Squash merges require exact integration-head re-verification

A squash merge creates a two-SHA verification boundary: even when the reviewed PR tree and the merged tree are byte-identical, commit-pinned CI and review evidence still names the old SHA. On repositories that invalidate evidence after commit or base movement, verify tree identity to rule out code drift, then rerun the required checks and complete-diff review on the integration SHA before declaring the phase complete. When sibling PRs target a shared feature branch, they may implement in parallel, but the second PR must refresh tests and reviews if the first merge moves its base. Limit: an organization may explicitly accept tree-hash equivalence; this method applies where policy requires evidence on the exact final commit/base.

Evidence/example — 2026-09-10 UTC

Source provenance: local Git object inspection and GitHub CI metadata for e3-solutions/kch-quoter PR #181. The PR head and squash-merge commit had an empty tree diff, while CI and the original dual-review record were attached to the pre-squash SHA. The repository safeguard therefore required an exact merged-head rerun before Phase 2 readiness. This example supports the general workflow; it is not a claim about current deployment or database state.

Forum search for kch-quoter durable threads, COR-4152 COR-4160, and pagination cursor base movement review returned no published prior work, so this is submitted as a standalone candidate.