feat(policy): the landing lease and the reland judgement, and the primitive the lease needed

[wenzowski]

Closes CLOUD-1280.

DO-NOT-CLOSE CLOUD-1269 — this PR serves it and does not complete it. Three of its
four predicates now exist (one here, one in #800, one dispositioned do-not-build
with a reason), but its "consumer #1 eats the same food" clause is still unmet:
lease-authorises-the-branch is inert in this repository until a [[recorder]]
row writes lease lines for it to read, and that wiring is a protected write needing
its own admission. It is the next commit, not a deferral. #800 already carries that
row into In Review.

---

CLOUD-1269 shipped one of its four landing predicates and CLOUD-1280 carried the
rest, recording that the other three name facts that cannot answer them. Two of
the three reasons that row first recorded were wrong, and re-investigating them
is what this change is: it builds two more predicates onto the landing-loop
preset and settles the fourth in writing.

What each of the three became

predicate	disposition
target-is-fast-forwardable	renamed and built as already-landed-work-is-not-relanded. Neither named fact decides descendant-ness — git-refs deliberately dropped reachability (CLOUD-36 decides merged-ness by patch identity, now gated by policy/ancestry-decides-nothing.rego) and input.tree.landing answers has this work landed. The predicate is named for the fact that answers it.
lease-authorises-the-branch	built, on a mechanism that needed one Rust primitive
spend-needs-a-verified-head	not built, and the shape is decided rather than deferred. The recorded blocker — a policy row may not declare checks — was true and beside the point: required_checks_for widens across the whole rule table, so the policy row never needed to. The real blockers are rule 1 (a preset over input.facts.receipts.verify bakes a consumer's check name into every consumer's binary) and redundancy (it is what ready-needs-receipts already denies).

The lease, and why the clock stays outside

The boundary grades the lease with its own clock and reports the grade as an exit
status; the consumer's [[recorder]] maps that status to a word; the module
compares words. Rule::max_age is the landed precedent — the comparison happens
where the subject is already being read. So no clock reaches the engine, no
input.tree.instant is added and no policy schema regenerates: CLOUD-1170's
refusal and CLOUD-1269's resolved-token decision both stand.

The fail-open asymmetry is conserved by the mechanism rather than by prose. An
exit status the consumer's table leaves unmapped records could-not-look, which
equals neither verdict token, so the refusal cannot hold. That matters because the
producer fails closed on an unreachable remote and the bash this replaces
deliberately does not: "a lease it cannot read stops EVERY job in the fleet, where
waving one matrix through costs one matrix."

Value::Branch is the one Rust primitive, and it is the admitted successor row
(CLOUD-369) that needs it. The producer's status arm grades the lease against the
clone; authorises grades it against the branch and admits one case status
cannot — a branch that reserved the slot behind the holder is buying the matrix
that overlaps the holder's merge, so refusing it cancels the very run the
reservation exists to start. write_records already resolved the branch to key the
record by and never handed it to an expression; this exposes what the writer holds.

The declared break

semver refused the first landing attempt and was right: Value::Branch is
enum_variant_added and Context.branch is constructible_struct_adds_field, so
an out-of-crate match over the enum and an out-of-crate construction of the struct
both stop compiling. CLOUD-1280's §6 said patch — a clause groomed before the
mechanism was chosen, and the mechanism it now specifies cannot be
patch-compatible. The subject is feat(recorder)! with a BREAKING CHANGE: footer,
and §6 is corrected on the row rather than left contradicting what landed.

Three defects found while getting the tiers green

Each is recorded where the next reader meets it, not only here:

• A Rego set is unordered and de-duplicating, so "the last line" was not
  recoverable from the contains set the lease module first used. The record is a
  history; it is an array comprehension now.
• regorus panics outright (node_idx out of bounds) on a defaulted helper rule
  here and on a some x in [rule] destructuring bind — a worse failure than the
  fault being guarded against, since it takes the whole bundle down at load.
• A preset is several files in one package, so a test helper named recorded
  collided with graded-head-is-not-regraded.rego's and broke both suites —
  eleven failures, three in a module this change never touches, none of them
  reading as a collision.

