Stale context being more dangerous than missing context is exactly right, because a confident agent following a valid-but-outdated handoff produces changes that look deliberate. Making the expiration a CI-verifiable signal rather than a date someone remembers to check is the key move, since the two-internally-consistent-answers problem never resolves itself. I'd probably also fail CI when the handoff index and the source docs disagree, so drift gets caught at the commit that introduces it rather than the one that trips over it.