@colrealpro/react-luau-doctor 0.20.0 → 0.20.2

package/dist/cli.js

@@ -3,7 +3,7 @@
 
 // src/cli.ts
 import fs11 from "fs";
-import os2 from "os";
+import os3 from "os";
 import path13 from "path";
 // package.json
 var package_default = {
@@ -11,7 +11,7 @@ var package_default = {
   publishConfig: {
     access: "public"
   },
-  version: "0.20.0",
+  version: "0.20.2",
   description: "Static analysis for React-Luau hooks, effects, rendering, and performance.",
   license: "MIT",
   type: "module",
@@ -34,10 +34,10 @@ var package_default = {
     check: "bunx tsc -p tsconfig.json --noEmit",
     "check:lsp": "npm --prefix editors/vscode run check",
     "test:lsp": "bun run scripts/build-lsp.ts && bun test tests/lsp.test.ts",
-    test: "bun run build && bun test --parallel=4",
+    test: "bun run build && bun test --parallel",
     "doctor:example": "bun run src/cli.ts examples",
     prepack: "bun run build && bun run check",
-    ci: "bun run build && bun run check && bun run check:lsp && bun run scripts/build-lsp.ts && bun test --parallel=4 && bun run scripts/verify-package.ts",
+    ci: "bun run build && bun run check && bun run check:lsp && bun run scripts/build-lsp.ts && bun test --parallel && bun run scripts/verify-package.ts",
     "verify:package": "bun run build && bun run scripts/verify-package.ts"
   },
   engines: {
@@ -45,7 +45,6 @@ var package_default = {
   },
   packageManager: "bun@1.4.0",
   dependencies: {
-    "jsonc-parser": "3.3.1",
     "web-tree-sitter": "0.26.11"
   },
   devDependencies: {
@@ -53,6 +52,7 @@ var package_default = {
     "@types/bun": "1.4.0",
     "@vscode/vsce": "^4.0.0",
     esbuild: "^0.28.2",
+    "jsonc-parser": "3.3.1",
     "vscode-languageserver": "^10.1.2",
     typescript: "5.8.3"
   },
@@ -121,6 +121,12 @@ function sameNode(left, right) {
 // src/ast/local-values.ts
 var valueCache = new WeakMap;
 var apiCache = new WeakMap;
+function isUnboundIdentifier(context, node) {
+  return node.type === "identifier" && visibleValue(context, node) === undefined;
+}
+function localValueBinding(context, node) {
+  return node.type === "identifier" ? visibleValue(context, node) : null;
+}
 function unwrapExpression(node) {
   while (["parenthesized_expression", "cast_expression"].includes(node.type) && node.namedChildren[0]) {
     node = node.namedChildren[0];
@@ -546,7 +552,13 @@ function isLazyRefInitialization(context, call) {
   }
   return false;
 }
-function isRefInitializer(context, call) {
+var hookInitializerArguments = new Map([
+  ["React.useRef", 0],
+  ["React.useState", 0],
+  ["React.useBinding", 0],
+  ["React.useReducer", 1]
+]);
+function isHookInitializer(context, call) {
   let node = call;
   while (node.parent) {
     const parent = node.parent;
@@ -554,8 +566,11 @@ function isRefInitializer(context, call) {
       return false;
     if (parent.type === "arguments") {
       const hook = parent.parent;
-      if (hook?.type === "function_call" && reactApiPath(context, hook) === "React.useRef" && context.callArguments(hook)[0]?.id === node.id)
-        return true;
+      if (hook?.type === "function_call") {
+        const argumentIndex = hookInitializerArguments.get(reactApiPath(context, hook) ?? "");
+        if (argumentIndex !== undefined && context.callArguments(hook)[argumentIndex]?.id === node.id)
+          return true;
+      }
     }
     node = parent;
   }
@@ -589,18 +604,18 @@ var noBindingGetValueInRender = {
   id: "react-luau/no-binding-getvalue-in-render",
   category: "Correctness",
   severity: "warning",
-  description: "Do not read binding snapshots during render except to initialize a ref",
+  description: "Do not read binding snapshots during render except in hook initialization arguments",
   guidance: {
     explanation: "getValue returns a snapshot without subscribing \u2014 later binding updates do not rerender the component or update props built from that snapshot",
     help: "Pass the binding directly to the prop or use binding:map(function(value) return ... end)",
-    caveat: "A snapshot used to initialize React.useRef is allowed because the initial value is intentionally preserved"
+    caveat: "Snapshots in the first argument to React.useRef, React.useState, or React.useBinding, or the second argument to React.useReducer, are allowed because those arguments are used only for initialization"
   },
   run(context) {
     return context.findCalls().flatMap((call) => {
       const owner = context.nearestFunction(call);
       const name = call.childForFieldName("name");
       const receiver = name?.namedChildren[0];
-      if (!owner || !owner.isComponent && !owner.isHook || name?.type !== "method_index_expression" || name.namedChildren.at(-1)?.text !== "getValue" || !receiver || !isBinding(context, receiver) || isRefInitializer(context, call))
+      if (!owner || !owner.isComponent && !owner.isHook || name?.type !== "method_index_expression" || name.namedChildren.at(-1)?.text !== "getValue" || !receiver || !isBinding(context, receiver) || isHookInitializer(context, call))
         return [];
       return [
         {
@@ -2421,6 +2436,242 @@ var effectNeedsCleanup = {
   }
 };
 
+// src/api-reference.ts
+var functions = new Map;
+function register(namespace, members, reference) {
+  for (const member of members)
+    functions.set(`${namespace}.${member}`, reference);
+}
+for (const type of [
+  "Instance",
+  "Random",
+  "RaycastParams",
+  "OverlapParams",
+  "CatalogSearchParams",
+  "SharedTable"
+]) {
+  register(type, ["new"], {
+    returnType: type,
+    allocation: "new",
+    equality: "reference"
+  });
+}
+register("table", ["clone", "create", "pack"], {
+  returnType: "table",
+  allocation: "new",
+  equality: "reference"
+});
+register("SharedTable", ["clone", "cloneAndFreeze"], {
+  returnType: "SharedTable",
+  allocation: "new",
+  equality: "reference"
+});
+register("string", ["split"], {
+  returnType: "table",
+  allocation: "new",
+  equality: "reference"
+});
+register("buffer", ["create", "fromstring"], {
+  returnType: "buffer",
+  allocation: "new",
+  equality: "reference"
+});
+register("coroutine", ["create"], {
+  returnType: "thread",
+  allocation: "new",
+  equality: "reference"
+});
+register("coroutine", ["wrap"], {
+  returnType: "function",
+  allocation: "new",
+  equality: "reference"
+});
+register("table", ["freeze"], {
+  returnType: "table",
+  allocation: "argument",
+  equality: "reference",
+  argumentIndex: 0
+});
+for (const [type, members] of Object.entries({
+  Color3: ["new", "fromRGB", "fromHSV", "fromHex"],
+  ColorSequence: ["new"],
+  ColorSequenceKeypoint: ["new"],
+  NumberSequence: ["new"],
+  NumberSequenceKeypoint: ["new"],
+  NumberRange: ["new"],
+  UDim: ["new"],
+  UDim2: ["new", "fromScale", "fromOffset"],
+  Vector2: ["new"],
+  Vector3: ["new", "fromNormalId", "fromAxis"],
+  CFrame: [
+    "new",
+    "Angles",
+    "fromEulerAnglesXYZ",
+    "fromEulerAnglesYXZ",
+    "fromOrientation",
+    "fromAxisAngle",
+    "fromMatrix",
+    "lookAt",
+    "lookAlong"
+  ],
+  Rect: ["new"],
+  BrickColor: ["new", "palette"]
+})) {
+  register(type, members, {
+    returnType: type,
+    allocation: "new",
+    equality: "value"
+  });
+}
+var instanceMethods = new Map([
+  ...["GetChildren", "GetDescendants", "GetAttributes", "GetTags"].map((member) => [
+    member,
+    { returnType: "table", allocation: "new", equality: "reference" }
+  ]),
+  [
+    "Clone",
+    { returnType: "Instance", allocation: "new", equality: "reference" }
+  ]
+]);
+function apiFunctionReference(path) {
+  return functions.get(path) ?? null;
+}
+function globalPath(context, expression, seen = new Set) {
+  const node = unwrapExpression(expression);
+  if (seen.has(node.id))
+    return null;
+  seen.add(node.id);
+  if (node.type === "identifier") {
+    if (isUnboundIdentifier(context, node))
+      return node.text;
+    const binding = localValueBinding(context, node);
+    return binding?.returnIndex === 0 ? globalPath(context, binding.value, seen) : null;
+  }
+  if (node.type !== "dot_index_expression")
+    return null;
+  const namespace = node.childForFieldName("table");
+  const member = node.childForFieldName("field");
+  const path = namespace && globalPath(context, namespace, seen);
+  return path && member ? `${path}.${member.text}` : null;
+}
+function isInstanceReceiver(context, expression, seen = new Set) {
+  const node = unwrapExpression(expression);
+  if (seen.has(node.id))
+    return false;
+  seen.add(node.id);
+  if (node.type === "identifier") {
+    if (isUnboundIdentifier(context, node))
+      return ["game", "workspace", "script"].includes(node.text);
+    const binding = localValueBinding(context, node);
+    return binding?.returnIndex === 0 && isInstanceReceiver(context, binding.value, seen);
+  }
+  if (node.type === "dot_index_expression") {
+    const receiver = node.childForFieldName("table");
+    return Boolean(receiver && isInstanceReceiver(context, receiver, seen));
+  }
+  if (node.type !== "function_call")
+    return false;
+  const name = node.childForFieldName("name");
+  if (!name)
+    return false;
+  if (globalPath(context, name) === "Instance.new")
+    return true;
+  if (name.type !== "method_index_expression")
+    return false;
+  const receiver = name.childForFieldName("table");
+  const member = name.childForFieldName("method")?.text;
+  return Boolean(receiver && member && [
+    "GetService",
+    "WaitForChild",
+    "FindFirstChild",
+    "FindFirstAncestor",
+    "Clone"
+  ].includes(member) && isInstanceReceiver(context, receiver, seen));
+}
+function apiReferenceForCall(context, call) {
+  const name = call.childForFieldName("name");
+  if (!name)
+    return null;
+  const path = globalPath(context, name);
+  if (path)
+    return apiFunctionReference(path);
+  if (name.type !== "method_index_expression")
+    return null;
+  const receiver = name.childForFieldName("table");
+  const member = name.childForFieldName("method")?.text;
+  return receiver && member && isInstanceReceiver(context, receiver) ? instanceMethods.get(member) ?? null : null;
+}
+
+// src/ast/value-identity.ts
+function freshValueKind(context, expression, lifetime, seen = new Set, returnIndex = 0, lifetimes = new Set([lifetime])) {
+  if (!expression)
+    return null;
+  const node = unwrapExpression(expression);
+  if (seen.has(node.id) || seen.size >= 64)
+    return null;
+  const visited = new Set(seen).add(node.id);
+  const analyze = (value, owner = lifetime, index = 0) => freshValueKind(context, value, owner, visited, index, new Set(lifetimes).add(owner));
+  if (node.type === "identifier") {
+    const binding = resolveLocalValue(context, node);
+    const owner = binding && context.nearestFunction(binding.value);
+    if (!binding || !owner || !lifetimes.has(owner))
+      return null;
+    return analyze(binding.value, lifetime, binding.returnIndex);
+  }
+  if (returnIndex === 0) {
+    if (node.type === "table_constructor")
+      return "table";
+    if (node.type === "function_definition" || node.type === "function_declaration")
+      return "function";
+    if (node.type === "binary_expression") {
+      const operator = node.children.find((child) => ["and", "or"].includes(child.type))?.type;
+      if (operator === "and")
+        return analyze(node.childForFieldName("right"));
+      if (operator === "or")
+        return analyze(node.childForFieldName("left")) ?? analyze(node.childForFieldName("right"));
+    }
+    if (node.type === "if_expression") {
+      for (const branch of [
+        node,
+        ...node.namedChildren.filter((child) => ["elseif_clause", "else_clause"].includes(child.type))
+      ]) {
+        const kind = analyze(branch.childForFieldName("consequence"));
+        if (kind)
+          return kind;
+      }
+    }
+  }
+  if (node.type !== "function_call")
+    return null;
+  const api = apiReferenceForCall(context, node);
+  if (api && returnIndex === 0) {
+    if (api.allocation === "argument")
+      return analyze(context.callArguments(node)[api.argumentIndex ?? 0] ?? null);
+    if (api.equality !== "reference")
+      return null;
+    return api.returnType === "table" || api.returnType === "function" ? api.returnType : "object";
+  }
+  const name = node.childForFieldName("name");
+  const factory = name && resolveLocalFunction(context, name);
+  if (!factory?.body)
+    return null;
+  for (const statement of context.walk(factory.body)) {
+    if (statement.type !== "return_statement" || context.nearestFunction(statement) !== factory)
+      continue;
+    const values = statement.namedChildren.find((child) => child.type === "expression_list")?.namedChildren ?? [];
+    const value = values[returnIndex] ?? values.at(-1);
+    if (!value)
+      continue;
+    const index = Math.max(0, returnIndex - values.length + 1);
+    if (index > 0 && value.type !== "function_call")
+      continue;
+    const kind = analyze(value, factory, index);
+    if (kind)
+      return kind;
+  }
+  return null;
+}
+
 // src/rules/effect-state-rules.ts
 var HOOKS_WITH_DEPS = new Set([
   "React.useEffect",
@@ -2484,23 +2735,6 @@ function hasExternalSubscription(node, context) {
   }
   return false;
 }
-function directLocalInitializer(owner, name) {
-  if (!owner.body)
-    return null;
-  for (const statement of owner.body.namedChildren) {
-    if (statement.type !== "variable_declaration")
-      continue;
-    const assignment = statement.namedChildren.find((child) => child.type === "assignment_statement");
-    const variableList = assignment?.namedChildren.find((child) => child.type === "variable_list");
-    const expressionList = assignment?.namedChildren.find((child) => child.type === "expression_list");
-    const names = variableList?.namedChildren.filter((child) => child.type === "identifier") ?? [];
-    const expressions = expressionList?.namedChildren ?? [];
-    const index = names.findIndex((child) => child.text === name);
-    if (index >= 0)
-      return expressions[index] ?? expressions[0] ?? null;
-  }
-  return null;
-}
 function setterCalledOutsideCallback(context, owner, callback, setterName) {
   if (!owner.body)
     return false;
@@ -2540,20 +2774,6 @@ function guaranteedRepeatedStateChange(argument, stateName, context) {
   }
   return false;
 }
-function freshDependencyKind(node, owner) {
-  if (node.type === "table_constructor")
-    return "table";
-  if (node.type === "function_definition")
-    return "function";
-  if (node.type === "identifier") {
-    const initializer = directLocalInitializer(owner, node.text);
-    if (initializer?.type === "table_constructor")
-      return "table";
-    if (initializer?.type === "function_definition")
-      return "function";
-  }
-  return null;
-}
 var noDerivedStateEffect = {
   id: "react-luau/no-derived-state-effect",
   category: "Effects",
@@ -2665,7 +2885,7 @@ var noEffectWithFreshDeps = {
   id: "react-luau/no-effect-with-fresh-deps",
   category: "Hooks",
   severity: "error",
-  description: "Dependency tables should not contain tables or functions recreated on every render.",
+  description: "Dependency tables should not contain reference values recreated during render",
   run(context) {
     const diagnostics = [];
     for (const call of context.findCalls()) {
@@ -2677,14 +2897,14 @@ var noEffectWithFreshDeps = {
       if (!owner || !parts)
         continue;
       for (const dependency of dependencyExpressions(parts.deps)) {
-        const kind = freshDependencyKind(dependency, owner);
+        const kind = freshValueKind(context, dependency, owner);
         if (!kind)
           continue;
         const label = dependency.type === "identifier" ? ` ${dependency.text}` : "";
         diagnostics.push({
           node: dependency,
-          message: `${path} depends on${label || " an inline value"} that is a new ${kind} on every render.`,
-          help: "Move the value inside the hook callback and depend on its simple inputs, or intentionally stabilize the value with useMemo/useCallback when identity is part of the contract."
