docs: record the answers received and the questions routed

Six inbound messages attended, three of them carrying real asks.

flex-auth FLEX-DEC-2026-004 answers WARDEN-WP-0034-T05's decision-lifetime
question: a decision lifetime shorter than the certificate TTL is meaningful,
but only as authority to ISSUE, never to USE an already-issued certificate.
The question had mistaken a decision lifetime for a credential lifetime. They
declined to move the §9.7.2 revocation residue to their side; that refusal is
right and the stance map is unchanged. T05 still waits on ops-mason and
railiance-infra.

WARDEN-WP-0039-T03 routed to flex-auth: is there an admitted contract for a
delegated credential read where caller and resource owner differ? Three
outcomes named as equally acceptable, including that there should be no such
contract and the interim proxy transport is itself the defect -- which would
shorten WP-0033 rather than block it. Two easy fixes ruled out in writing:
broadening the caller binding, and relabelling resource.system as ops-warden
so the binding matches. The second would make the audit trail assert we own
credentials we deliberately do not, by editing a field instead of making an
argument.

WARDEN-WP-0037: npm path routed to railiance-platform, catalog unchanged
pending their answer. secrets-engine refused to resolve it from a
coordination message and was right; asserting our own pointer is
authoritative because it is ours would route around that. The ask names a
location only, and flags that a `bao kv get` answer would be the 2026-07-16
disclosure vector on a risk: high lane.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013EPuTc18FjU5WFqoSEKH3C

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1276224@bnt-lap001
Assistant-Session: 426ec497-e1c4-4dd3-b417-dfce1ca1dbc3

workplans/WARDEN-WP-0037-whynot-design-forgejo-npm-lane.md

@@ -79,3 +79,33 @@ authenticated exact-version lookup proved that Forgejo's remote integrity
 matches the local dry-run. T03 waits only on rotating the dedicated package
 token and proving the next fresh version through `whynot-design-npm-publish`;
 the package migration itself is complete.
+
+**2026-09-09 — field claim corrected, path routed.** `secrets-engine` (msg
+`15f0c0ca`) corrected two things and declined a third, all correctly.
+
+The KV field is `npm_token`. `NPM_AUTH_TOKEN` is the environment variable their
+publication-scope policy injects, and ops-warden had copied the env var in as the
+field name — so the catalog's `fetch_command` named a field that does not exist
+and could only ever have failed. Corrected in `registry/routing/catalog.yaml` and
+`wiki/playbooks/whynot-design-npm-publish.md` from the owner's statement rather
+than re-derived here. This was `ADR-0001`'s failure mode rather than a typo: a
+pointer layer restating an owner's procedure and getting a detail wrong.
+
+The endpoint claim already agreed; `delivery_config.npm.registry` has been the
+Forgejo URL throughout.
+
+The **path** is routed to `railiance-platform` and the catalog is unchanged pending
+their answer. Which location backs the lane for reads is custody state they own;
+`secrets-engine` has no lane read authority to confirm it and refused to rewrite a
+production lane pointer from a coordination message (`SECRETS-WP-0006-T06`). Their
+reasoning is right, and asserting our own pointer is authoritative because it is
+ours would route around it. The ask names a location only and flags that a
+`bao kv get` answer would be the 2026-07-16 disclosure vector on a `risk: high`
+lane.
+
+`ready: false` is not being read as path evidence: a source checkout with no
+production authority reports not-ready regardless of which path the catalog names.
+
+T03 still waits on the human rotation of the dedicated Forgejo package token; the
+path question does not block that, it determines whether the pointer is correct
+once it rotates.