docs: record whynot-design lane pointer discrepancy from ops-warden

ops-warden (WARDEN-WP-0037-T01) reported the whynot-design npm lane as
platform/workloads/coulomb/whynot-design/npm-publish, field NPM_AUTH_TOKEN.

Reviewed without any OpenBao read or mutation:
- The field claim conflates the injected env var (resolved by
  publication_policy) with the declared KV field (npm_token). Annotated the
  catalog so the distinction is explicit at the point of confusion.
- The path claim is credible but unresolved: hardening-backlog already names
  both locations, and custody is owned by railiance-platform. Catalog
  mount/path left unchanged pending custody-side confirmation rather than
  rewriting a proven production lane from an inbox claim.

Recorded under SECRETS-WP-0006-T06.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M65ovP3eiiPHubibvWs9mD

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 393550@bnt-lap001
Assistant-Session: 4bb359f9-1f12-4410-9e76-079cf23c82e4

catalog/whynot-design-npm-publish.yaml

@@ -22,6 +22,10 @@ mount: secret
 path: coulomb/whynot-design/npm/publish
 
 # Field(s) inside the KV entry. The publish token is stored under this key.
+# NOTE: this is the KV field name, NOT the env var the value is injected as.
+# The injected name is resolved separately by the publication-scope policy and
+# is currently `NPM_AUTH_TOKEN` (see delivery_config.npm.maturity below and
+# docs/publication-scope-policy.md). Do not conflate the two.
 fields:
   - npm_token
 

workplans/SECRETS-WP-0006-catalog-lane-adoption.md

@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: custodian
 created: "2026-08-21"
-updated: "2026-09-03"
+updated: "2026-09-06"
 state_hub_workstream_id: "31f7f8ea-7f73-516c-8877-f03a13f1db82"
 ---
 
@@ -260,6 +260,40 @@ Acceptance:
 - The generic OpenBao route and key-cape login route retain their correct
   owners.
 
+Discrepancy report 2026-09-06 (ops-warden `fc898979`, WARDEN-WP-0037-T01).
+ops-warden reports the authoritative whynot-design npm concrete pointer as
+`platform/workloads/coulomb/whynot-design/npm-publish`, field `NPM_AUTH_TOKEN`,
+endpoint `https://forgejo.coulomb.social/api/packages/coulomb/npm/`. Reviewed
+here without any OpenBao read or mutation:
+
+- Endpoint agrees. `catalog/whynot-design-npm-publish.yaml` already carries the
+  Forgejo registry in `delivery_config.npm.registry`.
+- The field claim is a category error, not a repo defect. `NPM_AUTH_TOKEN` is
+  the resolved *injection env var* from `publication_policy.resolve` (default
+  template, repo-clamped while netkingdom is `maturity-build`), not a KV field
+  name. The declared KV field is `npm_token`. `docs/whynot-design-real-publish-closeout.md`
+  lists both rows separately. Renaming the catalog field to `NPM_AUTH_TOKEN`
+  would break the proven pilot lane.
+- The path claim is credible and unresolved here. `docs/hardening-backlog.md`
+  already records the value against *both* `whynot-design-npm-publish` and
+  `platform/workloads/coulomb/whynot-design/npm-publish`, and every other
+  admitted lane uses the `platform/workloads/...` convention. Which location is
+  authoritative for reads is custody state owned by railiance-platform; this
+  repo cannot confirm it without lane read authority, and production live
+  commands remain fail-closed pending `SECRETS-WP-0007-T04`.
+
+The catalog mount/path is therefore left unchanged pending a custody-side
+confirmation from railiance-platform. Rewriting a proven production lane pointer
+from an inbox claim is exactly the unverified custody mutation this task must
+not make. `ready: false` observed by ops-warden is the expected fail-closed
+result and is not evidence of a wrong path.
+
+Next: obtain from railiance-platform a non-secret confirmation of which KV
+location backs this lane. If the platform path is authoritative, the catalog
+mount/path move is a reviewed lane change carrying its own approval, and the
+declared field stays `npm_token` unless custody says otherwise.
+
+
 ## Exit criteria
 
 - The five concrete OpenBao lanes have reviewed catalog entries and guarded