Hardening: reject UpdateActivationEnvironment on non-canonical path