docs(records): lead decision 39, helper lead check passed, C1 in D (row 12)

Co-Authored-By: Claude Opus 5.5 <[email protected]>

docs/plans/2026-09-26_lead-decisions.md

@@ -513,3 +513,25 @@ which stay with him. Each item names who decided it and what happened.
     Darkwing applies it. Sage checks it with Rocko's reproducer and the
     ledger tests. That is a lead check, not a review round. If the check
     fails, the raw path is cut.
+39. **Lead check passed on helper.patch 48edd46b (decision 38), and C1
+    goes into D.**
+    - `export -n CFG` follows the checked assignment directly. Darkwing
+      also found `SHELLOPTS=allexport` as a second route to the same leak,
+      and the same line closes it.
+    - Sage checked it with dummy credentials and stub `curl` and `git`:
+      raw and JSON files, GET and POST, with an exported `CFG`, with
+      `SHELLOPTS=allexport`, and with both. On the patch all 12 cases
+      keep the token out of curl's environment, argv, stdout and stderr,
+      and the token appears only in the config stream. With the
+      `export -n` line removed, all 12 leak it into curl's environment.
+    - Ledger tests pass 58/58 on the patch alone at 8efc0ff3. The helper
+      ships with the D commit, together with Rocko's two reports
+      (e896192f, 2096b0a3).
+    - Filbert's D round 1 (a2dc2302) raised C1: on a comment round,
+      in-review→waiting-on-jason needed no reviewer approvals, so an
+      owner could move a Jason-gated row past its reviewers. It is fixed
+      in D, not deferred: that move gets the approval and unresolved
+      checks of in-review→done, plus a regression. No semantics-2 entry
+      is logged yet, so the fix is cheap now.
+    - Filbert's plan correction (293747cd) goes into the D commit.
+      Round 2 of D is Filbert's.