From c872aa082cb63fcfafae81b2438e18b2e72e013a Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 29 Oct 2026 15:37:59 -0400
Subject: [PATCH 1/2] feat(pr-pipeline): hold lanes App human-merge pull
 requests with a label only a listed person lifts

report-outcome labels a pull request it holds for a person
human-merge-hold right after it opens or reuses it, and closes and retries
one it cannot label (hold-label-failed). A new ci-status step fails while
the label is on and, once it is off, unless the first removal at or after
its newest add was a trusted-actor human acting directly. enable-auto-merge,
the merge queue's labelHolds and the babysit merge lane hold the label too,
so deleting the body's hold line or rewriting Refs to Closes no longer lets
a held pull request merge.

Closes #9437

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .../human-merge-hold-label-9437a4d1.md        |  17 ++
 .../human-merge-hold-label-9437a4d1.md        |   9 +
 .../scripts/pr-merge/enable-auto-merge.mjs    |   2 +-
 .../pr-merge/enable-auto-merge.test.mjs       |  19 ++
 .github/scripts/pr-merge/merge-holds.mjs      |   9 +-
 .github/scripts/pr-merge/merge-holds.test.mjs |   1 +
 .../work-resolve-issue/report-outcome.mjs     |  33 +++-
 .../report-outcome.test.mjs                   |  79 ++++++++-
 .../work-resolve-issue/stop-routes.json       |   1 +
 .github/workflows/pr-require-checks.yml       |  81 +++++++++
 docs/conventions/pr-pipeline/README.md        |   6 +
 .../pr-pipeline/pr-run-activity.md            |   5 +-
 .../scripts/babysit_merge_policy.py           |   3 +-
 scripts/ci-hold-human-merge.test.sh           | 165 ++++++++++++++++++
 14 files changed, 412 insertions(+), 18 deletions(-)
 create mode 100644 .changes/pr-pipeline/human-merge-hold-label-9437a4d1.md
 create mode 100644 .changes/source-control/human-merge-hold-label-9437a4d1.md
 create mode 100755 scripts/ci-hold-human-merge.test.sh

diff --git a/.changes/pr-pipeline/human-merge-hold-label-9437a4d1.md b/.changes/pr-pipeline/human-merge-hold-label-9437a4d1.md
new file mode 100644
index 00000000000..1a925191851
--- /dev/null
+++ b/.changes/pr-pipeline/human-merge-hold-label-9437a4d1.md
@@ -0,0 +1,17 @@
+---
+bump: minor
+---
+
+### Added
+
+- A lanes App pull request that holds for a person carries the `human-merge-hold` label as well as
+  the `Hold: a human merges this` body line, which the App can edit
+  ([#9437](https://github.com/melodic-software/claude-code-plugins/issues/9437)). report-outcome
+  adds the label right after it opens the pull request, or when it reuses its open one; a pull
+  request the label cannot reach is closed and the issue retried (`hold-label-failed`). ci-status's
+  new `Fail a human-merge hold a listed person has not lifted` step fails while the label is on,
+  and once it is off unless the first removal at or after its newest add was by a `human` of the
+  base's trusted-actor list acting directly, not through an App. `enable-auto-merge.mjs`
+  (`HOLD_LABELS`) never arms a pull request carrying it, and merge-holds.mjs `labelHolds` holds it
+  in the merge queue, so deleting the hold line or rewriting `Refs: #N` to `Closes #N` no longer
+  lets a held pull request merge.
diff --git a/.changes/source-control/human-merge-hold-label-9437a4d1.md b/.changes/source-control/human-merge-hold-label-9437a4d1.md
new file mode 100644
index 00000000000..6bcccd6b072
--- /dev/null
+++ b/.changes/source-control/human-merge-hold-label-9437a4d1.md
@@ -0,0 +1,9 @@
+---
+bump: patch
+---
+
+### Changed
+
+- The babysit merge lane holds a pull request carrying `human-merge-hold`
+  (`babysit_merge_policy.MERGE_HOLD_LABELS`), the label the lanes App puts on a pull request a
+  person merges ([#9437](https://github.com/melodic-software/claude-code-plugins/issues/9437)).
diff --git a/.github/scripts/pr-merge/enable-auto-merge.mjs b/.github/scripts/pr-merge/enable-auto-merge.mjs
index b74602371d9..c09d4f3519e 100755
--- a/.github/scripts/pr-merge/enable-auto-merge.mjs
+++ b/.github/scripts/pr-merge/enable-auto-merge.mjs
@@ -219,7 +219,7 @@ const REPO = /^([A-Za-z0-9_.-]+)\/([A-Za-z0-9_.-]+)$/;
 const SHA = /^[0-9a-f]{40}$/;
 const BOT_LOGIN = /^([a-z0-9][a-z0-9-]*)\[bot\]$/;
 // babysit_merge_policy.MERGE_HOLD_LABELS, plus the human-gated label.
-export const HOLD_LABELS = Object.freeze(["do-not-merge", "pr-verify-failed"]);
+export const HOLD_LABELS = Object.freeze(["do-not-merge", "pr-verify-failed", "human-merge-hold"]);
 // 100 pull requests a page; more than this many open is a listing the run
 // stops on rather than one it reads only part of.
 const MAX_PAGES = 10;
diff --git a/.github/scripts/pr-merge/enable-auto-merge.test.mjs b/.github/scripts/pr-merge/enable-auto-merge.test.mjs
index 36465d31065..2788c4e9831 100644
--- a/.github/scripts/pr-merge/enable-auto-merge.test.mjs
+++ b/.github/scripts/pr-merge/enable-auto-merge.test.mjs
@@ -27,6 +27,7 @@ import {
   UNLABELED_QUERY,
   decide,
   describe,
+  holdReason,
   unblockHold,
   liftedByPerson,
   READER_EVENTS,
@@ -1716,6 +1717,24 @@ test("the lane's own hold line holds a lanes App body", async () => {
   assert.deepEqual(writes, [{ mutation: "arm", id: "PR_3", head: HEAD }]);
 });
 
