diff --git a/src/applications/audit/editor/PhabricatorAuditCommentEditor.php b/src/applications/audit/editor/PhabricatorAuditCommentEditor.php
index bf81fe4fa5..55b91db276 100644
--- a/src/applications/audit/editor/PhabricatorAuditCommentEditor.php
+++ b/src/applications/audit/editor/PhabricatorAuditCommentEditor.php
@@ -1,566 +1,566 @@
 <?php
 
 final class PhabricatorAuditCommentEditor extends PhabricatorEditor {
 
   private $commit;
 
   private $attachInlineComments;
   private $auditors = array();
   private $ccs = array();
 
   private $noEmail;
 
   public function __construct(PhabricatorRepositoryCommit $commit) {
     $this->commit = $commit;
     return $this;
   }
 
   public function addAuditors(array $auditor_phids) {
     $this->auditors = array_merge($this->auditors, $auditor_phids);
     return $this;
   }
 
   public function addCCs(array $cc_phids) {
     $this->ccs = array_merge($this->ccs, $cc_phids);
     return $this;
   }
 
   public function setAttachInlineComments($attach_inline_comments) {
     $this->attachInlineComments = $attach_inline_comments;
     return $this;
   }
 
   public function setNoEmail($no_email) {
     $this->noEmail = $no_email;
     return $this;
   }
 
   public function addComment(PhabricatorAuditComment $comment) {
 
     $commit = $this->commit;
     $actor = $this->getActor();
 
-    $other_comments = id(new PhabricatorAuditComment())->loadAllWhere(
-      'targetPHID = %s',
+    $other_comments = PhabricatorAuditComment::loadComments(
+      $actor,
       $commit->getPHID());
 
     $inline_comments = array();
     if ($this->attachInlineComments) {
       $inline_comments = PhabricatorAuditInlineComment::loadDraftComments(
         $actor,
         $commit->getPHID());
     }
 
     $comment
       ->setActorPHID($actor->getPHID())
       ->setTargetPHID($commit->getPHID())
       ->save();
 
     $content_blocks = array($comment->getContent());
 
     if ($inline_comments) {
       foreach ($inline_comments as $inline) {
         $inline->setAuditCommentID($comment->getID());
         $inline->save();
         $content_blocks[] = $inline->getContent();
       }
     }
 
     $ccs = $this->ccs;
     $auditors = $this->auditors;
 
     $metadata = $comment->getMetadata();
     $metacc = array();
 
     // Find any "@mentions" in the content blocks.
     $mention_ccs = PhabricatorMarkupEngine::extractPHIDsFromMentions(
       $this->getActor(),
       $content_blocks);
     if ($mention_ccs) {
       $metacc = idx(
         $metadata,
         PhabricatorAuditComment::METADATA_ADDED_CCS,
         array());
       foreach ($mention_ccs as $cc_phid) {
         $metacc[] = $cc_phid;
       }
     }
 
     if ($metacc) {
       $ccs = array_merge($ccs, $metacc);
     }
 
     // When an actor submits an audit comment, we update all the audit requests
     // they have authority over to reflect the most recent status. The general
     // idea here is that if audit has triggered for, e.g., several packages, but
     // a user owns all of them, they can clear the audit requirement in one go
     // without auditing the commit for each trigger.
 
     $audit_phids = self::loadAuditPHIDsForUser($actor);
     $audit_phids = array_fill_keys($audit_phids, true);
 
     $requests = id(new PhabricatorRepositoryAuditRequest())
       ->loadAllWhere(
         'commitPHID = %s',
         $commit->getPHID());
 
     $action = $comment->getAction();
 
 
     // TODO: We should validate the action, currently we allow anyone to, e.g.,
     // close an audit if they muck with form parameters. I'll followup with this
     // and handle the no-effect cases (e.g., closing and already-closed audit).
 
 
     $actor_is_author = ($actor->getPHID() == $commit->getAuthorPHID());
 
     if ($action == PhabricatorAuditActionConstants::CLOSE) {
       if (!PhabricatorEnv::getEnvConfig('audit.can-author-close-audit')) {
           throw new Exception('Cannot Close Audit without enabling'.
           'audit.can-author-close-audit');
       }
       // "Close" means wipe out all the concerns.
       $concerned_status = PhabricatorAuditStatusConstants::CONCERNED;
       foreach ($requests as $request) {
         if ($request->getAuditStatus() == $concerned_status) {
           $request->setAuditStatus(PhabricatorAuditStatusConstants::CLOSED);
           $request->save();
         }
       }
     } else if ($action == PhabricatorAuditActionConstants::RESIGN) {
       // "Resign" has unusual rules for writing user rows, only affects the
       // user row (never package/project rows), and always affects the user
       // row (other actions don't, if they were able to affect a package/project
       // row).
       $actor_request = null;
       foreach ($requests as $request) {
         if ($request->getAuditorPHID() == $actor->getPHID()) {
           $actor_request = $request;
           break;
         }
       }
       if (!$actor_request) {
         $actor_request = id(new PhabricatorRepositoryAuditRequest())
           ->setCommitPHID($commit->getPHID())
           ->setAuditorPHID($actor->getPHID())
           ->setAuditReasons(array('Resigned'));
       }
 
       $actor_request
         ->setAuditStatus(PhabricatorAuditStatusConstants::RESIGNED)
         ->save();
 
       $requests[] = $actor_request;
     } else {
       $have_any_requests = false;
       foreach ($requests as $request) {
         if (empty($audit_phids[$request->getAuditorPHID()])) {
           continue;
         }
 
         $request_is_for_actor =
           ($request->getAuditorPHID() == $actor->getPHID());
 
         $have_any_requests = true;
         $new_status = null;
         switch ($action) {
           case PhabricatorAuditActionConstants::COMMENT:
           case PhabricatorAuditActionConstants::ADD_CCS:
           case PhabricatorAuditActionConstants::ADD_AUDITORS:
             // Commenting or adding cc's/auditors doesn't change status.
             break;
           case PhabricatorAuditActionConstants::ACCEPT:
             if (!$actor_is_author || $request_is_for_actor) {
               // When modifying your own commits, you act only on behalf of
               // yourself, not your packages/projects -- the idea being that
               // you can't accept your own commits.
               $new_status = PhabricatorAuditStatusConstants::ACCEPTED;
             }
             break;
           case PhabricatorAuditActionConstants::CONCERN:
             if (!$actor_is_author || $request_is_for_actor) {
               // See above.
               $new_status = PhabricatorAuditStatusConstants::CONCERNED;
             }
             break;
           default:
             throw new Exception("Unknown action '{$action}'!");
         }
         if ($new_status !== null) {
           $request->setAuditStatus($new_status);
           $request->save();
         }
       }
 
       // If the actor has no current authority over any audit trigger, make a
       // new one to represent their audit state.
       if (!$have_any_requests) {
         $new_status = null;
         switch ($action) {
           case PhabricatorAuditActionConstants::COMMENT:
           case PhabricatorAuditActionConstants::ADD_CCS:
           case PhabricatorAuditActionConstants::ADD_AUDITORS:
             $new_status = PhabricatorAuditStatusConstants::AUDIT_NOT_REQUIRED;
             break;
           case PhabricatorAuditActionConstants::ACCEPT:
             $new_status = PhabricatorAuditStatusConstants::ACCEPTED;
             break;
           case PhabricatorAuditActionConstants::CONCERN:
             $new_status = PhabricatorAuditStatusConstants::CONCERNED;
             break;
           case PhabricatorAuditActionConstants::CLOSE:
             // Impossible to reach this block with 'close'.
           default:
             throw new Exception("Unknown or invalid action '{$action}'!");
         }
 
         $request = id(new PhabricatorRepositoryAuditRequest())
           ->setCommitPHID($commit->getPHID())
           ->setAuditorPHID($actor->getPHID())
           ->setAuditStatus($new_status)
           ->setAuditReasons(array('Voluntary Participant'))
           ->save();
         $requests[] = $request;
       }
     }
 
     $requests_by_auditor = mpull($requests, null, 'getAuditorPHID');
     $requests_phids = array_keys($requests_by_auditor);
 
