chore(process): #303 H10 — review-verdict merge-gate (latest commit must be reviewed)

Folds condition (c) into pretooluse-merge-consent.sh (H6): a PR merge is
allowed only when a `Review-verdict:` comment references the PR's CURRENT
head sha — proving the latest commit was reviewed, not a stale earlier diff
(mechanizes the ersatztv#242 "re-review the fix commit" lesson).

Graceful adoption mirrors H6's Done-when tiering:
- positive verdict @ head        -> allow
- verdict @ older sha (stale)    -> deny  (#242 failure mode)
- head verdict negative          -> deny
- marker with no sha / none yet  -> ask
- comments unfetchable           -> ask

Reuses H6's PR fetch, docs-only exemption, and Gitea-auth-from-env (one hook,
no detection drift — per the #303 methodology review). Pipe-tested 12 cases.

Docs: decisions.md (new H10 entry + TOC), CLAUDE.md Task Completion Protocol.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/hooks/pretooluse-merge-consent.sh

@@ -1,11 +1,16 @@
 #!/usr/bin/env bash
 # PreToolUse / mcp__gitea__pull_request_write — derive merge consent from STATE instead of
-# trusting the agent's judgment (ersatztv#303 H6). A PR merge is the one irreversible op; allow it
-# only when BOTH are true:
+# trusting the agent's judgment (ersatztv#303 H6 + H10). A PR merge is the one irreversible op; allow it
+# only when ALL are true:
 #   (a) the PR's CI combined status is green, AND
-#   (b) every checkbox in the linked issue's "## Done-when" section is ticked.
+#   (b) every checkbox in the linked issue's "## Done-when" section is ticked, AND
+#   (c) a review-verdict comment on the PR references the CURRENT head sha (H10) — proving the
+#       LATEST commit was reviewed, not a stale earlier diff (the ersatztv#242 failure mode:
+#       "re-review the fix commit, not just the initial PR diff").
 # The "## Done-when" issue-body checklist is the convention (docs/decisions.md, CLAUDE.md Task
 # Completion Protocol). One box is "adversarial review passed"; the others are per-issue.
+# The H10 review-verdict convention: after reviewing a PR (or its latest fix commit), post a PR
+# comment carrying a line `Review-verdict: <MERGEABLE|APPROVED|BLOCKED|NOT-MERGEABLE> @ <head-sha>`.
 #
 # Decision policy — a CONSENT gate, so it does NOT fail silently open:
 #   - state derivable and NOT satisfied            -> deny  (actionable reason)
@@ -97,5 +102,36 @@ if [ "$mwcs" != "true" ]; then
   esac
 fi
 
-# Both derivable and satisfied -> allow.
+# --- (c) Review-verdict freshness (ersatztv#303 H10): a review-verdict comment must reference the
+#     CURRENT head sha, so the latest commit is proven-reviewed (ersatztv#242: re-review the fix
+#     commit, not just the initial diff). Graceful adoption mirrors (b): a verdict comment that
+#     references head must be positive -> allow; one that exists only for an OLDER commit -> deny
+#     (the stale-review failure mode); NO verdict comment at all -> ask (convention not yet used).
+[ -n "$sha" ] || decide ask "H10 merge gate: could not resolve PR #$pr head sha to verify a review verdict. Confirm the review covered the latest commit before merging."
+short=${sha:0:7}
+comments=$(gq "repos/$owner/$repo/issues/$pr/comments?limit=100")
+if [ -z "$comments" ]; then
+  decide ask "H10 merge gate: could not fetch PR #$pr comments to verify a head-referencing review verdict ($short). Confirm the adversarial/Codex review covered the latest commit before merging."
+fi
+# Verdict lines across all comment bodies (the convention marker, case-insensitive).
+verdicts=$(printf '%s' "$comments" | jq -r '.[].body // empty' 2>/dev/null | grep -iE 'review-verdict:' || true)
+if [ -z "$verdicts" ]; then
+  decide ask "H10 merge gate: no 'Review-verdict:' comment found on PR #$pr referencing head $short. Post the adversarial/Codex verdict (e.g. 'Review-verdict: MERGEABLE @ $short'), or confirm the review covered the latest commit and approve."
+fi
+# Of those, the ones that reference the current head (>=7-char sha prefix, fixed-string).
+head_verdicts=$(printf '%s\n' "$verdicts" | grep -F "$short" || true)
+if [ -z "$head_verdicts" ]; then
+  # A verdict marker exists but none references head. Distinguish a real stale review (the line
+  # carries a sha-shaped token for an OLDER commit -> deny, the #242 case) from a marker with no
+  # sha at all (a lazy or convention-quoting comment -> ask, don't mislabel it as stale).
+  if printf '%s\n' "$verdicts" | grep -iqE '[0-9a-f]{7,40}'; then
+    decide deny "H10 merge gate: BLOCKED — a review-verdict comment references an older commit, not the current head ($short). The latest commit(s) are unreviewed (ersatztv#242: re-review the fix commit, not just the initial diff). Re-review the head and post 'Review-verdict: MERGEABLE @ $short'."
+  fi
+  decide ask "H10 merge gate: a 'Review-verdict:' comment on PR #$pr references no commit sha. Post one referencing the current head ($short) — e.g. 'Review-verdict: MERGEABLE @ $short' — or confirm the review covered the latest commit and approve."
+fi
+if ! printf '%s\n' "$head_verdicts" | grep -iqE 'review-verdict:[[:space:]]*(mergeable|approved|lgtm)'; then
+  decide deny "H10 merge gate: BLOCKED — the review verdict for the current head ($short) is not MERGEABLE/APPROVED. Resolve the findings and post a fresh 'Review-verdict: MERGEABLE @ $short' comment before merging PR #$pr."
+fi
+
+# All derivable and satisfied -> allow.
 decide allow ""