[GTrunSec]

Go bootstrap previously submitted the original authority publication on every restart, including after Rust had committed it and the response was lost. Bootstrap now inspects that exact durable decision first. A matching committed outcome activates the frozen bundle without a publication write; rejection, unavailable inspection and invalid binding fail closed. Authoritative NotFound allows one unchanged CAS submission, with no retry or parent rebasing after a lost reply.

The real mTLS relay drops every successful publication response across recovery. Tests restart Go and Rust, verify one publication submission, preserve the consumed node's canonical receipt, and reject an unused node after later revocation. Rust still owns fresh Policy/fence checks at execution; a historical receipt cannot authorize a send.

Validation:

• Go client/config race tests and real Go/Rust publication-loss integration passed.
• Quint: 17 named scenarios/counterexamples and 1,000 safety traces at 60 steps, seed 293.
• Lean publication/accounting composition checked on the pinned toolchain; explicit native persistence/transport premises retained.
• Strict Project/SysML SDK checks passed; core D2 and English Org synchronized.

This PR is stacked on #1 and contains only the mainline recovery changes. No dependency pins change. Remote GitHub CI is not an acceptance blocker under the requested private-project workflow.