diff --git a/catalog/whynot-design-npm-publish.yaml b/catalog/whynot-design-npm-publish.yaml
index f338779..d1f7ce6 100644
--- a/catalog/whynot-design-npm-publish.yaml
+++ b/catalog/whynot-design-npm-publish.yaml
@@ -22,6 +22,10 @@ mount: secret
 path: coulomb/whynot-design/npm/publish
 
 # Field(s) inside the KV entry. The publish token is stored under this key.
+# NOTE: this is the KV field name, NOT the env var the value is injected as.
+# The injected name is resolved separately by the publication-scope policy and
+# is currently `NPM_AUTH_TOKEN` (see delivery_config.npm.maturity below and
+# docs/publication-scope-policy.md). Do not conflate the two.
 fields:
   - npm_token
 
diff --git a/workplans/SECRETS-WP-0006-catalog-lane-adoption.md b/workplans/SECRETS-WP-0006-catalog-lane-adoption.md
index 6e53e42..26fbabc 100644
--- a/workplans/SECRETS-WP-0006-catalog-lane-adoption.md
+++ b/workplans/SECRETS-WP-0006-catalog-lane-adoption.md
@@ -8,7 +8,7 @@ status: active
 owner: codex
 topic_slug: custodian
 created: "2026-08-21"
-updated: "2026-09-03"
+updated: "2026-09-06"
 state_hub_workstream_id: "31f7f8ea-7f73-516c-8877-f03a13f1db82"
 ---
 
@@ -260,6 +260,40 @@ Acceptance:
 - The generic OpenBao route and key-cape login route retain their correct
   owners.
 
+Discrepancy report 2026-09-06 (ops-warden `fc898979`, WARDEN-WP-0037-T01).
+ops-warden reports the authoritative whynot-design npm concrete pointer as
+`platform/workloads/coulomb/whynot-design/npm-publish`, field `NPM_AUTH_TOKEN`,
+endpoint `https://forgejo.coulomb.social/api/packages/coulomb/npm/`. Reviewed
+here without any OpenBao read or mutation:
+
+- Endpoint agrees. `catalog/whynot-design-npm-publish.yaml` already carries the
+  Forgejo registry in `delivery_config.npm.registry`.
+- The field claim is a category error, not a repo defect. `NPM_AUTH_TOKEN` is
+  the resolved *injection env var* from `publication_policy.resolve` (default
+  template, repo-clamped while netkingdom is `maturity-build`), not a KV field
+  name. The declared KV field is `npm_token`. `docs/whynot-design-real-publish-closeout.md`
+  lists both rows separately. Renaming the catalog field to `NPM_AUTH_TOKEN`
+  would break the proven pilot lane.
+- The path claim is credible and unresolved here. `docs/hardening-backlog.md`
+  already records the value against *both* `whynot-design-npm-publish` and
+  `platform/workloads/coulomb/whynot-design/npm-publish`, and every other
+  admitted lane uses the `platform/workloads/...` convention. Which location is
+  authoritative for reads is custody state owned by railiance-platform; this
+  repo cannot confirm it without lane read authority, and production live
+  commands remain fail-closed pending `SECRETS-WP-0007-T04`.
+
+The catalog mount/path is therefore left unchanged pending a custody-side
+confirmation from railiance-platform. Rewriting a proven production lane pointer
+from an inbox claim is exactly the unverified custody mutation this task must
+not make. `ready: false` observed by ops-warden is the expected fail-closed
+result and is not evidence of a wrong path.
+
+Next: obtain from railiance-platform a non-secret confirmation of which KV
+location backs this lane. If the platform path is authoritative, the catalog
+mount/path move is a reviewed lane change carrying its own approval, and the
+declared field stays `npm_token` unless custody says otherwise.
+
+
 ## Exit criteria
 
 - The five concrete OpenBao lanes have reviewed catalog entries and guarded