     $ccs = array_diff($ccs, $requests_phids);
     $auditors = array_diff($auditors, $requests_phids);
 
     if ($action == PhabricatorAuditActionConstants::ADD_CCS) {
       if ($ccs) {
         $metadata[PhabricatorAuditComment::METADATA_ADDED_CCS] = $ccs;
         $comment->setMetaData($metadata);
       } else {
         $comment->setAction(PhabricatorAuditActionConstants::COMMENT);
       }
     }
 
     if ($action == PhabricatorAuditActionConstants::ADD_AUDITORS) {
       if ($auditors) {
         $metadata[PhabricatorAuditComment::METADATA_ADDED_AUDITORS]
           = $auditors;
         $comment->setMetaData($metadata);
       } else {
         $comment->setAction(PhabricatorAuditActionConstants::COMMENT);
       }
     }
 
     $comment->save();
 
     if ($auditors) {
       foreach ($auditors as $auditor_phid) {
         $audit_requested = PhabricatorAuditStatusConstants::AUDIT_REQUESTED;
         $requests[] = id (new PhabricatorRepositoryAuditRequest())
           ->setCommitPHID($commit->getPHID())
           ->setAuditorPHID($auditor_phid)
           ->setAuditStatus($audit_requested)
           ->setAuditReasons(
             array('Added by '.$actor->getUsername()))
           ->save();
       }
     }
 
     if ($ccs) {
       foreach ($ccs as $cc_phid) {
         $audit_cc = PhabricatorAuditStatusConstants::CC;
         $requests[] = id (new PhabricatorRepositoryAuditRequest())
           ->setCommitPHID($commit->getPHID())
           ->setAuditorPHID($cc_phid)
           ->setAuditStatus($audit_cc)
           ->setAuditReasons(
             array('Added by '.$actor->getUsername()))
           ->save();
       }
     }
 
     $commit->updateAuditStatus($requests);
     $commit->save();
 
     $feed_dont_publish_phids = array();
     foreach ($requests as $request) {
       $status = $request->getAuditStatus();
       switch ($status) {
       case PhabricatorAuditStatusConstants::RESIGNED:
       case PhabricatorAuditStatusConstants::NONE:
       case PhabricatorAuditStatusConstants::AUDIT_NOT_REQUIRED:
       case PhabricatorAuditStatusConstants::CC:
         $feed_dont_publish_phids[$request->getAuditorPHID()] = 1;
         break;
       default:
         unset($feed_dont_publish_phids[$request->getAuditorPHID()]);
         break;
       }
     }
     $feed_dont_publish_phids = array_keys($feed_dont_publish_phids);
 
     $feed_phids = array_diff($requests_phids, $feed_dont_publish_phids);
     $this->publishFeedStory($comment, $feed_phids);
 
     id(new PhabricatorSearchIndexer())
       ->queueDocumentForIndexing($commit->getPHID());
 
     if (!$this->noEmail) {
       $this->sendMail($comment, $other_comments, $inline_comments, $requests);
     }
   }
 
 
   /**
    * Load the PHIDs for all objects the user has the authority to act as an
    * audit for. This includes themselves, and any packages they are an owner
    * of.
    */
   public static function loadAuditPHIDsForUser(PhabricatorUser $user) {
     $phids = array();
 
     // TODO: This method doesn't really use the right viewer, but in practice we
     // never issue this query of this type on behalf of another user and are
     // unlikely to do so in the future. This entire method should be refactored
     // into a Query class, however, and then we should use a proper viewer.
 
     // The user can audit on their own behalf.
     $phids[$user->getPHID()] = true;
 
     $owned_packages = id(new PhabricatorOwnersPackageQuery())
       ->setViewer($user)
       ->withOwnerPHIDs(array($user->getPHID()))
       ->execute();
     foreach ($owned_packages as $package) {
       $phids[$package->getPHID()] = true;
     }
 
     // The user can audit on behalf of all projects they are a member of.
     $projects = id(new PhabricatorProjectQuery())
       ->setViewer($user)
       ->withMemberPHIDs(array($user->getPHID()))
       ->execute();
     foreach ($projects as $project) {
       $phids[$project->getPHID()] = true;
     }
 
     return array_keys($phids);
   }
 
   private function publishFeedStory(
     PhabricatorAuditComment $comment,
     array $more_phids) {
 
     $commit = $this->commit;
     $actor = $this->getActor();
 
     $related_phids = array_merge(
       array(
         $actor->getPHID(),
         $commit->getPHID(),
       ),
       $more_phids);
 
     id(new PhabricatorFeedStoryPublisher())
       ->setRelatedPHIDs($related_phids)
       ->setStoryAuthorPHID($actor->getPHID())
       ->setStoryTime(time())
       ->setStoryType(PhabricatorFeedStoryTypeConstants::STORY_AUDIT)
       ->setStoryData(
         array(
           'commitPHID'    => $commit->getPHID(),
           'action'        => $comment->getAction(),
           'content'       => $comment->getContent(),
         ))
       ->publish();
   }
 
   private function sendMail(
     PhabricatorAuditComment $comment,
     array $other_comments,
     array $inline_comments,
     array $requests) {
 
     assert_instances_of($other_comments, 'PhabricatorAuditComment');
     assert_instances_of($inline_comments, 'PhabricatorInlineCommentInterface');
 
     $commit = $this->commit;
 
     $data = $commit->loadCommitData();
     $summary = $data->getSummary();
 
     $commit_phid = $commit->getPHID();
     $phids = array($commit_phid);
     $handles = id(new PhabricatorHandleQuery())
       ->setViewer($this->getActor())
       ->withPHIDs($phids)
       ->execute();
     $handle = $handles[$commit_phid];
 
     $name = $handle->getName();
 
     $map = array(
       PhabricatorAuditActionConstants::CONCERN  => 'Raised Concern',
       PhabricatorAuditActionConstants::ACCEPT   => 'Accepted',
       PhabricatorAuditActionConstants::RESIGN   => 'Resigned',
       PhabricatorAuditActionConstants::CLOSE    => 'Closed',
       PhabricatorAuditActionConstants::ADD_CCS => 'Added CCs',
       PhabricatorAuditActionConstants::ADD_AUDITORS => 'Added Auditors',
     );
     $verb = idx($map, $comment->getAction(), 'Commented On');
 
     $reply_handler = self::newReplyHandlerForCommit($commit);
 
     $prefix = PhabricatorEnv::getEnvConfig('metamta.diffusion.subject-prefix');
 
     $repository = id(new PhabricatorRepositoryQuery())
       ->setViewer($this->getActor())
       ->withIDs(array($commit->getRepositoryID()))
       ->executeOne();
     $threading = self::getMailThreading($repository, $commit);
     list($thread_id, $thread_topic) = $threading;
 
     $body = $this->renderMailBody(
       $comment,
       "{$name}: {$summary}",
       $handle,
       $reply_handler,
       $inline_comments);
 
     $email_to = array();
     $email_cc = array();
 
     $email_to[$comment->getActorPHID()] = true;
 
     $author_phid = $data->getCommitDetail('authorPHID');
     if ($author_phid) {
       $email_to[$author_phid] = true;
     }
 
     foreach ($other_comments as $other_comment) {
       $email_cc[$other_comment->getActorPHID()] = true;
     }
 
     foreach ($requests as $request) {
       switch ($request->getAuditStatus()) {
         case PhabricatorAuditStatusConstants::CC:
         case PhabricatorAuditStatusConstants::AUDIT_REQUIRED:
           $email_cc[$request->getAuditorPHID()] = true;
           break;
         case PhabricatorAuditStatusConstants::RESIGNED:
           unset($email_cc[$request->getAuditorPHID()]);
           break;
         case PhabricatorAuditStatusConstants::CONCERNED:
         case PhabricatorAuditStatusConstants::AUDIT_REQUESTED:
           $email_to[$request->getAuditorPHID()] = true;
           break;
       }
     }
 
     $email_to = array_keys($email_to);
     $email_cc = array_keys($email_cc);
 
     $phids = array_merge($email_to, $email_cc);
     $handles = id(new PhabricatorHandleQuery())
       ->setViewer($this->getActor())
       ->withPHIDs($phids)
       ->execute();
 
     // NOTE: Always set $is_new to false, because the "first" mail in the
     // thread is the Herald notification of the commit.
     $is_new = false;
 
