fix(iterate-pr): gate the in-progress check on the author, and bound its wait

Three findings from review, all real.

**A human is not a review bot, and this was the dangerous direction.** The
in-progress check ran on every comment regardless of author, so a person
writing "Review in progress on my end, back by EOD" was filed as an unfinished
review, vanished from `needs_attention`, and hung the wait loop permanently: a
person's comment never gets edited into a finished form the way the bot's
placeholder does, so the count never drops. Gated on `isReviewBot(author)`,
with tests covering the same body from both a human and the bot.

**Two regex edges could each reintroduce the bug.** Leading emphasis was capped
at two characters, so `***Review in progress***` did not match, which is one
format drift from the bold case already anticipated. And the trailing
`(?![A-Za-z0-9])` admitted a bare underscore, so `Review in progress_notes: …`
matched as unfinished. Emphasis is now unbounded, and the trailing side
consumes closing emphasis before refusing a word character including `_`, which
accepts `__…__` and rejects `progress_notes`.

**The wait loop had no escape hatch.** A cancelled run or a crashed job leaves
the placeholder in place with nobody to edit it, and the documented procedure
said only "repeat until it drops to 0". It is now bounded at roughly ten
minutes, and reaching the bound is an "Ask for help" report naming the PR and
the bot, rather than more polling. Waiting forever is the same failure as
exiting early, reached from the other side.

Author: theCodeDrift

.agents/skills/iterate-pr/SKILL.md

@@ -392,7 +392,9 @@ If step 7 required code changes (from new feedback after CI passed), return to s
 
 ## Exit Conditions
 
-Before exiting, check `summary.review_in_progress`. If it is > 0, do not exit — a review bot's placeholder is not a finished review, and `needs_attention: 0` alongside it means "hasn't started," not "clean." Sleep 30 seconds and re-check feedback; repeat until it drops to 0, addressing any new high/medium feedback that lands as it finishes (return to step 3).
+Before exiting, check `summary.review_in_progress`. If it is > 0, do not exit — a review bot's placeholder is not a finished review, and `needs_attention: 0` alongside it means "hasn't started," not "clean." Sleep 30 seconds and re-check feedback, addressing any new high/medium feedback that lands as it finishes (return to step 3).
+
+**This loop has a bound, and reaching it is a report rather than a retry.** Give up after roughly ten minutes of a count that never drops, and tell the user the review appears stuck, naming the PR and the bot. A placeholder can be left behind permanently: the run can be cancelled, or its job can crash, and the comment then sits in its posted state with nobody to edit it. Waiting forever on that is the same failure as exiting early, arrived at from the other side, and it is an infrastructure problem under **Ask for help** rather than something more polling will fix. Re-triggering the review is usually the fix, but that is the user's call, not yours.
 
 Then check `summary.pending_reviewers`. If it is > 0, reviewers have been requested but haven't submitted yet — their review may produce new feedback. Ask the user whether to wait:
 

.agents/skills/iterate-pr/scripts/fetch_pr_feedback.cjs

@@ -160,12 +160,20 @@ const isInfoBot = (username) =>
  * cannot stall a caller. The cost is that a NEW placeholder wording is missed,
  * so when this bot changes its output, add the new opening here.
  *
- * `(?![A-Za-z0-9])` rather than `\b`: underscore is a word character, so a
- * `\b` would not fire before the closing `__` of underscore emphasis.
+ * Emphasis is unbounded (`[*_]*`) rather than capped at two, so bold-italic
+ * (`***…***`) matches; a cap of two failed it, since two of the three leading
+ * `*` were consumed and the phrase could not then start.
+ *
+ * The trailing side consumes closing emphasis and THEN refuses a word
+ * character, underscore included. `\b` alone would not fire before a closing
+ * `__`, but a bare `(?![A-Za-z0-9])` went too far the other way and matched
+ * `Review in progress_notes: …`, a finished comment. Consuming `[*_]*` first
+ * and excluding `_` from the lookahead accepts `__…__` and rejects
+ * `progress_notes`.
  */
 const IN_PROGRESS_MARKERS = [
-  /^#{0,6}\s*[*_]{0,2}\s*review in progress(?![A-Za-z0-9])/i,
-  /^#{0,6}\s*[*_]{0,2}\s*claude code is working(?![A-Za-z0-9])/i,
+  /^#{0,6}\s*[*_]*\s*review in progress[*_]*(?![A-Za-z0-9_])/i,
+  /^#{0,6}\s*[*_]*\s*claude code is working[*_]*(?![A-Za-z0-9_])/i,
 ];
 
