@@ -1385,6 +1385,8 @@ const EnvironmentSchema = z
 
     // Infrastructure endpoint only. Modes and organization overrides are polled feature flags.
     RUN_ENGINE_SNAPSHOT_STORE_REDIS_URL: z.string().optional(),
+    // How long a fetched org snapshotStoreMode override is reused per process. 0 disables caching.
+    RUN_ENGINE_SNAPSHOT_STORE_DIAL_CACHE_MS: z.coerce.number().int().min(0).default(5000),
 
     RUN_ENGINE_RUN_LOCK_REDIS_HOST: z
       .string()
 
@@ -223,7 +223,9 @@ const snapshotStoreRuntime = singleton("SnapshotStoreRuntime", () => {
   });
   return createSnapshotStoreRuntime({
     connection,
-    rollout: createSnapshotRolloutResolver(() => globalFlagsRegistry.current(), prisma),
+    rollout: createSnapshotRolloutResolver(() => globalFlagsRegistry.current(), prisma, {
+      dialCacheMs: env.RUN_ENGINE_SNAPSHOT_STORE_DIAL_CACHE_MS,
+    }),
     getRunStore: () => runStore,
     metrics: metrics.decorator,
   });
 
@@ -1,10 +1,10 @@
 import { createRedisClusterClient, type Cluster } from "@internal/redis";
 import { RedisSnapshotStore, type SnapshotStoreMetrics } from "@internal/run-store";
 
-const COMMAND_TIMEOUT_MS = 500;
+const COMMAND_TIMEOUT_MS = 1_000;
 const CONNECT_TIMEOUT_MS = 500;
 const POLICY_CHECK_INTERVAL_MS = 30_000;
-const COMPLETED_TTL_MS = 14 * 24 * 60 * 60 * 1_000;
+const COMPLETED_TTL_MS = 4 * 24 * 60 * 60 * 1_000;
 
 /** Infrastructure only. Rollout modes belong to the existing polled flags, not this URL. */
 export function snapshotClusterOptions(endpoint: string) {
 
@@ -24,7 +24,7 @@ test("snapshot metrics ignore raw organization IDs; the endpoint creates no eage
   const plainOptions = snapshotClusterOptions("redis://127.0.0.1:1");
   expect(plainOptions.clusterOptions).toEqual({ lazyConnect: true, scaleReads: "master" });
   expect(plainOptions.redisOptions.tls).toBeUndefined();
-  expect(options.redisOptions.commandTimeout).toBe(500);
+  expect(options.redisOptions.commandTimeout).toBe(1000);
   const connection = createSnapshotConnection("redis://127.0.0.1:1");
   connection.getStore(); // Registers local Lua commands only.
   expect(connection.getClient().status).toBe("wait");
 
@@ -20,6 +20,87 @@ import {
   type SnapshotRolloutFlags,
 } from "./snapshotStoreRollout.server";
 
+function countOrganizationReads<T extends { $extends: (...args: any[]) => any }>(prisma: T) {
+  const counter = { reads: 0 };
+  const observed = prisma.$extends({
+    query: {
+      organization: {
+        async findFirst({ args, query }: { args: unknown; query: (args: unknown) => unknown }) {
+          counter.reads++;
+          return query(args);
+        },
+      },
+    },
+  });
+  return { counter, observed };
+}
+
+postgresTest(
+  "snapshotStoreMode org lookups are cached per organization for the TTL",
+  async ({ prisma }) => {
+    const org = await prisma.organization.create({
+      data: {
+        title: "Snapshot dial cache",
+        slug: "snapshot-dial-cache",
+        featureFlags: { snapshotStoreMode: "redis-only" },
+      },
+    });
+    const { counter, observed } = countOrganizationReads(prisma);
+
+    // Two hits within the TTL make one DB call, even after the org row changes.
+    const cached = createSnapshotRolloutResolver(() => undefined, observed, { dialCacheMs: 200 });
+    expect(await cached.resolveDial(org.id)).toBe("redis-only");
+    await prisma.organization.update({
+      where: { id: org.id },
+      data: { featureFlags: { snapshotStoreMode: "dual-write" } },
+    });
+    expect(await cached.resolveDial(org.id)).toBe("redis-only");
+    expect(counter.reads).toBe(1);
+
+    // After the TTL the lookup runs again and sees the new value.
+    await new Promise((resolve) => setTimeout(resolve, 250));
+    expect(await cached.resolveDial(org.id)).toBe("dual-write");
+    expect(counter.reads).toBe(2);
+
+    // An absent override is cached too.
+    await prisma.organization.update({
+      where: { id: org.id },
+      data: { featureFlags: Prisma.DbNull },
+    });
+    const absent = createSnapshotRolloutResolver(
+      () => ({ snapshotStoreMode: "redis-read" }),
+      observed,
+      { dialCacheMs: 200 }
+    );
+    counter.reads = 0;
+    expect(await absent.resolveDial(org.id)).toBe("redis-read");
+    expect(await absent.resolveDial(org.id)).toBe("redis-read");
+    expect(counter.reads).toBe(1);
+
+    // Supplied organization flags bypass the cache and are never stored in it.
+    const supplied = createSnapshotRolloutResolver(() => undefined, observed, { dialCacheMs: 200 });
+    counter.reads = 0;
+    expect(await supplied.resolveDial(org.id, { snapshotStoreMode: "redis-only" })).toBe(
+      "redis-only"
+    );
+    expect(counter.reads).toBe(0);
+    expect(await supplied.resolveDial(org.id)).toBe("off");
+    expect(counter.reads).toBe(1);
+    expect(await supplied.resolveDial(org.id, { snapshotStoreMode: "dual-write" })).toBe(
+      "dual-write"
+    );
+    expect(await supplied.resolveDial(org.id)).toBe("off");
+    expect(counter.reads).toBe(1);
+
+    // TTL 0 disables caching: every read makes a DB call.
+    const uncached = createSnapshotRolloutResolver(() => undefined, observed, { dialCacheMs: 0 });
+    counter.reads = 0;
+    await uncached.resolveDial(org.id);
+    await uncached.resolveDial(org.id);
+    expect(counter.reads).toBe(2);
+  }
+);
+
 postgresTest(
   "snapshotStoreMode uses loaded org flags or one lookup, then the global default",
   async ({ prisma }) => {
 
