diff --git a/workplans/SHR-WP-0002-predecessor-and-deployment-reality.md b/workplans/SHR-WP-0002-predecessor-and-deployment-reality.md
index 92847fa..61f81dc 100644
--- a/workplans/SHR-WP-0002-predecessor-and-deployment-reality.md
+++ b/workplans/SHR-WP-0002-predecessor-and-deployment-reality.md
@@ -312,9 +312,38 @@ permits `sourceRepos: https://gitea.coulomb.social/coulomb/*.git`. railiance01
 has no ArgoCD `applications` resource type, so this appears inert — but it is a
 bootstrap file and should be confirmed rather than assumed.
 
-**Not swept:** CI runners and any credential lane authenticating *to* gitea.
-`ops-warden`'s catalog carries `forgejo-admin-api-token`; whether a
-gitea-specific equivalent exists was not checked.
+### Credential-lane sweep, 2026-08-20 — a *third* registry service
+
+Checking ops-warden's routing catalog found what the file sweep could not: the
+host serves **three** package services, not two.
+
+`gitea.coulomb.social/api/packages/coulomb/npm/` is an **npm registry**, and
+ops-warden's catalog lane `whynot-design-npm-publish` — `risk: high`,
+production-exercised (WP-0018 published `@whynot/design@0.4.0` through it) —
+vends the `NPM_AUTH_TOKEN` that publishes to it.
+
+So the complete CoulombCore package surface is:
+
+| Service | Endpoint | Known consumers |
+| --- | --- | --- |
+| OCI container registry | `gitea.coulomb.social/coulomb/…` | `reuse-surface` (live Deployment) |
+| PyPI index | `…/api/packages/coulomb/pypi` | `kaizen-agentic` (never migrated), `issue-core` (legacy half) |
+| **npm registry** | `…/api/packages/coulomb/npm/` | `@whynot/design` via ops-warden lane `whynot-design-npm-publish` |
+
+**Consequence for the credential lane:** after 2026-08-31 that lane routes to a
+registry that does not exist. It does not fail safe — an operator following it
+gets a token for a dead endpoint and debugs the token. `forgejo-admin-api-token`
+already exists as the forgejo-side equivalent and its keywords include
+`forgejo-npm`, so the destination is plausibly in place; ops-warden must confirm
+rather than assume, and cannot repoint the lane before the packages are on
+forgejo — the same publish-before-repoint rule as `KAIZEN-WP-0010`.
+
+Routed to ops-warden (lane owner for the catalog entry; `railiance-platform`
+owns the credential itself).
+
+**Still not swept:** CI runners. `railiance-forge/tools/gitea-runner-status.sh`
+suggests gitea-registered Actions runners exist; whether any repo's pipelines
+depend on them was not established.
 
 `forgejo.coulomb.social` is already on railiance01, so the work is retag, push,
 update manifest. Routed to `railiance-platform`; ownership of the `reuse-surface`