@0xcraft/powershot 1.1.2 → 1.1.4

package/dist/selftest.js

@@ -22,7 +22,7 @@ import { stripControl } from './text.js';
 import { review } from './review.js';
 import { withTargetTree } from './snapshot.js';
 import { loadConfig } from './config.js';
-import { execFileSync } from 'node:child_process';
+import { execFileSync, spawnSync } from 'node:child_process';
 import { insideRepo, repoPath } from './fspolicy.js';
 import { Budget, parseLimits } from './budget.js';
 import { SelectionPlan, capabilitiesOf } from './plan.js';
@@ -48,12 +48,16 @@ import { compact } from './report/compact.js';
 import { apiKey } from './judges/llm.js';
 import { sarif } from './report/sarif.js';
 import { markdown } from './report/markdown.js';
+import { summarizeRun } from './report/summary.js';
 import { wrap } from './report/terminal.js';
 import { highlight, isJsx } from './report/highlight.js';
 import { buildGround, normalizeName, readEnvManifest, relPath } from './ground.js';
+import { implementationFingerprint, reinventionScope, typescriptImplementationFingerprint } from './reinvention.js';
 import { incompleteReasons } from './bench.js';
 import { PACKAGE_NAME, PACKAGE_VERSION } from './package-meta.js';
-import { addedLinesFromPatch, createReviewPayload, GitHubPullRequestApi, inlineMarker, parseReviewFindings, reconcileInlineComments, selectInlineComments, syncInlineComments, } from './github/inline-comments.js';
+import { addedLinesFromPatch, inlineMarker, parseReviewFindings, reconcileInlineComments, selectInlineComments, syncInlineComments, } from './github/inline-comments.js';
+import { createReviewPayload, GitHubPullRequestApi, } from './github/api.js';
+import { LEGACY_SUMMARY_MARKER, summaryCommentBody, summaryMarker, syncSummaryComment, workflowCommentScope, } from './github/summary-comment.js';
 const root = '/repo';
 /** Build a Ground by hand so verifiers are testable without git or a real repo. */
 function ground(files, deps = []) {
@@ -80,13 +84,26 @@ function ground(files, deps = []) {
     const symbolIndex = new Map();
     for (const sf of project.getSourceFiles()) {
         const rel = sf.getFilePath().slice(root.length + 1);
+        const input = files.find((file) => file.path === rel);
         for (const [name, decls] of sf.getExportedDeclarations()) {
             const decl = decls[0];
             if (!decl)
                 continue;
+            const fingerprint = typescriptImplementationFingerprint(decl);
+            if (!fingerprint)
+                continue;
             const key = normalizeName(name);
             const list = symbolIndex.get(key) ?? [];
-            list.push({ file: rel, name, line: decl.getStartLineNumber() });
+            const before = input?.before === undefined ? undefined : beforeProject.getSourceFile('/before/' + rel);
+            const existedInBase = (before?.getExportedDeclarations().get(name) ?? []).some((baseDeclaration) => typescriptImplementationFingerprint(baseDeclaration) === fingerprint);
+            list.push({
+                file: rel,
+                name,
+                line: decl.getStartLineNumber(),
+                fingerprint,
+                existedInBase,
+                scope: reinventionScope(root, rel),
+            });
             symbolIndex.set(key, list);
         }
     }
@@ -143,14 +160,40 @@ check('resolves a scoped subpath to its package', () => {
 });
 console.log('\nreinvented');
 check('fires when a helper already exists elsewhere', () => {
+    const existing = 'export function formatMinorUnits(n: number) { return n / 100 }\n';
     const g = ground([
-        { path: 'lib/currency.ts', after: 'export function formatMinorUnits(n: number) { return n / 100 }\n' },
-        { path: 'utils/money.ts', after: 'export function formatMinorUnits(n: number) { return n / 100 }\n' },
+        { path: 'lib/currency.ts', before: existing, after: existing },
+        { path: 'utils/money.ts', after: existing },
     ]);
     const found = reinvented.run(g);
     assert.ok(found.length >= 1, 'expected a duplication finding');
     assert.equal(found[0].confidence, 'firm'); // heuristic, never claims `proven`
 });
+check('silent when matching helpers are both new in the change', () => {
+    const added = 'export function formatMinorUnits(n: number) { return n / 100 }\n';
+    const g = ground([
+        { path: 'lib/currency.ts', after: added },
+        { path: 'utils/money.ts', after: added },
+    ]);
+    assert.equal(fires(reinvented, g), false);
+});
+check('silent when the matching implementation already existed in the changed file', () => {
