@fullstackhouse/cerber 0.34.0 → 0.35.1

package/README.md

@@ -25,6 +25,9 @@ That gate is the whole point, and the reason this is not another review bot:
 
 Named after Cerberus, the gatekeeper: cerber guards what gets merged.
 
+Why it exists, and the four things I tried first:
+[AI drafts the review. I decide what gets sent.](https://www.fullstack.house/blog/cerber?utm_source=github&utm_medium=readme)
+
 **The whole loop in seventeen seconds** — five PRs already drafted when you sit
 down, the one that isn't an approval, straight to its blocker, arguing with the
 reviewer until it rewrites its own finding, dropping the comment you disagree

package/dist/cli/index.js

@@ -9,8 +9,8 @@ import { configPath, loadConfig, saveConfig } from "../core/config.js";
 import { formatBlockers, isBlocking, preflight } from "../core/preflight.js";
 import { withWriter } from "../core/history.js";
 import { TrustRuleError, describeRule, explainRule, parseTrustRule } from "../core/trust.js";
-import { parsePrRef, searchAwaitingMe, submitReview } from "../core/gh.js";
-import { buildReviewPayload, computeCalibration, eventForRecommendation } from "../core/send.js";
+import { parsePrRef, postReplies, searchAwaitingMe, submitReview } from "../core/gh.js";
+import { buildReviewPayload, computeCalibration, describeReplyFailures, eventForRecommendation, recordReplies, } from "../core/send.js";
 import { cerberHome, listArtifacts, loadArtifact, readAutoSendLog, reconcileRunning, updateArtifactByKey, } from "../core/state.js";
 import { pool, reviewPr } from "../runner/review.js";
 import { isReviewRunning } from "../runner/inflight.js";
@@ -21,6 +21,13 @@ const program = new Command();
  * The published version, read from the manifest rather than typed here — a
  * hand-maintained copy drifted to 0.5.0 while 0.30.0 shipped, and `--version`
  * is the first thing anyone runs to decide whether a project is alive.
+ *
+ * In the published package that manifest is the one the release bumped, so this
+ * is the real version wherever anyone installed cerber. In a clone it reads
+ * `0.0.0-development`, because nothing commits the bump back to `main` and a
+ * number left behind there would quietly describe the release before last. A
+ * sentinel cannot drift: it says "built from source", which is true, instead of
+ * naming a version this build is not.
  */
 const { version } = createRequire(import.meta.url)("../../package.json");
 /**
@@ -208,6 +215,14 @@ program
             `either of which clears the stale status.`);
         process.exit(1);
     }
+    // The same wait the cockpit makes. A check run by `serve` leaves the status
+    // `ready`, so the guard above cannot see it — and sending now would post
+    // the duplicates it is about to find.
+    if (artifact.raisedCheck?.checkingSince) {
+        console.error(`cerber is checking which findings of ${id} other reviewers already raised — send once it finishes. ` +
+            `If nothing is running, restart \`cerber serve\`, which clears a check that died mid-flight.`);
+        process.exit(1);
+    }
     const event = (opts.event ??
         (artifact.verdict ? eventForRecommendation(artifact.verdict.recommendation) : "COMMENT")).toUpperCase();
     if (!["APPROVE", "COMMENT", "REQUEST_CHANGES"].includes(event)) {
@@ -221,6 +236,16 @@ program
     if (payload.folded.length > 0) {
         console.log(`  comments folded into body (no diff anchor): ${payload.folded.length}`);
     }
+    if (payload.replies.length > 0) {
+        console.log(`  replies in another reviewer's thread: ${payload.replies.length}`);
+    }
+    if (payload.held.length > 0) {
+        console.log(`  left out — already raised by another reviewer: ${payload.held.length}` +
+            ` (decide in the cockpit to post or reply instead)`);
+    }
+    if (artifact.raisedCheck?.error) {
+        console.log(`  ⚠ could not check what others already raised: ${artifact.raisedCheck.error}`);
+    }
     console.log(`  body: ${payload.body.length} chars\n`);
     if (!opts.yes) {
         const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
@@ -244,6 +269,16 @@ program
         calibration: computeCalibration(a, event),
     }));
     console.log(`✔ Review sent${url ? `: ${url}` : "."}`);
+    const outcomes = await postReplies(ref, payload.replies);
+    await updateArtifactByKey(artifactKey(id), (a) => recordReplies(a, outcomes));
+    const replyError = describeReplyFailures(outcomes);
+    if (replyError) {
+        console.error(`✖ ${replyError}`);
+        process.exitCode = 1;
+    }
+    else if (outcomes.length > 0) {
+        console.log(`✔ ${outcomes.length} ${outcomes.length === 1 ? "reply" : "replies"} posted in existing threads.`);
+    }
 });
 program
     .command("trust")

