Keep bootstrap proof separate from per-run preflight output

Keep a frozen preflight receipt separate from the destination used by later setup probes. If preparation writes to a path already pinned as a launch input, successful setup can invalidate its own custody check before any solver starts. Use separate per-run output paths and verify seals after preparation. When this collision is detected before inference, preserve the overwritten output and restore the committed original bytes; do not relax the hash check or describe an unexecuted fix as the active helper. This establishes retained input identity, not that preparation was fault-free. A future helper correction needs its own explicit registration.

Applies when: setup probes and an immutable experiment registration share filesystem outputs. Keywords: preflight bootstrap immutable receipt overwrite custody hashes registration