+// #9437: report-outcome labels a held PR human-merge-hold, so a lanes App
+// edit of the body (the hold line deleted, or `Refs: #N` rewritten to
+// `Closes #N`) leaves it unarmed while the label is on.
+test("a human-merge-hold label holds a lanes App PR whose body lost its hold line or its Refs line", async () => {
+  const appOnly = { totalCount: 0, nodes: [] };
+  const held = labels("human-merge-hold");
+  const { writes } = await run([
+    // The hold line deleted from a Refs PR's body.
+    pull(1, { body: "Refs: #5\n\n## Summary", labels: held, userContentEdits: appOnly }),
+    // `Refs: #5` rewritten to `Closes #5`, the hold line gone with it.
+    pull(2, { body: "Closes #5\n\n## Summary", labels: held, userContentEdits: appOnly }),
+    pull(3, { body: "Closes #5\n\n## Summary", userContentEdits: appOnly }),
+  ]);
+  assert.deepEqual(writes, [{ mutation: "arm", id: "PR_3", head: HEAD }]);
+  assert.equal(holdReason({ labels: held, body: "Closes #5" }, "needs-human"), "it carries human-merge-hold");
+  assert.equal(holdReason({ labels: labels("Human-Merge-Hold"), body: "Closes #5" }, "needs-human"), "it carries human-merge-hold");
+});
+
 // Owner decision Q-HOLDLINE: report-outcome's own hold line is a cause a
 // person must clear, so a reader run comments once and adds the human-gated
 // label, as for a configured denied path; it puts the label back unless a
diff --git a/.github/scripts/pr-merge/merge-holds.mjs b/.github/scripts/pr-merge/merge-holds.mjs
index 75fdfaac6c9..43c5a1165ac 100755
--- a/.github/scripts/pr-merge/merge-holds.mjs
+++ b/.github/scripts/pr-merge/merge-holds.mjs
@@ -1438,8 +1438,13 @@ export function humanGatedLabel(tracker) {
   return typeof label === "string" && label.trim() ? label.trim() : "needs-human";
 }
 
+// The label report-outcome puts on a lanes App pull request that holds for a
+// person (report-outcome.mjs HUMAN_MERGE_HOLD). Only a listed person's own
+// removal lifts it (ci-status's `Fail a human-merge hold` step).
+export const HUMAN_MERGE_HOLD = "human-merge-hold";
+
 // The hold labels on pull request `number`: `do-not-merge`, the tracker's
-// human-gated label and `pr-verify-failed`, one reason each. `labels` are
+// human-gated label, `pr-verify-failed` and HUMAN_MERGE_HOLD, one reason each. `labels` are
 // names or label objects; a list that is not an array throws.
 export function labelHolds(labels, tracker, number) {
   if (!Array.isArray(labels)) {
@@ -1452,6 +1457,8 @@ export function labelHolds(labels, tracker, number) {
     names.has(gated) && `#${number} carries '${gated}'; the merge queue removes it. Removing the label approves this pull request; re-queue it to merge.`,
     names.has("pr-verify-failed") &&
       `#${number} carries 'pr-verify-failed': pr-verify failed its head, and a pass at a new commit removes the label. The merge queue removes it; re-queue it once the label is off.`,
+    names.has(HUMAN_MERGE_HOLD) &&
+      `#${number} carries '${HUMAN_MERGE_HOLD}': a person merges it. The merge queue removes it; a person on the trusted-actor list removing the label approves it, then re-queue it to merge.`,
   ].filter(Boolean);
 }
 
diff --git a/.github/scripts/pr-merge/merge-holds.test.mjs b/.github/scripts/pr-merge/merge-holds.test.mjs
index 7a7c0519b75..bee95945995 100644
--- a/.github/scripts/pr-merge/merge-holds.test.mjs
+++ b/.github/scripts/pr-merge/merge-holds.test.mjs
@@ -1471,6 +1471,7 @@ test("queueHolds: each hold label holds with ci-status's text", () => {
     ["do-not-merge", "#7 carries the 'do-not-merge' label; the merge queue removes it. Remove the label and re-queue to merge."],
     ["needs-human", "#7 carries 'needs-human'; the merge queue removes it. Removing the label approves this pull request; re-queue it to merge."],
     ["pr-verify-failed", "#7 carries 'pr-verify-failed': pr-verify failed its head, and a pass at a new commit removes the label. The merge queue removes it; re-queue it once the label is off."],
+    ["human-merge-hold", "#7 carries 'human-merge-hold': a person merges it. The merge queue removes it; a person on the trusted-actor list removing the label approves it, then re-queue it to merge."],
   ]) {
     assert.deepEqual(holdsModule.queueHolds({ pull: queuedPull({ labels: [{ name: "bug" }, { name: label }] }), statuses: [] }), [want], label);
   }
diff --git a/.github/scripts/work-resolve-issue/report-outcome.mjs b/.github/scripts/work-resolve-issue/report-outcome.mjs
index 6fa6b222ae8..f3163eef9ac 100755
--- a/.github/scripts/work-resolve-issue/report-outcome.mjs
+++ b/.github/scripts/work-resolve-issue/report-outcome.mjs
@@ -128,6 +128,10 @@ import { networkError, retryFetch } from "./retry-fetch.mjs";
 import { ATTENDED_LABEL, HOST_RUN_LABEL, runCode, stopRoute, stopWhy } from "./stop-routes.mjs";
 
 export const HOLD_LINE = "Hold: a human merges this";
+// The label a held PR carries from its opening. The hold line is body text the
+// lanes App can edit; ci-status fails while this label is on and unless a
+// listed person's own removal took it off (merge-holds.mjs HUMAN_MERGE_HOLD).
+export const HUMAN_MERGE_HOLD = "human-merge-hold";
 const EXITS = new Set(["done", "pushback", "stopped"]);
 // The subject allows no `#`, `/` or `GH-<digit>`, so the squash commit title
 // cannot name an issue to close.
@@ -834,7 +838,7 @@ export function reusePlan({
     "",
     `#${issueNumber}`,
   ].join("\n");
-  return { action: "open-pr", issueNumber, title: prTitle(summary?.title ?? "", issueTitle, issueNumber), body, branch };
+  return { action: "open-pr", issueNumber, title: prTitle(summary?.title ?? "", issueTitle, issueNumber), body, branch, hold };
 }
 
 // What to do on the issue, from the outcome and what the run left. `limit` is
@@ -1062,6 +1066,7 @@ export function decide({
     title: prTitle(outcome.title, issueTitle, issueNumber),
     body,
     branch,
+    hold,
   };
 }
 
