@@ -345,6 +345,24 @@ def test_mark_pr_opened_flags_the_pr_for_review(self, mock_run):
         calls = [call.args[0] for call in mock_run.call_args_list]
         self.assertIn(["gh", "pr", "edit", "4742", "--repo", "springfall2008/batpred", "--add-label", "BOT_REVIEW"], calls)
 
+    @patch("triage_daemon.subprocess.run")
+    def test_mark_pr_opened_with_cleanup_flags_review_and_cleanup_together(self, mock_run):
+        """A PR this run just opened gets BOT_REVIEW and BOT_CLEANUP in one edit, so the
+        review's findings are acted on without anyone relabelling it by hand."""
+        mock_run.return_value = MagicMock(stdout=json.dumps([{"number": 4742}]))
+        triage_daemon.mark_pr_opened(4720, cleanup=True)
+        calls = [call.args[0] for call in mock_run.call_args_list]
+        self.assertIn(["gh", "pr", "edit", "4742", "--repo", "springfall2008/batpred", "--add-label", "BOT_REVIEW", "--add-label", "BOT_CLEANUP"], calls)
+
+    @patch("triage_daemon.subprocess.run")
+    def test_mark_pr_opened_without_cleanup_never_adds_bot_cleanup(self, mock_run):
+        """The default path is also taken for a PR found already open on entry, which may be
+        a person's own branch - that must never gain a label that pushes commits to it."""
+        mock_run.return_value = MagicMock(stdout=json.dumps([{"number": 4742}]))
+        triage_daemon.mark_pr_opened(4720)
+        calls = [call.args[0] for call in mock_run.call_args_list]
+        self.assertFalse(any("BOT_CLEANUP" in call for call in calls))
+
     @patch("triage_daemon.subprocess.run")
     def test_mark_pr_opened_skips_flagging_when_no_pr_found(self, mock_run):
         """Defensive path: an empty PR search (e.g. a race with the PR being closed
@@ -387,6 +405,15 @@ def test_adds_bot_review_to_the_pr_scoped_to_repo(self, mock_run):
         args = mock_run.call_args[0][0]
         self.assertEqual(args, ["gh", "pr", "edit", "4742", "--repo", "springfall2008/batpred", "--add-label", "BOT_REVIEW"])
 
+    @patch("triage_daemon.subprocess.run")
+    def test_cleanup_adds_bot_cleanup_in_the_same_edit(self, mock_run):
+        """Both labels land in one gh call, so no poll cycle can see BOT_CLEANUP without
+        BOT_REVIEW and run the cleanup before the review it is meant to act on."""
+        triage_daemon.flag_pr_for_review(4742, cleanup=True)
+        mock_run.assert_called_once()
+        args = mock_run.call_args[0][0]
+        self.assertEqual(args, ["gh", "pr", "edit", "4742", "--repo", "springfall2008/batpred", "--add-label", "BOT_REVIEW", "--add-label", "BOT_CLEANUP"])
+
 
 class PermissionModelTests(unittest.TestCase):
     """Regression tests for the ALLOWED_TOOLS/DISALLOWED_TOOLS delta between the
@@ -1663,11 +1690,12 @@ def test_skips_triage_when_already_triaged(self):
         self.patches["create_pr"].assert_called_once_with(4720)
 
     def test_marks_opened_when_a_pr_exists_afterwards(self):
-        """If a PR references the issue after create_pr() runs, swap to BOT_PR_OPENED."""
+        """If a PR references the issue after create_pr() runs, swap to BOT_PR_OPENED - and
+        since this run opened it, queue the cleanup that acts on its review as well."""
         self.patches["has_existing_pr"].side_effect = [False, True]
         self.patches["ensure_triaged"].return_value = True
         triage_daemon.process_bot_pr_issue({"number": 4720, "labels": [], "title": "Solis TOU bit refused"})
-        self.patches["mark_pr_opened"].assert_called_once_with(4720)
+        self.patches["mark_pr_opened"].assert_called_once_with(4720, cleanup=True)
         self.patches["mark_pr_failed"].assert_not_called()
 
     def test_marks_failed_when_no_pr_exists_afterwards(self):
@@ -1937,6 +1965,15 @@ def test_queries_open_prs_labelled_bot_cleanup(self, mock_run):
         self.assertEqual(args[args.index("--label") + 1], "BOT_CLEANUP")
         self.assertIn("--limit", args)
 