Verification

• mise run policy-test — 478 passed, 0 failed. This tier is insufficient by
  construction and is not the evidence: it reported 330 green over CLOUD-1161's
  two dead predicates.
• mise run test:cargo -- --test it — 3609 passed, 0 failed, over the compiled
  binary with policy::Vocabulary::EMPTY, which is the tier that catches a preset
  shipping dead. Each predicate has its deny and its anti-vacuity mirror
  (CLOUD-418); the lease has the third outcome its asymmetry requires — an
  unreadable lease allows, distinguishable from both — plus both successor
  rows, since the admitting clause is otherwise satisfied by any reservation at all.
• mise run semver — reproduced the original refusal, then green with the break
  declared.
• mise run schema regenerated schema/batten.schema.json for the new Value
  variant. Never hand-edited.

Weakens

Weakens: rule-predicate-changed rule[landing-loop-preset].landing, groomed on
CLOUD-1280's Ready block. The reland predicate reads input.tree.landing, and the
only place a fact column can be declared is the [[rule]] row that enables the
preset — policy::load refuses two rows naming one source — so the existing row's
predicate necessarily moves. config-lint reports that as a change and
deliberately not as a ranking, so the clause declares the move rather than claiming
a lowering: without the column the predicate is undefined and the preset ships
dead, which is CLOUD-845's class.

No mise-tasks/*.sh and no tests/**/*.bats is opened, so V-SHELL-RULE-EDITED
and V-SHELL-RULE-ADDED are both untouched and bash-surface-not-growing is
unmoved.

[linear-code]

CLOUD-1280 Three of CLOUD-1269's four landing predicates name facts that cannot answer them — and two of the three reasons this row first recorded were wrong

Why

CLOUD-1269's four-predicate table assigns each predicate the facts it reads. Three of those four assignments do not hold at head, and each was found while building the row rather than while reading it — so the row shipped one of four and this carries the rest.

That ratio is the finding, not an accident of this session: a refined row's fact column reads as checked and nothing checks it. Two of the three are refusals the engine states in its own docs (no_ancestry_decides_merged_ness, Fact::Instant's tree_key() = None), and the third is a column the config schema already refuses. All three were knowable before the row was marked Ready.

lease-authorises-the-branch — the freshness half is unresolvable on the tree surface

The row's fact column is "the lease record + a resolved freshness token". The record half is reachable: a [[recorder]] over a Bash call, Value::Section peeling branch: and next: out of captured stdout, pr-body-closes's shape (batten.toml:1615).

The freshness half has no mechanism. authorises (mise-tasks/land-lock.sh:1081) treats an expired lease as allow — [[ -z "$observed_sha" ]] || released || expired — so a module that cannot resolve expiry cannot tell expired from held by someone else and would deny where authorises allows. That is precisely the inversion the row names as its own failure mode: "a port that quietly makes it fail closed has laundered a stop-the-world into a gate."

Three routes, and each is closed:

1. A clock on the tree surface. CLOUD-1170 decided against it and PR feat(facts)!: a supplied instant, four lease/liveness retirements, and two engine defects they exposed #793 built it that way deliberately: Fact::Instant takes Fact::Waived's shape, tree_key() is None, and it "reaches no module on any surface". Reversing that is that row's decision, not this one's.

2. The boundary compares, via a recorder column. This row first said no program emits a freshness token. That was wrong — land-lock authorises already resolves freshness with its own clock and reports it as an exit code (0 run / 3 stop / 2 could-not-look, land-lock.sh:1051-1111), and Read::Status maps exit status to a token, so the shape looked exactly right. It fails for a different and harder reason: Program::args is a fixed Vec<String> frozen at config load (recorder.rs:371-373) with no template and no interpolation, while authorises takes its branch on ARGV and refuses exit 2 without it (land-lock.sh:138-147). run_program writes the evaluated expression to the child's STDIN only. A row could hard-code one branch forever or record unreadable on every call, and nothing in the expression language reaches $2. Worse, Value has no variant that yields the current branch at all (recorder.rs:231-325) — write_records knows it and uses it for the record key (lib.rs:6368) but never exposes it. So even a stdin-reading wrapper would need a Rust change, and the wrapper itself is a shell edit V-SHELL-RULE-EDITED refuses.

