@amityco/social-plus-vise 1.0.0 → 1.1.0

package/dist/tools/project.js

@@ -1,4 +1,4 @@
-import { access, readdir, readFile } from "node:fs/promises";
+import { access, readdir, readFile, stat } from "node:fs/promises";
 import path from "node:path";
 import { productFindingIdentity } from "../productExpectations.js";
 import { objectInput, optionalStringField, stringField, textResult } from "../types.js";
@@ -20,8 +20,21 @@ async function readIfExists(filePath) {
         return "";
     }
 }
+async function assertRepoPathIsDirectory(repoRoot) {
+    let info;
+    try {
+        info = await stat(repoRoot);
+    }
+    catch {
+        throw new Error(`repoPath does not exist: ${repoRoot}`);
+    }
+    if (!info.isDirectory()) {
+        throw new Error(`repoPath is not a directory: ${repoRoot}`);
+    }
+}
 export async function inspectProject(repoPath, surfacePath) {
     const repoRoot = path.resolve(repoPath);
+    await assertRepoPathIsDirectory(repoRoot);
     const surfaces = await detectProjectSurfaces(repoRoot);
     const effectiveRoot = resolveSurfaceRoot(repoRoot, surfacePath);
     const selectedSurface = surfacePath ? await surfaceForPath(repoRoot, effectiveRoot) : surfaceMatchingRoot(surfaces, repoRoot);
@@ -82,10 +95,6 @@ async function inspectRoot(root) {
             reason: "react-native dependency or script signal",
         });
     }
-    // When react-native is detected alongside generic typescript signals, prefer react-native
-    // so that platform-specific rules (react-native.*) are used for init/check/run-sensors.
-    // Same for android: an agent may create package.json (e.g. to enable a local Vise check script) which
-    // would normally trigger typescript detection — suppress it so only android rules apply.
     const rawPlatforms = Array.from(new Set(signals.map((signal) => signal.platform)));
     const hasRN = rawPlatforms.includes("react-native");
     const hasAndroid = rawPlatforms.includes("android");
@@ -181,9 +190,6 @@ async function validateAndroid(root) {
     const findings = [];
     const manifestPath = "app/src/main/AndroidManifest.xml";
     const manifest = await readIfExists(path.join(root, manifestPath));
-    // Scan ALL Gradle build scripts, not just app/root — a multi-module app idiomatically declares the
-    // SDK dependency in the consuming FEATURE module's build.gradle(.kts) (e.g. feature/community/impl).
-    // Only checking app/build.gradle false-fired android.dependency.sdk on those (brownfield Now-in-Android).
     const gradleScripts = (await findFiles(root, [".gradle", ".kts"], 200)).filter((f) => /(?:^|[\\/])(?:build|settings)\.gradle(?:\.kts)?$/.test(f));
     const buildFiles = [...new Set([
             ...(await existingFiles(root, ["app/build.gradle", "app/build.gradle.kts", "build.gradle", "build.gradle.kts", "settings.gradle", "settings.gradle.kts"])),
@@ -222,13 +228,8 @@ async function validateAndroid(root) {
     else {
         const activitySetup = setupFiles.find((file) => {
             const c = sourceContent.get(file) ?? "";
-            // Application-scoped setup (a Hilt @Module / @HiltAndroidApp Application / SingletonComponent
-            // provider) is the CORRECT place — never flag it. The old marker matched the bare word
-            // "Activity" anywhere (incl. a comment like "outlives any Activity/ViewModel" in a DI module),
-            // false-firing on idiomatic Hilt setup (brownfield Now-in-Android).
             if (/@Module\b|@HiltAndroidApp\b|SingletonComponent\b|@ApplicationContext\b|:\s*Application\b|\bApplication\s*\(\s*\)/.test(c))
                 return false;
-            // Otherwise flag setup in an actual UI lifecycle: an Activity/Fragment class, a @Composable, or onCreateView.
             return /\bclass\s+\w*(?:Activity|Fragment)\b|:\s*(?:ComponentActivity|AppCompatActivity|Activity|Fragment)\b|@Composable\b|\bonCreateView\b/.test(c);
         });
         if (activitySetup) {
@@ -247,14 +248,11 @@ async function validateAndroid(root) {
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding("android.push.unregister.present", "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens on logout or user switch so notifications are not sent to the wrong user."));
     }
-    // Android push payload: if onMessageReceived exists, require push-specific SDK forwarding
-    // Nexus gate (see iOS): a generic FCM handler with no social.plus push registration is the host
-    // app's own push, not a social.plus forwarding gap — require social.plus push registration first.
     const androidPayloadFiles = filesMatching(sourceContent, [/onMessageReceived/, /FirebaseMessagingService/]);
     if (androidPayloadFiles.length > 0 && pushRegistrationFiles.length > 0 && !containsAny(sourceContent, [/AmityPush/, /handlePushNotification/, /didReceiveAmityNotification/, /EkoPushNotification/, /amityPushMessaging/, /registerDeviceForPush/, /handleAmityPush/])) {
         findings.push(finding("android.push.payload-contract-respected", "warning", "Push payload handler (onMessageReceived) exists but no social.plus push forwarding call was detected.", relativeFile(root, androidPayloadFiles[0]), "Forward incoming FCM payloads to the social.plus SDK push handler (e.g. AmityPush.handleNotification) so social notifications are routed correctly."));
     }
-    if (liveDataFiles.length > 0 && !containsAny(sourceContent, [/dispose\s*\(/, /Disposable/, /CompositeDisposable/, /clear\s*\(/, /removeObserver/, /unsubscribe/])) {
+    if (liveDataFiles.length > 0 && !containsAnyStripped(sourceContent, "android", [/\.dispose\s*\(/, /\bdispose\s*\(\s*\)/, /\.clear\s*\(/, /\bremoveObserver\b/, /\bunsubscribe\b/, /\.cancel\s*\(/])) {
         findings.push(finding("android.live.cleanup", "warning", "Live Object/Collection observation was found but no obvious cleanup was detected.", relativeFile(root, liveDataFiles[0]), "Dispose or unsubscribe observers when the Activity, Fragment, ViewModel, or composable lifecycle ends."));
     }
     findings.push(...validateLiteralGuardrails(root, "android", sourceContent));
@@ -268,6 +266,15 @@ async function validateAndroid(root) {
     findings.push(...validateComments(root, "android", sourceContent));
     findings.push(...validateModeration(root, "android", sourceContent));
     findings.push(...validateLiveCollectionApiMismatch(root, "android", sourceContent));
+    findings.push(...validateStories(root, "android", sourceContent));
+    findings.push(...validateSearch(root, "android", sourceContent));
+    findings.push(...validateNotificationTray(root, "android", sourceContent));
+    findings.push(...validateMembershipList(root, "android", sourceContent));
+    findings.push(...validateEvents(root, "android", sourceContent));
+    findings.push(...validateBlockedUsers(root, "android", sourceContent));
+    findings.push(...validateInvitations(root, "android", sourceContent));
+    findings.push(...validatePollVoteStatusGuard(root, "android", sourceContent));
+    findings.push(...validateFollowStatusSubscription(root, "android", sourceContent));
     findings.push(...validatePostDataTypeHandled(root, "android", sourceContent));
     findings.push(...validateAvatarFromSdk(root, "android", sourceContent));
     findings.push(...validatePollAnswerDataShape(root, "android", sourceContent));
@@ -297,6 +304,8 @@ async function validateAndroid(root) {
     findings.push(...validateChatMessageOrderExplicit(root, "android", sourceContent));
     findings.push(...validateProfileSocialCounts(root, "android", sourceContent));
     findings.push(...validateChat(root, "android", sourceContent));
+    findings.push(...validateChatDeprecations(root, "android", sourceContent));
+    findings.push(...validateLivestreamDeprecation(root, "android", sourceContent));
     findings.push(...(await validateDesignReuse(root, "android", sourceContent)));
     findings.push(...(await validateEnvSecretHygiene(root, "android", sourceContent)));
     return findings;
@@ -327,13 +336,6 @@ async function validateFlutter(root) {
         if (!containsAny(dartContent, [/WidgetsFlutterBinding\.ensureInitialized\s*\(/])) {
             findings.push(finding("flutter.binding.initialized", "warning", "SDK setup was found but WidgetsFlutterBinding.ensureInitialized was not detected.", relativeFile(root, setupFiles[0]), "Call WidgetsFlutterBinding.ensureInitialized before async SDK setup in main()."));
         }
-        // Region is configured via AmityRegion.* OR an explicit endpoint (the idiomatic Flutter
-        // forms — `httpEndpoint:` is not matched by `\bendpoint:` because of the camelCase boundary
-        // + case). The real endpoint symbols are httpEndpoint/mqttEndpoint/uploadEndpoint and the
-        // AmityRegional{Http,Mqtt}Endpoint enums (verified against the SDK surface — there is no
-        // `socketEndpoint`). NOTE: do NOT key on AmityCoreClientOption — that builder is used by
-        // EVERY setup regardless of whether a region is set, so it would silence this rule for any
-        // standard setup (a false negative).
         if (!containsAnyForFiles(dartContent, setupFiles, [/AmityEndpoint\./, /\bendpoint\s*:/, /\bregion\s*:/, /\bhttpEndpoint\s*:/i, /\bmqttEndpoint\s*:/i, /\buploadEndpoint\s*:/i, /\bAmityRegional(?:Http|Mqtt)Endpoint\b/, /\bAmityRegion\b/])) {
             findings.push(finding("flutter.setup.region", "warning", "SDK setup was found but no explicit endpoint/region marker was detected.", relativeFile(root, setupFiles[0]), "Set the endpoint/region explicitly to match the customer's social.plus console project."));
         }
@@ -347,9 +349,6 @@ async function validateFlutter(root) {
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding("flutter.push.unregister.present", "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens on logout or user switch so notifications are not sent to the wrong user."));
     }
-    // Flutter push payload: if FirebaseMessaging.onMessage/onBackgroundMessage exists, require push-specific SDK forwarding
-    // Nexus gate (see iOS): require social.plus push registration before demanding forwarding, so a
-    // host app's own FirebaseMessaging handler doesn't false-fire when push isn't a social.plus concern.
     const flutterPayloadFiles = filesMatching(dartContent, [/FirebaseMessaging\.onMessage/, /onBackgroundMessage/, /FirebaseMessaging\.instance/]);
     if (flutterPayloadFiles.length > 0 && pushRegistrationFiles.length > 0 && !containsAny(dartContent, [/AmityPush/, /handlePushNotification/, /didReceiveAmityNotification/, /EkoPushNotification/, /amityPushMessaging/, /registerDeviceForPush/, /handleAmityPush/])) {
         findings.push(finding("flutter.push.payload-contract-respected", "warning", "Push payload handler (FirebaseMessaging) exists but no social.plus push forwarding call was detected.", relativeFile(root, flutterPayloadFiles[0]), "Forward incoming Firebase push payloads to the social.plus SDK push handler (e.g. AmityPush.handleNotification) so social notifications are routed correctly."));
@@ -368,6 +367,11 @@ async function validateFlutter(root) {
     findings.push(...validateComments(root, "flutter", dartContent));
     findings.push(...validateModeration(root, "flutter", dartContent));
     findings.push(...validateLiveCollectionApiMismatch(root, "flutter", dartContent));
+    findings.push(...validateStories(root, "flutter", dartContent));
+    findings.push(...validateSearch(root, "flutter", dartContent));
+    findings.push(...validateMembershipList(root, "flutter", dartContent));
+    findings.push(...validateBlockedUsers(root, "flutter", dartContent));
+    findings.push(...validatePollVoteStatusGuard(root, "flutter", dartContent));
     findings.push(...validatePostDataTypeHandled(root, "flutter", dartContent));
     findings.push(...validateAvatarFromSdk(root, "flutter", dartContent));
     findings.push(...validatePollAnswerDataShape(root, "flutter", dartContent));
@@ -396,6 +400,7 @@ async function validateFlutter(root) {
     findings.push(...validateChatMessageOrderExplicit(root, "flutter", dartContent));
     findings.push(...validateProfileSocialCounts(root, "flutter", dartContent));
     findings.push(...validateChat(root, "flutter", dartContent));
+    findings.push(...validateChatDeprecations(root, "flutter", dartContent));
     findings.push(...(await validateDesignReuse(root, "flutter", dartContent)));
     findings.push(...(await validateEnvSecretHygiene(root, "flutter", dartContent)));
     return findings;
@@ -408,15 +413,10 @@ async function validateTypeScript(root, platform) {
     const setupFiles = filesMatching(sourceContent, [/Client\s*\.\s*createClient/, /Client\s*\.\s*create\s*\(/, /createClient\s*\(/]);
     const loginFiles = filesMatching(sourceContent, [/Client\s*\.\s*login/, /\.login\s*\(/]);
     const pushRegistrationFiles = filesMatching(sourceContent, [/registerPushNotification/, /enablePushNotification/, /PushNotification/]);
-    // Skip .d.ts declarations when checking for unregister — type stubs declare both register and
-    // unregister methods but should not suppress the "unregister missing" finding.
     const implContent = new Map([...sourceContent].filter(([f]) => !path.basename(f).endsWith('.d.ts')));
     const pushUnregisterFiles = filesMatching(implContent, [/unregisterPushNotification/, /disablePushNotification/]);
-    // Only REACTIVE subscriptions need cleanup. A one-shot `await queryPosts(...)` /
-    // `await getPost(...)` returns a Promise with nothing to unsubscribe, so bare
-    // queryPosts(/getPost( are NOT live-data markers (they'd false-fire live.cleanup on
-    // one-shot awaits — found on a weak-model build). The reactive forms below remain.
-    const liveDataFiles = filesMatching(sourceContent, [/LiveCollection/, /LiveObject/, /\.subscribe\s*\(/, /\.observe\s*\(/, /\.onData\s*\(/, /onSnapshot/]);
+    const liveDataFiles = filesMatching(sourceContent, [/LiveCollection/, /LiveObject/, /\.subscribe\s*\(/, /\.observe\s*\(/, /\.onData\s*\(/, /onSnapshot/,
+        /\bgetNotificationTrayItems\s*\(\s*\{[^{}]*\}\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/]);
     if (!packageJson) {
         findings.push(finding("typescript.package.present", "warning", "No package.json file was found.", "package.json", "Point repoPath at the TypeScript or React Native project root."));
     }
@@ -430,19 +430,6 @@ async function validateTypeScript(root, platform) {
         findings.push(finding("typescript.client.create", "warning", "No obvious TypeScript client initialization pattern was found.", undefined, "Create the social.plus client before login and before API usage."));
     }
     else {
-        // Region detection accepts three idioms:
-        //   (a) keyword-arg style:  createClient({ region: 'sg' })  /  apiRegion / apiEndpoint
-        //   (b) positional with a named variable:  const region = ...; createClient(apiKey, region)
-        //   (c) env-sourced region declared anywhere in the codebase:
-        //        process.env.<*REGION*> | <*ENDPOINT*>, including NEXT_PUBLIC_, EXPO_PUBLIC_,
-        //        VITE_ prefixes; also import.meta.env.<*REGION*> for Vite/Astro.
-        // Any one of these is sufficient evidence the integration is region-aware.
-        // `API_REGIONS` is the canonical social.plus TS SDK region enum
-        // (API_REGIONS.SG/EU/US) — its presence is definitive region evidence. The
-        // named-decl form is case-insensitive so `const REGION = API_REGIONS.SG` counts.
-        //   (d) positional region argument: createClient(API_KEY, AMITY_REGION) — a 2nd arg whose name
-        //       contains "region" (incl. an uppercase env const like AMITY_REGION). Idiom (b)'s regex only
-        //       caught a `const region` decl named exactly "region"; the positional call site was missed (RN build).
         const setupHasKeywordRegion = containsAnyForFiles(sourceContent, setupFiles, [/\bregion\s*:/, /\bapiRegion\b/, /\bapiEndpoint\b/, /\bAPI_REGIONS\b/, /createClient\s*\([^,)]+,\s*[\w.$]*[Rr]egion/i]);
         const setupHasNamedRegionDecl = containsAnyForFiles(sourceContent, setupFiles, [/\b(?:const|let)\s+(?:region|apiRegion|endpoint|apiEndpoint)\b/i]);
         const projectHasEnvRegion = containsAny(sourceContent, [/process\.env\.[A-Z0-9_]*(?:REGION|ENDPOINT)[A-Z0-9_]*/, /import\.meta\.env\.[A-Z0-9_]*(?:REGION|ENDPOINT)[A-Z0-9_]*/]);
@@ -463,11 +450,7 @@ async function validateTypeScript(root, platform) {
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding(`${platform}.push.unregister.present`, "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens when the user logs out or the component unmounts. In React/React Native, return the unregister call from useEffect: return () => { NotificationRepository.unregisterPushNotification(deviceToken).catch(() => {}); }. Also update any local registration-state you maintain. Missing unregistration means notifications continue arriving after logout, which is a privacy and UX bug."));
     }
-    // A function whose RETURN TYPE is Amity.Unsubscriber hands the cleanup contract to
-    // its caller — the idiomatic repository/store pattern. Anchored on the return-type
-    // annotation `): Unsubscriber` (not a bare mention), so a disposer captured and
-    // dropped on the floor still fires.
-    if (liveDataFiles.length > 0 && !containsAny(sourceContent, [/unsubscribe\s*\(/, /\.unsubscribe\s*\(/, /return\s*\(\s*\)\s*=>/, /return\s+unsubscribe/, /AbortController/, /cleanup/i, /\)\s*:\s*(?:Amity\.)?Unsubscriber\b/, /\)\s*:\s*\(\s*\)\s*=>\s*void\b/])) {
+    if (liveDataFiles.length > 0 && !containsAny(sourceContent, [/unsubscribe\s*\(/, /\.unsubscribe\s*\(/, /return\s*\(\s*\)\s*=>/, /return\s+unsubscribe/, /AbortController/, /\)\s*:\s*(?:Amity\.)?Unsubscriber\b/, /\)\s*:\s*\(\s*\)\s*=>\s*void\b/])) {
         findings.push(finding(`${platform}.live.cleanup`, "warning", "Live Object/Collection subscription was found but no obvious cleanup was detected.", relativeFile(root, liveDataFiles[0]), "Return or call the unsubscribe cleanup from the owning component, route, or store lifecycle."));
     }
     findings.push(...validateLiteralGuardrails(root, platform, sourceContent));
@@ -481,6 +464,14 @@ async function validateTypeScript(root, platform) {
     findings.push(...validateComments(root, platform, sourceContent));
     findings.push(...validateModeration(root, platform, sourceContent));
     findings.push(...validateLiveCollectionApiMismatch(root, platform, sourceContent));
+    findings.push(...validateStories(root, platform, sourceContent));
+    findings.push(...validateSearch(root, platform, sourceContent));
+    findings.push(...validateNotificationTray(root, platform, sourceContent));
+    findings.push(...validateMembershipList(root, platform, sourceContent));
+    findings.push(...validateEvents(root, platform, sourceContent));
+    findings.push(...validateBlockedUsers(root, platform, sourceContent));
+    findings.push(...validateInvitations(root, platform, sourceContent));
+    findings.push(...validatePollVoteStatusGuard(root, platform, sourceContent));
     findings.push(...validatePostsStatusFilter(root, platform, sourceContent));
     findings.push(...validateActivityPostsTagFilter(root, platform, sourceContent));
     findings.push(...validatePostDataTypeHandled(root, platform, sourceContent));
@@ -513,6 +504,8 @@ async function validateTypeScript(root, platform) {
     findings.push(...validateChatMessageOrderExplicit(root, platform, sourceContent));
     findings.push(...validateProfileSocialCounts(root, platform, sourceContent));
     findings.push(...validateChat(root, platform, sourceContent));
+    findings.push(...validateChatDeprecations(root, platform, sourceContent));
+    findings.push(...validateLivestreamDeprecation(root, platform, sourceContent));
     findings.push(...(await validateDesignReuse(root, platform, sourceContent)));
     if (platform === "typescript") {
         findings.push(...validateClientNoSsrInit(root, sourceContent));
@@ -525,9 +518,6 @@ async function validateEnvSecretHygiene(root, platform, sourceContent) {
     if (platform === "typescript") {
         const envSecretFiles = await committedEnvSecretFiles(root);
         if (envSecretFiles.length > 0) {
-            // Only fire when the secret-bearing env file is NOT gitignored. A gitignored local `.env` (the
-            // exact practice this rule's own recommendation endorses) won't be committed, so flagging it is
-            // a false positive — committed-env is about a `.env` that WILL be committed (no .gitignore cover).
             const gitignore = await readIfExists(path.join(root, ".gitignore"));
             if (!gitignore || !gitignoreIgnoresEnvFiles(gitignore)) {
                 for (const file of envSecretFiles) {
@@ -603,10 +593,6 @@ function validateClientNoSsrInit(root, sourceContent) {
     }
     return findings;
 }
-// Logging hygiene: customers shipping debug logs of secret-shaped values is a
-// real failure mode (console.log("client", apiKey) escapes to production).