     $template = id(new PhabricatorMetaMTAMail())
       ->setSubject("{$name}: {$summary}")
       ->setSubjectPrefix($prefix)
       ->setVarySubjectPrefix("[{$verb}]")
       ->setFrom($comment->getActorPHID())
       ->setThreadID($thread_id, $is_new)
       ->addHeader('Thread-Topic', $thread_topic)
       ->setRelatedPHID($commit->getPHID())
       ->setExcludeMailRecipientPHIDs($this->getExcludeMailRecipientPHIDs())
       ->setIsBulk(true)
       ->setBody($body);
 
     $mails = $reply_handler->multiplexMail(
       $template,
       array_select_keys($handles, $email_to),
       array_select_keys($handles, $email_cc));
 
     foreach ($mails as $mail) {
       $mail->saveAndSend();
     }
   }
 
   public static function getMailThreading(
     PhabricatorRepository $repository,
     PhabricatorRepositoryCommit $commit) {
 
     return array(
       'diffusion-audit-'.$commit->getPHID(),
       'Commit r'.$repository->getCallsign().$commit->getCommitIdentifier(),
     );
   }
 
   public static function newReplyHandlerForCommit($commit) {
     $reply_handler = PhabricatorEnv::newObjectFromConfig(
       'metamta.diffusion.reply-handler');
     $reply_handler->setMailReceiver($commit);
     return $reply_handler;
   }
 
   private function renderMailBody(
     PhabricatorAuditComment $comment,
     $cname,
     PhabricatorObjectHandle $handle,
     PhabricatorMailReplyHandler $reply_handler,
     array $inline_comments) {
     assert_instances_of($inline_comments, 'PhabricatorInlineCommentInterface');
 
     $commit = $this->commit;
     $actor = $this->getActor();
     $name = $actor->getUsername();
 
     $verb = PhabricatorAuditActionConstants::getActionPastTenseVerb(
       $comment->getAction());
 
     $body = new PhabricatorMetaMTAMailBody();
     $body->addRawSection("{$name} {$verb} commit {$cname}.");
     $body->addRawSection($comment->getContent());
 
     if ($inline_comments) {
       $block = array();
 
       $path_map = id(new DiffusionPathQuery())
         ->withPathIDs(mpull($inline_comments, 'getPathID'))
         ->execute();
       $path_map = ipull($path_map, 'path', 'id');
 
       foreach ($inline_comments as $inline) {
         $path = idx($path_map, $inline->getPathID());
         if ($path === null) {
           continue;
         }
 
         $start = $inline->getLineNumber();
         $len   = $inline->getLineLength();
         if ($len) {
           $range = $start.'-'.($start + $len);
         } else {
           $range = $start;
         }
 
         $content = $inline->getContent();
         $block[] = "{$path}:{$range} {$content}";
       }
 
       $body->addTextSection(pht('INLINE COMMENTS'), implode("\n", $block));
     }
 
     $body->addTextSection(
       pht('COMMIT'),
       PhabricatorEnv::getProductionURI($handle->getURI()));
     $body->addReplySection($reply_handler->getReplyHandlerInstructions());
 
     return $body->render();
   }
 
 }
diff --git a/src/applications/audit/storage/PhabricatorAuditComment.php b/src/applications/audit/storage/PhabricatorAuditComment.php
index fa02ebfd9b..ffb0912e57 100644
--- a/src/applications/audit/storage/PhabricatorAuditComment.php
+++ b/src/applications/audit/storage/PhabricatorAuditComment.php
@@ -1,55 +1,64 @@
 <?php
 
 final class PhabricatorAuditComment extends PhabricatorAuditDAO
   implements PhabricatorMarkupInterface {
 
   const METADATA_ADDED_AUDITORS  = 'added-auditors';
   const METADATA_ADDED_CCS       = 'added-ccs';
 
   const MARKUP_FIELD_BODY        = 'markup:body';
 
   protected $phid;
   protected $actorPHID;
   protected $targetPHID;
   protected $action;
   protected $content;
   protected $metadata = array();
 
+  public static function loadComments(
+    PhabricatorUser $viewer,
+    $commit_phid) {
+
+    return id(new PhabricatorAuditComment())->loadAllWhere(
+      'targetPHID = %s',
+      $commit_phid);
+  }
+
   public function getConfiguration() {
     return array(
       self::CONFIG_SERIALIZATION => array(
         'metadata' => self::SERIALIZATION_JSON,
       ),
       self::CONFIG_AUX_PHID => true,
     ) + parent::getConfiguration();
   }
 
   public function generatePHID() {
     return PhabricatorPHID::generateNewPHID('ACMT');
   }
 
 
 /* -(  PhabricatorMarkupInterface Implementation  )-------------------------- */
 
 
   public function getMarkupFieldKey($field) {
     return 'AC:'.$this->getID();
   }
 
   public function newMarkupEngine($field) {
     return PhabricatorMarkupEngine::newDiffusionMarkupEngine();
   }
 
   public function getMarkupText($field) {
     return $this->getContent();
   }
 
   public function didMarkupText($field, $output, PhutilMarkupEngine $engine) {
     return $output;
   }
 
   public function shouldUseMarkupCache($field) {
     return (bool)$this->getID();
   }
 
 }
diff --git a/src/applications/diffusion/controller/DiffusionCommitController.php b/src/applications/diffusion/controller/DiffusionCommitController.php
index ff0eef5c01..614c885b8a 100644
--- a/src/applications/diffusion/controller/DiffusionCommitController.php
+++ b/src/applications/diffusion/controller/DiffusionCommitController.php
@@ -1,1178 +1,1178 @@
 <?php
 
 final class DiffusionCommitController extends DiffusionController {
 
   const CHANGES_LIMIT = 100;
 
   private $auditAuthorityPHIDs;
   private $highlightedAudits;
 
   public function shouldAllowPublic() {
     return true;
   }
 
   public function willProcessRequest(array $data) {
     // This controller doesn't use blob/path stuff, just pass the dictionary
     // in directly instead of using the AphrontRequest parsing mechanism.
     $data['user'] = $this->getRequest()->getUser();
     $drequest = DiffusionRequest::newFromDictionary($data);
     $this->diffusionRequest = $drequest;
   }
 
   public function processRequest() {
     $drequest = $this->getDiffusionRequest();
 
     $request = $this->getRequest();
     $user = $request->getUser();
 
     if ($request->getStr('diff')) {
       return $this->buildRawDiffResponse($drequest);
     }
 
     $repository = $drequest->getRepository();
     $callsign = $repository->getCallsign();
 
     $content = array();
     $commit = id(new DiffusionCommitQuery())
       ->setViewer($request->getUser())
       ->withRepository($repository)
       ->withIdentifiers(array($drequest->getCommit()))
       ->needCommitData(true)
       ->needAuditRequests(true)
       ->executeOne();
 
     $crumbs = $this->buildCrumbs(array(
       'commit' => true,
     ));
 
     if (!$commit) {
       $exists = $this->callConduitWithDiffusionRequest(
         'diffusion.existsquery',
         array('commit' => $drequest->getCommit()));
       if (!$exists) {
         return new Aphront404Response();
       }
 
       $error = id(new AphrontErrorView())
         ->setTitle(pht('Commit Still Parsing'))
         ->appendChild(
           pht(
             'Failed to load the commit because the commit has not been '.
             'parsed yet.'));
 
       return $this->buildApplicationPage(
         array(
           $crumbs,
           $error,
         ),
         array(
           'title' => pht('Commit Still Parsing'),
           'device' => false,
         ));
     }
 
 
     $top_anchor = id(new PhabricatorAnchorView())
       ->setAnchorName('top')
       ->setNavigationMarker(true);
 
     $audit_requests = $commit->getAudits();
     $this->auditAuthorityPHIDs =
       PhabricatorAuditCommentEditor::loadAuditPHIDsForUser($user);
 
     $commit_data = $commit->getCommitData();
     $is_foreign = $commit_data->getCommitDetail('foreign-svn-stub');
     $changesets = null;
     if ($is_foreign) {
       $subpath = $commit_data->getCommitDetail('svn-subpath');
 