@@ -1833,18 +1838,36 @@ export async function main({ env = process.env, fetch = globalThis.fetch, now =
             pull = (await findOpen()) ?? (await github("POST", `${repo}/pulls`, fields));
           }
         }
+        // A held PR carries the hold label from its opening; one the label
+        // cannot reach is closed rather than left held by body text alone.
+        const labeled =
+          !plan.hold ||
+          (await github("POST", `${repo}/issues/${pull.number}/labels`, { labels: [HUMAN_MERGE_HOLD] }, { safeToResend: true }).then(
+            () => true,
+            (error) => {
+              console.log(`::warning title=report-outcome::could not label PR #${pull.number} ${HUMAN_MERGE_HOLD}: ${String(error?.message ?? error)}`);
+              return false;
+            },
+          ));
         // A plan with a tip opens only at it: a PR whose head moved off the
         // checked tip is closed, and the issue goes to a person. Closing a
         // closed PR changes nothing, so the close is resent.
-        if (!plan.tip || pull.head?.sha === plan.tip) {
+        const moved = Boolean(plan.tip) && pull.head?.sha !== plan.tip;
+        if (labeled && !moved) {
           console.log(`report-outcome: opened PR #${pull.number} for issue #${issueNumber}`);
           return 0;
         }
         await github("PATCH", `${repo}/pulls/${pull.number}`, { state: "closed" }, { safeToResend: true });
-        console.log(`report-outcome: closed PR #${pull.number}: its head is not ${plan.tip}, the tip the runner checked`);
-        plan = routeStop("pr-head-moved", {
+        console.log(
+          moved
+            ? `report-outcome: closed PR #${pull.number}: its head is not ${plan.tip}, the tip the runner checked`
+            : `report-outcome: closed PR #${pull.number}: it holds for a person and could not be labeled ${HUMAN_MERGE_HOLD}`,
+        );
+        plan = routeStop(moved ? "pr-head-moved" : "hold-label-failed", {
           outcome: stopped(
-            `The PR from \`${plan.branch}\` opened at a head other than ${plan.tip}, the tip the runner checked, so it was closed.`,
+            moved
+              ? `The PR from \`${plan.branch}\` opened at a head other than ${plan.tip}, the tip the runner checked, so it was closed.`
+              : `The PR from \`${plan.branch}\` holds for a person, and the \`${HUMAN_MERGE_HOLD}\` label could not be added, so it was closed.`,
           ),
           issueNumber,
           branch: plan.branch,
diff --git a/.github/scripts/work-resolve-issue/report-outcome.test.mjs b/.github/scripts/work-resolve-issue/report-outcome.test.mjs
index cdc96f9cb7e..5d48fd88a7e 100644
--- a/.github/scripts/work-resolve-issue/report-outcome.test.mjs
+++ b/.github/scripts/work-resolve-issue/report-outcome.test.mjs
@@ -33,6 +33,7 @@ import {
   RESUMABLE,
   reusePlan,
   HOLD_LINE,
+  HUMAN_MERGE_HOLD,
   trustedLabeler,
   unmarkedAnswer,
 } from "./report-outcome.mjs";
@@ -762,7 +763,13 @@ function fakeFetch(routes) {
     const path = new URL(url).pathname;
     calls.push({ method, path, body: init.body ? JSON.parse(init.body) : undefined });
     // An issue no open PR closes, unless a route says otherwise.
-    const none = path === "/graphql" ? [method, /./, 200, { data: { repository: { issue: { closedByPullRequestsReferences: { nodes: [], pageInfo: { hasNextPage: false } } } } } }] : null;
+    // A held PR's human-merge-hold label write succeeds, unless a route says otherwise.
+    const none =
+      path === "/graphql"
+        ? [method, /./, 200, { data: { repository: { issue: { closedByPullRequestsReferences: { nodes: [], pageInfo: { hasNextPage: false } } } } } }]
+        : method === "POST" && /\/issues\/90\/labels$/.test(path)
+          ? [method, /./, 200, []]
+          : null;
     const route = routes.find(([m, p]) => m === method && p.test(path)) ?? none;
     const [, , status, body] = route ?? [method, /./, 404, { message: "Not Found" }];
     return { ok: status < 300, status, json: async () => body, text: async () => JSON.stringify(body) };
@@ -1000,7 +1007,7 @@ test("main refuses an escalation reason it does not know and writes nothing", as
   });
 });
 
-test("main on done opens a ready PR from the branch and adds no label to it", async () => {
+test("main on done opens a ready PR from the branch, labels it human-merge-hold when it holds, and writes nothing to the issue", async () => {
   await withDir(
     { "work-outcome.json": JSON.stringify(done), "lane.json": JSON.stringify({ branch: BRANCH }), "runner-checks": checksFile() },
     async (dir) => {
@@ -1019,7 +1026,8 @@ test("main on done opens a ready PR from the branch and adds no label to it", as
       assert.equal(pull.head, BRANCH);
       assert.equal(pull.base, "main");
       assert.ok(pull.body.startsWith("Closes #77\n"));
-      assert.ok(!calls.some((c) => c.path.endsWith("/issues/90/labels")));
+      assert.ok(pull.body.split("\n").includes(HOLD_LINE), pull.body);
+      assert.deepEqual(calls.filter((c) => c.path.endsWith("/issues/90/labels")).map((c) => c.body), [{ labels: ["human-merge-hold"] }]);
       assert.ok(!calls.some((c) => c.method === "POST" && c.path.startsWith("/repos/o/r/issues/77/")));
     },
   );
@@ -1117,7 +1125,8 @@ test("main on done with Refs opens the PR and writes nothing to the issue", asyn
       ]);
       assert.equal(await main({ env: env(dir), fetch }), 0);
       const writes = calls.filter((c) => c.method !== "GET" && c.path !== "/graphql").map((c) => `${c.method} ${c.path}`);
-      assert.deepEqual(writes, ["POST /repos/o/r/pulls"]);
+      // No denied-path list reads here, so the PR holds and carries the hold label.
+      assert.deepEqual(writes, ["POST /repos/o/r/pulls", "POST /repos/o/r/issues/90/labels"]);
       assert.ok(calls.find((c) => c.path.endsWith("/pulls") && c.method === "POST").body.body.startsWith("Refs: #77\n"));
     },
   );
@@ -1184,7 +1193,7 @@ test("main on a rerun reuses the open PR from the branch", async () => {
       ]);
       assert.equal(await main({ env: env(dir), fetch }), 0);
       assert.ok(!calls.some((c) => c.method === "POST" && c.path.endsWith("/pulls")));
-      assert.ok(!calls.some((c) => c.path.endsWith("/issues/90/labels")));
+      assert.deepEqual(calls.filter((c) => c.path.endsWith("/issues/90/labels")).map((c) => c.body), [{ labels: ["human-merge-hold"] }]);
     },
   );
 });
@@ -2462,7 +2471,8 @@ test("a reused branch with another run's or no outcome opens a held PR with none
       assert.ok(pull.body.split("\n").includes("Hold: a human merges this"), pull.body);
       assert.ok(!pull.body.includes("MODEL-SUMMARY-TEXT") && !pull.body.includes("model title"), pull.body);
       assert.ok(pull.body.includes("https://example/o/r/actions/runs/400"), pull.body);
-      assert.ok(!calls.some((c) => c.path.endsWith("/comments") || c.path.endsWith("/labels")), Object.keys(files).join());
+      assert.ok(!calls.some((c) => c.path.endsWith("/comments") || c.path.endsWith("/issues/77/labels")), Object.keys(files).join());
+      assert.deepEqual(calls.filter((c) => c.path.endsWith("/issues/90/labels")).map((c) => c.body), [{ labels: ["human-merge-hold"] }]);
     });
   }
 });
@@ -2626,7 +2636,7 @@ test("a branch's own outcome wins over a summary, so the summary never stands in
 