   A third obstacle sits behind those two: append_all APPENDS (recorder.rs:969) and recorder_records returns every line in write order, so the record is a HISTORY. A module reading it holds no clock — true — but also cannot tell today's run from an hour ago's, and record_path is branch-keyed with no per-lap partition.

3. A compiled authority. recorder::Ask has one variant, Ready — the Definition-of-Ready grammar. Nothing else is askable.

A second session reached the same blocked destination by a different route, and that convergence is worth more than either finding alone. PR #793's refactor(ci)! commit tried to port the lease to a RECEIPT row rather than to a preset, and recorded on CLOUD-1275 that it is "blocked on a measured shape rather than on effort": branch_receipt_name really does spell the lease's own path byte-identically to what land-lock.sh's swap writes, but branch_validity answers StaleMain when a receipt carries no base line — and a lease receipt carries an expiry epoch and none, so such a row would refuse every ready, always.

So the receipt route fails in the SAME direction the preset route does: refuse-everything rather than the fail-open authorises conserves. Two independent mechanisms, one shape of failure, and neither is a matter of effort.

So this predicate needs a mechanism decision before it can be built at all, and the honest options are a Surface::Check freshness fact resolved at the boundary (CLOUD-1170's answer 3, still unbuilt) or a second recorder::Ask variant.

THE MECHANISM DECISION, IN WRITING (the first acceptance clause)

Decided: route 2, and it needs ONE Rust primitive rather than the three obstacles this row first recorded. The decision is written here before any module is written, which is what the acceptance asks for.

The freshness half is already resolved, by a verb this row did not examine. authorises is not the only arm that grades the lease: status (land-lock.sh:995-1048) applies released and expired with its own clock and reports the result as an exit code — 0 for unheld, released, expired or mine, 1 for held by another clone, 2 where observe could not read. So the freshness comparison happens where the lease is already being read, which is Rule::max_age's precedent exactly, and the module reads a token rather than an epoch. No clock on the tree surface, no input.tree.instant, no schema key — CLOUD-1170's refusal and CLOUD-1269's token decision are both conserved rather than reopened.

And it needs no argv, which is what closed route 2 before. status takes none, so Program::args being a frozen Vec<String> stops mattering: the row is args = ["status"] and the branch never has to reach $2.

**Fail-open is conserved by the **Read::Status MAPPING TABLE, not by luck. status fails CLOSED on an unreachable remote where authorises fails open — authorises's own header says so in as many words. An unmapped status is ABSENT and ABSENT is could-not-look, so a table declaring only 0 and 1 restores the asymmetry at the boundary: 2 maps to nothing, the column records could-not-look, and the module allows. That is the fail-open half obtained from the mechanism rather than asserted in prose.

What is still missing is exactly one primitive, and it is the successor row. status answers is the lease mine, per clone; authorises answers does the lease authorise this branch, and it admits one more case — the ADMITTED SUCCESSOR (CLOUD-369, land-lock.sh:1102). peek prints that field alone, so the record can carry it; the module then has to compare it against the CURRENT BRANCH, and no Value yields one (recorder.rs:231-325). Without it the port refuses a reserved successor that authorises allows — a fail-CLOSED deviation on one row, which is precisely the laundering CLOUD-1269 forbids, so shipping without the primitive is not an option.

**So the build is: a **Value variant yielding the current branch. write_records already computes it for the record key (lib.rs:6368) and never exposes it; this exposes what is in hand. Contained in recorder.rs, regenerates the config schema (§4 above), and is inside this row's own §1.