-// Per platform we match the relevant log function calls; the secret-shaped
-// regex is shared. Returns at most one finding per scan to keep noise low.
 function validateLoggingHygiene(root, platform, sourceContent) {
     const logCallPattern = LOGGING_CALL_PATTERNS_BY_PLATFORM[platform];
     if (!logCallPattern) {
@@ -620,8 +606,6 @@ function validateLoggingHygiene(root, platform, sourceContent) {
             if (!logCallPattern.test(line)) {
                 continue;
             }
-            // Allow commented-out lines (//, #, /*); rough but kills the obvious
-            // false positives like documentation snippets.
             const trimmed = line.trimStart();
             if (trimmed.startsWith("//") || trimmed.startsWith("#") || trimmed.startsWith("*") || trimmed.startsWith("/*")) {
                 continue;
@@ -639,20 +623,11 @@ function validateLoggingHygiene(root, platform, sourceContent) {
     }
     return findings;
 }
-// Design system reuse: when the project has detected theme / token / design-
-// system files (via detectDesignSignals), at least one other source file
-// should reference one of those files by basename or class identifier.
-// Tolerant heuristic — false negatives are accepted (the agent might use a
-// theme provider context implicitly); the goal is to catch the obvious
-// "agent ignored the detected design system and wrote inline styles."
 async function validateDesignReuse(root, platform, sourceContent) {
     const designSignals = await detectDesignSignals(root);
     if (designSignals.length === 0) {
         return [];
     }
-    // Build reference markers per design file. For each design file we look for
-    // its basename (without extension) AND its PascalCase identifier guess. A
-    // source file that imports / mentions any marker counts as a reference.
     const markersByFile = [];
     for (const signal of designSignals) {
         const base = path.basename(signal.file).replace(/\.(ts|tsx|js|jsx|dart|kt|java|swift|xml|css)$/i, "");
@@ -663,14 +638,7 @@ async function validateDesignReuse(root, platform, sourceContent) {
         }
         markersByFile.push({ file: signal.file, markers: [...markers] });
     }
-    // Resolve design file absolute paths so we can skip them when scanning.
     const designAbsolutePaths = new Set(designSignals.map((signal) => path.resolve(root, signal.file)));
-    // Implicit theme-provider reuse patterns. Idiomatic UI on most platforms
-    // pulls tokens from an ambient theme context (Theme.of in Flutter, useTheme
-    // in MUI/Chakra, MaterialTheme.colorScheme in Compose, UIColor.systemBlue
-    // dynamic colors in iOS). These reuse the design system without importing
-    // the file that declared the theme — the cross-file marker heuristic misses
-    // them. Per-platform list of additional positive signals:
     const IMPLICIT_THEME_MARKERS_BY_PLATFORM = {
         flutter: [
             /Theme\.of\s*\(\s*context\s*\)/,
@@ -678,7 +646,6 @@ async function validateDesignReuse(root, platform, sourceContent) {
             /MediaQuery\.of\s*\(\s*context\s*\)/,
             /\bcolorScheme\s*\./,
             /\btextTheme\s*\./,
-            // Material 3 widget references — strong signal of design-system reuse.
             /\b(Card|ElevatedButton|FilledButton|OutlinedButton|TextButton|IconButton|Scaffold|AppBar|FloatingActionButton|ListTile|Chip|NavigationBar|NavigationRail)\s*\(/,
         ],
         android: [
@@ -711,11 +678,8 @@ async function validateDesignReuse(root, platform, sourceContent) {
         if (designAbsolutePaths.has(file)) {
             continue;
         }
-        // Phase 4: For AST-supported languages, check against comment-stripped
-        // content to avoid false passes from references only in comments.
         const astLang = astLanguageForFile(file, platform);
         const checkContent = astLang ? stripComments(astLang, content) : content;
-        // (a) Explicit reuse — cross-file basename / PascalCase reference.
         for (const { markers } of markersByFile) {
             for (const marker of markers) {
                 if (!marker || marker.length < 3) {
@@ -726,7 +690,6 @@ async function validateDesignReuse(root, platform, sourceContent) {
                 }
             }
         }
-        // (b) Implicit reuse — ambient theme-provider API or design-system widget.
         if (implicitMarkers.some((re) => re.test(checkContent))) {
             return [];
         }
@@ -742,11 +705,6 @@ function toPascalCase(snakeOrKebab) {
         .map((part) => part.charAt(0).toUpperCase() + part.slice(1))
         .join("");
 }
-// Feed UI states: when a source file observes a live data stream/collection,
-// it should also render loading / empty / error states. The heuristic is
-// per-platform: detect a live-data observation pattern in a file, then check
-// that file for at least one state marker. Returns at most one finding to
-// keep noise low.
 function validateFeedUiStates(root, platform, sourceContent) {
     const observationPatterns = LIVE_DATA_OBSERVATION_PATTERNS_BY_PLATFORM[platform];
     const statePatterns = UI_STATE_PATTERNS_BY_PLATFORM[platform];
@@ -761,10 +719,7 @@ function validateFeedUiStates(root, platform, sourceContent) {
         if (!observes) {
             continue;
         }
-        // Phase 4: For AST-supported languages, check state patterns against
-        // comment-stripped content to avoid false passes from comment text.
-        const astLang = astLanguageForFile(file, platform);
-        const checkContent = astLang ? stripComments(astLang, content) : content;
+        const checkContent = blankDeadDeclarations(commentStripped(file, platform, content), "(?:isLoading|loading|error|empty|isEmpty)");
         const hasStates = statePatterns.some((pattern) => pattern.test(checkContent));
         if (hasStates) {
             continue;
@@ -779,10 +734,7 @@ const LIVE_DATA_OBSERVATION_PATTERNS_BY_PLATFORM = {
     typescript: [/PostRepository\.getPosts/, /\.subscribe\s*\(/, /\.observe\s*\(/, /onSnapshot/],
     "react-native": [/PostRepository\.getPosts/, /\.subscribe\s*\(/, /\.observe\s*\(/, /onSnapshot/],
     flutter: [/\.listen\s*\(/, /StreamSubscription/, /getStreamController\s*\(/, /AmityCollection/, /AmityObject/],
-    // Kotlin uses trailing lambdas — `.observe { ... }` is more common than
-    // `.observe(...)`. Match either form.
     android: [/LiveCollection/, /LiveObject/, /\.observe\s*[({]/, /\.subscribe\s*[({]/, /\.collectAsState\b/, /AmitySocialClient\.newPostRepository/, /AmityCollection/],
-    // Swift trailing-closure form: `.observe { snapshot in ... }`.
     ios: [/AmityCollection/, /AmityObject/, /\.observe\s*[({]/, /getPosts\s*\(/, /queryPosts\s*\(/],
 };
 const UI_STATE_PATTERNS_BY_PLATFORM = {
@@ -817,14 +769,12 @@ function validateFeedPagination(root, platform, sourceContent) {
         if (!hasFeed) {
             continue;
         }
-        // Check all source files for pagination markers (may be in a separate hook/util)
         const astLang = astLanguageForFile(file, platform);
         const checkContent = astLang ? stripComments(astLang, content) : content;
         const hasPagination = paginationPatterns.some((pattern) => pattern.test(checkContent));
         if (hasPagination) {
             return [];
         }
-        // Also check sibling files for pagination markers
         for (const [otherFile, otherContent] of sourceContent) {
             if (otherFile === file)
                 continue;
@@ -861,7 +811,6 @@ function validateFeedModerationAffordance(root, platform, sourceContent) {
     if (!hasFeedFile) {
         return [];
     }
-    // Check all source files for any moderation marker (may be in a separate module)
     for (const [file, content] of sourceContent) {
         const astLang = astLanguageForFile(file, platform);
         const checkContent = astLang ? stripComments(astLang, content) : content;
@@ -873,11 +822,7 @@ function validateFeedModerationAffordance(root, platform, sourceContent) {
         finding(`${platform}.feed.moderation-affordance-present`, "warning", "A feed/posts UI is present but no moderation affordance (report, block, mute, hide) was detected.", undefined, "Add at least one user-visible moderation action (report, block, mute, or hide) to the feed UI or a sibling module. Attest if moderation is centralized elsewhere."),
     ];
 }
-// ─── Logout on user-switch ───────────────────────────────────────────────────
 const USER_SWITCH_SYMBOLS = [
-    // setActiveUser is the real SDK user-switch. `setCurrentUser`/`setUser` were REMOVED — they collide
-    // with ubiquitous React useState setters (`const [u, setCurrentUser] = useState(...)`) and false-fired
-    // logout-on-user-switch on an RN feed screen that merely READ the active user into state.
     /switchUser/i, /setActiveUser/i, /authStateChanged/i, /onAuthStateChanged/i,
     /logoutAndLogin/i, /signInAs/i, /changeUser/i,
 ];
@@ -898,21 +843,18 @@ const LOGOUT_MARKERS_BY_PLATFORM = {
 function validateLogoutOnUserSwitch(root, platform, sourceContent) {
     const loginPatterns = LOGIN_PATTERNS_BY_PLATFORM[platform] ?? LOGIN_PATTERNS_BY_PLATFORM.typescript;
     const logoutMarkers = LOGOUT_MARKERS_BY_PLATFORM[platform] ?? LOGOUT_MARKERS_BY_PLATFORM.typescript;
-    // Check: does the project have login AND user-switch symbols?
     const loginFiles = filesMatching(sourceContent, loginPatterns);
     if (loginFiles.length === 0)
         return [];
     const switchFiles = filesMatching(sourceContent, USER_SWITCH_SYMBOLS);
     if (switchFiles.length === 0)
         return [];
-    // Require a logout marker somewhere in the source
     if (containsAny(sourceContent, logoutMarkers))
         return [];
     return [
         finding(`${platform}.auth.logout-on-user-switch`, "warning", "User-switch pattern detected with social.plus login, but no logout/disconnect call was found. Switching users without logout can leak state across identities.", relativeFile(root, switchFiles[0]), "Call logout or disconnect on the current session before logging in as a different user. Preserve the existing sessionHandler or renewal wiring on the subsequent login call, and attest only if a centralized auth coordinator owns the switch flow."),
     ];
 }
-// ─── No anonymous write ──────────────────────────────────────────────────────
 const WRITE_CALL_PATTERNS = [
     /createPost\s*\(/, /createComment\s*\(/, /sendMessage\s*\(/,
     /createStory\s*\(/, /addReaction\s*\(/, /\.react\s*\(/,
@@ -920,13 +862,8 @@ const WRITE_CALL_PATTERNS = [
     /\.createPost\s*\(/, /\.createComment\s*\(/, /\.sendMessage\s*\(/,
 ];
 const AUTH_GATE_MARKERS = [
-    // `currentUser` prefix, NOT \bcurrentUser\b — a write gated on `currentUserId` (the
-    // session-derived user id, idiomatically passed into a component) is a valid
-    // anonymous-write guard, and \b after "currentUser" would not match "currentUserId".
     /\bcurrentUser\w*/, /\bisAuthenticated\b/, /\brequireAuth\b/,
-    /\bsession\b/, /\bisLoggedIn\b/, /\bauthState\b/,
-    // \w* not \b: `getCurrentUserId()` (the session-derived id used to gate writes) must match —
-    // the trailing \b would stop at "getCurrentUser" and miss the camelCase suffix (recurring pattern).
+    /\bsession\b/, /\bis(?:User)?LoggedIn\b/, /\bauthState\b/,
     /\bgetCurrentUser\w*/, /\bgetAccessToken\b/, /\baccessToken\b/,
     /\bauthGuard\b/, /\bwithAuth\b/, /\bProtectedRoute\b/, /\bAuthProvider\b/,
 ];
@@ -934,19 +871,17 @@ function validateNoAnonymousWrite(root, platform, sourceContent) {
     const writeFiles = filesMatching(sourceContent, WRITE_CALL_PATTERNS);
     if (writeFiles.length === 0)
         return [];
-    // For each file with write calls, check if it has auth gate markers
     for (const filePath of writeFiles) {
         const content = sourceContent.get(filePath) ?? "";
         const astLang = astLanguageForFile(filePath, platform);
-        const checkContent = astLang ? stripComments(astLang, content) : content;
-        if (AUTH_GATE_MARKERS.some((p) => p.test(checkContent)))
+        const authSurface = blankDeadDeclarations(astLang ? stripComments(astLang, content) : content, "currentUser\\w*");
+        if (AUTH_GATE_MARKERS.some((p) => p.test(authSurface)))
             return [];
     }
     return [
         finding(`${platform}.auth.no-anonymous-write`, "warning", "Write operations (createPost, sendMessage, etc.) found but no auth gate or user-session check was detected in the same file.", relativeFile(root, writeFiles[0]), "Ensure write operations are only reachable after authentication. Check currentUser, session, or isAuthenticated before calling create/send methods."),
     ];
 }
-// ─── Network error handling ──────────────────────────────────────────────────
 const SDK_CALL_PATTERNS = [
     /\.login\s*\(/, /\.setup\s*\(/, /createPost\s*\(/,
     /createComment\s*\(/, /sendMessage\s*\(/, /createStory\s*\(/,
@@ -956,15 +891,6 @@ const SDK_CALL_PATTERNS = [
 const ERROR_HANDLING_MARKERS_BY_PLATFORM = {
     android: [/try\s*\{/, /runCatching/, /\.onFailure/, /CoroutineExceptionHandler/, /\.catch\s*\{/],
     flutter: [/try\s*\{/, /\.catchError\s*\(/, /\.onError\s*\(/, /\.handleError/, /catch\s*\(/],
-    // TypeScript / React: in addition to imperative try/catch and Promise.catch,
-    // recognize React's idiomatic error-state pattern:
-    //   - setError(...) state setter
-    //   - useState<Error...> or useState<...Error> (error-typed state)
-    //   - ErrorBoundary component reference (React error boundary)
-    //   - error.tsx co-located file (Next.js App Router convention)
-    //   - destructured error from a callback's response object: ({ error }) or (error: foo)
-    // These are the canonical patterns the social.plus TS SDK's Live Collection
-    // callbacks use; flagging them would force attestation on idiomatic code.
     typescript: [/try\s*\{/, /\.catch\s*\(/, /\.then\s*\([^)]*,[^)]*\)/, /catchError/, /onError/, /setError\s*\(/, /useState\s*<[^>]*[Ee]rror/, /ErrorBoundary/, /error\.tsx\b/, /\berror\s*:\s*\w+\s*[,})]/],
     "react-native": [/try\s*\{/, /\.catch\s*\(/, /\.then\s*\([^)]*,[^)]*\)/, /catchError/, /onError/, /setError\s*\(/, /useState\s*<[^>]*[Ee]rror/, /ErrorBoundary/, /\berror\s*:\s*\w+\s*[,})]/],
     ios: [/do\s*\{/, /try\s+/, /try\?/, /catch\s*\{/, /\.failure\s*\(/, /Result\s*</, /completion.*Error/],
@@ -974,14 +900,12 @@ function validateErrorHandling(root, platform, sourceContent) {
     if (sdkCallFiles.length === 0)
         return [];
     const errorMarkers = ERROR_HANDLING_MARKERS_BY_PLATFORM[platform] ?? ERROR_HANDLING_MARKERS_BY_PLATFORM.typescript;
-    // Check if ANY source file has error handling markers
     if (containsAny(sourceContent, errorMarkers))
         return [];
     return [
         finding(`${platform}.network.error-handling-present`, "warning", "SDK calls found but no error handling (try/catch, .catch, Result) was detected. Unhandled network errors produce broken UX or crashes.", relativeFile(root, sdkCallFiles[0]), "Wrap SDK calls in try/catch or attach .catch() handlers. Attest if error handling is centralized in a middleware layer."),
     ];
 }
-// ─── Comments validation ─────────────────────────────────────────────────────
 const COMMENT_PRESENCE_PATTERNS = [
     /createComment\s*\(/, /getComments\s*\(/, /commentRepository/i,
     /CommentRepository/, /AmityCommentRepository/, /commentCollection/i,
@@ -995,15 +919,16 @@ const COMMENT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM = {
     ios: [/\.invalidate\s*\(/, /AmityNotificationToken/, /deinit/, /viewWillDisappear/],
 };
 const COMMENT_UI_STATE_MARKERS = [
-    /loading/i, /empty/i, /error/i, /isLoading/, /isEmpty/, /hasError/,
+    /isLoading/, /isEmpty/, /hasError/, /isError\b/, /isFetching/, /isPending/,
     /\.loading\b/, /\.empty\b/, /\.error\b/, /LoadingState/, /emptyState/i,
+    /\bloading\s*[?:&]/i, /\berror\s*[?:&]/i, /\bempty\s*[?:&]/i, /No comments/i,
+    /\.status\s*===?\s*["']?(?:loading|error|empty)/i,
 ];
 function validateComments(root, platform, sourceContent) {
     const findings = [];
     const commentFiles = filesMatching(sourceContent, COMMENT_PRESENCE_PATTERNS);
     if (commentFiles.length === 0)
         return findings;
-    // target-resolved: check for hardcoded postId/commentId in comment files
     for (const filePath of commentFiles) {
         const content = sourceContent.get(filePath) ?? "";
         const hardcodedTarget = /(?:postId|commentId|referenceId)\s*[:=]\s*["'`][a-z0-9-]+["'`]/i.exec(content);
@@ -1012,12 +937,6 @@ function validateComments(root, platform, sourceContent) {
             break;
         }
     }
-    // observer-cleanup: require cleanup only for a REACTIVE comment observer. The
-    // distinguisher is `await`: a one-shot `await queryComments(...)` returns a Promise
-    // with nothing to clean up (false-fired on a weak-model build), whereas a non-awaited
-    // getComments/queryComments creates a live collection that must be disposed. Strip the
-    // awaited one-shot queries, then any remaining (bare-call, assigned, or chained) comment
-    // query is a live observer.
     const hasReactiveCommentObserver = [...sourceContent.values()].some((c) => {
         const stripped = c.replace(/\bawait\b[^\n;]*?(?:get|query)Comments\s*\(/g, "");
         return /(?:get|query)Comments\s*\(/.test(stripped)
@@ -1027,12 +946,12 @@ function validateComments(root, platform, sourceContent) {
     if (commentFiles.length > 0 && hasReactiveCommentObserver && !containsAny(sourceContent, cleanupMarkers)) {
         findings.push(finding(`${platform}.comments.observer-cleanup`, "warning", "Comment observer/subscription was found but no obvious cleanup was detected.", relativeFile(root, commentFiles[0]), "Dispose or unsubscribe comment observers when the lifecycle owner is destroyed."));
     }
-    // ui-states-present: require loading/empty/error states in the comment surface itself.