+    const existing = 'export function formatMinorUnits(n: number) { return n / 100 }\n';
+    const g = ground([
+        { path: 'lib/currency.ts', before: existing, after: existing },
+        { path: 'utils/money.ts', before: existing, after: existing },
+    ]);
+    assert.equal(fires(reinvented, g), false);
+});
+check('silent when the candidate only became equivalent in this change', () => {
+    const before = 'export function formatMinorUnits(n: number) { return n / 10 }\n';
+    const after = 'export function formatMinorUnits(n: number) { return n / 100 }\n';
+    const g = ground([
+        { path: 'lib/currency.ts', before, after },
+        { path: 'utils/money.ts', after },
+    ]);
+    assert.equal(fires(reinvented, g), false);
+});
 check('silent on a genuinely new name', () => {
     const g = ground([
         { path: 'lib/currency.ts', after: 'export function formatMinorUnits(n: number) { return n / 100 }\n' },
@@ -165,6 +208,125 @@ check('silent on short and generic names', () => {
     ]);
     assert.equal(fires(reinvented, g), false);
 });
+check('silent when only the helper name matches', () => {
+    const existing = 'export function runCheck(currentVersion: string, availableVersion: string) { return currentVersion !== availableVersion }\n';
+    const g = ground([
+        { path: 'web/use-app-updater.ts', before: existing, after: existing },
+        {
+            path: 'scripts/check-import-boundaries.mjs',
+            after: 'function runCheck({ srcRoot, allowlist }) { return allowlist.filter((entry) => !entry.startsWith(srcRoot)) }\n',
+        },
+    ]);
+    assert.equal(fires(reinvented, g), false);
+});
+await checkAsync('silent across package boundaries', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-reinvented-scope-')));
+    try {
+        mkdirSync(join(dir, 'apps/web/src'), { recursive: true });
+        mkdirSync(join(dir, 'tools/scripts'), { recursive: true });
+        writeFileSync(join(dir, 'apps/web/package.json'), '{"name":"web","private":true}');
+        writeFileSync(join(dir, 'tools/scripts/package.json'), '{"name":"scripts","private":true}');
+        writeFileSync(join(dir, 'tsconfig.json'), '{"compilerOptions":{"allowJs":true},"include":["apps/**/*.mjs","tools/**/*.mjs"]}');
+        writeFileSync(join(dir, 'apps/web/src/normalize.mjs'), 'export function normalizePayload(value) { return value.trim() }\n');
+        writeFileSync(join(dir, 'tools/scripts/normalize.mjs'), 'function normalizePayload(value) { return value.trim() }\n');
+        const g = await buildGround(dir, [
+            { path: 'tools/scripts/normalize.mjs', added: new Set([1]) },
+        ]);
+        assert.equal(fires(reinvented, g), false);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+await checkAsync('silent when only a new barrel alias gives the candidate a matching name', async () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-reinvented-alias-')));
+    try {
+        mkdirSync(join(dir, 'lib'), { recursive: true });
+        mkdirSync(join(dir, 'scripts'), { recursive: true });
+        writeFileSync(join(dir, 'package.json'), '{"name":"fixture","private":true}');
+        writeFileSync(join(dir, 'tsconfig.json'), '{"include":["lib/**/*.ts","scripts/**/*.ts"]}');
+        writeFileSync(join(dir, 'lib/base.ts'), 'export function calculateVersion(current: string, available: string) { return current !== available }\n');
+        writeFileSync(join(dir, 'lib/index.ts'), "export { calculateVersion as runCheck } from './base.js'\n");
+        writeFileSync(join(dir, 'scripts/run-check.ts'), 'function runCheck(current: string, available: string) { return current !== available }\n');
+        const g = await buildGround(dir, [
+            { path: 'lib/index.ts', added: new Set([1]), before: '' },
+            { path: 'scripts/run-check.ts', added: new Set([1]) },
+        ]);
+        assert.equal(fires(reinvented, g), false);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+check('recognizes package boundaries for every declared language family', () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-reinvented-markers-')));
+    try {
+        const packages = [
+            ['typescript', 'package.json'],
+            ['python', 'pyproject.toml'],
+            ['rust', 'Cargo.toml'],
+            ['go', 'go.mod'],
+            ['jvm', 'build.gradle.kts'],
+            ['c-cpp', 'CMakeLists.txt'],
+            ['csharp', 'App.csproj'],
+            ['php', 'composer.json'],
+            ['ruby', 'Gemfile'],
+            ['solidity', 'foundry.toml'],