 // main on a done run of an issue with these labels and `labeled` events, under
 // a resolved config that denies no path, so only the label can hold the PR.
-async function runHumanMerge({ labels, events = [], eventsStatus = 200, trusted = TRUSTED_LIST }) {
+async function runHumanMerge({ labels, events = [], eventsStatus = 200, trusted = TRUSTED_LIST, open = [], labelStatus = 200 }) {
   return withAsyncDir(
     {
       "work-outcome.json": JSON.stringify(done),
@@ -2642,14 +2652,21 @@ async function runHumanMerge({ labels, events = [], eventsStatus = 200, trusted
         branchTip(),
         ["GET", /\/repos\/o\/r$/, 200, { default_branch: "main" }],
         ["GET", /\/compare\//, 200, { files: [{ filename: "README.md" }] }],
-        ["GET", /\/pulls$/, 200, []],
+        ["GET", /\/pulls$/, 200, open],
         ["POST", /\/pulls$/, 201, { number: 90 }],
+        ["POST", /\/issues\/90\/labels$/, labelStatus, []],
+        ["PATCH", /\/pulls\/90$/, 200, {}],
+        ...HISTORY,
+        ["POST", /\/issues\/77\/labels$/, 200, []],
+        ["DELETE", /\/issues\/77\/labels\//, 200, []],
+        ["POST", /\/issues\/77\/comments$/, 201, {}],
       ]);
       const code = await main({
         env: { ...env(dir), RESOLVED_CONFIG: join(dir, "resolved.json"), TRUSTED_ACTORS: join(dir, "trusted.json") },
         fetch,
+        sleep: async () => {},
       });
-      return { code, calls, body: calls.find((c) => c.method === "POST" && c.path.endsWith("/pulls")).body.body };
+      return { code, calls, body: calls.find((c) => c.method === "POST" && c.path.endsWith("/pulls"))?.body.body };
     },
   );
 }
@@ -2674,6 +2691,50 @@ test("main without merge: human holds no PR and reads no label events", async ()
   assert.ok(!calls.some((c) => c.path.endsWith("/events")));
 });
 
