diff --git a/workplans/WHYNOT-WP-0003-downstream-consumption.md b/workplans/WHYNOT-WP-0003-downstream-consumption.md
index 205f975..9dff632 100644
--- a/workplans/WHYNOT-WP-0003-downstream-consumption.md
+++ b/workplans/WHYNOT-WP-0003-downstream-consumption.md
@@ -100,11 +100,27 @@ tagged. Tag the current state as the first real anchor.
 
 ```task
 id: WHYNOT-WP-0003-T02
-status: wait
+status: done
 priority: high
 state_hub_task_id: "dbd3a2e6-0623-4efd-8293-399002e85ea2"
 ```
 
+**Done 2026-06-29.** Published `@whynot/design@0.4.0` to the coulomb Gitea npm
+registry (`https://gitea.coulomb.social/api/packages/coulomb/npm/`, 66 files).
+Cut as a coherent release first (`make release VERSION=0.4.0` + `make ir` so
+`ir/manifest.json` designVersion reads 0.4.0; tagged `v0.4.0`). The token was
+sourced via the ops-warden access front door — `warden access
+whynot-design-npm-publish --field NPM_AUTH_TOKEN --exec -- npm publish` — which
+proxies the OpenBao read as the caller (OIDC `bao login -path=netkingdom role=
+whynot-design-workload-kv-read`, OpenBao at `bao.coulomb.social`); no secret was
+inlined or committed. Install-verified in a scratch consumer: `npm i
+@whynot/design@0.4.0 lit` resolves, installed version + `ir/manifest.json`
+designVersion both 0.4.0, and the `exports` map resolves (`.`, `/tokens`,
+`/styles/components.css`, `/ir/*`). Lane provisioning tracked as railiance-platform
+CCR-2026-0001 (active/ready/resolvable). A separate read/install token id
+(`whynot-design-npm-read`) is not yet provisioned — the publish token sufficed for
+the verify install.
+
 Make the package installable with a version pin:
 - Flip `"private": true` → `false`; fix `repository.url` (currently the placeholder
   `gitea.example.com`) to the real Gitea remote.