       $error_panel = new AphrontErrorView();
       $error_panel->setTitle(pht('Commit Not Tracked'));
       $error_panel->setSeverity(AphrontErrorView::SEVERITY_WARNING);
       $error_panel->appendChild(
         pht("This Diffusion repository is configured to track only one ".
         "subdirectory of the entire Subversion repository, and this commit ".
         "didn't affect the tracked subdirectory ('%s'), so no ".
         "information is available.", $subpath));
       $content[] = $error_panel;
       $content[] = $top_anchor;
     } else {
       $engine = PhabricatorMarkupEngine::newDifferentialMarkupEngine();
       $engine->setConfig('viewer', $user);
 
       require_celerity_resource('diffusion-commit-view-css');
       require_celerity_resource('phabricator-remarkup-css');
 
       $parents = $this->callConduitWithDiffusionRequest(
         'diffusion.commitparentsquery',
         array('commit' => $drequest->getCommit()));
 
       if ($parents) {
         $parents = id(new DiffusionCommitQuery())
           ->setViewer($user)
           ->withRepository($repository)
           ->withIdentifiers($parents)
           ->execute();
       }
 
       $headsup_view = id(new PHUIHeaderView())
         ->setHeader(nonempty($commit->getSummary(), pht('Commit Detail')));
 
       $headsup_actions = $this->renderHeadsupActionList($commit, $repository);
 
       $commit_properties = $this->loadCommitProperties(
         $commit,
         $commit_data,
         $parents,
         $audit_requests);
       $property_list = id(new PHUIPropertyListView())
         ->setHasKeyboardShortcuts(true)
         ->setUser($user)
         ->setObject($commit);
       foreach ($commit_properties as $key => $value) {
         $property_list->addProperty($key, $value);
       }
 
       $message = $commit_data->getCommitMessage();
 
       $revision = $commit->getCommitIdentifier();
       $message = $this->linkBugtraq($message);
 
       $message = $engine->markupText($message);
 
       $property_list->invokeWillRenderEvent();
       $property_list->setActionList($headsup_actions);
 
       $detail_list = new PHUIPropertyListView();
       $detail_list->addSectionHeader(
         pht('Description'),
         PHUIPropertyListView::ICON_SUMMARY);
       $detail_list->addTextContent(
         phutil_tag(
           'div',
           array(
             'class' => 'diffusion-commit-message phabricator-remarkup',
           ),
           $message));
       $content[] = $top_anchor;
 
       $object_box = id(new PHUIObjectBoxView())
         ->setHeader($headsup_view)
         ->addPropertyList($property_list)
         ->addPropertyList($detail_list);
 
       $content[] = $object_box;
     }
 
     $content[] = $this->buildComments($commit);
 
     $hard_limit = 1000;
 
     if ($commit->isImported()) {
       $change_query = DiffusionPathChangeQuery::newFromDiffusionRequest(
         $drequest);
       $change_query->setLimit($hard_limit + 1);
       $changes = $change_query->loadChanges();
     } else {
       $changes = array();
     }
 
     $was_limited = (count($changes) > $hard_limit);
     if ($was_limited) {
       $changes = array_slice($changes, 0, $hard_limit);
     }
 
     $content[] = $this->buildMergesTable($commit);
 
     $highlighted_audits = $commit->getAuthorityAudits(
       $user,
       $this->auditAuthorityPHIDs);
 
     $owners_paths = array();
     if ($highlighted_audits) {
       $packages = id(new PhabricatorOwnersPackage())->loadAllWhere(
         'phid IN (%Ls)',
         mpull($highlighted_audits, 'getAuditorPHID'));
       if ($packages) {
         $owners_paths = id(new PhabricatorOwnersPath())->loadAllWhere(
           'repositoryPHID = %s AND packageID IN (%Ld)',
           $repository->getPHID(),
           mpull($packages, 'getID'));
       }
     }
 
     $change_table = new DiffusionCommitChangeTableView();
     $change_table->setDiffusionRequest($drequest);
     $change_table->setPathChanges($changes);
     $change_table->setOwnersPaths($owners_paths);
 
     $count = count($changes);
 
     $bad_commit = null;
     if ($count == 0) {
       $bad_commit = queryfx_one(
         id(new PhabricatorRepository())->establishConnection('r'),
         'SELECT * FROM %T WHERE fullCommitName = %s',
         PhabricatorRepository::TABLE_BADCOMMIT,
         'r'.$callsign.$commit->getCommitIdentifier());
     }
 
     if ($bad_commit) {
       $content[] = $this->renderStatusMessage(
         pht('Bad Commit'),
         $bad_commit['description']);
     } else if ($is_foreign) {
       // Don't render anything else.
     } else if (!$commit->isImported()) {
       $content[] = $this->renderStatusMessage(
         pht('Still Importing...'),
         pht(
           'This commit is still importing. Changes will be visible once '.
           'the import finishes.'));
     } else if (!count($changes)) {
       $content[] = $this->renderStatusMessage(
         pht('Empty Commit'),
         pht(
           'This commit is empty and does not affect any paths.'));
     } else if ($was_limited) {
       $content[] = $this->renderStatusMessage(
         pht('Enormous Commit'),
         pht(
           'This commit is enormous, and affects more than %d files. '.
           'Changes are not shown.',
           $hard_limit));
     } else {
       // The user has clicked "Show All Changes", and we should show all the
       // changes inline even if there are more than the soft limit.
       $show_all_details = $request->getBool('show_all');
 
       $change_panel = new PHUIObjectBoxView();
       $header = new PHUIHeaderView();
       $header->setHeader('Changes ('.number_format($count).')');
       $change_panel->setID('toc');
       if ($count > self::CHANGES_LIMIT && !$show_all_details) {
 
         $icon = id(new PHUIIconView())
           ->setIconFont('fa-files-o');
 
         $button = id(new PHUIButtonView())
           ->setText(pht('Show All Changes'))
           ->setHref('?show_all=true')
           ->setTag('a')
           ->setIcon($icon);
 
         $warning_view = id(new AphrontErrorView())
           ->setSeverity(AphrontErrorView::SEVERITY_WARNING)
           ->setTitle('Very Large Commit')
           ->appendChild(
             pht('This commit is very large. Load each file individually.'));
 
         $change_panel->setErrorView($warning_view);
         $header->addActionLink($button);
       }
 
       $change_panel->appendChild($change_table);
       $change_panel->setHeader($header);
 
       $content[] = $change_panel;
 
       $changesets = DiffusionPathChange::convertToDifferentialChangesets(
         $changes);
 
       $vcs = $repository->getVersionControlSystem();
       switch ($vcs) {
         case PhabricatorRepositoryType::REPOSITORY_TYPE_SVN:
           $vcs_supports_directory_changes = true;
           break;
         case PhabricatorRepositoryType::REPOSITORY_TYPE_GIT:
         case PhabricatorRepositoryType::REPOSITORY_TYPE_MERCURIAL:
           $vcs_supports_directory_changes = false;
           break;
         default:
           throw new Exception('Unknown VCS.');
       }
 
       $references = array();
       foreach ($changesets as $key => $changeset) {
         $file_type = $changeset->getFileType();
         if ($file_type == DifferentialChangeType::FILE_DIRECTORY) {
           if (!$vcs_supports_directory_changes) {
             unset($changesets[$key]);
             continue;
           }
         }
 
         $references[$key] = $drequest->generateURI(
           array(
             'action' => 'rendering-ref',
             'path'   => $changeset->getFilename(),
           ));
       }
 
       // TODO: Some parts of the views still rely on properties of the
       // DifferentialChangeset. Make the objects ephemeral to make sure we don't
       // accidentally save them, and then set their ID to the appropriate ID for
       // this application (the path IDs).
       $path_ids = array_flip(mpull($changes, 'getPath'));
       foreach ($changesets as $changeset) {
         $changeset->makeEphemeral();
         $changeset->setID($path_ids[$changeset->getFilename()]);
       }
 
       if ($count <= self::CHANGES_LIMIT || $show_all_details) {
         $visible_changesets = $changesets;
       } else {
         $visible_changesets = array();
         $inlines = PhabricatorAuditInlineComment::loadDraftAndPublishedComments(
           $user,
           $commit->getPHID());
         $path_ids = mpull($inlines, null, 'getPathID');
         foreach ($changesets as $key => $changeset) {
           if (array_key_exists($changeset->getID(), $path_ids)) {
             $visible_changesets[$key] = $changeset;
           }
         }
       }
 
       $change_list_title = DiffusionView::nameCommit(
         $repository,
         $commit->getCommitIdentifier());
       $change_list = new DifferentialChangesetListView();
       $change_list->setTitle($change_list_title);
       $change_list->setChangesets($changesets);
       $change_list->setVisibleChangesets($visible_changesets);
       $change_list->setRenderingReferences($references);
       $change_list->setRenderURI('/diffusion/'.$callsign.'/diff/');
       $change_list->setRepository($repository);
       $change_list->setUser($user);
 
       // TODO: Try to setBranch() to something reasonable here?
 