+// #9437: the hold line is body text the lanes App can edit, so a held PR also
+// carries a label only a listed person's removal lifts (ci-status's
+// human-merge hold step).
+const holdLabelPosts = (calls) => calls.filter((c) => c.method === "POST" && c.path.endsWith("/issues/90/labels"));
+
+test("main labels a held PR human-merge-hold right after it opens", async () => {
+  assert.equal(HUMAN_MERGE_HOLD, "human-merge-hold");
+  const { code, calls } = await runHumanMerge({ labels: MERGE_HUMAN, events: [labeled("merge: human", "kyle-sexton", OWNER_ID)] });
+  assert.equal(code, 0);
+  assert.deepEqual(holdLabelPosts(calls).map((c) => c.body), [{ labels: ["human-merge-hold"] }]);
+  assert.ok(!calls.some((c) => c.method === "PATCH"));
+});
+
+test("main puts no human-merge-hold label on a PR that does not hold", async () => {
+  const { code, calls } = await runHumanMerge({ labels: ["agent-ready", "work-class: scoped"] });
+  assert.equal(code, 0);
+  assert.deepEqual(holdLabelPosts(calls), []);
+});
+
+test("main labels a held PR it reuses from an earlier attempt", async () => {
+  const { code, calls } = await runHumanMerge({
+    labels: MERGE_HUMAN,
+    events: [labeled("merge: human", "kyle-sexton", OWNER_ID)],
+    open: [{ number: 90, user: { login: BOT } }],
+  });
+  assert.equal(code, 0);
+  assert.ok(!calls.some((c) => c.method === "POST" && c.path.endsWith("/pulls")));
+  assert.deepEqual(holdLabelPosts(calls).map((c) => c.body), [{ labels: ["human-merge-hold"] }]);
+});
+
+test("main closes a held PR it cannot label and retries the issue", async () => {
+  const { code, calls } = await runHumanMerge({
+    labels: MERGE_HUMAN,
+    events: [labeled("merge: human", "kyle-sexton", OWNER_ID)],
+    labelStatus: 500,
+  });
+  assert.equal(code, 0);
+  assert.ok(holdLabelPosts(calls).length >= 2, "the label write is resent");
+  assert.deepEqual(calls.find((c) => c.method === "PATCH" && c.path.endsWith("/pulls/90"))?.body, { state: "closed" });
+  const comment = calls.find((c) => c.method === "POST" && c.path.endsWith("/issues/77/comments")).body.body;
+  assert.ok(comment.startsWith("<!-- work-resolve-issue outcome=retry"), comment);
+  assert.match(comment, /`hold-label-failed`/);
+});
+
 test("main ignores merge: human from a labeler who is not a listed human or the lanes App", async () => {
   const { body } = await runHumanMerge({ labels: MERGE_HUMAN, events: [labeled("merge: human", "stranger", 42)] });
   assert.ok(!holds(body), body);
diff --git a/.github/scripts/work-resolve-issue/stop-routes.json b/.github/scripts/work-resolve-issue/stop-routes.json
index aa4ffd5411c..9acb50c4b94 100644
--- a/.github/scripts/work-resolve-issue/stop-routes.json
+++ b/.github/scripts/work-resolve-issue/stop-routes.json
@@ -16,6 +16,7 @@
   "resumed-unchecked": { "route": "retry", "why": "the runner's checks did not pass over the resumed branch, so the next run continues it" },
   "check-failed": { "route": "retry", "why": "a check the runner ran on the branch failed or could not be read, so the next run continues the branch" },
   "required-undone": { "route": "retry", "why": "the run left a required check undone, so the next run continues the branch" },
+  "hold-label-failed": { "route": "retry", "why": "the held PR could not be labeled human-merge-hold, a failed write, not a finding about the issue" },
   "pr-head-moved": { "route": "retry", "why": "the PR opened at a head other than the tip the runner checked, a race, not a finding about the issue" },
   "closed-by-open-pr": { "route": "retry", "why": "an open PR the lanes App or a listed human opened already closes the issue, a race with the earlier-work check, not a finding about the issue; while it stays open the next run stops before any model turn" },
   "turn-cap-spent": { "route": "fail", "why": "the run reached its turn cap with no restart left" },
diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index 06fc682b6f7..a7a7b4b4b1b 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -4692,6 +4692,87 @@ jobs:
             exit 1
           fi
           echo "$actor_login, a person on the trusted-actor list, lifted the review-lane hold on #$PR_NUMBER."
+      # A HUMAN-MERGE HOLD LIFTS ONLY BY A LISTED PERSON. report-outcome puts
+      # `human-merge-hold` on a lanes App pull request a person merges (#9437):
+      # its body's `Hold: a human merges this` line is text the App can edit.
+      # While the label is on this fails. Once it is off, it fails unless the
+      # first removal at or after the newest time any account added it was by
+      # a `human` of the base commit's trusted-actor list, matched by numeric
+      # id, acting directly and not through an App. It reads no other step's
+      # outcome, so neither the human-gated label nor a recorded cost decision
+      # lifts it. Labels and events are read live; an unreadable label list,
+      # event list or trusted-actor list fails closed. Pinned by
+      # scripts/ci-hold-human-merge.test.sh, which runs this body.
+      - name: Fail a human-merge hold a listed person has not lifted
+        if: ${{ !cancelled() && github.event_name == 'pull_request' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          BASE_CONFIG: ${{ steps.base_config.outcome == 'success' && format('{0}/base-config', github.workspace) || '' }}
+        run: |
+          . "$RUNNER_TEMP/gh-read.sh"
+          label=human-merge-hold
+          for attempt in 1 2 3; do
+            if raw=$(pr_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/labels?per_page=100" --paginate) && labels=$(jq -r '.[].name' <<<"$raw"); then
+              break
+            fi
+            [ "$attempt" -lt 3 ] || { echo "::error::could not read the labels of #$PR_NUMBER; re-run this run."; exit 1; }
+            sleep $((attempt * 5))
+          done
+          if grep -qixF -- "$label" <<<"$labels"; then
+            echo "::error::#$PR_NUMBER carries '$label': a person merges it. A person on the trusted-actor list removing the label approves it."
+            exit 1
+          fi
+          for attempt in 1 2 3; do
+            if events=$(pr_read "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/events?per_page=100" --paginate); then
+              break
+            fi
+            [ "$attempt" -lt 3 ] || { echo "::error::could not read the events of #$PR_NUMBER; re-run this run."; exit 1; }
+            sleep $((attempt * 5))
+          done
+          held_at=$(jq -rs --arg label "$label" '[add[] | select(.event == "labeled" and (.label.name | ascii_downcase) == $label)
+            | .created_at] | max // empty' <<<"$events") || {
+            echo "::error::cannot read the events of #$PR_NUMBER."
+            exit 1
+          }
+          if [ -z "$held_at" ]; then
+            echo "No human-merge hold on #$PR_NUMBER."
+            exit 0
+          fi
+          if [[ ! $BASE_SHA =~ ^[0-9a-f]{40}$ ]]; then
+            echo "::error::the base commit '$BASE_SHA' is not a commit SHA."
+            exit 1
+          fi
+          if [ ! -d "$BASE_CONFIG" ] || ! actors=$(cat "$BASE_CONFIG/.github/standards/trusted-actors/trusted-actors.json"); then
+            echo "::error::could not read the trusted-actor list at $BASE_SHA; re-run this run."
+            exit 1
+          fi
+          humans=$(jq -er '[.actors[] | select(.kind == "human") | .id | numbers | tostring] | select(length > 0) | join(" ")' <<<"$actors") || {
+            echo "::error::the trusted-actor list at $BASE_SHA names no person."
+            exit 1
+          }