+          message: `${path} depends on${label || " an inline value"} that can be a new ${kind} when the component renders`,
+          help: "Move the value inside the hook callback and depend on its simple inputs, or intentionally stabilize the value with useMemo/useCallback when identity is part of the contract"
         });
       }
     }
@@ -4791,40 +5011,32 @@ function componentRenderCost(context, owner) {
     parts.push(`${discovery} Instance discovery call${discovery === 1 ? "" : "s"}`);
   return parts;
 }
-function memoizedImports(context) {
-  const result = new Map;
-  for (const node of context.walk(context.root)) {
-    if (node.type !== "variable_declaration")
-      continue;
-    const match = node.text.match(/^\s*local\s+([A-Za-z_][A-Za-z0-9_]*)\s*=\s*require\s*\((.*?)\)\s*$/s);
-    if (!match)
-      continue;
-    const localName = match[1];
-    const memoKind = resolveModuleReference(normalizeRequireTarget(match[2]), context.project.memoizedModules);
-    if (memoKind)
-      result.set(localName, memoKind);
+function memoizedComponentKind(context, expression) {
+  const binding = resolveLocalValue(context, expression);
+  if (!binding || binding.returnIndex !== 0 || binding.value.type !== "function_call")
+    return null;
+  const call = binding.value;
+  if (reactApiPath(context, call) === "React.memo") {
+    return context.callArguments(call).length > 1 ? "custom" : "shallow";
   }
-  return result;
+  const target = context.callArguments(call)[0];
+  if (context.getCallPath(call) !== "require" || !target)
+    return null;
+  return resolveModuleReference(normalizeRequireTarget(target.text), context.project.memoizedModules) ?? null;
 }
 function fieldLabel(field) {
   return fieldName(field) ?? field.childForFieldName("name")?.text ?? "prop";
 }
-function isInlineFreshValue(node) {
-  return node?.type === "table_constructor" || node?.type === "function_definition";
-}
 var rerenderUnstableMemoProps = {
   id: "react-luau/rerender-unstable-memo-props",
   category: "Performance",
   severity: "warning",
-  description: "Warn when fresh table or function props defeat shallow React.memo comparisons.",
+  description: "Warn when props created during render can defeat shallow React.memo comparisons",
   guidance: {
-    explanation: "A new function or table has a new identity, so a shallow memo comparison cannot skip this child.",
-    help: "Stabilize props that change each render if this child is expensive, move construction into the child, or remove ineffective memoization."
+    explanation: "New tables, functions, and reference objects compare unequal even when their contents match",
+    help: "Stabilize props that change each render if this child is expensive, move construction into the child, or remove ineffective memoization"
   },
   run(context) {
-    const imports = memoizedImports(context);
-    if (imports.size === 0)
-      return [];
     const diagnostics = [];
     for (const call of context.findCalls()) {
       if (context.resolveCallPath(context.getCallPath(call) ?? "") !== "React.createElement")
@@ -4834,12 +5046,13 @@ var rerenderUnstableMemoProps = {
         continue;
       const args = context.callArguments(call);
       const childName = args[0]?.text.trim() ?? "";
-      if (imports.get(childName) !== "shallow")
+      if (!args[0] || memoizedComponentKind(context, args[0]) !== "shallow")
         continue;
-      const props = args[1];
-      if (!props || props.type !== "table_constructor")
+      const propsBinding = args[1] && resolveLocalValue(context, args[1]);
+      const props = propsBinding?.returnIndex === 0 ? propsBinding.value : null;
+      if (!props || props.type !== "table_constructor" || context.nearestFunction(props) !== component)
         continue;
-      const unstableFields = props.namedChildren.filter((node) => node.type === "field").filter((field) => isInlineFreshValue(fieldValue(field)));
+      const unstableFields = props.namedChildren.filter((node) => node.type === "field").filter((field) => freshValueKind(context, fieldValue(field), component));
       if (unstableFields.length === 0)
         continue;
       const unstable = unstableFields.map(fieldLabel);
@@ -4848,13 +5061,13 @@ var rerenderUnstableMemoProps = {
         node: highlights[0],
         highlights,
         severity: "warning",
-        message: `Memoized ${childName} receives fresh ${unstable.join(", ")} prop${unstable.length === 1 ? "" : "s"} on every parent render.`,
-        summary: `${childName} gets ${unstable.length} fresh ${unstable.length === 1 ? "prop" : "props"} each render. Memoization cannot skip it.`,
+        message: `Memoized ${childName} can receive fresh ${unstable.join(", ")} prop${unstable.length === 1 ? "" : "s"} when its parent renders`,
+        summary: `${childName} gets ${unstable.length} ${unstable.length === 1 ? "prop" : "props"} created during render that can prevent memoization from skipping it`,
         editorRanges: highlights.map((node, index) => ({
           node,
-          summary: `${childName} gets a fresh ${unstable[index]} prop each render. Memoization cannot skip it.`
+          summary: `${childName} gets a ${unstable[index]} prop created during render that can prevent memoization from skipping it`
         })),
-        help: "Fresh table or function identity prevents the shallow memo comparison from skipping this child. Stabilize the prop only when the parent rerenders frequently, move construction into the child, or remove ineffective memoization."
+        help: "Fresh reference identity can prevent the shallow memo comparison from skipping this child. Stabilize the prop when the parent rerenders frequently, move construction into the child, or remove ineffective memoization"
       });
     }
     return diagnostics;
@@ -7028,30 +7241,32 @@ function currentConditionalHookMode(context) {
   }
   return null;
 }
-function controlledParameterIndex(controlFlow, fn, summary) {
+function controlledParameterIndex(controlFlow, fn, summary, node) {
   if (controlFlow.type !== "if_statement")
     return null;
-  const header = (controlFlow.text.split(/\bthen\b/s, 1)[0] ?? "").trim();
-  for (const [conditionName, index] of Object.entries(summary.conditionVariables)) {
-    const escaped = conditionName.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    const patterns = [
-      new RegExp(`^if\\s+${escaped}\\s*$`),
-      new RegExp(`^if\\s+not\\s+${escaped}\\s*$`),
-      new RegExp(`^if\\s+${escaped}\\s*(?:==|~=)\\s*(?:true|false|nil)\\s*$`),
-      new RegExp(`^if\\s+(?:true|false|nil)\\s*(?:==|~=)\\s*${escaped}\\s*$`)
-    ];
-    if (patterns.some((pattern) => pattern.test(header)))
-      return index;
-  }
+  const conditions = guardConditions(controlFlow, node);
+  if (conditions.length === 0)
+    return null;
+  const variables = { ...summary.conditionVariables };
   for (const index of summary.parameterIndexes) {
     const name = fn.parameters[index];
-    if (!name)
-      continue;
-    const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-    if (new RegExp(`^if\\s+(?:not\\s+)?${escaped}\\s*$`).test(header))
-      return index;
+    if (name)
+      variables[name] ??= index;
   }
-  return null;
+  const indexes = conditions.map((condition) => {
+    for (const [name, index] of Object.entries(variables)) {
+      const escaped = name.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+      const patterns = [
+        new RegExp(`^(?:not\\s+)?${escaped}\\s*$`),
+        new RegExp(`^${escaped}\\s*(?:==|~=)\\s*(?:true|false|nil)\\s*$`),
+        new RegExp(`^(?:true|false|nil)\\s*(?:==|~=)\\s*${escaped}\\s*$`)
+      ];
+      if (patterns.some((pattern) => pattern.test(condition.text.trim())))
+        return index;
+    }
+    return null;
+  });
+  return indexes.every((index) => index !== null) ? indexes[0] : null;
 }
 function dynamicHookModeFixPreview(hookName, argumentText) {
   return {
@@ -7253,28 +7468,104 @@ function staticModuleTables(context) {
   }
   return candidates;
 }
-function simpleConditionRoot(controlFlow) {
-  if (controlFlow.type !== "if_statement" && controlFlow.type !== "if_expression")
-    return null;
+function containsNode(container, node) {
+  return node.startIndex >= container.startIndex && node.endIndex <= container.endIndex;
+}
+function branchContaining(controlFlow, node) {
+  return controlFlow.namedChildren.find((child) => containsNode(child, node)) ?? null;
+}
+function guardConditions(controlFlow, node) {
   const condition = controlFlow.namedChildren[0];
   if (!condition)
-    return null;
+    return [];
+  if (controlFlow.type !== "if_statement" && controlFlow.type !== "if_expression")
+    return [condition];
+  if (containsNode(condition, node))
+    return [];
+  const conditions = [condition];
+  for (const clause of controlFlow.namedChildren.slice(1)) {
+    if (clause.startIndex > node.startIndex)
+      break;
+    if (clause.type !== "elseif_statement" && clause.type !== "elseif_clause")
+      continue;
+    const clauseCondition = clause.namedChildren[0];
+    if (clauseCondition && !containsNode(clauseCondition, node))
+      conditions.push(clauseCondition);
+  }
+  return conditions;
+}
+function conditionallyContains(controlFlow, node) {
+  if (controlFlow.type === "if_statement" || controlFlow.type === "if_expression")
+    return guardConditions(controlFlow, node).length > 0;
+  if (controlFlow.type === "for_statement")
+    return controlFlow.namedChildren.some((child) => child.type === "block" && containsNode(child, node));
+  if (CONDITIONAL_TYPES.has(controlFlow.type))
+    return true;
+  if (controlFlow.type !== "binary_expression" || !controlFlow.children.some((child) => child.type === "and" || child.type === "or"))
+    return false;
+  const right = controlFlow.childForFieldName("right") ?? controlFlow.namedChildren[1];
+  return Boolean(right && containsNode(right, node));
+}
+function simpleConditionRoot(condition) {
   const text = condition.text.trim();
   const match = text.match(/^(?:not\s+)?([A-Za-z_][A-Za-z0-9_]*)(?:\s*(?:==|~=)\s*(?:true|false|nil))?$/);
   return match?.[1] ?? null;
 }
-function conditionIsProvablyInvariant(controlFlow, fn, context, moduleInvariants) {
-  const condition = controlFlow.namedChildren[0];
-  if (!condition)
+var unstableLocalNamesCache = new WeakMap;
+function unstableLocalNames(fn, context) {
+  const cached = unstableLocalNamesCache.get(fn);
+  if (cached)
+    return cached;
+  const declared = new Set;
+  const unstable = new Set;
+  for (const node of context.walk(fn.node)) {
+    if (node.type === "variable_declaration" && context.nearestFunction(node) === fn) {
+      for (const name of declarationNames(node)) {
+        if (declared.has(name))
+          unstable.add(name);
+        declared.add(name);
+      }
+    }
+    if (node.type !== "assignment_statement" || node.parent?.type === "variable_declaration")
+      continue;
+    const variables = node.namedChildren.find((child) => child.type === "variable_list");
+    for (const target of variables?.namedChildren ?? []) {
+      if (target.type === "identifier")
+        unstable.add(target.text);
+    }
+  }
+  unstableLocalNamesCache.set(fn, unstable);
+  return unstable;
+}
+function moduleNameIsUnshadowed(name, node, fn, context) {
+  let owner = fn;
+  while (owner) {
+    if (owner.parameters.includes(name) || isBindingShadowedBetween(node, owner, name))
+      return false;
+    owner = context.nearestFunction(owner.node);
+  }
+  return true;
+}
+function conditionIsProvablyInvariant(controlFlow, fn, context, moduleInvariants, node = controlFlow) {
+  if (!["if_statement", "if_expression", "binary_expression"].includes(controlFlow.type))
     return false;
-  if (["true", "false", "nil", "number", "string"].includes(condition.type))
-    return true;
-  const root = simpleConditionRoot(controlFlow);
-  if (!root)
+  const conditions = guardConditions(controlFlow, node);
+  if (conditions.length === 0)
     return false;
-  if (moduleInvariants.has(root))
-    return true;
-  return Boolean(context.model.stableVariablesByFunction.get(nodeKey(fn.node))?.has(root));
+  return conditions.every((condition) => {
+    if (["true", "false", "nil", "number", "string"].includes(condition.type))
+      return true;
+    const root = simpleConditionRoot(condition);
+    if (!root)
+      return false;
+    if (moduleInvariants.has(root) && moduleNameIsUnshadowed(root, condition, fn, context))
+      return true;
+    if (isNameShadowedBetween(condition, fn, root))
+      return false;
+    if (unstableLocalNames(fn, context).has(root))
+      return false;
+    return Boolean(context.model.stableVariablesByFunction.get(nodeKey(fn.node))?.has(root));
+  });
 }
 function branchHookSequence(branch, fn, context) {
   const hooks = [];
@@ -7289,28 +7580,45 @@ function branchHookSequence(branch, fn, context) {
     const path = context.resolveCallPath(rawPath);
     if (!isHookPath(path))
       continue;
-    const nestedControl = findAncestorBetween(node, branch, (ancestor) => CONDITIONAL_TYPES.has(ancestor.type));
-    if (nestedControl)
+    const nestedControl = node.id === branch.id ? null : findAncestorBetween(node, branch, (ancestor) => conditionallyContains(ancestor, node));
+    if (nestedControl || conditionallyContains(branch, node))
       return null;
     hooks.push(path);
   }
   return hooks;
 }
 function ifBranchesHaveEquivalentBuiltInTopology(controlFlow, fn, context) {
-  if (controlFlow.type !== "if_statement")
+  const isStatement = controlFlow.type === "if_statement";
+  if (!isStatement && controlFlow.type !== "if_expression")
     return false;
-  const thenBlock = controlFlow.namedChildren.find((child) => child.type === "block");
-  const elseStatement = controlFlow.namedChildren.find((child) => child.type === "else_statement");
-  const elseBlock = elseStatement?.namedChildren.find((child) => child.type === "block");
-  if (!thenBlock || !elseBlock)
+  const firstBranch = isStatement ? controlFlow.namedChildren.find((child) => child.type === "block") : controlFlow.namedChildren[1];
+  const elseClause = controlFlow.namedChildren.find((child) => child.type === "else_statement" || child.type === "else_clause");
+  const lastBranch = isStatement ? elseClause?.namedChildren.find((child) => child.type === "block") : elseClause?.namedChildren[0];
+  if (!firstBranch || !lastBranch)
     return false;
-  const thenHooks = branchHookSequence(thenBlock, fn, context);
-  const elseHooks = branchHookSequence(elseBlock, fn, context);
-  if (!thenHooks || !elseHooks || thenHooks.length !== elseHooks.length)
+  const branches = [firstBranch];
+  for (const clause of controlFlow.namedChildren) {
+    if (clause.type !== "elseif_statement" && clause.type !== "elseif_clause")
+      continue;
+    const condition = clause.namedChildren[0];
+    if (!condition)
+      return false;
+    const conditionHooks = branchHookSequence(condition, fn, context);
+    if (!conditionHooks || conditionHooks.length > 0)
+      return false;
+    const branch = isStatement ? clause.namedChildren.find((child) => child.type === "block") : clause.namedChildren[1];
+    if (!branch)
+      return false;
+    branches.push(branch);
+  }
+  branches.push(lastBranch);
+  const sequences = branches.map((branch) => branchHookSequence(branch, fn, context));
+  const first = sequences[0];
+  if (!first)
     return false;
-  if (!thenHooks.every((path, index) => path === elseHooks[index]))
+  if (!sequences.every((sequence) => sequence && sequence.length === first.length && sequence.every((path, index) => path === first[index])))
     return false;
-  return thenHooks.every((path) => path.startsWith("React."));
+  return first.every((path) => path.startsWith("React."));
 }
 function stateModeStability(name, owner, context) {
   const binding = context.model.stateBindings.find((candidate) => candidate.owner === owner && candidate.valueName === name);
@@ -7415,7 +7723,21 @@ function controlledAccessPaths(summary, parameterIndex) {
     paths.add("");
   return [...paths];
 }
-function loopIterationIsProvablyStable(loop, imports, owner, stableShapes, moduleTables) {
+function loopIterationIsProvablyStable(loop, imports, owner, stableShapes, moduleTables, context, moduleInvariants) {
+  for (const node of context.walk(loop)) {
+    if (!["break_statement", "continue_statement", "return_statement"].includes(node.type))
+      continue;
+    if (context.nearestFunction(node) !== owner)
+      continue;
+    if (node.type !== "return_statement") {
+      const targetLoop = findAncestorBetween(node, owner.node, (ancestor) => ["for_statement", "while_statement", "repeat_statement"].includes(ancestor.type));
+      if (targetLoop?.id !== loop.id)
+        continue;
+    }
+    const dynamicGuard = findAncestorBetween(node, loop, (ancestor) => conditionallyContains(ancestor, node) && !conditionIsProvablyInvariant(ancestor, owner, context, moduleInvariants, node));
+    if (dynamicGuard)
+      return false;
+  }
   const numeric = loop.namedChildren.find((child) => child.type === "for_numeric_clause");
   if (numeric) {
     const text = numeric.text;
@@ -7488,23 +7810,46 @@ function reachableReturnsBefore(call, fn, context, cache) {
     returns = [...context.walk(fn.body)].filter((node) => node.type === "return_statement" && !isNestedInsideFunction(node, fn.node) && !impossibleNilGuardReturn(node, fn, parameterTypes));
     cache.set(key, returns);
   }
-  return returns.filter((node) => node.endIndex <= call.startIndex);
+  return returns.filter((node) => {
+    if (node.endIndex > call.startIndex)
+      return false;
+    return !findAncestorBetween(node, fn.node, (ancestor) => {
+      if (ancestor.type !== "if_statement")
+        return false;
+      const returnBranch = branchContaining(ancestor, node);
+      const callBranch = branchContaining(ancestor, call);
+      return Boolean(returnBranch && callBranch && returnBranch.id !== callBranch.id);
+    });
+  });
 }
 function returnIsControlledByStableTopologyMode(node, fn, summary, context, moduleInvariants) {
   let current = node.parent;
+  let sawStableGuard = false;
   while (current && current !== fn.node) {
-    if (current.type === "if_statement" || current.type === "if_expression") {
-      if (summary && controlledParameterIndex(current, fn, summary) !== null)
-        return true;
-      if (conditionIsProvablyInvariant(current, fn, context, moduleInvariants))
-        return true;
+    if (["for_statement", "while_statement", "repeat_statement"].includes(current.type))
       return false;
+    if (current.type === "if_statement" || current.type === "if_expression") {
+      if (summary && controlledParameterIndex(current, fn, summary, node) !== null)
+        sawStableGuard = true;
+      else if (conditionIsProvablyInvariant(current, fn, context, moduleInvariants, node))
+        sawStableGuard = true;
+      else
+        return false;
     }
     current = current.parent;
   }
-  return false;
+  return sawStableGuard;
 }
 function conditionalFixPreview(kind, hookName) {
+  if (kind === "short-circuit expression") {
+    return {
+      kind: "pattern",
+      before: `local result = enabled and renderChild(${hookName}())`,
+      after: `local value = ${hookName}()
+local result = enabled and renderChild(value)`,
+      note: "Call the hook before the short-circuit expression, then branch on its result"
+    };
+  }
   if (hookName === "React.useEffect" && kind === "if statement") {
     return {
       kind: "pattern",
@@ -7583,6 +7928,34 @@ end`,
     note: "Call hooks before any reachable early return so every render executes the same hook sequence."