package/dist/core/artifact.js

@@ -8,6 +8,63 @@ export const SCHEMA_VERSION = 1;
  * is not a finding at all — a question, a note, praise — not "unknown".
  */
 export const SeveritySchema = z.enum(["blocker", "minor", "nit"]);
+/**
+ * Where on the PR somebody else already made a point: an inline thread, or the
+ * body of a review — some bots put their findings there and nowhere else.
+ */
+export const RaisedPlaceSchema = z.discriminatedUnion("kind", [
+    z.object({
+        kind: z.literal("thread"),
+        path: z.string(),
+        /** Null once GitHub can no longer place the thread on the current diff. */
+        line: z.number().int().positive().nullable(),
+        /** Outdated: the code it was on has changed since. Resolved wins over outdated. */
+        state: z.enum(["open", "resolved", "outdated"]),
+        /** REST id of the thread's first comment — what a reply is posted against. */
+        replyTo: z.string(),
+    }),
+    z.object({ kind: z.literal("review") }),
+]);
+/**
+ * Another reviewer — a person or a bot, never you — already raised the same
+ * defect on the PR.
+ *
+ * Found after the review, never shown to it: a review that has read earlier
+ * comments anchors on them, and they are third-party text the prompt would
+ * have to treat as hostile. So the draft is written blind, and this is the
+ * comparison afterwards (`src/runner/raised.ts`).
+ *
+ * It changes what Send does with the comment and nothing else — the comment
+ * stays in the draft, as written. What Send does is `decision`, and while it
+ * is null the default for the place applies (`sendTreatment` in
+ * `src/core/raised.ts`): left out, unless the thread was resolved, because a
+ * problem somebody marked settled that is still in the code is news.
+ */
+export const AlreadyRaisedSchema = z.object({
+    /** GitHub node id of the thread or review — how the next check finds it again. */
+    remarkId: z.string(),
+    by: z.string(),
+    at: z.string(),
+    url: z.string().nullable().default(null),
+    where: RaisedPlaceSchema,
+    /** Why the two are the same defect, in a sentence — and what this one adds, if anything. */
+    reason: z.string(),
+    /**
+     * What you chose: post it as a comment of its own anyway, or answer in their
+     * thread. Null is "not decided", which Send reads as the default above. Drop
+     * is not here: dropping is the comment's own `status`, as for any comment.
+     */
+    decision: z.enum(["send", "reply"]).nullable().default(null),
+    /** The reply Send posted into their thread. */
+    replied: z.object({ at: z.string(), url: z.string().nullable().default(null) }).nullable().default(null),
+    /**
+     * The other remarks that raised the same thing, behind the one shown. Kept
+     * because each was compared once and will not be asked about again: if the
+     * one shown is deleted, the next best takes its place instead of the
+     * finding quietly posting as new.
+     */
+    others: z.array(z.object({ remarkId: z.string(), reason: z.string() })).default([]),
+});
 /** A draft inline comment. Never sent to GitHub unless the user explicitly sends the review. */
 export const CommentSchema = z.object({
     id: z.string(),
@@ -26,6 +83,32 @@ export const CommentSchema = z.object({
     originalLine: z.number().int().positive().nullable().default(null),
     /** The commented line no longer exists in the diff — it can't post inline. */
     drifted: z.boolean().default(false),
+    /** Somebody else already raised this on the PR. AI comments only. */
+    alreadyRaised: AlreadyRaisedSchema.nullable().default(null),
+});
+/**
+ * The last comparison of the draft against what others already said on the PR.
+ *
+ * It is incremental, and these lists are why: a check compares only what is
+ * new since the last one — a remark nobody has looked at yet, or a finding a
+ * chat turn added — so opening a review costs one read of GitHub and no model
+ * call unless something actually changed.
+ */
+export const RaisedCheckSchema = z.object({
+    /**
+     * When the last check that changed anything finished, or failed. A check
+     * that found nothing new writes nothing (`raisedChanged`). Null while the
+     * first is still running.
+     */
+    at: z.string().nullable().default(null),
+    /** Set while a check runs detached, so the cockpit knows to wait for it. */
+    checkingSince: z.string().nullable().default(null),
+    /** GitHub node ids of every remark compared so far. */
+    remarks: z.array(z.string()).default([]),
+    /** Ids of every finding compared so far. */
+    findings: z.array(z.string()).default([]),
+    /** Why the last check could not finish. The matches from before it stand. */
+    error: z.string().nullable().default(null),
 });
 /** A logical group of changes — the unit of the review walkthrough. */
 export const ChapterSchema = z.object({
@@ -364,6 +447,8 @@ export const ArtifactSchema = z.object({
         .optional(),
     /** Last time this review was pulled forward onto a newer head commit. */
     refresh: RefreshInfoSchema.nullable().default(null),
+    /** The last check for findings somebody else already raised. Null: never checked. */
+    raisedCheck: RaisedCheckSchema.nullable().default(null),
     calibration: CalibrationSchema.nullable().default(null),
     /** The conversation about this review. Never sent to GitHub. */
     chat: z.array(ChatTurnSchema).default([]),