-    // Unrelated feed/auth/network state markers elsewhere in the project do not make a comment UI complete.
-    if (!containsAnyForFiles(sourceContent, commentFiles, COMMENT_UI_STATE_MARKERS)) {
+    const strippedCommentFiles = new Map();
+    for (const f of commentFiles)
+        strippedCommentFiles.set(f, commentStripped(f, platform, sourceContent.get(f) ?? ""));
+    if (!containsAnyForFiles(strippedCommentFiles, commentFiles, COMMENT_UI_STATE_MARKERS)) {
         findings.push(finding(`${platform}.comments.ui-states-present`, "warning", "Comment UI is present but no loading, empty, or error state handling was detected.", relativeFile(root, commentFiles[0]), "Handle loading, empty, and error states in the comment UI for a complete user experience."));
     }
-    // moderation-affordance-present: require moderation on comments (scoped to comment files)
     const commentOnlyContent = new Map();
     for (const f of commentFiles)
         commentOnlyContent.set(f, sourceContent.get(f) ?? "");
@@ -1041,7 +960,6 @@ function validateComments(root, platform, sourceContent) {
     }
     return findings;
 }
-// --- Moderation validators ---
 const MODERATION_PRESENCE_PATTERNS = [
     /\bAmityModerationRepository\b/,
     /\bModerationRepository\b/,
@@ -1086,31 +1004,22 @@ function validateModeration(root, platform, sourceContent) {
     const moderationFiles = filesMatching(sourceContent, MODERATION_PRESENCE_PATTERNS);
     if (moderationFiles.length === 0)
         return findings;
-    // report-flow-present: require report action
     const hasReport = containsAny(sourceContent, [/\breport\b/i, /\bflag\b/i, /\bflagContent\b/, /\breportContent\b/]);
     if (!hasReport) {
         findings.push(finding(`${platform}.moderation.report-flow-present`, "warning", "Moderation code is present but no report/flag flow was detected.", relativeFile(root, moderationFiles[0]), "Add a report action that calls the moderation API with a confirmation dialog before submission."));
     }
-    // block-or-mute-state-applied: require state rendering markers (not just the action call)
-    if (!containsAny(sourceContent, MODERATION_BLOCK_STATE_APPLIED_MARKERS)) {
+    const blockStateContent = new Map([...sourceContent].map(([f, c]) => [f, blankDeadDeclarations(c, "isBlocked")]));
+    if (!containsAny(blockStateContent, MODERATION_BLOCK_STATE_APPLIED_MARKERS)) {
         findings.push(finding(`${platform}.moderation.block-or-mute-state-applied`, "warning", "Moderation code is present but no block/mute state application was detected.", relativeFile(root, moderationFiles[0]), "After block/mute SDK call, update the UI to reflect the new state (hide content or show placeholder)."));
     }
-    // hidden-content-rendering-present: require rendering logic for hidden content
     if (!containsAny(sourceContent, MODERATION_HIDDEN_RENDERING_MARKERS)) {
         findings.push(finding(`${platform}.moderation.hidden-content-rendering-present`, "warning", "Moderation code is present but no hidden/blocked content rendering logic was detected.", relativeFile(root, moderationFiles[0]), "Add rendering logic for hidden/blocked content (placeholder, removed indicator, or blur)."));
     }
-    // confirmation-ux-present: require confirmation for destructive moderation actions
     if (!containsAny(sourceContent, MODERATION_CONFIRMATION_MARKERS)) {
         findings.push(finding(`${platform}.moderation.confirmation-ux-present`, "warning", "Destructive moderation actions found without confirmation UX.", relativeFile(root, moderationFiles[0]), "Add a confirmation step (dialog/alert/modal) before submitting destructive moderation actions."));
     }
     return findings;
 }
-// --- Chat validators ---
-// social.plus chat presence. NOTE: bare `sendMessage` is intentionally NOT here — it is not a
-// social.plus symbol (the SDK sends via createMessage; see sdk-surface), and it false-matched
-// foreign chat SDKs (e.g. Google Gemini's `chat.sendMessage`) — on the Flexify pilot smoke that
-// mis-classified a feed-only app's AI-assistant store as a chat file and fired chat.* rules.
-// Detection anchors on social.plus-specific message/channel symbols instead.
 const CHAT_PRESENCE_PATTERNS = [
     /\bcreateMessage\b/,
     /\bAmityMessageRepository\b/,
@@ -1123,7 +1032,7 @@ const CHAT_PRESENCE_PATTERNS = [
 const CHAT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM = {
     typescript: [/\bunsubscribe\b/, /\bdispose\b/, /\bremoveListener\b/, /\buseEffect\b.*\breturn\b/s],
     "react-native": [/\bunsubscribe\b/, /\bdispose\b/, /\bremoveListener\b/, /\buseEffect\b.*\breturn\b/s],
-    android: [/\bonCleared\b/, /\bonDestroy\b/, /\bdispose\b/, /\bremoveObserver\b/],
+    android: [/\bdispose\s*\(/, /\bremoveObserver\b/, /\bunsubscribe\b/, /\bcancel\s*\(/, /\bclose\s*\(/],
     flutter: [/\bdispose\b/, /\bcancel\b/, /\bclose\b/],
     ios: [/\bdeinit\b/, /\bonDisappear\b/, /\binvalidate\b/, /\bremoveObserver\b/],
 };
@@ -1132,28 +1041,18 @@ function validateChat(root, platform, sourceContent) {
     const chatFiles = filesMatching(sourceContent, CHAT_PRESENCE_PATTERNS);
     if (chatFiles.length === 0)
         return findings;
-    // channel-type-dm: createChannel with type 'community' AND userIds indicates DM intent with wrong type.
-    // Disambiguating condition: community channels do not pass userIds in createChannel (membership is
-    // managed separately). If userIds appears alongside type:'community', the intent is clearly a DM
-    // conversation but the wrong channel type was used. Do NOT fire on community channels without userIds.
     for (const filePath of chatFiles) {
         const content = sourceContent.get(filePath) ?? "";
         if (/\bcreateChannel\b/.test(content)) {
             const hasCommunityType = /createChannel[\s\S]{0,400}type\s*:\s*['"]community['"]/.test(content);
             const hasUserIds = /createChannel[\s\S]{0,400}\buserIds\b/.test(content);
             const hasConversationType = /createChannel[\s\S]{0,400}type\s*:\s*['"]conversation['"]/.test(content);
-            // Only fire on react-native/typescript where this rule is registered.
-            // Only fire when both type:'community' AND userIds are present — that combination signals
-            // DM intent. Community channel creation does not pass userIds to createChannel.
             if ((platform === "react-native" || platform === "typescript") && hasCommunityType && hasUserIds && !hasConversationType) {
                 findings.push(finding(`${platform}.chat.channel-type-dm`, "warning", "createChannel uses type 'community' with userIds, which indicates DM intent — but 'community' creates a discoverable group channel, not a private conversation.", relativeFile(root, filePath), "Use type: 'conversation' for 1-to-1 direct messages between known users. 'community' channels are discoverable group channels; passing userIds to createChannel with type:'community' does not create a private DM."));
                 break;
             }
         }
     }
-    // channel-target-resolved: check for hardcoded channelId/conversationId.
-    // Comment-stripped so a commented-out or documented channelId can't trip this
-    // no-escape (exit-2) gate.
     for (const filePath of chatFiles) {
         const content = commentStripped(filePath, platform, sourceContent.get(filePath) ?? "");
         const hardcodedChannel = /(?:channelId|conversationId|channel_id)\b[^=\n]*=\s*["'`][a-z0-9-]+["'`]/i.exec(content);
@@ -1162,12 +1061,10 @@ function validateChat(root, platform, sourceContent) {
             break;
         }
     }
-    // message-observer-cleanup: require cleanup
     const chatCleanupMarkers = CHAT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM[platform] ?? CHAT_OBSERVER_CLEANUP_MARKERS_BY_PLATFORM.typescript;
-    if (!containsAny(sourceContent, chatCleanupMarkers)) {
+    if (!containsAnyStripped(sourceContent, platform, chatCleanupMarkers)) {
         findings.push(finding(`${platform}.chat.message-observer-cleanup`, "warning", "Chat message observers were found but no obvious cleanup was detected.", relativeFile(root, chatFiles[0]), "Unsubscribe from message live collections on component unmount or view disposal."));
     }
-    // send-error-handling: require error handling around sendMessage (scoped to chat files)
     const chatFileContent = new Map();
     for (const f of chatFiles)
         chatFileContent.set(f, sourceContent.get(f) ?? "");
@@ -1183,13 +1080,72 @@ function validateChat(root, platform, sourceContent) {
     if (!hasErrorHandling) {
         findings.push(finding(`${platform}.chat.send-error-handling`, "warning", "Message send calls found without error handling.", relativeFile(root, chatFiles[0]), "Wrap sendMessage in try/catch or handle the error callback to show send failure state."));
     }
-    // moderation-affordance-present: require moderation on chat messages (scoped to chat files)
     if (!containsAny(chatFileContent, MODERATION_MARKERS)) {
         findings.push(finding(`${platform}.chat.moderation-affordance-present`, "warning", "Chat messages are user-generated content but no moderation affordance (report/block/hide) was detected.", relativeFile(root, chatFiles[0]), "Add a report/block/hide action on chat messages."));
     }
     return findings;
 }
-// ─── Session Handler Retention ────────────────────────────────────────────────
+const DEPRECATED_MARKER_SYNC_PATTERNS = [
+    /\bstartMessageReceiptSync\b/,
+    /\bstopMessageReceiptSync\b/,
+];
+const DEPRECATED_MARKER_SYNC_PLATFORMS = new Set(["typescript", "react-native", "android", "ios"]);
+const DEPRECATED_SUBCHANNEL_PATTERNS = [
+    /\bcreateSubChannel\b/,
+    /\bupdateSubChannel\b/,
+    /\bdeleteSubChannel\b/,
+    /\bAmitySubChannelQuery\b/,
+];
+const DEPRECATED_MARKER_SYNC_ESCAPE = /\/\/\s*vise:\s*receipt-sync intentional/i;
+const DEPRECATED_SUBCHANNEL_ESCAPE = /\/\/\s*vise:\s*subchannel-management intentional/i;
+function validateChatDeprecations(root, platform, sourceContent) {
+    const findings = [];
+    if (DEPRECATED_MARKER_SYNC_PLATFORMS.has(platform)) {
+        for (const [filePath, raw] of sourceContent) {
+            const content = commentStripped(filePath, platform, raw);
+            if (DEPRECATED_MARKER_SYNC_PATTERNS.some((pattern) => pattern.test(content))) {
+                if (DEPRECATED_MARKER_SYNC_ESCAPE.test(raw))
+                    continue;
+                findings.push(finding(`${platform}.chat.deprecated-marker-sync`, "warning", "Chat code uses the deprecated MarkerSyncEngine receipt sync API (startMessageReceiptSync/stopMessageReceiptSync), which is being sun-set.", relativeFile(root, filePath), "MarkerSyncEngine receipt sync is deprecated. Track read state with the channel unread count (channel.unreadCount / getTotalChannelUnread) and mark read via markRead() — the unread-count APIs stay fully supported. Add `// vise: receipt-sync intentional — <reason>` only if you are deliberately staying on the legacy API during migration."));
+                break;
+            }
+        }
+    }
+    for (const [filePath, raw] of sourceContent) {
+        const content = commentStripped(filePath, platform, raw);
+        if (DEPRECATED_SUBCHANNEL_PATTERNS.some((pattern) => pattern.test(content))) {
+            if (DEPRECATED_SUBCHANNEL_ESCAPE.test(raw))
+                continue;
+            findings.push(finding(`${platform}.chat.deprecated-subchannel`, "warning", "Chat code manually manages sub-channels (createSubChannel/updateSubChannel/deleteSubChannel), a deprecated pattern that is being sun-set.", relativeFile(root, filePath), "Manual sub-channel management is deprecated. Use the channel's default sub-channel via channel.defaultSubChannelId (channel.getDefaultSubChannelId() on Android) — you do not need to create or query sub-channels separately. Add `// vise: subchannel-management intentional — <reason>` only if a multi-sub-channel layout is deliberately required."));
+            break;
+        }
+    }
+    return findings;
+}
+const DEPRECATED_LEGACY_STREAM_PATTERNS = [
+    /\bAmityStreamRepository\b/,
+    /\bStreamRepository\b/,
+    /\bgetStreamById\b/,
+    /\bcreateLiveStreamPost\b/,
+    /\bAmityLiveStreamPostCreator\b/,
+];
+const DEPRECATED_LEGACY_STREAM_PLATFORMS = new Set(["typescript", "react-native", "android", "ios"]);
+const DEPRECATED_LEGACY_STREAM_ESCAPE = /\/\/\s*vise:\s*legacy-stream intentional/i;
+function validateLivestreamDeprecation(root, platform, sourceContent) {
+    const findings = [];
+    if (!DEPRECATED_LEGACY_STREAM_PLATFORMS.has(platform))
+        return findings;
+    for (const [filePath, raw] of sourceContent) {
+        const content = commentStripped(filePath, platform, raw);
+        if (DEPRECATED_LEGACY_STREAM_PATTERNS.some((pattern) => pattern.test(content))) {
+            if (DEPRECATED_LEGACY_STREAM_ESCAPE.test(raw))
+                continue;
+            findings.push(finding(`${platform}.livestream.deprecated-stream`, "warning", "Livestream code uses the deprecated legacy Stream API (AmityStreamRepository/StreamRepository/getStreamById/createLiveStreamPost), which is being sun-set in favour of Room-based livestreaming.", relativeFile(root, filePath), "The legacy Stream feature is deprecated. Migrate to the Room API: AmityRoomRepository/RoomRepository.getRoom(roomId) (observe the returned room live object and handle all four statuses — idle/live/ended/recorded) and createRoomPost in place of createLiveStreamPost. Add `// vise: legacy-stream intentional — <reason>` only if you are deliberately staying on legacy Stream during migration."));
+            break;
+        }
+    }
+    return findings;
+}
 const SESSION_HANDLER_PRESENCE = {
     android: [/\bAmitySessionHandler\b/, /\bSessionHandler\b/],
     flutter: [/\bAmitySessionHandler\b/, /\bSessionHandler\b/],
@@ -1228,7 +1184,7 @@ function validateLiveCollectionApiMismatch(root, platform, sourceContent) {
         /\bListView\b/,
         /\bRecyclerView\b/,
         /\bLazyColumn\b/,
-        /\bLazyRow\b/, // Jetpack Compose lists
+        /\bLazyRow\b/,
         /\bLazyVerticalGrid\b/,
         /\bLazyVerticalStaggeredGrid\b/,
         /\bForEach\b/,
@@ -1245,26 +1201,17 @@ function validateLiveCollectionApiMismatch(root, platform, sourceContent) {
         /\bonData\b/,
         /\bStreamBuilder\b/,
         /\bLiveData\b/,
-        /\bMutableLiveData\b/, // Android LiveData (modern; `\bLiveData\b` misses Mutable/Mediator forms)
+        /\bMutableLiveData\b/,
         /\bMediatorLiveData\b/,
-        /collectAsState/, // Jetpack Compose: Flow/StateFlow → State (collectAsState, collectAsStateWithLifecycle)
-        /observeAsState/, // Jetpack Compose: LiveData → State
+        /collectAsState/,
+        /observeAsState/,
         /Amity\w*Flow\b/,
         /\bPagingData\b/,
-        /LazyPagingItems/, // Paging3 Compose: getX().collectAsLazyPagingItems() in a LazyColumn — reactive
+        /LazyPagingItems/,
         /collectAsLazyPagingItems/,
-        /\.on\s*\(\s*['"]data[A-Z]/, // event-emitter SDK pattern: .on('dataUpdated', ...)
-        /\$snapshots\b/, // iOS Combine: AmityCollection.$snapshots.sink { ... }
-        /\bAmityCollection\b/, // iOS live collection type, consumed reactively (@Published / .snapshots in a List)
-        /\bLiveCollectionCallback\b/, // TS/RN live-collection callback type (Amity.LiveCollectionCallback)
-        /\bLiveObjectCallback\b/, // TS/RN live-object callback type
-        // TS/RN reactive form: getPosts(params, callback) / getComments(params, cb) — the
-        // 2-arg callback form IS the live collection (callback fires on every update). Earlier
-        // markers only knew getLiveCollection/observe and missed this idiomatic v6 form. The
-        // first arg is a flat params OBJECT or an identifier; the callback is a genuine SECOND
-        // argument — matching `{...},` (not a comma *inside* the object, which would falsely
-        // count a one-shot `queryPosts({ a, b })` as reactive).