   };
 }
+function callbackFunctions(context) {
+  const callbacks = new Set;
+  const addCallback = (expression) => {
+    const fn = resolveLocalFunction(context, expression);
+    if (fn)
+      callbacks.add(fn.node.id);
+  };
+  for (const call of context.findCalls()) {
+    const path = reactApiPath(context, call);
+    const args = context.callArguments(call);
+    for (const [index, argument] of args.entries()) {
+      if (index === 0 && ["React.memo", "React.forwardRef", "React.createElement"].includes(path ?? ""))
+        continue;
+      if (path?.startsWith("React.use") || path === "React.memo" || unwrapExpression(argument).type === "function_definition")
+        addCallback(argument);
+    }
+    if (path !== "React.createElement" || args[0]?.type !== "string" || args[1]?.type !== "table_constructor")
+      continue;
+    for (const field of args[1].namedChildren) {
+      if (field.type !== "field")
+        continue;
+      const value = field.namedChildren.at(-1);
+      if (value)
+        addCallback(value);
+    }
+  }
+  return callbacks;
+}
 var rulesOfHooks = {
   id: "react-luau/rules-of-hooks",
   category: "Hooks",
@@ -7603,6 +7976,7 @@ var rulesOfHooks = {
     const modeImports = conditionalHookModeImports(context);
     const ignoredHookImports = nonReactHookImports(context);
     const currentModeSummary = currentConditionalHookMode(context);
+    const callbacks = callbackFunctions(context);
     const reachableReturns = new Map;
     for (const call of context.findCalls()) {
       const rawPath = context.getCallPath(call);
@@ -7614,11 +7988,11 @@ var rulesOfHooks = {
       if (!isHookPath(path))
         continue;
       const fn = context.nearestFunction(call);
-      if (!fn || !fn.isComponent && !fn.isHook) {
+      if (!fn || !fn.isComponent && !fn.isHook || callbacks.has(fn.node.id)) {
         diagnostics.push({
           node: callNameNode(call),
-          message: `Hook ${path} is called outside a React component or custom hook.`,
-          help: "Move the hook into a component or a custom hook whose name starts with use.",
+          message: `Hook ${path} is called outside a React component or custom hook`,
+          help: "Move the hook into a component or a custom hook whose name starts with use",
           fixPreview: {
             kind: "pattern",
             before: `local value = ${path}()
@@ -7630,7 +8004,7 @@ end`,
 	local value = ${path}()
 	return value
 end`,
-            note: "Hooks need a React-owned component or custom-hook call stack."
+            note: "Hooks need a React-owned component or custom-hook call stack"
           }
         });
         continue;
@@ -7661,24 +8035,28 @@ end`,
           });
         }
       }
-      const controlFlow = findAncestorBetween(call, fn.node, (node) => CONDITIONAL_TYPES.has(node.type));
+      const controlFlow = findAncestorBetween(call, fn.node, (node) => {
+        if (!conditionallyContains(node, call))
+          return false;
+        if (currentModeSummary && controlledParameterIndex(node, fn, currentModeSummary, call) !== null)
+          return false;
+        if (conditionIsProvablyInvariant(node, fn, context, moduleInvariants, call))
+          return false;
+        if (ifBranchesHaveEquivalentBuiltInTopology(node, fn, context))
+          return false;
+        if (node.type === "for_statement" && loopIterationIsProvablyStable(node, staticImports, fn, stableShapes, moduleTables, context, moduleInvariants))
+          return false;
+        return true;
+      });
       if (controlFlow) {
-        if (currentModeSummary && controlledParameterIndex(controlFlow, fn, currentModeSummary) !== null)
-          continue;
-        if (conditionIsProvablyInvariant(controlFlow, fn, context, moduleInvariants))
-          continue;
-        if (ifBranchesHaveEquivalentBuiltInTopology(controlFlow, fn, context))
-          continue;
-        if (controlFlow.type === "for_statement" && loopIterationIsProvablyStable(controlFlow, staticImports, fn, stableShapes, moduleTables))
-          continue;
-        const kind = controlFlow.type.replaceAll("_", " ");
+        const kind = controlFlow.type === "binary_expression" ? "short-circuit expression" : controlFlow.type.replaceAll("_", " ");
         const loopLike = controlFlow.type === "for_statement" || controlFlow.type === "while_statement" || controlFlow.type === "repeat_statement";
         diagnostics.push({
           node: callNameNode(call),
-          message: loopLike ? `Hook ${path} is called inside ${kind} whose size or iteration order may change between renders. If that happens, React will see a different hook sequence.` : `Hook ${path} is called inside ${kind}, so the hook may be skipped on some renders.`,
-          summary: loopLike ? `${path} may run a different number of times between renders.` : `${path} may be skipped on some renders.`,
-          explanation: loopLike ? `This ${kind} may change how many times ${path} is called.` : `This ${kind} can skip ${path} on some renders.`,
-          help: loopLike ? "Keep hook count independent of runtime collection size or loop iterations. A common fix is to render a child component per item and call the hook inside that child." : "Call the hook unconditionally at the top level, then branch on the returned value.",
+          message: loopLike ? `Hook ${path} is called inside ${kind} whose size or iteration order may change between renders. If that happens, React will see a different hook sequence` : `Hook ${path} is called inside ${kind}, so the hook may be skipped on some renders`,
+          summary: loopLike ? `${path} may run a different number of times between renders` : `${path} may be skipped on some renders`,
+          explanation: loopLike ? `This ${kind} may change how many times ${path} is called` : `This ${kind} can skip ${path} on some renders`,
+          help: loopLike ? "Keep hook count independent of runtime collection size or loop iterations. A common fix is to render a child component per item and call the hook inside that child" : "Call the hook unconditionally at the top level, then branch on the returned value",
           fixPreview: conditionalFixPreview(kind, path)
         });
         continue;
@@ -8051,7 +8429,7 @@ var unstableContextValue = {
   id: "react-luau/unstable-context-value",
   category: "Performance",
   severity: "warning",
-  description: "Avoid recreating context value tables on every provider render when identity matters.",
+  description: "Avoid recreating context reference values during render when identity matters",
   run(context) {
     const diagnostics = [];
     for (const call of context.findCalls()) {
@@ -8066,13 +8444,13 @@ var unstableContextValue = {
       const props = args[1];
       if (!/\.Provider$/.test(element) || !props || props.type !== "table_constructor")
         continue;
-      const valueField = props.namedChildren.find((field) => field.type === "field" && fieldName(field) === "value" && fieldValue(field)?.type === "table_constructor");
+      const valueField = props.namedChildren.find((field) => field.type === "field" && fieldName(field) === "value" && freshValueKind(context, fieldValue(field), component));
       if (!valueField)
         continue;
       diagnostics.push({
         node: fieldNameNode(valueField),
-        message: "Context Provider receives a new inline value table on every render.",
-        help: "Memoize the provider value from its real dependencies when consumer updates depend on object identity."
+        message: "Context Provider can receive a new reference value when the component renders",
+        help: "Memoize the provider value from its real dependencies when consumer updates depend on object identity"
       });
     }
     return diagnostics;
@@ -8247,11 +8625,12 @@ function normalizeCategory(value) {
   return null;
 }
 
-// src/ci.ts
+// src/ci/index.ts
 import { spawnSync as spawnSync2 } from "child_process";
-import { createHash } from "crypto";
+import { createHash as createHash2 } from "crypto";
 import fs9 from "fs";
 import path11 from "path";
+import os2 from "os";
 import readline from "readline/promises";
 import { stdin as input, stdout as output } from "process";
 
@@ -8421,18 +8800,20 @@ function mergeBase(repoRoot, left, right = "HEAD") {
   return result.status === 0 ? result.stdout.trim() : null;
 }
 function resolveGitBase(repoRoot, requested) {
-  if (requested) {
-    if (requested.startsWith("-"))
-      throw new Error(`Invalid git ref: ${requested}`);
-    const base = mergeBase(repoRoot, requested);
+  const gitLab = process.env.GITLAB_CI === "true";
+  const baseRef = requested ?? (gitLab ? process.env.CI_MERGE_REQUEST_DIFF_BASE_SHA?.trim() : undefined);
+  if (baseRef) {
+    if (baseRef.startsWith("-"))
+      throw new Error(`Invalid git ref: ${baseRef}`);
+    const base = mergeBase(repoRoot, baseRef);
     if (base)
       return base;
-    const commit = verifyCommit(repoRoot, requested);
+    const commit = verifyCommit(repoRoot, baseRef);
     if (!commit)
-      throw new Error(`Could not resolve git base ref: ${requested}`);
+      throw new Error(`Could not resolve git base ref: ${baseRef}`);
     return commit;
   }
-  const environmentBase = process.env.GITHUB_BASE_REF?.trim();
+  const environmentBase = process.env.GITHUB_BASE_REF?.trim() || (gitLab ? process.env.CI_DEFAULT_BRANCH?.trim() : undefined);
   const candidates = [
     environmentBase ? `origin/${environmentBase}` : null,
     environmentBase ?? null,
@@ -8622,6 +9003,7 @@ function createGitScopePlan(scanRootInput, options, relativeRootInput = scanRoot
   const baselineFiles = [];
   const changedLines = new Map;
   const changedFiles = [];
+  const baselinePaths = new Map;
   const stagedSources = options.staged ? readGitObjects(repoRoot, repoFiles.map((file) => `:${file.currentPath}`)) : new Map;
   const baselineSources = options.scope === "changed" ? readGitObjects(repoRoot, repoFiles.filter((file) => file.baselinePath !== null).map((file) => `${base}:${file.baselinePath}`)) : new Map;
   for (const repoFile of repoFiles) {
@@ -8633,10 +9015,16 @@ function createGitScopePlan(scanRootInput, options, relativeRootInput = scanRoot
       continue;
     const source = options.staged ? stagedSources.get(`:${repoRelativePath}`) ?? null : currentSource(repoRoot, repoRelativePath, false);
     const relativePath = normalize2(path4.relative(relativeRoot, absolutePath));
+    if (repoFile.baselinePath !== null) {
+      baselinePaths.set(relativePath, normalize2(path4.relative(relativeRoot, path4.resolve(repoRoot, repoFile.baselinePath))));
+    }
     changedFiles.push(relativePath);
     if (source !== null)
       currentFiles.push({ absolutePath, relativePath, source, forceScan: false });
     const baseline = options.scope !== "changed" || repoFile.baselinePath === null ? null : baselineSources.get(`${base}:${repoFile.baselinePath}`) ?? null;
+    if (options.scope === "changed" && repoFile.baselinePath !== null && baseline === null) {
+      throw new Error(`Could not read baseline source for ${repoFile.baselinePath}`);
+    }
     if (baseline !== null)
       baselineFiles.push({ absolutePath, relativePath, source: baseline, forceScan: false });
     if (options.scope === "lines" && source !== null) {
@@ -8650,7 +9038,8 @@ function createGitScopePlan(scanRootInput, options, relativeRootInput = scanRoot
     changedFiles: [...new Set(changedFiles)].sort(),
     currentFiles,
     baselineFiles,
-    changedLines
+    changedLines,
+    baselinePaths
   };
 }
 
@@ -8945,34 +9334,775 @@ function renderAnnotations(report) {
 `);
 }
 
-// src/scope.ts
-import path10 from "path";
-
-// src/scanner.ts
-import fs8 from "fs";
-import path9 from "path";
-
-// src/cache.ts
-import crypto from "crypto";
-import fs4 from "fs";
-import os from "os";
-import path5 from "path";
-import { fileURLToPath } from "url";
-var MAX_CACHED_REPORTS = 8;
-function normalizeRelative2(value) {
-  return value.split(path5.sep).join("/");
+// src/ci/report.ts
+var SUMMARY_MARKER = "<!-- react-luau-doctor:summary -->";
+var REVIEW_MARKER = "<!-- react-luau-doctor:review -->";
+var SUCCESS_ICON = '<img src="https://raw.githubusercontent.com/ColRealPro/react-luau-doctor/main/assets/ci/check-circle.svg" width="14" height="14" alt="">';
+var MAX_COMMENT_LENGTH = 60000;
+function escapeMarkdown(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/[\\`*_{}\[\]()!|#$~]/g, "\\$&").replace(/\r?\n/g, " ");
 }
-function hashText(value) {
-  return crypto.createHash("sha256").update(value).digest("hex");
+function inlineCode(value) {
+  const text = value.replace(/\r?\n/g, " ");
+  const fence = "`".repeat(Math.max(0, ...[...text.matchAll(/`+/g)].map((match) => match[0].length)) + 1);
+  const padding = text.startsWith("`") || text.endsWith("`") || text.startsWith(" ") && text.endsWith(" ") ? " " : "";
+  return `${fence}${padding}${text}${padding}${fence}`;
 }
-var analyzerHashes = new Map;
-function hashAnalyzerFile(hash, root, filename) {
-  if (!fs4.existsSync(filename))
-    return;
-  hash.update(normalizeRelative2(path5.relative(root, filename)));
-  hash.update("\x00");
-  hash.update(fs4.readFileSync(filename));
-  hash.update("\x00");
+function escapeHtml(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+function issueCount(count) {
+  return `${count} ${count === 1 ? "issue" : "issues"}`;
+}
+function statusText(kind, text) {
+  let rendered = kind === "fixed" ? `**${escapeMarkdown(text)}**` : escapeMarkdown(text);
+  return rendered;
+}
+function renderReviewProgress(total, fixed, unknown, discussions) {
+  const lines = [`**React-Luau Doctor found ${total} new ${total === 1 ? "issue" : "issues"}**`];
+  const status = [];
+  if (unknown > 0) {
+    status.push(`${unknown} ${unknown === 1 ? "issue" : "issues"} awaiting verification`);
+  }
+  if (discussions === undefined && fixed > 0) {
+    status.push("discussion status unavailable");
+  }
+  const discussion = discussions ? `${discussions} ${discussions === 1 ? "discussion" : "discussions"} awaiting resolution` : "";
+  if (fixed > 0) {
+    let fixedText = `${fixed} of these ${issueCount(total)} fixed`;
+    if (fixed === total) {
+      if (total === 1) {
+        fixedText = "This issue fixed in later commits";
+      } else if (total === 2) {
+        fixedText = "Both issues fixed in later commits";
+      } else {
+        fixedText = `All ${total} issues fixed in later commits`;
+      }
+    }
+    const remaining = total - fixed - unknown;
+    if (remaining > 0) {
+      status.unshift(`${remaining} still ${remaining === 1 ? "remains" : "remain"} in the PR`);
+    }
+    lines.push("", [
+      `${SUCCESS_ICON} ${statusText("fixed", fixedText)}`,
+      status.length ? statusText("remaining", `\xB7 ${status.join(" \xB7 ")}`) : "",
+      discussion ? statusText("discussion", `\xB7 ${discussion}`) : ""
+    ].filter(Boolean).join(" "));
+  } else if (status.length || discussion) {
+    lines.push("", [
+      status.length ? statusText("remaining", status.join(" \xB7 ")) : "",
+      discussion ? statusText("discussion", `${status.length ? "\xB7 " : ""}${discussion}`) : ""
+    ].filter(Boolean).join(" "));
+  }
+  return lines.join(`
+`);
+}
+function ordered(diagnostics) {
+  return [...diagnostics].sort((a, b) => a.file.localeCompare(b.file) || a.location.line - b.location.line || a.rule.localeCompare(b.rule) || a.message.localeCompare(b.message));
+}
+function diagnosticDetails(diagnostic) {
+  const details = [diagnostic.help, diagnostic.explanation, diagnostic.caveat].filter((value) => Boolean(value) && value !== diagnostic.message);
+  return details.length ? `
+  ${[...new Set(details)].map(escapeMarkdown).join(" \xB7 ")}` : "";
+}
+function renderSummaryComment(report, options) {
+  const total = report.diagnostics.length;