+        ];
+        for (const [name, marker] of packages) {
+            mkdirSync(join(dir, name, 'src'), { recursive: true });
+            writeFileSync(join(dir, name, marker), '');
+            assert.equal(reinventionScope(dir, name + '/src/file.txt'), name);
+        }
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
+check('implementation fingerprints cannot confuse token boundaries with token text', () => {
+    const oneToken = implementationFingerprint([{ type: '1', text: 'x\u00002\u0000y' }]);
+    const twoTokens = implementationFingerprint([{ type: '1', text: 'x' }, { type: '2', text: 'y' }]);
+    assert.notEqual(oneToken, twoTokens);
+});
+check('public CLI rejects the name-only repro and keeps an exact-match control', () => {
+    const dir = realpathSync(mkdtempSync(join(tmpdir(), 'psh-reinvented-cli-')));
+    const cli = join(process.cwd(), 'dist', 'cli.js');
+    const git = (...args) => {
+        execFileSync('git', args, { cwd: dir, stdio: ['ignore', 'ignore', 'pipe'] });
+    };
+    const run = () => {
+        const result = spawnSync(process.execPath, [cli, 'review', '--verify-only', '--checks', 'reinvented', '--from', 'HEAD~1', '--to', 'HEAD', '--format', 'compact'], { cwd: dir, env: { ...process.env, CI: 'true' }, encoding: 'utf8' });
+        return { status: result.status, stdout: result.stdout, stderr: result.stderr };
+    };
+    try {
+        git('init', '-q', '.');
+        git('config', 'user.name', 'PowerShot Tests');
+        git('config', 'user.email', 'tests@powershot.invalid');
+        mkdirSync(join(dir, 'src'), { recursive: true });
+        mkdirSync(join(dir, 'scripts'), { recursive: true });
+        writeFileSync(join(dir, 'package.json'), '{"name":"fixture","private":true}\n');
+        writeFileSync(join(dir, 'tsconfig.json'), '{"compilerOptions":{"allowJs":true},"include":["src/**/*.ts","scripts/**/*"]}\n');
+        const existing = 'export function runCheck(currentVersion: string, availableVersion: string) { return currentVersion !== availableVersion }\n';
+        writeFileSync(join(dir, 'src/use-app-updater.ts'), existing);
+        git('add', '.');
+        git('commit', '-q', '-m', 'base');
+        writeFileSync(join(dir, 'scripts/check-import-boundaries.mjs'), 'function runCheck({ srcRoot, allowlist }) { return allowlist.filter((entry) => !entry.startsWith(srcRoot)) }\n');
+        git('add', '.');
+        git('commit', '-q', '-m', 'different helper with same name');
+        const nameOnly = run();
+        assert.equal(nameOnly.status, 0, nameOnly.stderr || nameOnly.stdout);
+        assert.doesNotMatch(nameOnly.stdout, /\[reinvented\]/);
+        writeFileSync(join(dir, 'scripts/duplicate.ts'), existing);
+        git('add', '.');
+        git('commit', '-q', '-m', 'exact duplicate');
+        const exact = run();
+        assert.equal(exact.status, 1, exact.stderr || exact.stdout);
+        assert.match(exact.stdout, /\[reinvented\]/);
+    }
+    finally {
+        rmSync(dir, { recursive: true, force: true });
+    }
+});
 console.log('\ndropped-guard');
 check('fires when an early-return guard disappears', () => {
     const before = 'export function close(inv: any) {\n  if (!inv.customer) return null\n  return inv.total\n}\n';
@@ -584,30 +746,64 @@ check('a review that did not complete never renders as clean', () => {
     });
     assert.match(partial, /partial, not a verdict/);
     assert.match(partial, /outside\.ts \(no types\)/);
+    const partialMarkdown = markdown([], {
+        state: 'partial', notLookedAt: ['outside.ts (no types)'],
+        verifyOnly: true, minSeverity: 'medium', filesReviewed: 4, deterministicChecks: 7,
+    });
+    assert.match(partialMarkdown, /This review is partial — not a verdict/);
+    assert.match(partialMarkdown, /<summary>Why this is not a verdict<\/summary>/);
+    assert.match(partialMarkdown, /4 files reviewed · 7 deterministic checks/);
+    assert.doesNotMatch(partialMarkdown.slice(0, partialMarkdown.indexOf('<details>')), /outside\\?\.ts/);
+    assert.match(partialMarkdown.replace(/\\/g, ''), /outside\.ts \(no types\)/);
 });
 check('portable coverage is a verdict, but never masquerades as full semantic coverage', () => {
     const unavailable = [
-        '1 file(s) without enriched semantic coverage: web/app.ts (types, references)',
-        '2 enriched check(s) unavailable: phantom-api (no types), contract-drift (no references)',
+        '1 reviewed file lacked type information and a reference graph',
+        '2 checks requiring type information or a reference graph did not run: phantom-api, contract-drift',
