fix(kvb-check-security): one acceptance never hides an identical line elsewhere

An acceptance was keyed by rule, path and the sha1 of the stripped line, so two identical flagged lines in one file shared it: Experiment accepted a false positive at utils/docker/registry.py:105 and the real B310 at :78, same text, vanished from the score (2026-11-12). A row without context now accepts a finding only while no other finding of the scan shares its rule, path and text; accept --line binds a row to the sha1 of the five surrounding lines and is required when the line's text occurs more than once in the file, and refuses a --sha1 that is not that line's. Existing rows keep working on unique lines; the new test fails on master (100 percent, 2 accepted) and passes here (50, then 75 percent).

🎯 Fix: 93 %
💥 Break: 4 %
💸 Cost: 100 %
⏱️ Time: 100 %
🛡️ Security: 100 %
🏆 Score: 89
🚦 Gate: ✅ 90/5, cost and time <= 100, security 100 %

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_security.py

@@ -108,6 +108,7 @@ class TestSecurity(unittest.TestCase):
             {
                 "severity": "high", "rule": "FAKE-HIGH", "path": "app.py", "line": 2,
                 "sha1": hashlib.sha1(f"token = '{PLACEHOLDER}'  # MARK-HIGH".encode()).hexdigest(),
+                "context": hashlib.sha1(f"print(1)\ntoken = '{PLACEHOLDER}'  # MARK-HIGH".encode()).hexdigest(),
             },
         )
         self.assertEqual(found["accepted"], [])
@@ -148,6 +149,35 @@ class TestSecurity(unittest.TestCase):
             ("🛡️ security 50 % (medusa: 1 finding in 1 file: critical app.py:2)\n", 1),
         )
 
+    def test_one_acceptance_never_hides_an_identical_line_elsewhere(self):
+        twin = "x = fetch(url)  # MARK-HIGH"
+        self.write("app.py", f"print(1)\n{twin}\ny = 2\n{twin}\n")
+        sha1 = hashlib.sha1(twin.encode()).hexdigest()
+        both = ("🛡️ security 50 % (medusa: 2 findings in 1 file: high app.py:2, high app.py:4)\n", 3)
+        listing = self.base / "council" / "security-accepted.jsonl"
+        listing.parent.mkdir(parents=True)
+        listing.write_text(json.dumps({"rule": "FAKE-HIGH", "path": "app.py", "sha1": sha1}) + "\n", encoding="utf-8")
+        result = self.scan(env=self.env)
+        self.assertEqual((result.stdout, result.returncode), both)
+        listing.unlink()
+        refused = self.accept("--rule", "FAKE-HIGH", "--path", "app.py", "--sha1", sha1, "--reason", "fixture")
+        self.assertEqual(refused.returncode, 2)
+        self.assertIn("the line occurs 2 times in app.py; name the reviewed one with --line", refused.stderr)
+        self.assertFalse(listing.exists())
+        wrong = self.accept("--rule", "FAKE-HIGH", "--path", "app.py", "--sha1", sha1, "--line", "3", "--reason", "fixture")
+        self.assertEqual(wrong.returncode, 2)
+        self.assertIn("--sha1 is not the sha1 of line 3 of app.py", wrong.stderr)
+        named = self.accept("--rule", "FAKE-HIGH", "--path", "app.py", "--sha1", sha1, "--line", "4", "--reason", "fixture")
+        self.assertEqual(named.returncode, 0, named.stderr)
+        result = self.scan(env=self.env)
+        self.assertEqual(
+            (result.stdout, result.returncode),
+            ("🛡️ security 75 % (medusa: 1 finding, 1 accepted in 1 file: high app.py:2)\n", 3),
+        )
+        self.write("app.py", f"print(1)\n{twin}\ny = 3\n{twin}\n")
+        result = self.scan(env=self.env)
+        self.assertEqual((result.stdout, result.returncode), both)
+
     def test_kept_rows_count_and_broken_rows_stop(self):
         line = "y = other()  # MARK-HIGH"
         self.write("app.py", f"{line}\n")