[rmcdaniel]

Visual classification could miss a deleted interaction when its comparison branch moved between the changed-path diff and baseline content reads. The CLI now resolves that branch before either operation, and direct multi-file classification also holds one immutable comparison commit for the entire call.

Two real-Git controls move the branch immediately after its first resolution. The previous source loses the deleted modal CSS in both CLI and multi-file classification; the successor retains it. All 23 visual-evidence controls pass, including the existing option-shaped reference refusals and SHA/branch/relative-commit positives. No browser or fixture runtime was started.

Closes the remaining baseline-coherence finding in the #289 review; contributes to #187. The protected-App configuration and live pilot remain separate.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[rmcdaniel]

Security exact-source disposition: PASS; PROTECTED-APP/PILOT/RUNTIME HOLD for head 6a5b03d88880e1771654c470fd54d4eb52191418, tree 67ed216f, accepted base e3d5d4644e56094f53dcd0b61e09abcb60946ed3.

I independently reviewed the two-file +51-line delta and reproduced the original coherence failure with real Git state: after the comparison alias moved following the first resolution, the accepted-base implementation diffed the deleted stylesheet from commit A but re-resolved its content from commit B and returned an empty classification instead of the required modal classification. The successor resolves the CLI --base-ref to one verified commit before the diff, and classify_changes resolves any direct caller's reference once before iterating files. Every later git diff/git show receives the immutable object ID; the option-shaped-ref refusal and SHA/branch/relative-commit positives remain.

Independent verification:

• all 23 VisualEvidenceGitBoundaryTest/visual-evidence tests pass, including the two real branch-movement controls;
• the predecessor produced {"classification":{}} in the deleted-modal reproduction, while this exact successor returns the required source.css modal classification;
• compile and whitespace checks pass;
• eight ordinary hosted checks are successful, and direct PR Sonar has zero open/confirmed findings.

The remaining failed Validate bounded workflow inputs job is the already-separated protected-App configuration refusal: its App ID is empty. It is not waived or counted as a source failure/pass, and this review does not provision the App or authorize a protected gate, browser, provider, pilot, or runtime operation.

[rmcdaniel]

General's main acceptance and safe branch cleanup are complete. Actual merge 48dec41737ab11b61a7c988adea12141a5360a4b has exact reviewed tree 67ed216fcb89b86b666c8015159868ad9a3c8a43 and ordered parents [e3d5d4644e56094f53dcd0b61e09abcb60946ed3, 6a5b03d88880e1771654c470fd54d4eb52191418]. All seven exact-main contexts and all three ordinary main workflows succeeded.

The local and remote merged source branch were deleted normally, and GitHub independently returns 404 for that exact ref. Both real-Git move-after-resolution controls and the 23 focused controls are reconciled with Security's exact source PASS. This closes #289's remaining baseline-coherence finding. The unprovisioned protected-App gate and live issuer/pilot remain held; #187 retains its other source corrections.