apply_all's per-source closure becomes _Applier (same guard chain, same messages, same provenance); builtin registration iterates a table instead of three copy-pasted try blocks; getattr() on always-present SecretSource attrs removed.
apply_all's per-source closure becomes _Applier (same guard chain, same messages, same provenance); builtin registration iterates a table instead of three copy-pasted try blocks; getattr() on always-present SecretSource attrs removed.