+  const files = new Set(report.diagnostics.map((diagnostic) => diagnostic.file)).size;
+  const newLabel = report.scope === "changed" ? "new" : "reported";
+  const severity = [
+    `${report.counts.error} ${report.counts.error === 1 ? "error" : "errors"}`,
+    `${report.counts.warning} ${report.counts.warning === 1 ? "warning" : "warnings"}`,
+    `${report.counts.suggestion} ${report.counts.suggestion === 1 ? "suggestion" : "suggestions"}`
+  ].join(" & ");
+  const info = options.incomplete ? `score unavailable \xB7 fixes unverified \xB7 vs ${inlineCode(options.baseBranch)}` : `score ${report.score}/100 (${scoreLabel(report.score)}) \xB7 ${options.fixed.length} fixed \xB7 vs ${inlineCode(options.baseBranch)}`;
+  let headline;
+  if (options.incomplete) {
+    headline = `**React-Luau Doctor analysis incomplete \xB7 ${issueCount(total)} reported so far**` + `
+
+Findings may be missing and fixes have not been verified`;
+  } else if (options.skipped || total === 0) {
+    headline = `**React-Luau Doctor found no ${newLabel} issues${newLabel === "new" ? ". \uD83C\uDF89" : ""}**`;
+    if (options.skipped) {
+      headline += `
+
+No eligible React-Luau files changed in this pull request \xB7 scan skipped`;
+    }
+  } else {
+    headline = `**React-Luau Doctor found ${total} ${newLabel} ${total === 1 ? "issue" : "issues"}` + ` in ${files} ${files === 1 ? "file" : "files"} \xB7 ${severity} \xB7 ${info}**`;
+  }
+  const lines = [SUMMARY_MARKER, headline];
+  if (options.incomplete) {
+    lines.push("", `${severity} \xB7 ${info}`);
+  }
+  const sections = [
+    {
+      title: "Errors",
+      diagnostics: report.diagnostics.filter((d) => d.severity === "error"),
+      icon: "\u274C",
+      grouped: false,
+      baseline: false
+    },
+    {
+      title: `\u26A0\uFE0F ${report.counts.warning} ${report.counts.warning === 1 ? "warning" : "warnings"}`,
+      diagnostics: report.diagnostics.filter((d) => d.severity === "warning"),
+      icon: "\u26A0\uFE0F",
+      grouped: true,
+      baseline: false
+    },
+    {
+      title: `\uD83D\uDCA1 ${report.counts.suggestion} ${report.counts.suggestion === 1 ? "suggestion" : "suggestions"}`,
+      diagnostics: report.diagnostics.filter((d) => d.severity === "suggestion"),
+      icon: "\uD83D\uDCA1",
+      grouped: true,
+      baseline: false
+    },
+    {
+      title: `${options.fixed.length} fixed vs <code>${escapeHtml(options.baseBranch)}</code>`,
+      diagnostics: options.incomplete ? [] : options.fixed,
+      icon: SUCCESS_ICON,
+      grouped: true,
+      baseline: true
+    }
+  ];
+  const inlineNote = options.inlineCount > 0 ? "See inline comments for fixes" : "See this report for findings";
+  const footer = `
+
+<sub>Reviewed by [React-Luau Doctor](https://github.com/ColRealPro/react-luau-doctor)` + ` for commit ${inlineCode(options.sha.slice(0, 7))} \xB7 ${inlineNote}</sub>
+`;
+  const reportLink = options.runUrl ? `[the full workflow report](${options.runUrl})` : "the workflow summary and logs";
+  const overflow = `
+
+Additional findings were omitted from this comment \xB7 See ` + `${reportLink} for all findings and diagnostic details
+`;
+  const fullLink = options.runUrl && (total > 0 || options.fixed.length > 0 || options.incomplete) ? `
+
+[View full workflow report](${options.runUrl})` : "";
+  const limit = options.limit ?? MAX_COMMENT_LENGTH;
+  const reserve = footer.length + Math.max(overflow.length, fullLink.length);
+  let omitted = false;
+  let body = lines.join(`
+`);
+  for (const note of report.notes ?? []) {
+    const text = `
+
+${escapeMarkdown(note)}`;
+    if (body.length + text.length + reserve > limit) {
+      omitted = true;
+      continue;
+    }
+    body += text;
+  }
+  for (const section of sections) {
+    if (!section.diagnostics.length)
+      continue;
+    const start = section.grouped ? `
+
+<details>
+<summary>${section.title}</summary>
+` : `
+
+**Errors**
+
+`;
+    const end = section.grouped ? `
+</details>` : "";
+    let content = "";
+    let file = "";
+    for (const diagnostic of ordered(section.diagnostics)) {
+      const group = section.grouped && file !== diagnostic.file ? `
+**${inlineCode(diagnostic.file)}**
+` : "";
+      const uncertainLocation = section.baseline && diagnostic.baselineLocationUncertain;
+      const location = uncertainLocation ? "File" : section.grouped ? `L${diagnostic.location.line}` : inlineCode(`${diagnostic.file}:${diagnostic.location.line}`);
+      const message = escapeMarkdown(diagnostic.message);
+      const description = section.baseline ? statusText("fixed", diagnostic.message) : !section.grouped ? `**${message}**` : message;
+      const entry = `${group}${group ? `
+` : ""}- ${section.icon} [${location}](${options.url(diagnostic, section.baseline)})` + ` ${description} ${inlineCode(diagnostic.rule)}` + `${options.includeDiagnosticDetails ? diagnosticDetails(diagnostic) : ""}
+`;
+      if (body.length + start.length + content.length + entry.length + end.length + reserve > limit) {
+        omitted = true;
+        continue;
+      }
+      content += entry;
+      file = diagnostic.file;
+    }
+    if (content)
+      body += start + content + end;
+  }
+  return body + (omitted ? overflow : fullLink) + footer;
+}
+function diagnosticDifference(left, right, anchors) {
+  const fingerprint = (d) => `${d.file}\x00${d.rule}\x00${d.severity}\x00${d.message}`;
+  const groups = new Map;
+  for (const diagnostic of ordered(left)) {
+    groups.set(fingerprint(diagnostic), [
+      ...groups.get(fingerprint(diagnostic)) ?? [],
+      diagnostic
+    ]);
+  }
+  const result = [];
+  for (const [key, baseline] of groups) {
+    const current = right.filter((diagnostic) => fingerprint(diagnostic) === key);
+    const matched = new Set;
+    const used = new Set;
+    if (anchors) {
+      for (const diagnostic of baseline) {
+        const anchor = anchors.left(diagnostic);
+        if (!anchor || baseline.filter((entry) => anchors.left(entry) === anchor).length !== 1) {
+          continue;
+        }
+        const candidates = current.filter((entry) => !used.has(entry) && anchors.right(entry) === anchor);
+        if (candidates.length !== 1)
+          continue;
+        matched.add(diagnostic);
+        used.add(candidates[0]);
+      }
+    }
+    const remaining = baseline.filter((entry) => !matched.has(entry));
+    const count = current.length - used.size;
+    const uncertain = count > 0 && count < remaining.length;
+    for (const diagnostic of remaining.slice(count)) {
+      result.push(uncertain ? { ...diagnostic, baselineLocationUncertain: true } : diagnostic);
+    }
+  }
+  return ordered(result);
+}
+
+// src/ci/github.ts
+import { createHash } from "crypto";
+var STATE_PREFIX = "<!-- react-luau-doctor:state:";
+var MAX_REVIEW_COMMENTS = 20;
+function assignFindings(records, analysis) {
+  const groups = new Map;
+  for (const record of records) {
+    if (!record.file) {
+      record.finding.status = "unknown";
+      continue;
+    }
+    const key = findingFingerprint({ ...record.finding, file: record.file });
+    groups.set(key, [...groups.get(key) ?? [], record]);
+  }
+  for (const [key, group] of groups) {
+    const identities = [...new Set(group.map((entry) => entry.identity))];
+    const originals = identities.map((identity) => group.find((entry) => entry.identity === identity));
+    const current = analysis.current.filter((finding) => findingFingerprint(finding) === key).map((finding) => ({ finding, used: false }));
+    const matches = new Map;
+    for (const original of originals) {
+      if (!original.finding.anchor || originals.filter((entry) => entry.finding.anchor === original.finding.anchor).length !== 1) {
+        continue;
+      }
+      const candidates = current.filter((entry) => !entry.used && entry.finding.anchor === original.finding.anchor);
+      if (candidates.length !== 1)
+        continue;
+      candidates[0].used = true;
+      matches.set(original.identity, candidates[0].finding);
+    }
+    const unmatched = originals.filter((entry) => !matches.has(entry.identity));
+    const remaining = current.filter((entry) => !entry.used);
+    const ambiguous = remaining.length > 0 && remaining.length < unmatched.length;
+    if (!ambiguous) {
+      for (const original of unmatched) {
+        const candidate = remaining.filter((entry) => !entry.used).sort((a, b) => Math.abs(a.finding.line - original.finding.line) - Math.abs(b.finding.line - original.finding.line))[0];
+        if (!candidate)
+          continue;
+        candidate.used = true;
+        matches.set(original.identity, candidate.finding);
+      }
+    }
+    for (const record of group) {
+      const match = matches.get(record.identity);
+      const potentiallyRelocated = analysis.deletedFiles?.has(record.file) && analysis.current.some((finding) => finding.file !== record.file && finding.rule === record.finding.rule && finding.severity === record.finding.severity && finding.message === record.finding.message);
+      if (match) {
+        record.finding.status = "active";
+        match.identity = record.identity;
+      } else {
+        record.finding.status = !ambiguous && !potentiallyRelocated && analysis.verifiedFiles.has(record.file) && analysis.eligible({ ...record.finding, file: record.file }) && record.state.signature === analysis.signature ? "fixed" : "unknown";
+      }
+    }
+  }
+}
+function findingFingerprint(finding) {
+  return createHash("sha256").update(`${finding.file}\x00${finding.rule}\x00${finding.severity}\x00${finding.message}`).digest("hex").slice(0, 32);
+}
+function readReviewState(body) {
+  const encoded = body.match(/<!-- react-luau-doctor:state:([A-Za-z0-9+/=]+) -->/)?.[1];
+  if (!encoded)
+    return null;
+  try {
+    const state = JSON.parse(Buffer.from(encoded, "base64").toString("utf8"));
+    if (state.version !== 1 || typeof state.commit !== "string" || typeof state.signature !== "string" || !Array.isArray(state.findings) || state.findings.length === 0 || state.findings.length > MAX_REVIEW_COMMENTS) {
+      return null;
+    }
+    if (state.findings.some((f) => !f || typeof f.file !== "string" || typeof f.rule !== "string" || typeof f.severity !== "string" || typeof f.message !== "string" || !Number.isSafeInteger(f.line) || f.line < 1 || !["active", "fixed", "unknown"].includes(f.status) || [f.anchor, f.identity, f.diagnosticId].some((value) => value !== undefined && typeof value !== "string"))) {
+      return null;
+    }
+    return state;
+  } catch {
+    return null;
+  }
+}
+function renderReviewBody(state, discussions) {
+  const fixed = state.findings.filter((finding) => finding.status === "fixed").length;
+  const unknown = state.findings.filter((finding) => finding.status === "unknown").length;
+  const progress = renderReviewProgress(state.findings.length, fixed, unknown, discussions);
+  const metadata = Buffer.from(JSON.stringify(state)).toString("base64");
+  return `${REVIEW_MARKER}
+${progress}
+
+${STATE_PREFIX}${metadata} -->`;
+}
+
+class StalePublication extends Error {
+}
+
+class GitHubClient {
+  repo;
+  pullNumber;
+  publication;
+  constructor(repo, pullNumber, publication) {
+    this.repo = repo;
+    this.pullNumber = pullNumber;
+    this.publication = publication;
+  }
+  async request(endpoint, options = {}, graphql = false) {
+    const token = process.env.GITHUB_TOKEN;
+    if (!token)
+      throw new Error("GITHUB_TOKEN is unavailable");
+    const base = (process.env.GITHUB_API_URL ?? "https://api.github.com").replace(/\/$/, "");
+    const url = graphql ? `${base.replace(/\/api\/v3$/, "/api")}/graphql` : `${base}/repos/${this.repo}${endpoint}`;
+    for (let attempt = 0;; attempt += 1) {
+      if (attempt > 0 && options.guarded)
+        await this.assertCurrent();
+      const response = await fetch(url, {
+        method: options.method ?? "GET",
+        headers: {
+          Accept: "application/vnd.github+json",
+          Authorization: `Bearer ${token}`,
+          "X-GitHub-Api-Version": "2022-11-28",
+          "User-Agent": "react-luau-doctor",
+          "Content-Type": "application/json"
+        },
+        body: options.body === undefined ? undefined : JSON.stringify(options.body),
+        signal: AbortSignal.timeout(30000)
+      });
+      const responseText = response.status === 204 ? "" : await response.text();
+      const result = response.ok && responseText ? JSON.parse(responseText) : undefined;
+      const rateLimited = response.status === 429 || response.status === 403 && (response.headers.get("x-ratelimit-remaining") === "0" || /rate limit|rate_limit|abuse detection/i.test(responseText)) || response.ok && graphql && result?.errors && /rate limit|rate_limit/i.test(responseText);
+      if (response.ok && !rateLimited) {
+        if (graphql && (result?.errors || !result?.data)) {
+          throw new Error(`GitHub GraphQL: ${responseText}`);
+        }
+        return result;
+      }
+      const retryAfter = response.headers.get("retry-after");
+      const reset = Number(response.headers.get("x-ratelimit-reset"));
+      const delay = retryAfter ? /^\d+$/.test(retryAfter) ? Number(retryAfter) * 1000 : Date.parse(retryAfter) - Date.now() : response.headers.get("x-ratelimit-remaining") === "0" && reset ? Math.max(0, reset * 1000 - Date.now() + 1000) : 60000;
+      if (!rateLimited || attempt >= 2 || !Number.isFinite(delay) || delay > 60000) {
+        throw new Error(`GitHub API ${response.status}: ${responseText}`);
+      }
+      process.stderr.write(`react-luau-doctor: GitHub API ${response.status}; retrying in ${Math.ceil(Math.max(0, delay) / 1000)} seconds
+`);
+      await new Promise((resolve) => setTimeout(resolve, Math.max(0, delay)));
+    }
+  }
+  async list(endpoint) {
+    const all = [];
+    for (let page = 1;; page++) {
+      const batch = await this.request(`${endpoint}?per_page=100&page=${page}`);
+      if (!Array.isArray(batch))
+        throw new Error("GitHub returned an invalid paginated response");
+      all.push(...batch);
+      if (batch.length < 100)
+        return all;
+    }
+  }
+  async assertCurrent() {
+    const pull = await this.request(`/pulls/${this.pullNumber}`);
+    if (pull.head?.sha !== this.publication.head || pull.base?.sha !== this.publication.base || pull.state !== "open") {
+      throw new StalePublication("PR head or baseline changed; skipping outdated publication");
+    }
+    const summaries = await this.list(`/issues/${this.pullNumber}/comments`);
+    for (const summary of summaries.filter((c) => c.user?.type === "Bot" && c.body?.startsWith(SUMMARY_MARKER))) {
+      const marker = summary.body?.match(/<!-- react-luau-doctor:run:(\d+):(\d+) -->/);
+      if (marker && this.publication.runId && (BigInt(marker[1]) > BigInt(this.publication.runId) || marker[1] === this.publication.runId && Number(marker[2]) > Number(this.publication.attempt))) {
+        throw new StalePublication("A newer workflow run already published; skipping outdated publication");
+      }
+    }
+    if (!summaries.some((c) => c.user?.type === "Bot" && c.body?.startsWith(SUMMARY_MARKER))) {
+      const reviews = await this.list(`/pulls/${this.pullNumber}/reviews`);
+      for (const review of reviews.filter((r) => r.user?.type === "Bot")) {
+        const state = readReviewState(review.body ?? "");
+        if (state?.runId && /^\d+$/.test(state.runId) && this.publication.runId && (BigInt(state.runId) > BigInt(this.publication.runId) || state.runId === this.publication.runId && Number(state.attempt) > Number(this.publication.attempt))) {
+          throw new StalePublication("A newer review run already published; skipping outdated publication");
+        }
+      }
+    }
+  }
+  async mutate(endpoint, method, body) {
+    await this.assertCurrent();