package/dist/core/autosend.js

@@ -1,7 +1,14 @@
+import { sendTreatment } from "./raised.js";
 /**
  * Auto-send policy — deliberately narrow:
  * only APPROVE verdicts, at or above the confidence threshold, never a
  * re-send. COMMENT and REQUEST_CHANGES always wait for a human.
+ *
+ * Findings somebody else already raised go the way Send's default sends them:
+ * an undecided one is left out, and the reason says how many were. Nobody is
+ * there to decide, and the default is the side that posts less. A reply into
+ * someone's thread is never auto-sent — that is a decision only a person makes,
+ * and auto-send posts one review and nothing else.
  */
 export function evaluateAutoSend(artifact, threshold) {
     if (artifact.sent)
@@ -31,5 +38,34 @@ export function evaluateAutoSend(artifact, threshold) {
             reason: `confidence ${artifact.verdict.confidence}% < threshold ${threshold}%`,
         };
     }
-    return { eligible: true, reason: `approve at ${artifact.verdict.confidence}% ≥ ${threshold}%` };
+    // Nobody is watching an auto-send, so a check that never ran, is still
+    // running, or failed is not the same as one that found nothing: each would
+    // post every duplicate it missed. Only a finished, clean check will do.
+    const check = artifact.raisedCheck;
+    if (check?.error) {
+        return {
+            eligible: false,
+            reason: `could not check which findings other reviewers already raised (${check.error})`,
+        };
+    }
+    if (check == null || check.at == null || check.checkingSince != null) {
+        return {
+            eligible: false,
+            reason: "the check for findings other reviewers already raised has not finished",
+        };
+    }
+    const live = artifact.comments.filter((c) => c.status !== "dropped");
+    const replies = live.filter((c) => sendTreatment(c) === "reply").length;
+    if (replies > 0) {
+        return {
+            eligible: false,
+            reason: `${replies} finding(s) marked to reply in another reviewer's thread — only a human Send posts replies`,
+        };
+    }
+    const held = live.filter((c) => sendTreatment(c) === "hold").length;
+    return {
+        eligible: true,
+        reason: `approve at ${artifact.verdict.confidence}% ≥ ${threshold}%` +
+            (held > 0 ? `; ${held} finding(s) already raised by another reviewer left out` : ""),
+    };
 }

