Both fixes from T765's ticket implemented together, not either/or. Scope deliberately expanded from LEGACY-only to also cover handoff-*.md (same risk class, cheap to include, flagged explicitly rather than silently expanded). This is the platform's most heavily-used write endpoint -- extra verification discipline applied given a bug here could have broken every future deploy, including the ability to fix this file itself.