     ];
     const out = terminal([], {
         subtitle: 'workspace', verified: 0, judged: 0, state: 'complete', notLookedAt: [],
-        coverage: 'portable', unavailableCoverage: unavailable,
+        coverage: 'portable', verifyOnly: true, minSeverity: 'medium',
+        filesReviewed: 1, deterministicChecks: 1, scopeDetails: unavailable,
     });
-    assert.match(out, /No findings in portable coverage\./);
-    assert.match(out, /web\/app\.ts \(types, references\)/);
+    assert.match(out, /No medium-or-higher deterministic findings\./);
+    assert.match(out, /1 file reviewed · 1 deterministic check · portable coverage/);
+    assert.match(out, /1 reviewed file lacked type information and a reference graph/);
     assert.doesNotMatch(out, /not a verdict/);
-    const md = markdown([], {
+    const selected = Array.from({ length: 20 }, (_, index) => ({
+        path: 'web/file-' + index + '.ts',
+        disposition: 'selected',
+        unavailable: index < 11 ? ['types', 'references'] : undefined,
+    }));
+    const waived = Array.from({ length: 16 }, (_, index) => ({
+        path: 'assets/file-' + index + '.json',
+        disposition: 'waived',
+        reason: 'no parser',
+    }));
+    const md = markdown([], summarizeRun({
         state: 'complete', notLookedAt: [], coverage: 'portable',
-        files: [{ path: 'web/app.ts', unavailable: ['types', 'references'] }],
-        checks: { unavailable: [
+        engine: { verifyOnly: true, minSeverity: 'medium' },
+        files: [...selected, ...waived],
+        checks: {
+            ran: Array.from({ length: 19 }, (_, index) => 'check-' + index),
+            unavailable: [
                 { check: 'phantom-api', missing: 'types' },
                 { check: 'contract-drift', missing: 'references' },
-            ] },
-    });
-    assert.match(md, /\*\*Portable coverage\.\*\*/);
-    assert.match(md, /No findings in portable coverage\./);
-    assert.doesNotMatch(md, /^No findings\.$/m);
+                { check: 'dead-on-arrival', missing: 'references' },
+            ],
+        },
+    }));
+    assert.match(md, /✅ \*\*No medium-or-higher deterministic findings\*\*/);
+    assert.match(md, /20 files reviewed · 19 deterministic checks · portable coverage/);
+    assert.match(md, /Model review was disabled \(`verify-only`\)\./);
+    assert.match(md, /<summary>Coverage details<\/summary>/);
+    const rendered = md.replace(/\\/g, '');
+    assert.match(rendered, /11 reviewed files? lacked type information and a reference graph/);
+    assert.match(rendered, /3 checks? requiring type information or a reference graph did not run: phantom-api, contract-drift, dead-on-arrival/);
+    assert.match(rendered, /16 changed files? not reviewed: no parser/);
+    assert.ok(md.indexOf('No medium-or-higher deterministic findings') < md.indexOf('Coverage details'));
+    assert.doesNotMatch(md, /web\/file-|assets\/file-/);
+    assert.doesNotMatch(md, /No findings in portable coverage\./);
 });
 check('findings are still shown when a stage failed, with the warning kept', () => {
     const f = { id: 'F1', class: 'verified', check: 'phantom-dep', severity: 'high',
@@ -724,6 +920,353 @@ const sample = [
     { id: 'F2', class: 'judged', check: 'plausible-logic', severity: 'low', confidence: 'tentative',
         file: 'src/b.ts', line: 9, title: 'off by one' },
 ];
+const summaryHead = 'a'.repeat(40);
+const summaryScope = 'xcrft/powershot/.github/workflows/review.yml:review';
+const ownedSummaryMarker = summaryMarker(summaryScope);
+const renderedSummary = (markdown) => summaryCommentBody(markdown, ownedSummaryMarker, summaryHead);
+check('summary scope follows the workflow file and job, not its moving ref', () => {
+    assert.equal(workflowCommentScope('xcrft/powershot/.github/workflows/review.yml@refs/pull/6/merge', 'review'), summaryScope);
+    assert.equal(workflowCommentScope('xcrft/powershot/.github/workflows/review.yml@refs/heads/release@v1', 'review'), summaryScope);
+});
+await checkAsync('summary publishing creates a marked comment without touching another workflow', async () => {
+    const events = [];
+    const comments = [
+        { id: 8, body: '## PR Analysis', user: { login: 'github-actions[bot]' } },
+        { id: 9, body: ownedSummaryMarker, user: { login: 'human' } },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push(`create:${body}`);
+            const created = { id: 10, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async (id) => { events.push(`update:${id}`); },
