Regeneration Path. A documented, repeatable way to recreate, rotate, or replace sensitive or generated operational material without making that material part of the source repository.
The Services README demonstrates the concept: it does not commit GitLab tokens, WireGuard client configs, preshared keys, or OAuth secrets, but it records how to regenerate or replace each one and where the live value belongs. The source owns the procedure; the operational boundary owns the state. When a secret crosses the boundary, the compromised credential rule determines the recovery posture: rotate, invalidate, and repair the record.