ci: stop cancelled Ring 1 runs from failing the Fly deploy

Two merges landing on main within a few minutes cancelled the earlier
commit's User Journeys run (cancel-in-progress keyed on the ref), and
fly-deploy's gate treats a cancelled reliability-ring1 as a hard failure —
so a superseded commit produced a red deploy.

- user-journeys.yml: keep superseded runs on main alive, matching
  docker.yml's expression. Every main commit's Ring 1 now reaches a
  conclusion of its own, which is what the gate reads.
- fly-deploy.yml: when an upstream is red or cancelled for a commit main
  has already moved past, skip the deploy (deploy=false output) instead of
  failing. The newer commit's own run does the releasing.

Also fold timed_out into the terminal conclusions the gate reacts to,
rather than polling until the 65-minute job timeout.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LGkCEj3kPc4QMCxBPGo95p

Author: claude

.github/workflows/README.md

@@ -104,7 +104,12 @@ F2 wires this table into the actual gates:
   workflows' conclusion on the triggering commit before `deploy` runs —
   whichever of the two finishes second is the run that actually reaches
   `deploy` (the other is superseded by `fly-deploy`'s existing
-  `cancel-in-progress` concurrency group).
+  `cancel-in-progress` concurrency group). Because that gate reads a
+  per-commit conclusion, `user-journeys.yml` does not cancel superseded runs
+  on `main` — a run cancelled by the next merge would read as "Ring 1 failed"
+  and block the release. And when the gate does see a red or cancelled
+  upstream for a commit `main` has already moved past, it skips the deploy
+  instead of failing: that commit's image is not what anyone is releasing.
 - **Ring 2**: `release.yaml` gained a per-OS "Reliability Ring 2
   packed-backend journey" step right after each OS's existing smoke-boot
   step, running linear-text-pipeline against that OS's packed backend

.github/workflows/fly-deploy.yml

@@ -58,10 +58,12 @@ jobs:
     timeout-minutes: 65
     outputs:
       sha: ${{ github.event.workflow_run.head_sha }}
+      deploy: ${{ steps.poll.outputs.deploy }}
     env:
       GH_TOKEN: ${{ github.token }}
     steps:
       - name: Poll for both workflows' success on this commit
+        id: poll
         shell: bash
         run: |
           set -euo pipefail
@@ -74,26 +76,50 @@ jobs:
               --jq '.workflow_runs[0].conclusion // "pending"'
           }
 
+          # True once a newer commit has landed on main. That commit's own
+          # fly-deploy run releases the newer image, so anything this run could
+          # still conclude about ${sha} is moot — and a red X here would be
+          # noise, not a broken deploy.
+          superseded() {
+            [ "$(gh api "repos/${repo}/commits/main" --jq .sha)" != "${sha}" ]
+          }
+
+          skip() {
+            echo "::notice::${1} Superseded on main; skipping the deploy of ${sha}."
+            echo "deploy=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          }
+
           for attempt in $(seq 1 60); do
             docker_conclusion="$(conclusion_for docker.yml)"
             journeys_conclusion="$(conclusion_for user-journeys.yml)"
             echo "attempt ${attempt}/60: docker.yml=${docker_conclusion} user-journeys.yml=${journeys_conclusion}"
 
             if [ "${docker_conclusion}" = "success" ] && [ "${journeys_conclusion}" = "success" ]; then
               echo "Both workflows succeeded for ${sha}."
+              echo "deploy=true" >> "$GITHUB_OUTPUT"
               exit 0
             fi
-            if [ "${docker_conclusion}" = "failure" ] || [ "${docker_conclusion}" = "cancelled" ]; then
-              echo "::error::docker.yml concluded '${docker_conclusion}' for ${sha}; not deploying."
-              exit 1
-            fi
-            if [ "${journeys_conclusion}" = "failure" ] || [ "${journeys_conclusion}" = "cancelled" ]; then
-              echo "::error::user-journeys.yml (reliability-ring1) concluded '${journeys_conclusion}' for ${sha}; not deploying."
-              exit 1
-            fi
+            case "${docker_conclusion}" in
+              failure|cancelled|timed_out)
+                if superseded; then skip "docker.yml concluded '${docker_conclusion}' for ${sha}."; fi
+                echo "::error::docker.yml concluded '${docker_conclusion}' for ${sha}; not deploying."
+                exit 1
+                ;;
+            esac
+            case "${journeys_conclusion}" in
+              failure|cancelled|timed_out)
+                if superseded; then skip "user-journeys.yml (reliability-ring1) concluded '${journeys_conclusion}' for ${sha}."; fi
+                echo "::error::user-journeys.yml (reliability-ring1) concluded '${journeys_conclusion}' for ${sha}; not deploying."
+                exit 1
+                ;;
+            esac
             sleep 60
           done
 
+          if superseded; then
+            skip "Timed out waiting for docker.yml and user-journeys.yml on ${sha}."
+          fi
           echo "::error::Timed out waiting for docker.yml and user-journeys.yml to both complete for ${sha}."
           exit 1
 
@@ -103,11 +129,13 @@ jobs:
     runs-on: ubuntu-latest
     # Skip when the image build (or the reliability Ring 1 gate) failed/was
     # cancelled. workflow_dispatch always runs (manual re-deploy); on
-    # workflow_run, `gate` must have completed successfully.
+    # workflow_run, `gate` must have completed successfully AND still consider
+    # this commit worth releasing — it reports deploy=false for a commit main
+    # has already moved past, whose own run does the releasing.
     if: >
       always() &&
       (github.event_name == 'workflow_dispatch' ||
-       needs.gate.result == 'success')
+       (needs.gate.result == 'success' && needs.gate.outputs.deploy == 'true'))
     steps:
       - uses: actions/checkout@v7
         with:

.github/workflows/user-journeys.yml

@@ -27,9 +27,14 @@ on:
 permissions:
   contents: read
 
+# On main, every commit's reliability-ring1 run must reach a conclusion of its
+# own: fly-deploy.yml gates the deploy on this workflow's result for that exact
+# head_sha, so a run cancelled by a follow-up merge reads as "Ring 1 failed" and
+# blocks the release. Same reasoning (and same expression) as docker.yml.
+# Elsewhere — PR branches, tags — superseded runs are still cancelled.
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' && !startsWith(github.ref, 'refs/tags/') }}
 
 jobs:
   journeys: