diff --git a/.github/actions/comment-triggered-check/README.md b/.github/actions/comment-triggered-check/README.md
index 7ee3d14a..06a13818 100644
--- a/.github/actions/comment-triggered-check/README.md
+++ b/.github/actions/comment-triggered-check/README.md
@@ -126,7 +126,7 @@ read-only collaborator passes. That coarse check remains sufficient for a
 same-repository command. When `allow-forks` is enabled, the action performs the
 precise permission lookup and refuses anyone below write access.
 
-## The two modes
+## The three modes
 
 `start` parses the comment, authorizes the commenter, resolves the pull request,
 and opens the check-run. A same-repository request takes two API calls. An
@@ -137,6 +137,9 @@ command takes none.
 id from `start` and the raw job results; it computes the conclusion so the
 matrix lives in a tested script rather than in workflow YAML.
 
+`link` records the run a check-run was dispatched to, for the optional reply
+below. It needs only the check-run id and the run URL.
+
 ## The outcome matrix fails closed
 
 | Condition | Conclusion |
@@ -249,6 +252,49 @@ repeat. A missing or non-numeric value reports `malformed-repeat` or
 `malformed-runs`, a value outside the range `repeat-out-of-range` or
 `runs-out-of-range`.
 
+## Optional reply
+
+Set `reply: "true"` and pass `comment-id` to answer every command with one
+reply that links its runs. `start` reacts with :eyes:, posts the reply, and
+stamps each check-run it opens with a small JSON `external_id`: the reply id,
+the workflow attempt, the row label and, once linked, the run URL. Pass `run-label`
+to name the rows, such as `Pro`; `--runs` and `--repeat` add `run k of N` or
+`repeat N`.
+
+```text
+:rocket: `/test-e2e snapshots` started 2 runs on `abc1234`. This comment updates when they finish.
+
+- Pro: running, [watch the run](...)
+- OSS: passed, [view the run](...)
+```
+
+After each dispatch, call `link` with the check-run id and the run URL that
+`gh workflow run` prints. `link` adds the URL to the check's `external_id`, so it
+edits the check: pass it the same app inputs as `start` when the app opened the
+check. `finish` then redraws the reply with the outcome.
+The reply is edited in place, so it notifies nobody, and each new command gets
+its own reply so older runs stay findable. A re-run of the workflow reuses the
+reply, and its checks, stamped with the new attempt, replace the rows. The reply
+is posted saying the command is starting, never that it failed, because its
+first version is the one notification emails carry.
+
+The reply is a view of the check-runs. Its hidden state holds only the command
+and the commit; which rows exist, their labels, status and run links all come
+from the checks on the commit stamped with this reply, newest attempt only.
+Every writer lists those checks, redraws the whole reply, reads it back, and
+writes again if it differs. A job that overwrites the reply with an older view,
+such as a finish from a cancelled attempt, is corrected by the next redraw of
+any job, because nothing it wrote back is a source of truth. GitHub has no
+conditional comment edit, so this is what keeps parallel jobs from losing each
+other's rows or links. A reply that cannot be written only warns; it never
+fails `start`, `link` or `finish`. Only a bot's comment is taken as an existing
+reply, so a person cannot plant the marker, and a run link is drawn only when it
+is a plain https URL.
+
+Run the `start` calls for one command one after another, as separate steps of
+one job. Two `start` calls running in parallel could both find no reply and
+post two.
+
 ## Permissions
 
 The calling job needs `checks: write` to create and complete the check-run, and
@@ -257,38 +303,46 @@ the commenter's repository permission through repository metadata. With the app
 inputs, `start` also reads `finish-workflow`, which needs `contents: read`;
 without it the check opens with `github-token`.
 
+With `reply`, every job that runs `start`, `link` or `finish` needs
+`pull-requests: write` for `github-token`, to post, react and edit. A finish job
+without it keeps the reply at its last state.
+
 ## Inputs
 
 <!-- AUTO-DOC-INPUT:START - Do not remove or modify this section -->
 
-|       INPUT        |  TYPE  | REQUIRED |           DEFAULT            |                                                                                                                  DESCRIPTION                                                                                                                  |
-|--------------------|--------|----------|------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-|    allow-forks     | string |  false   |          `"false"`           |                                              start mode. Allow fork pull requests <br>only when the commenter has write, <br>maintain, or admin repository permission. Disabled <br>by default.                                               |
-|  allowed-targets   | string |  false   |         `"pro oss"`          |                                                   start mode. Whitespace-separated target values accepted <br>when target-name is set. Each value <br>needs a matching action invocation.                                                     |
-|   app-client-id    | string |  false   |                              |                    Optional client ID of a GitHub <br>App with checks: write. With app-private-key, <br>the check-run gets its own check <br>suite. Pass the same pair to <br>start and finish. Empty keeps github-token.                     |
-|  app-private-key   | string |  false   |                              |                                                                                                    Optional private key for app-client-id.                                                                                                    |
-| author-association | string |  false   |                              |       start mode. How the commenter relates <br>to the repository. Pass the github.event.comment.author_association <br>context. OWNER, MEMBER and COLLABORATOR may <br>run the command; anything else, including <br>empty, may not.         |
-|    build-result    | string |  false   |                              |                                                                                  finish mode. Result of the build <br>job. Pass the matching needs result.                                                                                    |
-| check-name-prefix  | string |  false   |           `"e2e"`            |                                                                  start mode. Prefix for the check-run <br>name; the filter and optional target <br>and focus are appended.                                                                    |
-|    check-run-id    | string |  false   |                              |                                                                 finish mode. The id returned by <br>start mode. Empty is not an <br>error; it means no check was <br>opened.                                                                  |
-|      command       | string |  false   |        `"/test-e2e"`         |                                                                                     Command word that must open the <br>comment, on its own first line.                                                                                       |
-|   comment-author   | string |  false   |                              |                                                                          start mode. Login of the commenter. <br>Pass the github.event.comment.user.login context.                                                                            |
-|    comment-body    | string |  false   |                              |                                                                                start mode. The comment text. Pass <br>the github.event.comment.body context.                                                                                  |
-|    details-url     | string |  false   |                              |                                                                                          finish mode. Link target for the <br>completed check-run.                                                                                            |
-|  finish-workflow   | string |  false   |     `"e2e-ginkgo.yaml"`      |                                                     start mode. Workflow file that runs <br>finish. The app opens the check <br>only if that file passes both <br>app inputs to finish.                                                       |
-|    github-token    | string |  false   |   `"${{ github.token }}"`    |                                                                           Token for gh. The calling job <br>must grant checks: write and pull-requests: <br>read.                                                                             |
-|        mode        | string |   true   |                              |                                                                                                          Either "start" or "finish".                                                                                                          |
-|    parse-focus     | string |  false   |          `"false"`           |                                              start mode. Set to true to <br>split an optional trailing --focus expression <br>from the filter. Disabled by default <br>for existing consumers.                                                |
-|    parse-repeat    | string |  false   |          `"false"`           |                               start mode. Set to true to <br>accept `--repeat N` (1 to 10) before --focus: one <br>run whose suite repeats N extra <br>times. Disabled by default for existing <br>consumers.                                 |
-|     parse-runs     | string |  false   |          `"false"`           | start mode. Set to true to <br>accept `--runs N` (1 to 5) before --focus: N <br>independent runs, each with its own <br>check-run and concurrency key. Cannot be <br>combined with --repeat. Disabled by default <br>for existing consumers.  |
-|     pr-number      | string |  false   |                              |                                                                               start mode. Pull request number. Pass <br>the github.event.issue.number context.                                                                                |
-|        repo        | string |  false   | `"${{ github.repository }}"` |                                                                                                        Repository in owner/name form.                                                                                                         |
-| report-conclusion  | string |  false   |                              |                                               finish mode. What the test run <br>declared about itself, parsed from its <br>report. The only input that can <br>produce a neutral conclusion.                                                 |
-|       run-id       | string |  false   |                              |                                                                        start mode. Used to build the <br>check-run details link. Pass the github.run_id <br>context.                                                                          |
-|     server-url     | string |  false   |    `"https://github.com"`    |                                                                  start mode. Base URL used to <br>build the check-run details link. Pass <br>the github.server_url context.                                                                   |
-|    suite-result    | string |  false   |                              |                                                                                  finish mode. Result of the suite <br>job. Pass the matching needs result.                                                                                    |
-|      summary       | string |  false   |                              |                                                                       finish mode. Markdown body for the <br>completed check-run. Defaults to the two <br>job results.                                                                        |
-|    target-name     | string |  false   |                              |                             start mode. Target represented by this <br>invocation. Setting it enables --target parsing; <br>a different explicit target returns target-not-selected <br>without opening a check.                              |
+|       INPUT        |  TYPE  | REQUIRED |           DEFAULT            |                                                                                                                                        DESCRIPTION                                                                                                                                         |
+|--------------------|--------|----------|------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+|    allow-forks     | string |  false   |          `"false"`           |                                                                    start mode. Allow fork pull requests <br>only when the commenter has write, <br>maintain, or admin repository permission. Disabled <br>by default.                                                                      |
+|  allowed-targets   | string |  false   |         `"pro oss"`          |                                                                          start mode. Whitespace-separated target values accepted <br>when target-name is set. Each value <br>needs a matching action invocation.                                                                           |
+|   app-client-id    | string |  false   |                              |                                          Optional client ID of a GitHub <br>App with checks: write. With app-private-key, <br>the check-run gets its own check <br>suite. Pass the same pair to <br>start and finish. Empty keeps github-token.                                            |
+|  app-private-key   | string |  false   |                              |                                                                                                                          Optional private key for app-client-id.                                                                                                                           |
+| author-association | string |  false   |                              |                              start mode. How the commenter relates <br>to the repository. Pass the github.event.comment.author_association <br>context. OWNER, MEMBER and COLLABORATOR may <br>run the command; anything else, including <br>empty, may not.                               |
+|    build-result    | string |  false   |                              |                                                                                                         finish mode. Result of the build <br>job. Pass the matching needs result.                                                                                                          |
+| check-name-prefix  | string |  false   |           `"e2e"`            |                                                                                         start mode. Prefix for the check-run <br>name; the filter and optional target <br>and focus are appended.                                                                                          |
+|    check-run-id    | string |  false   |                              |                                                                                  finish and link modes. The id <br>returned by start mode. Empty is <br>not an error; it means no <br>check was opened.                                                                                    |
+|      command       | string |  false   |        `"/test-e2e"`         |                                                                                                            Command word that must open the <br>comment, on its own first line.                                                                                                             |
+|   comment-author   | string |  false   |                              |                                                                                                 start mode. Login of the commenter. <br>Pass the github.event.comment.user.login context.                                                                                                  |
+|    comment-body    | string |  false   |                              |                                                                                                       start mode. The comment text. Pass <br>the github.event.comment.body context.                                                                                                        |
+|     comment-id     | string |  false   |                              |                                                                                     start mode. Id of the command <br>comment, which the reply answers. Pass <br>the github.event.comment.id context.                                                                                      |
+|    details-url     | string |  false   |                              |                                                                                                                 finish mode. Link target for the <br>completed check-run.                                                                                                                  |
+|  finish-workflow   | string |  false   |     `"e2e-ginkgo.yaml"`      |                                                                            start mode. Workflow file that runs <br>finish. The app opens the check <br>only if that file passes both <br>app inputs to finish.                                                                             |
+|    github-token    | string |  false   |   `"${{ github.token }}"`    |                                                                                                  Token for gh. The calling job <br>must grant checks: write and pull-requests: <br>read.                                                                                                   |
+|        mode        | string |   true   |                              |                                                                                                                            One of "start", "finish" or "link".                                                                                                                             |
+|    parse-focus     | string |  false   |          `"false"`           |                                                                     start mode. Set to true to <br>split an optional trailing --focus expression <br>from the filter. Disabled by default <br>for existing consumers.                                                                      |
+|    parse-repeat    | string |  false   |          `"false"`           |                                                      start mode. Set to true to <br>accept `--repeat N` (1 to 10) before --focus: one <br>run whose suite repeats N extra <br>times. Disabled by default for existing <br>consumers.                                                       |
+|     parse-runs     | string |  false   |          `"false"`           |                       start mode. Set to true to <br>accept `--runs N` (1 to 5) before --focus: N <br>independent runs, each with its own <br>check-run and concurrency key. Cannot be <br>combined with --repeat. Disabled by default <br>for existing consumers.                         |
+|     pr-number      | string |  false   |                              |                                                                                                     start mode. Pull request number. Pass <br>the github.event.issue.number context.                                                                                                       |
+|       reply        | string |  false   |          `"false"`           | start mode. Set to true to <br>react to the command comment and <br>answer it with one reply that <br>links each run and shows its <br>result. Needs comment-id, and pull-requests: write <br>for github-token in every job that <br>runs start, link or finish. Disabled <br>by default.  |
+|        repo        | string |  false   | `"${{ github.repository }}"` |                                                                                                                               Repository in owner/name form.                                                                                                                               |
+| report-conclusion  | string |  false   |                              |                                                                      finish mode. What the test run <br>declared about itself, parsed from its <br>report. The only input that can <br>produce a neutral conclusion.                                                                       |
+|       run-id       | string |  false   |                              |                                                                                               start mode. Used to build the <br>check-run details link. Pass the github.run_id <br>context.                                                                                                |
+|     run-label      | string |  false   |                              |                                                                                   start mode. Short name for this <br>invocation's runs in the reply, such <br>as "Pro". Defaults to check-name-prefix.                                                                                    |
+|      run-url       | string |  false   |                              |                                                      link mode. URL of the run <br>dispatched for check-run-id. Stored on the <br>check, so link edits the check: <br>pass the same app inputs as <br>start when the app opened it.                                                        |
+|     server-url     | string |  false   |    `"https://github.com"`    |                                                                                        Base URL for the check-run details <br>link and the reply's links. Pass <br>the github.server_url context.                                                                                          |
+|    suite-result    | string |  false   |                              |                                                                                                         finish mode. Result of the suite <br>job. Pass the matching needs result.                                                                                                          |
+|      summary       | string |  false   |                              |                                                                                             finish mode. Markdown body for the <br>completed check-run. Defaults to the two <br>job results.                                                                                               |
+|    target-name     | string |  false   |                              |                                                   start mode. Target represented by this <br>invocation. Setting it enables --target parsing; <br>a different explicit target returns target-not-selected <br>without opening a check.                                                     |
 