+    return this.request(endpoint, { method, body, guarded: true });
+  }
+  async sticky(body, complete = true) {
+    await this.assertCurrent();
+    const comments = await this.list(`/issues/${this.pullNumber}/comments`);
+    const previous = comments.find((c) => c.user?.type === "Bot" && c.body?.startsWith(SUMMARY_MARKER));
+    const identity = `<!-- react-luau-doctor:commit:${this.publication.head}:${this.publication.base}:complete -->`;
+    if (!complete && previous?.body?.includes(identity))
+      return;
+    const stamp = (this.publication.runId ? `
+<!-- react-luau-doctor:run:${this.publication.runId}:${this.publication.attempt} -->` : "") + `
+<!-- react-luau-doctor:commit:${this.publication.head}:${this.publication.base}:${complete ? "complete" : "incomplete"} -->`;
+    const next = body + stamp;
+    if (previous?.body === next)
+      return;
+    await this.mutate(previous ? `/issues/comments/${previous.id}` : `/issues/${this.pullNumber}/comments`, previous ? "PATCH" : "POST", { body: next });
+  }
+  async threads() {
+    const [owner, name] = this.repo.split("/");
+    const result = new Map;
+    let cursor = null;
+    for (;; ) {
+      const response = await this.request("", {
+        method: "POST",
+        body: {
+          query: `query($owner: String!, $name: String!, $number: Int!, $cursor: String) {
+              repository(owner: $owner, name: $name) {
+                pullRequest(number: $number) {
+                  reviewThreads(first: 100, after: $cursor) {
+                    nodes {
+                      isResolved
+                      comments(first: 1) {
+                        nodes { databaseId }
+                      }
+                    }
+                    pageInfo {
+                      hasNextPage
+                      endCursor
+                    }
+                  }
+                }
+              }
+            }`,
+          variables: { owner, name, number: this.pullNumber, cursor }
+        }
+      }, true);
+      const connection = response.data.repository?.pullRequest?.reviewThreads;
+      if (!connection || !Array.isArray(connection.nodes)) {
+        throw new Error("GitHub review-thread state is unavailable");
+      }
+      for (const thread of connection.nodes) {
+        const root = thread.comments.nodes[0]?.databaseId;
+        if (typeof thread.isResolved !== "boolean") {
+          throw new Error("GitHub returned an invalid review-thread resolution state");
+        }
+        if (root)
+          result.set(root, { resolved: thread.isResolved });
+      }
+      if (!connection.pageInfo.hasNextPage)
+        return result;
+      if (!connection.pageInfo.endCursor || connection.pageInfo.endCursor === cursor) {
+        throw new Error("GitHub review-thread pagination did not advance");
+      }
+      cursor = connection.pageInfo.endCursor;
+    }
+  }
+}
+function commentFingerprint(comment) {
+  if (comment.user?.type !== "Bot" || !comment.body?.startsWith(REVIEW_MARKER) || comment.in_reply_to_id) {
+    return null;
+  }
+  const marker = comment.body.match(/<!-- react-luau-doctor:fingerprint:([a-f0-9]{32}) -->/i);
+  if (marker)
+    return marker[1].toLowerCase();
+  const legacy = comment.body.match(/\*\*React-Luau Doctor\*\* \u00B7 `([^`]+)` \((error|warning|suggestion)\)\n\n([^\n]+)/);
+  return legacy ? findingFingerprint({
+    file: comment.path,
+    rule: legacy[1],
+    severity: legacy[2],
+    message: legacy[3]
+  }) : null;
+}
+function recoverReviewState(review, comments) {
+  const count = Number(review.body?.match(/(?:^|\n)(?:\*\*)?React-Luau Doctor found (\d+) new issues?(?:\*\*)?(?:\n|$)/)?.[1]);
+  const roots = comments.filter((comment) => comment.pull_request_review_id === review.id && !comment.in_reply_to_id);
+  if (!count || count > MAX_REVIEW_COMMENTS || roots.length !== count)
+    return null;
+  const commit = review.commit_id ?? roots[0]?.original_commit_id ?? roots[0]?.commit_id;
+  if (!commit)
+    return null;
+  const findings = [];
+  for (const comment of roots) {
+    const diagnostic = comment.body?.match(/\*\*React-Luau Doctor\*\* \u00B7 `([^`]+)` \((error|warning|suggestion)\)\n\n([^\n]+)/);
+    const line = comment.original_line ?? comment.line;
+    if (!diagnostic || !Number.isSafeInteger(line) || line < 1)
+      return null;
+    const finding = {
+      file: comment.path,
+      rule: diagnostic[1],
+      severity: diagnostic[2],
+      message: diagnostic[3],
+      line,
+      identity: `legacy:${review.id}:${comment.id}`,
+      status: "unknown"
+    };
+    if (commentFingerprint(comment) !== findingFingerprint(finding))
+      return null;
+    findings.push(finding);
+  }
+  return { version: 1, commit, signature: "", findings };
+}
+function prioritizedFindings(candidates) {
+  const severity = { error: 0, warning: 1, suggestion: 2 };
+  const counts = new Map;
+  return [...candidates].sort((a, b) => a.finding.file.localeCompare(b.finding.file) || a.finding.line - b.finding.line || a.diagnostic.id.localeCompare(b.diagnostic.id)).map((candidate) => {
+    const key = `${candidate.finding.severity}\x00${candidate.finding.file}`;
+    const round = counts.get(key) ?? 0;
+    counts.set(key, round + 1);
+    return { candidate, round };
+  }).sort((a, b) => severity[a.candidate.diagnostic.severity] - severity[b.candidate.diagnostic.severity] || a.round - b.round || a.candidate.finding.file.localeCompare(b.candidate.finding.file)).map(({ candidate }) => candidate);
+}
+async function reviewSnapshot(client) {
+  const [reviews, comments] = await Promise.all([
+    client.list(`/pulls/${client.pullNumber}/reviews`),
+    client.list(`/pulls/${client.pullNumber}/comments`)
+  ]);
+  return { reviews, comments };
+}
+async function reconcileReviews(client, snapshot, analysis, canInline) {
+  if (!analysis.complete)
+    return snapshot.comments.filter((c) => commentFingerprint(c)).length;
+  const ownedReviews = snapshot.reviews.filter((r) => r.user?.type === "Bot" && (r.body?.startsWith(REVIEW_MARKER) || /^(?:\*\*)?React-Luau Doctor found (?:\d+ )?new issues?(?:\*\*)?$/.test(r.body ?? "") || r.body?.startsWith("\u2705 React-Luau Doctor: findings from this review are no longer current")));
+  let threads;
+  try {
+    threads = await client.threads();
+  } catch (error) {
+    process.stderr.write(`react-luau-doctor: could not read review threads; preserving discussions: ${error instanceof Error ? error.message : String(error)}
+`);
+  }
+  const states = new Map;
+  const records = [];
+  for (const review of ownedReviews) {
+    const original = readReviewState(review.body ?? "") ?? recoverReviewState(review, snapshot.comments);
+    if (!original)
+      continue;
+    const state = { ...original, findings: original.findings.map((finding) => ({ ...finding })) };
+    states.set(review.id, state);
+    for (const finding of state.findings) {
+      const identity = finding.identity ?? `${state.commit}:${findingFingerprint(finding)}:${finding.line}`;
+      finding.identity = identity;
+      records.push({
+        state,
+        finding,
+        identity,
+        file: analysis.canonicalFile(finding.file, state.commit)
+      });
+    }
+  }
+  assignFindings(records, analysis);
+  for (const state of states.values()) {
+    if (state.signature !== "")
+      continue;
+    if (state.findings.every((finding) => {
+      const file = analysis.canonicalFile(finding.file, state.commit);
+      return finding.status === "active" && file && analysis.verifiedFiles.has(file) && analysis.eligible({ ...finding, file });
+    })) {
+      state.signature = analysis.signature;
+    }
+  }
+  const represented = new Map;
+  const representedIdentities = new Set;
+  const failures = [];
+  const updates = [];
+  let inlineCount = snapshot.comments.filter((c) => commentFingerprint(c)).length;
+  for (const review of ownedReviews.sort((a, b) => a.id - b.id)) {
+    const state = states.get(review.id);
+    if (!state) {
+      const retained = snapshot.comments.filter((comment) => comment.pull_request_review_id === review.id && commentFingerprint(comment)).length;
+      const body = `${REVIEW_MARKER}
+**React-Luau Doctor \xB7 earlier findings**
+
+` + `${retained ? `${issueCount(retained)} retained inline \xB7 ` : ""}` + "Original finding history unavailable \xB7 See the current PR report";
+      updates.push({ review, body, cleanup: [] });
+      continue;
+    }
+    let discussions = threads ? 0 : undefined;
+    const ownedComments = snapshot.comments.filter((c) => c.pull_request_review_id === review.id && commentFingerprint(c));
+    const consumedComments = new Set;
+    const cleanup = [];
+    for (const finding of state.findings) {
+      const file = analysis.canonicalFile(finding.file, state.commit);
+      const fingerprint = findingFingerprint(finding);
+      const comments = ownedComments.filter((c) => !consumedComments.has(c.id) && commentFingerprint(c) === fingerprint).sort((a, b) => Math.abs((a.original_line ?? a.line ?? finding.line) - finding.line) - Math.abs((b.original_line ?? b.line ?? finding.line) - finding.line));
+      const comment = comments[0];
+      if (comment)
+        consumedComments.add(comment.id);
+      const replies = comment ? snapshot.comments.filter((c) => c.in_reply_to_id === comment.id) : [];
+      const discussion = comment && replies.length > 0;
+      if (discussion && threads) {
+        const thread = threads.get(comment.id);
+        if (!thread || typeof thread.resolved !== "boolean")
+          discussions = undefined;
+        else if (!thread.resolved && discussions !== undefined)
+          discussions++;
+      }
+      const key = findingFingerprint({ ...finding, file: file ?? finding.file });
+      if ((finding.status === "active" && comment || finding.status === "unknown") && !representedIdentities.has(finding.identity)) {
+        represented.set(key, (represented.get(key) ?? 0) + 1);
+        representedIdentities.add(finding.identity);
+      }
+      if (comment && finding.status === "fixed" && !discussion && threads?.has(comment.id)) {
+        cleanup.push(comment);
+      }
+    }
+    const body = renderReviewBody(state, discussions);
+    if (body !== review.body) {
+      state.runId = client.publication.runId;
+      state.attempt = client.publication.attempt;
+    }
+    updates.push({
+      review,
+      body: body === review.body ? body : renderReviewBody(state, discussions),
+      cleanup
+    });
+  }
+  for (const comment of snapshot.comments) {
+    if (!commentFingerprint(comment) || states.has(comment.pull_request_review_id))
+      continue;
+    const key = commentFingerprint(comment);
+    represented.set(key, (represented.get(key) ?? 0) + 1);
+  }
+  const selected = [];
+  const candidates = [];
+  const alreadyPublished = [...states.values()].filter((state) => state.commit === client.publication.head).reduce((count, state) => count + state.findings.length, 0);
+  for (const candidate of analysis.introduced) {
+    const key = findingFingerprint(candidate.finding);
+    const count = represented.get(key) ?? 0;
+    if (count) {
+      represented.set(key, count - 1);
+      continue;
+    }
+    if (!canInline(candidate.diagnostic))
+      continue;
+    candidates.push(candidate);
+  }
+  for (const candidate of prioritizedFindings(candidates)) {
+    const key = findingFingerprint(candidate.finding);
+    if (selected.length + alreadyPublished >= MAX_REVIEW_COMMENTS)
+      break;
+    const current = analysis.current.find((finding) => findingFingerprint(finding) === key && (candidate.finding.diagnosticId ? finding.diagnosticId === candidate.finding.diagnosticId : finding.line === candidate.finding.line && finding.column === candidate.finding.column));
+    candidate.finding.identity = current?.identity ?? `${client.publication.head}:${key}:${candidate.diagnostic.id}`;
+    const nextState = {
+      version: 1,
+      signature: analysis.signature,
+      commit: client.publication.head,
+      findings: [...selected, candidate].map((entry) => entry.finding)
+    };
+    if (renderReviewBody(nextState, 0).length > MAX_COMMENT_LENGTH || inlineBody(candidate.finding, candidate.diagnostic).length > MAX_COMMENT_LENGTH) {
+      continue;
+    }
+    selected.push(candidate);
+  }
+  let publicationSucceeded = true;
+  if (selected.length) {
+    const state = {
+      version: 1,
+      commit: client.publication.head,
+      signature: analysis.signature,
+      runId: client.publication.runId,
+      attempt: client.publication.attempt,
+      findings: selected.map((entry) => entry.finding)
+    };
+    const comments = selected.map(({ finding, diagnostic }) => ({
+      path: finding.file,
+      line: finding.line,
+      side: "RIGHT",
+      body: inlineBody(finding, diagnostic)
+    }));
+    try {
+      await client.mutate(`/pulls/${client.pullNumber}/reviews`, "POST", {
+        commit_id: client.publication.head,
+        event: "COMMENT",
+        body: renderReviewBody(state, 0),
+        comments
+      });
+      inlineCount += comments.length;
+    } catch (error) {
+      if (error instanceof StalePublication)
+        throw error;
+      publicationSucceeded = false;
+      failures.push(`could not create new review comments: ${String(error)}`);
+    }
+  }
+  for (const { review, body, cleanup } of updates) {
+    try {
+      if (body !== review.body) {
+        await client.mutate(`/pulls/${client.pullNumber}/reviews/${review.id}`, "PUT", { body });
+      }
+      if (!publicationSucceeded)
+        continue;
+      for (const comment of cleanup) {
+        const latest = await client.list(`/pulls/${client.pullNumber}/comments`);
+        if (latest.some((entry) => entry.in_reply_to_id === comment.id))
+          continue;
+        if (!latest.some((entry) => entry.id === comment.id))
+          continue;
+        await client.mutate(`/pulls/comments/${comment.id}`, "DELETE");
+        inlineCount--;
+      }
+    } catch (error) {
+      if (error instanceof StalePublication)
+        throw error;
+      failures.push(`could not update review ${review.id}: ${String(error)}`);
+    }
+  }
+  if (failures.length) {
+    process.stderr.write(`react-luau-doctor: could not update inline review comments: ${failures.join("; ")}
+`);
+  }
+  return inlineCount;
+}
+function inlineBody(finding, diagnostic) {
+  const details = [diagnostic.help, diagnostic.explanation, diagnostic.caveat].filter((value) => Boolean(value) && value !== finding.message);
+  const header = `${REVIEW_MARKER}
+<!-- react-luau-doctor:fingerprint:${findingFingerprint(finding)} -->`;
+  const title = `**React-Luau Doctor** \xB7 ${inlineCode(finding.rule)} (${finding.severity})`;
+  const guidance = [...new Set(details)].map((detail) => `
+
+${escapeMarkdown(detail)}`).join("");
+  return `${header}
+${title}
+
+${escapeMarkdown(finding.message)}${guidance}`;
+}
+
+// src/scope.ts
+import path10 from "path";
+
+// src/scanner.ts
+import fs8 from "fs";
+import path9 from "path";
+
+// src/cache.ts
+import crypto from "crypto";
+import fs4 from "fs";
+import os from "os";
+import path5 from "path";
+import { fileURLToPath } from "url";
+var MAX_CACHED_REPORTS = 8;
+function normalizeRelative2(value) {
+  return value.split(path5.sep).join("/");
+}
+function hashText(value) {
+  return crypto.createHash("sha256").update(value).digest("hex");
+}
+var analyzerHashes = new Map;
+function hashAnalyzerFile(hash, root, filename) {
+  if (!fs4.existsSync(filename))
+    return;
+  hash.update(normalizeRelative2(path5.relative(root, filename)));
+  hash.update("\x00");
+  hash.update(fs4.readFileSync(filename));
+  hash.update("\x00");
 }
 function sourceFiles(directory) {
   if (!fs4.existsSync(directory))
@@ -9251,7 +10381,8 @@ function previousCachedReport(session, key) {
   return {
