Content-addressed by construction
Every publish canonicalizes the bundle to stable JSON and hashes it with SHA-256. The hash is the identity of the release, so identical content re-publishes as a no-op and there is no ambiguity about which artifact a version record points to.