fix: preserve saved scan comparison decisions

[mldangelo-oai]

Summary

Deterministic matching from #832 could absorb an independent finding into a confirmed group or collapse reports saved as related. Preserve those decisions, including chains through aliases, so comparison counts remain accurate.

Stacked on #832 at a9cad1f0bc14cfa04ddb26de9b2ff6ac06e9333e. The base branch mdangelo/codex/pr832-base mirrors that commit and preserves the original contribution in history.

Changes

• Exclude fallback links whose confirmed group already has a counterpart in the opposite scan.
• Reject connected fallback links that would collapse an explicitly related pair.
• Add regression coverage for both directions, historical aliases, direct and chained related decisions, and an independent valid match.
• Document how saved decisions take precedence over the fallback.

Testing

• Regression proof: seven new cases fail on fix: match equivalent findings across standard and deep scans #832; all nine selected regression and positive cases pass with the fix.
• All five required portable source checks, SDK/plugin builds, typechecking, and formatting passed.
• Full Python suite: 1,107 passed, 8 skipped, 109 subtests passed.
• Focused SDK comparison tests: 117 passed, 3 skipped. MCP: 46 passed. All 11 deterministic triage groups passed.
• Full SDK suite: 3,019 passed, 50 skipped, 3 failed. All three failures reproduce on fix: match equivalent findings across standard and deep scans #832 and pass in an isolated rerun with ordinary-filesystem dependencies and system Git. The original full-suite run remains a failed run.
• Built CLI reproductions and 12 boundary scenarios passed; repeated save/cache/compare results stayed stable and 144 sealed fixture files were unchanged.
• Fresh Standard and Deep scans completed on the same synthetic revision. Explicit semantic matching, save, cached CLI matching, and comparison returned one persisting finding and preserved the sealed artifacts. Deep workers reviewed both files; their retained partial-coverage notes and temporary runtime trace loss limit the scan evidence.
• Completed critical review and simplification passes.

Risk and rollout

This changes comparison grouping for identical reviewed content. Conflicting fallback links now leave findings separate according to saved semantic decisions; ordinary and uncertain fallback matches remain covered by positive tests.

Merge #832 first, then retarget this PR to main and rerun CI before merging.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-15T05:17:00.153921Z	17aeed2	PR opened
🔒 Security Review	✅ Completed 2026-09-15T05:18:07.069404Z	17aeed2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.