package/dist/core/export.js

@@ -38,7 +38,7 @@ export function toMarkdown(artifact) {
             lines.push("");
             const comments = artifact.comments.filter((c) => c.chapterId === ch.id && c.status !== "dropped");
             for (const c of comments) {
-                lines.push(`> **${c.path}${c.line != null ? `:${c.line}` : ""}** — ${withGrade(c.body, c.severity).replace(/\n/g, "\n> ")}`);
+                lines.push(renderComment(c));
                 lines.push("");
             }
         }
@@ -49,9 +49,15 @@ export function toMarkdown(artifact) {
         lines.push("## Other comments");
         lines.push("");
         for (const c of orphans) {
-            lines.push(`> **${c.path}${c.line != null ? `:${c.line}` : ""}** — ${withGrade(c.body, c.severity).replace(/\n/g, "\n> ")}`);
+            lines.push(renderComment(c));
             lines.push("");
         }
     }
     return lines.join("\n");
 }
+function renderComment(c) {
+    const text = `> **${c.path}${c.line != null ? `:${c.line}` : ""}** — ${withGrade(c.body, c.severity).replace(/\n/g, "\n> ")}`;
+    // Said here too, so a reader of the export does not take a repeat for news.
+    const raised = c.alreadyRaised;
+    return raised ? `${text}\n>\n> _Already raised by @${raised.by}: ${raised.reason}_` : text;
+}