     scannedFiles: report.scannedFiles,
     candidateFiles: report.candidateFiles,
-    diagnostics: report.diagnostics
+    diagnostics: report.diagnostics,
+    unverifiedFiles: report.unverifiedFiles
   };
 }
 function cachedReport(session, key) {
@@ -9263,7 +10394,8 @@ function cachedReport(session, key) {
   return {
     scannedFiles: report.scannedFiles,
     candidateFiles: report.candidateFiles,
-    diagnostics: report.diagnostics
+    diagnostics: report.diagnostics,
+    unverifiedFiles: report.unverifiedFiles
   };
 }
 function cacheHasSameFileSet(session) {
@@ -10124,6 +11256,7 @@ async function analyzeReactFile(input, tree, selectedRules = rules) {
       project: input.project
     };
     const context = createRuleContext(file);
+    const syntaxFindings = parsedTree.rootNode.hasError ? parseErrors.run(context) : [];
     const categorySet = input.categories && input.categories.length > 0 ? new Set(input.categories) : null;
     const isSuppressed = input.respectInlineDisables ? createInlineSuppressionChecker(input.source) : () => false;
     const diagnostics = [];
@@ -10135,7 +11268,7 @@ async function analyzeReactFile(input, tree, selectedRules = rules) {
       const severity = effectiveSeverity(rule.severity, rule.id, input.config);
       if (!severity)
         continue;
-      const findings = rule.run(context);
+      const findings = rule.id === parseErrors.id ? syntaxFindings : rule.run(context);
       for (const finding of findings) {
         const configuredSeverity = input.config.rules?.[rule.id];
         const diagnostic = toDiagnostic(file, rule.id, rule.category, severity, {
@@ -10156,7 +11289,8 @@ async function analyzeReactFile(input, tree, selectedRules = rules) {
       relativePath: input.relativePath,
       isReactFile: model.isReactFile,
       scanned: true,
-      diagnostics: filteredDiagnostics
+      diagnostics: filteredDiagnostics,
+      unverified: syntaxFindings.length > 0
     };
   } finally {
     if (!tree)
@@ -12483,7 +13617,8 @@ async function scanPath(target = ".", options = {}) {
         counts: countDiagnostics(reportHit.diagnostics),
         diagnostics: reportHit.diagnostics,
         partial: false,
-        skippedFiles: []
+        skippedFiles: [],
+        unverifiedFiles: reportHit.unverifiedFiles
       };
     }
   }
@@ -12538,6 +13673,7 @@ async function scanPath(target = ".", options = {}) {
       options.analysisSession.effectModules = cacheSession.effectModules ?? previousEffectModules;
     const diagnostics = [];
     const skippedFiles = [];
+    const unverifiedFiles = [];
     let scannedFiles = 0;
     let scanCandidates = candidates;
     let incrementalReuse = false;
@@ -12545,6 +13681,7 @@ async function scanPath(target = ".", options = {}) {
     if (canCacheWholeReport && previousReport && previousProject && cacheHasSameFileSet(cacheSession) && projectModelFeatureKey(previousProject) === projectModelFeatureKey(project)) {
       const affectedFiles = transitiveAffectedFiles(changedFiles, previousEffectModules, currentEffectModules);
       diagnostics.push(...previousReport.diagnostics.filter((diagnostic) => !affectedFiles.has(normalizeRelative4(diagnostic.file))));
+      unverifiedFiles.push(...(previousReport.unverifiedFiles ?? []).filter((file) => !affectedFiles.has(normalizeRelative4(file))));
       scanCandidates = candidates.filter((candidate) => {
         const relativePath = normalizeRelative4(candidate.relativePath ?? path9.relative(root, candidate.absolutePath));
         return affectedFiles.has(relativePath);
@@ -12559,6 +13696,8 @@ async function scanPath(target = ".", options = {}) {
       if (result.scanned)
         scannedFiles += 1;
       diagnostics.push(...result.diagnostics);
+      if (result.unverified)
+        unverifiedFiles.push(result.relativePath);
     };
     const prepareCandidate = (candidate) => {
       const relativePath = normalizeRelative4(candidate.relativePath ?? path9.relative(root, candidate.absolutePath));
@@ -12644,13 +13783,15 @@ async function scanPath(target = ".", options = {}) {
       counts: countDiagnostics(diagnostics),
       diagnostics,
       partial: skippedFiles.length > 0,
-      skippedFiles
+      skippedFiles,
+      unverifiedFiles: unverifiedFiles.length ? [...new Set(unverifiedFiles)].sort() : undefined
     };
     if (canPersistCache)
       saveProjectCache(cacheSession, project, cacheSession.effectModules ?? cachedEffectModules(cacheSession), canCacheWholeReport && !report.partial ? reportCacheKey : undefined, canCacheWholeReport && !report.partial ? {
         scannedFiles: report.scannedFiles,
         candidateFiles: report.candidateFiles ?? candidates.length,
-        diagnostics: report.diagnostics
+        diagnostics: report.diagnostics,
+        unverifiedFiles: report.unverifiedFiles
       } : undefined);
     return report;
   } finally {
@@ -12732,24 +13873,29 @@ async function scanProjectWithScope(projectRoot, options) {
   let diagnostics = current.diagnostics;
   let partial = current.partial;
   let skippedFiles = current.skippedFiles;
+  let unverifiedFiles = current.unverifiedFiles;
   if (effectiveScope === "changed") {
     const baseline = await scanPath(targetRoot, {
       ...sharedScanOptions(scanOptions, projectRoot, "baseline"),
       files: plan.baselineFiles
     });
-    options.onDelta?.(current.diagnostics, baseline.diagnostics);
+    options.onDelta?.(current.diagnostics, baseline.diagnostics, { current, baseline, plan });
     const baselineSkipped = new Set(baseline.skippedFiles ?? []);
     const baselinePaths = new Set(plan.baselineFiles.map((file) => file.relativePath ?? ""));
     const comparableCurrent = current.diagnostics.filter((diagnostic) => !baselinePaths.has(diagnostic.file) || !baselineSkipped.has(diagnostic.file));
     diagnostics = introducedDiagnostics(comparableCurrent, baseline.diagnostics);
     partial = partial || Boolean(baseline.partial);
     skippedFiles = [...new Set([...current.skippedFiles ?? [], ...baseline.skippedFiles ?? []])].sort();
+    unverifiedFiles = [
+      ...new Set([...current.unverifiedFiles ?? [], ...baseline.unverifiedFiles ?? []])
+    ].sort();
   } else if (effectiveScope === "lines") {
     diagnostics = current.diagnostics.filter((diagnostic) => touchesChangedLines(diagnostic, plan.changedLines.get(diagnostic.file) ?? []));
   }
   return rebuildReport(current, diagnostics, {
     partial,
     skippedFiles,
+    unverifiedFiles,
     scope: options.staged ? "staged" : effectiveScope,
     base: plan.base,
     changedFiles: plan.changedFiles
@@ -12767,6 +13913,7 @@ function aggregateReports(root, reports) {
   const startedDuration = reports.reduce((total, entry) => total + entry.report.durationMs, 0);
   const diagnostics = [];
   const skippedFiles = [];
+  const unverifiedFiles = [];
   const changedFiles = [];
   const notes = [];
   const projects = [];
@@ -12781,6 +13928,7 @@ function aggregateReports(root, reports) {
     partial = partial || Boolean(report.partial);
     diagnostics.push(...report.diagnostics.map((diagnostic) => prefixDiagnostic(diagnostic, prefix)));
     skippedFiles.push(...(report.skippedFiles ?? []).map((file) => prefix ? normalize3(path10.posix.join(prefix, file)) : file));
+    unverifiedFiles.push(...(report.unverifiedFiles ?? []).map((file) => prefix ? normalize3(path10.posix.join(prefix, file)) : file));
     changedFiles.push(...(report.changedFiles ?? []).map((file) => prefix ? normalize3(path10.posix.join(prefix, file)) : file));
     notes.push(...report.notes ?? []);
   }
@@ -12801,6 +13949,7 @@ function aggregateReports(root, reports) {
     diagnostics,
     partial,
     skippedFiles: [...new Set(skippedFiles)].sort(),
+    unverifiedFiles: unverifiedFiles.length ? [...new Set(unverifiedFiles)].sort() : undefined,
     scope: scopes.size === 1 ? [...scopes][0] : undefined,
     base: bases.size === 1 ? [...bases][0] : undefined,
     changedFiles: [...new Set(changedFiles)].sort(),
@@ -12809,7 +13958,7 @@ function aggregateReports(root, reports) {
   };
 }
 
-// src/ci.ts
+// src/ci/index.ts
 var DEFAULT_SETTINGS = {
   provider: "github",
   blocking: "none",
@@ -12822,11 +13971,6 @@ var DEFAULT_SETTINGS = {
 };
 var GITHUB_WORKFLOW = path11.join(".github", "workflows", "react-luau-doctor.yml");
 var GITLAB_WORKFLOW = ".gitlab-ci.yml";
-var SUMMARY_MARKER = "<!-- react-luau-doctor:summary -->";
-var REVIEW_MARKER = "<!-- react-luau-doctor:review -->";
-var MAX_REVIEW_COMMENTS = 20;
-var MAX_GITHUB_RETRIES = 2;
-var MAX_RATE_LIMIT_WAIT_MS = 60000;
 var PACKAGE_SPEC = `${package_default.name}@${package_default.version}`;
 function yamlString(value) {
   return JSON.stringify(value);
@@ -12855,6 +13999,8 @@ jobs:
       - uses: actions/checkout@v5
         with:
           fetch-depth: 0
+          ref: \${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: "1.4.0"
@@ -12874,6 +14020,12 @@ jobs:
           ${settings.comment ? "--comment" : "--no-comment"}
           ${settings.reviewComments ? "--review-comments" : "--no-review-comments"}
           ${settings.commitStatus ? "--commit-status" : "--no-commit-status"}
+      - name: Upload full Doctor report
+        if: always() && steps.doctor.outputs.report-path != ''
+        uses: actions/upload-artifact@v4
+        with:
+          name: react-luau-doctor-report
+          path: \${{ steps.doctor.outputs.report-path }}
 `;
 }
 function renderGitLabWorkflow(settings) {
@@ -12888,6 +14040,8 @@ react-luau-doctor:
     DOCTOR_DIRECTORY: ${yamlString(settings.directory)}
     DOCTOR_SCOPE: ${yamlString(settings.scope)}
     DOCTOR_BLOCKING: ${yamlString(settings.blocking)}
+  before_script:
+    - apt-get update -qq && apt-get install -y --no-install-recommends git
   script:
     - 'bunx --bun ${PACKAGE_SPEC} "$DOCTOR_DIRECTORY" --scope "$DOCTOR_SCOPE" --blocking "$DOCTOR_BLOCKING" --no-color'
 `;
@@ -12900,8 +14054,9 @@ function parseBoolean(value, name) {
   throw new Error(`${name} must be true or false`);
 }
 function parseBlocking(value) {
-  if (value !== "error" && value !== "warning" && value !== "none")
+  if (value !== "error" && value !== "warning" && value !== "none") {
     throw new Error("--blocking must be error, warning, or none");
+  }
   return value;
 }
 function parseScope(value) {
@@ -12911,8 +14066,9 @@ function parseScope(value) {
   return value;
 }
 function parseProvider(value) {
-  if (value !== "github" && value !== "gitlab")
+  if (value !== "github" && value !== "gitlab") {
     throw new Error("--provider must be github or gitlab");
+  }
   return value;
 }
 function nextValue(argv, index, flag) {
@@ -12969,7 +14125,9 @@ function parseManagedWorkflowSettings(filename) {
     return {};
   const text = fs9.readFileSync(filename, "utf8");
   const match = (name) => text.match(new RegExp(`^\\s*${name}:\\s*(.+?)\\s*$`, "m"))?.[1]?.replace(/^['"]|['"]$/g, "");
-  const result = { provider: filename.endsWith(".gitlab-ci.yml") ? "gitlab" : "github" };
+  const result = {
+    provider: filename.endsWith(".gitlab-ci.yml") ? "gitlab" : "github"
+  };
   const blocking = match("DOCTOR_BLOCKING") ?? match("blocking");
   const scope = match("DOCTOR_SCOPE") ?? match("scope");
   const project = match("DOCTOR_PROJECT") ?? match("project");
@@ -13060,15 +14218,23 @@ function runCommand(cwd, command, args, allowFailure = false) {
 }
 function openPullRequest(cwd, files, action) {
   findGitRoot(cwd);
-  if (!runCommand(cwd, "gh", ["--version"], true))
+  if (!runCommand(cwd, "gh", ["--version"], true)) {
     throw new Error("--pr requires the GitHub CLI (gh) to be installed and authenticated");
+  }
   const branch = action === "install" ? "chore/add-react-luau-doctor-ci" : "chore/upgrade-react-luau-doctor-ci";
   const title = action === "install" ? "Add React-Luau Doctor CI" : "Upgrade React-Luau Doctor CI";
   runCommand(cwd, "git", ["switch", "-c", branch]);
   runCommand(cwd, "git", ["add", "--", ...files.map((file) => path11.relative(cwd, file))]);
   runCommand(cwd, "git", ["commit", "-m", title]);
   runCommand(cwd, "git", ["push", "-u", "origin", branch]);
-  const url = runCommand(cwd, "gh", ["pr", "create", "--title", title, "--body", "Adds React-Luau Doctor pull request analysis."]);
+  const url = runCommand(cwd, "gh", [
+    "pr",
+    "create",
+    "--title",
+    title,
+    "--body",
+    "Adds React-Luau Doctor pull request analysis."
+  ]);
   process.stdout.write(`${url}
 `);
 }
@@ -13084,80 +14250,296 @@ async function runCiManage(action, argv) {
       return;
   }
   const files = writeManagedCi(options.cwd, settings);
-  for (const filename of files)
+  for (const filename of files) {
     process.stdout.write(`${action === "install" ? "Installed" : action === "config" ? "Updated" : "Upgraded"} ${path11.relative(options.cwd, filename)}
 `);
+  }
   if (options.pr)
     openPullRequest(options.cwd, files, action === "install" ? "install" : "upgrade");
 }
-function diagnosticFingerprint2(diagnostic) {
-  return `${diagnostic.file}\x00${diagnostic.rule}\x00${diagnostic.severity}\x00${diagnostic.message}`;
-}
-function countDifference(left, right) {
-  const counts = new Map;
-  for (const diagnostic of right) {
-    const key = diagnosticFingerprint2(diagnostic);
-    counts.set(key, (counts.get(key) ?? 0) + 1);
-  }
-  let difference = 0;
-  for (const diagnostic of left) {
-    const key = diagnosticFingerprint2(diagnostic);
-    const remaining = counts.get(key) ?? 0;
-    if (remaining > 0)
-      counts.set(key, remaining - 1);
-    else
-      difference += 1;
-  }
-  return difference;
-}
-async function fixedIssueCount(directory, base) {
-  const plan = createGitScopePlan(directory, { scope: "changed", base });
-  if (plan.currentFiles.length === 0 && plan.baselineFiles.length === 0)
-    return 0;
-  const config = loadConfigWithSource(directory).config;
-  const selected = (file) => isSelectedLuauPath(file.relativePath ?? "", config);
-  const current = await scanPath(directory, { files: plan.currentFiles.filter(selected), config, categories: config.categories });
-  const baseline = await scanPath(directory, { files: plan.baselineFiles.filter(selected), config, categories: config.categories });
-  return countDifference(baseline.diagnostics, current.diagnostics);
-}
 function resolveCiProjectRoots(directory, project) {
   if (!project || project === "*")
     return [directory];
   return project.split(",").map((entry) => {
     const resolved = path11.resolve(directory, entry.trim());
-    if (!fs9.existsSync(resolved) || !fs9.statSync(resolved).isDirectory())
+    if (!fs9.existsSync(resolved) || !fs9.statSync(resolved).isDirectory()) {
       throw new Error(`Could not find project: ${entry}`);
+    }
     return resolved;
   });
 }
-async function scanForCi(settings, eventName, base, onFixed) {
-  const directory = path11.resolve(process.cwd(), settings.directory);
-  const isPullRequest = eventName === "pull_request";
-  const scope = isPullRequest ? settings.scope : "full";
+function gitResult(directory, args) {
+  const result = spawnSync2(gitExecutable, args, {
+    cwd: directory,
+    encoding: "utf8",
+    windowsHide: true,
+    maxBuffer: 64 * 1024 * 1024
+  });
+  return result.status === 0 ? result.stdout : null;
+}
+function renameResolver(directory, head) {
+  const cache = new Map;
+  return (file, commit) => {
+    if (!commit)
+      return file;
+    if (!cache.has(commit)) {
+      const diff = gitResult(directory, [
+        "diff",
+        "--name-status",
+        "-z",
+        "--find-renames",
+        commit,
+        head
+      ]);
+      const renames = new Map;
+      if (diff !== null) {
+        const fields = diff.split("\x00");
+        for (let i = 0;i < fields.length && fields[i]; ) {
+          const status = fields[i++];
+          const oldPath = fields[i++];
