refactor(webapp): rely on cold safe-default for compute migration routing

Drop the per-trigger readiness gate (waitUntilReady) and the /healthcheck
dependency; a cold registry read falls back to not-migrated, matching the
datastore/llm-pricing registries. Add computeMigrationRequireTemplate flag
(migrated orgs build the compute template in required mode at deploy when on,
else shadow) and a reloading_registry_loaded gauge so a never-loaded registry
is alertable. Drop dead GLOBAL_FLAGS_READY_TIMEOUT_MS.

Author: nicktrn

apps/webapp/app/env.server.ts

@@ -161,9 +161,6 @@ const EnvironmentSchema = z
     // How often each replica reloads the global flags snapshot from the DB.
     // Sets kill/ramp propagation latency.
     GLOBAL_FLAGS_RELOAD_INTERVAL_MS: z.coerce.number().int().min(1000).default(5000),
-    // Max time the first trigger blocks waiting for the initial flags load
-    // before falling back to defaults (off = container, the safe direction).
-    GLOBAL_FLAGS_READY_TIMEOUT_MS: z.coerce.number().int().min(0).default(5000),
     WORKER_ENABLED: z.string().default("true"),
     GRACEFUL_SHUTDOWN_TIMEOUT: z.coerce.number().int().default(60000),
     DISABLE_SSE: z.string().optional(),

apps/webapp/app/runEngine/services/triggerTask.server.ts

@@ -362,15 +362,8 @@ export class RunEngineTriggerTaskService {
           const enableFastPath = workerQueueResult?.enableFastPath ?? false;
 
           // Rewrite the region to its compute backing for migration-enrolled orgs,
-          // from the in-memory flag snapshot (no DB query). The isLoaded gates only
-          // block during cold start so the first request can't serve a default over
-          // a real flag; once warm they're a synchronous no-op.
-          if (!globalFlagsRegistry.isLoaded) {
-            await globalFlagsRegistry.waitUntilReady(env.GLOBAL_FLAGS_READY_TIMEOUT_MS);
-          }
-          if (!workerRegionRegistry.isLoaded) {
-            await workerRegionRegistry.waitUntilReady(env.GLOBAL_FLAGS_READY_TIMEOUT_MS);
-          }
+          // from the in-memory snapshots (no DB query). A cold read (registry not yet
+          // loaded) returns undefined/[] and the resolver falls back to not-migrated.
           const workerGroups = workerRegionRegistry.current() ?? [];
           const region = baseWorkerQueue ? regionForQueue(baseWorkerQueue, workerGroups) : undefined;
           const backing = baseWorkerQueue ? backingForQueue(baseWorkerQueue, workerGroups) : undefined;

apps/webapp/app/utils/reloadingRegistry.server.ts

@@ -18,12 +18,20 @@ const lastSuccessfulLoadAt = new Gauge({
   registers: [metricsRegister],
 });
 
+// 0 until the first successful load, then 1. Starts at 0 (not absent) so a
+// never-loaded registry is an alertable series, distinct from "feature off".
+const registryLoaded = new Gauge({
+  name: "reloading_registry_loaded",
+  help: "1 once the registry has loaded at least once, else 0 (0 = serving cold fallback)",
+  labelNames: ["name"],
+  registers: [metricsRegister],
+});
+
 export type ReloadingRegistry<T> = {
   isReady: Promise<void>;
   readonly isLoaded: boolean;
   current(): T | undefined;
   reload(): Promise<void>;
-  waitUntilReady(timeoutMs: number): Promise<void>;
   stop(): void;
 };
 
@@ -42,15 +50,14 @@ export type ReloadingRegistryOptions<T> = {
 
 /**
  * In-memory snapshot loaded at startup and refreshed on an interval. Reads are
- * synchronous (`current()`); the first read should gate on `waitUntilReady` so a
- * cold replica never serves a default over a real value. Mirrors the datastore /
- * LLM-pricing registries. Interval-only: no pub/sub (a follow-up if sub-second
- * propagation is ever needed).
+ * synchronous (`current()`) and return undefined until the first load completes;
+ * callers must tolerate that (e.g. fall back to a safe default), the same cold-start
+ * contract as the datastore / LLM-pricing registries. Interval-only: no pub/sub
+ * (a follow-up if sub-second propagation is ever needed).
  */
 export function createReloadingRegistry<T>(opts: ReloadingRegistryOptions<T>): ReloadingRegistry<T> {
   let snapshot: T | undefined;
   let loaded = false;
-  let started = false;
   let loadSeq = 0;
   let resolveReady!: () => void;
   const isReady = new Promise<void>((resolve) => {
@@ -65,14 +72,15 @@ export function createReloadingRegistry<T>(opts: ReloadingRegistryOptions<T>): R
     lastSuccessfulLoadAt.set({ name: opts.name }, Date.now() / 1000);
     if (!loaded) {
       loaded = true;
+      registryLoaded.set({ name: opts.name }, 1);
       resolveReady();
     }
   }
 