+          lifted=$(jq -rs --arg label "$label" --arg held_at "$held_at" '[add[] | select(.event == "unlabeled"
+              and (.label.name | ascii_downcase) == $label and .created_at >= $held_at)]
+            | min_by(.created_at) // empty | [.created_at, (.actor.id // 0 | tostring), (.actor.login // "an unknown account"),
+              (.performed_via_github_app | if . == null then "" else .slug // .name // "an unnamed App" end)] | @tsv' <<<"$events") || {
+            echo "::error::cannot read the events of #$PR_NUMBER."
+            exit 1
+          }
+          IFS=$'\t' read -r lifted_at actor_id actor_login via_app <<<"$lifted"
+          if [ -z "$lifted_at" ]; then
+            echo "::error::'$label' was added to #$PR_NUMBER at $held_at, and no removal since then is recorded. Add the label back; a person on the trusted-actor list removing it approves this pull request."
+            exit 1
+          fi
+          if [[ " $humans " != *" $actor_id "* ]]; then
+            echo "::error::$actor_login removed '$label' from #$PR_NUMBER and is not a person on the trusted-actor list. Add the label back; a person on that list removing it approves this pull request."
+            exit 1
+          fi
+          if [ -n "$via_app" ]; then
+            echo "::error::$actor_login removed '$label' from #$PR_NUMBER through the App $via_app, which is not a person's own approval. Add the label back; a person on the trusted-actor list removing it directly approves this pull request."
+            exit 1
+          fi
+          echo "$actor_login, a person on the trusted-actor list, lifted the human-merge hold on #$PR_NUMBER."
       # BOTH REVIEW LANES REVIEW THE HEAD. Neither review check is required by a
       # ruleset (github-iac ADR 0017); this step makes ci-status need them. For
       # each lane it takes the newest pull_request run of the lane's caller
diff --git a/docs/conventions/pr-pipeline/README.md b/docs/conventions/pr-pipeline/README.md
index 841ed0d0b52..fa84e7ee43c 100644
--- a/docs/conventions/pr-pipeline/README.md
+++ b/docs/conventions/pr-pipeline/README.md
@@ -2406,6 +2406,12 @@ them on every `pull_request` run, contract-only runs included:
   trusted-actor list; a later removal is of a later label, such as an escalation
   `clear-escalations` lifts. A bot's or anyone else's lift, or none recorded, fails. To recover, a
   trusted person adds the label back, which starts a new hold, and a trusted person removes it.
+- **Only a trusted person lifts a human-merge hold.** report-outcome labels a lanes App PR that
+  carries `Hold: a human merges this` with `human-merge-hold`, since the App can edit that body
+  line. ci-status fails while the label is on, and once it is off unless the first removal at or
+  after its newest add, by anyone, was a `human` of the base's trusted-actor list acting directly,
+  not through an App. No other hold step skips it. `enable-auto-merge.mjs`, the merge queue's
+  label step and the babysit merge lane hold the label too.
 - **Both lanes review the head.** On a ready PR, the newest `pull_request` run of each caller on the
   head must have a successful status job (`pr-review / claude-review-status`,
   `pr-review-security / security-review`) whose `Apply the hold` step ran. A summary-mode run or
diff --git a/docs/conventions/pr-pipeline/pr-run-activity.md b/docs/conventions/pr-pipeline/pr-run-activity.md
index a328fc0c6bc..7c25d2c33af 100644
--- a/docs/conventions/pr-pipeline/pr-run-activity.md
+++ b/docs/conventions/pr-pipeline/pr-run-activity.md
@@ -2142,12 +2142,15 @@ step under the escalation marker and an `outcome=<reason>` marker. What changes
   body starts `Closes #<n>` (or `Refs: #<n>`, with a `## Remaining work` section listing them,
   when the outcome's `remaining` names parts of the issue the PR leaves for later work; a
   `remaining` that is not 1 to 20 strings with text counts as none, and the run's `link` field
-  decides nothing), puts no label on it (the work class stays on the issue), and adds
+  decides nothing), and adds
   `Hold: a human merges this` for untrusted-provenance work, for a diff that
   touches a path the merge lane refuses (`merge.diff-check.denied-paths`, read from the run's
   resolved config; unreadable holds every PR), or, while some path is denied, for one too large
   for the compare listing to show whole. It adds the same line when the issue carries `merge: human` whose newest `labeled`
   event is a listed human's or the lanes App's, or cannot be read, and never for anyone else's.
+  A PR with that line also gets the `human-merge-hold` label right after it opens, or when the run
+  reuses its open PR; the work class stays on the issue. A PR the label cannot reach is closed
+  and the issue retried (`hold-label-failed`).
   The run's own summary is quoted with issue references broken, so squash-merging the PR closes only `#<n>`. Every stop takes the route its reason has in
   `.github/scripts/work-resolve-issue/stop-routes.json`, one row per reason with a `why`; a
   `stopped` run opens its `reason` with one of the rows marked `code` (`host-only`,
diff --git a/plugins/source-control/skills/babysit-prs/scripts/babysit_merge_policy.py b/plugins/source-control/skills/babysit-prs/scripts/babysit_merge_policy.py
index e18eb679237..deae579043b 100755
--- a/plugins/source-control/skills/babysit-prs/scripts/babysit_merge_policy.py
+++ b/plugins/source-control/skills/babysit-prs/scripts/babysit_merge_policy.py
@@ -116,7 +116,8 @@
 # autopilot merge tier is engaged. `--block-labels` only adds to it.
 # `pr-verify-failed` is pr-verify's FAIL on a person's pull request, which
 # ci-status enforces only in the merge queue: held here, it is never queued.
-MERGE_HOLD_LABELS = ("do-not-merge", "pr-verify-failed")
+# `human-merge-hold` is the lanes App's label on a pull request a person merges.
+MERGE_HOLD_LABELS = ("do-not-merge", "pr-verify-failed", "human-merge-hold")
 # An `adoption.idle-hours` value outside 1 to `MAX_ADOPTION_IDLE_HOURS`, or
 # none, adopts nothing.
 MAX_ADOPTION_IDLE_HOURS = 720
diff --git a/scripts/ci-hold-human-merge.test.sh b/scripts/ci-hold-human-merge.test.sh
new file mode 100755
index 00000000000..a7a3579f7ae
--- /dev/null
+++ b/scripts/ci-hold-human-merge.test.sh
@@ -0,0 +1,165 @@
+#!/usr/bin/env bash
+# Runs the `Fail a human-merge hold a listed person has not lifted` step body of
+# .github/workflows/pr-require-checks.yml's ci-status under the shell Actions
+# gives a step with no `shell:` (bash -e), against stub `gh` and `sleep`.
+#
+# report-outcome labels a lanes App pull request that a person merges
+# `human-merge-hold` (#9437). ci-status fails while the label is on, and once
+# it is off passes only when the first removal at or after the newest add was
+# a `human` of the base commit's trusted-actor list acting directly. It fails
+# closed when it cannot tell.
+# test-scope: .github/workflows/pr-require-checks.yml
+set -uo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORKFLOW="$ROOT/.github/workflows/pr-require-checks.yml"
+
+# shellcheck source=lib/test-harness.sh
+. "$ROOT/scripts/lib/test-harness.sh"
+
+TMP_ROOT="$(mktemp -d)"
+trap 'rm -rf "$TMP_ROOT"' EXIT
+
+# shellcheck source=lib/ci-gh-read.sh
+. "$ROOT/scripts/lib/ci-gh-read.sh"
+export RUNNER_TEMP="$TMP_ROOT"
+ci_gh_read::install "$WORKFLOW" "$TMP_ROOT" budget || fail "the ci-status gh_read helper step is missing or fails"
+
+NAME='Fail a human-merge hold a listed person has not lifted'
+step="$(awk -v name="      - name: $NAME" '$0 == name { on = 1; print; next }
+  on && /^      - / { exit }
