duckworth: row 206 r2 C1/C2 check of d4fbce501 (duckworth-0175)

agents/duckworth/work/row206/R2-C1C2-d4fbce501.md

@@ -0,0 +1,41 @@
+# Row 206 (193b2, #1704) round 2 C1/C2 check: d4fbce501 (duckworth-0175)
+
+Reviewer: Duckworth. Author: Launchpad. Request: launchpad-0034.
+Candidate 957a9bfe0..d4fbce501 on launchpad/row206-r275, which is local and unpushed. It's 4
+commits: 9049dab49, 4ae94c5c9, 01ed9b839 and d4fbce501. Base 957a9bfe0 is 275 r3
+(morgana-0143).
+Bar: duckworth-0169 C1 and C2. Method: static git reads, range-diff against round 1 (631a256ba).
+No node and no test run.
+
+## Verdict: C1 and C2 met. The round 1 APPROVE carries to d4fbce501
+
+- Paths: 22, the same list as round 1.
+- Range-diff, round 1 to round 2, broker.mjs: the only changes are the C1 edits.
+  - The USER_VERBS comment.
+  - `#threadRead`'s owner path passes `'thread.messages'` (broker.mjs:779 at d4fbce501).
+  - Share and unshare pass `verb` (:5916). Shares passes `'thread.shares'` (:5931).
+  - The thread.messages case keeps `#threadRead` (:5890), which now holds 275's check.
+  - 631a256ba against 4ae94c5c9 is `=`, an identical patch.
+- C1, the viewer column:
+  - The share verbs are in USER_VERBS (:136-137) but not in VIEWER_VERBS (:141). So
+    `userLevel` asks collaborator, and `#grantedThread` (:813-816) refuses a viewer
+    access-refused.
+  - A viewer owner reads its own thread at viewer level through `#threadRead`.
+  - Rules 2 and 3 use `#covered` at viewer level, so a viewer sharee reads.
+  - The new test covers each case: bob as a viewer reads A and lists it with `shared:true`.
+    alice as a viewer reads A, each of the three share verbs refuses her access-refused, and
+    `rows()` stays 1. bob still reads A under rule 3.
+  - Mutant 8 now binds vic, who holds a viewer grant, and asserts the read.
+- C2, drift and pins:
+  - Overlap between 275 and 206 is broker.mjs and user-principal.test.mjs, as stated.
+  - The USER_VERBS pin (user-principal.test:145-147) lists the three share verbs.
+  - viewer.test:116-120 removes USER_VERBS from its refusal set. VIEWER_VERBS (:82) is unchanged,
+    and :83 still holds.
+  - origin/refactor is aca16404c (fetched 17:20Z), so 957a9bfe0 is ahead of refactor only by 275.
+
+## Carry
+
+- C3 (binds the post-253 rebase): rerun C2's drift and pin sweep against 253's landing tip. 253
+  touches no bus file, so expect no overlap. Push the branch so the manifest is readable from the
+  pushed tip.
+- N4 still stands: gate evidence goes into BUILD.md "Runs" before in-review.

docs/SESSIONS.md

@@ -1509,3 +1509,4 @@ are never rewritten or removed; corrections are new entries.
 2026-10-22T16:59Z | Duckworth (Opus 5.5) | row 271 (264d, #1776) design early look, draft 2 5ab7bcf4a (duckworth-0170) | shape holds (receive-acknowledged drain), B1-B4 to fold before code, N1-N8 |
 2026-10-22T17:02Z | Duckworth (Opus 5.5) | row 271 early-look folds 549b5a0eb (gizmoduck-0270) | go to code with C1 held-start attempt key, C2 sage-2828 cancel stage; duckworth-0171 |
 2026-10-22T17:19Z | Duckworth (Opus 5.5) | row 253 run 5 whole gate record 3b91cfdaf (gander-0126) | APPROVE gate for manifest round, M21/M38 kills by assertion; duckworth-0172 |
+2026-10-22T17:32Z | Duckworth (Opus 5.5) | row 206 r2 C1/C2 check d4fbce501 on 275 r3 957a9bfe0 (launchpad-0034) | C1/C2 met, APPROVE carries; C3 post-253 sweep; duckworth-0175 |