-        /\b(?:get|query)(?:Posts|Comments|Channels|Communities|Users|Members|Reactions)\s*\(\s*(?:\{[^{}]*\}|\w+)\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/,
+        /\.on\s*\(\s*['"]data[A-Z]/,
+        /\$snapshots\b/,
+        /\b(?:get|query)(?:Posts|Comments|Channels|Communities|Users|Members|Reactions|CommunityFeed|GlobalFeed)\s*\(\s*(?:\{[^{}]*\}|\w+)\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/,
         /\/\/\s*vise:\s*one-shot query/i
     ];
     for (const [file, content] of sourceContent) {
@@ -1275,7 +1222,8 @@ function validateLiveCollectionApiMismatch(root, platform, sourceContent) {
         if (hasListQuery) {
             const hasListUI = LIST_UI_PATTERNS.some((p) => p.test(content));
             if (hasListUI) {
-                const hasReactivity = REACTIVE_MARKERS.some((p) => p.test(content));
+                const reactiveSurface = commentStripped(file, platform, content);
+                const hasReactivity = /\/\/\s*vise:\s*one-shot query/i.test(content) || REACTIVE_MARKERS.some((p) => p.test(reactiveSurface));
                 if (!hasReactivity) {
                     findings.push(finding(ruleId, "warning", `A list query (like getPosts) is present but no reactive markers (getLiveCollection, observe, onData) were found in the same file.`, rel, "Use the reactive LiveCollection API for lists so the UI updates when new items arrive. Preserve existing query options and pagination wiring (for example pageToken, hasMore/loadMore, useInfiniteQuery) while converting the list to live updates. If a one-shot query is truly intended, add comment // vise: one-shot query."));
                 }
@@ -1284,23 +1232,212 @@ function validateLiveCollectionApiMismatch(root, platform, sourceContent) {
     }
     return findings;
 }
+function validateStories(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.story.live-collection`;
+    const STORY_LIST_QUERY_PATTERNS = [
+        /\bgetActiveStoriesByTarget\b/,
+        /\bgetActiveStories\b/,
+        /\bgetStoriesByTargets\b/,
+        /\bgetStoriesByTargetIds\b/,
+        /\bgetGlobalStoryTargets\b/,
+    ];
+    const LIST_UI_PATTERNS = [
+        /\bmap\s*\(/,
+        /\bFlatList\b/,
+        /\bListView\b/,
+        /\bRecyclerView\b/,
+        /\bLazyColumn\b/,
+        /\bLazyRow\b/,
+        /\bLazyVerticalGrid\b/,
+        /\bLazyVerticalStaggeredGrid\b/,
+        /\bForEach\b/,
+        /\bList\s*\(/,
+        /\bsubmitList\b/,
+        /\btableView\b/,
+        /\bcollectionView\b/
+    ];
+    const REACTIVE_MARKERS = [
+        /\bgetLiveCollection\b/,
+        /\bobserve\b/,
+        /\bobserveOnce\b/,
+        /\blisten\b/,
+        /\bonData\b/,
+        /\bStreamBuilder\b/,
+        /\bLiveData\b/,
+        /\bMutableLiveData\b/,
+        /\bMediatorLiveData\b/,
+        /collectAsState/,
+        /observeAsState/,
+        /Amity\w*Flow\b/,
+        /\bPagingData\b/,
+        /LazyPagingItems/,
+        /collectAsLazyPagingItems/,
+        /\.on\s*\(\s*['"]data[A-Z]/,
+        /\$snapshots\b/,
+        /\bStoryLiveCollection\b/,
+        /\bget(?:ActiveStoriesByTarget|StoriesByTargets|StoriesByTargetIds|GlobalStoryTargets)\s*\(\s*(?:\{[^{}]*\}|\w+)\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/,
+        /\/\/\s*vise:\s*one-shot query/i
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        if (path.basename(file).endsWith('.d.ts'))
+            continue;
+        const hasStoryQuery = STORY_LIST_QUERY_PATTERNS.some((p) => p.test(content));
+        if (hasStoryQuery) {
+            const hasListUI = LIST_UI_PATTERNS.some((p) => p.test(content));
+            if (hasListUI) {
+                const reactiveSurface = commentStripped(file, platform, content);
+                const hasReactivity = /\/\/\s*vise:\s*one-shot query/i.test(content) || REACTIVE_MARKERS.some((p) => p.test(reactiveSurface));
+                if (!hasReactivity) {
+                    findings.push(finding(ruleId, "warning", `A story query (like getActiveStoriesByTarget) renders a list but no reactive markers (observe, onData, the (params, callback) live form, StreamBuilder, PagingData) were found in the same file.`, rel, "Render story trays from the reactive Story LiveCollection so the UI updates when stories are created, viewed, or expire. Pass the live callback (TS/RN: getActiveStoriesByTarget(params, callback)) or observe the collection (iOS .observe / Android PagingData / Flutter StreamBuilder). If a one-shot query is truly intended, add comment // vise: one-shot query."));
+                }
+            }
+        }
+    }
+    return findings;
+}
+function validateSearch(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.search.live-collection`;
+    const SEARCH_LIST_QUERY_PATTERNS = [
+        /\bsearchCommunities\b/,
+        /\bsemanticSearchCommunities\b/,
+        /\bsemanticSearchPosts\b/,
+        /\bsearchPostsByHashtag\b/,
+        /\bsearchUsers\b/,
+        /\bsearchUserByDisplayName\b/,
+        /\bsearchChannels\b/,
+    ];
+    const LIST_UI_PATTERNS = [
+        /\bmap\s*\(/,
+        /\bFlatList\b/,
+        /\bListView\b/,
+        /\bRecyclerView\b/,
+        /\bLazyColumn\b/,
+        /\bLazyRow\b/,
+        /\bLazyVerticalGrid\b/,
+        /\bLazyVerticalStaggeredGrid\b/,
+        /\bForEach\b/,
+        /\bList\s*\(/,
+        /\bsubmitList\b/,
+        /\btableView\b/,
+        /\bcollectionView\b/
+    ];
+    const REACTIVE_MARKERS = [
+        /\bgetLiveCollection\b/,
+        /\bobserve\b/,
+        /\bobserveOnce\b/,
+        /\blisten\b/,
+        /\bonData\b/,
+        /\bStreamBuilder\b/,
+        /\bLiveData\b/,
+        /\bMutableLiveData\b/,
+        /\bMediatorLiveData\b/,
+        /collectAsState/,
+        /observeAsState/,
+        /Amity\w*Flow\b/,
+        /\bPagingData\b/,
+        /LazyPagingItems/,
+        /collectAsLazyPagingItems/,
+        /\.on\s*\(\s*['"]data[A-Z]/,
+        /\$snapshots\b/,
+        /\bPagingController\b/,
+        /\bgetPagingData\b/,
+        /\b(?:search(?:Communities|Users|UserByDisplayName|PostsByHashtag|Channels)|semanticSearch(?:Communities|Posts))\s*\(\s*\{[^{}]*\}\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/,
+        /\/\/\s*vise:\s*one-shot query/i
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        if (path.basename(file).endsWith('.d.ts'))
+            continue;
+        const hasSearchQuery = SEARCH_LIST_QUERY_PATTERNS.some((p) => p.test(content));
+        if (hasSearchQuery) {
+            const hasListUI = LIST_UI_PATTERNS.some((p) => p.test(content));
+            if (hasListUI) {
+                const reactiveSurface = commentStripped(file, platform, content);
+                const hasReactivity = /\/\/\s*vise:\s*one-shot query/i.test(content) || REACTIVE_MARKERS.some((p) => p.test(reactiveSurface));
+                if (!hasReactivity) {
+                    findings.push(finding(ruleId, "warning", `A search query (like searchCommunities/searchUsers) renders a list but no reactive/paginated markers (observe, the (params, callback) live form, PagingData, PagingController) were found in the same file.`, rel, "Render search results from the reactive, paginated Search LiveCollection so the list updates and pages past the first result set. Use the live callback (TS/RN: searchX(params, callback)), observe the collection (iOS .observe / Android PagingData), or wire a PagingController (Flutter). If a one-shot, single-page search is truly intended, add comment // vise: one-shot query."));
+                }
+            }
+        }
+    }
+    return findings;
+}
+function validateNotificationTray(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.notification-tray.live-collection`;
+    const TRAY_LIST_QUERY_PATTERNS = [
+        /\bgetNotificationTrayItems\b/,
+    ];
+    const LIST_UI_PATTERNS = [
+        /\bmap\s*\(/,
+        /\bFlatList\b/,
+        /\bListView\b/,
+        /\bRecyclerView\b/,
+        /\bLazyColumn\b/,
+        /\bLazyRow\b/,
+        /\bLazyVerticalGrid\b/,
+        /\bLazyVerticalStaggeredGrid\b/,
+        /\bForEach\b/,
+        /\bList\s*\(/,
+        /\bsubmitList\b/,
+        /\btableView\b/,
+        /\bcollectionView\b/
+    ];
+    const REACTIVE_MARKERS = [
+        /\bgetLiveCollection\b/,
+        /\bobserve\b/,
+        /\bobserveOnce\b/,
+        /\blisten\b/,
+        /\bonData\b/,
+        /\bStreamBuilder\b/,
+        /\bLiveData\b/,
+        /\bMutableLiveData\b/,
+        /\bMediatorLiveData\b/,
+        /collectAsState/,
+        /observeAsState/,
+        /Amity\w*Flow\b/,
+        /\bPagingData\b/,
+        /LazyPagingItems/,
+        /collectAsLazyPagingItems/,
+        /\.on\s*\(\s*['"]data[A-Z]/,
+        /\$snapshots\b/,
+        /\bgetNotificationTrayItems\s*\(\s*\{[^{}]*\}\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/,
+        /\/\/\s*vise:\s*one-shot query/i
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        if (path.basename(file).endsWith('.d.ts'))
+            continue;
+        const hasTrayQuery = TRAY_LIST_QUERY_PATTERNS.some((p) => p.test(content));
+        if (hasTrayQuery) {
+            const hasListUI = LIST_UI_PATTERNS.some((p) => p.test(content));
+            if (hasListUI) {
+                const reactiveSurface = commentStripped(file, platform, content);
+                const hasReactivity = /\/\/\s*vise:\s*one-shot query/i.test(content) || REACTIVE_MARKERS.some((p) => p.test(reactiveSurface));
+                if (!hasReactivity) {
+                    findings.push(finding(ruleId, "warning", `A notification tray query (getNotificationTrayItems) renders a list but no reactive markers (observe, the (params, callback) live form, PagingData) were found in the same file.`, rel, "Render the notification tray from the reactive Tray LiveCollection so it updates as notifications arrive and seen-state changes. Use the live callback (TS/RN: getNotificationTrayItems(params, callback)) or observe the collection (iOS .observe / Android PagingData). If a one-shot tray snapshot is truly intended, add comment // vise: one-shot query."));
+                }
+            }
+        }
+    }
+    return findings;
+}
 function validatePostsStatusFilter(root, platform, sourceContent) {
     const findings = [];
     const ruleId = `${platform}.posts.status-filter-applied`;
     const POST_QUERY_PATTERNS = [
         /\bgetPosts\b/,
         /\bqueryPosts\b/,
-        // getCommunityFeed intentionally NOT matched: it is also a common name for a
-        // user-defined wrapper, and firing on a wrapper CALL SITE (which has no query
-        // params to filter) is a false positive. The explicit getPosts/queryPosts cover
-        // the real query path where filters are actually applied.
     ];
     const FILTER_MARKERS = [
-        /\bfeedTypes?\b/,
+        /\bfeedTypes?\s*[:(]/,
         /\bincludeDeleted\s*\(\s*false\s*\)/,
         /\bisDeleted\s*:\s*false\b/,
         /\bisFlagged\s*:\s*false\b/,
-        /\bstatuses\b/,
+        /\bstatuses\s*[:(]/,
         /\bif\s*\([^)]*isDeleted\)/,
         /\bfilter\s*\([^)]*isDeleted\)/,
         /\bif\s*\([^)]*isFlagged\)/,
@@ -1311,7 +1448,8 @@ function validatePostsStatusFilter(root, platform, sourceContent) {
         const rel = relativeFile(root, file);
         const hasPostQuery = POST_QUERY_PATTERNS.some((p) => p.test(content));
         if (hasPostQuery) {
-            const hasFilter = FILTER_MARKERS.some((p) => p.test(content));
+            const filterSurface = commentStripped(file, platform, content);
+            const hasFilter = /\/\/\s*vise:\s*moderation review feed/i.test(content) || FILTER_MARKERS.some((p) => p.test(filterSurface));
             if (!hasFilter) {
                 findings.push(finding(ruleId, "warning", `A post query (like getPosts) is present but no status filters (includeDeleted, statuses, feedType) were found.`, rel, "Unfiltered queries leak deleted or flagged posts to the feed. Apply a status filter."));
             }
@@ -1327,7 +1465,6 @@ function validateActivityPostsTagFilter(root, platform, sourceContent) {
         const filename = path.basename(file).toLowerCase();
         if (filename.endsWith('.d.ts'))
             continue;
-        // Only fire for files that are clearly activity / toast / notification hooks
         if (!/activity|toast|notification|event/.test(filename))
             continue;
         if (!/\bgetPosts\b/.test(content))
@@ -1347,16 +1484,12 @@ function validateReactionStalePostRef(root, platform, sourceContent) {
         const rel = relativeFile(root, file);
         if (path.basename(file).endsWith('.d.ts'))
             continue;
-        // Only check files that have reaction calls
         if (!/\baddReaction\b|\bremoveReaction\b/.test(content))
             continue;
-        // Only check files that use a ref (React hook — TypeScript/React Native only)
         if (!/\buseRef\b/.test(content))
             continue;
-        // Look for .current passed into the reaction call — the stale-ref pattern
         if (!/.current\b/.test(content))
             continue;
-        // If the file already reads post.postId from live state it is correct
         if (/\bpost\s*\??\.\s*postId\b/.test(content))
             continue;
         if (/\/\/\s*vise:\s*captured ref intentional/i.test(content))
@@ -1368,29 +1501,24 @@ function validateReactionStalePostRef(root, platform, sourceContent) {
 function validateFollowStatusSubscription(root, platform, sourceContent) {
     const findings = [];
     const ruleId = `${platform}.follow.status-subscription`;
+    if (platform === 'flutter')
+        return findings;
     for (const [file, content] of sourceContent) {
         const rel = relativeFile(root, file);
         if (path.basename(file).endsWith('.d.ts'))
             continue;
-        if (!/\bgetFollowStatus\b/.test(content))
-            continue;
-        // Positive markers: live object subscription or explicit escape hatch.
-        // The canonical "live" pattern is `getFollowStatus(userId, ({ data }) => ...)` —
-        // a callback that receives the live snapshot. That's also what the
-        // recommendation below suggests. If the call passes a function-style argument
-        // (arrow or function), treat it as a live subscription.
-        if (/\.on\s*\(\s*['"]dataUpdated['"]/.test(content) ||
-            /\bLiveObject\b/.test(content) ||
-            /\bobserve\s*\(/.test(content) ||
-            // `getFollowStatus(userId, callback)` — two-arg form (comma inside the
-            // first level of parens). Matches the recommended pattern whether the
-            // callback is inline `({ data }) => …` or a named reference.
-            // [^()]* keeps us inside the first level — disqualifies promise chains
-            // like `getFollowStatus(userId).then(...)` which have no comma inside.
-            /getFollowStatus\s*\([^()]*,/.test(content) ||
+        const checkContent = commentStripped(file, platform, content);
+        if (!/\bgetFollowInfo\b/.test(checkContent))
+            continue;
+        if (/\.on\s*\(\s*['"]dataUpdated['"]/.test(checkContent) ||
+            /\bobserve\s*\(/.test(checkContent) ||
+            /\bobserve\s*\{/.test(checkContent) ||
+            /\bdoOnNext\b/.test(checkContent) ||
+            /\.subscribe\s*\(/.test(checkContent) ||
+            /getFollowInfo\s*\([^()]*,/.test(checkContent) ||
             /\/\/\s*vise:\s*one-shot follow status intentional/i.test(content))
             continue;
-        findings.push(finding(ruleId, "warning", "getFollowStatus is called without a live subscription. Follow state will not update when the relationship changes.", rel, "Subscribe to the live object returned by getFollowStatus and dispose on cleanup: const unsubFollow = UserRepository.getFollowStatus(userId, ({ data }) => { if (data) setFollowStatus(data.status); }); return () => { unsubFollow(); };"));
+        findings.push(finding(ruleId, "warning", "getFollowInfo is called without a live subscription. Follow state will not update when the relationship changes.", rel, "Subscribe to the live object returned by getFollowInfo and dispose on cleanup: const unsubFollow = UserRepository.getFollowInfo(userId, ({ data }) => { if (data) setFollowStatus(data.status); }); return () => { unsubFollow(); };"));
         break;
     }
     return findings;
@@ -1398,6 +1526,8 @@ function validateFollowStatusSubscription(root, platform, sourceContent) {
 function validateMembershipUsesLiveCollection(root, platform, sourceContent) {
     const findings = [];
     const ruleId = `${platform}.membership.use-live-collection`;
+    if (platform !== 'react-native')
+        return findings;
     for (const [file, content] of sourceContent) {
         const rel = relativeFile(root, file);
         if (path.basename(file).endsWith('.d.ts'))
@@ -1405,10 +1535,313 @@ function validateMembershipUsesLiveCollection(root, platform, sourceContent) {
         if (!/\bsearchMembers\b/.test(content))
             continue;
         if (/\bgetMembers\b/.test(content))
-            continue; // already uses live collection
+            continue;
+        if (/searchMembers\s*\(\s*\{[\s\S]*?\}\s*,/.test(content))
+            continue;
         if (/\/\/\s*vise:\s*one-shot membership intentional/i.test(content))
             continue;
-        findings.push(finding(ruleId, "warning", "searchMembers is a one-shot query — it fetches membership once and will not update when members join or leave.", rel, "Replace searchMembers with CommunityRepository.Membership.getMembers({ communityId }) which returns a LiveCollection. Subscribe to dataUpdated for real-time membership changes and call dispose() for cleanup: const liveCollection = CommunityRepository.Membership.getMembers({ communityId }); liveCollection.on('dataUpdated', (members) => setMembers(members)); return () => liveCollection.dispose();"));
+        findings.push(finding(ruleId, "warning", "searchMembers is called as a one-shot Promise (no callback) — it fetches membership once and will not update when members join or leave.", rel, "Pass a callback so searchMembers subscribes to its LiveCollection (or use CommunityRepository.Membership.getMembers): const unsub = CommunityRepository.Membership.searchMembers({ communityId }, ({ data }) => setMembers(data)); return () => unsub();"));
+    }
+    return findings;
+}
+function validateMembershipList(root, platform, sourceContent) {
+    const findings = [];
+    if (platform === 'react-native')
+        return findings;
+    const ruleId = `${platform}.membership.use-live-collection`;
+    const MEMBER_LIST_QUERY_PATTERNS = [
+        /\bgetMembers\b/,
+        /\bsearchMembers\b/,
+    ];
+    const LIST_UI_PATTERNS = [
+        /\bmap\s*\(/,
+        /\bFlatList\b/,
+        /\bListView\b/,
+        /\bRecyclerView\b/,
+        /\bLazyColumn\b/,
+        /\bLazyRow\b/,
+        /\bLazyVerticalGrid\b/,
+        /\bLazyVerticalStaggeredGrid\b/,
+        /\bForEach\b/,
+        /\bList\s*\(/,
+        /\bsubmitList\b/,
+        /\btableView\b/,
+        /\bcollectionView\b/
+    ];
+    const REACTIVE_MARKERS = [
+        /\bgetLiveCollection\b/,
+        /\bobserve\b/,
+        /\bobserveOnce\b/,
+        /\blisten\b/,
+        /\bonData\b/,
+        /\bStreamBuilder\b/,
+        /\bLiveData\b/,
+        /\bMutableLiveData\b/,
+        /\bMediatorLiveData\b/,
+        /collectAsState/,
+        /observeAsState/,
+        /Amity\w*Flow\b/,
+        /\bPagingData\b/,
+        /LazyPagingItems/,
+        /collectAsLazyPagingItems/,
+        /\.on\s*\(\s*['"]data[A-Z]/,
+        /\$snapshots\b/,
+        /\bPagingController\b/,
+        /\bgetPagingData\b/,
+        /\bCommunityMemberLiveCollection\b/,
+        /\b(?:getMembers|searchMembers)\s*\(\s*\{[^{}]*\}\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/,
+        /\/\/\s*vise:\s*one-shot query/i
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        if (path.basename(file).endsWith('.d.ts'))
+            continue;
+        const hasMemberQuery = MEMBER_LIST_QUERY_PATTERNS.some((p) => p.test(content));
