docs(memory): record the two landing-loop traps #946 paid for

[wenzowski]

Refs CLOUD-1663

Two traps that each cost a lap on #946, written nowhere a later session would find them. Neither could ride in the commit body it belonged to: both surfaced after those messages were written — the first during CI, the second during the second rebase.

The fan-in hole

mem:workflow/landing-loop's Verdicts section already states the principle: a cancelled read as red wedges a branch with no exit. What it did not say is that this repository currently does exactly that on its second fan-in.

CI_FANIN_CHECK holds one name against final and action-final, so the superseded-run handling never applies to the latter. A cancelled action-final writes a real failure — its if: always() fails the needs: assertion — and a failure conclusion is an answer, so it outranks the newer run's non-answer and reads as red.

Verified the engine is not misreading anything, by feeding checks green the two real rows via CHECKS_GREEN_RUNS:

• later skipped alone → pending — required check(s) with no verdict, exit 3. Correct: a skip is not an answer.
• earlier failure + later skipped → red, exit 1. Correct in isolation.

What made it expensive rather than merely wrong: the conclusion is permanent on its sha. An unchanged sha creates no new run, so re-lapping re-reads the identical failure for a full verify's cost — measured, twice on #946. Only a new sha clears it, which is free when main has moved and unavailable when it has not.

CLOUD-1663 is open and owns the fix (measured there independently on #848). This is the operating note until it lands.

A union is the wrong resolution when one side removed

MUTANT_GATES is one long comma-separated line both sides append to, so most conflicted laps conflict there and a union looks obviously right.

It is right only while both sides added. 8b619266 removed release-trigger-independent — mutate sweep answered no-suite, so the row was a coverage claim with nothing behind it and moved to #MUTANT-EXEMPT. A mechanical union silently resurrects exactly that, re-reddening mutate census with a name main had just retired, and nothing in the conflict markers says so. Caught on #946 only because the entry's name looked unfamiliar.

The rule: diff against origin/main, not the merge base, so a deliberate removal survives the resolution.

Also records the neighbouring trap in the opposite direction — $MUTANT_GATES entries are module names resolved against policy/{name}.rego on disk, never rule ids, so renaming them to follow a rule-id rename stands the census's subjects up against names no file carries.

Scope

Memory file only; no code, no gate behaviour changes.

---

Generated by Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 0bdca062-f034-498a-959d-3cf52e6e3945

📥 Commits

Reviewing files that changed from the base of the PR and between c2755e2 and 4605850.

📒 Files selected for processing (1)

• .serena/memories/workflow/landing-loop.md

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The landing-loop documentation now describes that CI_FANIN_CHECK names one of two fan-ins, and that a cancelled action-final can create a permanent sha-specific failure. It also documents when to union MUTANT_GATES lists, when to resolve against the current main list, and that entries are module names.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to 46058

This documentation-only change does not alter runtime behavior, and no merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies a documentation change that records the two landing-loop traps described in the pull request.
Description check	✅ Passed	The description directly explains both documented traps, their impact, and the scope of the documentation-only change.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch claude/markdown-yaml-frontmatter-gkj9ty

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}