The stated bound, rather than a silence. recorder_records returns every line in write order, so the record is a HISTORY and the module reads the last line — an answer as fresh as the most recent call the recorder row selected, never now. That is a real bound and it is acceptable HERE because the selector is the landing call itself, so the line the lap reads is seconds old. A predicate wanting a stronger guarantee needs a per-lap partition, which is not this row's.

target-is-fast-forwardable — neither named fact decides descendant-ness

The row's fact column is input.tree.landing, input.tree["git-refs"]. Neither answers the predicate, and one of them says so in its own doc:

• input.tree["git-refs"] deliberately dropped reachability. Fact::Landing's doc: "The fact GIT_REF deliberately does not carry. That row's own header says so: it dropped the reachability answer because no_ancestry_decides_merged_ness refused it, since CLOUD-36 decides merged-ness by PATCH IDENTITY and a rebased landing is invisible to ancestry." git::ref_facts (crates/batten/src/git.rs:3233) inserts (name, commit) and the schema pins additionalProperties: {"type": "string"}.
• input.tree.landing answers a different question. It is whether this branch's work is on each declared target, by patch identity — {"verdict", "landed", "unlanded"}. "Has this work landed" is not "is this head a descendant".

The refusal of ancestry is deliberate and correct, so this is not a request to add it back — and it is now GATED rather than merely documented: no_ancestry_decides_merged_ness no longer exists as a test, having moved to policy/ancestry-decides-nothing.rego under CLOUD-756, which refuses merge-base, is-ancestor, --contains and --ancestry-path as arguments anywhere in src/. So no ahead/behind fact can be added without an argument at that gate.

What IS decidable from input.tree.landing, established from git.rs:2985-3110 and LandingFact at git.rs:3694-3705. verdict has exactly four values — landed, partially_landed, nothing_to_land, not_landed_within_window — and the schema declares only "string", so a module comparing against a token that does not exist passes validation and never holds.

The trap, and it is sharp: landed **is NOT **count(unlanded) == 0. A squash-landed branch reaches Verdict::Landed through cumulative_evidence, leaving per-commit evidence all None — so landed == true with a non-empty unlanded. And not_landed_within_window is an UNPROVEN absence, not "not landed": the module cannot see target_truncated or window, because Scan is not projected.

So the honest predicate available here is already-landed-work-is-not-relanded over input.tree.landing[target].landed — generic, since the target is the consumer's declared string, and reading the fact for what it says rather than for what the old name wanted.

spend-needs-a-verified-head — a policy row may not declare the receipts it reads

Found by the gate rather than by reading, which is the part worth keeping. The module was written, the preset wired, and the enabling row declared the roster exactly the way CLOUD-1269's §2 asks — the consumer's checks in batten.toml, out of the bundle. config-lint refused it at the pre-commit gate:

batten: rule landing-spend-preset: `checks` is not valid for kind "policy"

THAT DIAGNOSIS WAS WRONG, and the correct one kills the predicate rather than deferring it. checks is indeed not valid on a policy row (rules.rs:852-894), but the policy row never needed to declare it: required_checks_for (hook.rs:3159-3172) narrows by CALL via matching_receipt_rows and widens across the WHOLE rule table, and call_document serializes one document before the bundle loop (hook.rs:5484). So a policy module DOES read receipts a kind = "receipt" row declared — here ready-needs-receipts (batten.toml:502-521, pattern = "gh pr ready", checks = ["verify", "linear-check"]).

The real blockers are two, and neither is a missing column:

1. Rule 1. A preset predicate over input.facts.receipts.verify bakes a CONSUMER's check name into every consumer's binary — the violation policy.rs:305-309 names for shipping this repository's job names inside ci-hygiene.
2. Redundancy. The generic spelling — every receipt this call requires is valid — names nothing and is already what ready-needs-receipts denies. The preset would refuse what the receipt row refused, under a second set of words.

And the failure mode if shipped anyway is silent: delete or re-pattern that receipt row and facts.receipts projects null (Look::IsNot), the predicate is undefined, no violation is raised, and config-lint is clean because the policy row is independently valid. batten.toml:599-604 already documents exactly this coupling for agent-sourced.

Disposition: do not build. Not deferred pending a shape decision — the shape is decided and it is "not a preset".

What did ship

graded-head-is-not-regraded alone, as the landing-loop preset — tree-scoped, over input.tree.forge.

The surface split is still real and still forced: a [[rule]] carries one scope and policy::load refuses two rows naming one preset, source_key for a preset row being the preset's own name, so a bundle cannot span the tree and the mediated call. With only one predicate left buildable there is one preset.