+        deleteIssueComment: async (id) => { events.push(`delete:${id}`); },
+    };
+    const result = await syncSummaryComment(api, '## PowerShot\n\nNo findings.\n', summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'created', commentId: 10, retired: 0 });
+    assert.deepEqual(events, [`create:${renderedSummary('## PowerShot\n\nNo findings.')}`]);
+});
+await checkAsync('summary reruns update the marked PowerShot comment, not the latest bot comment', async () => {
+    const events = [];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [
+            { id: 10, body: renderedSummary('## PowerShot\n\nOld'), user: { login: 'github-actions[bot]' } },
+            { id: 11, body: '## Best Practices', user: { login: 'github-actions[bot]' } },
+        ],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async (id, body) => { events.push(`update:${id}:${body}`); },
+        deleteIssueComment: async (id) => { events.push(`delete:${id}`); },
+    };
+    const markdown = '## PowerShot\n\nNew';
+    const result = await syncSummaryComment(api, markdown, summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'updated', commentId: 10, retired: 0 });
+    assert.deepEqual(events, [`update:10:${renderedSummary(markdown)}`]);
+});
+await checkAsync('summary reruns make no write when the marked body is current', async () => {
+    const body = renderedSummary('## PowerShot\n\nCurrent');
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [
+            { id: 10, body, user: { login: 'github-actions[bot]' } },
+            { id: 11, body: '## Best Practices', user: { login: 'github-actions[bot]' } },
+        ],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async () => { throw new Error('must not delete'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope), {
+        state: 'unchanged', commentId: 10, retired: 0,
+    });
+});
+await checkAsync('summary publishing migrates the newest legacy PowerShot body once', async () => {
+    const events = [];
+    const comments = [
+        { id: 12, body: LEGACY_SUMMARY_MARKER, user: { login: 'github-actions[bot]' } },
+        { id: 14, body: '## PowerShot\n\nLatest', user: { login: 'github-actions[bot]' } },
+        { id: 15, body: '## PR Analysis', user: { login: 'github-actions[bot]' } },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push('create');
+            const created = { id: 16, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('legacy comments must not be claimed with PATCH'); },
+        deleteIssueComment: async (id) => {
+            events.push(`delete:${id}`);
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    const result = await syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'migrated', commentId: 16, retired: 1 });
+    assert.deepEqual(events, ['create', 'delete:14']);
+    assert.equal(comments.some((comment) => comment.id === 12), true);
+});
+await checkAsync('summary publishing never patches a candidate from another pull request head', async () => {
+    const previousHead = '9'.repeat(40);
+    const comments = [
+        { id: 16, body: summaryCommentBody('old head', ownedSummaryMarker, previousHead), user: { login: 'github-actions[bot]' } },
+    ];
+    const events = [];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push('create');
+            const created = { id: 17, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not patch a different-head candidate'); },
+        deleteIssueComment: async (id) => {
+            events.push(`delete:${id}`);
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'current head', summaryHead, summaryScope), {
+        state: 'created', commentId: 17, retired: 1,
+    });
+    assert.deepEqual(events, ['create', 'delete:16']);
+    assert.deepEqual(comments.map((comment) => comment.id), [17]);
+});
+await checkAsync('summary ownership requires the marker at the start of the bot comment', async () => {
+    const events = [];
+    const comments = [{
+            id: 16,
+            body: `## PR Analysis\n\nQuoted output: ${ownedSummaryMarker}`,
+            user: { login: 'github-actions[bot]' },
+        }];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            events.push('create');
+            const created = { id: 17, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async (id) => { events.push(`update:${id}`); },
+        deleteIssueComment: async (id) => { events.push(`delete:${id}`); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope), {
+        state: 'created', commentId: 17, retired: 0,
+    });
+    assert.deepEqual(events, ['create']);
+});