+  on { print }' "$WORKFLOW")"
+awk '/^        run: \|$/ { on = 1; next }
+  on && /^          / { print substr($0, 11); next }
+  on && /^[[:blank:]]*$/ { print ""; next }
+  on { exit }' <<<"$step" >"$TMP_ROOT/body.sh"
+
+if [[ ! -s "$TMP_ROOT/body.sh" ]]; then
+  fail "no '$NAME' step with a run: | body in $WORKFLOW"
+  test_harness::report
+  exit 1
+fi
+if [[ "$step" == *"if: \${{ !cancelled() && github.event_name == 'pull_request' }}"* ]]; then
+  ok "step runs on every pull_request run, whatever the human-gated or cost steps found"
+else
+  fail "step's condition is not the pull_request event alone"
+fi
+if [[ "$step" == *"continue-on-error"* ]]; then
+  fail "step must not continue on error: its exit code is the hold"
+else
+  ok "step fails the job on its exit code"
+fi
+order="$(grep -nE "^  ci-status:$|^      - name: ($NAME|Aggregate lane results)$" "$WORKFLOW" | cut -d: -f1 | paste -sd' ')"
+read -r job_line step_line agg_line <<<"$order"
+if [[ -n "${agg_line:-}" && "$job_line" -lt "$step_line" && "$step_line" -lt "$agg_line" ]]; then
+  ok "step sits in ci-status before the aggregate"
+else
+  fail "step is not inside ci-status before the aggregate (lines: $order)"
+fi
+
+# The stub logs its arguments. A labels read fails when STUB_LABELS_FAIL is
+# set, else prints STUB_LABELS; an events read likewise with STUB_EVENTS
+# (pages concatenated, as --paginate prints them).
+mkdir -p "$TMP_ROOT/bin"
+cat >"$TMP_ROOT/bin/gh" <<'EOF'
+#!/usr/bin/env bash
+printf '%s\n' "$*" >>"$STUB_LOG"
+case "$*" in
+*/labels*)
+  [[ -z "${STUB_LABELS_FAIL:-}" ]] || exit 1
+  printf '%s\n' "${STUB_LABELS:-[]}"
+  ;;
+*/events*)
+  [[ -z "${STUB_EVENTS_FAIL:-}" ]] || exit 1
+  printf '%s\n' "${STUB_EVENTS:-[]}"
+  ;;
+*) exit 1 ;;
+esac
+EOF
+printf '#!/usr/bin/env bash\n' >"$TMP_ROOT/bin/sleep"
+chmod +x "$TMP_ROOT/bin/gh" "$TMP_ROOT/bin/sleep"
+
+BASE=89abcdef0123456789abcdef0123456789abcdef
+ACTORS='{"version":1,"actors":[{"id":153232337,"login":"kyle-sexton","kind":"human"},{"id":337595936,"login":"melodic-automation-lanes[bot]","kind":"bot"}]}'
+# labeled <label> <at> [login] [id]; unlabeled <label> <at> <id> <login>
+labeled() { jq -cn --arg l "$1" --arg at "$2" --arg login "${3:-melodic-automation-lanes[bot]}" --argjson id "${4:-337595936}" \
+  '{event: "labeled", created_at: $at, label: {name: $l}, actor: {id: $id, login: $login}}'; }
+unlabeled() { jq -cn --arg l "$1" --arg at "$2" --argjson id "$3" --arg login "$4" \
+  '{event: "unlabeled", created_at: $at, label: {name: $l}, actor: {id: $id, login: $login}}'; }
+OPENED="$(labeled human-merge-hold 2026-10-23T10:00:00Z)"
+OWNER_LIFT="$(unlabeled human-merge-hold 2026-10-23T11:00:00Z 153232337 kyle-sexton)"
+BOT_LIFT="$(unlabeled human-merge-hold 2026-10-23T10:30:00Z 337595936 'melodic-automation-lanes[bot]')"
+STRANGER_LIFT="$(unlabeled human-merge-hold 2026-10-23T10:30:00Z 4242 octocat)"
+
+# expect <label> <want-rc> [want-out]; stubs come from the environment.
+expect() {
+  local label="$1" want_rc="$2" out rc config="$TMP_ROOT/base-config"
+  : >"$TMP_ROOT/log"
+  rm -rf "$config" "$TMP_ROOT/pr-reads"
+  mkdir -p "$config/.github/standards/trusted-actors"
+  printf '%s\n' "${STUB_ACTORS-$ACTORS}" >"$config/.github/standards/trusted-actors/trusted-actors.json"
+  [[ -z "${STUB_CHECKOUT_FAILED:-}" ]] || config=
+  out="$(PATH="$TMP_ROOT/bin:$PATH" STUB_LOG="$TMP_ROOT/log" PR_NUMBER=6419 \
+    GITHUB_REPOSITORY=o/r BASE_SHA="${BASE_SHA-$BASE}" \
+    BASE_CONFIG="$config" bash -e "$TMP_ROOT/body.sh" 2>&1)" && rc=0 || rc=$?
+  if [[ "$rc" -ne "$want_rc" ]]; then
+    fail "$label: expected rc=$want_rc got rc=$rc out='$out'"
+  elif [[ -n "${3:-}" && "$out" != *"$3"* ]]; then
+    fail "$label: output lacks '$3': '$out'"
+  else
+    ok "$label"
+  fi
+}
+
+export STUB_LABELS STUB_EVENTS
+STUB_LABELS='[{"name":"bug"}]'
+STUB_EVENTS="[$(labeled needs-human 2026-10-23T09:00:00Z 'github-actions[bot]' 41898282)]"
+expect "a pull request never labeled human-merge-hold passes" 0 "No human-merge hold on #6419."
+STUB_CHECKOUT_FAILED=1 expect "with no hold the actor list is not needed, so a failed base checkout passes" 0 "No human-merge hold on #6419."
+
+# The two body edits #9437 names leave the label on, so the step still fails.
+STUB_LABELS='[{"name":"human-merge-hold"}]'
+STUB_EVENTS="[$OPENED]"
+expect "a pull request carrying the label fails, whatever its body says" 1 \
+  "::error::#6419 carries 'human-merge-hold': a person merges it."
+STUB_LABELS='[{"name":"Human-Merge-Hold"}]'
+expect "the label holds in any case" 1 "carries 'human-merge-hold'"
+
+STUB_LABELS='[]'
+STUB_EVENTS="[$OPENED,$OWNER_LIFT]"
+expect "a trusted person's removal lifts it" 0 "kyle-sexton, a person on the trusted-actor list, lifted the human-merge hold"
+STUB_EVENTS="[$OPENED][$OWNER_LIFT]"
+expect "the events are read across pages" 0 "lifted the human-merge hold"
+STUB_EVENTS="[$OPENED,$STRANGER_LIFT,$OWNER_LIFT]"
+expect "an account off the list removing it fails, whatever a trusted person did after" 1 \
+  "::error::octocat removed 'human-merge-hold' from #6419 and is not a person on the trusted-actor list."
+STUB_EVENTS="[$OPENED,$BOT_LIFT]"
+expect "the lanes App removing its own label fails" 1 "melodic-automation-lanes[bot] removed 'human-merge-hold'"
+STUB_EVENTS="[$OPENED,$(jq -c '.performed_via_github_app = {slug: "some-app"}' <<<"$OWNER_LIFT")]"
+expect "a removal an App made for a trusted person fails, naming the App" 1 \
+  "::error::kyle-sexton removed 'human-merge-hold' from #6419 through the App some-app"
+STUB_EVENTS="[$OWNER_LIFT,$OPENED]"
+expect "the first removal after the add decides, not the list order" 0 "lifted the human-merge hold"
+STUB_EVENTS="[$OPENED]"
+expect "a label off with no removal recorded fails closed" 1 \
+  "::error::'human-merge-hold' was added to #6419 at 2026-10-23T10:00:00Z, and no removal since then is recorded."
+STUB_EVENTS="[$OPENED,$(unlabeled other-label 2026-10-23T11:00:00Z 153232337 kyle-sexton)]"
+expect "removing another label does not lift it" 1 "no removal since then is recorded"
+STUB_EVENTS="[$OPENED,$OWNER_LIFT,$(labeled human-merge-hold 2026-10-23T12:00:00Z octocat 4242),$(unlabeled human-merge-hold 2026-10-23T12:05:00Z 4242 octocat)]"
+expect "any account adding the label back starts a new hold that only a listed person lifts" 1 "octocat removed 'human-merge-hold'"
+STUB_EVENTS="[$OPENED,$STRANGER_LIFT,$(labeled human-merge-hold 2026-10-23T12:00:00Z kyle-sexton 153232337),$(unlabeled human-merge-hold 2026-10-23T12:05:00Z 153232337 kyle-sexton)]"
+expect "a listed person adding it back and removing it recovers an untrusted lift" 0 "lifted the human-merge hold"
+
+STUB_EVENTS="[$OPENED,$OWNER_LIFT]"
+export STUB_ACTORS='{"actors":[{"id":1,"login":"someone","kind":"human"}]}'
+expect "a person missing from the base list is not trusted" 1 "kyle-sexton removed 'human-merge-hold'"
+export STUB_ACTORS='{not json'
+expect "an unreadable trusted-actor list fails closed" 1 "names no person"
+unset STUB_ACTORS
+STUB_CHECKOUT_FAILED=1 expect "a hold with a failed base checkout fails closed" 1 \
+  "::error::could not read the trusted-actor list at $BASE; re-run this run."
+BASE_SHA=main expect "a base that is not a commit SHA fails closed" 1 "::error::the base commit 'main' is not a commit SHA"
+STUB_LABELS_FAIL=1 expect "an unreadable label list fails closed" 1 "::error::could not read the labels of #6419; re-run this run."
+STUB_EVENTS_FAIL=1 expect "an unreadable event list fails closed" 1 "::error::could not read the events of #6419; re-run this run."
+
+test_harness::report

