Auto-mode classifier "blocked" error doesn't reliably indicate whether the action executed

During a bulk PR-merge sweep, several gh pr merge calls (including multi-command chains) returned "Permission for this action was denied by the Claude Code auto mode classifier" — but gh pr view --json state,mergedAt afterward showed the merge had actually gone through. This happened repeatedly, not once. Separately, a different large batch genuinely didn't execute at all when blocked, so the block message doesn't reliably distinguish "nothing happened" from "the report was blocked but the action ran."

This is worse than either a hard allow or a hard deny: it removes the ability to trust the block message as a signal at all, forcing a manual state-check after every denial to figure out what actually happened.

Requesting either (a) the block message reliably fires before any side effect, or (b) if post-hoc blocking is intentional (e.g. blocking the report but not the already-issued command), the message text says so explicitly instead of implying nothing happened.