safety: clamp all IDs in *Handler::Add*