Settle the npm lane field, and record an ungoverned duplicate

The attended session enumerated field names at the governed path: NPM_AUTH_TOKEN
is the only field present, at KV version 2. This repository's record was correct.
secrets-engine's lowercase field name and the ops-warden catalog change made on
that statement both name a field absent from that path, so that change points the
front door at nothing and must be reverted before next use. The both-fields
reconciliation is ruled out.

The same session found the legacy path is real: secret/coulomb/whynot-design/
npm/publish exists at version 1, created five days after the governed lane was
verified, outside its policy and outside any CCR. Only metadata was read; field
names were not enumerated and nothing was deleted. Disposition is the new
RPF-WP-0035-T07, which asks first whether the consumer's proven publish has been
reading the duplicate rather than the governed lane.

Receipt carries field names only, attended_identity true, no mutation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5

credential-change-requests/CCR-2026-0001-whynot-design-npm-publish.yaml

@@ -101,6 +101,25 @@ verification:
   - Secret value provisioned directly in OpenBao through approved operator custody.
   - Positive and negative verification recorded with non-secret audit ids or timestamps.
   evidence:
+  - at: '2026-09-10T07:00:55+00:00'
+    actor: bernd.worsch
+    kind: attended_field_name_resolution
+    result: passed
+    details:
+    - Attended founder session enumerated field names at platform/workloads/coulomb/whynot-design/npm-publish.
+    - The only field present is NPM_AUTH_TOKEN, at KV version 2. This request's
+      openbao.fields is correct and unchanged.
+    - secrets-engine reported a different, lowercase field name and ops-warden
+      changed their catalog and playbook on that statement; both name a field
+      absent from this path. The exact spelling is deliberately not repeated here
+      because the CCR secret-marker guard rejects it; see
+      docs/workload-kv-access-lanes.md. Reverting that catalog change is tracked
+      with the owners.
+    - Legacy path secret/coulomb/whynot-design/npm/publish exists at version 1,
+      created 2026-07-03T15:00:44Z, never updated, outside this request's policy.
+      Field names not enumerated. Disposition RPF-WP-0035-T07.
+    - Read-only; no value emitted, no mutation. Receipt
+      docs/evidence/2026-09-10-npm-lane-field-resolution.json.
   - at: '2026-06-28T10:37:42+00:00'
     actor: codex
     kind: non_secret_openbao_apply_check