+    @patch("triage_daemon.subprocess.run")
+    def test_the_query_asks_for_labels(self, mock_run):
+        """process_bot_cleanup_pr() holds a PR that still carries BOT_REVIEW, which it can
+        only see if the labels are fetched."""
+        mock_run.return_value = MagicMock(stdout="[]")
+        triage_daemon.fetch_bot_cleanup_prs()
+        cmd = mock_run.call_args[0][0]
+        self.assertIn("labels", cmd[cmd.index("--json") + 1].split(","))
+
 
 class RemovePrReviewLabelTests(unittest.TestCase):
     """Tests for remove_pr_review_label(), new - the BOT_REVIEW-on-PR flow."""
@@ -2372,6 +2409,21 @@ def test_failed_cleanup_marks_failed_instead_of_removing_the_label(self):
         self.patches["mark_pr_cleanup_failed"].assert_called_once_with(4742)
         self.patches["remove_pr_cleanup_label"].assert_not_called()
 
+    def test_waits_while_the_pr_still_carries_bot_review(self):
+        """Cleanup acts on the review's findings, so with both labels set the review goes
+        first. Nothing runs and BOT_CLEANUP stays, so a later poll picks the PR up again
+        once the review has cleared BOT_REVIEW."""
+        triage_daemon.process_bot_cleanup_pr({"number": 4742, "title": "Add confirmed findings", "labels": [{"name": "BOT_CLEANUP"}, {"name": "BOT_REVIEW"}]})
+        self.patches["sync_repo"].assert_not_called()
+        self.patches["cleanup_pr"].assert_not_called()
+        self.patches["remove_pr_cleanup_label"].assert_not_called()
+        self.patches["mark_pr_cleanup_failed"].assert_not_called()
+
+    def test_runs_once_the_review_label_has_gone(self):
+        """The hold is keyed on BOT_REVIEW alone - other labels do not block a cleanup."""
+        triage_daemon.process_bot_cleanup_pr({"number": 4742, "title": "Add confirmed findings", "labels": [{"name": "BOT_CLEANUP"}, {"name": "bug"}]})
+        self.patches["cleanup_pr"].assert_called_once_with(4742)
+
     @patch("builtins.print")
     def test_prints_the_title_and_link_before_doing_anything(self, mock_print):
         """Prints the PR's title and an openable GitHub link as soon as work starts."""
 
@@ -655,26 +655,33 @@ def is_actionable(issue_number):
     return bool(label_names & {"bug", "enhancement"})
 
 
-def flag_pr_for_review(pr_number):
-    """Add BOT_REVIEW to a PR, so the next poll cycle runs /code-review against it.
-    Idempotent - adding a label the PR already carries is a no-op, not an error.
+def flag_pr_for_review(pr_number, cleanup=False):
+    """Add BOT_REVIEW to a PR, so the next poll cycle runs /code-review against it - and
+    with cleanup, BOT_CLEANUP too, so /pr-cleanup then acts on what the review found.
+    Both go in one edit: a cycle that saw BOT_CLEANUP alone would run the cleanup before
+    the review existed. Idempotent - adding a label the PR already carries is a no-op.
     """
-    subprocess.run(["gh", "pr", "edit", str(pr_number), "--repo", REPO, "--add-label", "BOT_REVIEW"], check=True)
+    labels = ["--add-label", "BOT_REVIEW"] + (["--add-label", "BOT_CLEANUP"] if cleanup else [])
+    subprocess.run(["gh", "pr", "edit", str(pr_number), "--repo", REPO] + labels, check=True)
 