 <!-- AUTO-DOC-INPUT:END -->
 
@@ -426,7 +480,7 @@ second check-run for the same filter. The error message names the distinction.
 
 ## Reporting failures to the author
 
-The action deliberately posts no comments. It emits the machine-readable
+Apart from the opt-in `reply`, the action posts no comments. It emits the machine-readable
 `reason` plus presentation-ready `reason-title` and `reason-guidance`, which
 keeps it usable by repositories that surface results differently. Pair it with
 `sticky-pr-comment` when the caller wants a comment.
diff --git a/.github/actions/comment-triggered-check/action.yml b/.github/actions/comment-triggered-check/action.yml
index c13af0a8..abd300bb 100644
--- a/.github/actions/comment-triggered-check/action.yml
+++ b/.github/actions/comment-triggered-check/action.yml
@@ -6,13 +6,17 @@ description: |
   command should run, resolves the pull request identity the event does not
   carry, and owns the check-run lifecycle.
 
-  Two modes. `start` parses the comment, authorizes the commenter, resolves the
+  Three modes. `start` parses the comment, authorizes the commenter, resolves the
   head SHA and base ref, and opens the check-run. `finish` resolves the terminal
-  outcome with a fail-closed matrix and completes it. Repeated commands are
+  outcome with a fail-closed matrix and completes it. `link` records the run a
+  check was dispatched to in the command's reply. Repeated commands are
   deduplicated by the caller's concurrency group, not here.
+
+  With `reply: true`, start answers the command comment with one reply that
+  lists its runs, and link and finish edit that reply as the runs progress.
 inputs:
   mode:
-    description: 'Either "start" or "finish".'
+    description: 'One of "start", "finish" or "link".'
     required: true
   command:
     description: 'Command word that must open the comment, on its own first line.'
@@ -66,16 +70,32 @@ inputs:
     description: 'start mode. Target represented by this invocation. Setting it enables --target parsing; a different explicit target returns target-not-selected without opening a check.'
     required: false
     default: ''
+  reply:
+    description: 'start mode. Set to true to react to the command comment and answer it with one reply that links each run and shows its result. Needs comment-id, and pull-requests: write for github-token in every job that runs start, link or finish. Disabled by default.'
+    required: false
+    default: 'false'
+  comment-id:
+    description: 'start mode. Id of the command comment, which the reply answers. Pass the github.event.comment.id context.'
+    required: false
+    default: ''
+  run-label:
+    description: 'start mode. Short name for this invocation''s runs in the reply, such as "Pro". Defaults to check-name-prefix.'
+    required: false
+    default: ''
+  run-url:
+    description: 'link mode. URL of the run dispatched for check-run-id. Stored on the check, so link edits the check: pass the same app inputs as start when the app opened it.'
+    required: false
+    default: ''
   run-id:
     description: 'start mode. Used to build the check-run details link. Pass the github.run_id context.'
     required: false
     default: ''
   server-url:
-    description: 'start mode. Base URL used to build the check-run details link. Pass the github.server_url context.'
+    description: 'Base URL for the check-run details link and the reply''s links. Pass the github.server_url context.'
     required: false
     default: 'https://github.com'
   check-run-id:
-    description: 'finish mode. The id returned by start mode. Empty is not an error; it means no check was opened.'
+    description: 'finish and link modes. The id returned by start mode. Empty is not an error; it means no check was opened.'
     required: false
     default: ''
   report-conclusion:
@@ -176,12 +196,12 @@ runs:
   using: composite
   steps:
     - name: Reject an unknown mode
-      if: inputs.mode != 'start' && inputs.mode != 'finish'
+      if: inputs.mode != 'start' && inputs.mode != 'finish' && inputs.mode != 'link'
       shell: bash
       env:
         INPUT_MODE: ${{ inputs.mode }}
       run: |
-        echo "::error::mode must be 'start' or 'finish', got '${INPUT_MODE}'"
+        echo "::error::mode must be 'start', 'finish' or 'link', got '${INPUT_MODE}'"
         exit 1
 
     # Only the identity that opened a check-run can complete it; start and
@@ -219,6 +239,9 @@ runs:
         INPUT_SERVER_URL: ${{ inputs.server-url }}
         INPUT_APP_TOKEN: ${{ steps.app-token.outputs.token }}
         INPUT_FINISH_WORKFLOW: ${{ inputs.finish-workflow }}
+        INPUT_REPLY: ${{ inputs.reply }}
+        INPUT_COMMENT_ID: ${{ inputs.comment-id }}
+        INPUT_RUN_LABEL: ${{ inputs.run-label }}
         GH_TOKEN: ${{ inputs.github-token }}
       run: ${{ github.action_path }}/src/start.sh
 
@@ -234,9 +257,23 @@ runs:
         INPUT_SUITE_RESULT: ${{ inputs.suite-result }}
         INPUT_SUMMARY: ${{ inputs.summary }}
         INPUT_DETAILS_URL: ${{ inputs.details-url }}
+        INPUT_SERVER_URL: ${{ inputs.server-url }}
         INPUT_APP_TOKEN: ${{ steps.app-token.outputs.token }}
         GH_TOKEN: ${{ inputs.github-token }}
       run: ${{ github.action_path }}/src/finish.sh
+
+    - name: Link
+      id: link
+      if: inputs.mode == 'link'
+      shell: bash
+      env:
+        INPUT_CHECK_RUN_ID: ${{ inputs.check-run-id }}
+        INPUT_RUN_URL: ${{ inputs.run-url }}
+        INPUT_REPO: ${{ inputs.repo }}
+        INPUT_SERVER_URL: ${{ inputs.server-url }}
+        INPUT_APP_TOKEN: ${{ steps.app-token.outputs.token }}
+        GH_TOKEN: ${{ inputs.github-token }}
+      run: ${{ github.action_path }}/src/link.sh
 branding:
   icon: 'play-circle'
   color: 'orange'
diff --git a/.github/actions/comment-triggered-check/src/finish.sh b/.github/actions/comment-triggered-check/src/finish.sh
index 81d9d08a..d0e2a421 100755
--- a/.github/actions/comment-triggered-check/src/finish.sh
+++ b/.github/actions/comment-triggered-check/src/finish.sh
@@ -23,6 +23,8 @@ set -euo pipefail
 
