[Birfy]

Written-by: Dev
Fixes #602

Owner: Dev
Reviewer: Reviewer
Branch: dev/602-comment-hold
Base: 5b862c6
Tip SHA: d7b246b

What changed

The guard ran on the labels, the diff and the newest conclusion, and never read the comments. On 2026-11-01 that merged #2067 two minutes after its author wrote "please do not merge this tip": hold is a label only a person can set or lift, so the author of a pull request opened by a Bot account has no marker to apply, and the comment was the only brake (#602, reopened by the Chief's 17:43 comment on the issue).

stopRequestAt (.github/scripts/enqueue-rules.mjs) reads the comments written after the conclusion the decision used — a person's (type: User) or the pull request's own author's, the #2067 shape where the author was the only one objecting — and guard refuses with one reason naming the comment id, the login, the time and the phrase it read. The newest comment in that window decides, so a later one that lets the tip merge clears the stop and a corrected tip with its own PASS moves the window past it; without that a T0/T1 change, which has no PASS to move the window with, would wedge on one mistaken sentence. Quoted text and code fences are mentions, not requests — the lesson #687 left when the record-only marker made the first PASS explaining it freeze itself. A merged pull request is not re-judged (this check also runs on every comment).

merge-gate.mjs now carries comment and review ids into its report list and passes the author to guard, so a queue entry refuses by the same rule; enqueue-guard.mjs passes the author. One judgement, two readers, no second copy of the rules (#812/#960).

Red first

Five cases added to .github/scripts/enqueue-guard.test.mjs and two to .github/scripts/merge-gate.test.mjs, run against main 5b862c6e before any source change:

$ node --test .github/scripts/enqueue-guard.test.mjs
not ok 89 - #602 (2026-11-01): a comment after the PASS asking not to merge this tip refuses, and names the comment
not ok 90 - #602 (2026-11-01): the pull request author counts even from a bot account, and a bot that is not the author does not
not ok 92 - #602 (2026-11-01): a newer comment that lets it merge clears the stop; another comment does not
not ok 94 - #602 (2026-11-01): a T0/T1 pull request with no PASS is stopped by a comment too
# tests 95  # pass 91  # fail 4
$ node --test .github/scripts/merge-gate.test.mjs
not ok 18 - #602 (2026-11-01): a comment asking not to merge refuses the queue entry, through main()
# tests 48  # pass 47  # fail 1

The same rule was replayed over the real API payload of #2067 (its comments, its author HugoXK, read as of 17:38:30Z, after the 17:35:30 PASS): {"id":6561490250,"login":"HugoXK","at":"2026-11-01T17:38:11Z","phrase":"please do not merge"} — the merge of 17:39:54 would have been refused. The whole list reads {"id":6561504238,"login":"HugoXK",…,"phrase":"hold request"} (its addendum), and the same call on the three open pull requests of this repository returns null on each.

Verification at the tip

Tip SHA: d7b246b

Ran: node --test ".github/scripts/*.test.mjs" — 565 tests, 563 pass, 0 fail; node --test .github/scripts/enqueue-guard.test.mjs .github/scripts/merge-gate.test.mjs — 143/143; node core/scripts/build-client.mjs --check exit 0; node scripts/ds-bot-patches.mjs check — "10 patches apply cleanly in order", "core/ equals ds-bot/ + patches/ds-bot/"; node .github/scripts/changelog.mjs check — 47 fragments well formed; core lint oxlint — 73 warnings, 0 errors; the core suite at --test-concurrency=4 — 2528 tests, 2525 pass, 3 fail, all three on host tooling this box lacks (two core/test/check-arch-docs.test.js cases run git, and core/test/usage-fields.test.js runs python3); interop 37/37 and live-e2e 24/24.

Not run (and why): arch-docs — this copy has no .git (the working tree came from the main tarball and the box has no git), and no owned path changes, so nothing there can move; ds-bot-patches canonical — it asks git for the diff; the plugin suites — their ds-bot import needs npm ci inside each plugin, which this copy does not have (no plugin file is touched); the smoke test — no index.js or src/host/ change.

Checkpoint

{
  "pr": 2073,
  "claim": "Dev",
  "issue": 602,
  "summary": "The guard read the labels, the diff and the conclusions and never the comments, which is how #2067 merged two minutes after its author wrote a stop: `hold` is human-only and a Bot-opened pull request cannot carry it. It now refuses on a comment written after the conclusion it used asking not to merge this tip, naming the comment id, and the queue entry refuses by the same rule. The newest comment in that window decides, so a later answer clears it and a corrected tip with its own PASS moves the window past it. Quotes and code fences are mentions, and a merged pull request is not re-judged.",
  "files": [
    ".github/scripts/enqueue-rules.mjs",
    ".github/scripts/enqueue-guard.test.mjs",
    "AGENTS.md"
  ],
  "checks": {
    "ran": "node --test \".github/scripts/*.test.mjs\"",
    "result": "green",
    "at": "d7b246ba8a52ddaf8d1a64f5dec256a5c2c284ee"
  },
  "next": "none — ready for review"
}

[Birfy]

Verdict: PASS at d7b246b
Written-by: Reviewer
Attestation: d7b246b role=Reviewer

Ran at this tip:

$ node --test ".github/scripts/*.test.mjs"
$ node --test .github/scripts/enqueue-guard.test.mjs .github/scripts/merge-gate.test.mjs
# tests 565  # pass 563  # fail 0

Red first (the same suites with enqueue-rules.mjs, enqueue-guard.mjs and merge-gate.mjs swapped back to their base blob at 5b862c6, same box, nothing else changed):

$ node --test .github/scripts/enqueue-guard.test.mjs
# tests 95  # pass 91  # fail 4
$ node --test .github/scripts/merge-gate.test.mjs
# tests 48  # pass 47  # fail 1

The five red are exactly the new #602 cases (enqueue-guard 89, 90, 92, 94; merge-gate 18); with the tip's sources restored the two touched suites read 143/143 and the whole scripts suite 565 (563 pass, 2 skipped, 0 fail), matching the author's numbers.

• Scope: 8 files +200/−11 against base 5b862c6 — enqueue-rules.mjs (+96/−2, the new stopRequestAt and its wiring into guard), enqueue-guard.mjs (+1/−1, passes the author), merge-gate.mjs (+4/−2, comment/review ids into the report and the author into guard), the two test files, plus docs/AGENTS/.claude wording. No unrelated code.
• Behaviour read in the diff: comments are read after the conclusion the decision used, from a type: User or the pull request's own author, newest in the window decides; quoted text and fences are mentions; a merged pull request is not re-judged; one rule, two readers (guard called by both enqueue-guard and the queue entry's merge-gate). The refusal names comment id, login, time and phrase, so the brake is auditable.
• Tip check-runs (16): everything green except enqueue-guard, which is red only for "no Verifier report names the tip d7b246b" — that is this comment; it re-runs on a comment. tests-ok, merge-gate, judge, risk tier, plugins, package, agent-audience and the Node 24 job all success.
• Checkpoint block present and within bounds (987 chars, summary 596), Fixes #602, Owner: Dev, Reviewer: Reviewer, agent-pr labelled.

T2 (AGENTS.md/doc + workflow-script change): PASS at this head, enqueueing now.