       $change_list->setStandaloneURI(
         '/diffusion/'.$callsign.'/diff/');
       $change_list->setRawFileURIs(
         // TODO: Implement this, somewhat tricky if there's an octopus merge
         // or whatever?
         null,
         '/diffusion/'.$callsign.'/diff/?view=r');
 
       $change_list->setInlineCommentControllerURI(
         '/diffusion/inline/edit/'.phutil_escape_uri($commit->getPHID()).'/');
 
       $change_references = array();
       foreach ($changesets as $key => $changeset) {
         $change_references[$changeset->getID()] = $references[$key];
       }
       $change_table->setRenderingReferences($change_references);
 
       $content[] = $change_list->render();
     }
 
     $content[] = $this->renderAddCommentPanel($commit, $audit_requests);
 
     $commit_id = 'r'.$callsign.$commit->getCommitIdentifier();
     $short_name = DiffusionView::nameCommit(
       $repository,
       $commit->getCommitIdentifier());
 
     $prefs = $user->loadPreferences();
     $pref_filetree = PhabricatorUserPreferences::PREFERENCE_DIFF_FILETREE;
     $pref_collapse = PhabricatorUserPreferences::PREFERENCE_NAV_COLLAPSED;
     $show_filetree = $prefs->getPreference($pref_filetree);
     $collapsed = $prefs->getPreference($pref_collapse);
 
     if ($changesets && $show_filetree) {
       $nav = id(new DifferentialChangesetFileTreeSideNavBuilder())
         ->setAnchorName('top')
         ->setTitle($short_name)
         ->setBaseURI(new PhutilURI('/'.$commit_id))
         ->build($changesets)
         ->setCrumbs($crumbs)
         ->setCollapsed((bool)$collapsed)
         ->appendChild($content);
       $content = $nav;
     } else {
       $content = array($crumbs, $content);
     }
 
     return $this->buildApplicationPage(
       $content,
       array(
         'title' => $commit_id,
         'pageObjects' => array($commit->getPHID()),
         'device' => false,
       ));
   }
 
   private function loadCommitProperties(
     PhabricatorRepositoryCommit $commit,
     PhabricatorRepositoryCommitData $data,
     array $parents,
     array $audit_requests) {
 
     assert_instances_of($parents, 'PhabricatorRepositoryCommit');
     $viewer = $this->getRequest()->getUser();
     $commit_phid = $commit->getPHID();
     $drequest = $this->getDiffusionRequest();
     $repository = $drequest->getRepository();
 
     $edge_query = id(new PhabricatorEdgeQuery())
       ->withSourcePHIDs(array($commit_phid))
       ->withEdgeTypes(array(
         DiffusionCommitHasTaskEdgeType::EDGECONST,
         PhabricatorEdgeConfig::TYPE_COMMIT_HAS_PROJECT,
         PhabricatorEdgeConfig::TYPE_COMMIT_HAS_DREV,
       ));
 
     $edges = $edge_query->execute();
 
     $task_phids = array_keys(
       $edges[$commit_phid][DiffusionCommitHasTaskEdgeType::EDGECONST]);
     $proj_phids = array_keys(
       $edges[$commit_phid][PhabricatorEdgeConfig::TYPE_COMMIT_HAS_PROJECT]);
     $revision_phid = key(
       $edges[$commit_phid][PhabricatorEdgeConfig::TYPE_COMMIT_HAS_DREV]);
 
     $phids = $edge_query->getDestinationPHIDs(array($commit_phid));
 
     if ($data->getCommitDetail('authorPHID')) {
       $phids[] = $data->getCommitDetail('authorPHID');
     }
     if ($data->getCommitDetail('reviewerPHID')) {
       $phids[] = $data->getCommitDetail('reviewerPHID');
     }
     if ($data->getCommitDetail('committerPHID')) {
       $phids[] = $data->getCommitDetail('committerPHID');
     }
     if ($parents) {
       foreach ($parents as $parent) {
         $phids[] = $parent->getPHID();
       }
     }
 
     // NOTE: We should never normally have more than a single push log, but
     // it can occur naturally if a commit is pushed, then the branch it was
     // on is deleted, then the commit is pushed again (or through other similar
     // chains of events). This should be rare, but does not indicate a bug
     // or data issue.
 
     // NOTE: We never query push logs in SVN because the commiter is always
     // the pusher and the commit time is always the push time; the push log
     // is redundant and we save a query by skipping it.
 
     $push_logs = array();
     if ($repository->isHosted() && !$repository->isSVN()) {
       $push_logs = id(new PhabricatorRepositoryPushLogQuery())
         ->setViewer($viewer)
         ->withRepositoryPHIDs(array($repository->getPHID()))
         ->withNewRefs(array($commit->getCommitIdentifier()))
         ->withRefTypes(array(PhabricatorRepositoryPushLog::REFTYPE_COMMIT))
         ->execute();
       foreach ($push_logs as $log) {
         $phids[] = $log->getPusherPHID();
       }
     }
 
     $handles = array();
     if ($phids) {
       $handles = $this->loadViewerHandles($phids);
     }
 
     $props = array();
 
     if ($commit->getAuditStatus()) {
       $status = PhabricatorAuditCommitStatusConstants::getStatusName(
         $commit->getAuditStatus());
       $tag = id(new PHUITagView())
         ->setType(PHUITagView::TYPE_STATE)
         ->setName($status);
 
       switch ($commit->getAuditStatus()) {
         case PhabricatorAuditCommitStatusConstants::NEEDS_AUDIT:
           $tag->setBackgroundColor(PHUITagView::COLOR_ORANGE);
           break;
         case PhabricatorAuditCommitStatusConstants::CONCERN_RAISED:
           $tag->setBackgroundColor(PHUITagView::COLOR_RED);
           break;
         case PhabricatorAuditCommitStatusConstants::PARTIALLY_AUDITED:
           $tag->setBackgroundColor(PHUITagView::COLOR_BLUE);
           break;
         case PhabricatorAuditCommitStatusConstants::FULLY_AUDITED:
           $tag->setBackgroundColor(PHUITagView::COLOR_GREEN);
           break;
       }
 
       $props['Status'] = $tag;
     }
 
     if ($audit_requests) {
       $user_requests = array();
       $other_requests = array();
       foreach ($audit_requests as $audit_request) {
         if ($audit_request->isUser()) {
           $user_requests[] = $audit_request;
         } else {
           $other_requests[] = $audit_request;
         }
       }
 
       if ($user_requests) {
         $props['Auditors'] = $this->renderAuditStatusView(
           $user_requests);
       }
 
       if ($other_requests) {
         $props['Project/Package Auditors'] = $this->renderAuditStatusView(
           $other_requests);
       }
     }
 
     $author_phid = $data->getCommitDetail('authorPHID');
     $author_name = $data->getAuthorName();
 
     if (!$repository->isSVN()) {
       $authored_info = id(new PHUIStatusItemView());
       // TODO: In Git, a distinct authorship date is available. When present,
       // we should show it here.
 
       if ($author_phid) {
         $authored_info->setTarget($handles[$author_phid]->renderLink());
       } else if (strlen($author_name)) {
         $authored_info->setTarget($author_name);
       }
 
       $props['Authored'] = id(new PHUIStatusListView())
         ->addItem($authored_info);
     }
 
     $committed_info = id(new PHUIStatusItemView())
       ->setNote(phabricator_datetime($commit->getEpoch(), $viewer));
 
