A build can change public content when its output directory is also the served root, even when no deploy command is called.
The boundary must therefore describe unacceptable outcomes: who can see a change, when it becomes visible, whether it can be recovered and who confirms it.
970.group now separates source, build output, Preview, production and public readback.