---

Refinement — Ready (decide the mechanism each blocked predicate needs, then build it)

Refinement gate: Definition of Ready & Done. This body carries only specializations.

• Authority boundary (§1). crates/batten/src/facts.rs or crates/batten/src/recorder.rs for whichever mechanism is taken; new crates/batten/src/policy/presets/landing-loop/*.rego; crates/batten/src/verdict.rs; crates/batten/tests/; and the enabling rows in batten.toml. No mise-tasks/*.sh and no tests/**/*.bats — which is the constraint that closed route 2 above, so a plan reaching for one has not found a blocked row, it has written §1 in the wrong shape.
• Computable predicate (§2). For the lease: a lease record whose branch does not match, with freshness resolved as live, is refused; the same record resolved as expired is not; an unreadable lease is not. The middle case is the one no current mechanism can produce, and it is the whole row. For the second: whichever predicate is decided on, its deny and its mirror.
• Deliberately not in scope (§2). Adding ancestry to input.tree["git-refs"] — no_ancestry_decides_merged_ness refused it and CLOUD-36's patch-identity verdict stands. Adding a raw instant key — CLOUD-1170 decided that and feat(facts)!: a supplied instant, four lease/liveness retirements, and two engine defects they exposed #793 built the decision. Retiring any landing program — CLOUD-1148's.
• Effect (§3). read.
• Generated artifacts (§4). A new fact regenerates schema/policy-input.schema.json; a new recorder::Ask variant regenerates the config schema. mise run fix; never hand-edit.
• **Weakens: **rule-predicate-changed at rule[landing-loop-preset].landing. The second predicate reads input.tree.landing, and the only place a fact column can be declared is the [[rule]] row that enables the preset — policy::load refuses two rows naming one source (policy.rs:813), so a separate row is not available and the existing row's predicate necessarily moves. config-lint reports this as a CHANGE and deliberately not as a ranking (trust.rs:527-533: "whether one glob is narrower than another is a judgement this module refuses to make, but that the predicate moved at all is a byte comparison"), so this clause declares the move rather than claiming a lowering: the column ADDS a fact a dead predicate had nothing to read, and without it the preset ships dead — CLOUD-845's class, and what CLOUD-1161's ci-hygiene shipped twice.
• Output and exit (§5). Pointer-only: the lease key, the ref, the commit. Never a lease body.
• Commit / bump (§6). feat(policy) — patch.
• Test obligation (§7). Over the compiled binary, with policy::Vocabulary::EMPTY. Shown able to fail per CLOUD-418: each predicate's deny and its anti-vacuity mirror, plus the lease's third case — an unreadable lease allows, distinguishable from both a live lease and a refusing one. The fail-open asymmetry is the load-bearing half and a suite that cannot show all three has not tested it.
• Blockers (§8). relatedTo CLOUD-1269 (the row that shipped the other two), CLOUD-1170 (whose answer 3 is one of the two candidate mechanisms and is unbuilt), CLOUD-1148 (the migration these are the successors for), CLOUD-499 (the lease's conserved verdict).

Acceptance

• The mechanism for lease freshness is decided in writing — a boundary-resolved fact, a second recorder::Ask, or a recorded refusal that this predicate stays bash — before any module is written.
• If it is built, an expired lease naming another branch allows, and that case is exercised over the compiled binary rather than with with input as.
• The second predicate is either renamed to the question input.tree.landing actually answers, or dropped with a reason.
• The receipts predicate has a shape decided — a policy row that may declare checks, or an explicit statement that it reads another row's declaration and what that couples it to.
• CLOUD-1269's four-predicate table is corrected so the next reader does not re-derive both findings.

CLOUD-1269 Ship the `landing-loop` preset — CLOUD-1170 names PRESET as the lease predicate's home and no row owns building one, so the generic half of 3,538 lines of landing bash has a disposition and no destination

Why

CLOUD-1170 took the answer and named the home in as many words:

*"A lease predicate over *(record, instant) is generic — every consumer with a landing lease has that shape — so it is a PRESET, with the TTL and the lease's identity as consumer config."

