Thank you for the feedback. You're right about the difficulty of testing, and I certainly don't expect perfection, just improvement and an aggressive focus on governance by witnesses. I think an especially important thing that should get careful thought is the capability for back-out, or @personz' term is better in a post today... fallback.

Although that capability has not been available in this and past hardforks, I think it's critical to enable it for future hardforks. I'm aware that implementation is difficult, but it should be possible. For example, it might involve writing transactions in old and new formats for a period of time and staging the hard fork in two phases. Phase 1: redundant transaction storage with fallback capability; Phase 2: Only new format transactions, after stability, validation, and signoff by stakeholders.