Secret travels only through the credentials.set wire.
Fail-closed transport classification blocks non-loopback plaintext HTTP.
Generic Other answers are discouraged; label and reason text is bounded.
Expiry aborts the pending question instead of leaving it live.