docs(records): lead decision 38, Gitea helper round 2 disposition (row 12)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -496,3 +496,20 @@ which stay with him. Each item names who decided it and what happened.
     ruling, and the change only lets the helper read the file's actual
     format. JSON wrapper files would need writes under `~/.mosaic`, which
     are forbidden.
+38. **Gitea helper round 2: one blocker left, fixed under a lead check.**
+    Rocko closed the round 1 blocker (config is built and checked before
+    curl starts) on helper.patch dd9e38bf. The round 2 report (2096b0a3)
+    has one new blocker: `CFG` keeps an export attribute inherited from
+    the caller, so an exported `CFG` in the environment carries the secret
+    config into curl and the body-file utilities. The fix is Rocko's:
+    `export -n CFG` right after the checked assignment, before any child
+    starts, plus inherited-`CFG` regressions for GET and POST with raw and
+    JSON dummy credentials, and a mutation that removes the line and must
+    fail them.
+    Item 27 says scope is cut rather than opening round 3, and Sage told
+    Darkwing the raw path would be cut. Sage departs from that here. The
+    fix is one line and the reviewer has specified it and its test, while
+    cutting the raw path would stall Piece D's live round and Gate G.
+    Darkwing applies it. Sage checks it with Rocko's reproducer and the
+    ledger tests. That is a lead check, not a review round. If the check
+    fails, the raw path is cut.