fix(review): accept bounded Gitea supersession by default

harness/agents/review/skills/gitea-code-review/scripts/native_review.py

@@ -369,7 +369,10 @@ def validate_plan(plan):
         fail('invalid provider projection flags')
     if any(type(x) is not str or not x.strip() for x in provider['evidence']):
         fail('invalid provider evidence')
-    if any(flags) and not provider['evidence']:
+    # Replacement booleans remain typed v1 compatibility fields, not permissions.
+    # Normal same-author metadata transitions are verified from before/after/exact.
+    # File-order normalization is still a separate, evidence-backed exception.
+    if provider['unordered_commit_files'] and not provider['evidence']:
         fail('provider projection requires evidence')
     return plan
 
@@ -613,9 +616,11 @@ def verify_publication(plan, before, after, exact):
                 or set(review) != set(fresh)
                 or canonical({k: v for k, v in review.items() if k not in permitted}) != canonical({k: v for k, v in fresh.items() if k not in permitted})):
             fail('historical review immutable content changed')
-        provider = plan['provider_contract']
-        superseded = provider['supersede_same_author'] and review.get('official') is True and review.get('dismissed') is False
-        retouched = provider['retouch_dismissed'] and review.get('official') is False and review.get('dismissed') is True
+        # Normal same-author Gitea replacement is part of the readback contract,
+        # not an opt-in exception. Immutable fields/comments were checked above;
+        # only these exact flag transitions and the new review timestamp qualify.
+        superseded = review.get('official') is True and review.get('dismissed') is False
+        retouched = review.get('official') is False and review.get('dismissed') is True
         if (not (superseded or retouched) or fresh.get('official') is not False or fresh.get('dismissed') is not True
                 or fresh.get('updated_at') not in {exact['submitted_at'], exact['updated_at']}):
             fail('unauthorized historical review projection')