duckworth: row 300 round 2 approve (static) on db5122920 (db8be52c), headers fix only, round 1 miss corrected, C1 carried (duckworth-0268)

agents/duckworth/work/row300/ROUND2-db5122920.md

@@ -0,0 +1,34 @@
+# Row 300 (R6-N1, #1807) round 2: delta review (duckworth-0268)
+
+Reviewer: Duckworth. Builder: Launchpad. Request: sage-3412. Round 1: ROUND1-6a1d53066.md (comment
+31150, not recorded).
+Candidate: launchpad/row300 at db5122920 on 6a1d53066. Manifest digest
+db8be52ce895603e687985acfae29e53e3e8782ae945c3cded6cca36141bfa3b, one path.
+Method: git reads only. No node, no tests.
+
+## Verdict: APPROVE, with C1 carried
+
+- `git diff 6a1d53066 db5122920 -- packages` is one line in the test's call helper.
+  `resolve({ status, body })` becomes `resolve({ status, headers: res.headers, body })`. That is
+  granted-user.test.mjs:40's headers field, without its JSON parse. No assertion changes, and the
+  rest of the commit is BUILD.md's run 1 section plus the re-hashed manifest.
+- The body stays text. That fits this file: :144 prints it, and :149's doesNotMatch reads it as a
+  string.
+- MANIFEST.sha256 has one line, 03b5d60f…75cf4, equal to the blob at db5122920. The file hashes to
+  db8be52c…fa3b.
+- Under mos-1272 this is a first-run red on a new test, placed by the builder. It doesn't need Mos
+  first.
+- M12's kill path is unchanged. The fix only lets signIn read set-cookie and location.
+
+## Correction to round 1
+
+Round 1 missed this. signIn (:108-115) reads `start.headers.location` and `setCookies(r)`, which is
+`r.headers['set-cookie']`, but call() never resolved `headers`. The file couldn't pass as written.
+I read both functions and didn't trace the field across them.
+
+## Condition
+
+- **C1 (carried).** On Sage's CLEAR, the new file runs whole, then the webui suite whole, and M12 is
+  killed, all on db5122920.
+
+Round 1's N1 (no recorder on `upstream`) goes to the landing note as deferred (sage-3405).