   let interval: ReturnType<typeof setInterval> | undefined;
 
   if (opts.autoStart !== false) {
-    started = true;
+    registryLoaded.set({ name: opts.name }, 0); // visible cold series until first load
 
     const startup = pRetry(() => doLoad(), {
       forever: opts.retry?.retries === undefined,
@@ -124,20 +132,6 @@ export function createReloadingRegistry<T>(opts: ReloadingRegistryOptions<T>): R
     },
     current: () => snapshot,
     reload: doLoad,
-    async waitUntilReady(timeoutMs: number) {
-      if (!started || loaded || timeoutMs <= 0) return;
-      let timer: ReturnType<typeof setTimeout> | undefined;
-      try {
-        await Promise.race([
-          isReady,
-          new Promise<void>((resolve) => {
-            timer = setTimeout(resolve, timeoutMs);
-          }),
-        ]);
-      } finally {
-        if (timer) clearTimeout(timer);
-      }
-    },
     stop,
   };
 }

apps/webapp/app/v3/featureFlags.ts

@@ -14,6 +14,7 @@ export const FEATURE_FLAG = {
   computeMigrationEnabled: "computeMigrationEnabled",
   computeMigrationFreePercentage: "computeMigrationFreePercentage",
   computeMigrationPaidPercentage: "computeMigrationPaidPercentage",
+  computeMigrationRequireTemplate: "computeMigrationRequireTemplate",
 } as const;
 
 export const FeatureFlagCatalog = {
@@ -37,6 +38,9 @@ export const FeatureFlagCatalog = {
   [FEATURE_FLAG.computeMigrationEnabled]: z.boolean(),
   [FEATURE_FLAG.computeMigrationFreePercentage]: z.coerce.number().int().min(0).max(100),
   [FEATURE_FLAG.computeMigrationPaidPercentage]: z.coerce.number().int().min(0).max(100),
+  // When on, migrated orgs build their compute template in required mode at deploy
+  // (fails the deploy on error) instead of shadow. Strict boolean (see above).
+  [FEATURE_FLAG.computeMigrationRequireTemplate]: z.boolean(),
 };
 
 export type FeatureFlagKey = keyof typeof FeatureFlagCatalog;

apps/webapp/app/v3/globalFlagsRegistry.server.ts

@@ -7,8 +7,9 @@ import { createReloadingRegistry } from "~/utils/reloadingRegistry.server";
 /**
  * In-memory snapshot of the global feature flags, refreshed every
  * GLOBAL_FLAGS_RELOAD_INTERVAL_MS. `flags()` reads the DB-backed global values
- * (no per-org overrides). Read synchronously on the trigger hot path; callers
- * gate the first read on `waitUntilReady`.
+ * (no per-org overrides). Read synchronously on the trigger hot path; a cold
+ * read (before the first load) returns undefined and the resolver falls back to
+ * not-migrated.
  */
 export const globalFlagsRegistry = singleton("globalFlagsRegistry", () =>
   createReloadingRegistry<Partial<FeatureFlagCatalog>>({

apps/webapp/app/v3/services/computeTemplateCreation.server.ts

@@ -168,14 +168,9 @@ export class ComputeTemplateCreationService {
     // Migrated orgs route runs to the compute backing even though their stored
     // default is still the container region, so they need a compute template too.
     // shadow mode: never fail a deploy over a backing the org didn't opt into.
-    if (!workerRegionRegistry.isLoaded) {
-      await workerRegionRegistry.waitUntilReady(env.GLOBAL_FLAGS_READY_TIMEOUT_MS);
-    }
+    // A cold registry read returns no backing, so this is simply skipped until loaded.
     const defaultQueue = project.defaultWorkerGroup?.masterQueue;
     if (defaultQueue && backingForQueue(defaultQueue, workerRegionRegistry.current() ?? [])) {
-      if (!globalFlagsRegistry.isLoaded) {
-        await globalFlagsRegistry.waitUntilReady(env.GLOBAL_FLAGS_READY_TIMEOUT_MS);
-      }
       const decision = {
         orgId: project.organization.id,
         orgFeatureFlags: project.organization.featureFlags as Record<string, unknown> | null,
@@ -198,7 +193,8 @@ export class ComputeTemplateCreationService {
         migrated = isOrgMigrated({ ...decision, planType });
       }
       if (migrated) {
-        return "shadow";
+        // required => template built at deploy (deploy fails on error); off => shadow.
+        return decision.flags?.computeMigrationRequireTemplate ? "required" : "shadow";
       }
     }
 