package/dist/core/gh.js

@@ -424,6 +424,105 @@ export async function fetchLastReviewRequest(ref, login) {
     const raw = JSON.parse(out);
     return lastRequestOf(raw.data?.repository?.pullRequest?.timelineItems?.nodes ?? [], login);
 }
+/**
+ * Everything others have said on the PR in review form: the inline threads, by
+ * their first comment, and the review bodies.
+ *
+ * Yours are left out — what you already said is not something a draft of yours
+ * repeats from somebody else — and so are the author's: a thread the author
+ * opens on their own PR is an explanation, not a finding. Bots stay in. A bot
+ * is very often the first to raise a thing, and some put their findings only in
+ * the review body, which is why bodies are read at all.
+ *
+ * Replies inside a thread are not read. The finding is what opened the thread;
+ * the rest is the conversation about it.
+ */
+export function priorRemarks(raw, people) {
+    const skip = new Set([people.you.toLowerCase(), people.author.toLowerCase()]);
+    const remarks = [];
+    for (const t of raw.threads) {
+        const first = t.comments.nodes[0];
+        // GitHub's own deleted-user placeholder, so a thread whose author left is
+        // still a thing somebody raised.
+        const by = first?.author?.login ?? "ghost";
+        if (!first || first.fullDatabaseId == null || skip.has(by.toLowerCase()))
+            continue;
+        remarks.push({
+            kind: "thread",
+            id: t.id,
+            by,
+            bot: first.author?.__typename === "Bot",
+            at: first.createdAt,
+            body: first.body ?? "",
+            url: first.url,
+            path: t.path,
+            line: t.line,
+            state: t.isResolved ? "resolved" : t.isOutdated ? "outdated" : "open",
+            replyTo: String(first.fullDatabaseId),
+        });
+    }
+    for (const r of raw.reviews) {
+        const by = r.author?.login ?? "ghost";
+        // An empty body is a review whose whole say is in its threads, read above.
+        // A pending one is a draft nobody else can see.
+        if (!r.body?.trim() || r.submittedAt == null || skip.has(by.toLowerCase()))
+            continue;
+        remarks.push({
+            kind: "review",
+            id: r.id,
+            by,
+            bot: r.author?.__typename === "Bot",
+            at: r.submittedAt,
+            body: r.body,
+            url: r.url,
+        });
+    }
+    return remarks;
+}
+// The last 100 of each, in one call. A PR past 100 threads loses its oldest
+// from the comparison — accepted rather than paginated, because the failure is
+// the conservative one: a duplicate that posts, which is what happened before
+// there was any comparison at all.
+const PRIOR_REMARKS_QUERY = `query($owner:String!,$repo:String!,$number:Int!){
+  repository(owner:$owner,name:$repo){
+    pullRequest(number:$number){
+      reviewThreads(last:100){
+        nodes{ id isResolved isOutdated path line
+          comments(first:1){ nodes{ fullDatabaseId url createdAt body author{ login __typename } } }
+        }
+      }
+      reviews(last:100){
+        nodes{ id state submittedAt url body author{ login __typename } }
+      }
+    }
+  }
+}`;
+/**
+ * Read what others have already said on a PR in review form.
+ *
+ * GraphQL because REST has no thread resolution: `pulls/N/comments` returns the
+ * comments but not whether anybody resolved the thread they are in, and that is
+ * the fact that decides what Send does with a match.
+ */
+export async function fetchPriorRemarks(ref, people) {
+    const out = await gh([
+        "api",
+        "graphql",
+        "-f",
+        `query=${PRIOR_REMARKS_QUERY}`,
+        "-F",
+        `owner=${ref.owner}`,
+        "-F",
+        `repo=${ref.repo}`,
+        "-F",
+        `number=${ref.number}`,
+    ]);
+    const raw = JSON.parse(out);
+    const pr = raw.data?.repository?.pullRequest;
+    if (!pr)
+        throw new Error(`GitHub returned no pull request for ${ref.owner}/${ref.repo}#${ref.number}`);
+    return priorRemarks({ threads: pr.reviewThreads?.nodes ?? [], reviews: pr.reviews?.nodes ?? [] }, people);
+}
 export function searchAwaitingArgs(repoFilter, limit = 50) {
     const args = [
         "search",
@@ -541,14 +640,64 @@ export async function postIssueComment(ref, body) {
         return { url: null };
     }
 }
+/**
+ * Answer an existing review thread — a finding of yours that somebody else
+ * already raised, posted where they raised it instead of as a second thread.
+ *
+ * Part of Send and never anything on its own: it is called only by
+ * `postReplies`, after `submitReview` has posted the review it goes with, and
+ * only for comments the user marked "reply in their thread". GitHub files each
+ * reply under a small review of its own, which is GitHub's bookkeeping and not
+ * a second verdict: it carries no event, and the review that carries yours has
+ * already landed.
+ */
+export async function replyInThread(ref, replyTo, body) {
+    const out = await gh([
+        "api",
+        `repos/${ref.owner}/${ref.repo}/pulls/${ref.number}/comments/${replyTo}/replies`,
+        "--method",
+        "POST",
+        "-f",
+        `body=${body}`,
+    ]);
+    try {
+        return { url: JSON.parse(out).html_url ?? null };
+    }
+    catch {
+        return { url: null };
+    }
+}
+/**
+ * Post a Send's replies, one by one, each allowed to fail on its own.
+ *
+ * After the review, never before it: the review is the thing the user vouched
+ * for, and a review that failed must leave nothing behind for the retry to post
+ * twice. A reply that fails once the review is up is reported against its
+ * comment rather than rolled back into a claim that nothing was sent.
+ */
+export async function postReplies(ref, replies) {
+    const outcomes = [];
+    for (const r of replies) {
+        const at = new Date().toISOString();
+        try {
+            const { url } = await replyInThread(ref, r.replyTo, r.body);
+            outcomes.push({ commentId: r.commentId, at, url, error: null });
+        }
+        catch (err) {
+            outcomes.push({ commentId: r.commentId, at, url: null, error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+    return outcomes;
+}
 /**
  * THE ONLY GITHUB WRITE THAT SPEAKS AS A REVIEW.
  * Submits a review in one shot. Must only ever be called from a human act:
  * the cockpit's Send button, `cerber send` after confirmation, opt-in
  * auto-send, or a handoff that was ticked to carry the draft — which composes
  * through this same path and always as COMMENT.
- * The two writes above are the other things that reach GitHub — a handoff's
- * request swap and its note — and neither of those is a review.
+ * The other writes are a handoff's request swap and its note, neither of them
+ * a review, and the thread replies a Send carries for findings somebody else
+ * already raised (`replyInThread`).
  */
 export async function submitReview(ref, payload) {
     const args = [

