runtime-registry + catalog-secret-material: the #455 registry and P5 guard Two pages the work had no coverage for at all (Rule 1, first touch). runtime-registry records the lease invariant (expiry is a read-time verdict, never a delete), the kinds and who registers each, the endpoints, and — the load-bearing part — WHY the Ehdb hook sits on both publish paths and only on a landed publish. v3.130.0 placed it on the events publish alone and measured 0 on prod, because should_publish skips system executions and that is all of prod's regular traffic; the structural tests passed throughout because they assert gating, not reach. Also the per-address throttle and why one global slot was a defect. catalog-secret-material records the P5 guard: what fires, the scan-before-write ordering, that the error never echoes the value, and the measured false positive (1 finding in 26,081 string values, and it was wrong) that forced the PEM-body requirement — plus how that fix briefly made the class unreachable.