 /** Whether a body still opens with one of the in-progress placeholders. */
@@ -257,7 +265,13 @@ const categorizeComment = (comment, body) => {
  * three sources.
  */
 const bucketByAuthor = (feedback, item, comment, body, author) => {
-  if (isReviewInProgress(body)) {
+  // The author gate is load-bearing, not belt and braces. A human writing
+  // "Review in progress on my end, back by EOD" would otherwise be filed as an
+  // unfinished review, vanish from `needs_attention`, and hang the wait loop
+  // forever: a person's comment never gets edited into a finished form the way
+  // the bot's placeholder does, so the count never drops. Only a review bot has
+  // the lifecycle this bucket describes.
+  if (isReviewBot(author) && isReviewInProgress(body)) {
     feedback.review_in_progress.push(item);
   } else if (isReviewBot(author)) {
     item.review_bot = true;

.agents/skills/iterate-pr/scripts/fetch_pr_feedback.test.cjs

@@ -784,3 +784,58 @@ test("an in-progress placeholder keeps every other bucket empty", () => {
   );
   assert.match(output.action_required, /still in progress/);
 });
+
+// A HUMAN IS NOT A REVIEW BOT, AND THIS IS THE DANGEROUS DIRECTION. A person
+// writing "Review in progress on my end" would otherwise be filed as an
+// unfinished review, vanish from needs_attention, and hang the wait loop
+// forever: a person's comment never gets edited into a finished form the way
+// the bot's placeholder does, so the count never drops to zero.
+test("a human comment opening with the phrase is feedback, not an unfinished review", () => {
+  const output = build(
+    fakeClient({
+      comments: [
+        {
+          id: 1,
+          // The LOGAF marker is deliberately absent: it only counts at the
+          // start, and the start is occupied by the phrase under test. So this
+          // lands in medium by content, which is the correct default.
+          body: "Review in progress on my end, will finish by EOD.",
+          user: { login: "a-human-reviewer" },
+        },
+      ],
+    }),
+    {}
+  );
+  assert.equal(output.summary.review_in_progress, 0);
+  assert.equal(output.summary.medium, 1, "it stays actionable feedback");
+  assert.equal(output.summary.needs_attention, 1);
+});
+
+test("the same body from the review bot IS an unfinished review", () => {
+  const output = build(
+    fakeClient({
+      comments: [
+        {
+          id: 1,
+          body: "Review in progress on my end, will finish by EOD.",
+          user: { login: "claude[bot]" },
+        },
+      ],
+    }),
+    {}
+  );
+  assert.equal(output.summary.review_in_progress, 1);
+  assert.equal(output.summary.needs_attention, 0);
+});
+
+// Two regex edges, both able to reintroduce the bug. Bold-italic is one format
+// drift away from the bold case already anticipated; `progress_notes` is a
+// finished comment that a too-permissive boundary would freeze the loop on.
+test("bold-italic emphasis is matched, and a bare underscore is not emphasis", () => {
+  assert.equal(isReviewInProgress("***Review in progress***"), true);
+  assert.equal(isReviewInProgress("___Claude Code is working___"), true);
+  assert.equal(
+    isReviewInProgress("Review in progress_notes: nothing else found"),
+    false
+  );
+});