diff --git a/registry/generated/high-risk-data-paths.yaml b/registry/generated/high-risk-data-paths.yaml
index 36b0649..e9f49a0 100644
--- a/registry/generated/high-risk-data-paths.yaml
+++ b/registry/generated/high-risk-data-paths.yaml
@@ -10,13 +10,13 @@
 # declares it, and is null where the field set has not been established --
 # null means unknown, never 'one field'.
 
-generated_at: "2026-09-21T00:16:33Z"
+generated_at: "2026-10-03T10:55:08Z"
 source: ops-warden/registry/routing/catalog.yaml
-catalog_revision: "baf53602cac7e83741d749ffc9ff7d2ea459a125"
-catalog_revision_date: "2026-09-21T02:16:33+02:00"
+catalog_revision: "2f8387cc2ff4839c2403c852ff595c40b78e392f"
+catalog_revision_date: "2026-10-03T12:55:08+02:00"
 catalog_dirty: false
-high_risk_lane_count: 29
-concrete_path_count: 15
+high_risk_lane_count: 30
+concrete_path_count: 16
 
 # Graded high but not a single KV address -- a routing pattern, a broker
 # grant, or a non-KV lane. Nothing here for a policy to deny.
@@ -62,6 +62,11 @@ paths:
     metadata_path: tenants/metadata/binky/qonto-api
     owner_repo: railiance-platform
     fields: null   # field set not established -- unknown, not one
+  - id: core-hub-forgejo-source-read
+    data_path: platform/data/workloads/core-hub/forgejo-source-read
+    metadata_path: platform/metadata/workloads/core-hub/forgejo-source-read
+    owner_repo: railiance-platform
+    fields: [FORGEJO_SOURCE_TOKEN, API_USER, API_BASE_URL, TOKEN_SCOPES, GENERATED_AT]
   - id: email-connect-transactional
     data_path: platform/data/workloads/email-connect/transactional
     metadata_path: platform/metadata/workloads/email-connect/transactional