@@ -117,9 +117,9 @@ This is symmetric with the `module-info.java` rule above: a new package that's e
 
 ## Examples live in `misc/`, not in the Gradle modules
 
-`misc/` is the canonical home for example / demo code. Existing example packages: `misc/src/main/java/org/bouncycastle/{asn1,crypto,jcajce,openpgp,pqc/crypto}/examples/`. It is also where a **test harness that needs third-party jars** belongs — `org.bouncycastle.mls.examples.client` (the MLS working group's gRPC interop runner, with its `src/main/proto/mls_client.proto` and the protobuf codegen plugin) moved here out of the published `mls` module, which had been shipping classes needing `io.grpc` / `com.google.protobuf` in a jar whose POM and OSGi manifest declared neither. Take such dependencies **by Maven coordinate**, not as jars hand-placed under `test/libs` and pulled in with `files()`: those are invisible to Dependabot (its config says so) and to any dependency scanner, which is how that set drifted three CVEs behind — CVE-2024-7246 and CVE-2025-55163 in gRPC, CVE-2024-7254 in protobuf-java — with nothing anywhere to report it. `misc` not being published is what makes a real coordinate free of consequence for the shipped jars. New example code should land here, not under `core/.../examples`, `prov/.../examples`, `pg/.../openpgp/examples`, etc. — putting it inside a **published** Gradle module (core/prov/pkix/pg/...) would force it into the published `bc*` jars and make it part of the JPMS-exported API surface.
+`misc/` is the canonical home for example / demo code. Existing example packages: `misc/src/main/java/org/bouncycastle/{asn1,asn1/x500,cades,cbor/c509,cert,cert/plants,cms,crypto,jcajce,mail/smime,mls,openpgp,pqc/crypto,tls}/examples/`. It is also where a **test harness that needs third-party jars** belongs — `org.bouncycastle.mls.examples.client` (the MLS working group's gRPC interop runner, with its `src/main/proto/mls_client.proto` and the protobuf codegen plugin) moved here out of the published `mls` module, which had been shipping classes needing `io.grpc` / `com.google.protobuf` in a jar whose POM and OSGi manifest declared neither. Take such dependencies **by Maven coordinate**, not as jars hand-placed under `test/libs` and pulled in with `files()`: those are invisible to Dependabot (its config says so) and to any dependency scanner, which is how that set drifted three CVEs behind — CVE-2024-7246 and CVE-2025-55163 in gRPC, CVE-2024-7254 in protobuf-java — with nothing anywhere to report it. `misc` not being published is what makes a real coordinate free of consequence for the shipped jars. New example code should land here, never inside a **published** Gradle module (core/prov/pkix/pg/...) — that would force it into the published `bc*` jars and make it part of the JPMS-exported API surface.
 
-`misc` **is** a Gradle module (in `settings.gradle`, with a `misc/build.gradle`) — but a deliberately *non-publishing* one: it is compiled and its example smoke-tests are run by `./gradlew :misc:build` so the examples don't rot against the library APIs, but it defines **no** `publishing` block and is **not** in the root `build.gradle` `distModules` list, so nothing from `misc` ships to Maven or into the distribution jars. Keep it that way — the whole point is that example code compiles under CI without becoming shipped API. Two consequences to preserve: (1) the shared `config/checkstyle/checkstyle.xml` exempts every `org.bouncycastle..*.examples.*` package from the `DebugMethodChecker` (examples legitimately call `System.out.println` / `System.exit`), so example files carry **no** `-DM` squelch comments — the Allman-brace checks (`LeftCurly`/`RightCurly`) still apply; (2) `misc/build.gradle` declares its cross-module deps explicitly (`prov`, `util`, `pkix`, `pg`, `mail`, plus `javax.mail`) since the `project(...)` deps are `implementation` (non-transitive), and `misc/src/test` carries its own `org.bouncycastle.test.PrintTestResult` copy like every other module's test tree. `pg/src/main/java/org/bouncycastle/openpgp/examples/` already exists as a legacy quirk and is published; the rule applies symmetrically — new OpenPGP example code goes under `misc/.../openpgp/examples/` instead (the package was added there for github #1414's `PublicKeyByteArrayHandler`, complementing the older PBE-only `ByteArrayHandler` in pg).
+`misc` **is** a Gradle module (in `settings.gradle`, with a `misc/build.gradle`) — but a deliberately *non-publishing* one: it is compiled and its example smoke-tests are run by `./gradlew :misc:build` so the examples don't rot against the library APIs, but it defines **no** `publishing` block and is **not** in the root `build.gradle` `distModules` list, so nothing from `misc` ships to Maven or into the distribution jars. Keep it that way — the whole point is that example code compiles under CI without becoming shipped API. Two consequences to preserve: (1) the shared `config/checkstyle/checkstyle.xml` exempts every `org.bouncycastle..*.examples.*` package from the `DebugMethodChecker` (examples legitimately call `System.out.println` / `System.exit`), so example files carry **no** `-DM` squelch comments — the Allman-brace checks (`LeftCurly`/`RightCurly`) still apply; (2) `misc/build.gradle` declares its cross-module deps explicitly (`prov`, `util`, `pkix`, `pg`, `mail`, plus `javax.mail`) since the `project(...)` deps are `implementation` (non-transitive), and `misc/src/test` carries its own `org.bouncycastle.test.PrintTestResult` copy like every other module's test tree. `pg/src/main/java/org/bouncycastle/openpgp/examples/` was the last published-module holdout and moved here in `06152ac3e2`, so **no published module has an `examples` package under `src/main/java` any more**, and no `module-info.java` exports one — `PublicKeyByteArrayHandler` (github #1414) and the older PBE-only `ByteArrayHandler` now sit side by side under `misc/.../openpgp/examples/`. Three kinds of `examples` directory do still exist under published modules and are **not** counterexamples to leave or to "consolidate": `<module>/src/main/javadoc/.../examples` (javadoc-only trees, nothing compiled from them), and `core/src/main/j2me/.../crypto/examples` plus `pg/src/main/jdk1.1/.../openpgp/examples` (legacy Ant distribution overlays, which Gradle does not compile).
 
 When moving existing example code into `misc/`, remember to drop any matching `exports …examples;` line from the source module's `module-info.java` files (both `jdk1.9` and `ext-jdk1.9` variants when the source was `prov`).