+          if (/^[RC]/.test(status)) {
+            const newPath = fields[i++];
+            if (status.startsWith("R"))
+              renames.set(oldPath, newPath);
+          }
+        }
+      }
+      cache.set(commit, diff === null ? null : renames);
+    }
+    const renames = cache.get(commit);
+    return renames ? renames.get(file) ?? file : null;
+  };
+}
+async function scanForCi(settings, isPullRequest, base, head, snapshot) {
+  const directory = path11.resolve(settings.directory);
+  const repoRoot = isPullRequest ? findGitRoot(directory) : directory;
   const roots = resolveCiProjectRoots(directory, settings.project);
+  const canonicalFile = renameResolver(repoRoot, head);
+  const historicalFiles = new Set;
+  for (const review of snapshot?.reviews ?? []) {
+    const state = readReviewState(review.body ?? "");
+    if (!state)
+      continue;
+    for (const finding of state.findings) {
+      const file = canonicalFile(finding.file, state.commit);
+      if (file)
+        historicalFiles.add(file);
+    }
+  }
+  for (const comment of snapshot?.comments ?? []) {
+    if (comment.user?.type === "Bot" && comment.body?.startsWith("<!-- react-luau-doctor:review -->")) {
+      const file = canonicalFile(comment.path, comment.commit_id ?? "");
+      if (file)
+        historicalFiles.add(file);
+    }
+  }
   const reports = [];
-  for (const projectRoot of roots) {
-    const config = loadConfigWithSource(projectRoot).config;
-    const report = await scanProjectWithScope(projectRoot, {
-      scope,
+  const comparisons = [];
+  const currentDiagnostics = [];
+  const fixed = [];
+  const verifiedFiles = new Set;
+  const deletedFiles = new Set;
+  const uncertainFiles = new Set;
+  const unverifiedFiles = new Set;
+  const verificationSkippedFiles = new Set;
+  const configs = roots.map((root) => ({ root, config: loadConfigWithSource(root).config }));
+  const signature = createHash2("sha256").update(JSON.stringify({
+    version: package_default.version,
+    configs: configs.map(({ root, config }) => ({
+      root: path11.relative(directory, root),
+      config
+    }))
+  })).digest("hex");
+  let complete = true;
+  let potentiallyRelocated = false;
+  const normalize = (file) => file.split(path11.sep).join("/");
+  const relativeFile = (file, root) => normalize(path11.relative(directory, path11.resolve(root, file)));
+  const rebaseDiagnostic = (diagnostic, root) => ({
+    ...diagnostic,
+    file: relativeFile(diagnostic.file, root)
+  });
+  for (const { root: projectRoot, config } of configs) {
+    const sources = new Map;
+    const eligibleFiles = new Set;
+    const scope = isPullRequest ? settings.scope : "full";
+    const comparisonOptions = {
+      scope: "changed",
       base,
+      config,
       minSeverity: "suggestion",
       categories: config.categories,
       respectInlineDisables: config.respectInlineDisables ?? true,
-      onDelta: onFixed ? (current, baseline) => onFixed(countDifference(baseline, current)) : undefined
-    });
+      onDelta: (current, baseline, context) => {
+        complete &&= !context.current.partial && !context.baseline.partial && !context.current.unverifiedFiles?.length && !context.baseline.unverifiedFiles?.length;
+        for (const file of [
+          ...context.current.unverifiedFiles ?? [],
+          ...context.baseline.unverifiedFiles ?? []
+        ]) {
+          unverifiedFiles.add(relativeFile(file, projectRoot));
+        }
+        const skipped = new Set([
+          ...context.current.skippedFiles ?? [],
+          ...context.baseline.skippedFiles ?? []
+        ]);
+        const currentFiles = new Set(context.plan.currentFiles.map((file) => file.relativePath));
+        for (const file of context.plan.changedFiles) {
+          const repoFile = repoRelativeDiagnosticPath(projectRoot, file, repoRoot);
+          eligibleFiles.add(repoFile);
+          if (!currentFiles.has(file))
+            deletedFiles.add(repoFile);
+          if (!skipped.has(file))
+            verifiedFiles.add(repoFile);
+        }
+        for (const input of context.plan.currentFiles) {
+          if (input.relativePath && input.source !== undefined) {
+            sources.set(repoRelativeDiagnosticPath(projectRoot, input.relativePath, repoRoot), input.source);
+          }
+        }
+        for (const diagnostic of current) {
+          currentDiagnostics.push(rebaseDiagnostic(diagnostic, projectRoot));
+        }
+        if (complete) {
+          const baselineSources = new Map(context.plan.baselineFiles.map((file) => [
+            file.relativePath,
+            file.source?.split(/\r?\n/) ?? []
+          ]));
+          const currentSources = new Map(context.plan.currentFiles.map((file) => [
+            file.relativePath,
+            file.source?.split(/\r?\n/) ?? []
+          ]));
+          for (const diagnostic of diagnosticDifference(baseline, current, {
+            left: (entry) => baselineSources.get(entry.file)?.[entry.location.line - 1]?.trim() ?? "",
+            right: (entry) => currentSources.get(entry.file)?.[entry.location.line - 1]?.trim() ?? ""
+          })) {
+            if (!currentFiles.has(diagnostic.file) && current.some((entry) => entry.file !== diagnostic.file && entry.rule === diagnostic.rule && entry.severity === diagnostic.severity && entry.message === diagnostic.message)) {
+              potentiallyRelocated = true;
+              continue;
+            }
+            const oldFile = context.plan.baselinePaths.get(diagnostic.file) ?? diagnostic.file;
+            const oldSource = context.plan.baselineFiles.find((file) => file.relativePath === diagnostic.file)?.source ?? "";
+            const newSource = sources.get(repoRelativeDiagnosticPath(projectRoot, diagnostic.file, repoRoot)) ?? "";
+            const directives = (source) => source.split(/\r?\n/).filter((line) => /react-luau-doctor.*(?:disable|ignore)/i.test(line)).join(`
+`);
+            if (directives(oldSource) !== directives(newSource))
+              continue;
+            fixed.push({
+              ...rebaseDiagnostic({ ...diagnostic, file: oldFile }, projectRoot),
+              ...diagnostic.baselineLocationUncertain ? { baselineLocationUncertain: true } : {}
+            });
+          }
+        }
+      }
+    };
+    const report = await scanProjectWithScope(projectRoot, { ...comparisonOptions, scope });
     reports.push({ projectRoot, report });
+    for (const file of report.unverifiedFiles ?? []) {
+      unverifiedFiles.add(relativeFile(file, projectRoot));
+    }
+    complete &&= !report.partial && !report.unverifiedFiles?.length;
+    if (isPullRequest && base) {
+      const comparison = scope === "changed" ? report : await scanProjectWithScope(projectRoot, comparisonOptions);
+      comparisons.push({ projectRoot, report: comparison });
+      const extraFiles = [];
+      for (const file of historicalFiles) {
+        const absolutePath = path11.resolve(repoRoot, file);
+        const relativePath = normalize(path11.relative(projectRoot, absolutePath));
+        if (relativePath.startsWith("../") || path11.isAbsolute(relativePath) || !isSelectedLuauPath(relativePath, config) || eligibleFiles.has(file)) {
+          continue;
+        }
+        eligibleFiles.add(file);
+        if (!fs9.existsSync(absolutePath)) {
+          const existsAtHead = gitResult(repoRoot, ["ls-tree", "-z", head, "--", file]);
+          if (existsAtHead === "") {
+            verifiedFiles.add(file);
+            deletedFiles.add(file);
+          }
+          continue;
+        }
+        const source = fs9.readFileSync(absolutePath, "utf8");
+        sources.set(file, source);
+        extraFiles.push({ absolutePath, relativePath, source });
+      }
+      if (extraFiles.length) {
+        const extra = await scanPath(projectRoot, {
+          files: extraFiles,
+          projectRoot,
+          config,
+          categories: config.categories
+        });
+        complete &&= !extra.partial && !extra.unverifiedFiles?.length;
+        for (const file of extra.unverifiedFiles ?? []) {
+          unverifiedFiles.add(relativeFile(file, projectRoot));
+        }
+        for (const file of extra.skippedFiles ?? []) {
+          verificationSkippedFiles.add(relativeFile(file, projectRoot));
+        }
+        for (const file of extraFiles) {
+          if (!extra.skippedFiles?.includes(file.relativePath)) {
+            verifiedFiles.add(repoRelativeDiagnosticPath(projectRoot, file.relativePath, repoRoot));
+          }
+        }
+        currentDiagnostics.push(...extra.diagnostics.map((diagnostic) => rebaseDiagnostic(diagnostic, projectRoot)));
+      }
+    }
+    for (const [file, source] of sources) {
+      if (/react-luau-doctor.*(?:disable|ignore)/i.test(source))
+        uncertainFiles.add(file);
+    }
   }
-  return roots.length === 1 && roots[0] === directory ? reports[0].report : aggregateReports(directory, reports);
-}
-async function findNewReviewDiagnostics(settings, eventName, event, currentReport) {
-  if (event.action === "synchronize" && event.before) {
-    const report = await scanForCi({ ...settings, scope: "changed" }, eventName, event.before);
-    return { diagnostics: report.diagnostics, base: event.before };
-  }
-  if (event.action && event.action !== "opened")
-    return { diagnostics: [] };
-  return { diagnostics: currentReport.diagnostics };
+  const report = roots.length === 1 && roots[0] === directory ? reports[0].report : aggregateReports(directory, reports);
+  const comparison = comparisons.length ? aggregateReports(directory, comparisons) : report;
+  const sourceCache = new Map;
+  const toFinding = (diagnostic) => {
+    const file = repoRelativeDiagnosticPath(directory, diagnostic.file, repoRoot);
+    const absolute = path11.resolve(repoRoot, file);
+    if (!sourceCache.has(file)) {
+      sourceCache.set(file, fs9.existsSync(absolute) ? fs9.readFileSync(absolute, "utf8").split(/\r?\n/) : []);
+    }
+    return {
+      file,
+      rule: diagnostic.rule,
+      severity: diagnostic.severity,
+      message: diagnostic.message,
+      line: diagnostic.location.line,
+      column: diagnostic.location.column,
+      diagnosticId: diagnostic.id,
+      anchor: createHash2("sha256").update(sourceCache.get(file)?.[diagnostic.location.line - 1]?.trim() ?? "").digest("hex").slice(0, 16),
+      status: "active"
+    };
+  };
+  return {
+    repoRoot,
+    report: {
+      ...report,
+      partial: Boolean(report.partial) || !complete,
+      unverifiedFiles: unverifiedFiles.size ? [...unverifiedFiles].sort() : undefined,
+      skippedFiles: [
+        ...new Set([...report.skippedFiles ?? [], ...verificationSkippedFiles])
+      ].sort(),
+      notes: potentiallyRelocated ? [
+        ...report.notes ?? [],
+        "Some removed findings may have moved to other files and were not counted as fixed"
+      ] : report.notes
+    },
+    comparison,
+    fixed: complete ? fixed : [],
+    analysis: {
+      signature,
+      complete,
+      current: currentDiagnostics.map(toFinding),
+      introduced: comparison.diagnostics.map((diagnostic) => ({
+        diagnostic,
+        finding: toFinding(diagnostic)
+      })),
+      verifiedFiles,
+      deletedFiles,
+      canonicalFile,
+      eligible: (finding) => !uncertainFiles.has(finding.file) && configs.some(({ root, config }) => {
+        const relative = normalize(path11.relative(root, path11.resolve(repoRoot, finding.file)));
+        return !relative.startsWith("../") && !path11.isAbsolute(relative) && isSelectedLuauPath(relative, config) && config.rules?.[finding.rule] !== "off";
+      })
+    }
+  };
 }
 function shouldBlock(report, level) {
   if (level === "none")
@@ -13191,329 +14573,32 @@ function githubRunUrl() {
   const runId = process.env.GITHUB_RUN_ID;
   return server && repository && runId ? `${server}/${repository}/actions/runs/${runId}` : null;
 }
-function wait(milliseconds) {
-  return new Promise((resolve) => setTimeout(resolve, milliseconds));
-}
 function errorMessage(error) {
   return error instanceof Error ? error.message : String(error);
 }
-function githubRetryDelay(response, responseText, attempt) {
-  const remaining = response.headers.get("x-ratelimit-remaining");
-  const rateLimited = response.status === 429 || response.status === 403 && (remaining === "0" || /rate limit|rate_limit|abuse detection/i.test(responseText)) || response.status === 200 && /"errors"\s*:/.test(responseText) && /rate limit|rate_limit/i.test(responseText);
-  if (!rateLimited)
-    return null;
-  const retryAfter = response.headers.get("retry-after");
-  if (retryAfter) {
-    const seconds = Number(retryAfter);
-    if (Number.isFinite(seconds) && seconds >= 0)
-      return seconds * 1000;
-    const date = Date.parse(retryAfter);
-    if (Number.isFinite(date))
-      return Math.max(0, date - Date.now());
-  }
-  if (remaining === "0") {
-    const reset = Number(response.headers.get("x-ratelimit-reset"));
-    if (Number.isFinite(reset))
-      return Math.max(0, reset * 1000 - Date.now() + 1000);
-  }
-  return 60000 * 2 ** attempt;
-}
-async function githubRequest(url, options = {}) {
-  const token = process.env.GITHUB_TOKEN;
-  if (!token)
-    throw new Error("GITHUB_TOKEN is unavailable");
-  for (let attempt = 0;; attempt += 1) {
-    const response = await fetch(url, {
-      method: options.method ?? "GET",
-      headers: {
-        Accept: "application/vnd.github+json",
-        Authorization: `Bearer ${token}`,
-        "X-GitHub-Api-Version": "2022-11-28",
-        "User-Agent": "react-luau-doctor",
-        "Content-Type": "application/json"
-      },
-      body: options.body === undefined ? undefined : JSON.stringify(options.body)
-    });
-    const responseText = response.status === 204 ? "" : await response.text();
-    const delay = githubRetryDelay(response, responseText, attempt);
-    if (response.ok && delay === null)
-      return responseText ? JSON.parse(responseText) : undefined;
-    if (delay === null || attempt >= MAX_GITHUB_RETRIES || delay > MAX_RATE_LIMIT_WAIT_MS) {
-      const retryDetail = delay !== null && delay > MAX_RATE_LIMIT_WAIT_MS ? ` Retry after ${Math.ceil(delay / 1000)} seconds.` : "";
-      throw new Error(`GitHub API ${response.status}: ${responseText}${retryDetail}`);
-    }
-    process.stderr.write(`react-luau-doctor: GitHub API ${response.status}; retrying in ${Math.ceil(delay / 1000)} seconds
-`);
-    await wait(delay);
-  }
-}
-async function githubApi(repo, endpoint, options = {}) {
-  const apiBase = (process.env.GITHUB_API_URL ?? "https://api.github.com").replace(/\/$/, "");
-  return githubRequest(`${apiBase}/repos/${repo}${endpoint}`, options);
-}
-function repoRelativeDiagnosticPath(directory, diagnosticFile) {
+function repoRelativeDiagnosticPath(directory, diagnosticFile, repoRoot) {
   const absoluteDirectory = path11.resolve(directory);
-  const repoRoot = findGitRoot(absoluteDirectory);
   const prefix = path11.relative(repoRoot, absoluteDirectory).split(path11.sep).join("/");
   return prefix && prefix !== "." ? path11.posix.join(prefix, diagnosticFile) : diagnosticFile;
 }
-function githubFileUrl(repo, sha, diagnostic, directory) {
+function githubFileUrl(repo, sha, diagnostic, directory, repoRoot) {
   const server = process.env.GITHUB_SERVER_URL ?? "https://github.com";
-  const repoPath = repoRelativeDiagnosticPath(directory, diagnostic.file);
-  const encoded = repoPath.split("/").map(encodeURIComponent).join("/");
-  return `${server}/${repo}/blob/${sha}/${encoded}#L${diagnostic.location.line}`;
-}
-function renderSummaryComment(report, repo, sha, fixed, skipped, directory) {
-  if (skipped) {
-    return `${SUMMARY_MARKER}
-## React-Luau Doctor
-
-No eligible React-Luau files changed in this pull request, so the scan was skipped.
