diff --git a/.github/workflows/copilot-review-tests.lock.yml b/.github/workflows/copilot-review-tests.lock.yml
index ab7bdeff1ff8..d7ac9dd14e94 100644
--- a/.github/workflows/copilot-review-tests.lock.yml
+++ b/.github/workflows/copilot-review-tests.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"478424151672a1d00be2f61c9d74e9a372766a90126cf5b02fa0c03d0e1a1802","body_hash":"44becb5921a41041d2bfe4f01ab40a77a42cabe36e4b2f68d213eba783e7bde3","compiler_version":"v0.79.8","strict":true,"agent_id":"copilot","agent_model":"claude-sonnet-4.6","engine_versions":{"copilot":"1.0.60"}}
+# gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"9ab192f5db28928c77ad216be142ee5cc92df89e30836d460acbc8f281adb85e","body_hash":"44becb5921a41041d2bfe4f01ab40a77a42cabe36e4b2f68d213eba783e7bde3","compiler_version":"v0.79.8","strict":true,"agent_id":"copilot","agent_model":"claude-sonnet-4.6","engine_versions":{"copilot":"1.0.60"}}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"df4cb1c069e1874edd31b4311f1884172cec0e10","version":"v6.0.3"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"c0338fef4749d08c21f8f975fb0e37efa17dda47","version":"v0.79.8"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.27.2","digest":"sha256:f88e5b17b6b7a600117bc121114d6ce2155c88c983c0c939c5df884f730fa1d6","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.27.2@sha256:f88e5b17b6b7a600117bc121114d6ce2155c88c983c0c939c5df884f730fa1d6"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.2","digest":"sha256:ee39841d980878ebbb87592903b06d31a1af500c71525c9616f7e8e2a27041a4","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.27.2@sha256:ee39841d980878ebbb87592903b06d31a1af500c71525c9616f7e8e2a27041a4"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.27.2","digest":"sha256:2e3a717e5f19a654cd9a2263beb52012b56bcb68562ec5ae2e42f9d156b49591","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.27.2@sha256:2e3a717e5f19a654cd9a2263beb52012b56bcb68562ec5ae2e42f9d156b49591"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.25","digest":"sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.25@sha256:c10331ad17668ef89f38f5e356678788a40b0cd5fef96e8f92e1d9c1de47cbaa"},{"image":"ghcr.io/github/github-mcp-server:v1.1.2","digest":"sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c","pinned_image":"ghcr.io/github/github-mcp-server:v1.1.2@sha256:30197479d8036c7811892bc07e06f9a05c9ef3cdd79bc59f256d50647f95788c"}]}
 # This file was automatically generated by gh-aw (v0.79.8). DO NOT EDIT. To debug this workflow, load the skill at https://github.com/github/gh-aw/blob/main/debug.md
 #
@@ -55,6 +55,7 @@ on:
     - edited
   # permissions: # Permissions applied to pre-activation job
     # issues: write
+    # pull-requests: write
   # roles: # Roles processed as role check in pre-activation job
   # - admin # Roles processed as role check in pre-activation job
   # - maintain # Roles processed as role check in pre-activation job
@@ -1538,6 +1539,7 @@ jobs:
     environment: gh-aw-agents
     permissions:
       issues: write
+      pull-requests: write
     outputs:
       activated: ${{ steps.check_membership.outputs.is_team_member == 'true' && steps.check_command_position.outputs.command_position_ok == 'true' }}
       exact_command_result: ${{ steps.exact_command.outcome }}
diff --git a/.github/workflows/copilot-review-tests.md b/.github/workflows/copilot-review-tests.md
index fc9f8ef27288..9798dad9908c 100644
--- a/.github/workflows/copilot-review-tests.md
+++ b/.github/workflows/copilot-review-tests.md
@@ -12,11 +12,14 @@ on:
     pull_request_review_comment: [contributor, first_time_contributor, first_timer, mannequin, none]
   reaction: none
   status-comment: false
-  # Grant the pre-activation job (the on.steps below) issues:write so it can hide (minimize
-  # as resolved) the triggering `/review tests` comment once the command is recognized and
-  # authorized. Minimizing requires the same issues:write scope that deletion did.