+await checkAsync('summary markers isolate different workflow jobs using the same bot', async () => {
+    const otherMarker = summaryMarker('xcrft/powershot/.github/workflows/audit.yml:audit');
+    const comments = [
+        {
+            id: 18,
+            body: summaryCommentBody('## PowerShot\n\nAudit', otherMarker, summaryHead),
+            user: { login: 'github-actions[bot]' },
+        },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            const created = { id: 19, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not update another workflow'); },
+        deleteIssueComment: async () => { throw new Error('must not delete another workflow'); },
+    };
+    const result = await syncSummaryComment(api, '## PowerShot\n\nReview', summaryHead, summaryScope);
+    assert.deepEqual(result, { state: 'created', commentId: 19, retired: 0 });
+    assert.equal(comments[0]?.body.includes('Audit'), true);
+});
+await checkAsync('summary publishing makes no writes for an outdated pull request head', async () => {
+    const api = {
+        headSha: async () => 'b'.repeat(40),
+        listIssueComments: async () => { throw new Error('must not list'); },
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async () => { throw new Error('must not delete'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'report', summaryHead, summaryScope), {
+        state: 'outdated', retired: 0,
+    });
+});
+await checkAsync('summary publishing makes no writes when the head changes during reads', async () => {
+    let headReads = 0;
+    const api = {
+        headSha: async () => ++headReads === 1 ? summaryHead : 'b'.repeat(40),
+        listIssueComments: async () => [],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async () => { throw new Error('must not delete'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'report', summaryHead, summaryScope), {
+        state: 'outdated', retired: 0,
+    });
+});
+await checkAsync('summary publishing retires its own new comment when the head changes after create', async () => {
+    let headReads = 0;
+    const comments = [];
+    const api = {
+        headSha: async () => ++headReads < 3 ? summaryHead : 'b'.repeat(40),
+        listIssueComments: async () => [...comments],
+        createIssueComment: async (body) => {
+            const created = { id: 19, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'report', summaryHead, summaryScope), {
+        state: 'outdated', retired: 1,
+    });
+    assert.deepEqual(comments, []);
+});
+await checkAsync('summary publishing stops after a same-head update when the pull request head changes', async () => {
+    const nextHead = 'b'.repeat(40);
+    let headReads = 0;
+    const oldCandidate = { id: 19, body: renderedSummary('old'), user: { login: 'github-actions[bot]' } };
+    const newCandidate = {
+        id: 20,
+        body: summaryCommentBody('new head', ownedSummaryMarker, nextHead),
+        user: { login: 'github-actions[bot]' },
+    };
+    const comments = [oldCandidate];
+    const api = {
+        headSha: async () => ++headReads < 3 ? summaryHead : nextHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async (id, body) => {
+            assert.equal(id, oldCandidate.id);
+            oldCandidate.body = body;
+            comments.push(newCandidate);
+        },
+        deleteIssueComment: async () => { throw new Error('must not delete after the head changes'); },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'updated old head', summaryHead, summaryScope), {
+        state: 'outdated', retired: 0,
+    });
+    assert.equal(comments[1]?.body, newCandidate.body);
+});
+await checkAsync('summary reruns retire only older duplicates with the same scoped marker', async () => {
+    const comments = [
+        { id: 20, body: renderedSummary('old'), user: { login: 'github-actions[bot]' } },
+        { id: 21, body: renderedSummary('old'), user: { login: 'github-actions[bot]' } },
+        { id: 22, body: 'human note', user: { login: 'human' } },
+    ];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => [...comments],
+        createIssueComment: async () => { throw new Error('must not create'); },
+        updateIssueComment: async (id, body) => {
+            const comment = comments.find((candidate) => candidate.id === id);
+            if (comment)
+                comment.body = body;
+        },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    assert.deepEqual(await syncSummaryComment(api, 'current', summaryHead, summaryScope), {
+        state: 'updated', commentId: 21, retired: 1,