 
-def mark_pr_opened(issue_number):
+def mark_pr_opened(issue_number, cleanup=False):
     """Swap BOT_PR for BOT_PR_OPENED once the draft PR has been confirmed open, and
     flag the PR itself with BOT_REVIEW so a code review runs against it automatically -
     /issue-pr's own quality gate (step 4 of its SKILL.md) is pre-commit and a targeted
     test, not an LLM review of the diff.
+
+    cleanup also queues BOT_CLEANUP. Only process_bot_pr_issue() passes it, and only for a
+    PR its own create_pr() just opened: a PR found already open on entry may be someone's
+    own branch, and BOT_CLEANUP is the label that commits and pushes to it.
     """
     subprocess.run(
         ["gh", "issue", "edit", str(issue_number), "--repo", REPO, "--remove-label", "BOT_PR", "--add-label", "BOT_PR_OPENED"],
         check=True,
     )
     pr_number = find_pr_number_for_issue(issue_number)
     if pr_number is not None:
-        flag_pr_for_review(pr_number)
+        flag_pr_for_review(pr_number, cleanup=cleanup)
 
 
 def mark_triage_failed(issue_number, attempts):
@@ -1293,7 +1300,7 @@ def process_bot_pr_issue(issue):
         return
     create_pr(issue_number)
     if has_existing_pr(issue_number):
-        mark_pr_opened(issue_number)
+        mark_pr_opened(issue_number, cleanup=True)
     else:
         mark_pr_failed(issue_number)
 
@@ -1333,9 +1340,9 @@ def pr_head_is_fork(pr):
 
 
 def fetch_bot_cleanup_prs():
-    """Return open PRs currently labelled BOT_CLEANUP, each with its title."""
+    """Return open PRs currently labelled BOT_CLEANUP, each with its title and labels."""
     result = subprocess.run(
-        ["gh", "pr", "list", "--repo", REPO, "--state", "open", "--label", "BOT_CLEANUP", "--json", "number,title,headRepositoryOwner", "--limit", "100"],
+        ["gh", "pr", "list", "--repo", REPO, "--state", "open", "--label", "BOT_CLEANUP", "--json", "number,title,headRepositoryOwner,labels", "--limit", "100"],
         capture_output=True,
         text=True,
         check=True,
@@ -1686,9 +1693,15 @@ def process_bot_cleanup_pr(pr):
     """Run the BOT_CLEANUP flow for one PR: address review feedback and CI failures,
     then remove the trigger label. A failed run swaps to BOT_FAILED instead, with an
     explanatory comment.
+
+    A PR still carrying BOT_REVIEW is left alone, label and all: the cleanup acts on the
+    review's findings, so the review goes first and a later poll picks this PR up again.
     """
     pr_number = pr["number"]
     print(f'[cleanup-pr] PR #{pr_number}: "{pr["title"]}" - {pr_url(pr_number)}', flush=True)
+    if "BOT_REVIEW" in {label["name"] for label in pr.get("labels", [])}:
+        print(f"[cleanup-pr] PR #{pr_number}: BOT_REVIEW still pending - waiting for the review before cleaning up", flush=True)
+        return
     if pr_head_is_fork(pr):
         print(f"[cleanup-pr] PR #{pr_number}: head branch is in a fork - not writable with this credential, skipping", flush=True)
         mark_pr_cleanup_unsupported(pr_number)
@@ -1754,6 +1767,8 @@ def main():
                 process_bot_pr_issue(issue)
             for issue in fetch_bot_review_issues():
                 process_bot_review_issue(issue)
+            # Reviews before cleanups, so a PR carrying both is reviewed and cleaned up in
+            # the same cycle; process_bot_cleanup_pr() holds any PR whose review is pending.
             for pr in fetch_bot_review_prs():
                 process_bot_review_pr(pr)
             for pr in fetch_bot_cleanup_prs():