Two shipped plots file to external institutional bodies on the Filing channel, but Filing custody assumed an observer recipient and panicked without one, aborting a live session at the beat. Filing now takes the observer endpoint only when addressed to an observer; an outward filing keeps the same carrier first hop - so the route-local LIE boundary is unchanged - and terminates at the institutional relay, authoring no observer-local evidence. Save validation, which enforced the same invariant a second time, accepts that shape on its own terms. Defense: amends messages.md's Filing clause to cover a destination the evidence law never modelled, preserving exact carrier and relay custody without inventing a recipient. Two new tests: one reproduces the panic and pins the route, one proves a run holding an outward filing still saves and loads.