Round 3's blocker, and the second time the head clause re-opened the
contradiction this PR exists to close. Two entrances this round, both
after a "Re-run failed jobs": attempt 2 dies before the review step
writes its head, so the guard falls back to a head attempt 1 never
reviewed; or a push lands and attempt 2 records the NEW head — in both,
attempt 1's own review no longer matches `.commit_id`, and the fallback
posts "failed before a review could be posted … retry" beneath the
review the same run had posted.
Rather than patch the head lookup a third time, the head clause is
gone. What the guard proves is now narrower and stable: a bot review of
this PR was submitted while this run was alive — bot account plus the
attempt-stable `createdAt` window. That closes both entrances at once
and takes the round-2 cross-job wiring with it (review-pr's
`expected_head_sha` output and the env line that read it), so there is
no untested chain left whose silent breakage would restore the
fresh-head comparison. The job-level step no longer needs the PR head
either and reverts to its state-only query; the test stub's
state-only branch, removed in round 1 as dead, has a caller again.
The comment blocks now state the guarantee the concurrency model
actually supports. They claimed a review inside the window "cannot
belong to an earlier run", but per-run concurrency groups deliberately
allow overlapping runs on the same head, so an earlier-created run's
review can match and this run's failure then goes unannounced. That is
accepted, and said plainly: the silence coincides with a bot review a
reader can see — the very state that makes the comment's claim false —
while the bot-author and creation-time clauses still rule out silence
with no review at all.
Tests: the moved-head case flips from "posts" to "silences" and is
pinned per site (a review on ANY head inside the window silences);
re-introducing a head clause fails exactly that test; and a structural
pin asserts the wiring is absent rather than merely unused.