Revert the npm field, re-measure coverage, and hold the layer divergence

Five inbox items worked, none of which changed a credential value or moved a
secret.

whynot-design-npm-publish: field reverted npm_token -> NPM_AUTH_TOKEN and the
path confirmed, on railiance-platform's attended, read-only, no-value field
enumeration (their docs/evidence/2026-09-10-npm-lane-field-resolution.json).
Exactly one field is present at the governed path. The 2026-09-09 change was
adopted from a coordination message and would have failed at the WP-0037-T03
rotation. The ungoverned second location is recorded as an explicit non-lane,
not deleted and not tidied away.

pep-stance coverage: published figures were stale by eight lanes (unknown
18->20, not_applicable 12->15) while resolved stayed at 3 — the denominator
moved, the classification did not. Caught by the test that asserts the published
block equals what report_coverage.py measures. tests/test_workload_join.py held
the same stale counts; both now measure the same populations.

rapp-qonto-keycape-client: blocker character updated — authority exists and is
unexercised by owner decision ("not yet", offer open), which is not the same as
no authority existing. Reopen triggers are events, never elapsed time.

flex-auth -> access-engine rename (WARDEN-IN-0003): access-engine added to the
policy-check lane's keywords so routing resolves under both names from today.
owner_repo deliberately not flipped — policy.py sends it as resource.system on
every /v1/check, and FLEX-DEC-2026-013 keeps runtime names as flex-auth.

layer declaration: INTENT.md says Staff, layer.yaml says staff, section 11 does
not say which governs. Neither changed; gate-house holds the ruling. Position in
docs/layer-declaration-precedence.md, wait in WARDEN-WP-0034-T06, and a comment
in layer.yaml telling the next session not to "fix" it — the divergence is the
evidence the ruling is made against.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 63291@bnt-lap001
Assistant-Session: 8bd77868-ca68-4f49-bb1e-d539ecc0d703

pep-stance.yaml

@@ -87,8 +87,14 @@ on_apply:
 # Coverage is DISCLOSURE, never a transitional licence: it does not soften this
 # map's stance, does not gate it, and never makes the marked cell conformant.
 # Self-measured; regenerate with `python scripts/report_coverage.py`.
+# 2026-09-21 re-measure: routing lanes grew from 30 to 38 catalogued entries
+# since 2026-09-09, so unknown rose 18 -> 20 and not-applicable 12 -> 15 while
+# RESOLVED STAYED AT 3. Classification did not regress; the denominator moved.
+# Signing targets are unchanged. Reported to gate-house per §13.1 — a figure in
+# a register that cannot detect its own staleness is only as good as the last
+# re-measure, and this one was stale by eight lanes before the test caught it.
 classification_coverage:
-  measured: "2026-09-09"
+  measured: "2026-09-21"
   attribution: self-measured
   signing_targets:
     resolved: 0
@@ -96,8 +102,8 @@ classification_coverage:
     not_applicable: 1
   routing_lanes:
     resolved: 3
-    unknown: 18
-    not_applicable: 12
+    unknown: 20
+    not_applicable: 15
 
 verdict_caching: none
 input_claim_caching: "registry/flex-auth/production_registry_snapshot.json, rebuilt by scripts/build_flex_auth_registry.py"