apps/webapp/app/v3/workerRegions.server.ts

@@ -50,9 +50,10 @@ export function backingForQueue(
 
 /**
  * In-memory snapshot of every worker group's (queue, region, type, hidden),
- * refreshed on an interval. Read synchronously on the hot path; callers gate the
- * first read on `waitUntilReady`. DB-backed source of truth for region<->backing
- * resolution (replaces the old env-var backing map).
+ * refreshed on an interval. Read synchronously on the hot path; a cold read
+ * returns undefined (callers default safely - no backing, so not-migrated).
+ * DB-backed source of truth for region<->backing resolution (replaces the old
+ * env-var backing map).
  */
 export const workerRegionRegistry = singleton("workerRegionRegistry", () =>
   createReloadingRegistry<WorkerGroupRegionRow[]>({

apps/webapp/test/reloadingRegistry.test.ts

@@ -1,4 +1,4 @@
-import { describe, it, expect, vi } from "vitest";
+import { describe, it, expect } from "vitest";
 import { createReloadingRegistry } from "~/utils/reloadingRegistry.server";
 
 describe("createReloadingRegistry", () => {
@@ -15,32 +15,6 @@ describe("createReloadingRegistry", () => {
     reg.stop();
   });
 
-  it("waitUntilReady resolves once loaded", async () => {
-    const reg = createReloadingRegistry({
-      name: "test-b",
-      intervalMs: 10_000,
-      load: async () => 1,
-    });
-    await reg.waitUntilReady(1000);
-    expect(reg.current()).toBe(1);
-    reg.stop();
-  });
-
-  it("waitUntilReady times out (and stays unloaded) when load never succeeds", async () => {
-    const reg = createReloadingRegistry({
-      name: "test-c",
-      intervalMs: 10_000,
-      retry: { retries: 0 },
-      load: async () => {
-        throw new Error("db down");
-      },
-    });
-    await reg.waitUntilReady(50);
-    expect(reg.isLoaded).toBe(false);
-    expect(reg.current()).toBeUndefined();
-    reg.stop();
-  });
-
   it("reload() picks up a changed value", async () => {
     let v = 1;
     const reg = createReloadingRegistry({
@@ -86,7 +60,7 @@ describe("createReloadingRegistry", () => {
     reg.stop();
   });
 
-  it("autoStart:false stays inert and non-blocking", async () => {
+  it("autoStart:false stays inert (never loads)", async () => {
     let loadCalls = 0;
     const reg = createReloadingRegistry({
       name: "test-inert",
@@ -99,37 +73,7 @@ describe("createReloadingRegistry", () => {
     });
     expect(reg.isLoaded).toBe(false);
     expect(reg.current()).toBeUndefined();
-    await reg.waitUntilReady(10_000); // must resolve ~immediately, not wait 10s
-    expect(reg.isLoaded).toBe(false);
     expect(loadCalls).toBe(0); // never hit the DB/load
     reg.stop();
   });
-
-  it("waitUntilReady clears its timeout when ready wins", async () => {
-    const clearSpy = vi.spyOn(global, "clearTimeout");
-    // load resolves only when the test releases it, so waitUntilReady runs the
-    // race while still unloaded (it would return early if already loaded)
-    let releaseLoad!: () => void;
-    const loadGate = new Promise<void>((resolve) => {
-      releaseLoad = resolve;
-    });
-    const reg = createReloadingRegistry({
-      name: "test-f",
-      intervalMs: 10_000,
-      load: async () => {
-        await loadGate;
-        return 1;
-      },
-    });
-
-    // long timeout so isReady is what actually wins the race
-    const waiting = reg.waitUntilReady(10_000);
-    releaseLoad();
-    await reg.isReady;
-    await waiting;
-
-    expect(clearSpy).toHaveBeenCalled();
-    clearSpy.mockRestore();
-    reg.stop();
-  });
 });