Opaque secret requirement resolution for restored sessions.
The kernel sees descriptors only. Secret bytes remain owned by the host’s provider and are consumed through provider operations, never Hara values.