+        if (hasMemberQuery) {
+            const hasListUI = LIST_UI_PATTERNS.some((p) => p.test(content));
+            if (hasListUI) {
+                const reactiveSurface = commentStripped(file, platform, content);
+                const hasReactivity = /\/\/\s*vise:\s*one-shot query/i.test(content) || REACTIVE_MARKERS.some((p) => p.test(reactiveSurface));
+                if (!hasReactivity) {
+                    findings.push(finding(ruleId, "warning", `A community-member query (getMembers/searchMembers) renders a list but no reactive markers (observe, the (params, callback) live form, PagingData, PagingController) were found in the same file.`, rel, "Render the member list from the reactive member LiveCollection so the roster updates as people join, leave, or change role. Use the live callback (TS/RN: getMembers(params, callback)) or observe the collection (iOS .observe / Android PagingData / Flutter PagingController/CommunityMemberLiveCollection). If a one-shot member snapshot is truly intended, add comment // vise: one-shot query."));
+                }
+            }
+        }
+    }
+    return findings;
+}
+function validateEvents(root, platform, sourceContent) {
+    const findings = [];
+    if (platform !== 'typescript' && platform !== 'android' && platform !== 'ios')
+        return findings;
+    const ruleId = `${platform}.event.live-collection`;
+    const EVENT_LIST_QUERY_PATTERNS = [
+        /\bgetEvents\b/,
+        /\bgetRSVPs\b/,
+    ];
+    const LIST_UI_PATTERNS = [
+        /\bmap\s*\(/,
+        /\bFlatList\b/,
+        /\bListView\b/,
+        /\bRecyclerView\b/,
+        /\bLazyColumn\b/,
+        /\bLazyRow\b/,
+        /\bLazyVerticalGrid\b/,
+        /\bLazyVerticalStaggeredGrid\b/,
+        /\bForEach\b/,
+        /\bList\s*\(/,
+        /\bsubmitList\b/,
+        /\btableView\b/,
+        /\bcollectionView\b/
+    ];
+    const REACTIVE_MARKERS = [
+        /\bgetLiveCollection\b/,
+        /\bobserve\b/,
+        /\bobserveOnce\b/,
+        /\blisten\b/,
+        /\bonData\b/,
+        /\bStreamBuilder\b/,
+        /\bLiveData\b/,
+        /\bMutableLiveData\b/,
+        /\bMediatorLiveData\b/,
+        /collectAsState/,
+        /observeAsState/,
+        /Amity\w*Flow\b/,
+        /\bPagingData\b/,
+        /LazyPagingItems/,
+        /collectAsLazyPagingItems/,
+        /\.on\s*\(\s*['"]data[A-Z]/,
+        /\$snapshots\b/,
+        /\bget(?:Events|RSVPs)\s*\(\s*\{[^{}]*\}\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/,
+        /\/\/\s*vise:\s*one-shot query/i
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        if (path.basename(file).endsWith('.d.ts'))
+            continue;
+        const hasEventQuery = EVENT_LIST_QUERY_PATTERNS.some((p) => p.test(content));
+        if (hasEventQuery) {
+            const hasListUI = LIST_UI_PATTERNS.some((p) => p.test(content));
+            if (hasListUI) {
+                const reactiveSurface = commentStripped(file, platform, content);
+                const hasReactivity = /\/\/\s*vise:\s*one-shot query/i.test(content) || REACTIVE_MARKERS.some((p) => p.test(reactiveSurface));
+                if (!hasReactivity) {
+                    findings.push(finding(ruleId, "warning", `An event/RSVP query (getEvents/getRSVPs) renders a list but no reactive markers (observe, the (params, callback) live form, PagingData) were found in the same file.`, rel, "Render event calendars and attendee lists from the reactive Event/RSVP LiveCollection so rsvpCount and the roster update as people RSVP. Use the live callback (TS: getEvents(params, callback)) or observe the collection (iOS .observe / Android PagingData). If a one-shot snapshot is truly intended, add comment // vise: one-shot query."));
+                }
+            }
+        }
+    }
+    return findings;
+}
+function validateBlockedUsers(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.blocked-users.live-collection`;
+    const BLOCKED_LIST_QUERY_PATTERNS = [
+        /\bgetBlockedUsers\b/,
+    ];
+    const LIST_UI_PATTERNS = [
+        /\bmap\s*\(/,
+        /\bFlatList\b/,
+        /\bListView\b/,
+        /\bRecyclerView\b/,
+        /\bLazyColumn\b/,
+        /\bLazyRow\b/,
+        /\bLazyVerticalGrid\b/,
+        /\bLazyVerticalStaggeredGrid\b/,
+        /\bForEach\b/,
+        /\bList\s*\(/,
+        /\bsubmitList\b/,
+        /\btableView\b/,
+        /\bcollectionView\b/
+    ];
+    const REACTIVE_MARKERS = [
+        /\bgetLiveCollection\b/,
+        /\bobserve\b/,
+        /\bobserveOnce\b/,
+        /\blisten\b/,
+        /\bonData\b/,
+        /\bStreamBuilder\b/,
+        /\bLiveData\b/,
+        /\bMutableLiveData\b/,
+        /\bMediatorLiveData\b/,
+        /collectAsState/,
+        /observeAsState/,
+        /Amity\w*Flow\b/,
+        /\bPagingData\b/,
+        /LazyPagingItems/,
+        /collectAsLazyPagingItems/,
+        /\.on\s*\(\s*['"]data[A-Z]/,
+        /\$snapshots\b/,
+        /\bPagingController\b/,
+        /\bgetPagingData\b/,
+        /\bgetBlockedUsers\s*\(\s*\{[^{}]*\}\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/,
+        /\/\/\s*vise:\s*one-shot query/i
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        if (path.basename(file).endsWith('.d.ts'))
+            continue;
+        const hasBlockedQuery = BLOCKED_LIST_QUERY_PATTERNS.some((p) => p.test(content));
+        if (hasBlockedQuery) {
+            const hasListUI = LIST_UI_PATTERNS.some((p) => p.test(content));
+            if (hasListUI) {
+                const reactiveSurface = commentStripped(file, platform, content);
+                const hasReactivity = /\/\/\s*vise:\s*one-shot query/i.test(content) || REACTIVE_MARKERS.some((p) => p.test(reactiveSurface));
+                if (!hasReactivity) {
+                    findings.push(finding(ruleId, "warning", `A blocked-users query (getBlockedUsers) renders a list but no reactive markers (observe, the (params, callback) live form, PagingData, PagingController) were found in the same file.`, rel, "Render the blocked-users list from the reactive getBlockedUsers LiveCollection so it refreshes when the user blocks/unblocks. Use the live callback (TS/RN: getBlockedUsers(params, callback)) or observe the collection (iOS .observe / Android PagingData / Flutter PagingController). For a one-shot feed-filter snapshot use getAllBlockedUsers instead, or add comment // vise: one-shot query."));
+                }
+            }
+        }
+    }
+    return findings;
+}
+function validateInvitations(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.invitation.live-collection`;
+    const isNative = platform === 'android' || platform === 'ios';
+    const INVITATION_LIST_QUERY_PATTERNS = isNative
+        ? [/\bgetMyCommunityInvitations\b/, /\bgetMemberInvitations\b/]
+        : [/\bgetMyCommunityInvitations\b/];
+    const LIST_UI_PATTERNS = [
+        /\bmap\s*\(/,
+        /\bFlatList\b/,
+        /\bListView\b/,
+        /\bRecyclerView\b/,
+        /\bLazyColumn\b/,
+        /\bLazyRow\b/,
+        /\bLazyVerticalGrid\b/,
+        /\bLazyVerticalStaggeredGrid\b/,
+        /\bForEach\b/,
+        /\bList\s*\(/,
+        /\bsubmitList\b/,
+        /\btableView\b/,
+        /\bcollectionView\b/
+    ];
+    const REACTIVE_MARKERS = [
+        /\bgetLiveCollection\b/,
+        /\bobserve\b/,
+        /\bobserveOnce\b/,
+        /\blisten\b/,
+        /\bonData\b/,
+        /\bStreamBuilder\b/,
+        /\bLiveData\b/,
+        /\bMutableLiveData\b/,
+        /\bMediatorLiveData\b/,
+        /collectAsState/,
+        /observeAsState/,
+        /Amity\w*Flow\b/,
+        /\bPagingData\b/,
+        /LazyPagingItems/,
+        /collectAsLazyPagingItems/,
+        /\.on\s*\(\s*['"]data[A-Z]/,
+        /\$snapshots\b/,
+        /\bPagingController\b/,
+        /\bgetPagingData\b/,
+        /\bgetMyCommunityInvitations\s*\(\s*\{[^{}]*\}\s*,\s*(?:\w+|\([^)]*\)\s*=>|function\b|async\b)/,
+        /\/\/\s*vise:\s*one-shot query/i
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        if (path.basename(file).endsWith('.d.ts'))
+            continue;
+        const hasInvitationQuery = INVITATION_LIST_QUERY_PATTERNS.some((p) => p.test(content));
+        if (hasInvitationQuery) {
+            const hasListUI = LIST_UI_PATTERNS.some((p) => p.test(content));
+            if (hasListUI) {
+                const reactiveSurface = commentStripped(file, platform, content);
+                const hasReactivity = /\/\/\s*vise:\s*one-shot query/i.test(content) || REACTIVE_MARKERS.some((p) => p.test(reactiveSurface));
+                if (!hasReactivity) {
+                    findings.push(finding(ruleId, "warning", `A community-invitations query (getMyCommunityInvitations/getMemberInvitations) renders a list but no reactive markers (observe, the (params, callback) live form, PagingData, PagingController) were found in the same file.`, rel, "Render the invitations list from the reactive invitation LiveCollection so it refreshes as invitations arrive or change status. Use the live callback (TS/RN: getMyCommunityInvitations(params, callback)) or observe the collection (iOS .observe / Android PagingData). If a one-shot snapshot is truly intended, add comment // vise: one-shot query."));
+                }
+            }
+        }
+    }
+    return findings;
+}
+function validatePollVoteStatusGuard(root, platform, sourceContent) {
+    const findings = [];
+    const ruleId = `${platform}.poll.vote-status-guard`;
+    const VOTE_PATTERNS = [/\bvotePoll\b/, /\bvote\s*\(\s*pollId/];
+    const ANSWER_REF_PATTERNS = [/\banswers\b/, /\bgetAnswers\b/];
+    const LIST_UI_PATTERNS = [
+        /\bmap\s*\(/,
+        /\bforEach\b/,
+        /\bForEach\b/,
+        /\bLazyColumn\b/,
+        /\bLazyRow\b/,
+        /\bList\s*\(/,
+        /\bRecyclerView\b/,
+        /\bsubmitList\b/,
+        /\btableView\b/,
+        /\bcollectionView\b/,
+        /\bFlatList\b/
+    ];
+    const GUARD_PATTERNS = [
+        /\bisVoted/,
+        /\bvoteCount\b/,
+        /\bgetStatus\b/,
+        /\bPollStatus\b/,
+        /\bisClosed?\b/,
+        /\.status\b/,
+        /\bclosedAt\b/
+    ];
+    for (const [file, content] of sourceContent) {
+        const rel = relativeFile(root, file);
+        if (path.basename(file).endsWith('.d.ts'))
+            continue;
+        const surface = commentStripped(file, platform, content);
+        const hasVote = VOTE_PATTERNS.some((p) => p.test(surface));
+        if (!hasVote)
+            continue;
+        const hasAnswerUI = ANSWER_REF_PATTERNS.some((p) => p.test(surface)) && LIST_UI_PATTERNS.some((p) => p.test(surface));
+        if (!hasAnswerUI)
+            continue;
+        if (/\/\/\s*vise:\s*poll status handled/i.test(content))
+            continue;
+        const hasGuard = GUARD_PATTERNS.some((p) => p.test(surface));
+        if (!hasGuard) {
+            findings.push(finding(ruleId, "warning", `A poll vote action (votePoll/vote) renders the answers but never reads poll status, voted-state, or vote counts — users can vote on a closed poll, re-vote without feedback, and see no results.`, rel, "Gate the vote affordance on poll state and render results: check poll.status / isClosed and poll.isVoted before allowing a vote, and show answer.voteCount / answer.isVotedByUser. If poll status/voted-state is handled in another file, add comment // vise: poll status handled."));
+        }
     }
     return findings;
 }
@@ -1449,17 +1882,6 @@ function validatePaginationCursorOpaque(root, platform, sourceContent) {
 function validatePostsParentChild(root, platform, sourceContent) {
     const findings = [];
     const ruleId = `${platform}.posts.parent-child-rendered`;
-    // Direct text-field reads that signal a component is rendering the post body.
-    // Deliberately NOT a bare `post.data` — that also matches passing post.data as
-    // an argument to a content/share helper (e.g. textFromContent(post.dataType,
-    // post.data)) in a non-rendering file like an actions menu, which produced a
-    // false positive on a correctly-factored app where rendering and the actions
-    // menu live in separate files.
-    // Case-SENSITIVE on purpose: lowercase `post.data.text` is post-body rendering,
-    // but the case-insensitive form also matched Kotlin/Swift sealed-class type
-    // discriminators like `AmityComment.Data.TEXT` / `AmityMessage.Data.TEXT` —
-    // which are type checks in comment/message code, not post rendering. That
-    // produced a large false-positive cluster on real Kotlin (Android sample app).
     const POST_RENDER_PATTERNS = [
         /\.data\.text\b/,
         /\bpost\.text\b/
@@ -1469,29 +1891,19 @@ function validatePostsParentChild(root, platform, sourceContent) {
         /\.\s*childrenPosts\b/,
         /\bgetChildren\b/
     ];
-    // Child-typed media the parent-child model carries (TS/RN string dataTypes).
     const CHILD_MEDIA_TYPES = ["poll", "video", "room", "file", "audio"];
     for (const [filename, text] of sourceContent) {
         const rel = relativeFile(root, filename);
-        // Escape-hatch checked on RAW content (stripComments would delete the marker).
         if (/\/\/\s*vise:\s*child-types intentional/i.test(text))
             continue;
         const astLang = astLanguageForFile(filename, platform);
         const checkContent = astLang ? stripComments(astLang, text) : text;
         const hasPostRender = POST_RENDER_PATTERNS.some((p) => p.test(checkContent));
         const hasChildRef = CHILD_REFERENCE_PATTERNS.some((p) => p.test(checkContent));
-        // (1) Presence: renders post text but never inspects children at all.
         if (hasPostRender && !hasChildRef) {
             findings.push(finding(ruleId, "warning", `A component renders post text but does not appear to inspect post children for media.`, rel, "Amity models images and videos as child posts. A UI that only renders the parent post's text will silently drop attachments. Inspect post.children or call getChildren()."));
             continue;
         }
-        // (2) Inconsistency (TS/RN): the renderer DOES inspect children (so the
-        // parent-child model is in play) but gates some media types on the PARENT
-        // post's dataType with no matching child lookup. A feed parent is dataType
-        // 'text', so `post.dataType === 'poll'` never matches and that content
-        // silently never renders. Only fires when child handling is already
-        // present for something — which keeps false positives low (a feed with
-        // genuinely top-level posts won't be inspecting childrenPosts at all).
         if (hasChildRef && (platform === "typescript" || platform === "react-native")) {
             const missed = CHILD_MEDIA_TYPES.filter((t) => {
                 const parentGated = new RegExp(`post\\s*\\.\\s*dataType\\s*===\\s*['"\`]${t}['"\`]`).test(checkContent);
@@ -1514,14 +1926,6 @@ function validateSessionHandlerRetention(root, platform, sourceContent) {
     const goodPatterns = SESSION_HANDLER_GOOD_PATTERNS[platform] ?? SESSION_HANDLER_GOOD_PATTERNS.typescript;
     for (const file of handlerFiles) {
         const content = sourceContent.get(file) ?? "";
-        // iOS AST arm: scope-aware detection. The regex bad-pattern bridges up to 200
-        // chars from ANY `func … {` into the next `let/var … = …SessionHandler`, which
-        // false-fires on a class-scope property that merely FOLLOWS a short function
-        // (it cannot see brace depth). The AST asks the real question — is the binding
-        // function-local? — and also catches type-annotated locals
-        // (`let h: AmitySessionHandler = AppSessionHandler()`) the regex bridge missed.
-        // Same rule id / severity / message; regex stays the floor when the file can't
-        // be parsed (grammar unavailable, oversized).
         if (platform === "ios" && file.endsWith(".swift")) {
             const tree = tryParse("swift", content);
             if (tree) {
@@ -1529,11 +1933,14 @@ function validateSessionHandlerRetention(root, platform, sourceContent) {
                 if (locals.length > 0 && !containsAny(new Map([[file, content]]), goodPatterns)) {
                     return [sessionHandlerRetainedFinding(platform, relativeFile(root, file))];
                 }
-                continue; // parsed: AST verdict replaces the regex bridge for this file
+                continue;
             }
         }
         if (badPattern && badPattern.test(content)) {
-            if (containsAny(new Map([[file, content]]), goodPatterns)) {
+            const hasGood = platform === "android"
+                ? androidSessionHandlerRetained(file, content)
+                : containsAny(new Map([[file, content]]), goodPatterns);
+            if (hasGood) {
                 continue;
             }
             return [sessionHandlerRetainedFinding(platform, relativeFile(root, file))];
@@ -1541,6 +1948,20 @@ function validateSessionHandlerRetention(root, platform, sourceContent) {
     }
     return [];
 }
+function androidSessionHandlerRetained(file, content) {
+    if (/\/\/\s*vise:\s*handler retained/.test(content))
+        return true;
+    const stripped = commentStripped(file, "android", content);
+    const declRe = /private\s+(?:val|var)\s+(\w+)\s*=\s*(?:object\s*:\s*)?(?:Amity)?SessionHandler/g;
+    let match;
+    while ((match = declRe.exec(stripped)) !== null) {
+        const name = match[1];
+        const uses = stripped.match(new RegExp(`\\b${escapeRegExp(name)}\\b`, "g")) ?? [];
+        if (uses.length > 1)
+            return true;
+    }
+    return false;
+}
 function sessionHandlerRetainedFinding(platform, file) {
     return finding(`${platform}.session-handler.retained`, "warning", "Session handler appears to be declared as a function-local variable, making it eligible for garbage collection. The SDK's access token renewal callback will fail to fire, causing sessions to silently expire.", file, "Declare the session handler as a class-level property, a module-scoped variable, or retain it via a state container so it outlives the setup function. Add `// vise: handler retained` if it is explicitly assigned to a long-lived store.");
 }
@@ -1563,56 +1984,16 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
         findings.push(finding(`${platform}.feed.target.literal`, "warning", `A hardcoded feed target literal was found: ${feedTarget.name}.`, relativeFile(root, feedTarget.file), "Do not invent or hardcode communityId, targetId, feedId, or channelId. Ask the user for the target or use an existing app-owned selection/create flow."));
     }
     const inlineApiKey = firstLiteralAssignment(sourceContent, [
-        // Direct literal assignment — apiKey: "literal" or apiKey = "literal".
         /\bapiKey\b\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
         /\bapi_key\b\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
         /\bapi-key\b\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
-        // Env-fallback secret leak patterns — the literal is on the RHS of an
-        // env-lookup fallback, not directly assigned to apiKey. The v0.7 §14
-        // Antigravity benchmark surfaced this gap: Dart's
-        // `apiKey = String.fromEnvironment(KEY, defaultValue: 'literal')` and
-        // JS/TS's `apiKey: process.env.X ?? 'literal'` both shipped a hardcoded
-        // key while the original regex (which requires the literal immediately
-        // after `apiKey [:=]`) saw `String.fromEnvironment(` or `process.env.`
-        // first and missed the literal. The patterns below explicitly walk
-        // through the env-lookup wrapper to the literal default.
-        //
-        // Dart: `defaultValue:` form inside String.fromEnvironment. Uses
-        // non-greedy any-char so the regex can bridge a multi-line argument
-        // list (real Dart code commonly puts each named arg on its own line).
         /\bapi[-_]?key\b\s*[:=][\s\S]{0,200}?defaultValue\s*:\s*["'`]([^"'`]+)["'`]/i,
-        // JS/TS: process.env.X ?? 'literal' or process.env.X || 'literal'.
