How so? Ansible describes a sequence of mutative steps, Puppet describes a desired end state; the latter seems far more amenable to immutable infrastructure than the former.

We run ansible-pull as the very last step of a CloudFormation build (instance or autoscaling group). So it's a local pull, not a push from somewhere else. Only done once, hence the immutability. To make changes you replace the instance.

Puppet (can) keep it's hooks into an already running instance and continue making changes to it.