 # shellcheck source=.github/actions/comment-triggered-check/src/lib.sh
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+# shellcheck source=.github/actions/comment-triggered-check/src/reply.sh
+source "$(dirname "${BASH_SOURCE[0]}")/reply.sh"
 
 check_run_id="${INPUT_CHECK_RUN_ID:-}"
 repo="${INPUT_REPO:?INPUT_REPO required}"
@@ -199,5 +201,12 @@ republish_if_hidden() {
 
 republish_if_hidden
 
+# A command started with a reply stores its id on the check. Redrawing it needs
+# pull-requests: write; without that the reply keeps its last state.
+ref="$(check_reply_ref "$repo" "$check_run_id")"
+if [[ -n "$ref" ]]; then
+  reply_refresh "$repo" "$(jq -r .reply <<< "$ref")" "$(jq -r .sha <<< "$ref")"
+fi
+
 echo "::notice::published ${conclusion} to check-run ${check_run_id}"
 emit "conclusion" "$conclusion"
diff --git a/.github/actions/comment-triggered-check/src/lib.sh b/.github/actions/comment-triggered-check/src/lib.sh
index 79b84f3b..01141a9b 100755
--- a/.github/actions/comment-triggered-check/src/lib.sh
+++ b/.github/actions/comment-triggered-check/src/lib.sh
@@ -531,6 +531,128 @@ refusal_details() {
   esac
 }
 