-        //
-        // The bridge here is `[^;,}\n]` (NOT the `[\s\S]` used by the Dart arm
-        // above) and that difference is load-bearing. A wide `[\s\S]` bridge is
-        // not statement-scoped: anchored on `apiKey`, it walks past the apiKey
-        // assignment into the NEXT statement/property and binds a DIFFERENT
-        // variable's env-fallback literal — e.g. an idiomatic
-        //   const apiKey = process.env.API_KEY
-        //   const region = process.env.REGION || 'sg'
-        // mis-reports the region default 'sg' as a hardcoded apiKey. Forbidding
-        // `;`, `,`, and `\n` in the bridge keeps it inside the apiKey assignment:
-        // `;` stops a semicolon'd next statement, `\n` stops an ASI/no-semicolon
-        // next statement, and `,` stops the next object property
-        // (`{ apiKey: env, region: env || 'sg' }`). The genuine single-expression
-        // leak `apiKey: process.env.X || 'realkey'` is still caught because
-        // nothing separates the key from its own fallback. Known residual: a real
-        // leak written with the env lookup on a line BELOW the key
-        // (`apiKey:\n  process.env.X || 'realkey'`) is missed — rare; the AST pass
-        // (resolveLiteralValue) is the structural place to catch that.
         /\bapi[-_]?key\b\s*[:=][^;,}\n]{0,200}?(?:process\.env\.[A-Z0-9_]+|import\.meta\.env\.[A-Z0-9_]+)\s*(?:\?\?|\|\|)\s*["'`]([^"'`]+)["'`]/i,
-        // Ternary fallback: `apiKey = X ? 'literal' : ...` captures the truthy
-        // branch. Same statement/property-scoped bridge as the `||`/`??` arm so a
-        // sibling property's ternary (`{ apiKey: env, region: prod ? 'sg' : 'us' }`)
-        // does not bind 'sg' to apiKey.
         /\bapi[-_]?key\b\s*[:=][^;,}\n]{0,200}?\?\s*["'`]([^"'`]+)["'`]\s*:/i,
     ], platform);
     if (inlineApiKey && !isAllowedPlaceholder(inlineApiKey.value)) {
         findings.push(finding(`${platform}.secret.inline-api-key`, "warning", "A social.plus API key appears to be hardcoded in source.", relativeFile(root, inlineApiKey.file), "Use the host app's environment/config pattern instead of committing API keys directly into source files. The literal is still committed even when wrapped in an env-fallback (e.g. `defaultValue:`, `??`, `||`, ternary)."));
     }
-    // Hardcoded user identity — every benchmark Pure MCP failure mode included
-    // `userId: "current-user"` or similar. The user identity should come from
-    // the host app's auth state, not a literal in source.
     const literalUserId = firstLiteralAssignment(sourceContent, [
         /\buserId\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
         /\buser_id\s*[:=]\s*["'`]([^"'`]+)["'`]/i,
@@ -1622,9 +2003,6 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
     if (literalUserId && !isAllowedPlaceholder(literalUserId.value)) {
         findings.push(finding(`${platform}.auth.no-literal-user-id`, "warning", `A hardcoded user identity literal was found: ${literalUserId.name}.`, relativeFile(root, literalUserId.file), "Do not hardcode a userId in source. Read the authenticated user from the host app's auth state (current session, route param, user-store hook, etc.)."));
     }
-    // AST pass — catches indirect literals via identifier resolution.
-    // Runs for TypeScript/TSX files. Covers: auth.no-literal-user-id,
-    // secret.inline-api-key, and feed.target.literal.
     if (platform === "typescript" || platform === "react-native") {
         for (const [file, content] of sourceContent) {
             if (!file.endsWith(".ts") && !file.endsWith(".tsx"))
@@ -1633,8 +2011,7 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
             const lang = file.endsWith(".tsx") ? "tsx" : "typescript";
             const tree = tryParse(lang, content);
             if (!tree)
-                continue; // oversized/unparseable file — regex passes above still apply
-            // ── auth.no-literal-user-id via .login({ userId: CONST }) ──
+                continue;
             const userIdRule = `${platform}.auth.no-literal-user-id`;
             if (!findings.some((f) => f.ruleId === userIdRule && f.file === rel)) {
                 const loginCalls = findCallExpressions(tree, /\.login\b/);
@@ -1652,17 +2029,14 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
                     }
                 }
             }
-            // ── secret.inline-api-key via createClient({ apiKey: CONST }) or createClient(CONST, ...) ──
             const secretRule = `${platform}.secret.inline-api-key`;
             if (!findings.some((f) => f.ruleId === secretRule && f.file === rel)) {
                 const createCalls = findCallExpressions(tree, /\bcreateClient\b/);
                 for (const call of createCalls) {
-                    // Object form: createClient({ apiKey: CONST })
                     const firstArg = call.args[0];
                     if (!firstArg)
                         continue;
                     let apiKeyNode = pickObjectProperty(firstArg, "apiKey");
-                    // Positional form: createClient(KEY, region)
                     if (!apiKeyNode && firstArg.type !== "object") {
                         apiKeyNode = firstArg;
                     }
@@ -1675,7 +2049,6 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
                     }
                 }
             }
-            // ── feed.target.literal via getPosts({ targetId: CONST }) or similar ──
             const feedRule = `${platform}.feed.target.literal`;
             if (!findings.some((f) => f.ruleId === feedRule && f.file === rel)) {
                 const feedCalls = findCallExpressions(tree, /\bgetPosts\b|\bgetComments\b|\bcreatePost\b/);
@@ -1699,7 +2072,6 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
             }
         }
     }
-    // AST pass for Kotlin/Android — catches indirect literals via identifier resolution.
     if (platform === "android") {
         for (const [file, content] of sourceContent) {
             if (!file.endsWith(".kt"))
@@ -1707,8 +2079,7 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
             const rel = relativeFile(root, file);
             const tree = tryParse("kotlin", content);
             if (!tree)
-                continue; // oversized/unparseable file — regex passes above still apply
-            // ── auth.no-literal-user-id via .login(CONST) ──
+                continue;
             const userIdRule = `${platform}.auth.no-literal-user-id`;
             if (!findings.some((f) => f.ruleId === userIdRule && f.file === rel)) {
                 const loginCalls = findCallExpressions(tree, /\.login$/);
@@ -1723,7 +2094,6 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
                     }
                 }
             }
-            // ── secret.inline-api-key via .setup(CONST) ──
             const secretRule = `${platform}.secret.inline-api-key`;
             if (!findings.some((f) => f.ruleId === secretRule && f.file === rel)) {
                 const setupCalls = findCallExpressions(tree, /\.setup$/);
@@ -1738,7 +2108,6 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
                     }
                 }
             }
-            // ── feed.target.literal via .targetCommunity(CONST) / .targetUser(CONST) ──
             const feedRule = `${platform}.feed.target.literal`;
             if (!findings.some((f) => f.ruleId === feedRule && f.file === rel)) {
                 const feedCalls = findCallExpressions(tree, /targetCommunity$|targetUser$|targetFeed$/);
@@ -1755,11 +2124,6 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
             }
         }
     }
-    // AST pass for Swift/iOS — catches indirect literals via identifier resolution.
-    // Swift SDK calls are label-keyed (`login(userId:…)`, `AmityClient(apiKey:…)`,
-    // `getPosts(targetType:targetId:)`), so the arms resolve the labeled argument.
-    // tryParse returns null when tree-sitter-swift is unavailable or the file is
-    // oversized — the regex passes above remain the detection floor in that case.
     if (platform === "ios") {
         for (const [file, content] of sourceContent) {
             if (!file.endsWith(".swift"))
@@ -1768,7 +2132,6 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
             const tree = tryParse("swift", content);
             if (!tree)
                 continue;
-            // ── auth.no-literal-user-id via .login(userId: CONST) ──
             const userIdRule = `${platform}.auth.no-literal-user-id`;
             if (!findings.some((f) => f.ruleId === userIdRule && f.file === rel)) {
                 for (const call of findCallExpressions(tree, /\.login$/)) {
@@ -1782,7 +2145,6 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
                     }
                 }
             }
-            // ── secret.inline-api-key via AmityClient(apiKey: CONST) / .setup(apiKey: CONST) ──
             const secretRule = `${platform}.secret.inline-api-key`;
             if (!findings.some((f) => f.ruleId === secretRule && f.file === rel)) {
                 for (const call of findCallExpressions(tree, /(?:^|\.)AmityClient$|\.setup$/)) {
@@ -1796,8 +2158,6 @@ function validateLiteralGuardrails(root, platform, sourceContent) {
                     }
                 }
             }
-            // ── feed.target.literal via any call carrying a target label (targetId:,
-            //    communityId:, channelId:, withCommunityId:, …) resolving to a literal ──
             const feedRule = `${platform}.feed.target.literal`;
             if (!findings.some((f) => f.ruleId === feedRule && f.file === rel)) {
                 outer: for (const call of findCallExpressions(tree, /\w/)) {
@@ -1927,10 +2287,6 @@ async function validateIos(root) {
     const swiftContent = await readMany(swiftFiles);
     const setupFiles = filesMatching(swiftContent, [/AmityClient\s*\(/, /AmityClient\s*\.\s*setup/]);
     const loginFiles = filesMatching(swiftContent, [/\.login\s*\(/, /client\.login\s*\(/]);
-    // social.plus push REGISTRATION only (real iOS symbol: registerPushNotification). Do NOT key
-    // on the generic APNs primitive `didRegisterForRemoteNotifications` — that is the host app's own
-    // push, present in any iOS app with notifications, and made the social.plus-push rules false-fire
-    // on brownfield apps whose social.plus integration never included push.
     const pushRegistrationFiles = filesMatching(swiftContent, [/registerPushNotification/, /enablePushNotification/]);
     const pushUnregisterFiles = filesMatching(swiftContent, [/unregisterPushNotification/, /disablePushNotification/]);
     const liveDataFiles = filesMatching(swiftContent, [/AmityCollection/, /AmityObject/, /\.observe\s*\(/, /getPost\s*\(/, /queryPosts\s*\(/]);
@@ -1950,9 +2306,6 @@ async function validateIos(root) {
         if (!containsAnyForFiles(swiftContent, setupFiles, [/\bregion\s*:/, /\.SG\b|\.EU\b|\.US\b/])) {
             findings.push(finding("ios.setup.region", "warning", "AmityClient initialization was found but no explicit region marker was detected.", relativeFile(root, setupFiles[0]), "Set the region explicitly to match the customer's social.plus console project."));
         }
-        // Setup must happen during app startup (AppDelegate.application(_:didFinishLaunchingWithOptions:),
-        // @main App.init, or a UIApplicationDelegate willFinishLaunching), not in
-        // a view/scene lifecycle method that re-runs across screens.
         const lifecycleSetup = setupFiles.find((file) => /(viewDidLoad|viewWillAppear|viewWillDisappear|viewDidAppear|viewDidDisappear|scene\s*\(_:willConnectTo)/.test(swiftContent.get(file) ?? ""));
         if (lifecycleSetup) {
             findings.push(finding("ios.setup.lifecycle", "warning", "AmityClient initialization appears inside a view or scene lifecycle method.", relativeFile(root, lifecycleSetup), "Run AmityClient setup during app process startup (AppDelegate.application(_:didFinishLaunchingWithOptions:) or @main App.init) so it does not re-initialize on screen transitions."));
@@ -1967,15 +2320,9 @@ async function validateIos(root) {
     if (pushRegistrationFiles.length > 0 && pushUnregisterFiles.length === 0) {
         findings.push(finding("ios.push.unregister.present", "warning", "Push registration was found but no obvious unregister call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Unregister device tokens on logout or user switch so notifications are not sent to the wrong user."));
     }
-    // iOS push permission: if push registration exists, require UNUserNotificationCenter.requestAuthorization
     if (pushRegistrationFiles.length > 0 && !containsAny(swiftContent, [/requestAuthorization/, /UNUserNotificationCenter/])) {
         findings.push(finding("ios.push.permission-prompt-before-register", "warning", "Push registration was found but no UNUserNotificationCenter.requestAuthorization call was detected.", relativeFile(root, pushRegistrationFiles[0]), "Request push permission from the user via UNUserNotificationCenter before registering for remote notifications."));
     }
-    // iOS push payload: if didReceiveRemoteNotification or userNotificationCenter(_:didReceive:) exists,
-    // require push-specific SDK forwarding marker.
-    // Nexus gate: only demand social.plus forwarding when social.plus push is actually set up
-    // (registration present). A host app's generic push payload handler with no social.plus push
-    // registration is not a social.plus concern (brownfield false-positive).
     const iosPayloadHandlerFiles = filesMatching(swiftContent, [/didReceiveRemoteNotification/, /userNotificationCenter\s*\(\s*_\s*,\s*didReceive/]);
     if (iosPayloadHandlerFiles.length > 0 && pushRegistrationFiles.length > 0 && !containsAny(swiftContent, [/AmityPush/, /handlePushNotification/, /didReceiveAmityNotification/, /EkoPushNotification/, /amityPushMessaging/, /registerDeviceForPush/, /handleAmityPush/])) {
         findings.push(finding("ios.push.payload-contract-respected", "warning", "Push payload handler exists but no social.plus push forwarding call was detected.", relativeFile(root, iosPayloadHandlerFiles[0]), "Forward incoming push payloads to the social.plus SDK push handler (e.g. AmityPush.handleNotification) so social notifications are routed correctly."));
@@ -1994,6 +2341,15 @@ async function validateIos(root) {
     findings.push(...validateComments(root, "ios", swiftContent));
     findings.push(...validateModeration(root, "ios", swiftContent));
     findings.push(...validateLiveCollectionApiMismatch(root, "ios", swiftContent));
+    findings.push(...validateStories(root, "ios", swiftContent));
+    findings.push(...validateSearch(root, "ios", swiftContent));
+    findings.push(...validateNotificationTray(root, "ios", swiftContent));
+    findings.push(...validateMembershipList(root, "ios", swiftContent));
+    findings.push(...validateEvents(root, "ios", swiftContent));
+    findings.push(...validateBlockedUsers(root, "ios", swiftContent));
+    findings.push(...validateInvitations(root, "ios", swiftContent));
+    findings.push(...validatePollVoteStatusGuard(root, "ios", swiftContent));
+    findings.push(...validateFollowStatusSubscription(root, "ios", swiftContent));
     findings.push(...validatePostDataTypeHandled(root, "ios", swiftContent));
     findings.push(...validateAvatarFromSdk(root, "ios", swiftContent));
     findings.push(...validatePollAnswerDataShape(root, "ios", swiftContent));
@@ -2022,6 +2378,8 @@ async function validateIos(root) {
     findings.push(...validateChatMessageOrderExplicit(root, "ios", swiftContent));
     findings.push(...validateProfileSocialCounts(root, "ios", swiftContent));
     findings.push(...validateChat(root, "ios", swiftContent));
+    findings.push(...validateChatDeprecations(root, "ios", swiftContent));
+    findings.push(...validateLivestreamDeprecation(root, "ios", swiftContent));
     findings.push(...(await validateDesignReuse(root, "ios", swiftContent)));
     findings.push(...(await validateEnvSecretHygiene(root, "ios", swiftContent)));
     return findings;
@@ -2308,6 +2666,19 @@ function containsAny(contents, patterns) {
     }
     return false;
 }
+function containsAnyStripped(contents, platform, patterns) {
+    for (const [file, content] of contents) {
+        const stripped = commentStripped(file, platform, content);
+        if (patterns.some((pattern) => pattern.test(stripped))) {
+            return true;
+        }
+    }
+    return false;
+}
+function blankDeadDeclarations(text, namePattern) {
+    const typeToken = "(?:[A-Za-z_$][\\w$]*(?:\\.[A-Za-z_$][\\w$]*)*(?:<[^>=;{}\\n]*>)?\\??\\s+)?";
+    return text.replace(new RegExp(`\\b(?:export\\s+)?(?:default\\s+)?(?:async\\s+)?(?:late\\s+)?(?:function|fun|func|const|let|var|val|final)\\s+${typeToken}${namePattern}\\b`, "g"), " ");
+}
 function escapeRegExp(value) {
     return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -2320,11 +2691,6 @@ function containsAnyForFiles(contents, files, patterns) {
 function relativeFile(root, file) {
     return file ? path.relative(root, file) : undefined;
 }
-/**
- * Map a source file path + platform to the AST Language type (if supported).
- * Returns undefined for languages without tree-sitter support (Dart — no npm
- * grammar compatible with the pinned tree-sitter 0.21 exists; see ARCHITECTURE.md).
- */
 function astLanguageForFile(filePath, platform) {
     const ext = path.extname(filePath).toLowerCase();
     if (ext === ".ts")
@@ -2335,26 +2701,14 @@ function astLanguageForFile(filePath, platform) {
         return "kotlin";
     if (ext === ".swift")
         return "swift";
-    // Platforms that use TS/TSX but file doesn't have extension — infer from platform
     if ((platform === "typescript" || platform === "react-native") && (ext === ".js" || ext === ".jsx")) {
         return "typescript";
     }
     return undefined;
 }
-// Comment-aware view of a source file for the presence-of-a-bad-literal regex
-// checks that GATE (channel-target-resolved, inline secrets, literal userId/feed
-// target). A pattern that appears only in a commented-out or documentation line
-// must not trip a gate — a hard CI failure on a comment is the worst false positive
-// a compliance gate can produce. ts/tsx/kotlin/swift use the precise tree-sitter
-// stripper; Dart (no compatible grammar published) uses the conservative scanner
-// below. Anything else is returned unchanged.
 function commentStripped(filePath, platform, content) {
     const astLang = astLanguageForFile(filePath, platform);
     if (astLang === "swift") {
-        // Swift is gate-relevant, so it must never degrade to RAW content: when the
-        // tree-sitter pass is a no-op (bindings unavailable, oversized file, or simply
-        // no comments) chain into the conservative scanner. Both strippers only ever
-        // blank comment spans, so the composition stays fail-toward-firing.
         const stripped = stripComments("swift", content);
         return stripped !== content ? stripped : stripLineAndBlockComments(content);
     }
@@ -2365,15 +2719,6 @@ function commentStripped(filePath, platform, content) {
         return stripLineAndBlockComments(content);
     return content;
 }
-// Conservative comment stripper for languages without a wired tree-sitter grammar
-// (Swift, Dart). Blanks `//` line comments and `/* */` block comments with spaces,
-// preserving newlines so offsets/line numbers are unchanged. It tracks single-line
-// string state ("…" and '…') with escape handling so a `//` inside a string or a URL
-// ("https://…") is not mistaken for a comment. Critically, it only ever blanks
-// comment spans — never code or string text — so any mis-classification degrades
-// toward a residual false-positive (a comment left un-stripped), never a silent
-// false-negative on a gate. Multi-line/raw strings are not modeled precisely, but the
-// same fail-toward-firing property holds (worst case: a comment is not stripped).
 function stripLineAndBlockComments(source) {
     const out = source.split("");
     let inString = null;
@@ -2396,8 +2741,6 @@ function stripLineAndBlockComments(source) {
             continue;
         }
         if (inString) {
-            // Escape: skip the next char — but never jump past a newline, so a stray
-            // trailing backslash can't swallow the following line of real code.