+    });
+    assert.deepEqual(comments.map((comment) => comment.id), [21, 22]);
+});
+await checkAsync('concurrent first summary runs converge on one marked comment', async () => {
+    let releaseInitialReads = () => undefined;
+    const initialReads = new Promise((resolve) => { releaseInitialReads = resolve; });
+    let reads = 0;
+    let nextId = 20;
+    const comments = [];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => {
+            if (reads < 2) {
+                const snapshot = [...comments];
+                reads++;
+                if (reads === 2)
+                    releaseInitialReads();
+                await initialReads;
+                return snapshot;
+            }
+            return [...comments];
+        },
+        createIssueComment: async (body) => {
+            const created = { id: nextId++, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('must not update'); },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    await Promise.all([
+        syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope),
+        syncSummaryComment(api, '## PowerShot\n\nCurrent', summaryHead, summaryScope),
+    ]);
+    assert.equal(comments.filter((comment) => comment.body.startsWith(ownedSummaryMarker)).length, 1);
+});
+await checkAsync('different workflows replace a shared legacy summary without cross-scope PATCH', async () => {
+    let releaseInitialReads = () => undefined;
+    const initialReads = new Promise((resolve) => { releaseInitialReads = resolve; });
+    let reads = 0;
+    let nextId = 31;
+    const legacy = { id: 30, body: '## PowerShot\n\nLegacy', user: { login: 'github-actions[bot]' } };
+    const comments = [legacy];
+    const api = {
+        headSha: async () => summaryHead,
+        listIssueComments: async () => {
+            if (reads < 2) {
+                const snapshot = [...comments];
+                reads++;
+                if (reads === 2)
+                    releaseInitialReads();
+                await initialReads;
+                return snapshot;
+            }
+            return [...comments];
+        },
+        createIssueComment: async (body) => {
+            const created = { id: nextId++, body, user: { login: 'github-actions[bot]' } };
+            comments.push(created);
+            return created;
+        },
+        updateIssueComment: async () => { throw new Error('legacy ownership must not use PATCH'); },
+        deleteIssueComment: async (id) => {
+            const index = comments.findIndex((comment) => comment.id === id);
+            if (index !== -1)
+                comments.splice(index, 1);
+        },
+    };
+    const auditScope = 'xcrft/powershot/.github/workflows/audit.yml:audit';
+    await Promise.all([
+        syncSummaryComment(api, 'review', summaryHead, summaryScope),
+        syncSummaryComment(api, 'audit', summaryHead, auditScope),
+    ]);
+    assert.equal(comments.some((comment) => comment.id === legacy.id), false);
+    assert.equal(comments.filter((comment) => comment.body.startsWith(summaryMarker(summaryScope))).length, 1);
+    assert.equal(comments.filter((comment) => comment.body.startsWith(summaryMarker(auditScope))).length, 1);
+});
 check('GitHub patches expose only added right-side lines for inline comments', () => {
     const patch = [
         '@@ -1,3 +1,4 @@',
@@ -842,10 +1385,20 @@ await checkAsync('the GitHub client paginates files, submits the review contract
                 { id: 10, path: 'a.ts', line: 1, body: 'reply', in_reply_to_id: 9, user: { login: 'human' } },
             ]);
         }
+        if (method === 'GET' && url.includes('/issues/7/comments')) {
+            return json([{ id: 21, body: 'summary', user: { login: 'github-actions[bot]' } }]);
+        }
         if (method === 'POST' && url.endsWith('/pulls/7/reviews'))
             return json({ id: 1 });
+        if (method === 'POST' && url.endsWith('/issues/7/comments')) {
+            return json({ id: 22, body: 'new summary', user: { login: 'github-actions[bot]' } }, { status: 201 });
+        }
+        if (method === 'PATCH' && url.endsWith('/issues/comments/21'))
+            return json({ id: 21 });
         if (method === 'DELETE' && url.endsWith('/pulls/comments/9'))
             return json({ message: 'gone' }, { status: 404 });
+        if (method === 'DELETE' && url.endsWith('/issues/comments/21'))
+            return new Response(undefined, { status: 204 });
         return json({ message: 'unexpected request' }, { status: 500 });
     };
     globalThis.fetch = fakeFetch;