+# --- Reply comment ------------------------------------------------------------
+# One reply per command comment, drawn entirely from the command's check-runs.
+# Each check's external_id is a small JSON object: the reply id (r), the
+# workflow attempt that opened it (a), its row label (l) and, once linked, its
+# run URL (u). The reply's own state holds only what never changes: the command
+# and the commit. So any writer that redraws after another's change draws it,
+# and nothing a stale writer puts back can hide a row or a link for good. The
+# state is base64 so user text can never close the HTML comment around it.
+
+REPLY_MARKER_PREFIX="<!-- comment-triggered-check:reply:"
+REPLY_STATE_PREFIX="<!-- comment-triggered-check:state "
+# A run link is drawn only when it matches this; link checks it with jq too, so
+# both use the same rule.
+RUN_URL_PATTERN='^https://[^\s()\[\]<>]+$'
+
+# reply_marker <comment-id> — first line of the reply for that command comment.
+reply_marker() {
+  printf '%s%s -->' "$REPLY_MARKER_PREFIX" "${1-}"
+}
+
+# reply_state_decode <body> — the state JSON from a reply body; empty and
+# non-zero when the body has no readable state.
+reply_state_decode() {
+  local line encoded json
+  line="$(grep -F -- "$REPLY_STATE_PREFIX" <<< "${1-}" | head -n1)" || return 1
+  encoded="${line#*"$REPLY_STATE_PREFIX"}"
+  encoded="${encoded%% -->*}"
+  json="$(printf '%s' "$encoded" | base64 -d 2>/dev/null)" || return 1
+  jq -e 'type == "object" and (.command | type) == "string"' <<< "$json" >/dev/null 2>&1 || return 1
+  jq -c . <<< "$json"
+}
+
+# is_run_url <url> — true when the URL may be drawn as a run link.
+is_run_url() {
+  jq -e -n --arg u "${1-}" --arg p "$RUN_URL_PATTERN" '$u | test($p)' >/dev/null 2>&1
+}
+
+# run_label <label> <repeat> <run-index> <run-count> — row label for one run.
+run_label() {
+  local label="${1-}" repeat="${2-}" k="${3:-1}" n="${4:-1}"
+  if [[ -n "$repeat" ]]; then
+    printf '%s, repeat %s' "$label" "$repeat"
+  elif (( n > 1 )); then
+    printf '%s, run %s of %s' "$label" "$k" "$n"
+  else
+    printf '%s' "$label"
+  fi
+}
+
+# reply_rows <reply-id> <check-runs-json> — the checks that belong to the reply,
+# newest attempt only, oldest first. Input is any array of check-runs.
+reply_rows() {
+  jq -c --argjson r "${1:-0}" '
+    [.[] | select(type == "object")
+     | . + {ext: ((.external_id // "") | try fromjson catch null)}
+     | select((.ext | type) == "object" and .ext.r == $r)]
+    | (map(.ext.a // 0) | max // 0) as $latest
+    | map(select((.ext.a // 0) == $latest))
+    | unique_by(.id)
+    | map({id, status, conclusion, head_sha, label: (.ext.l // "run"), url: (.ext.u // "")})
+  ' <<< "${2:-[]}"
+}
+
+# render_reply <state-json> <rows-json> <server-url> <repo>
+# The reply body. rows-json comes from reply_rows. No rows means the command is
+# still opening its checks, so the headline stays neutral: the first version of
+# a comment is the one notification emails carry.
+render_reply() {
+  local state="${1-}" rows="${2:-[]}" server="${3-}" repo="${4-}" encoded
+  encoded="$(printf '%s' "$state" | jq -c . | base64 | tr -d '\n')"
+  jq -r -n \
+    --argjson state "$state" \
+    --argjson rows "$rows" \
+    --arg base "${server}/${repo}" \
+    --arg marker "$(reply_marker "$(jq -r '.comment_id' <<< "$state")")" \
+    --arg encoded "$encoded" \
+    --arg state_prefix "$REPLY_STATE_PREFIX" \
+    --arg url_pattern "$RUN_URL_PATTERN" '
+    def bad: . as $c | ["failure", "timed_out", "cancelled", "action_required", "startup_failure", "stale"] | index($c) != null;
+    # CommonMark closes a code span only on a backtick run of the same length,
+    # so a fence one longer than the longest run in the text cannot be closed.
+    def code:
+      (if length > 200 then .[0:200] + "…" else . end) as $t
+      | ([$t | scan("`+") | length] | max // 0) as $longest
+      | ([range($longest + 1)] | map("`") | join("")) as $fence
+      | if $longest == 0 then $fence + $t + $fence else $fence + " " + $t + " " + $fence end;
+    def outcome:
+      {"success": "passed", "failure": "failed", "neutral": "nothing to run",
+       "timed_out": "timed out", "cancelled": "cancelled", "skipped": "skipped"}[.] // .;
+    ([$rows[] | .head_sha // empty][0] // $state.sha // "" | .[0:7]) as $sha
+    | ($rows | map(.status == "completed") | all) as $done
+    | ($rows | length) as $n
+    | (if $sha == "" then "" else " on `" + $sha + "`" end) as $on
+    | ($state.command | code) as $cmd
+    | (if $n == 0 then
+         ":rocket: " + $cmd + " is starting" + $on + "."
+       elif ($done | not) then
+         ":rocket: " + $cmd + " started " + ($n | tostring) + (if $n == 1 then " run" else " runs" end)
+         + $on + ". This comment updates when " + (if $n == 1 then "it finishes." else "they finish." end)
+       elif ($rows | map(.conclusion | bad) | any) then
+         ":x: " + $cmd + " finished" + $on + "."
+       else
+         ":white_check_mark: " + $cmd + " finished" + $on + "."
+       end) as $headline
+    | [$rows[]
+       | .label as $label
+       | ((.url // "") | if test($url_pattern) then . else "" end) as $url
+       | ($base + "/runs/" + (.id | tostring)) as $check_url
+       | if .status != "completed" then
+           if $url != "" then "- " + $label + ": running, [watch the run](" + $url + ")"
+           else "- " + $label + ": starting, [view the check](" + $check_url + ")" end
+         elif $url == "" and .conclusion == "failure" then
+           "- " + $label + ": did not start, [see why](" + $check_url + ")"
+         elif $url == "" then
+           "- " + $label + ": " + (.conclusion | outcome) + ", [view the check](" + $check_url + ")"
+         else
+           "- " + $label + ": " + (.conclusion | outcome) + ", [view the run](" + $url + ")"
+         end] as $lines
+    | ([$marker, $state_prefix + $encoded + " -->", $headline] + (if $n == 0 then [] else [""] + $lines end)) | join("\n")
+  '
+}
+
 # emit <name> <value> — write a step output and echo it for the log.
 # dispatch_ref_for <is-fork> <head-ref> <base-ref> — the ref whose workflow a
 # caller dispatches: the target branch for forks, the pull request's otherwise.
diff --git a/.github/actions/comment-triggered-check/src/link.sh b/.github/actions/comment-triggered-check/src/link.sh
new file mode 100755
index 00000000..8d129595
--- /dev/null
+++ b/.github/actions/comment-triggered-check/src/link.sh
@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+# link mode: store the run a check-run was dispatched to on that check, in
+# its external_id, and redraw the reply. Best effort, never fails the caller.
+#
+# The link lives on the check, not in the reply, so a job that overwrites the
+# reply with an older view still draws this link on its read-back pass.
+#
+# Inputs (env):
+#   INPUT_CHECK_RUN_ID  check-run opened by start mode
+#   INPUT_RUN_URL       URL of the run that works on that check
+#   INPUT_REPO          owner/name
+#   INPUT_SERVER_URL    github.server_url
+#   GH_TOKEN            token with pull-requests: write, and checks: write
+#                       when it opened the check
+#   INPUT_APP_TOKEN     optional GitHub App token, used when the app opened it
+set -euo pipefail
+
+# shellcheck source=.github/actions/comment-triggered-check/src/lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+# shellcheck source=.github/actions/comment-triggered-check/src/reply.sh
+source "$(dirname "${BASH_SOURCE[0]}")/reply.sh"
+
+check_run_id="${INPUT_CHECK_RUN_ID:-}"
+run_url="${INPUT_RUN_URL:-}"
+repo="${INPUT_REPO:?INPUT_REPO required}"
+
+if [[ ! "$check_run_id" =~ ^[0-9]+$ ]]; then
+  echo "no check-run to link"
+  exit 0
+fi
+if ! is_run_url "$run_url"; then
+  echo "::warning::run-url is not a plain https URL; not linking check-run ${check_run_id}"
+  exit 0
+fi
+
+ref="$(check_reply_ref "$repo" "$check_run_id")"
+if [[ -z "$ref" ]]; then
+  echo "check-run ${check_run_id} has no reply to update"
+  exit 0
+fi
+
+ext="$(jq -c --arg u "$run_url" '.ext + {u: $u}' <<< "$ref")"
+if ! GH_TOKEN="$(check_owner_token "$repo" "$check_run_id")" gh api --method PATCH \
+  "repos/${repo}/check-runs/${check_run_id}" -f "external_id=${ext}" >/dev/null 2>&1; then
+  echo "::warning::could not store the run link on check-run ${check_run_id}"
+  exit 0
+fi
+
+reply_refresh "$repo" "$(jq -r .reply <<< "$ref")" "$(jq -r .sha <<< "$ref")"
+echo "::notice::linked check-run ${check_run_id} to ${run_url}"
diff --git a/.github/actions/comment-triggered-check/src/reply.sh b/.github/actions/comment-triggered-check/src/reply.sh
new file mode 100755
index 00000000..1145d086
--- /dev/null
+++ b/.github/actions/comment-triggered-check/src/reply.sh
@@ -0,0 +1,109 @@
+#!/usr/bin/env bash
+# Reply comment I/O, sourced by start.sh, link.sh and finish.sh after lib.sh.
+#
+# The reply is a view of the command's check-runs (see lib.sh). Every writer
+# lists the checks, redraws the whole reply, reads it back and redraws again if
+# it differs, so a writer that overwrote it with an older view is corrected by
+# the next pass of any writer. Nothing here may fail a caller: a reply that
+# cannot be written only warns.
+#
+# Env: GH_TOKEN needs pull-requests: write to post and edit the reply.
+
+REPLY_ATTEMPTS="${INPUT_REPLY_ATTEMPTS:-4}"
+REPLY_JITTER_SECONDS="${INPUT_REPLY_JITTER_SECONDS:-2}"
+
+# reply_find <repo> <pr-number> <comment-id> — id of the existing reply, empty
+# when there is none. Non-zero when the comments could not be listed. Only bot
+# comments count: anyone who can comment could otherwise plant the marker.
+reply_find() {
+  local listing
+  listing="$(gh api --paginate "repos/${1}/issues/${2}/comments?per_page=100" 2>/dev/null)" || return 1
+  printf '%s' "$listing" | jq -r -s --arg m "$(reply_marker "$3")" '
+    [.[] | if type == "array" then .[] else . end
+     | select(type == "object" and .user.type == "Bot" and ((.body // "") | startswith($m)))
+     | .id] | first // ""
+  ' 2>/dev/null || return 1
+}
+
+# reply_create <repo> <pr-number> <state-json> — posts a reply that says the
+# command is starting and prints its id.
+reply_create() {
+  local body created
+  body="$(render_reply "$3" '[]' "${INPUT_SERVER_URL:-https://github.com}" "$1")" || return 1
+  created="$(gh api --method POST "repos/${1}/issues/${2}/comments" -f "body=${body}" 2>/dev/null)" || return 1
+  jq -r 'if (.id | type) == "number" then .id else empty end' <<< "$created"
+}
+
+# reply_checks_on <repo> <sha> — every check-run on the commit, superseded ones
+# included, as one array. Non-zero when the listing failed.
+reply_checks_on() {
+  local listing
+  listing="$(gh api --paginate "repos/${1}/commits/${2}/check-runs?filter=all&per_page=100" 2>/dev/null)" || return 1
+  printf '%s' "$listing" | jq -c -s '[.[] | .check_runs? // [] | .[]]' 2>/dev/null
+}
+
+# reply_refresh <repo> <reply-id> [sha] — redraws the reply from the checks on
+# its commit and on sha, writing only when the body changed, until a read finds
+# nothing to change. sha is the caller's own commit, which differs from the
+# stored one after a re-run on a pull request that moved.
+reply_refresh() {
+  local repo="$1" reply_id="$2" own_sha="${3-}" attempt current state body all checks sha
+  for ((attempt = 1; attempt <= REPLY_ATTEMPTS; attempt++)); do
+    if ! current="$(gh api "repos/${repo}/issues/comments/${reply_id}" 2>/dev/null | jq -r '.body // empty')" ||
+      [[ -z "$current" ]]; then
+      echo "::warning::could not read reply comment ${reply_id}"
+      return 0
+    fi
+    if ! state="$(reply_state_decode "$current")"; then
+      echo "::warning::reply comment ${reply_id} has no readable state; leaving it as is"
+      return 0
+    fi
+    all='[]'
+    while IFS= read -r sha; do
+      [[ -n "$sha" ]] || continue
+      if ! checks="$(reply_checks_on "$repo" "$sha")"; then
+        echo "::warning::could not list the checks on ${sha}; leaving reply comment ${reply_id} as is"
+        return 0
+      fi
+      all="$(jq -c --argjson more "$checks" '. + $more' <<< "$all")"
+    done < <(printf '%s\n%s\n' "$(jq -r '.sha // ""' <<< "$state")" "$own_sha" | awk 'NF && !seen[$0]++')
+    checks="$(reply_rows "$reply_id" "$all")"
+    # The rows decide the commit, so a stale writer cannot pin an old one.
+    state="$(jq -c --argjson rows "$checks" '.sha = ($rows[0].head_sha // .sha)' <<< "$state")"
+    body="$(render_reply "$state" "$checks" "${INPUT_SERVER_URL:-https://github.com}" "$repo")" || return 0
+    if [[ "$body" == "$current" ]]; then
+      return 0
+    fi
+    if ! gh api --method PATCH "repos/${repo}/issues/comments/${reply_id}" -f "body=${body}" >/dev/null 2>&1; then
+      echo "::warning::could not update reply comment ${reply_id} (attempt ${attempt}/${REPLY_ATTEMPTS})"
+    fi
+    # Read back after a pause, so a writer that read before this one wrote is
+    # caught on the next pass.
+    sleep "$(( RANDOM % (REPLY_JITTER_SECONDS + 1) ))"
+  done
+  echo "::warning::reply comment ${reply_id} was still changing after ${REPLY_ATTEMPTS} attempts"
+}
+
+# check_reply_ref <repo> <check-run-id> — {"reply": id, "sha": head, "ext": {...}}
+# for a check that belongs to a reply; empty when it does not or cannot be read.
+check_reply_ref() {
+  gh api "repos/${1}/check-runs/${2}" 2>/dev/null | jq -c '
+    ((.external_id // "") | try fromjson catch null) as $ext
+    | select(($ext | type) == "object" and ($ext.r | type) == "number")
+    | {reply: $ext.r, sha: (.head_sha // ""), ext: $ext}
+  ' 2>/dev/null || true
+}
+
+# check_owner_token <repo> <check-run-id> — the token that may edit the check:
+# GitHub lets only the identity that opened a check-run change it.
+check_owner_token() {
+  local owner
+  if [[ -n "${INPUT_APP_TOKEN:-}" ]]; then
+    owner="$(gh api "repos/${1}/check-runs/${2}" 2>/dev/null | jq -r '.app.slug // ""' 2>/dev/null)" || owner=""
+    if [[ "$owner" != "github-actions" ]]; then
+      printf '%s' "$INPUT_APP_TOKEN"
+      return 0
+    fi
+  fi
+  printf '%s' "${GH_TOKEN:-}"
+}
diff --git a/.github/actions/comment-triggered-check/src/start.sh b/.github/actions/comment-triggered-check/src/start.sh
index 166f49e0..0de59133 100755
--- a/.github/actions/comment-triggered-check/src/start.sh
+++ b/.github/actions/comment-triggered-check/src/start.sh
@@ -32,10 +32,15 @@
 #   GH_TOKEN                  token for gh
 #   INPUT_APP_TOKEN           optional GitHub App token for the check-run create
 #   INPUT_FINISH_WORKFLOW     workflow file that runs finish for this command
+#   INPUT_REPLY               whether to post a reply that links the runs
+#   INPUT_COMMENT_ID          github.event.comment.id, which the reply answers
+#   INPUT_RUN_LABEL           short name for this invocation's runs in the reply
 set -euo pipefail
 
 # shellcheck source=.github/actions/comment-triggered-check/src/lib.sh
 source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+# shellcheck source=.github/actions/comment-triggered-check/src/reply.sh
+source "$(dirname "${BASH_SOURCE[0]}")/reply.sh"
 
 command_word="${INPUT_COMMAND:-/test-e2e}"
 comment_body="${INPUT_COMMENT_BODY:-}"
@@ -53,6 +58,9 @@ parse_repeat="${INPUT_PARSE_REPEAT:-false}"
 parse_runs="${INPUT_PARSE_RUNS:-false}"
 allowed_targets="$(normalize_filter "${INPUT_ALLOWED_TARGETS-}")"
 target_name="${INPUT_TARGET_NAME:-}"
+want_reply="${INPUT_REPLY:-false}"
+comment_id="${INPUT_COMMENT_ID:-}"
+run_label="${INPUT_RUN_LABEL:-}"
 parse_target=false
 if [[ -n "$target_name" ]]; then
   parse_target=true
@@ -310,17 +318,49 @@ if [[ -n "${INPUT_APP_TOKEN:-}" ]]; then
   fi
 fi
 
