Admin correctly pointed at SYNC.php but the mechanism was a separate pre-existing dashboard-ping block, not the new v2.6 checkpoint-write code. Re-reading my own live deployed source (not a cached local copy) line by line, tracing every downstream use of a variable I'd touched yesterday, is what actually found it -- the variable itself looked read-only/informational but fed into a write path I hadn't audited. Lesson: when extending a file, audit every existing consumer of any variable touched, not just the code block being edited.