diff --git a/app/comments.js b/app/comments.js
new file mode 100644
index 0000000..7a349f4
--- /dev/null
+++ b/app/comments.js
@@ -0,0 +1,70 @@
+import fs from 'fs';
+import path from 'path';
+import { postComment } from './gitea.js';
+import { FINDINGS_PATH } from './config.js';
+
+const LEVEL_EMOJI = { critical: '🔴', warning: '🟡', info: '🔵' };
+const LEVEL_LABEL = { critical: '嚴重', warning: '警告', info: '建議' };
+
+function findingRow(f) {
+  return `| ${LEVEL_EMOJI[f.level] || ''} ${LEVEL_LABEL[f.level] || f.level} | ${f.role} | ${f.location} | ${f.suggestion} |`;
+}
+
+function buildTable(findings) {
+  const rows = findings.map(findingRow).join('\n');
+  return `| 等級 | 審查員 | 位置 | 建議 |\n|------|--------|------|------|\n${rows}`;
+}
+
+/**
+ * 寫入 findings.json 到 workspace
+ */
+export function saveFindings(workspace, findings) {
+  const fullPath = path.join(workspace, FINDINGS_PATH);
+  fs.mkdirSync(path.dirname(fullPath), { recursive: true });
+  fs.writeFileSync(fullPath, JSON.stringify(findings, null, 2), 'utf8');
+  console.log(`  ✅ findings 寫入: ${fullPath} (${findings.length} 筆)`);
+}
+
+/**
+ * 發布所有舊問題 comment（一次發布，依等級排序）
+ */
+export async function postOldFindingsComment(findings) {
+  const old = findings.filter(f => !f.is_new);
+  if (old.length === 0) {
+    console.log('  無舊問題，跳過');
+    return;
+  }
+  const body = `## 📋 舊有未解決問題（${old.length} 筆）\n\n${buildTable(old)}`;
+  await postComment(body);
+  console.log(`  ✅ 舊問題 comment 發布 (${old.length} 筆)`);
+}
+
+/**
+ * 發布新問題中非 critical 的 comment（一次發布）
+ */
+export async function postNewNonCriticalComment(findings) {
+  const items = findings.filter(f => f.is_new && f.level !== 'critical');
+  if (items.length === 0) {
+    console.log('  無新的非嚴重問題，跳過');
+    return;
+  }
+  const body = `## 🔍 新發現問題（${items.length} 筆）\n\n${buildTable(items)}`;
+  await postComment(body);
+  console.log(`  ✅ 新問題（非嚴重）comment 發布 (${items.length} 筆)`);
+}
+
+/**
+ * 每個新 critical 問題各發一個 comment
+ */
+export async function postNewCriticalComments(findings) {
+  const criticals = findings.filter(f => f.is_new && f.level === 'critical');
+  if (criticals.length === 0) {
+    console.log('  無新的嚴重問題，跳過');
+    return;
+  }
+  for (const f of criticals) {
+    const body = `## 🚨 嚴重問題\n\n| 審查員 | 位置 | 建議 |\n|--------|------|------|\n| ${f.role} | ${f.location} | ${f.suggestion} |`;
+    await postComment(body);
+    console.log(`  ✅ 嚴重問題 comment 發布: [${f.role}] ${f.location}`);
+  }
+}
diff --git a/app/main.js b/app/main.js
index d9db8c9..de466f7 100644
--- a/app/main.js
+++ b/app/main.js
@@ -2,6 +2,7 @@ import { GITEA_REPOSITORY, PR_NUMBER, PR_HEAD_BRANCH, PR_BASE_BRANCH, getLLMConf
 import { loadRoles, getRoleIntro } from './roles.js';
 import { getPRDiff, postComment } from './gitea.js';
 import { analyzeWithRole, loadOldFindings, mergeFindings, sortByLevel, deduplicateWithAI } from './findings.js';
+import { saveFindings, postOldFindingsComment, postNewNonCriticalComment, postNewCriticalComments } from './comments.js';
 
 const WORKSPACE = process.env.GITHUB_WORKSPACE || '/workspace';
 
@@ -74,8 +75,18 @@ async function main() {
   const sorted = sortByLevel(deduped);
   console.log(`  Step3b dedup findings total=${sorted.length} (critical=${sorted.filter(f=>f.level==='critical').length} warning=${sorted.filter(f=>f.level==='warning').length} info=${sorted.filter(f=>f.level==='info').length})`);
 
-  console.log('\n📝 Step4: Findings 寫入與 Comment 發布（待實作）');
-  console.log('  [stub] 寫入 findings.json，發布 comment...');
+  // Step4: 寫入 findings.json，依序發布 comment
+  console.log('\n📝 Step4: Findings 寫入與 Comment 發布');
+  saveFindings(WORKSPACE, sorted);
+
+  try {
+    await postOldFindingsComment(sorted);
+    await postNewNonCriticalComment(sorted);
+    await postNewCriticalComments(sorted);
+    console.log('  Step4 完成');
+  } catch (e) {
+    console.log(`  ⚠️  comment 發布失敗（繼續執行）: ${e.message}`);
+  }
 
   console.log('\n💾 Step5: 記憶區 Commit/Push（待實作）');
   console.log('  [stub] commit & push findings.json...');