-# open_check <name> — creates one check-run and prints its id; fails on anything
+# --- 4a. The reply ------------------------------------------------------------
+# Posted before the checks, so each check can carry the reply's id and every
+# later step finds the reply from the check alone. A re-run of this workflow
+# reuses the reply; its checks carry the new attempt, which replaces the rows.
+reply_id=""
+reply_created=false
+if [[ "$want_reply" == "true" && "$comment_id" =~ ^[0-9]+$ ]]; then
+  gh api --method POST "repos/${repo}/issues/comments/${comment_id}/reactions" -f "content=eyes" \
+    >/dev/null 2>&1 || echo "::warning::could not react to comment ${comment_id}"
+  if reply_id="$(reply_find "$repo" "$pr_number" "$comment_id")"; then
+    if [[ -z "$reply_id" ]]; then
+      new_state="$(jq -c -n --argjson c "$comment_id" --arg cmd "${command_word} ${args}" --arg sha "$head_sha" \
+        '{v: 2, comment_id: $c, command: $cmd, sha: $sha}')"
+      if reply_id="$(reply_create "$repo" "$pr_number" "$new_state")" && [[ -n "$reply_id" ]]; then
+        reply_created=true
+      else
+        reply_id=""
+        echo "::warning::could not post the reply to comment ${comment_id}"
+      fi
+    fi
+  else
+    reply_id=""
+    echo "::warning::could not list the comments of ${repo}#${pr_number}; not replying"
+  fi
+fi
+
+# open_check <name> <label> — creates one check-run and prints its id; fails on anything
 # that would leave a check nothing can close.
 open_check() {
   local created id
+  local -a extra=()
+  if [[ -n "$reply_id" ]]; then
+    extra=(-f "external_id=$(jq -c -n --argjson r "$reply_id" --argjson a "$run_attempt" --arg l "$2" \
+      '{r: $r, a: $a, l: $l}')")
+  fi
   if ! created="$(GH_TOKEN="$check_token" gh_json --method POST "repos/${repo}/check-runs" \
     -f "name=${1}" \
     -f "head_sha=${head_sha}" \
     -f "status=in_progress" \
     -f "details_url=${server_url}/${repo}/actions/runs/${run_id}" \
     -f "output[title]=Running" \
-    -f "output[summary]=${summary}")"; then
+    -f "output[summary]=${summary}" \
+    ${extra[@]+"${extra[@]}"})"; then
     echo "::warning::could not create the check-run ${1}; not starting a run" >&2
     return 1
   fi
@@ -339,6 +379,18 @@ open_check() {
 # One check per run, each with its own key, so the runs neither cancel nor hide
 # each other, and a repeated command replaces them one for one.
 opened=()
+label_base="${run_label:-$prefix}"
+# reply_update — draws this invocation's checks into the reply, or removes a
+# reply this invocation posted when none of its checks opened.
+reply_update() {
+  [[ -n "$reply_id" ]] || return 0
+  if [[ ${#opened[@]} -eq 0 && "$reply_created" == "true" ]]; then
+    gh api --method DELETE "repos/${repo}/issues/comments/${reply_id}" >/dev/null 2>&1 ||
+      echo "::warning::could not remove the empty reply ${reply_id}"
+    return 0
+  fi
+  reply_refresh "$repo" "$reply_id" "$head_sha"
+}
 for (( k = 1; k <= run_count; k++ )); do
   run_name="$base_name"
   run_key="$base_key"
@@ -350,7 +402,7 @@ for (( k = 1; k <= run_count; k++ )); do
     run_key="${base_key}-run-${k}-of-${run_count}"
   fi
 
-  if ! opened_id="$(open_check "$run_name")"; then
+  if ! opened_id="$(open_check "$run_name" "$(run_label "$label_base" "$repeat" "$k" "$run_count")")"; then
     # No run starts, so close what this command opened rather than leave it spinning.
     for id in ${opened[@]+"${opened[@]}"}; do
       GH_TOKEN="$check_token" gh_json --method PATCH "repos/${repo}/check-runs/${id}" \
@@ -360,6 +412,7 @@ for (( k = 1; k <= run_count; k++ )); do
         -f "output[summary]=Another run of this command could not be opened, so none started. Comment the command again." \
         >/dev/null || echo "::warning::could not close check-run ${id}"
     done
+    reply_update
     reason="check-run-not-created"
     should_run=false
     runs_json="[]"
@@ -371,6 +424,8 @@ for (( k = 1; k <= run_count; k++ )); do
   echo "::notice::started ${run_name} on ${head_sha}"
 done
 
+reply_update
+
 # The single-run outputs keep naming the first run for callers that read only those.
 check_run_id="$(jq -r '.[0]["check-run-id"]' <<< "$runs_json")"
 concurrency_key="$(jq -r '.[0]["concurrency-key"]' <<< "$runs_json")"
diff --git a/.github/actions/comment-triggered-check/test/action-wiring.bats b/.github/actions/comment-triggered-check/test/action-wiring.bats
index 1c5d0e91..13eb96b3 100644
--- a/.github/actions/comment-triggered-check/test/action-wiring.bats
+++ b/.github/actions/comment-triggered-check/test/action-wiring.bats
@@ -44,11 +44,11 @@ START="$BATS_TEST_DIRNAME/../src/start.sh"
   grep -Fq 'value: ${{ steps.start.outputs.is-fork }}' "$ACTION"
 }
 
-@test "the app inputs are optional, mint once, and reach both modes" {
+@test "the app inputs are optional, mint once, and reach every mode" {
   run grep -A3 '^  app-client-id:' "$ACTION"
   [[ "$output" == *"default: ''"* ]]
   run grep -A3 '^  app-private-key:' "$ACTION"
   [[ "$output" == *"default: ''"* ]]
   grep -Fq "if: inputs.app-client-id != '' && inputs.app-private-key != ''" "$ACTION"
-  [ "$(grep -Fc 'INPUT_APP_TOKEN: ${{ steps.app-token.outputs.token }}' "$ACTION")" -eq 2 ]
+  [ "$(grep -Fc 'INPUT_APP_TOKEN: ${{ steps.app-token.outputs.token }}' "$ACTION")" -eq 3 ]
 }
diff --git a/.github/actions/comment-triggered-check/test/finish.bats b/.github/actions/comment-triggered-check/test/finish.bats
index 2ae15dc4..fa896da2 100644
--- a/.github/actions/comment-triggered-check/test/finish.bats
+++ b/.github/actions/comment-triggered-check/test/finish.bats
@@ -408,3 +408,45 @@ creates() { calls_matching "method POST repos/loft-sh/demo/check-runs"; }
   [ "$status" -eq 0 ]
   [ "$(tokens_for "")" = "x" ]
 }
+
+# --- the reply ---------------------------------------------------------------
+
+seed_reply_for_4242() {
+  export INPUT_REPLY_JITTER_SECONDS="0" INPUT_SERVER_URL="https://github.com" INPUT_REPORT_CONCLUSION="success"
+  # The check as finish leaves it: completed, carrying the reply and its run.
+  jq -c -n '{id: 4242, name: "e2e-pro: snapshots", head_sha: "abc1234", app: {id: 1},
+             status: "completed", conclusion: "success",
+             external_id: ({r: 555, a: 1, l: "Pro", u: "https://e/1"} | tojson)}' \
+    > "$MOCK_DIR/checkrun-4242.json"
+  (
+    # shellcheck source=../src/lib.sh
+    source "$BATS_TEST_DIRNAME/../src/lib.sh"
+    render_reply '{"v":2,"comment_id":777,"command":"/test-e2e snapshots","sha":"abc1234"}' \
+      '[{"id":4242,"status":"in_progress","conclusion":null,"head_sha":"abc1234","label":"Pro","url":"https://e/1"}]' \
+      https://github.com loft-sh/demo
+  ) > "$MOCK_DIR/comment-555"
+}
+
+@test "finish redraws the reply of a check that has one" {
+  seed_reply_for_4242
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(kv conclusion)" = "success" ]
+  [[ "$(cat "$MOCK_DIR/comment-555")" == *':white_check_mark: `/test-e2e snapshots` finished on `abc1234`.'* ]]
+  [[ "$(cat "$MOCK_DIR/comment-555")" == *"- Pro: passed, [view the run](https://e/1)"* ]]
+}
+
+@test "finish still publishes when the reply cannot be edited" {
+  seed_reply_for_4242
+  export GH_MOCK_COMMENT_PATCH_FAIL=1 INPUT_REPLY_ATTEMPTS=1
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(kv conclusion)" = "success" ]
+  [[ "$output" == *"could not update reply comment 555"* ]]
+}
+
+@test "finish leaves comments alone for a check without a reply" {
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(calls_matching "issues/comments")" -eq 0 ]
+}
diff --git a/.github/actions/comment-triggered-check/test/gh_mock.bash b/.github/actions/comment-triggered-check/test/gh_mock.bash
index 4e20df58..2093e01b 100644
--- a/.github/actions/comment-triggered-check/test/gh_mock.bash
+++ b/.github/actions/comment-triggered-check/test/gh_mock.bash
@@ -15,6 +15,7 @@
 #   GH_MOCK_CREATE_JSON  body for POST .../check-runs
 #   GH_MOCK_CREATE_FAIL  non-empty → the create call fails
 #   GH_MOCK_CREATE_FAIL_FROM  N → the Nth create call and every later one fails
+#   GH_MOCK_CREATE_SEQ   non-empty → creates return ids 5001, 5002, ...
 #   GH_MOCK_PATCH_FAIL   non-empty → a PATCH fails
 #   GH_MOCK_CALLS        path; each invocation appends one line of args
 #   GH_MOCK_TOKENS       path; each invocation appends its GH_TOKEN and args
@@ -25,6 +26,16 @@
 #   GH_MOCK_LIST_JSON      raw body for that listing, for malformed-response cases
 #   GH_MOCK_WORKFLOW       YAML served by .../contents/... (base64, like the API)
 #   GH_MOCK_CONTENTS_FAIL  non-empty → the contents read fails
+#   GH_MOCK_COMMENTS_JSON  body for the pull request comment listing (default [])
+#   GH_MOCK_COMMENTS_FAIL  non-empty → that listing fails
+#   GH_MOCK_COMMENT_CREATE_FAIL non-empty → posting a comment fails
+#   GH_MOCK_COMMENT_PATCH_FAIL  non-empty → editing a comment fails
+# A PATCH to a seeded check-run stores its external_id in that check's file.
+# With GH_MOCK_CREATE_SEQ, a created check-run is seeded too. Seeded checks
+# answer the commit listing, filtered by head_sha.
+# A posted or edited comment body is kept in $MOCK_DIR/comment-<id>, and GET
+# .../issues/comments/<id> serves it. $MOCK_DIR/checkrun-<id>.json, when present,
+# answers GET .../check-runs/<id> ahead of GH_MOCK_CHECKRUN_JSON.
 