From 9cf8f26cf9aefcba7e4c63a3c7d9830558eafc6a Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Thu, 29 Oct 2026 15:38:29 -0400
Subject: [PATCH 2/2] test(pr-pipeline): drop tracker references from the
 human-merge hold comments

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/scripts/pr-merge/enable-auto-merge.test.mjs       | 8 ++++----
 .../scripts/work-resolve-issue/report-outcome.test.mjs    | 2 +-
 .github/workflows/pr-require-checks.yml                   | 2 +-
 scripts/ci-hold-human-merge.test.sh                       | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/.github/scripts/pr-merge/enable-auto-merge.test.mjs b/.github/scripts/pr-merge/enable-auto-merge.test.mjs
index 2788c4e9831..9fea5b701c4 100644
--- a/.github/scripts/pr-merge/enable-auto-merge.test.mjs
+++ b/.github/scripts/pr-merge/enable-auto-merge.test.mjs
@@ -1717,16 +1717,16 @@ test("the lane's own hold line holds a lanes App body", async () => {
   assert.deepEqual(writes, [{ mutation: "arm", id: "PR_3", head: HEAD }]);
 });
 
-// #9437: report-outcome labels a held PR human-merge-hold, so a lanes App
-// edit of the body (the hold line deleted, or `Refs: #N` rewritten to
-// `Closes #N`) leaves it unarmed while the label is on.
+// report-outcome labels a held PR human-merge-hold, so a lanes App edit of
+// the body (the hold line deleted, or the Refs line rewritten to a closing
+// line) leaves it unarmed while the label is on.
 test("a human-merge-hold label holds a lanes App PR whose body lost its hold line or its Refs line", async () => {
   const appOnly = { totalCount: 0, nodes: [] };
   const held = labels("human-merge-hold");
   const { writes } = await run([
     // The hold line deleted from a Refs PR's body.
     pull(1, { body: "Refs: #5\n\n## Summary", labels: held, userContentEdits: appOnly }),
-    // `Refs: #5` rewritten to `Closes #5`, the hold line gone with it.
+    // The Refs line rewritten to a closing line, the hold line gone with it.
     pull(2, { body: "Closes #5\n\n## Summary", labels: held, userContentEdits: appOnly }),
     pull(3, { body: "Closes #5\n\n## Summary", userContentEdits: appOnly }),
   ]);
diff --git a/.github/scripts/work-resolve-issue/report-outcome.test.mjs b/.github/scripts/work-resolve-issue/report-outcome.test.mjs
index 5d48fd88a7e..5425b11314d 100644
--- a/.github/scripts/work-resolve-issue/report-outcome.test.mjs
+++ b/.github/scripts/work-resolve-issue/report-outcome.test.mjs
@@ -2691,7 +2691,7 @@ test("main without merge: human holds no PR and reads no label events", async ()
   assert.ok(!calls.some((c) => c.path.endsWith("/events")));
 });
 
-// #9437: the hold line is body text the lanes App can edit, so a held PR also
+// The hold line is body text the lanes App can edit, so a held PR also
 // carries a label only a listed person's removal lifts (ci-status's
 // human-merge hold step).
 const holdLabelPosts = (calls) => calls.filter((c) => c.method === "POST" && c.path.endsWith("/issues/90/labels"));
diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index a7a7b4b4b1b..69ce0220fee 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -4693,7 +4693,7 @@ jobs:
           fi
           echo "$actor_login, a person on the trusted-actor list, lifted the review-lane hold on #$PR_NUMBER."
       # A HUMAN-MERGE HOLD LIFTS ONLY BY A LISTED PERSON. report-outcome puts
-      # `human-merge-hold` on a lanes App pull request a person merges (#9437):
+      # `human-merge-hold` on a lanes App pull request a person merges:
       # its body's `Hold: a human merges this` line is text the App can edit.
       # While the label is on this fails. Once it is off, it fails unless the
       # first removal at or after the newest time any account added it was by
diff --git a/scripts/ci-hold-human-merge.test.sh b/scripts/ci-hold-human-merge.test.sh
index a7a3579f7ae..b6b395430b3 100755
--- a/scripts/ci-hold-human-merge.test.sh
+++ b/scripts/ci-hold-human-merge.test.sh
@@ -4,7 +4,7 @@
 # gives a step with no `shell:` (bash -e), against stub `gh` and `sleep`.
 #
 # report-outcome labels a lanes App pull request that a person merges
-# `human-merge-hold` (#9437). ci-status fails while the label is on, and once
+# `human-merge-hold`. ci-status fails while the label is on, and once
 # it is off passes only when the first removal at or after the newest add was
 # a `human` of the base commit's trusted-actor list acting directly. It fails
 # closed when it cannot tell.
@@ -117,7 +117,7 @@ STUB_EVENTS="[$(labeled needs-human 2026-10-23T09:00:00Z 'github-actions[bot]' 4
 expect "a pull request never labeled human-merge-hold passes" 0 "No human-merge hold on #6419."
 STUB_CHECKOUT_FAILED=1 expect "with no hold the actor list is not needed, so a failed base checkout passes" 0 "No human-merge hold on #6419."
 
-# The two body edits #9437 names leave the label on, so the step still fails.
+# Deleting the hold line or rewriting the Refs line leaves the label on, so the step still fails.
 STUB_LABELS='[{"name":"human-merge-hold"}]'
 STUB_EVENTS="[$OPENED]"
 expect "a pull request carrying the label fails, whatever its body says" 1 \