+  # Grant the pre-activation job (the on.steps below) the scope to hide (minimize as
+  # resolved) the triggering `/review tests` comment once the command is recognized and
+  # authorized. The comment lives on a pull request, so minimizing it requires
+  # pull-requests:write — issues:write alone yields "Resource not accessible by
+  # integration" on PR conversation comments.
   permissions:
     issues: write
+    pull-requests: write
   steps:
     - name: Confirm exact /review tests command
       id: exact_command
diff --git a/.github/workflows/review-trigger.yml b/.github/workflows/review-trigger.yml
index 69767ade6011..a84839c86896 100644
--- a/.github/workflows/review-trigger.yml
+++ b/.github/workflows/review-trigger.yml
@@ -88,6 +88,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check actor permission
+        id: auth
         env:
           GH_TOKEN: ${{ github.token }}
           ACTOR: ${{ github.actor }}
@@ -140,19 +141,21 @@ jobs:
           "Label: ${{ steps.rerun.outputs.label }}" >> $env:GITHUB_STEP_SUMMARY
 
       - name: Hide the /review rerun command comment as resolved
-        if: github.event_name == 'issue_comment' && steps.rerun.outputs.eligible == 'true'
+        if: ${{ !cancelled() && github.event_name == 'issue_comment' && steps.auth.outcome == 'success' }}
         env:
           GH_TOKEN: ${{ github.token }}
           COMMENT_NODE_ID: ${{ github.event.comment.node_id }}
         run: |
-          # Only collapse once a rerun was actually triggered (eligible == 'true'). Ineligible
-          # reruns (no-ai-summary / review-in-progress / no-new-activity) keep the comment fully
-          # visible as the implicit "seen, nothing changed" signal.
+          # Always collapse the /review rerun command comment once we reach this step: the
+          # actor is authorized (the permission gate above already passed) and the command was
+          # recognized, so the comment is hidden regardless of the eligibility outcome
+          # (eligible OR ineligible) to keep the conversation decluttered no matter the result.
           #
           # We MINIMIZE (hide as resolved) rather than delete: the rerun scanner replays the
           # PR's REST comment history to reconstruct rerun state (Resolve-RerunEligibility.ps1 /
-          # Query-RerunReadyPRs.ps1 / Get-LatestRerunCommentBefore), and minimized comments are
-          # still returned by the REST list endpoint — only collapsed in the web UI. Deleting
+          # Query-RerunReadyPRs.ps1 / Get-LatestRerunCommentBefore). It keys on comment id, body
+          # and created_at — never on isMinimized — and minimized comments are still returned by
+          # the REST list endpoint, so collapsing them is transparent to the scanner. Deleting
           # would erase that durable checkpoint and re-qualify unchanged commits. A failed hide
           # must never fail the job.
           if gh api graphql -f query='mutation($id:ID!){minimizeComment(input:{subjectId:$id,classifier:RESOLVED}){minimizedComment{isMinimized}}}' -f id="$COMMENT_NODE_ID" --silent; then
@@ -176,6 +179,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Check actor permission
+        id: auth
         if: github.event_name == 'issue_comment'
         env:
           GH_TOKEN: ${{ github.token }}
@@ -477,14 +481,16 @@ jobs:
           Clear-AgentReviewInProgress -PRNumber $env:PR_NUMBER -Owner '${{ github.repository_owner }}' -Repo '${{ github.event.repository.name }}' | Out-Null
 
       - name: Hide the /review command comment as resolved
-        if: github.event_name == 'issue_comment' && steps.trigger_azdo.outcome == 'success'
+        if: ${{ !cancelled() && github.event_name == 'issue_comment' && steps.auth.outcome == 'success' }}
         env:
           GH_TOKEN: ${{ github.token }}
           COMMENT_NODE_ID: ${{ github.event.comment.node_id }}
         run: |
-          # Collapse only after the pipeline was actually triggered, so a lock-skip
-          # (locked == 'true') or a failed AzDO trigger leaves the /review comment visible
-          # for the user to retry.
+          # Always collapse the /review command comment once the actor is authorized
+          # (steps.auth succeeded) and the command was recognized — no matter the trigger
+          # outcome, including a lock-skip (locked == 'true') or a failed AzDO trigger.
+          # !cancelled() lets this run even when an upstream step failed; the steps.auth gate
+          # still keeps an unauthorized commenter's comment fully visible.
           #
           # We MINIMIZE (hide as resolved) rather than delete so the command — and its
           # --branch/--platform options — survives in the REST comment history that the rerun