 setup_gh_mock() {
   MOCK_DIR="$(mktemp -d)"
@@ -52,7 +63,47 @@ default_create='{"id":4242}'
 default_checkrun='{"id":4242,"name":"e2e-pro: snapshots","head_sha":"abc123","app":{"id":1}}'
 default_permission='{"permission":"write"}'
 
+# field_value <name> — the value of the `-f name=value` argument.
+field_value() {
+  local prev=""
+  for a in "$@"; do
+    if [ "$prev" = "-f" ] && [ "${a%%=*}" = "$FIELD" ]; then
+      printf '%s' "${a#*=}"
+      return 0
+    fi
+    prev="$a"
+  done
+}
+
 case "$all" in
+  *"--method POST"*"/reactions"*)
+    printf '{"id":1}\n'
+    ;;
+  *"--method POST"*"/issues/"*"/comments"*)
+    [ -n "${GH_MOCK_COMMENT_CREATE_FAIL:-}" ] && { echo "mock: comment create failed" >&2; exit 1; }
+    FIELD=body field_value "$@" > "$MOCK_DIR/comment-9001"
+    printf '{"id":9001}\n'
+    ;;
+  *"--method PATCH"*"/issues/comments/"*)
+    [ -n "${GH_MOCK_COMMENT_PATCH_FAIL:-}" ] && { echo "mock: comment patch failed" >&2; exit 1; }
+    id="${all##*/issues/comments/}"; id="${id%% *}"
+    FIELD=body field_value "$@" > "$MOCK_DIR/comment-${id}"
+    printf '{}\n'
+    ;;
+  *"--method DELETE"*"/issues/comments/"*)
+    id="${all##*/issues/comments/}"; id="${id%% *}"
+    rm -f "$MOCK_DIR/comment-${id}"
+    printf '\n'
+    ;;
+  *"/issues/comments/"*)
+    id="${all##*/issues/comments/}"; id="${id%% *}"
+    [ -f "$MOCK_DIR/comment-${id}" ] || { echo "mock: no comment ${id}" >&2; exit 1; }
+    jq -n --rawfile b "$MOCK_DIR/comment-${id}" --argjson id "$id" '{id: $id, body: $b}'
+    ;;
+  *"/issues/"*"/comments"*)
+    [ -n "${GH_MOCK_COMMENTS_FAIL:-}" ] && { echo "mock: comments listing failed" >&2; exit 1; }
+    printf '%s\n' "${GH_MOCK_COMMENTS_JSON:-[]}"
+    ;;
   *"/contents/"*)
     [ -n "${GH_MOCK_CONTENTS_FAIL:-}" ] && { echo "mock: contents failed" >&2; exit 1; }
     printf '{"content":"%s"}\n' "$(printf '%s' "${GH_MOCK_WORKFLOW:-}" | base64 | tr -d '\n')"
@@ -64,10 +115,32 @@ case "$all" in
       echo "$creates" > "$MOCK_DIR/creates"
       [ "$creates" -ge "$GH_MOCK_CREATE_FAIL_FROM" ] && { echo "mock: create failed" >&2; exit 1; }
     fi
+    if [ -n "${GH_MOCK_CREATE_SEQ:-}" ]; then
+      seq=$(( $(cat "$MOCK_DIR/seq" 2>/dev/null || echo 5000) + 1 ))
+      echo "$seq" > "$MOCK_DIR/seq"
+      # Kept, so a later read or commit listing sees the check as created.
+      jq -c -n --argjson id "$seq" --arg n "$(FIELD=name field_value "$@")" \
+        --arg sha "$(FIELD=head_sha field_value "$@")" --arg e "$(FIELD=external_id field_value "$@")" \
+        '{id: $id, name: $n, head_sha: $sha, status: "in_progress", conclusion: null,
+          app: {slug: "github-actions"}, external_id: $e}' > "$MOCK_DIR/checkrun-${seq}.json"
+      printf '{"id":%s}\n' "$seq"
+      exit 0
+    fi
     printf '%s\n' "${GH_MOCK_CREATE_JSON:-$default_create}"
     ;;
   *"--method PATCH"*)
     [ -n "${GH_MOCK_PATCH_FAIL:-}" ] && { echo "mock: patch failed" >&2; exit 1; }
+    # A seeded check keeps the external_id written to it.
+    case "$all" in
+      *"check-runs/"*)
+        id="${all##*check-runs/}"; id="${id%% *}"
+        ext="$(FIELD=external_id field_value "$@")"
+        if [ -n "$ext" ] && [ -f "$MOCK_DIR/checkrun-${id}.json" ]; then
+          jq -c --arg e "$ext" '.external_id = $e' "$MOCK_DIR/checkrun-${id}.json" > "$MOCK_DIR/x.$$" &&
+            mv "$MOCK_DIR/x.$$" "$MOCK_DIR/checkrun-${id}.json"
+        fi
+        ;;
+    esac
     printf '{}\n'
     ;;
   *"/pulls/"*)
@@ -82,6 +155,12 @@ case "$all" in
   *"/commits/"*"check-runs"*)
     [ -n "${GH_MOCK_LIST_FAIL:-}" ] && { echo "mock: listing failed" >&2; exit 1; }
     [ -n "${GH_MOCK_LIST_JSON+x}" ] && { printf '%s\n' "$GH_MOCK_LIST_JSON"; exit 0; }
+    # Seeded checks, when there are any, are the commit's checks.
+    if ls "$MOCK_DIR"/checkrun-*.json >/dev/null 2>&1; then
+      sha="${all##*/commits/}"; sha="${sha%%/*}"
+      cat "$MOCK_DIR"/checkrun-*.json | jq -c -s --arg sha "$sha" '{check_runs: map(select(.head_sha == $sha))}'
+      exit 0
+    fi
     ids=""
     for id in ${GH_MOCK_LATEST_IDS-4242}; do
       ids="${ids:+${ids},}{\"id\":${id},\"name\":\"check-${id}\",\"app\":{\"id\":1}}"
@@ -90,6 +169,8 @@ case "$all" in
     ;;
   *"check-runs/"*)
     [ -n "${GH_MOCK_CHECKRUN_FAIL:-}" ] && { echo "mock: check-run lookup failed" >&2; exit 1; }
+    id="${all##*check-runs/}"; id="${id%% *}"
+    [ -f "$MOCK_DIR/checkrun-${id}.json" ] && { cat "$MOCK_DIR/checkrun-${id}.json"; exit 0; }
     printf '%s\n' "${GH_MOCK_CHECKRUN_JSON:-$default_checkrun}"
     ;;
   *)
diff --git a/.github/actions/comment-triggered-check/test/reply.bats b/.github/actions/comment-triggered-check/test/reply.bats
new file mode 100644
index 00000000..9f9e8077
--- /dev/null
+++ b/.github/actions/comment-triggered-check/test/reply.bats
@@ -0,0 +1,296 @@
+#!/usr/bin/env bats
+# The reply comment: pure rendering, link mode, and redraws against a stubbed gh.
+
+load gh_mock
+
+LIB="$BATS_TEST_DIRNAME/../src/lib.sh"
+LINK="$BATS_TEST_DIRNAME/../src/link.sh"
+BASE="https://github.com/loft-sh/demo"
+
+setup() {
+  # shellcheck source=../src/lib.sh
+  source "$LIB"
+  setup_gh_mock
+  export INPUT_REPO="loft-sh/demo"
+  export INPUT_SERVER_URL="https://github.com"
+  export INPUT_REPLY_JITTER_SECONDS="0"
+  export GH_TOKEN="x"
+}
+
+teardown() {
+  teardown_gh_mock
+}
+
+state() {
+  jq -c -n --arg cmd "${1:-/test-e2e snapshots}" '{v: 2, comment_id: 777, command: $cmd, sha: "abc1234def56"}'
+}
+# row <id> <label> <status> [conclusion] [url] — one reply row, as reply_rows gives it.
+row() {
+  jq -c -n --argjson id "$1" --arg l "$2" --arg s "$3" --arg c "${4-}" --arg u "${5-}" \
+    '{id: $id, label: $l, status: $s, conclusion: (if $c == "" then null else $c end), head_sha: "abc1234def56", url: $u}'
+}
+# seed_check <id> <label> <status> [conclusion] [url] [attempt] [reply] — a
+# check-run on the commit, stamped for reply 555 unless told otherwise.
+seed_check() {
+  jq -c -n --argjson id "$1" --arg l "$2" --arg s "$3" --arg c "${4-}" --arg u "${5-}" \
+    --argjson a "${6:-1}" --argjson r "${7:-555}" '
+    {id: $id, name: ("check-" + ($id | tostring)), status: $s, conclusion: (if $c == "" then null else $c end),
+     head_sha: "abc1234def56", app: {slug: "github-actions"},
+     external_id: ({r: $r, a: $a, l: $l} + (if $u == "" then {} else {u: $u} end) | tojson)}
+  ' > "$MOCK_DIR/checkrun-$1.json"
+}
+seed_reply() { render_reply "$(state)" '[]' https://github.com loft-sh/demo > "$MOCK_DIR/comment-555"; }
+body() { cat "$MOCK_DIR/comment-555"; }
+refresh() {
+  # shellcheck source=../src/reply.sh
+  source "$BATS_TEST_DIRNAME/../src/reply.sh"
+  reply_refresh loft-sh/demo 555 "$@"
+}
+
+# --- rendering ---------------------------------------------------------------
+
+@test "a running run with a link says running and links the run" {
+  run render_reply "$(state)" "[$(row 11 Pro in_progress "" https://example.com/run/1)]" https://github.com loft-sh/demo
+  [[ "$output" == *':rocket: `/test-e2e snapshots` started 1 run on `abc1234`. This comment updates when it finishes.'* ]]
+  [[ "$output" == *"- Pro: running, [watch the run](https://example.com/run/1)"* ]]
+}
+
+@test "a run with no link yet points at its check" {
+  run render_reply "$(state)" "[$(row 11 Pro in_progress),$(row 12 OSS queued)]" https://github.com loft-sh/demo
+  [[ "$output" == *"started 2 runs"*"when they finish."* ]]
+  [[ "$output" == *"- OSS: starting, [view the check](${BASE}/runs/12)"* ]]
+}
+
+@test "a reply with no rows yet says the command is starting, never that it failed" {
+  run render_reply "$(state)" '[]' https://github.com loft-sh/demo