             if (c === "\\" && next !== "\n") {
                 i += 2;
                 continue;
@@ -2432,14 +2775,6 @@ function stripLineAndBlockComments(source) {
 }
 function validateCommentReferenceTypeEnum(root, platform, sourceContent) {
     const findings = [];
-    // TypeScript/React Native: the SDK types referenceType as the string-literal
-    // union Amity.CommentReferenceType ('post' | 'story' | 'content') — there is
-    // no enum to use, and `referenceType: 'post'` is the documented, idiomatic
-    // value (this ruleset's own comment-limit / creation-affordance remediation
-    // strings instruct exactly that). A wrong casing like 'POST' is not assignable
-    // to the union, so tsc already catches it. Flagging the correct string here was
-    // a pure false positive; the rule remains active on android/flutter/ios where a
-    // real AmityCommentReferenceType enum exists.
     if (platform === "typescript" || platform === "react-native")
         return findings;
     const ruleId = `${platform}.comment.reference-type-enum`;
@@ -2457,7 +2792,7 @@ function validateCommentReferenceTypeEnum(root, platform, sourceContent) {
         for (const pattern of REFERENCE_TYPE_PATTERNS) {
             if (pattern.test(text)) {
                 findings.push(finding(ruleId, "warning", `A createComment call appears to hardcode referenceType to a raw string instead of an enum.`, rel, `Comment reference types should be strongly typed using the SDK enums (e.g. AmityCommentReferenceType.POST) to prevent casing errors. If this is intentional, add comment // vise: reference-type rationale — <reason>.`));
-                break; // one per file is enough for this rule
+                break;
             }
         }
     }
@@ -2498,11 +2833,6 @@ function validateReactionConfiguredNameUsed(root, platform, sourceContent) {
         if (/\/\/\s*vise:\s*reaction\s*"[^"]+"\s*matches\s*console\s*config/i.test(text)) {
             continue;
         }
-        // The reaction NAME is the tenant-specific argument. The TS/RN SDK signature is
-        // addReaction(referenceType, referenceId, reactionName) — the first literal is the
-        // referenceType ('post'/'comment'/'message'/'story'), which is LEGITIMATELY a literal
-        // and must not be mistaken for a hardcoded reaction name. Flag only when a string
-        // literal that is NOT a known reference-type appears in the call.
         const REF_TYPE = /^(?:post|comment|message|story|community|user|channel|content)$/i;
         const reactionCallRe = /\b(?:addReaction|removeReaction|flagReaction|react)\s*\(([^)]*)\)/gi;
         let hardcodesReactionName = false;
@@ -2525,7 +2855,6 @@ function validateImagePostChildResolutionAwaited(root, platform, sourceContent)
     const ruleId = platform + '.image-post.child-resolution-awaited';
     for (const [filename, text] of sourceContent) {
         const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
-        // Look for createPost and immediate render/setState/display
         if (/createPost\s*\(/.test(text) &&
             /(?:render|setState|display)\s*\(/.test(text)) {
             const hasResolution = /whenComplete/.test(text) ||
@@ -2582,22 +2911,23 @@ function validateUnreadSubscribedNotCounted(root, platform, sourceContent) {
     let hasSubscribedStream = false;
     let firstManualCountFile = '';
     for (const [filename, text] of sourceContent) {
-        if (/\.filter\s*\(\s*[^)]*!\s*[^)]*isRead\s*[^)]*\)\s*\.\s*length/.test(text) ||
-            /\.where\s*\(\s*[^)]*!\s*[^)]*isRead\s*[^)]*\)\s*\.\s*length/.test(text) ||
-            /\.count\s*\(\s*[^)]*!\s*[^)]*\.isRead\s*\)/.test(text) ||
-            /unreadCount\s*=\s*[^;]*\bfilter\b/.test(text)) {
+        const checkContent = commentStripped(filename, platform, text);
+        if (/\.filter\s*\(\s*[^)]*!\s*[^)]*isRead\s*[^)]*\)\s*\.\s*length/.test(checkContent) ||
+            /\.where\s*\(\s*[^)]*!\s*[^)]*isRead\s*[^)]*\)\s*\.\s*length/.test(checkContent) ||
+            /\.count\s*\(\s*[^)]*!\s*[^)]*\.isRead\s*\)/.test(checkContent) ||
+            /unreadCount\s*=\s*[^;]*\bfilter\b/.test(checkContent)) {
             hasManualCount = true;
             if (!firstManualCountFile) {
                 firstManualCountFile = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
             }
         }
-        if (/AmityCoreClient\.unreadCount/.test(text) ||
-            /\.unreadCount\(\)/.test(text) ||
-            /unreadCountObservable/.test(text) ||
-            /getUnreadCount/.test(text) ||
-            /subscribeUnread/.test(text) ||
-            /unreadCount\.observe/.test(text) ||
-            /unread\.stream/.test(text) ||
+        if (/AmityCoreClient\.unreadCount/.test(checkContent) ||
+            /\.unreadCount\(\)/.test(checkContent) ||
+            /unreadCountObservable/.test(checkContent) ||
+            /getUnreadCount\s*\(/.test(checkContent) ||
+            /subscribeUnread\s*\(/.test(checkContent) ||
+            /unreadCount\.observe/.test(checkContent) ||
+            /unread\.stream/.test(checkContent) ||
             /\/\/\s*vise:\s*unread sourced from/.test(text)) {
             hasSubscribedStream = true;
         }
@@ -2620,9 +2950,10 @@ function validateNotificationsPreferencesConfigured(root, platform, sourceConten
                 firstPushRegistrationFile = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
             }
         }
-        if (/\.notifications\s*\(\s*\)\.(?:getSettings|setSettings)/.test(text) ||
-            /notificationRepository\.(?:getSettings|setSettings)/.test(text) ||
-            /\bNotificationSettings\b/.test(text) ||
+        const astLang = astLanguageForFile(filename, platform);
+        const checkContent = astLang ? stripComments(astLang, text) : text;
+        if (/\.notifications\s*\(\s*\)(?:\s*\.\s*\w+\s*\([^)]*\))*\s*\.\s*(?:getSettings|setSettings)\s*[({]/.test(checkContent) ||
+            /\b(?:notificationRepository|notificationManager)\s*\.\s*(?:getSettings|setSettings)\s*[({]/.test(checkContent) ||
             /\/\/\s*vise:\s*notification preferences synced via/.test(text)) {
             hasPreferences = true;
         }
@@ -2632,31 +2963,14 @@ function validateNotificationsPreferencesConfigured(root, platform, sourceConten
     }
     return findings;
 }
-// The ban-state / role-gated / flagCount-leak rules all flag a MISSING UI guard.
-// That claim only makes sense for files that render UI. Service and data layers —
-// repositories, managers, datasources, API clients, stores, interactors — wrap the
-// SDK call but legitimately leave the guard to the UI layer above them, so firing on
-// them is a false positive. Observed on the official Amity sample apps, where
-// PostFlagManager / StoryManager / MembershipListDataSource tripped all three rules
-// despite the guards living correctly in their View/ViewController callers.
 function isNonUiSourceFile(filename) {
     const base = path.basename(filename).replace(/\.(kt|swift|dart|tsx?|jsx?)$/i, "");
-    // PascalCase class-named files (Swift, Kotlin, TS): suffix match. Note "Controller"
-    // and "View(Model)" are deliberately absent — iOS ViewControllers/SwiftUI Views DO
-    // render and must keep firing.
     if (/(?:Application|Manager|Repository|Repo|Service|DataSource|Datasource|Provider|Client|Store|Mapper|Interactor|UseCase|Bloc|Cubit|Notifier|Mock|Fake|Stub|Test|Tests|Spec)$/.test(base))
         return true;
-    // snake_case files (Dart, sometimes RN): same non-UI layers, plus Flutter's BLoC /
-    // Cubit / ChangeNotifier state-management layers. "_page"/"_popup"/"_screen" are UI
-    // and intentionally not matched.
     if (/_(?:manager|repository|repo|service|data_source|datasource|provider|client|store|mapper|interactor|use_case|usecase|bloc|cubit|notifier|mock|fake|stub|test|spec)$/i.test(base))
         return true;
-    // Bare data-layer file names (store.ts, repository.ts, service.ts, datasource.ts, …) — the same
-    // non-UI layers as the suffix/snake forms above, just without a domain prefix. A file literally
-    // named `store` is a state-management/data layer (e.g. a Zustand/Redux store), not a screen.
     if (/^(?:store|stores|repository|repositories|repo|repos|service|services|datasource|datasources|provider|providers|client|clients|interactor|interactors|usecase|usecases|bloc|cubit|notifier|api|mapper)$/i.test(base))
         return true;
-    // dotted test/spec helpers (foo.test.ts, foo.spec.ts)
     if (/\.(?:test|spec)$/i.test(base))
         return true;
     return false;
@@ -2666,38 +2980,17 @@ function validateUserBanStateRespected(root, platform, sourceContent) {
     const ruleId = platform + '.user.ban-state-respected';
     for (const [filename, text] of sourceContent) {
         const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
-        // Skip type declaration files — they declare the method signatures but are not
-        // the implementation that needs the ban-state guard.
         if (path.basename(filename).endsWith('.d.ts'))
             continue;
-        // Skip non-UI service/data layers — the ban gate belongs in the UI that renders
-        // the interaction button, not in the manager/repository that wraps the SDK call.
         if (isNonUiSourceFile(filename))
             continue;
-        // Check if interaction methods are used in the file (includes flag actions — banned users
-        // should also not be able to flag content, preventing spurious moderation queue spam).
-        // iOS/Swift: the interaction surface is the COMMENT-STRIPPED file (tree-sitter, scanner
-        // fallback) — a `// TODO: wire createPost here` comment is not an interaction surface and
-        // used to false-fire this rule. The ban-state markers below stay on RAW text on purpose:
-        // the `// vise: ban state checked at` escape hatch lives in a comment.
         const interactionSurface = platform === "ios" && filename.endsWith(".swift") ? commentStripped(filename, platform, text) : text;
         if (!/\b(createPost|createComment|sendMessage|addReaction|flagComment|flagPost)\b/.test(interactionSurface)) {
             continue;
         }
-        // Ban-state positive markers. Accepts both member-access form
-        // (`user.isBanned`, `currentUser.isGlobalBan`) and bare-variable form
-        // (`disabled={isBanned}`, `!isBanned && ...`) — the latter is common
-        // when a hook destructures the flag and the screen consumes it directly.
-        const hasBanCheck = 
-        // Any ban-STATE boolean: isBanned, isGlobalBan, isGlobalBanned, isUserBanned,
-        // currentUser.isGlobalBan(ned). The `is` prefix anchors this to ban-state flags
-        // and excludes the banUser/bannedUserIds ACTION names. Real SDK ships both
-        // isGlobalBan and isGlobalBanned; agents commonly derive a local `isGlobalBanned`.
-        /\bis\w*Ban(?:ned)?\b/.test(text) ||
-            // camelCase boolean form: `currentUserIsBanned` / `userIsBanned` — typically the ban state
-            // fetched in a parent and passed down as a prop, then used to gate the write. The lowercase
-            // `is`-anchored marker above misses it (capital `Is`, no leading word boundary mid-identifier).
-            /\b\w*[Ii]sBanned\b/.test(text) ||
+        const banUseSurface = text.replace(/\b(?:export\s+)?(?:default\s+)?(?:async\s+)?(?:function|fun|func|const|let|var|val)\s+\w*[Bb]an\w*\b/g, " ");
+        const hasBanCheck = /\bis\w*Ban(?:ned)?\b/.test(banUseSurface) ||
+            /\b\w*[Ii]sBanned\b/.test(banUseSurface) ||
             /isCurrentUserBannedFromCommunity/.test(text) ||
             /community\.bannedUserIds\.(?:contains|includes)/i.test(text) ||
             /channel\.isMuted/.test(text) ||
@@ -2715,24 +3008,22 @@ function validateFlagCountNotLeaked(root, platform, sourceContent) {
     const ruleId = platform + '.flag-count.not-leaked-to-non-mods';
     for (const [filename, text] of sourceContent) {
         const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
-        // Non-UI service/data layers read flagCount to pass it upward; the role gate
-        // that decides whether to RENDER it lives in the UI layer, so skip them.
         if (isNonUiSourceFile(filename))
             continue;
-        // Check if flagCount is used in the file
-        if (!/\bflagCount\b/.test(text)) {
+        const stripped = commentStripped(filename, platform, text);
+        if (!/\bflagCount\b/.test(stripped)) {
             continue;
         }
-        // Role-check positive markers
-        const hasRoleCheck = /currentUser\.roles\.(?:contains|includes|some).*moderator/i.test(text) ||
-            /\.hasRole\s*\(.*moderator/i.test(text) ||
-            /community\.hasModeratorRole/.test(text) ||
-            /isCommunityModerator/.test(text) ||
-            /isModerator\s*[(=]/.test(text) ||
-            /member\.isModerator/.test(text) ||
-            /roles\.includes\s*\(.*moderator/i.test(text) ||
-            /permissions\.(?:contains|includes).*moderation/i.test(text) ||
-            /myReactions\.(?:contains|includes).*flag/i.test(text) ||
+        const roleUseSurface = blankDeadDeclarations(stripped, "(?:isModerator|isCommunityModerator)");
+        const hasRoleCheck = /currentUser\.roles\.(?:contains|includes|some).*moderator/i.test(stripped) ||
+            /\.hasRole\s*\(.*moderator/i.test(stripped) ||
+            /community\.hasModeratorRole/.test(stripped) ||
+            /\bisCommunityModerator\b/.test(roleUseSurface) ||
+            /\bisModerator\b/.test(roleUseSurface) ||
+            /member\.isModerator/.test(stripped) ||
+            /roles\.includes\s*\(.*moderator/i.test(stripped) ||
+            /permissions\.(?:contains|includes).*moderation/i.test(stripped) ||
+            /myReactions\.(?:contains|includes).*flag/i.test(stripped) ||
             /\/\/\s*vise:\s*flagCount visible only to moderators/i.test(text);
         if (!hasRoleCheck) {
             findings.push(finding(ruleId, "warning", "File " + rel + " references flagCount without a role check.", rel, "flagCount is moderator-only data. Rendering it to everyone leaks moderation signal. Ensure flagCount rendering is gated by a role check."));
@@ -2745,52 +3036,37 @@ function validateModerationRoleGatedAction(root, platform, sourceContent) {
     const ruleId = platform + '.moderation.role-gated-action';
     for (const [filename, text] of sourceContent) {
         const rel = (typeof filename === 'string' && root) ? (filename.startsWith(root) ? filename.slice(root.length).replace(/^\//, '') : filename) : filename;
-        // Skip non-UI service/data layers for BOTH branches. The ownership gate
-        // (edit/delete) is a UI concern; and on real code (Amity's MembershipListDataSource,
-        // a UITableView data source that wraps muteMembers) the mod-only ban/mute gate also
-        // belongs in the presenting ViewController, not the data layer — firing on the
-        // service reads as a false positive. The SDK enforces ban/mute server-side regardless.
         if (isNonUiSourceFile(filename))
             continue;
-        // Moderator-ONLY actions: only an admin/moderator can ban or mute members.
-        // (flagPost/flagComment/unflag are deliberately NOT here — flagging/reporting
-        // is a user-level action available to any authenticated member, so gating it
-        // on a moderator role is itself a bug.)
-        const hasModOnlyAction = /\b(banUser|unbanUser|banMembers|muteChannelMember|unmuteChannelMember|muteMembers)\b/.test(text);
-        // Delete/edit: valid for the content AUTHOR (ownership) OR a moderator/admin
-        // — per the SDK, "only post owners and admins can delete posts".
-        const hasOwnableAction = /\b(deletePost|softDeletePost|hardDeletePost|deleteComment|softDeleteComment|hardDeleteComment|editPost|updateComment)\b/.test(text);
+        const stripped = commentStripped(filename, platform, text);
+        const hasModOnlyAction = /\b(banUser|unbanUser|banMembers|muteChannelMember|unmuteChannelMember|muteMembers)\b/.test(stripped);
+        const hasOwnableAction = /\b(deletePost|softDeletePost|hardDeletePost|deleteComment|softDeleteComment|hardDeleteComment|editPost|updateComment)\b/.test(stripped);
         if (!hasModOnlyAction && !hasOwnableAction) {
             continue;
         }
-        // Moderator role markers
-        const hasRoleCheck = /currentUser\.roles\.(?:contains|includes|some).*moderator/i.test(text) ||
-            /\.hasRole\s*\(.*moderator/i.test(text) ||
-            /community\.hasModeratorRole/.test(text) ||
-            /isCommunityModerator/.test(text) ||
-            /isModerator\s*[(=]/.test(text) ||
-            /member\.isModerator/.test(text) ||
-            /roles\.includes\s*\(.*moderator/i.test(text) ||
-            /permissions\.(?:contains|includes).*moderation/i.test(text) ||
-            /\bhasPermission\s*\(/.test(text) ||
+        const roleUseSurface = blankDeadDeclarations(stripped, "(?:isModerator|isCommunityModerator)");
+        const hasRoleCheck = /currentUser\.roles\.(?:contains|includes|some).*moderator/i.test(stripped) ||
+            /\.hasRole\s*\(.*moderator/i.test(stripped) ||
+            /community\.hasModeratorRole/.test(stripped) ||
+            /\bisCommunityModerator\b/.test(roleUseSurface) ||
+            /\bisModerator\b/.test(roleUseSurface) ||
+            /member\.isModerator/.test(stripped) ||
+            /roles\.includes\s*\(.*moderator/i.test(stripped) ||
+            /permissions\.(?:contains|includes).*moderation/i.test(stripped) ||
+            /\bhasPermission\s*\(/.test(stripped) ||
             /\/\/\s*vise:\s*role check applied/i.test(text);
-        // Ownership markers (valid alternative to a role check for delete/edit).
-        const hasOwnershipCheck = /\bisAuthor\b/.test(text) ||
-            /\bisOwner\b/.test(text) ||
-            /postedUserId\s*===?=?\s*\w+/.test(text) ||
-            /\w+\s*===?=?\s*[\w.]*postedUserId\b/.test(text) ||
-            /creator\s*\??\.\s*userId\s*===?=?/.test(text) ||
-            // Ownership by comparing the entity's userId to the current user — the
-            // idiomatic Swift/Kotlin form, e.g. `comment.userId == amity.currentUserId`.