-`;
-  }
-  const lines = [
-    SUMMARY_MARKER,
-    "## React-Luau Doctor",
-    "",
-    `**${report.counts.error} errors \xB7 ${report.counts.warning} warnings \xB7 ${report.counts.suggestion} suggestions \xB7 Score ${report.score}/100**`,
-    "",
-    `${report.diagnostics.length} ${report.scope === "changed" ? "introduced finding" : "reported finding"}${report.diagnostics.length === 1 ? "" : "s"} \xB7 ${fixed} fixed`
-  ];
-  const errors = report.diagnostics.filter((diagnostic) => diagnostic.severity === "error").slice(0, 20);
-  if (errors.length > 0) {
-    lines.push("", "### Errors");
-    for (const diagnostic of errors) {
-      lines.push(`- [\`${diagnostic.file}:${diagnostic.location.line}\`](${githubFileUrl(repo, sha, diagnostic, directory)}) **${diagnostic.rule}**: ${diagnostic.message}`);
-    }
-  }
-  const warningsByFile = new Map;
-  for (const diagnostic of report.diagnostics.filter((entry) => entry.severity === "warning").slice(0, 50)) {
-    const entries = warningsByFile.get(diagnostic.file) ?? [];
-    entries.push(diagnostic);
-    warningsByFile.set(diagnostic.file, entries);
-  }
-  if (warningsByFile.size > 0) {
-    lines.push("", "### Warnings");
-    for (const [file, diagnostics] of warningsByFile) {
-      lines.push(`- **${file}**`);
-      for (const diagnostic of diagnostics)
-        lines.push(`  - [line ${diagnostic.location.line}](${githubFileUrl(repo, sha, diagnostic, directory)}): ${diagnostic.message}`);
-    }
-  }
-  if (report.diagnostics.length > errors.length + [...warningsByFile.values()].reduce((sum, entries) => sum + entries.length, 0)) {
-    lines.push("", "Additional findings are available in the workflow logs.");
-  }
-  const runUrl = githubRunUrl();
-  if (runUrl)
-    lines.push("", `[View full workflow run](${runUrl})`);
-  lines.push("", `<sub>Reviewed commit \`${sha.slice(0, 7)}\`</sub>`);
-  return `${lines.join(`
-`)}
-`;
-}
-async function listComments(repo, endpoint) {
-  const comments = [];
-  for (let page = 1;; page += 1) {
-    const batch = await githubApi(repo, `${endpoint}?per_page=100&page=${page}`);
-    comments.push(...batch);
-    if (batch.length < 100)
-      return comments;
-  }
-}
-function isDoctorComment(comment, marker) {
-  return comment.user?.type === "Bot" && comment.body?.startsWith(marker) === true;
-}
-async function updateStickyComment(repo, pullNumber, body, createIfMissing = true) {
-  const comments = await listComments(repo, `/issues/${pullNumber}/comments`);
-  const previous = comments.find((comment) => isDoctorComment(comment, SUMMARY_MARKER));
-  if (previous)
-    await githubApi(repo, `/issues/comments/${previous.id}`, { method: "PATCH", body: { body } });
-  else if (createIfMissing)
-    await githubApi(repo, `/issues/${pullNumber}/comments`, { method: "POST", body: { body } });
-}
-function changedLineMap(directory, base) {
-  return createGitScopePlan(directory, { scope: "lines", base }).changedLines;
-}
-function touchesChangedLine(diagnostic, ranges) {
-  return ranges.some((range) => diagnostic.location.line >= range.start && diagnostic.location.line <= range.end);
-}
-function reviewFingerprint(pathname, rule, severity, message) {
-  return createHash("sha256").update(`${pathname}\x00${rule}\x00${severity}\x00${message}`).digest("hex").slice(0, 32);
-}
-function diagnosticReviewFingerprint(directory, diagnostic) {
-  return reviewFingerprint(repoRelativeDiagnosticPath(directory, diagnostic.file), diagnostic.rule, diagnostic.severity, diagnostic.message);
+  const repoPath = repoRelativeDiagnosticPath(directory, diagnostic.file, repoRoot);
+  const encoded = repoPath.split("/").map((segment) => encodeURIComponent(segment).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16)}`)).join("/");
+  return `${server}/${repo}/blob/${sha}/${encoded}${diagnostic.baselineLocationUncertain ? "" : `#L${diagnostic.location.line}`}`;
 }
-function fingerprintFromReviewBody(body, pathname) {
-  const marker = body.match(/<!-- react-luau-doctor:fingerprint:([a-f0-9]{32}) -->/i);
-  if (marker)
-    return marker[1].toLowerCase();
-  const legacy = body.match(/\*\*React-Luau Doctor\*\* \u00B7 `([^`]+)` \((error|warning|suggestion)\)\n\n([^\n]+)/);
-  return legacy ? reviewFingerprint(pathname, legacy[1], legacy[2], legacy[3]) : null;
-}
-function reviewCommentBody(directory, diagnostic) {
-  const fingerprint = diagnosticReviewFingerprint(directory, diagnostic);
-  return `${REVIEW_MARKER}
-<!-- react-luau-doctor:fingerprint:${fingerprint} -->
-**React-Luau Doctor** \xB7 \`${diagnostic.rule}\` (${diagnostic.severity})
-
-${diagnostic.message}${diagnostic.help ? `
-
-${diagnostic.help}` : ""}`;
-}
-var ARCHIVED_REVIEW_BODY = "\u2705 React-Luau Doctor: findings from this review are no longer current. Active findings, if any, are shown in newer reviews.";
-async function listReviewComments(repo, pullNumber) {
-  const comments = [];
-  for (let page = 1;; page += 1) {
-    const batch = await githubApi(repo, `/pulls/${pullNumber}/comments?per_page=100&page=${page}`);
-    comments.push(...batch);
-    if (batch.length < 100)
-      return comments;
-  }
-}
-async function listReviews(repo, pullNumber) {
-  const reviews = [];
-  for (let page = 1;; page += 1) {
-    const batch = await githubApi(repo, `/pulls/${pullNumber}/reviews?per_page=100&page=${page}`);
-    reviews.push(...batch);
-    if (batch.length < 100)
-      return reviews;
-  }
-}
-function isDoctorReview(review) {
-  return review.user?.type === "Bot" && (review.body?.includes("React-Luau Doctor") ?? false);
-}
-function doctorReviewCommentFingerprint(comment) {
-  if (comment.user?.type !== "Bot" || !comment.body.startsWith(REVIEW_MARKER))
-    return null;
-  return fingerprintFromReviewBody(comment.body, comment.path);
-}
-function takeCount(counts, key) {
-  const count = counts.get(key) ?? 0;
-  if (count === 0)
-    return false;
-  counts.set(key, count - 1);
-  return true;
-}
-function incrementCount(counts, key) {
-  counts.set(key, (counts.get(key) ?? 0) + 1);
-}
-async function manageReviewComments(repo, pullNumber, currentReport, newDiagnostics, directory, newBase, pullBase) {
-  const [allReviewComments, reviews] = await Promise.all([
-    listReviewComments(repo, pullNumber),
-    listReviews(repo, pullNumber)
-  ]);
-  const reviewComments = allReviewComments.map((comment) => ({ comment, fingerprint: doctorReviewCommentFingerprint(comment) })).filter((entry) => entry.fingerprint !== null);
-  const activeCounts = new Map;
-  for (const diagnostic of currentReport.diagnostics)
-    incrementCount(activeCounts, diagnosticReviewFingerprint(directory, diagnostic));
-  const newCounts = new Map;
-  for (const diagnostic of newDiagnostics)
-    incrementCount(newCounts, diagnosticReviewFingerprint(directory, diagnostic));
-  const replacementCounts = new Map;
-  const staleComments = [];
-  const orderedComments = reviewComments.slice().sort((left, right) => Number(left.comment.position === null) - Number(right.comment.position === null));
-  for (const { comment, fingerprint } of orderedComments) {
-    if (comment.position !== null && takeCount(activeCounts, fingerprint)) {
-      takeCount(newCounts, fingerprint);
-      continue;
-    }
-    const needsReplacement = takeCount(activeCounts, fingerprint);
-    if (needsReplacement) {
-      incrementCount(replacementCounts, fingerprint);
-      takeCount(newCounts, fingerprint);
-    }
-    staleComments.push({ comment, fingerprint, needsReplacement });
-  }
-  const newLineMap = newCounts.size > 0 || newBase === pullBase && replacementCounts.size > 0 ? changedLineMap(directory, newBase) : new Map;
-  const pullLineMap = newBase === pullBase ? newLineMap : replacementCounts.size > 0 ? changedLineMap(directory, pullBase) : new Map;
-  const candidates = [];
-  for (const diagnostic of newDiagnostics) {
-    if (!touchesChangedLine(diagnostic, newLineMap.get(diagnostic.file) ?? []))
-      continue;
-    const fingerprint = diagnosticReviewFingerprint(directory, diagnostic);
-    if (!takeCount(newCounts, fingerprint))
-      continue;
-    candidates.push({ diagnostic, replacement: false });
-  }
-  for (const diagnostic of currentReport.diagnostics) {
-    if (!touchesChangedLine(diagnostic, pullLineMap.get(diagnostic.file) ?? []))
-      continue;
-    const fingerprint = diagnosticReviewFingerprint(directory, diagnostic);
-    if (!takeCount(replacementCounts, fingerprint))
-      continue;
-    candidates.push({ diagnostic, replacement: true });
-  }
-  const selected = candidates.slice(0, MAX_REVIEW_COMMENTS);
-  const comments = selected.map(({ diagnostic }) => ({
-    path: repoRelativeDiagnosticPath(directory, diagnostic.file),
-    line: diagnostic.location.line,
-    side: "RIGHT",
-    body: reviewCommentBody(directory, diagnostic)
-  }));
-  const failures = [];
-  let postedNewComments = true;
-  if (comments.length > 0) {
-    try {
-      await githubApi(repo, `/pulls/${pullNumber}/reviews`, {
-        method: "POST",
-        body: { event: "COMMENT", body: "React-Luau Doctor found new issues", comments }
-      });
-    } catch (error) {
-      postedNewComments = false;
-      failures.push(`could not create new review comments: ${errorMessage(error)}`);
-    }
-  }
-  if (postedNewComments) {
-    const postedReplacementCounts = new Map;
-    for (const candidate of selected) {
-      if (candidate.replacement)
-        incrementCount(postedReplacementCounts, diagnosticReviewFingerprint(directory, candidate.diagnostic));
-    }
-    const remainingByReview = new Map;
-    for (const { comment } of reviewComments) {
-      remainingByReview.set(comment.pull_request_review_id, (remainingByReview.get(comment.pull_request_review_id) ?? 0) + 1);
-    }
-    for (const stale of staleComments) {
-      if (stale.needsReplacement && !takeCount(postedReplacementCounts, stale.fingerprint))
-        continue;
-      try {
-        await githubApi(repo, `/pulls/comments/${stale.comment.id}`, { method: "DELETE" });
-        const reviewId = stale.comment.pull_request_review_id;
-        const remaining = Math.max(0, (remainingByReview.get(reviewId) ?? 1) - 1);
-        remainingByReview.set(reviewId, remaining);
-      } catch (error) {
-        failures.push(`could not delete stale review comment ${stale.comment.id}: ${errorMessage(error)}`);
-      }
-    }
-    for (const review of reviews) {
-      if (!isDoctorReview(review) || review.body === ARCHIVED_REVIEW_BODY)
-        continue;
-      if ((remainingByReview.get(review.id) ?? 0) > 0)
-        continue;
-      try {
-        await githubApi(repo, `/pulls/${pullNumber}/reviews/${review.id}`, {
-          method: "PUT",
-          body: { body: ARCHIVED_REVIEW_BODY }
-        });
-      } catch (error) {
-        failures.push(`could not archive empty review ${review.id}: ${errorMessage(error)}`);
-      }
-    }
-  }
-  if (failures.length > 0)
-    throw new Error(failures.join("; "));
-}
-async function publishCommitStatus(repo, sha, report, blocking) {
+async function publishCommitStatus(client, sha, report, blocking) {
   const blocked = shouldBlock(report, blocking);
-  await githubApi(repo, `/statuses/${sha}`, {
-    method: "POST",
-    body: {
-      state: blocked ? "failure" : "success",
-      context: "React-Luau Doctor",
-      description: `Score ${report.score}/100 \xB7 ${report.counts.error} errors \xB7 ${report.counts.warning} warnings`,
-      target_url: githubRunUrl() ?? undefined
-    }
-  });
+  const body = {
+    state: report.partial ? "error" : blocked ? "failure" : "success",
+    context: "React-Luau Doctor",
+    description: report.partial ? "Analysis incomplete; findings and fixes are unverified" : `Score ${report.score}/100 \xB7 ${report.counts.error} errors \xB7 ${report.counts.warning} warnings`,
+    target_url: githubRunUrl() ?? undefined
+  };
+  if (client.pullNumber)
+    await client.mutate(`/statuses/${sha}`, "POST", body);
+  else
+    await client.request(`/statuses/${sha}`, { method: "POST", body });
 }
 function parseCiRunOptions(argv) {
   const settings = { ...DEFAULT_SETTINGS };
@@ -13555,17 +14640,33 @@ function parseCiRunOptions(argv) {
 async function runCiJob(argv) {
   const settings = parseCiRunOptions(argv);
   const eventName = process.env.GITHUB_EVENT_NAME ?? "";
+  if (eventName === "pull_request_target") {
+    throw new Error("ci run does not execute PR analysis under pull_request_target; use pull_request with least-privilege permissions");
+  }
   const event = githubEvent();
   const isPullRequest = eventName === "pull_request" && event.pull_request !== undefined;
   const base = isPullRequest ? event.pull_request.base.sha : undefined;
   const head = isPullRequest ? event.pull_request.head.sha : process.env.GITHUB_SHA ?? "HEAD";
-  let fixedFromScan;
-  const report = await scanForCi(settings, eventName, base, (count) => {
-    fixedFromScan = (fixedFromScan ?? 0) + count;
-  });
-  const reviewChanges = isPullRequest ? await findNewReviewDiagnostics(settings, eventName, event, report) : { diagnostics: [] };
-  const fixed = isPullRequest && base ? fixedFromScan ?? (await Promise.all(resolveCiProjectRoots(path11.resolve(settings.directory), settings.project).map((root) => fixedIssueCount(root, base)))).reduce((sum, count) => sum + count, 0) : 0;
-  const skipped = isPullRequest && report.scannedFiles === 0 && fixed === 0;
+  const repo = githubRepo(event);
+  const client = repo ? new GitHubClient(repo, event.pull_request?.number ?? 0, {
+    head,
+    base: base ?? "",
+    runId: process.env.GITHUB_RUN_ID ?? "",
+    attempt: process.env.GITHUB_RUN_ATTEMPT ?? "1"
+  }) : undefined;
+  let snapshot;
+  if (client && isPullRequest && settings.reviewComments) {
+    try {
+      snapshot = await reviewSnapshot(client);
+    } catch (error) {
+      process.stderr.write(`react-luau-doctor: could not update inline review comments: ${errorMessage(error)}
+`);
+    }
+  }
+  const scan = await scanForCi(settings, isPullRequest, base, head, snapshot);
+  const { report, fixed, analysis } = scan;
+  const baselineCommit = scan.comparison.base ?? base;
+  const skipped = isPullRequest && report.scannedFiles === 0 && fixed.length === 0 && report.diagnostics.length === 0 && !report.partial;
   const effectiveBlocking = isPullRequest ? settings.blocking : "none";
   process.stdout.write(`${renderTextReport(report, true, false, false, process.stdout.columns ?? 120)}
 `);
@@ -13575,39 +14676,88 @@ async function runCiJob(argv) {
 `);
   writeOutput("score", report.score);
   writeOutput("total-issues", report.diagnostics.length);
-  writeOutput("fixed-issues", fixed);
+  writeOutput("fixed-issues", fixed.length);
   writeOutput("error-count", report.counts.error);
   writeOutput("warning-count", report.counts.warning);
+  writeOutput("suggestion-count", report.counts.suggestion);
   writeOutput("affected-files", affectedFiles(report));
-  const repo = githubRepo(event);
-  if (repo && isPullRequest) {
-    const pullNumber = event.pull_request.number;
-    if (settings.comment) {
+  writeOutput("analysis-complete", report.partial ? "false" : "true");
+  const render = (inlineCount, limit) => renderSummaryComment(report, {
+    baseBranch: event.pull_request?.base.ref ?? "baseline",
+    fixed,
+    sha: head,
+    inlineCount,
+    incomplete: report.partial,
+    skipped,
+    runUrl: githubRunUrl(),
+    limit,
+    includeDiagnosticDetails: limit === Number.POSITIVE_INFINITY,
+    url: (diagnostic, baseline) => githubFileUrl(repo ?? "unknown/repository", baseline ? baselineCommit ?? "HEAD" : head, diagnostic, settings.directory, scan.repoRoot)
+  });
+  const fullReport = render(0, Number.POSITIVE_INFINITY);
+  if (process.env.GITHUB_STEP_SUMMARY) {
+    if (Buffer.byteLength(fullReport) < 900000) {
+      fs9.appendFileSync(process.env.GITHUB_STEP_SUMMARY, fullReport);
+    } else {
+      fs9.appendFileSync(process.env.GITHUB_STEP_SUMMARY, `${render(0)}
+The complete diagnostic report exceeds the workflow summary limit and is available in the report artifact and logs
+`);
+    }
+  }
+  const reportFile = path11.join(fs9.mkdtempSync(path11.join(process.env.RUNNER_TEMP ?? os2.tmpdir(), "react-luau-doctor-report-")), "report.json");
+  fs9.writeFileSync(reportFile, JSON.stringify({
+    ...report,
+    fixedDiagnostics: fixed,
+    baseBranch: event.pull_request?.base.ref,
+    baseCommit: baselineCommit,
+    baseBranchCommit: base,
+    headCommit: head
+  }, null, 2) + `
+`);
+  writeOutput("report-path", reportFile);
+  process.stdout.write(`Full diagnostic report
+${JSON.stringify({ ...report, fixedDiagnostics: fixed })}
+`);
+  if (client && isPullRequest) {
+    let inlineCount = snapshot?.comments.filter((comment) => comment.user?.type === "Bot" && comment.body?.startsWith("<!-- react-luau-doctor:review -->")).length ?? 0;
+    let stale = false;
+    const publishSummary = async () => {
+      if (!settings.comment || stale)
+        return;
       try {
-        await updateStickyComment(repo, pullNumber, renderSummaryComment(report, repo, head, fixed, skipped, settings.directory), !skipped);
+        await client.sticky(render(inlineCount), !report.partial);
       } catch (error) {
+        stale ||= error instanceof StalePublication;
         process.stderr.write(`react-luau-doctor: could not update the sticky PR comment: ${errorMessage(error)}
 `);
       }
-    }
-    if (settings.reviewComments && base) {
+    };
+    await publishSummary();
+    if (settings.reviewComments && snapshot && base && !stale) {
       try {
-        await manageReviewComments(repo, pullNumber, report, reviewChanges.diagnostics, path11.resolve(settings.directory), reviewChanges.base ?? base, base);
+        const lines = createGitScopePlan(path11.resolve(settings.directory), {
+          scope: "lines",
+          base
+        }).changedLines;
+        const latestSnapshot = await reviewSnapshot(client);
+        inlineCount = await reconcileReviews(client, latestSnapshot, analysis, (diagnostic) => (lines.get(diagnostic.file) ?? []).some((range) => diagnostic.location.line >= range.start && diagnostic.location.line <= range.end));
       } catch (error) {
+        stale ||= error instanceof StalePublication;
         process.stderr.write(`react-luau-doctor: could not update inline review comments: ${errorMessage(error)}
 `);
       }
+      await publishSummary();
     }
   }
-  if (repo && settings.commitStatus) {
+  if (client && settings.commitStatus) {
     try {
-      await publishCommitStatus(repo, head, report, effectiveBlocking);
+      await publishCommitStatus(client, head, report, effectiveBlocking);
     } catch (error) {
       process.stderr.write(`react-luau-doctor: could not publish the commit status: ${errorMessage(error)}
 `);
     }
   }
-  if (shouldBlock(report, effectiveBlocking))
+  if (report.partial || shouldBlock(report, effectiveBlocking))
     process.exitCode = 1;
 }
 async function runCiCommand(argv) {
@@ -15480,7 +16630,7 @@ async function main() {
       process.stdout.write(`React-Luau Doctor ${VERSION2}
 Bun ${Bun.version}
 ${process.platform} ${process.arch}
-${os2.release()}
+${os3.release()}
 `);
       return;
     }
@@ -15554,5 +16704,5 @@ ${renderUpdateNotice(update.current, update.latest, colorized)}
 }
 main();
 
-//# debugId=9D947B614FF21B3A64756E2164756E21
+//# debugId=72F30B6744C80DF864756E2164756E21
 //# sourceMappingURL=cli.js.map