The daemon's local door is a unix socket — a file on the node's own disk. A file has no IP and no port, so nothing off the box can dial it. That single fact, not a policy setting, is why running shc on the node is admin with no login, and why running it from your laptop starts at 401.
One state that cannot exist. An explicit SHC_URL beats a ctx login'd cluster in the resolver and deliberately replays no auth header — so "SHC_URL set plus a logged-in bearer" never happens, and the diagram never draws it.