Adopt ConfigKit overlays for pipeline selection

docs/internal/configuration.md

@@ -9,9 +9,9 @@ pipeline-loading boundary implemented by `internal/config`.
 `LoadPipeline` assembles and validates a pipeline in this order:
 
 1. Give ConfigKit a fresh typed `PipelineConfig` default value, the root file,
-   enabled imports, and the caller's profile selection. Omitted, empty, and
-   exact `default` selections use the base; named profiles use the fixed
-   `profiles/<name>.yml` convention.
+   enabled imports, and the caller's overlay selection. Omitted, empty, and
+   exact `default` selections use the base; named overlays use the fixed
+   `overlays/<name>.yml` convention.
 2. ConfigKit parses the root and declared imports, additively merges base
    sources, applies only the selected overlay, and strictly decodes the result.
 3. The definition resolver applies recorded entry-level and inherited defaults,
@@ -45,7 +45,7 @@ a temporary downloaded session file therefore cannot invalidate the resolved
 pipeline or campaign context.
 
 Campaign and session files use independent ConfigKit definitions with imports
-and profiles disabled. Campaign files normally load directly from their source;
+and overlays disabled. Campaign files normally load directly from their source;
 session files are first read through the 8 MiB bounded-read boundary because the
 application must reject unresolved template placeholders before passing an exact
 byte snapshot to ConfigKit. Local and remotely downloaded session bytes then use
@@ -53,8 +53,9 @@ the same typed loader and retain the existing post-load identity expectations,
 stable-input precedence, and source-relative path semantics.
 
 The application also has a separate read-only inspection resolver for `config
-validate`, `config show`, `config sources`, and `config artifacts`. It uses the same production root/profile and
-campaign selection functions, but never routes through session discovery,
+validate`, `config show`, `config sources`, and `config artifacts`. It uses the
+same production root, overlay, and campaign selection functions, but never routes
+through session discovery,
 remote-session download, adapter composition, workspace
 initialization, manifest access, or cleanup. A pipeline with retained artifact
 family declarations must resolve its selected campaign before ordinary pipeline
@@ -73,7 +74,7 @@ commands do not marshal runtime objects directly.
 `EffectivePipelineSources` and `EffectiveCampaignSources` provide the separate
 safe provenance projection for `config sources`. Pipeline ownership begins with
 the complete logical field paths projected from the schema and classifies
-each contributor as root, import, profile, or centralized default. The
+each contributor as root, import, overlay, or centralized default. The
 projection replaces generated concrete member paths with paired family and
 canonical-party records, and does the same for generated publish rules.
 Campaign records identify campaign-owned fields and party inputs; canonical
@@ -106,7 +107,7 @@ configured roster authority; player and session-party fields are unsupported.
 ## Canonical Party Domain
 
 `ParseParty` is the package-owned boundary for parsing a party source. Its
-single-source ConfigKit definition disables imports and profiles, requires
+single-source ConfigKit definition disables imports and overlays, requires
 `schema_version` through `VersionRule`, and strictly decodes the
 character-keyed typed schema before applying Narratio's party-domain checks.
 Successful metadata coordinates recover authored character-map order without a
@@ -144,14 +145,14 @@ not compatibility contracts.
 
 ## Diagnostics And Runtime Metadata
 
-Syntax, duplicate-key, merge, profile, and schema failures include the
+Syntax, duplicate-key, merge, overlay, and schema failures include the
 relevant source name and full field path. Additive conflicts report every
 claiming source so operators can repair the split without repeatedly
 rediscovering additional conflicts.
 
 The loaded pipeline retains private runtime metadata for the absolute root
-path, ordered imports, selected profile name and selection source, selected
-overlay, original ConfigKit metadata and source snapshots, effective digest,
+path, ordered imports, selected overlay name, source, and path, original
+ConfigKit metadata and source snapshots, effective digest,
 and leaf ownership. Base
 leaves retain their root/import owners, replaced leaves belong to the selected
 overlay, and centrally supplied values use the synthetic `default` owner. This
@@ -163,7 +164,7 @@ the same typed safe projection used by show and diff. Runtime Notarius paths rem
 execution, but the digest substitutes their normalized logical values captured
 before root-relative resolution, so relocating an equivalent configuration
 bundle does not change provenance. Because ConfigKit and resolution metadata
-are private, the digest excludes source layout, profile name, and ownership.
+are private, the digest excludes source layout, overlay name, and ownership.
 Configuration stores credentials as ConfigKit typed references. A successful
 load resolves their values inside the opaque typed boundary, while this safe
 projection serializes only `EnvName()` identities. Credential-value changes are
@@ -177,7 +178,7 @@ for later runtime expansion.
 
 ## Test Surfaces
 
-`pipeline_configkit_test.go` exercises real imports and fixed-path profiles,
+`pipeline_configkit_test.go` exercises real imports and fixed-path overlays,
 base selection, unselected-overlay isolation, source attribution, and Narratio's
 unique artifact/family base-declaration rule. Existing focused configuration
 tests protect defaults, explicit-value semantics, strict decoding, validation,

docs/internal/manifest.md

@@ -23,9 +23,11 @@ portable opaque segments. Unsafe legacy identities are rejected with migration
 guidance rather than being normalized into a different workspace or remote
 namespace.
 
-Decoding is strict at every typed manifest field. Unknown fields are rejected;
-the schema version remains `narratio.session-manifest.v1` and there is no
-compatibility reader that silently drops retired state. Cleanup progress uses
+Decoding is strict at typed execution-state fields. Unknown informational fields
+inside `effective_config` are ignored so older selection labels can be read;
+unknown fields elsewhere are rejected. The schema version remains
+`narratio.session-manifest.v1` and there is no compatibility reader that
+silently drops retired execution state. Cleanup progress uses
 only the cleanup entry in `stages`.
 
 Every persisted session manifest has a non-nil `stages` map. Each entry is
@@ -306,10 +308,10 @@ after such a private content change.
 
 The session manifest is the authoritative stage-progress ledger across
 invocations. It retains the most recently resolved invocation's bounded
-configuration provenance. It identifies the selected profile name and source
-(`default` or `cli`) plus the effective configuration digest, but never a raw
-secret or profile content. This provenance is informational: it does not
-participate in stage resume or cache decisions. A profile change therefore
+configuration provenance. It identifies the selected overlay name and source
+(`explicit` when selected) plus the effective configuration digest, but never a raw
+secret or overlay content. This provenance is informational: it does not
+participate in stage resume or cache decisions. An overlay change therefore
 invalidates only stages whose semantic configuration changed. When a private
 external-tool model, module, prompt, or profile changes behind an unchanged
 configured identifier, use `--force` for the affected work.