`pgh publish --dry-run` on favela-bridge blocked with a code-differs conflict: atproto-identity@0.0.3 in the workspace no longer matches what was published as 0.0.3. Three commits landed after the version was set — 8261f49 (a recovery secret sealed for replication), ed610bd (a genesis may name nobody's infrastructure) and c7bb0cc (the holder's half of the hosting ceremony) — and none of them bumped it. Consumers bundle this by file: link at publish time, so an unchanged version over changed bytes means every app that vendors it skews silently against every other. That is exactly the class the publish guard exists to catch, and it did. No code change here; the version is the fix. atproto-identity 68/68 tests, 232/232 asserts Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>