secret-source leak check (status row 127): a credential that cannot be presented reaches every door plane's caller as one fixed-class refusal; kernel cell + all-doors scan with its RED arm kept - #779