+  [[ "$output" == *':rocket: `/test-e2e snapshots` is starting on `abc1234`.'* ]]
+  [[ "$output" != *":x:"* ]]
+}
+
+@test "finished runs show their outcome and a check mark when none failed" {
+  run render_reply "$(state)" \
+    "[$(row 11 Pro completed success https://e/1),$(row 12 OSS completed neutral https://e/2)]" https://github.com loft-sh/demo
+  [[ "$output" == *':white_check_mark: `/test-e2e snapshots` finished on `abc1234`.'* ]]
+  [[ "$output" == *"- Pro: passed, [view the run](https://e/1)"* ]]
+  [[ "$output" == *"- OSS: nothing to run, [view the run](https://e/2)"* ]]
+}
+
+@test "any failed, timed out or cancelled run gives a cross" {
+  for pair in failure:failed timed_out:"timed out" cancelled:cancelled; do
+    c="${pair%%:*}" phrase="${pair#*:}"
+    run render_reply "$(state)" \
+      "[$(row 11 Pro completed success https://e/1),$(row 12 OSS completed "$c" https://e/2)]" https://github.com loft-sh/demo
+    [[ "$output" == *":x: "*"finished"* ]]
+    [[ "$output" == *"- OSS: ${phrase//\"/}, [view the run](https://e/2)"* ]]
+  done
+}
+
+@test "the headline waits for the last run" {
+  run render_reply "$(state)" \
+    "[$(row 11 Pro completed failure https://e/1),$(row 12 OSS in_progress "" https://e/2)]" https://github.com loft-sh/demo
+  [[ "$output" == *":rocket: "* ]]
+  [[ "$output" == *"- Pro: failed,"* ]]
+}
+
+@test "a failed check that never got a run did not start" {
+  run render_reply "$(state)" "[$(row 13 "Platform, run 3 of 3" completed failure)]" https://github.com loft-sh/demo
+  [[ "$output" == *"- Platform, run 3 of 3: did not start, [see why](${BASE}/runs/13)"* ]]
+}
+
+@test "a backtick in the command cannot break out of the code span" {
+  run render_reply "$(state '/test-e2e a`b')" '[]' https://github.com loft-sh/demo
+  [[ "$output" == *'`` /test-e2e a`b ``'* ]]
+}
+
+@test "a run of backticks gets a longer fence, so text after it stays code" {
+  run render_reply "$(state '/test-e2e a``b @someone')" '[]' https://github.com loft-sh/demo
+  [[ "$output" == *'``` /test-e2e a``b @someone ```'* ]]
+}
+
+@test "a long command is shortened" {
+  long="/test-e2e $(printf 'x%.0s' {1..300})"
+  run render_reply "$(state "$long")" '[]' https://github.com loft-sh/demo
+  [[ "$output" == *"…\`"* ]]
+  [[ "$output" != *"$long"* ]]
+}
+
+@test "the state survives a render, even when the command closes an HTML comment" {
+  s="$(state '/test-e2e a --> <!-- b')"
+  body="$(render_reply "$s" '[]' https://github.com loft-sh/demo)"
+  [ "$(reply_state_decode "$body")" = "$s" ]
+  [ "$(head -n1 <<< "$body")" = "<!-- comment-triggered-check:reply:777 -->" ]
+}
+
+@test "a body without state is not decoded" {
+  run reply_state_decode "just a comment"
+  [ "$status" -ne 0 ]
+  [ -z "$output" ]
+}
+
+@test "row labels name the run or the repeat" {
+  [ "$(run_label Pro "" 1 1)" = "Pro" ]
+  [ "$(run_label Platform "" 2 3)" = "Platform, run 2 of 3" ]
+  [ "$(run_label Platform 4 1 1)" = "Platform, repeat 4" ]
+}
+
+@test "a run URL that is not a plain https link is never rendered" {
+  for bad in 'https://e/1)[x](https://evil' 'javascript:alert(1)' 'http://e/1' 'https://e/<b>' 'https://e/1?x=[a]'; do
+    run render_reply "$(state)" "[$(row 11 Pro in_progress "" "$bad")]" https://github.com loft-sh/demo
+    [[ "$output" == *"- Pro: starting, [view the check](${BASE}/runs/11)"* ]]
+    [[ "$output" != *"evil"* && "$output" != *"javascript"* ]]
+    run is_run_url "$bad"
+    [ "$status" -ne 0 ]
+  done
+  is_run_url "https://github.com/loft-sh/demo/actions/runs/42"
+}
+
+# --- which checks are rows ---------------------------------------------------
+
+@test "rows are this reply's checks from the newest attempt, oldest first" {
+  seed_check 21 OSS in_progress "" "" 2
+  seed_check 20 Pro in_progress "" "" 2
+  seed_check 11 Pro completed failure "" 1
+  seed_check 30 Other in_progress "" "" 9 999
+  printf '%s' '{"id":31,"external_id":"555"}' > "$MOCK_DIR/checkrun-31.json"
+  run reply_rows 555 "$(cat "$MOCK_DIR"/checkrun-*.json | jq -s .)"
+  [ "$(jq -c 'map([.id, .label])' <<< "$output")" = '[[20,"Pro"],[21,"OSS"]]' ]
+}
+
+# --- redraws -----------------------------------------------------------------
+
+@test "a redraw draws the checks into the reply and stops once it matches" {
+  seed_reply
+  seed_check 11 Pro completed success https://e/1
+  run refresh
+  [ "$status" -eq 0 ]
+  [ "$(calls_matching "PATCH")" -eq 1 ]
+  [[ "$(body)" == *"- Pro: passed, [view the run](https://e/1)"* ]]
+}
+
+@test "a redraw that changes nothing writes nothing" {
+  seed_check 11 Pro in_progress "" https://e/1
+  render_reply "$(state)" "[$(row 11 Pro in_progress "" https://e/1)]" https://github.com loft-sh/demo > "$MOCK_DIR/comment-555"
+  run refresh
+  [ "$status" -eq 0 ]
+  [ "$(calls_matching "PATCH")" -eq 0 ]
+}
+
+@test "a stale write that dropped a row is restored by the next redraw" {
+  # A finish from the old attempt writes back a reply without the new rows.
+  seed_check 11 Pro completed cancelled https://e/old 1
+  seed_check 20 Pro in_progress "" https://e/new 2
+  render_reply "$(state)" "[$(row 11 Pro completed cancelled https://e/old)]" https://github.com loft-sh/demo > "$MOCK_DIR/comment-555"
+  run refresh
+  [ "$status" -eq 0 ]
+  [[ "$(body)" == *"- Pro: running, [watch the run](https://e/new)"* ]]
+  [[ "$(body)" != *"e/old"* ]]
+}
+
+@test "a redraw finds the checks of a re-run on a newer commit" {
+  seed_reply
+  seed_check 11 Pro completed success https://e/1 1
+  jq -c '.id = 20 | .head_sha = "def5678aaaa" | .status = "in_progress" | .conclusion = null
+         | .external_id = ({r: 555, a: 2, l: "Pro"} | tojson)' \
+    "$MOCK_DIR/checkrun-11.json" > "$MOCK_DIR/checkrun-20.json"
+  run refresh def5678aaaa
+  [ "$status" -eq 0 ]
+  [[ "$(body)" == *"started 1 run on \`def5678\`"*"runs/20"* ]]
+  [ "$(reply_state_decode "$(body)" | jq -r .sha)" = "def5678aaaa" ]
+}
+
+@test "a redraw leaves the reply alone when the checks cannot be listed" {
+  seed_reply
+  before="$(body)"
+  export GH_MOCK_LIST_FAIL=1
+  run refresh
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"could not list the checks"* ]]
+  [ "$(body)" = "$before" ]
+}
+
+# --- link mode ---------------------------------------------------------------
+
+@test "link stores the run on its check and redraws the reply" {
+  seed_reply
+  seed_check 11 Pro in_progress
+  seed_check 12 OSS in_progress
+  export INPUT_CHECK_RUN_ID=11 INPUT_RUN_URL="https://github.com/loft-sh/demo/actions/runs/99"
+  run bash "$LINK"
+  [ "$status" -eq 0 ]
+  [ "$(jq -c '.external_id | fromjson' "$MOCK_DIR/checkrun-11.json")" = '{"r":555,"a":1,"l":"Pro","u":"https://github.com/loft-sh/demo/actions/runs/99"}' ]
+  [[ "$(body)" == *"- Pro: running, [watch the run](https://github.com/loft-sh/demo/actions/runs/99)"* ]]
+  [[ "$(body)" == *"- OSS: starting,"* ]]
+}
+
+@test "a job that overwrites the reply with an older view restores the other job's link" {
+  # Job A links run 11 and returns. Job B read the reply before A wrote, so its
+  # write drops A's link. B's own read-back must still draw it.
+  seed_reply
+  seed_check 11 Pro in_progress
+  seed_check 12 OSS in_progress
+  stale="$(body)"
+  INPUT_CHECK_RUN_ID=11 INPUT_RUN_URL="https://e/a" run bash "$LINK"
+  [[ "$(body)" == *"- Pro: running, [watch the run](https://e/a)"* ]]
+
+  printf '%s' "$stale" > "$MOCK_DIR/comment-555"
+  INPUT_CHECK_RUN_ID=12 INPUT_RUN_URL="https://e/b" run bash "$LINK"
+  [ "$status" -eq 0 ]
+  [[ "$(body)" == *"- Pro: running, [watch the run](https://e/a)"* ]]
