fix(process): #303 H10 — anchor sha match to the @<sha> field; retraction-wins [decisions-edit]

Adversarial review found false-opens in the first cut:
- `grep -F "$short"` was an unanchored substring test: a MERGEABLE verdict for
  a DIFFERENT/older commit was accepted whenever the head 7-prefix appeared
  anywhere on the line (inside a longer sha, or an unrelated commit URL). Now
  each verdict line's `@ <sha>` token is extracted and matched to head by git
  short-sha prefix semantics (head begins with token, token >=7 chars).
- No retraction semantics: a later `BLOCKED @ head` didn't override an earlier
  `MERGEABLE @ head`. Now a negative verdict on head wins -> deny.
- A 7-digit build number falsely tripped the "references an older commit" deny;
  the `@`-anchored parse fixes it -> a marker with no @sha now asks, not denies.

Also documents the issue-comment scope (gate reads issues/{pr}/comments, not
Gitea formal-review bodies). Pipe-tested: 16 cases incl. 4 adversarial
false-open reproductions, all now deny/ask. bash -n + shellcheck clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.claude/hooks/pretooluse-merge-consent.sh

@@ -118,20 +118,41 @@ verdicts=$(printf '%s' "$comments" | jq -r '.[].body // empty' 2>/dev/null | gre
 if [ -z "$verdicts" ]; then
   decide ask "H10 merge gate: no 'Review-verdict:' comment found on PR #$pr referencing head $short. Post the adversarial/Codex verdict (e.g. 'Review-verdict: MERGEABLE @ $short'), or confirm the review covered the latest commit and approve."
 fi
-# Of those, the ones that reference the current head (>=7-char sha prefix, fixed-string).
-head_verdicts=$(printf '%s\n' "$verdicts" | grep -F "$short" || true)
-if [ -z "$head_verdicts" ]; then
-  # A verdict marker exists but none references head. Distinguish a real stale review (the line
-  # carries a sha-shaped token for an OLDER commit -> deny, the #242 case) from a marker with no
-  # sha at all (a lazy or convention-quoting comment -> ask, don't mislabel it as stale).
-  if printf '%s\n' "$verdicts" | grep -iqE '[0-9a-f]{7,40}'; then
-    decide deny "H10 merge gate: BLOCKED — a review-verdict comment references an older commit, not the current head ($short). The latest commit(s) are unreviewed (ersatztv#242: re-review the fix commit, not just the initial diff). Re-review the head and post 'Review-verdict: MERGEABLE @ $short'."
-  fi
-  decide ask "H10 merge gate: a 'Review-verdict:' comment on PR #$pr references no commit sha. Post one referencing the current head ($short) — e.g. 'Review-verdict: MERGEABLE @ $short' — or confirm the review covered the latest commit and approve."
+# Classify each verdict line by the sha it references (its "@ <sha>" field) and its verdict word.
+# A line references the CURRENT head iff head BEGINS WITH that sha token AND the token is >=7 chars
+# (git short-sha prefix semantics) — NOT a loose substring test: an older sha that merely contains
+# the head prefix, or the head prefix appearing in an unrelated URL on the line, must NOT count
+# (adversarial false-opens). The verdict token must sit right after the marker on the same line.
+head_pos=0; head_neg=0; stale=0; nosha=0
+while IFS= read -r line; do
+  [ -n "$line" ] || continue
+  # The sha the line references: the hex token in its "@ <sha>" field (>=7 chars), lowercased.
+  ref=$(printf '%s' "$line" | grep -ioE '@[[:space:]]*[0-9a-f]{7,40}' | head -1 \
+        | grep -oiE '[0-9a-f]{7,40}' | tr 'A-F' 'a-f' || true)
+  is_pos=0
+  if printf '%s' "$line" | grep -iqE 'review-verdict:[[:space:]]*(mergeable|approved|lgtm)'; then is_pos=1; fi
+  if [ -z "$ref" ]; then nosha=1; continue; fi
+  case "$sha" in
+    "$ref"*) if [ "$is_pos" = 1 ]; then head_pos=1; else head_neg=1; fi ;;
+    *)       stale=1 ;;
+  esac
+done <<VERDICTS
+$verdicts
+VERDICTS
+
+# A negative verdict on head wins over a positive one (a later BLOCKED retracts an earlier MERGEABLE
+# on the SAME head; and if the head were fixed the sha would change, so this can't wrongly block).
+if [ "$head_neg" = 1 ]; then
+  decide deny "H10 merge gate: BLOCKED — a review verdict for the current head ($short) is negative (BLOCKED/NOT-MERGEABLE). Resolve the findings and post a fresh 'Review-verdict: MERGEABLE @ $short' before merging PR #$pr."
 fi
-if ! printf '%s\n' "$head_verdicts" | grep -iqE 'review-verdict:[[:space:]]*(mergeable|approved|lgtm)'; then
-  decide deny "H10 merge gate: BLOCKED — the review verdict for the current head ($short) is not MERGEABLE/APPROVED. Resolve the findings and post a fresh 'Review-verdict: MERGEABLE @ $short' comment before merging PR #$pr."
+if [ "$head_pos" = 1 ]; then
+  decide allow ""   # a positive verdict references the current head -> (c) satisfied
 fi
+if [ "$stale" = 1 ]; then
+  decide deny "H10 merge gate: BLOCKED — a review-verdict comment references an older commit, not the current head ($short). The latest commit(s) are unreviewed (ersatztv#242: re-review the fix commit, not just the initial diff). Re-review the head and post 'Review-verdict: MERGEABLE @ $short'."
+fi
+# Marker(s) exist but reference no sha at all -> ask (don't mislabel as a stale older-commit review).
+decide ask "H10 merge gate: a 'Review-verdict:' comment on PR #$pr references no commit sha. Post one referencing the current head ($short) — e.g. 'Review-verdict: MERGEABLE @ $short' — or confirm the review covered the latest commit and approve."
 
 # All derivable and satisfied -> allow.
 decide allow ""