Nothing owns building it. CLOUD-1170 owns the facts (the supplied instant, the liveness record) and its §2 excludes retiring any member. CLOUD-1148 owns the migration and, until an owner correction on 2026-08-31, excluded "shipping a landing preset" outright. So the disposition was recorded twice and the destination zero times — the punt shape AGENTS.md names: an unbuilt mechanism awaited instead of the instance in hand.

This row is the destination.

What is generic, and why that is the test that matters

Landing judgements split three ways, and only one third belongs in a preset:

part	example	home
effect and loop	fetch, rebase, push, the CAS on the lease ref, the poll	outside the engine, unchanged — CLOUD-1170's own split
consumer fact	which branch is trunk, the required-check roster, the TTL, the lease's identity	batten.toml
generic predicate	given this lease record and this instant, may this branch spend a matrix?	this preset

.claude/rules/policy-modules.md's "module or preset" test is the authority: a preset only when the predicate stays generic once the consumer's facts are pulled into batten.toml. Each predicate below passes it — none names a branch, a check roster, a task or a tracker key, which is also non-negotiable rule 1 reaching the vendored tier via presets_are_inside_the_rule_one_glob.

The four predicates

THIS TABLE'S FACT COLUMN WAS WRONG FOR THREE OF THE FOUR ROWS, AND THE DISPOSITION COLUMN IS THE CORRECTION (CLOUD-1280). Each of the three was found while BUILDING the row rather than while reading it, which is the finding: a refined row's fact column reads as checked and nothing checks it.

predicate	the practice	facts	disposition
lease-authorises-the-branch	exactly one branch at a time spends a matrix; a lapsed lease authorises nobody	the lease record + a resolved freshness token	blocked on a mechanism, CLOUD-1280. The record half is reachable; the FRESHNESS half has no producer the engine can read. All three routes are closed at head — a tree-surface clock is CLOUD-1170's refusal, a [[recorder]] over authorises cannot reach $2 (Program::args is a fixed Vec<String> and no Value yields the current branch) and the record is an append-only history with no per-lap partition, and recorder::Ask has one variant
target-is-fast-forwardable	a landing attempt on a head that is not a descendant is refused locally, before the matrix	~~input.tree.landing~~~~, ~~~~input.tree["git-refs"]~~	RENAMED and shipped as already-landed-work-is-not-relanded. Neither named fact decides descendant-ness: git-refs deliberately dropped reachability (CLOUD-36 decides merged-ness by patch identity, now gated by policy/ancestry-decides-nothing.rego), and input.tree.landing answers has this work landed, which is a different question. The predicate is named for the fact that answers it
graded-head-is-not-regraded	a SHA the forge already graded is not re-run, and a red one is not readied	input.tree.forge	shipped, PR #800
spend-needs-a-verified-head	the event that starts CI is refused unless this exact head carries a live verification receipt	receipt validity, per Rule::max_age	DO NOT BUILD, and the shape is decided rather than deferred. A policy row may not declare checks — but it never needed to, since required_checks_for widens across the whole rule table. The real blockers are non-negotiable rule 1 (a preset over input.facts.receipts.verify bakes a consumer's check name into every consumer's binary) and redundancy (the generic spelling is what ready-needs-receipts already denies)

lease-authorises-the-branch is mise-tasks/land-lock.sh:1051's authorises arm, which is already a pure function and says so: "Read-only and side-effect free… a pure function of (lease state, branch) so the suite can drive every row without a second clone."

Its fail-open asymmetry is conserved verbatim, and that is the load-bearing half. land-lock.sh:1069 — "FAIL OPEN, EVERYWHERE IT CANNOT TELL. Every other refusal in this file fails closed, and this one deliberately does not: a lease it cannot read stops EVERY job in the fleet, where waving one matrix through costs one matrix." A port that quietly makes it fail closed has laundered a stop-the-world into a gate.

The instant reaches the predicate as a RESOLVED TOKEN, not as arithmetic

Owner decision, 2026-08-31, and it is a refinement of CLOUD-1170's "one value per invocation, on the input, treated as data" rather than a contradiction of it: the engine is still handed the instant and still never reads a clock. What changes is what Rego sees.

