Opus advisor noted the static guard covered 4 of the 5 identity-mismatch eviction sites; add the credential-self-heal pop/close pair so a future re-lock of that path is caught by the gate too.