Really like the direction here, and the ADR is excellent. One design worry: baking experimental_ into every variable name means anyone who helps test this, or adopts it once a migration path exists, has to rename their whole config again at graduation. That penalizes exactly the early adopters we want.

Could we instead treat instability as a lifecycle property, not a naming one?

• Give the config its intended permanent names now (global_config, global_config_observability, multi_runner_config, …).
• Gate opt-in behind a single acknowledgement flag, e.g. experimental_features = ["multi-runner-v2"], with a validation that errors if the v2 config is set without the ack.
• Communicate "this may break" via the docs banner, description warnings, and semver on the schema during the experimental window.

Then graduation is just dropping the flag (kept as a deprecated no-op for one release), the user's actual config blocks never change. It also fits the ADR's goal of a stable provider boundary: the boundary shouldn't be spelled experimental_ in every consumer's HCL.

Fair trade-off: the prefix does make instability impossible to miss and keeps v1/v2 unambiguous in locals/state, the gate approach reproduces that via validation instead of naming. I think that's worth it to avoid the double migration.

What do you think?