[LeiterConsulting]

Bounded safety fix

Read the raw existing channel pointer before bootstrap staging; reject a different revision with zero staging writes. Preserve existing post-stage atomic guards, authentication, exact-seed checks and default publication hold. No legacy channel migration, no cleanup of old state, and no activation.

Regression tests cover a raw conflicting pointer whose resolved head is unavailable, proving zero stageContentBundle calls and no state change. Documentation distinguishes bootstrap recovery from historical migration.

Validation

• Focused suite: 52 passed.
• Exact historical source tests: 14 passed after recovering and hash-verifying the original signed deployed source commit/tree.
• Full maintenance:verify: passed locally, inputCount 1218.
• Six changed files; generated content manifests/bundle reflect the real publisher engine change, with unchanged dataset digest 90724152168c84de71c7dbd70c052b80b2346b60a18481056b06d479c72787a0 and 948 records.
• New engine engine-2c8ab6c231551a48ad85, revision content-950f79b4f0e8b2004202daf3.
• Exact remote CI/export evidence pending.

Release boundary

Draft only. No merge, deployment, workflow enablement, bootstrap dispatch, channel migration or flag change. Current deployed-seed record remains v292; this changed runtime requires independently reviewed deployment and exact seed record before any future bootstrap. It is not an approval to initialize a new channel or bypass conflicting historical state.