package/dist/core/raised.js

@@ -0,0 +1,175 @@
+/**
+ * The rule Send follows for a comment, given what is known about who else
+ * raised it. Dropped comments never reach this — they post nothing either way.
+ *
+ * Undecided is not "post": a duplicate the user never looked at is exactly what
+ * this exists to keep off the PR. The one place undecided still posts is a
+ * resolved thread — somebody marked that problem settled, and a review that
+ * found it again in the current code is saying it isn't.
+ */
+export function sendTreatment(comment) {
+    const raised = comment.alreadyRaised;
+    if (!raised)
+        return "post";
+    if (raised.decision === "send")
+        return "post";
+    // Only a thread can be answered; a reply decision anywhere else is not one
+    // the cockpit or the API will write, and holding is the side that posts less.
+    if (raised.decision === "reply")
+        return raised.where.kind === "thread" ? "reply" : "hold";
+    return raised.where.kind === "thread" && raised.where.state === "resolved" ? "post" : "hold";
+}
+/**
+ * Which match a comment keeps when several remarks raised the same thing:
+ * the liveliest place first, because that is what decides whether posting it
+ * again would repeat a conversation still going on. An open thread, then an
+ * outdated one nobody resolved, then a review body, then a resolved thread.
+ * Ties go to whoever said it first.
+ */
+function rank(place) {
+    if (place.kind === "review")
+        return 2;
+    return { open: 0, outdated: 1, resolved: 3 }[place.state];
+}
+export function pickMatch(candidates) {
+    if (candidates.length === 0)
+        return null;
+    return candidates.reduce((best, c) => {
+        const d = rank(c.where) - rank(best.where);
+        return d < 0 || (d === 0 && c.at < best.at) ? c : best;
+    });
+}
+/** A remark as the match it becomes on a comment. */
+export function raisedFrom(remark, reason) {
+    const where = remark.kind === "thread"
+        ? { kind: "thread", path: remark.path, line: remark.line, state: remark.state, replyTo: remark.replyTo }
+        : { kind: "review" };
+    return {
+        remarkId: remark.id,
+        by: remark.by,
+        at: remark.at,
+        url: remark.url,
+        where,
+        reason,
+        decision: null,
+        replied: null,
+        others: [],
+    };
+}
+/** The comments a check compares: the AI's, and only those still in the draft. */
+export function comparable(comments) {
+    // Not the user's own. A comment you wrote is something you decided to say,
+    // and holding it back from Send by default would overrule you.
+    return comments.filter((c) => c.origin === "ai" && c.status !== "dropped");
+}
+/**
+ * What a check has to compare: everything new against everything, and nothing
+ * already compared against each other. Empty on both sides means no model call.
+ */
+export function whatToCompare(comments, remarks, previous) {
+    const findings = comparable(comments);
+    const seenRemarks = new Set(previous?.remarks ?? []);
+    const seenFindings = new Set(previous?.findings ?? []);
+    const newRemarks = remarks.filter((r) => !seenRemarks.has(r.id));
+    const newFindings = findings.filter((f) => !seenFindings.has(f.id));
+    if (newRemarks.length === 0 && newFindings.length === 0)
+        return { findings: [], remarks: [] };
+    // New remarks are compared against every finding, new findings against
+    // every remark. Doing both whenever either is new over-asks a little, and
+    // is one call either way.
+    return {
+        findings: newRemarks.length > 0 ? findings : newFindings,
+        remarks: newFindings.length > 0 ? remarks : newRemarks,
+    };
+}
+const NO_CHECK = { at: null, checkingSince: null, remarks: [], findings: [], error: null };
+/** Mark a check as running, so the cockpit waits for it. */
+export function startRaisedCheck(artifact, at) {
+    return { ...artifact, raisedCheck: { ...(artifact.raisedCheck ?? NO_CHECK), checkingSince: at } };
+}
+/**
+ * Fold a finished check onto the artifact as it is now.
+ *
+ * The check takes up to a minute and reads a snapshot, so by the time it lands the
+ * user may have dropped a comment, decided about a match, or a chat turn may
+ * have added one. It writes `alreadyRaised` and `raisedCheck` and nothing else,
+ * and a comment it has nothing new to say about keeps what it had — the user's
+ * decision included, as long as it is still about the same remark.
+ *
+ * A remark that is gone from the PR (deleted) takes its match with it. A
+ * remark still there refreshes its state, so a thread resolved since the last
+ * check reads as resolved — and posts by default — without a model call.
+ */
+export function foldRaised(current, result) {
+    // A sent review is a record of what was posted; nothing is re-decided on it.
+    if (current.sent) {
+        return current.raisedCheck ? { ...current, raisedCheck: { ...current.raisedCheck, checkingSince: null } } : current;
+    }
+    const remarks = new Map(result.remarks.map((r) => [r.id, r]));
+    const found = new Map();
+    for (const m of result.matches)
+        found.set(m.findingId, [...(found.get(m.findingId) ?? []), m]);
+    const comments = current.comments.map((c) => {
+        const before = c.alreadyRaised;
+        // Every remark this comment has ever matched that is still on the PR —
+        // the one shown, the ones behind it, and whatever this check found — each
+        // refreshed from the remark itself, so a thread resolved since reads as
+        // resolved without asking anyone.
+        const known = new Map();
+        for (const m of [
+            ...(before ? [{ remarkId: before.remarkId, reason: before.reason }, ...before.others] : []),
+            ...(found.get(c.id) ?? []),
+        ]) {
+            if (remarks.has(m.remarkId) && !known.has(m.remarkId))
+                known.set(m.remarkId, m.reason);
+        }
+        const candidates = [...known].flatMap(([id, reason]) => {
+            const remark = remarks.get(id);
+            return remark ? [raisedFrom(remark, reason)] : [];
+        });
+        const best = pickMatch(candidates);
+        if (best === null)
+            return before === null ? c : { ...c, alreadyRaised: null };
+        // The user's decision belongs to the remark it was made about.
+        const same = before !== null && before.remarkId === best.remarkId;
+        return {
+            ...c,
+            alreadyRaised: {
+                ...best,
+                decision: same ? before.decision : null,
+                replied: same ? before.replied : null,
+                others: candidates.filter((x) => x !== best).map((x) => ({ remarkId: x.remarkId, reason: x.reason })),
+            },
+        };
+    });
+    return {
+        ...current,
+        comments,
+        raisedCheck: {
+            at: result.at,
+            checkingSince: null,
+            remarks: result.remarks.map((r) => r.id),
+            findings: result.findings,
+            error: null,
+        },
+    };
+}
+/** A check that could not finish: say why, and leave every match as it was. */
+export function foldRaisedError(current, at, error) {
+    return {
+        ...current,
+        raisedCheck: { ...(current.raisedCheck ?? NO_CHECK), at, checkingSince: null, error },
+    };
+}
+/**
+ * Whether a fold changed anything worth a write. Opening a review checks every
+ * time, and a write moves `updatedAt` — which the queue sorts and ages rows by
+ * — so a check that found nothing new must leave the file alone.
+ */
+export function raisedChanged(before, after) {
+    const material = (a) => JSON.stringify([
+        a.comments.map((c) => c.alreadyRaised),
+        a.raisedCheck && { ...a.raisedCheck, at: null },
+    ]);
+    return material(before) !== material(after);
+}