+  [[ "$(body)" == *"- OSS: running, [watch the run](https://e/b)"* ]]
+}
+
+@test "link edits the check with the token that opened it" {
+  seed_reply
+  seed_check 11 Pro in_progress
+  jq -c '.app.slug = "ci-app"' "$MOCK_DIR/checkrun-11.json" > "$MOCK_DIR/x" && mv "$MOCK_DIR/x" "$MOCK_DIR/checkrun-11.json"
+  export INPUT_APP_TOKEN="app" INPUT_CHECK_RUN_ID=11 INPUT_RUN_URL="https://e/1"
+  run bash "$LINK"
+  [ "$status" -eq 0 ]
+  [ "$(tokens_for "PATCH repos/loft-sh/demo/check-runs/11")" = "app" ]
+  [ "$(tokens_for "PATCH repos/loft-sh/demo/issues/comments/555")" = "x" ]
+}
+
+@test "link does nothing for a check without a reply" {
+  export INPUT_CHECK_RUN_ID=4242 INPUT_RUN_URL="https://github.com/loft-sh/demo/actions/runs/99"
+  run bash "$LINK"
+  [ "$status" -eq 0 ]
+  [ "$(calls_matching "issues/comments")" -eq 0 ]
+  [ "$(calls_matching "PATCH")" -eq 0 ]
+}
+
+@test "link refuses a run URL the reply would not draw" {
+  for bad in "https://e/1) [x](https://evil" "https://e/1?x=[a]"; do
+    export INPUT_CHECK_RUN_ID=11 INPUT_RUN_URL="$bad"
+    run bash "$LINK"
+    [ "$status" -eq 0 ]
+    [[ "$output" == *"not a plain https URL"* ]]
+  done
+  [ "$(call_count)" -eq 0 ]
+}
+
+@test "link without a check id is a no-op" {
+  export INPUT_CHECK_RUN_ID="" INPUT_RUN_URL="https://e/1"
+  run bash "$LINK"
+  [ "$status" -eq 0 ]
+  [ "$(call_count)" -eq 0 ]
+}
+
+@test "link never fails the caller when the check cannot be edited" {
+  seed_reply
+  seed_check 11 Pro in_progress
+  export GH_MOCK_PATCH_FAIL=1 INPUT_CHECK_RUN_ID=11 INPUT_RUN_URL="https://e/1"
+  run bash "$LINK"
+  [ "$status" -eq 0 ]
+  [[ "$output" == *"could not store the run link on check-run 11"* ]]
+}
+
+@test "link retries a reply it cannot edit and never fails the caller" {
+  seed_reply
+  seed_check 11 Pro in_progress
+  export GH_MOCK_COMMENT_PATCH_FAIL=1 INPUT_REPLY_ATTEMPTS=2
+  export INPUT_CHECK_RUN_ID=11 INPUT_RUN_URL="https://github.com/loft-sh/demo/actions/runs/99"
+  run bash "$LINK"
+  [ "$status" -eq 0 ]
+  [ "$(calls_matching "PATCH repos/loft-sh/demo/issues/comments/555")" -eq 2 ]
+  [[ "$output" == *"could not update reply comment 555"* ]]
+}
diff --git a/.github/actions/comment-triggered-check/test/start.bats b/.github/actions/comment-triggered-check/test/start.bats
index 8e8e2188..478235e9 100644
--- a/.github/actions/comment-triggered-check/test/start.bats
+++ b/.github/actions/comment-triggered-check/test/start.bats
@@ -608,3 +608,135 @@ app_finish_workflow() {
   [ "$(calls_matching "/contents/")" -eq 0 ]
   [ "$(tokens_for "POST")" = "x" ]
 }
+
+# --- the reply ---------------------------------------------------------------
+
+reply_on() {
+  export INPUT_REPLY="true" INPUT_COMMENT_ID="777" INPUT_RUN_LABEL="Pro"
+  export INPUT_REPLY_JITTER_SECONDS="0" GH_MOCK_CREATE_SEQ=1
+}
+reply_body() { cat "$MOCK_DIR/comment-9001"; }
+ext_of() { jq -c '.external_id | fromjson' "$MOCK_DIR/checkrun-$1.json"; }
+EXISTING='[{"id":9001,"user":{"type":"Bot"},"body":"<!-- comment-triggered-check:reply:777 -->"}]'
+
+@test "without reply the command posts and reacts to nothing" {
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(calls_matching "comments")" -eq 0 ]
+  [ "$(calls_matching "reactions")" -eq 0 ]
+  [ "$(calls_matching "external_id")" -eq 0 ]
+}
+
+@test "reply reacts, posts one reply, and stamps it on the check" {
+  reply_on
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(kv should-run)" = "true" ]
+  [ "$(calls_matching "POST repos/loft-sh/demo/issues/comments/777/reactions -f content=eyes")" -eq 1 ]
+  [ "$(calls_matching "POST repos/loft-sh/demo/issues/7/comments")" -eq 1 ]
+  [ "$(ext_of 5001)" = '{"r":9001,"a":1,"l":"Pro"}' ]
+  [ "$(head -n1 <<< "$(reply_body)")" = "<!-- comment-triggered-check:reply:777 -->" ]
+  [[ "$(reply_body)" == *':rocket: `/test-e2e snapshots` started 1 run on `abc123`.'* ]]
+  [[ "$(reply_body)" == *"- Pro: starting, [view the check](https://github.com/loft-sh/demo/runs/5001)"* ]]
+}
+
+@test "the first version of the reply never announces a failure" {
+  reply_on
+  run bash "$SCRIPT"
+  first="$(grep -m1 "POST repos/loft-sh/demo/issues/7/comments" "$GH_MOCK_CALLS")"
+  [[ "$first" == *':rocket: `/test-e2e snapshots` is starting on `abc123`.'* ]]
+  [[ "$first" != *":x:"* ]]
+}
+
+@test "reply labels every run of --runs" {
+  reply_on
+  export INPUT_PARSE_RUNS="true" INPUT_COMMENT_BODY="/test-e2e snapshots --runs 3"
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(for id in 5001 5002 5003; do ext_of "$id" | jq -r .l; done | paste -sd, -)" = "Pro, run 1 of 3,Pro, run 2 of 3,Pro, run 3 of 3" ]
+  [[ "$(reply_body)" == *"started 3 runs"*"- Pro, run 3 of 3: starting,"* ]]
+}
+
+@test "the label defaults to the check name prefix" {
+  reply_on
+  unset INPUT_RUN_LABEL
+  run bash "$SCRIPT"
+  [ "$(ext_of 5001 | jq -r .l)" = "e2e" ]
+}
+
+@test "a second invocation in the same run adds its rows to the same reply" {
+  reply_on
+  run bash "$SCRIPT"
+  export GH_MOCK_COMMENTS_JSON="$EXISTING" INPUT_RUN_LABEL="OSS"
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(calls_matching "POST repos/loft-sh/demo/issues/7/comments")" -eq 1 ]
+  [[ "$(reply_body)" == *"started 2 runs"*"- Pro: starting,"*"- OSS: starting,"* ]]
+}
+
+@test "a re-run of the workflow shows only its own checks in the same reply" {
+  reply_on
+  run bash "$SCRIPT"
+  export GH_MOCK_COMMENTS_JSON="$EXISTING" INPUT_RUN_ATTEMPT="2"
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(calls_matching "POST repos/loft-sh/demo/issues/7/comments")" -eq 1 ]
+  [ "$(ext_of 5002)" = '{"r":9001,"a":2,"l":"Pro"}' ]
+  [[ "$(reply_body)" == *"started 1 run"*"runs/5002"* ]]
+  [[ "$(reply_body)" != *"runs/5001"* ]]
+}
+
+@test "a reply that cannot be posted still runs the command" {
+  reply_on
+  export GH_MOCK_COMMENT_CREATE_FAIL=1
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(kv should-run)" = "true" ]
+  [[ "$output" == *"could not post the reply"* ]]
+  [ "$(calls_matching "external_id")" -eq 0 ]
+}
+
+@test "comments that cannot be listed skip the reply and still run the command" {
+  reply_on
+  export GH_MOCK_COMMENTS_FAIL=1
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(kv should-run)" = "true" ]
+  [ "$(calls_matching "POST repos/loft-sh/demo/issues/7/comments")" -eq 0 ]
+}
+
+@test "a reply with no check behind it is removed" {
+  reply_on
+  export GH_MOCK_CREATE_FAIL=1
+  run bash "$SCRIPT"
+  [ "$(kv reason)" = "check-run-not-created" ]
+  [ "$(calls_matching "DELETE repos/loft-sh/demo/issues/comments/9001")" -eq 1 ]
+}
+
+@test "a refused command posts no reply" {
+  reply_on
+  export INPUT_AUTHOR_ASSOCIATION="NONE"
+  run bash "$SCRIPT"
+  [ "$(kv reason)" = "insufficient-permission" ]
+  [ "$(calls_matching "comments")" -eq 0 ]
+}
+
+@test "reply without a comment id does nothing extra" {
+  reply_on
+  export INPUT_COMMENT_ID=""
+  run bash "$SCRIPT"
+  [ "$(kv should-run)" = "true" ]
+  [ "$(calls_matching "comments")" -eq 0 ]
+}
+
+@test "a person's comment carrying the reply marker is not taken as the reply" {
+  reply_on
+  printf '<!-- comment-triggered-check:reply:777 -->\nplanted' > "$MOCK_DIR/comment-6000"
+  export GH_MOCK_COMMENTS_JSON='[{"id":6000,"user":{"type":"User"},"body":"<!-- comment-triggered-check:reply:777 -->\nplanted"}]'
+  run bash "$SCRIPT"
+  [ "$status" -eq 0 ]
+  [ "$(calls_matching "POST repos/loft-sh/demo/issues/7/comments")" -eq 1 ]
+  [ "$(ext_of 5001 | jq -r .r)" = "9001" ]
+  [ "$(calls_matching "issues/comments/6000")" -eq 0 ]
+  [ "$(cat "$MOCK_DIR/comment-6000")" = $'<!-- comment-triggered-check:reply:777 -->\nplanted' ]
+}