and `map[string]any`; preserves
+  scalar kinds and sequence order; sorts maps; rejects named/unsupported values,
+  nonfinite floats and cycles; and snapshots all accepted caller-owned state without
+  YAML reparsing or textual inference.
+- Added full-record preflight for safe flag labels, non-root mapping paths,
+  sequence traversal, existing non-mapping ancestors, duplicates/overlaps,
+  `_configkit`, schema-version overlap, and fixed record/source/string-byte/node/
+  depth budgets. Valid records create deterministic synthetic CLI sources after
+  file and profile sources; failures identify those safe flag sources without raw
+  arguments or values.
+- Generalized the existing non-aliasing overlay machinery across profile and CLI
+  layers. Overrides apply after the selected profile and before defaults/typed
+  decode, create missing mapping ancestors, recursively overlay mappings, replace
+  sequences atomically, and retain detached before/after snapshots plus displaced
+  origins even for equal-value operations. Layered history reconstruction now
+  preserves default/base/profile/CLI order and parent operations for descendants.
+- Added lifecycle and boundary coverage in
+  [`override_test.go`](../../override_test.go) for defaults < imports/base < profile
+  < CLI < recorded normalization, followed by secret lookup and validation; explicit
+  zero/false/empty/list/null; defaults-only loads; map merge, whole-list replacement,
+  parsed numeric map keys, caller mutation, equal replacements, safe decode source
+  attribution, invalid paths/ancestors/overlaps/directives/version writes, value
+  types/cycles/nonfinite values, and bounds. Added executable `ExampleOverride` and
+  moved the normative behavior into the
+  [current override contract](../config.md#explicit-cli-overrides), explicitly
+  retaining general environment overlays as a non-goal. Verified `go test ./...`,
+  `go test -race ./...`, `go vet ./...`, `go build ./...`, `go mod tidy -diff`, and
+  `git diff --check` with Go 1.26.7 on linux/amd64. No deviations were required;
+  safe historical-value explanation remains later work.
 
 Read: [override contract](initial.md#cli-overrides), overlay/presence/version rules,
 source ordering, and the secret-reference boundary.