     $committer_phid = $data->getCommitDetail('committerPHID');
     $committer_name = $data->getCommitDetail('committer');
     if ($committer_phid) {
       $committed_info->setTarget($handles[$committer_phid]->renderLink());
     } else if (strlen($committer_name)) {
       $committed_info->setTarget($committer_name);
     } else if ($author_phid) {
       $committed_info->setTarget($handles[$author_phid]->renderLink());
     } else if (strlen($author_name)) {
       $committed_info->setTarget($author_name);
     }
 
     $props['Committed'] = id(new PHUIStatusListView())
       ->addItem($committed_info);
 
     if ($push_logs) {
       $pushed_list = new PHUIStatusListView();
 
       foreach ($push_logs as $push_log) {
         $pushed_item = id(new PHUIStatusItemView())
           ->setTarget($handles[$push_log->getPusherPHID()]->renderLink())
           ->setNote(phabricator_datetime($push_log->getEpoch(), $viewer));
         $pushed_list->addItem($pushed_item);
       }
 
       $props['Pushed'] = $pushed_list;
     }
 
     $reviewer_phid = $data->getCommitDetail('reviewerPHID');
     if ($reviewer_phid) {
       $props['Reviewer'] = $handles[$reviewer_phid]->renderLink();
     }
 
     if ($revision_phid) {
       $props['Differential Revision'] = $handles[$revision_phid]->renderLink();
     }
 
     if ($parents) {
       $parent_links = array();
       foreach ($parents as $parent) {
         $parent_links[] = $handles[$parent->getPHID()]->renderLink();
       }
       $props['Parents'] = phutil_implode_html(" \xC2\xB7 ", $parent_links);
     }
 
     $props['Branches'] = phutil_tag(
       'span',
       array(
         'id' => 'commit-branches',
       ),
       pht('Unknown'));
     $props['Tags'] = phutil_tag(
       'span',
       array(
         'id' => 'commit-tags',
       ),
       pht('Unknown'));
 
     $callsign = $repository->getCallsign();
     $root = '/diffusion/'.$callsign.'/commit/'.$commit->getCommitIdentifier();
     Javelin::initBehavior(
       'diffusion-commit-branches',
       array(
         $root.'/branches/' => 'commit-branches',
         $root.'/tags/' => 'commit-tags',
       ));
 
     $refs = $this->buildRefs($drequest);
     if ($refs) {
       $props['References'] = $refs;
     }
 
     if ($task_phids) {
       $task_list = array();
       foreach ($task_phids as $phid) {
         $task_list[] = $handles[$phid]->renderLink();
       }
       $task_list = phutil_implode_html(phutil_tag('br'), $task_list);
       $props['Tasks'] = $task_list;
     }
 
     if ($proj_phids) {
       $proj_list = array();
       foreach ($proj_phids as $phid) {
         $proj_list[] = $handles[$phid]->renderLink();
       }
       $proj_list = phutil_implode_html(phutil_tag('br'), $proj_list);
       $props['Projects'] = $proj_list;
     }
 
     return $props;
   }
 
   private function buildComments(PhabricatorRepositoryCommit $commit) {
     $user = $this->getRequest()->getUser();
-    $comments = id(new PhabricatorAuditComment())->loadAllWhere(
-      'targetPHID = %s ORDER BY dateCreated ASC',
+    $comments = PhabricatorAuditComment::loadComments(
+      $user,
       $commit->getPHID());
 
     $inlines = PhabricatorAuditInlineComment::loadPublishedComments(
       $user,
       $commit->getPHID());
 
     $path_ids = mpull($inlines, 'getPathID');
 
     $path_map = array();
     if ($path_ids) {
       $path_map = id(new DiffusionPathQuery())
         ->withPathIDs($path_ids)
         ->execute();
       $path_map = ipull($path_map, 'path', 'id');
     }
 
     $engine = new PhabricatorMarkupEngine();
     $engine->setViewer($user);
 
     foreach ($comments as $comment) {
       $engine->addObject(
         $comment,
         PhabricatorAuditComment::MARKUP_FIELD_BODY);
     }
 
     foreach ($inlines as $inline) {
       $engine->addObject(
         $inline,
         PhabricatorInlineCommentInterface::MARKUP_FIELD_BODY);
     }
 
     $engine->process();
 
     $view = new DiffusionCommentListView();
     $view->setMarkupEngine($engine);
     $view->setUser($user);
     $view->setComments($comments);
     $view->setInlineComments($inlines);
     $view->setPathMap($path_map);
 
     $phids = $view->getRequiredHandlePHIDs();
     $handles = $this->loadViewerHandles($phids);
     $view->setHandles($handles);
 
     return $view;
   }
 
   private function renderAddCommentPanel(
     PhabricatorRepositoryCommit $commit,
     array $audit_requests) {
     assert_instances_of($audit_requests, 'PhabricatorRepositoryAuditRequest');
 
     $request = $this->getRequest();
     $user = $request->getUser();
 
     if (!$user->isLoggedIn()) {
       return id(new PhabricatorApplicationTransactionCommentView())
         ->setUser($user)
         ->setRequestURI($request->getRequestURI());
     }
 
     $is_serious = PhabricatorEnv::getEnvConfig('phabricator.serious-business');
 
     $pane_id = celerity_generate_unique_node_id();
     Javelin::initBehavior(
       'differential-keyboard-navigation',
       array(
         'haunt' => $pane_id,
       ));
 
     $draft = id(new PhabricatorDraft())->loadOneWhere(
       'authorPHID = %s AND draftKey = %s',
       $user->getPHID(),
       'diffusion-audit-'.$commit->getID());
     if ($draft) {
       $draft = $draft->getDraft();
     } else {
       $draft = null;
     }
 
     $actions = $this->getAuditActions($commit, $audit_requests);
 
     $form = id(new AphrontFormView())
       ->setUser($user)
       ->setAction('/audit/addcomment/')
       ->addHiddenInput('commit', $commit->getPHID())
       ->appendChild(
         id(new AphrontFormSelectControl())
           ->setLabel(pht('Action'))
           ->setName('action')
           ->setID('audit-action')
           ->setOptions($actions))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
           ->setLabel(pht('Add Auditors'))
           ->setName('auditors')
           ->setControlID('add-auditors')
           ->setControlStyle('display: none')
           ->setID('add-auditors-tokenizer')
           ->setDisableBehavior(true))
       ->appendChild(
         id(new AphrontFormTokenizerControl())
           ->setLabel(pht('Add CCs'))
           ->setName('ccs')
           ->setControlID('add-ccs')
           ->setControlStyle('display: none')
           ->setID('add-ccs-tokenizer')
           ->setDisableBehavior(true))
       ->appendChild(
         id(new PhabricatorRemarkupControl())
           ->setLabel(pht('Comments'))
           ->setName('content')
           ->setValue($draft)
           ->setID('audit-content')
           ->setUser($user))
       ->appendChild(
         id(new AphrontFormSubmitControl())
           ->setValue(pht('Submit')));
 
     $header = new PHUIHeaderView();
     $header->setHeader(
       $is_serious ? pht('Audit Commit') : pht('Creative Accounting'));
 
     require_celerity_resource('phabricator-transaction-view-css');
 
     $mailable_source = new PhabricatorMetaMTAMailableDatasource();
     $auditor_source = new DiffusionAuditorDatasource();
 
     Javelin::initBehavior(
       'differential-add-reviewers-and-ccs',
       array(
         'dynamic' => array(
           'add-auditors-tokenizer' => array(
             'actions' => array('add_auditors' => 1),
             'src' => $auditor_source->getDatasourceURI(),
             'row' => 'add-auditors',
             'placeholder' => $auditor_source->getPlaceholderText(),
           ),
           'add-ccs-tokenizer' => array(
             'actions' => array('add_ccs' => 1),
             'src' => $mailable_source->getDatasourceURI(),
             'row' => 'add-ccs',
             'placeholder' => $mailable_source->getPlaceholderText(),
           ),
         ),
         'select' => 'audit-action',
       ));
 