-            /\buserId\s*===?\s*[\w.]*(?:currentUser|currentUserId)\b/.test(text) ||
-            /\b(?:currentUser|currentUserId)[\w.]*\s*===?\s*[\w.]*\buserId\b/.test(text) ||
+        const hasOwnershipCheck = /\bisAuthor\b/.test(stripped) ||
+            /\bisOwner\b/.test(stripped) ||
+            /postedUserId\s*===?=?\s*\w+/.test(stripped) ||
+            /\w+\s*===?=?\s*[\w.]*postedUserId\b/.test(stripped) ||
+            /creator\s*\??\.\s*userId\s*===?=?/.test(stripped) ||
+            /\buserId\s*===?\s*[\w.]*(?:currentUser|currentUserId)\b/.test(stripped) ||
+            /\b(?:currentUser|currentUserId)[\w.]*\s*===?\s*[\w.]*\buserId\b/.test(stripped) ||
             /\/\/\s*vise:\s*owner action\b/i.test(text);
-        // Moderator-only actions require a role check.
         if (hasModOnlyAction && !hasRoleCheck) {
             findings.push(finding(ruleId, "warning", "File " + rel + " invokes a moderator-only action (ban/mute) without a role check.", rel, "Ban/mute require the moderator role and fail on the server otherwise. Gate the action behind a role check (e.g. currentUser.roles.includes('moderator'), or client.hasPermission(...))."));
         }
         else if (hasOwnableAction && !hasRoleCheck && !hasOwnershipCheck) {
-            // Delete/edit need EITHER ownership OR a moderator role.
             findings.push(finding(ruleId, "warning", "File " + rel + " deletes/edits content without an ownership or moderator-role check.", rel, "Only the content author or a moderator/admin can delete or edit a post/comment. Gate the action behind an ownership check (post.postedUserId === currentUserId) or a moderator role check. Add // vise: owner action if the author-ownership gate lives elsewhere."));
         }
     }
@@ -2808,9 +3084,6 @@ function validateCustomPostTypeDataTypeDeclared(root, platform, sourceContent) {
         if (!matches)
             continue;
         for (const match of matches) {
-            // A standard TEXT post (`data: { text: ... }`, incl. quoted keys for Dart/Swift) legitimately
-            // has no dataType — only CUSTOM data payloads need the dataType tag. Don't mistake the canonical
-            // text-post shape for a custom post (the weak-model bench build hit this with `data: { text }`).
             if (/data\s*[:=(]\s*[\{\[]\s*['"]?text['"]?\s*:/i.test(match))
                 continue;
             if (!/dataType\s*[:=\(]/i.test(match)) {
@@ -2820,11 +3093,6 @@ function validateCustomPostTypeDataTypeDeclared(root, platform, sourceContent) {
     }
     return findings;
 }
-// ── Post data-type check ──────────────────────────────────────────────────────
-// Fires when a file renders post content but only reads the text field without
-// branching on the post's data type. getGlobalFeed / getPosts return every
-// post type (image, video, file, poll, liveStream…); text-only rendering leaves
-// all non-text posts silently blank.
 function validatePostDataTypeHandled(root, platform, sourceContent) {
     const findings = [];
     const ruleId = `${platform}.feed.post-datatype-handled`;
@@ -2833,9 +3101,6 @@ function validatePostDataTypeHandled(root, platform, sourceContent) {
         "react-native": /post\s*\??\.\s*data\s*(?:as\s*\{|\.text\b|\?\.text\b)/,
         flutter: /\.getData\s*<|\bAmityTextPost\b|\bAmityPostData\b/,
         ios: /\.getData\(\)\s*as\?.*AmityPost\.Data\.TEXT|post\s*\.\s*text\b/,
-        // POST text only — a bare `.getText()` also matches a COMMENT renderer reading
-        // AmityComment.Data.TEXT (comments are text by nature), which is not a post
-        // renderer and must not trip this rule. Scope to AmityPost.Data.TEXT.
         android: /\.getData\(\)\s*as\??\s*AmityPost\.Data\.TEXT/,
     };
     const TYPE_GUARD = {
@@ -2926,19 +3191,10 @@ function validateRichPostComposerScope(root, platform, sourceContent) {
     }
     return findings;
 }
-// ── Avatar / display-identity from SDK ───────────────────────────────────────
-// Fires when a file renders community or user display identity using raw string
-// manipulation (charAt / slice on a name or raw userId) instead of the SDK-
-// provided avatar.fileUrl / avatarImage / getAvatar(). The SDK resolves the
-// avatar URL on the linked object; ignoring it shows a generated initial where
-// the user uploaded a real photo.
 function validateAvatarFromSdk(root, platform, sourceContent) {
     const findings = [];
     const ruleId = `${platform}.community.avatar-from-sdk`;
     const INITIAL_PAT = {
-        // slice(0,1) / slice(0,2) are avatar initials; slice(0,8)+ is a userId/name
-        // truncation used as a display fallback (e.g. userId.slice(0, 8)) and must
-        // NOT be flagged as a missing avatar.
         typescript: /(?:displayName|name|userId|postedUserId)\s*\??\.\s*(?:charAt\s*\(\s*0\s*\)|slice\s*\(\s*0\s*,\s*[12]\s*\))/,
         "react-native": /(?:displayName|name|userId|postedUserId)\s*\??\.\s*(?:charAt\s*\(\s*0\s*\)|slice\s*\(\s*0\s*,\s*[12]\s*\))/,
         flutter: /(?:displayName|name)\s*\??\.(?:substring\s*\(\s*0\s*,\s*1|characters\.first)/,
@@ -2960,11 +3216,12 @@ function validateAvatarFromSdk(root, platform, sourceContent) {
             continue;
         if (/\/\/\s*vise:\s*avatar fallback intentional/i.test(content))
             continue;
-        if (!CTX_PAT.test(content))
+        const checkContent = commentStripped(file, platform, content);
+        if (!CTX_PAT.test(checkContent))
             continue;
-        if (!initPat.test(content))
+        if (!initPat.test(checkContent))
             continue;
-        if (avatarPat.test(content))
+        if (avatarPat.test(checkContent))
             continue;
         findings.push(finding(ruleId, "warning", "Community or user display uses a string initial instead of the SDK-provided avatar URL.", relativeFile(root, file), "Check the avatar field before falling back to initials. For TypeScript/React Native: community.avatar?.fileUrl or user.avatar?.fileUrl. For Flutter: community.avatarImage?.getUrl(AmityImageSize.MEDIUM). For iOS: community.avatar?.fileURL. For Android: community.getAvatar()?.getUrl(). Add // vise: avatar fallback intentional if no avatar field is available in your SDK version."));
         break;
@@ -2973,13 +3230,6 @@ function validateAvatarFromSdk(root, platform, sourceContent) {
 }
 function validatePollAnswerDataShape(root, platform, sourceContent) {
     const findings = [];
-    // iOS has no poll-answer data-shape footgun: AmityPollAnswer exposes a typed
-    // `public let text: String` (and `image: AmityImageData?`) — there is no
-    // `.data` to mis-shape, and `answer.text` is the documented, correct accessor
-    // (confirmed against the SDK source; two independent agent builds both wrote
-    // it from the docs). The rule used to flag `answer.text` as wrong — a pure
-    // false positive. The TS/RN concern (`answer.data` is a string, don't read
-    // `.data.text`) doesn't translate to typed Swift. Rule de-registered for iOS.
     if (platform === "ios")
         return findings;
     const ruleId = `${platform}.feed.poll-answer-data-shape`;
@@ -3003,7 +3253,6 @@ function validatePollAnswerDataShape(root, platform, sourceContent) {
     for (const [file, content] of sourceContent) {
         if (path.basename(file).endsWith('.d.ts'))
             continue;
-        // Escape-hatch is checked on RAW content — stripComments would delete the marker.
         if (/\/\/\s*vise:\s*poll-answer-shape intentional/i.test(content))
             continue;
         const astLang = astLanguageForFile(file, platform);
@@ -3039,17 +3288,12 @@ function validateCommentsQueryHasLimit(root, platform, sourceContent) {
     const COMMENT_CTX = /referenceType\s*[:=]\s*['"]?post['"]?|\breferenceId\b|\bCommentRepository\b|\bAmityComment\b/;
     const recommendation = "Pass an explicit pageSize to the getComments params (limit is deprecated). For TypeScript/React Native: CommentRepository.getComments({ referenceId, referenceType: 'post', pageSize: 20 }, cb). For Flutter: .getLiveCollection(pageSize: 20). For iOS: AmityCommentQueryOptions(..., pageSize: 20). For Android: .pageSize(20). Add // vise: comment-limit handled if you have a deliberate reason to omit it.";
     const message = "Comment live collection called without an explicit limit/pageSize — the SDK default may use skip/limit pagination incompatible with scrollable query types, causing a runtime 500000 error.";
-    // TypeScript / React Native: AST pass — inspect the actual getComments({...})
-    // first argument and fire only when the object literal carries neither
-    // pageSize nor limit. More precise than a text scan: ignores the token
-    // appearing in comments/strings, and won't fire when params are passed as a
-    // variable we can't statically read (conservative — avoids false positives).
     if (platform === "typescript" || platform === "react-native") {
         for (const [file, content] of sourceContent) {
             if (path.basename(file).endsWith('.d.ts'))
                 continue;
             if (/\/\/\s*vise:\s*comment-limit handled/i.test(content))
-                continue; // escape on RAW content
+                continue;
             const astLang = astLanguageForFile(file, platform);
             if (!astLang)
                 continue;
@@ -3064,7 +3308,7 @@ function validateCommentsQueryHasLimit(root, platform, sourceContent) {
             for (const call of calls) {
                 const objArg = call.args[0];
                 if (!objArg || objArg.type !== "object")
-                    continue; // params not a literal → can't analyze, skip
+                    continue;
                 if (pickObjectProperty(objArg, "pageSize") || pickObjectProperty(objArg, "limit"))
                     continue;
                 findings.push(finding(ruleId, "warning", message, relativeFile(root, file), recommendation));
@@ -3073,16 +3317,13 @@ function validateCommentsQueryHasLimit(root, platform, sourceContent) {
         }
         return findings;
     }
-    // Flutter / iOS / Android: regex pass (builder chains and option structs do
-    // not fit call-argument inspection). Kotlin runs against comment-stripped
-    // source; Dart/Swift have no grammar and run against raw content.
     const getCommentsPat = GETCOMMENTS_PAT[platform] ?? GETCOMMENTS_PAT.typescript;
     const limitPat = HAS_LIMIT[platform] ?? HAS_LIMIT.typescript;
     for (const [file, content] of sourceContent) {
         if (path.basename(file).endsWith('.d.ts'))
             continue;
         if (/\/\/\s*vise:\s*comment-limit handled/i.test(content))
-            continue; // escape on RAW content
+            continue;
         const astLang = astLanguageForFile(file, platform);
         const checkContent = astLang ? stripComments(astLang, content) : content;
         if (!COMMENT_CTX.test(checkContent))
@@ -3096,12 +3337,6 @@ function validateCommentsQueryHasLimit(root, platform, sourceContent) {
     }
     return findings;
 }
-// ── Comment creation affordance ──────────────────────────────────────────────
-// Fires when comments are READ (getComments) but never CREATED (createComment)
-// anywhere in the codebase. A read-only comment list gives users no way to
-// participate. Mirrors the moderation-affordance-present precedent: the write
-// path may live in a sibling file, so detection is codebase-wide and an
-// attestation escape covers deliberately read-only surfaces.
 function validateCommentCreationAffordance(root, platform, sourceContent) {
     const findings = [];
     const ruleId = `${platform}.comments.creation-affordance-present`;
@@ -3116,9 +3351,6 @@ function validateCommentCreationAffordance(root, platform, sourceContent) {
         typescript: /CommentRepository\s*\.\s*createComment\s*\(/,
         "react-native": /CommentRepository\s*\.\s*createComment\s*\(/,
         flutter: /\.createComment\s*\(/,
-        // Any receiver, not just a var literally named `commentRepository` — agents
-        // idiomatically hold the repo in `repo`/`vm`/etc. (real v8: AmityCommentRepository
-        // .createComment(with: AmityCommentCreateOptions(...))). Mirrors android/flutter.
         ios: /AmityCommentCreateOptions\s*\(|\.createComment\s*\(/,
         android: /\.createComment\s*\(/,
     };
@@ -3129,7 +3361,6 @@ function validateCommentCreationAffordance(root, platform, sourceContent) {
     for (const [file, content] of sourceContent) {
         if (path.basename(file).endsWith('.d.ts'))
             continue;
-        // Escape-hatch is checked on RAW content — stripComments would delete the marker.
         if (/\/\/\s*vise:\s*comments read-only intentional/i.test(content))
             return findings;
         const astLang = astLanguageForFile(file, platform);
@@ -3172,7 +3403,7 @@ function validateCommentThreadUiStates(root, platform, sourceContent) {
             continue;
         const hasLoading = /LoadState\.Loading|loadState\.refresh\s+is\s+LoadState\.Loading|loadState\.append\s+is\s+LoadState\.Loading/.test(checkContent);
         const hasError = /LoadState\.Error|loadState\.refresh\s+is\s+LoadState\.Error|retry\s*\(\s*\)/.test(checkContent);
-        const hasEmpty = /itemCount\s*==\s*0|itemCount\s*<=\s*0|No comments|empty/i.test(checkContent);
+        const hasEmpty = /itemCount\s*==\s*0|itemCount\s*<=\s*0|No comments|EmptyState|emptyState|\bisEmpty\b/.test(checkContent);
         if (!(hasLoading && hasError && hasEmpty)) {
             findings.push(finding(ruleId, "warning", "Comment tray renders a paged comment list but does not handle loading, error, and empty states. It can show an empty tray while comments are still loading or hide failures.", relativeFile(root, file), "For collectAsLazyPagingItems(), branch on comments.loadState.refresh/append for Loading and Error, show retry for errors, and show the empty state only when refresh is NotLoading and itemCount == 0. Add // vise: comment-ui-states intentional — <reason> only when a parent component handles these states."));
             break;
@@ -3184,7 +3415,7 @@ function validateChatUnreadVisible(root, platform, sourceContent) {
     const findings = [];
     const ruleId = `${platform}.chat.unread-visible`;
     let chatListFile;
-    let hasUnreadSignal = false;
+    let chatListContent;
     const channelListPat = {
         typescript: /\b(?:ChannelRepository|ChatRepository|AmityChannelRepository)\s*\.\s*(?:getChannels|queryChannels)\b|\bgetChannels\s*\(/,
         "react-native": /\b(?:ChannelRepository|ChatRepository|AmityChannelRepository)\s*\.\s*(?:getChannels|queryChannels)\b|\bgetChannels\s*\(/,
@@ -3212,16 +3443,15 @@ function validateChatUnreadVisible(root, platform, sourceContent) {
     for (const [file, content] of sourceContent) {
         if (/\/\/\s*vise:\s*chat-unread intentional/i.test(content))
             return findings;
-        const astLang = astLanguageForFile(file, platform);
-        const checkContent = astLang ? stripComments(astLang, content) : content;
-        if (unreadSignalPat.test(checkContent)) {
-            hasUnreadSignal = true;
-        }
+        const checkContent = commentStripped(file, platform, content);
         if (!chatListFile && queryPat.test(checkContent) && uiPat.test(checkContent)) {
             chatListFile = file;
+            chatListContent = checkContent;
         }
     }
-    if (chatListFile && !hasUnreadSignal) {
+    if (chatListFile &&
+        chatListContent !== undefined &&
+        !unreadSignalPat.test(blankDeadDeclarations(chatListContent, "(?:unreadCount|totalChannelUnread|subChannelsUnreadCount)"))) {
         findings.push(finding(ruleId, "warning", "Chat channel list is present but no SDK unread count is rendered or subscribed. The UI will drop unread badges/counts.", relativeFile(root, chatListFile), "Render unread from the SDK, for example channel.getUnreadCount()/getSubChannelsUnreadCount() for channel rows or AmityCoreClient.observeUserUnread()/getTotalChannelUnread() for a global badge. Add // vise: chat-unread intentional — <reason> only for a deliberately unread-free chat surface."));
     }
     return findings;
@@ -3263,11 +3493,11 @@ function validateProfileSocialCounts(root, platform, sourceContent) {
     const findings = [];
     const ruleId = `${platform}.profile.social-counts-from-sdk`;
     const sdkCountsPat = {
-        typescript: /\bfollowerCount\b|\bfollowingCount\b|\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(|\bUserRepository\b/i,
-        "react-native": /\bfollowerCount\b|\bfollowingCount\b|\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(|\bUserRepository\b/i,
-        flutter: /\bfollowerCount\b|\bfollowingCount\b|\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(|\bnewUserRepository\s*\(/i,
-        ios: /\bfollowerCount\b|\bfollowingCount\b|\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(|\bAmityUserRepository\b/i,
-        android: /\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(|\bAmityCoreClient\s*\.\s*newUserRepository\s*\(\s*\)/,
+        typescript: /\bfollowerCount\b|\bfollowingCount\b|\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(/i,
+        "react-native": /\bfollowerCount\b|\bfollowingCount\b|\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(/i,
+        flutter: /\bfollowerCount\b|\bfollowingCount\b|\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(/i,
+        ios: /\bfollowerCount\b|\bfollowingCount\b|\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(/i,
+        android: /\bgetFollowerCount\s*\(|\bgetFollowingCount\s*\(|\bgetFollowers\s*\(|\bgetFollowings\s*\(/,
     };
     const placeholderCountsPat = {
         typescript: /value\s*=\s*["'][—-]+["']|value\s*=\s*["']0["']|>\s*[—-]+\s*<|>\s*0\s*</,
@@ -3311,7 +3541,6 @@ function validateCommunityDisplayNameFromSdk(root, platform, sourceContent) {
     for (const [file, content] of sourceContent) {
         if (path.basename(file).endsWith('.d.ts'))
             continue;
-        // Escape-hatch is checked on RAW content — stripComments would delete the marker.
         if (/\/\/\s*vise:\s*community-id display intentional/i.test(content))
             continue;
         const astLang = astLanguageForFile(file, platform);
@@ -3334,9 +3563,6 @@ function validateRoomPostFetched(root, platform, sourceContent) {
         typescript: /(?:getRoomInfo\s*\(\s*\)|room)\s*\??\.\s*roomId\b(?!\s*[,;)]|\s*,\s*cb)/,
         "react-native": /(?:getRoomInfo\s*\(\s*\)|room)\s*\??\.\s*roomId\b(?!\s*[,;)]|\s*,\s*cb)/,
         flutter: /room\s*\??\.\s*roomId\b|getRoomInfo\s*\(\s*\)\s*\??\.\s*roomId/,
-        // Negative lookbehind for Swift string interpolation `\(room.roomId)`:
-        // that's a segment/identifier key, not a displayed name, and must not fire.
-        // Real display (`Text(room.roomId)`, `label.text = room.roomId`) still matches.
         ios: /(?<!\\\()room\s*\??\.\s*roomId\b|getRoomInfo\s*\(\s*\)\s*\?\.?\s*roomId/,
         android: /room\s*\??\.\s*getRoomId\s*\(\)|getRoomInfo\s*\(\s*\)\s*\??\.\s*roomId/,
     };
@@ -3353,7 +3579,6 @@ function validateRoomPostFetched(root, platform, sourceContent) {
     for (const [file, content] of sourceContent) {
         if (path.basename(file).endsWith('.d.ts'))
             continue;
-        // Escape-hatch is checked on RAW content — stripComments would delete the marker.
         if (/\/\/\s*vise:\s*room-display intentional/i.test(content))
             continue;
         const astLang = astLanguageForFile(file, platform);
@@ -3388,16 +3613,8 @@ function validateFeedTargetTypeExplicit(root, platform, sourceContent) {
             let ttm;
             let flagged = false;
             while ((ttm = g.exec(text)) !== null) {
-                // A literal targetType in a READ query (getPosts/getCommunityFeed params) is correct —
-                // you specify targetType:'community' + targetId to read that feed. Read-query objects
-                // carry feedType/sortBy keys; a createPost payload carries dataType/data. Only the
-                // latter is the reusability concern this rule targets.
                 const window = text.slice(Math.max(0, ttm.index - 180), ttm.index + 180);
                 const isReadQuery = /\b(?:feedType|sortBy)\s*:/.test(window) && !/\bdataType\s*:/.test(window);
-                // A literal targetType is the required enum ('community'/'user'); the reusability concern is
-                // the TARGET id. If targetId is bound to a dynamic value (identifier/member/prop, not a
-                // string literal) it is the correct community-feed form — do not flag. Only flag when the
-                // targetId is hardcoded or absent. (Mirrors the read-query carve-out above.)
                 const targetIdDynamic = /\btargetId\s*:\s*[A-Za-z_$]/.test(window);
                 if (!isReadQuery && !targetIdDynamic) {
                     flagged = true;