# LESSON_LEARNED — mgf-secrets

> Append-only, dated lessons log (DOC-19). One entry per real lesson so the
> Foundation stops re-learning the same thing. Newest first.

## 2026-07-18 — P1 bootstrap

- **The registry must fail closed, always.** A partial registry is worse than no
  registry: a silently-dropped entry is exactly the inventory-blindness class the
  program exists to kill. Every validation path raises rather than best-efforts.
- **A fingerprint is not a secret.** The redaction property test first flagged a
  forge deploy-key fingerprint as a "leak" — but fingerprints are public
  identifiers (forge UIs show them; the registry declares them). Redaction guards
  *values*, not public metadata.
- **Unmarked tests are tier-1.** The supervisor coverage gate (`--tier 0-2`)
  selects unmarked tests as tier-1, so a plain unit suite is gated without markers.