     Javelin::initBehavior('differential-feedback-preview', array(
       'uri'       => '/audit/preview/'.$commit->getID().'/',
       'preview'   => 'audit-preview',
       'content'   => 'audit-content',
       'action'    => 'audit-action',
       'previewTokenizers' => array(
         'auditors' => 'add-auditors-tokenizer',
         'ccs'      => 'add-ccs-tokenizer',
       ),
       'inline'     => 'inline-comment-preview',
       'inlineuri'  => '/diffusion/inline/preview/'.$commit->getPHID().'/',
     ));
 
     $loading = phutil_tag_div(
       'aphront-panel-preview-loading-text',
       pht('Loading preview...'));
 
     $preview_panel = phutil_tag_div(
       'aphront-panel-preview aphront-panel-flush',
       array(
         phutil_tag('div', array('id' => 'audit-preview'), $loading),
         phutil_tag('div', array('id' => 'inline-comment-preview'))
       ));
 
     // TODO: This is pretty awkward, unify the CSS between Diffusion and
     // Differential better.
     require_celerity_resource('differential-core-view-css');
 
     $anchor = id(new PhabricatorAnchorView())
       ->setAnchorName('comment')
       ->setNavigationMarker(true)
       ->render();
 
     $comment_box = id(new PHUIObjectBoxView())
       ->setHeader($header)
       ->appendChild($form);
 
     return phutil_tag(
       'div',
       array(
         'id' => $pane_id,
       ),
       phutil_tag_div(
         'differential-add-comment-panel',
         array($anchor, $comment_box, $preview_panel)));
   }
 
   /**
    * Return a map of available audit actions for rendering into a <select />.
    * This shows the user valid actions, and does not show nonsense/invalid
    * actions (like closing an already-closed commit, or resigning from a commit
    * you have no association with).
    */
   private function getAuditActions(
     PhabricatorRepositoryCommit $commit,
     array $audit_requests) {
     assert_instances_of($audit_requests, 'PhabricatorRepositoryAuditRequest');
     $user = $this->getRequest()->getUser();
 
     $user_is_author = ($commit->getAuthorPHID() == $user->getPHID());
 
     $user_request = null;
     foreach ($audit_requests as $audit_request) {
       if ($audit_request->getAuditorPHID() == $user->getPHID()) {
         $user_request = $audit_request;
         break;
       }
     }
 
     $actions = array();
     $actions[PhabricatorAuditActionConstants::COMMENT] = true;
     $actions[PhabricatorAuditActionConstants::ADD_CCS] = true;
     $actions[PhabricatorAuditActionConstants::ADD_AUDITORS] = true;
 
     // We allow you to accept your own commits. A use case here is that you
     // notice an issue with your own commit and "Raise Concern" as an indicator
     // to other auditors that you're on top of the issue, then later resolve it
     // and "Accept". You can not accept on behalf of projects or packages,
     // however.
     $actions[PhabricatorAuditActionConstants::ACCEPT]  = true;
     $actions[PhabricatorAuditActionConstants::CONCERN] = true;
 
 
     // To resign, a user must have authority on some request and not be the
     // commit's author.
     if (!$user_is_author) {
       $may_resign = false;
 
       $authority_map = array_fill_keys($this->auditAuthorityPHIDs, true);
       foreach ($audit_requests as $request) {
         if (empty($authority_map[$request->getAuditorPHID()])) {
           continue;
         }
         $may_resign = true;
         break;
       }
 
       // If the user has already resigned, don't show "Resign...".
       $status_resigned = PhabricatorAuditStatusConstants::RESIGNED;
       if ($user_request) {
         if ($user_request->getAuditStatus() == $status_resigned) {
           $may_resign = false;
         }
       }
 
       if ($may_resign) {
         $actions[PhabricatorAuditActionConstants::RESIGN] = true;
       }
     }
 
     $status_concern = PhabricatorAuditCommitStatusConstants::CONCERN_RAISED;
     $concern_raised = ($commit->getAuditStatus() == $status_concern);
     $can_close_option = PhabricatorEnv::getEnvConfig(
       'audit.can-author-close-audit');
     if ($can_close_option && $user_is_author && $concern_raised) {
       $actions[PhabricatorAuditActionConstants::CLOSE] = true;
     }
 
     foreach ($actions as $constant => $ignored) {
       $actions[$constant] =
         PhabricatorAuditActionConstants::getActionName($constant);
     }
 
     return $actions;
   }
 
   private function buildMergesTable(PhabricatorRepositoryCommit $commit) {
     $drequest = $this->getDiffusionRequest();
     $limit = 50;
 
     $merges = array();
     try {
       $merges = $this->callConduitWithDiffusionRequest(
         'diffusion.mergedcommitsquery',
         array(
           'commit' => $drequest->getCommit(),
           'limit' => $limit + 1));
     } catch (ConduitException $ex) {
       if ($ex->getMessage() != 'ERR-UNSUPPORTED-VCS') {
         throw $ex;
       }
     }
 
     if (!$merges) {
       return null;
     }
 
     $caption = null;
     if (count($merges) > $limit) {
       $merges = array_slice($merges, 0, $limit);
       $caption =
         "This commit merges more than {$limit} changes. Only the first ".
         "{$limit} are shown.";
     }
 
     $history_table = new DiffusionHistoryTableView();
     $history_table->setUser($this->getRequest()->getUser());
     $history_table->setDiffusionRequest($drequest);
     $history_table->setHistory($merges);
     $history_table->loadRevisions();
 
     $phids = $history_table->getRequiredHandlePHIDs();
     $handles = $this->loadViewerHandles($phids);
     $history_table->setHandles($handles);
 
     $panel = new AphrontPanelView();
     $panel->setHeader(pht('Merged Changes'));
     $panel->setCaption($caption);
     $panel->appendChild($history_table);
     $panel->setNoBackground();
 
     return $panel;
   }
 
   private function renderHeadsupActionList(
     PhabricatorRepositoryCommit $commit,
     PhabricatorRepository $repository) {
 
     $request = $this->getRequest();
     $user = $request->getUser();
 
     $actions = id(new PhabricatorActionListView())
       ->setUser($user)
       ->setObject($commit)
       ->setObjectURI($request->getRequestURI());
 
     $can_edit = PhabricatorPolicyFilter::hasCapability(
       $user,
       $commit,
       PhabricatorPolicyCapability::CAN_EDIT);
 
     $uri = '/diffusion/'.$repository->getCallsign().'/commit/'.
            $commit->getCommitIdentifier().'/edit/';
 
     $action = id(new PhabricatorActionView())
       ->setName(pht('Edit Commit'))
       ->setHref($uri)
       ->setIcon('fa-pencil')
       ->setDisabled(!$can_edit)
       ->setWorkflow(!$can_edit);
     $actions->addAction($action);
 
     require_celerity_resource('phabricator-object-selector-css');
     require_celerity_resource('javelin-behavior-phabricator-object-selector');
 
     $maniphest = 'PhabricatorManiphestApplication';
     if (PhabricatorApplication::isClassInstalled($maniphest)) {
       $action = id(new PhabricatorActionView())
         ->setName(pht('Edit Maniphest Tasks'))
         ->setIcon('fa-anchor')
         ->setHref('/search/attach/'.$commit->getPHID().'/TASK/edge/')
         ->setWorkflow(true)
         ->setDisabled(!$can_edit);
       $actions->addAction($action);
     }
 
     $action = id(new PhabricatorActionView())
       ->setName(pht('Download Raw Diff'))
       ->setHref($request->getRequestURI()->alter('diff', true))
       ->setIcon('fa-download');
     $actions->addAction($action);
 
     return $actions;
   }
 
   private function buildRefs(DiffusionRequest $request) {
     // this is git-only, so save a conduit round trip and just get out of
     // here if the repository isn't git
     $type_git = PhabricatorRepositoryType::REPOSITORY_TYPE_GIT;
     $repository = $request->getRepository();
     if ($repository->getVersionControlSystem() != $type_git) {
       return null;
     }
 
     $results = $this->callConduitWithDiffusionRequest(
       'diffusion.refsquery',
       array('commit' => $request->getCommit()));
     $ref_links = array();
     foreach ($results as $ref_data) {
       $ref_links[] = phutil_tag('a',
         array('href' => $ref_data['href']),
         $ref_data['ref']);
     }
     return phutil_implode_html(', ', $ref_links);
   }
 
   private function buildRawDiffResponse(DiffusionRequest $drequest) {
     $raw_diff = $this->callConduitWithDiffusionRequest(
       'diffusion.rawdiffquery',
       array(
         'commit' => $drequest->getCommit(),
         'path' => $drequest->getPath()));
 