@@ -861,11 +1414,19 @@ await checkAsync('the GitHub client paginates files, submits the review contract
         assert.equal(comments[1]?.inReplyToId, 9);
         await api.createReview('a'.repeat(40), [{ path: 'a.ts', line: 1, side: 'RIGHT', body: 'finding' }]);
         await api.deleteReviewComment(9);
+        assert.deepEqual(await api.listIssueComments(), [
+            { id: 21, body: 'summary', user: { login: 'github-actions[bot]' } },
+        ]);
+        await api.updateIssueComment(21, 'updated summary');
+        assert.deepEqual(await api.createIssueComment('new summary'), {
+            id: 22, body: 'new summary', user: { login: 'github-actions[bot]' },
+        });
+        await api.deleteIssueComment(21);
     }
     finally {
         globalThis.fetch = originalFetch;
     }
-    const submitted = calls.find((call) => call.method === 'POST');
+    const submitted = calls.find((call) => call.method === 'POST' && call.url.endsWith('/pulls/7/reviews'));
     assert.ok(submitted?.body);
     assert.deepEqual(JSON.parse(submitted.body), {
         commit_id: 'a'.repeat(40),
@@ -874,6 +1435,9 @@ await checkAsync('the GitHub client paginates files, submits the review contract
         comments: [{ path: 'a.ts', line: 1, side: 'RIGHT', body: 'finding' }],
     });
     assert.equal(calls.filter((call) => call.url.includes('/files')).length, 2);
+    assert.equal(calls.some((call) => call.method === 'PATCH' && call.url.endsWith('/issues/comments/21') && call.body === '{"body":"updated summary"}'), true);
+    assert.equal(calls.some((call) => call.method === 'POST' && call.url.endsWith('/issues/7/comments') && call.body === '{"body":"new summary"}'), true);
+    assert.equal(calls.some((call) => call.method === 'DELETE' && call.url.endsWith('/issues/comments/21')), true);
 });
 await checkAsync('inline synchronization creates one review before removing stale comments', async () => {
     const finding = {
@@ -976,6 +1540,11 @@ check('the public action persists judge answers and publishes only a verdict', (
     assert.match(action, /inline-comments:\s*\n\s+description: [^\n]+\n\s+default: 'false'/);
     assert.match(action, /Post inline comments[\s\S]+inputs\.inline-comments == 'true'[\s\S]+steps\.review\.outputs\.complete == 'true'/);
     assert.match(action, /node "\$GITHUB_ACTION_PATH\/dist\/github\/inline-comments\.js"/);
+    assert.doesNotMatch(action, /--edit-last/);
+    assert.match(action, /node "\$GITHUB_ACTION_PATH\/dist\/github\/summary-comment\.js"/);
+    assert.match(action, /POWERSHOT_HEAD_SHA: \$\{\{ github\.event\.pull_request\.head\.sha \}\}/);
+    assert.match(action, /GITHUB_WORKFLOW_REF: \$\{\{ github\.workflow_ref \}\}/);
+    assert.match(action, /GITHUB_JOB: \$\{\{ github\.job \}\}/);
     assert.match(action, /--report manifest=powershot\.manifest\.json/);
     assert.match(action, /coverage=\$COVERAGE/);
     assert.match(action, /m\.coverage === "full" \|\| m\.coverage === "portable" \? m\.coverage : "unknown"/);
@@ -988,6 +1557,7 @@ check('published CI examples preserve one verdict and its exit status', () => {
     assert.match(action, /upload-sarif: 'true'/);
     assert.match(action, /inline-comments: 'true'/);
     assert.match(action, /runs-on: ubuntu-24\.04/);
+    assert.match(action, /concurrency:[\s\S]+github\.workflow[\s\S]+cancel-in-progress: true/);
     assert.doesNotMatch(action, /npm ci|NPM_AUTH_TOKEN|NODE_AUTH_TOKEN/);
     assert.match(action, /uses: xcrft\/powershot@v1/);
     assert.match(github, /npm install --global --ignore-scripts @0xcraft\/powershot@1\.1\.2/);
@@ -1019,10 +1589,12 @@ check('the viewer labels a complete portable session', () => {
     const html = viewer([], {
         id: 'portable', target: 'workspace', started: '2026-01-01T10:00:00Z',
         state: 'complete', notLookedAt: [], coverage: 'portable',
-        unavailableCoverage: ['1 file(s) without enriched semantic coverage: app.ts (types)'],
+        verifyOnly: true, minSeverity: 'medium', filesReviewed: 1, deterministicChecks: 2,
+        scopeDetails: ['1 reviewed file lacked type information'],
     });
-    assert.match(html, /Portable coverage\./);
-    assert.match(html, /No findings in portable coverage\./);
+    assert.match(html, /1 file reviewed · 2 deterministic checks · portable coverage/);
+    assert.match(html, /No medium-or-higher deterministic findings\./);
+    assert.match(html, /<summary>Coverage details<\/summary>/);
 });
 check('the viewer escapes content rather than rendering it', () => {
     const nasty = [{ ...sample[0], title: '<img src=x onerror=alert(1)>' }];