Inert provider declarations paired with trusted implementations.

Phase 5 reads only descriptors; process-free implementations remain sealed for later active phases. Credential access is supplied separately through PtcRunner.Kernel.ProviderRuntimeServices when execution opens. Host-backed catalogs carry an opaque keyed binding so runtime services from a different host document are rejected before activation. Run-bound registry construction receives the exact selected aliases and their already-anchored operation deadline; unselected implementations and OAuth authorities never enter that registry. The two-argument embedding adapter intentionally opens the complete catalog under its own bounded activation deadline because it has no run selection. Catalog construction checks that active validators, connectivity probes, and local checks agree with their descriptors without invoking any callback. An :audited_local declaration additionally requires a runtime binding, so an embedder-assembled catalog cannot carry a check phase 7 runs before provider activity. The binding scopes that claim to a sealed host document; it does not attest that the callback itself came from a shipped installation recipe, which no in-process registration can prove about its own caller. Every builder placed in a run-bound registry carries the data policy its validated sealed descriptor declares, so a staged preparation cannot contradict the policy phase 5 and sink authorization already used.