The receiver is fail-closed outside a short, source-recorded validation window.
Only the fixed 64-byte app-private synthetic canary is accepted.