package/dist/core/revise.js

@@ -41,7 +41,13 @@ export function mergeConcurrentEdits(before, after, current) {
             return true;
         return then.body !== now.body || then.status !== now.status || then.severity !== now.severity;
     };
-    const merged = current.comments.map((now) => userTouched(now.id, now) ? now : fromTurn.get(now.id) ?? now);
+    const merged = current.comments.map((now) => {
+        const chosen = userTouched(now.id, now) ? now : fromTurn.get(now.id) ?? now;
+        // Who else raised a comment is the check's to say, not the turn's: a check
+        // that landed while the turn ran — and a decision made about it — is only
+        // on disk, and the turn's copy predates both.
+        return chosen === now ? now : { ...chosen, alreadyRaised: now.alreadyRaised };
+    });
     // Comments the turn itself added are not in `current` yet. Only those: a
     // comment present in both `before` and `after` but missing from `current` is
     // one the user deleted while the turn ran, and pushing it back would undo
@@ -66,6 +72,9 @@ export function mergeConcurrentEdits(before, after, current) {
         // Nor does a turn announce anything: the ledger is the poll's, and a turn
         // takes minutes, which is long enough for a poll to have stamped it.
         notified: current.notified,
+        // Nor does it compare the draft with what others said; that check folds
+        // onto the disk on its own.
+        raisedCheck: current.raisedCheck,
         // Nor does it hand a review to anybody. A handoff that landed while the
         // turn ran has already moved the request on GitHub, so restoring the
         // pre-turn `null` would erase the only local record of where the PR went.
@@ -172,6 +181,7 @@ export function applyRevisions(artifact, revisions, opts = {}) {
                             editedByUser: false,
                             originalLine: null,
                             drifted: false,
+                            alreadyRaised: null,
                         },
                     ],
                 };