     $file = PhabricatorFile::buildFromFileDataOrHash(
       $raw_diff,
       array(
         'name' => $drequest->getCommit().'.diff',
         'ttl' => (60 * 60 * 24),
         'viewPolicy' => PhabricatorPolicies::POLICY_NOONE,
       ));
 
     $unguarded = AphrontWriteGuard::beginScopedUnguardedWrites();
       $file->attachToObject(
         $this->getRequest()->getUser(),
         $drequest->getRepository()->getPHID());
     unset($unguarded);
 
     return id(new AphrontRedirectResponse())->setURI($file->getBestURI());
   }
 
   private function renderAuditStatusView(array $audit_requests) {
     assert_instances_of($audit_requests, 'PhabricatorRepositoryAuditRequest');
 
     $phids = mpull($audit_requests, 'getAuditorPHID');
     $this->loadHandles($phids);
 
     $authority_map = array_fill_keys($this->auditAuthorityPHIDs, true);
 
     $view = new PHUIStatusListView();
     foreach ($audit_requests as $request) {
       $item = new PHUIStatusItemView();
 
       switch ($request->getAuditStatus()) {
         case PhabricatorAuditStatusConstants::AUDIT_NOT_REQUIRED:
           $item->setIcon(
             PHUIStatusItemView::ICON_OPEN,
             'blue',
             pht('Commented'));
           break;
         case PhabricatorAuditStatusConstants::AUDIT_REQUIRED:
           $item->setIcon(
             PHUIStatusItemView::ICON_WARNING,
             'blue',
             pht('Audit Required'));
           break;
         case PhabricatorAuditStatusConstants::CONCERNED:
           $item->setIcon(
             PHUIStatusItemView::ICON_REJECT,
             'red',
             pht('Concern Raised'));
           break;
         case PhabricatorAuditStatusConstants::ACCEPTED:
           $item->setIcon(
             PHUIStatusItemView::ICON_ACCEPT,
             'green',
             pht('Accepted'));
           break;
         case PhabricatorAuditStatusConstants::AUDIT_REQUESTED:
           $item->setIcon(
             PHUIStatusItemView::ICON_WARNING,
             'dark',
             pht('Audit Requested'));
           break;
         case PhabricatorAuditStatusConstants::RESIGNED:
           $item->setIcon(
             PHUIStatusItemView::ICON_OPEN,
             'dark',
             pht('Resigned'));
           break;
         case PhabricatorAuditStatusConstants::CLOSED:
           $item->setIcon(
             PHUIStatusItemView::ICON_ACCEPT,
             'blue',
             pht('Closed'));
           break;
         case PhabricatorAuditStatusConstants::CC:
           $item->setIcon(
             PHUIStatusItemView::ICON_INFO,
             'dark',
             pht('Subscribed'));
           break;
         default:
           $item->setIcon(
             PHUIStatusItemView::ICON_QUESTION,
             'dark',
             pht('%s?', $request->getAuditStatus()));
           break;
       }
 
       $note = array();
       foreach ($request->getAuditReasons() as $reason) {
         $note[] = phutil_tag('div', array(), $reason);
       }
       $item->setNote($note);
 
       $auditor_phid = $request->getAuditorPHID();
       $target = $this->getHandle($auditor_phid)->renderLink();
       $item->setTarget($target);
 
       if (isset($authority_map[$auditor_phid])) {
         $item->setHighlighted(true);
       }
 
       $view->addItem($item);
     }
 
     return $view;
   }
 
   private function linkBugtraq($corpus) {
     $url = PhabricatorEnv::getEnvConfig('bugtraq.url');
     if (!strlen($url)) {
       return $corpus;
     }
 
     $regexes = PhabricatorEnv::getEnvConfig('bugtraq.logregex');
     if (!$regexes) {
       return $corpus;
     }
 
     $parser = id(new PhutilBugtraqParser())
       ->setBugtraqPattern("[[ {$url} | %BUGID% ]]")
       ->setBugtraqCaptureExpression(array_shift($regexes));
 
     $select = array_shift($regexes);
     if ($select) {
       $parser->setBugtraqSelectExpression($select);
     }
 
     return $parser->processCorpus($corpus);
   }
 
 }
diff --git a/src/applications/repository/search/PhabricatorRepositoryCommitSearchIndexer.php b/src/applications/repository/search/PhabricatorRepositoryCommitSearchIndexer.php
index d8bc0125b8..ecdd4d6e64 100644
--- a/src/applications/repository/search/PhabricatorRepositoryCommitSearchIndexer.php
+++ b/src/applications/repository/search/PhabricatorRepositoryCommitSearchIndexer.php
@@ -1,93 +1,93 @@
 <?php
 
 final class PhabricatorRepositoryCommitSearchIndexer
   extends PhabricatorSearchDocumentIndexer {
 
   public function getIndexableObject() {
     return new PhabricatorRepositoryCommit();
   }
 
   protected function buildAbstractDocumentByPHID($phid) {
     $commit = $this->loadDocumentByPHID($phid);
 
     $commit_data = id(new PhabricatorRepositoryCommitData())->loadOneWhere(
       'commitID = %d',
       $commit->getID());
     $date_created = $commit->getEpoch();
     $commit_message = $commit_data->getCommitMessage();
     $author_phid = $commit_data->getCommitDetail('authorPHID');
 
     $repository = id(new PhabricatorRepositoryQuery())
       ->setViewer($this->getViewer())
       ->withIDs(array($commit->getRepositoryID()))
       ->executeOne();
     if (!$repository) {
       throw new Exception('No such repository!');
     }
 
     $title = 'r'.$repository->getCallsign().$commit->getCommitIdentifier().
       ' '.$commit_data->getSummary();
 
     $doc = new PhabricatorSearchAbstractDocument();
     $doc->setPHID($commit->getPHID());
     $doc->setDocumentType(PhabricatorRepositoryCommitPHIDType::TYPECONST);
     $doc->setDocumentCreated($date_created);
     $doc->setDocumentModified($date_created);
     $doc->setDocumentTitle($title);
 
     $doc->addField(
       PhabricatorSearchField::FIELD_BODY,
       $commit_message);
 
     if ($author_phid) {
       $doc->addRelationship(
         PhabricatorSearchRelationship::RELATIONSHIP_AUTHOR,
         $author_phid,
         PhabricatorPeopleUserPHIDType::TYPECONST,
         $date_created);
     }
 
     $project_phids = PhabricatorEdgeQuery::loadDestinationPHIDs(
       $commit->getPHID(),
       PhabricatorEdgeConfig::TYPE_COMMIT_HAS_PROJECT);
     if ($project_phids) {
       foreach ($project_phids as $project_phid) {
         $doc->addRelationship(
           PhabricatorSearchRelationship::RELATIONSHIP_PROJECT,
           $project_phid,
           PhabricatorProjectProjectPHIDType::TYPECONST,
           $date_created);
       }
     }
 
     $doc->addRelationship(
       PhabricatorSearchRelationship::RELATIONSHIP_REPOSITORY,
       $repository->getPHID(),
       PhabricatorRepositoryRepositoryPHIDType::TYPECONST,
       $date_created);
 
-    $comments = id(new PhabricatorAuditComment())->loadAllWhere(
-      'targetPHID = %s',
+    $comments = PhabricatorAuditComment::loadComments(
+      $this->getViewer(),
       $commit->getPHID());
     foreach ($comments as $comment) {
       if (strlen($comment->getContent())) {
         $doc->addField(
           PhabricatorSearchField::FIELD_COMMENT,
           $comment->getContent());
       }
     }
 
     $inlines = PhabricatorAuditInlineComment::loadPublishedComments(
       $this->getViewer(),
       $commit->getPHID());
     foreach ($inlines as $inline) {
       if (strlen($inline->getContent())) {
         $doc->addField(
           PhabricatorSearchField::FIELD_COMMENT,
           $inline->getContent());
       }
     }
 
     return $doc;
   }
 }