The precedent is landed. crates/batten/src/rules.rs:1351-1377 (Rule::max_age):

*"THE CLOCK IS THE BOUNDARY'S, NEVER adjudicate's. The comparison happens where the receipt is already being read… That is the waiver table's precedent: a waiver lapses on a date, and *today() *is handed in rather than taken inside, pinned by adjudicate_reads_no_clock_even_now_that_a_waiver_can_lapse. This column buys a fourth *Validity and no clock in the core."

So the boundary compares and the module reads fresh / expired / could-not-look. Three consequences, each a reason:

1. **No 25th **input.tree key and no schema regeneration. The 24 keys stand.
2. Byte-stable output survives by construction. An integer instant on the input makes two evaluations over one tree differ whenever the module does arithmetic on it; a resolved token does not. That is CLOUD-1170's own third acceptance clause — "the same evaluation repeated produces identical bytes" — obtained rather than asserted.
3. No second authority over time. max_age already compares; a raw instant would let every module compare too, differently.

A raw input.tree.instant is not in this row's scope and nothing in the loop needs one. If a second predicate ever wants arithmetic over an arbitrary timestamp, that is its own row.

The two ways a preset ships DEAD, both already measured here

Not cautionary: both have happened in this repository.

1. Every pattern literal is written INLINE. A [[pattern]] row is consumer config, so data.batten.patterns["x"] resolves to undefined for a consumer who wrote none; Rego reads undefined as does not hold; the module loads clean and decides nothing. crates/batten/src/policy.rs states it at the exemption's own site — the demand is *"unsatisfiable… a consumer cannot add a *[[pattern]] row on its behalf, and the preset cannot read one." CLOUD-934 predicted it in those words; CLOUD-1161's ci-hygiene preset is it happening, two predicates dead.
2. The compiled tier supplies the empty vocabulary (patterns: &[]). batten policy test reported 330 passed over the dead version, because the load-time tier cannot see this class. crates/batten/tests/policy_presets.rs, running the bundle the way a consumer gets it, is the only tier that catches it.

And per CLOUD-857: anchor on input.call.segments, never split(input.call.command, " "), for anything that turns out to be mediated-call scoped.

---

Refinement — Ready (ship the generic landing judgements as a vendored, overridable bundle)

Refinement gate: Definition of Ready & Done. This body carries only specializations.

