Settle the npm lane field, and record an ungoverned duplicate

The attended session enumerated field names at the governed path: NPM_AUTH_TOKEN
is the only field present, at KV version 2. This repository's record was correct.
secrets-engine's lowercase field name and the ops-warden catalog change made on
that statement both name a field absent from that path, so that change points the
front door at nothing and must be reverted before next use. The both-fields
reconciliation is ruled out.

The same session found the legacy path is real: secret/coulomb/whynot-design/
npm/publish exists at version 1, created five days after the governed lane was
verified, outside its policy and outside any CCR. Only metadata was read; field
names were not enumerated and nothing was deleted. Disposition is the new
RPF-WP-0035-T07, which asks first whether the consumer's proven publish has been
reading the duplicate rather than the governed lane.

Receipt carries field names only, attended_identity true, no mutation.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5

docs/evidence/2026-09-10-npm-lane-field-resolution.json

@@ -0,0 +1,30 @@
+{
+  "schema": "platform.openbao-open-questions-session.v1",
+  "observed_at": "2026-09-10T07:00:55.690609+00:00",
+  "operation": "read-only observation",
+  "credential_values_emitted": false,
+  "openbao_mutations": 0,
+  "questions": [
+    "Q1",
+    "Q2"
+  ],
+  "attended_identity": true,
+  "ambient_token_vars_present": [],
+  "q1_legacy_npm_path": {
+    "legacy_mount_present": true,
+    "legacy_path": "secret/coulomb/whynot-design/npm/publish",
+    "legacy_path_present": true,
+    "current_version": 1,
+    "created_time": "2026-07-03T15:00:44.99885594Z",
+    "updated_time": "2026-07-03T15:00:44.99885594Z"
+  },
+  "q2_npm_lane": {
+    "path": "platform/workloads/coulomb/whynot-design/npm-publish",
+    "readable": true,
+    "field_names": [
+      "NPM_AUTH_TOKEN"
+    ],
+    "kv_version": 2,
+    "values_recorded": false
+  }
+}