• Authority boundary (§1). New crates/batten/src/policy/presets/landing-loop/*.rego; the PRESETS entry in crates/batten/src/policy.rs; the VendoredVerdict rows in crates/batten/src/verdict.rs's vendored-presets section; arms in crates/batten/tests/policy_presets.rs; and the enabling [[rule]] rows in this repository's own batten.toml. Purely additive — no mise-tasks/*.sh and no tests/**/*.bats is opened, so V-SHELL-RULE-EDITED and V-SHELL-RULE-ADDED are both untouched, and no program retires in this row.
• Computable predicate (§2). A consumer enabling preset = "landing-loop" and supplying a lapsed lease record is refused, naming the lease key; the same consumer with a live lease is not. Each of the four predicates carries that pair.
• Consumer ci: check in the main-branch protection ruleset #1 eats the same food (§2). This repository enables the bundle in the same change, the way batten.toml's trunk-based-preset row already does — "the only way the surface gets exercised by something other than its own tests." The row states a position on overlap with the enabled ci-hygiene bundle, which judges workflow wiring, so the two do not report one practice twice.
• Overridability is per verdict (§2). Each predicate raises its own token in VENDORED, with a route; lease-authorises-the-branch and graded-head-is-not-regraded carry a route with a precondition (a wedged holder starving the fleet; a re-grade genuinely wanted after a runner fault). target-is-fast-forwardable carries none — rebasing is the route. Contrast V-SHELL-RULE-EDITED, whose single routeless verdict is the design and not an oversight.
• Deliberately not in scope (§2). Retiring land.sh, land-lock.sh or main-watch.sh — CLOUD-1148 owns the migration and its ci-lease-precondition fetch-and-exec precondition is untouched here. Adding a raw instant key. Changing what landing currently decides: the port is behaviour-conserving, and CLOUD-499's liveness-not-progress verdict is carried, not revisited.
• Effect (§3). read. A preset is include_str! at build time — no network, no registry, no trust-on-first-use — and every predicate reads facts the boundary already resolved. evaluator-io-check stays the gate.
• Generated artifacts (§4). The published preset-name enum regenerates from preset_names(). mise run fix; never hand-edit. No schema/policy-input.schema.json change, which is the point of the token decision above.
• Output and exit (§5). Pointer-only: the lease key, the ref, the SHA, the check name — never a lease body, never a fetched payload, never a process listing. The 0/1/2/3 table is untouched; a lease that cannot be read is could-not-look and allows, per the fail-open asymmetry above.
• Commit / bump (§6). feat(policy) — patch.
• Test obligation (§7). Over the compiled binary, in crates/batten/tests/policy_presets.rs, **with **patterns: &[] — the load-time tier is insufficient by construction and 330 green tests over two dead predicates is the measurement. Shown able to fail per CLOUD-418: for each predicate, the deny case and its anti-vacuity mirror, without which the first is satisfied by a gate that refuses everything. Plus the third case this row's own asymmetry needs: an unreadable lease allows, distinguishable from both.
• Blockers (§8). blockedBy CLOUD-1170 — the supplied instant and the liveness record are its deliverables, and three of the four predicates are inert without a fact layer to read. relatedTo CLOUD-1148 (the migration parent, whose §2 exclusion of this row was struck on 2026-08-31), CLOUD-1181 (a preset is three parallel hardcoded tables, which this row adds a sixth row to and does not fix), CLOUD-836 (the vendored-preset mechanism), CLOUD-934 (the inline-regex exemption), CLOUD-1161 (the two dead predicates), CLOUD-857 (the segments anchor), CLOUD-418, CLOUD-499.

Acceptance

• preset_names() includes landing-loop, and enabling it by name in a [[rule]] row loads.
• Each of the four predicates has a deny case, an anti-vacuity mirror, and — for the lease — an unreadable-lease case that allows, all in crates/batten/tests/policy_presets.rs over the compiled binary with patterns: &[].
• No data.batten.patterns[...] reference appears anywhere under presets/landing-loop/.
• Every verdict raised is declared in VENDORED, and every VENDORED row added is raised by a predicate — both directions, which the loader already refuses.
• This repository enables the bundle, and the enabling row states its position on ci-hygiene overlap.
• No mise-tasks/ program and no .bats suite is added, edited or deleted, and bash-surface-not-growing is unmoved.
• CLOUD-1148's child rows can cite this bundle as the successor for the generic half of authorises, rather than re-deriving it.

Filed 2026-08-31 after an owner decision that the landing loop ships as an overridable preset. The disposition existed on CLOUD-1170 and the exclusion on CLOUD-1148; neither was a destination.

Review in Linear

[coderabbitai]

Warning

Review limit reached

Next included review available in 20 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Free

Run ID: e519e7b3-5a15-4699-b091-050baecf27c7

📥 Commits

Reviewing files that changed from the base of the PR and between 0b31cae and cb33679.

📒 Files selected for processing (9)

• batten.toml
• crates/batten/src/lib.rs
• crates/batten/src/policy.rs
• crates/batten/src/policy/presets/landing-loop/already-landed-work-is-not-relanded.rego
• crates/batten/src/policy/presets/landing-loop/lease-authorises-the-branch.rego
• crates/batten/src/recorder.rs
• crates/batten/src/verdict.rs
• crates/batten/tests/it/policy_presets.rs
• schema/batten.schema.json

---

Note

🎁 Summarized by CodeRabbit Free

Your organization is on the Free plan. CodeRabbit will generate a high-level summary and a walkthrough for each pull request. For a comprehensive line-by-line review, please upgrade your subscription to CodeRabbit Essentials by visiting https://app.coderabbit.ai/settings/billing.

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

❌ The last analysis has failed.

See analysis details on SonarQube Cloud

[wenzowski]

/fast-forward