@@ -4,26 +4,55 @@ import { FEATURE_FLAG, FeatureFlagCatalog } from "../featureFlags";
 
 export type SnapshotRolloutFlags = { snapshotStoreMode?: SnapshotStoreDial };
 
-/** Use the normal org flag, falling back to the already-polled global default. No org cache. */
+const DIAL_CACHE_MAX_ENTRIES = 10_000;
+
+/**
+ * Use the normal org flag, falling back to the already-polled global default.
+ * Fetched org overrides are cached in memory per organization for `dialCacheMs` (absent or 0
+ * disables), so a flag flip takes up to that long to apply.
+ */
 export function createSnapshotRolloutResolver(
   readFlags: () => SnapshotRolloutFlags | undefined,
-  prisma: Pick<PrismaClient, "organization">
+  prisma: Pick<PrismaClient, "organization">,
+  options?: { dialCacheMs?: number }
 ) {
+  const ttlMs = options?.dialCacheMs ?? 0;
+  // Insertion-ordered, so the first key is the oldest entry for FIFO eviction.
+  const overridesCache = new Map<string, { overrides: unknown; fetchedAt: number }>();
+
+  async function fetchOverrides(organizationId: string): Promise<unknown> {
+    if (ttlMs > 0) {
+      const cached = overridesCache.get(organizationId);
+      if (cached) {
+        if (Date.now() - cached.fetchedAt < ttlMs) return cached.overrides;
+        overridesCache.delete(organizationId);
+      }
+    }
+    const overrides = (
+      await prisma.organization.findFirst({
+        where: { id: organizationId },
+        select: { featureFlags: true },
+      })
+    )?.featureFlags;
+    if (ttlMs > 0) {
+      overridesCache.delete(organizationId);
+      if (overridesCache.size >= DIAL_CACHE_MAX_ENTRIES) {
+        const oldest = overridesCache.keys().next().value;
+        if (oldest !== undefined) overridesCache.delete(oldest);
+      }
+      overridesCache.set(organizationId, { overrides, fetchedAt: Date.now() });
+    }
+    return overrides;
+  }
+
   return {
     async resolveDial(
       organizationId: string,
       organizationFlags?: unknown
     ): Promise<SnapshotStoreDial> {
       // undefined means not loaded; null/{} means loaded with no override. Do not refetch those.
       const overrides =
-        organizationFlags === undefined
-          ? (
-              await prisma.organization.findFirst({
-                where: { id: organizationId },
-                select: { featureFlags: true },
-              })
-            )?.featureFlags
-          : organizationFlags;
+        organizationFlags === undefined ? await fetchOverrides(organizationId) : organizationFlags;
       const value =
         typeof overrides === "object" && overrides !== null && "snapshotStoreMode" in overrides
           ? overrides.snapshotStoreMode
 
@@ -78,13 +78,14 @@ import {
   ExecutionSnapshotSystem,
   getExecutionSnapshotsSince,
   getLatestExecutionSnapshot,
+  getLatestExecutionSnapshotOrFinishedRun,
 } from "./systems/executionSnapshotSystem.js";
 import {
   PARKED_ON_EXTERNAL_DEPLOYMENT_STATUS_REASON,
   PendingVersionSystem,
 } from "./systems/pendingVersionSystem.js";
 import { RaceSimulationSystem } from "./systems/raceSimulationSystem.js";
-import { RunAttemptSystem } from "./systems/runAttemptSystem.js";
+import { type CancelRunResult, RunAttemptSystem } from "./systems/runAttemptSystem.js";
 import { NoopPendingVersionRunIdLookup } from "./services/pendingVersionLookup.js";
 import type { SystemResources } from "./systems/systems.js";
 import {
@@ -1753,7 +1754,7 @@ export class RunEngine {
     finalizeRun?: boolean;
     bulkActionId?: string;
     tx?: PrismaClientOrTransaction;
-  }): Promise<ExecutionResult & { alreadyFinished: boolean }> {
+  }): Promise<CancelRunResult> {
     return this.runAttemptSystem.cancelRun({
       runId,
       organizationId,
@@ -2718,13 +2719,35 @@ export class RunEngine {
   }
 
   async #repairRun(runId: string, dryRun: boolean, organizationId: string) {
-    const snapshot = await getLatestExecutionSnapshot(
+    const { snapshot, finishedRun } = await getLatestExecutionSnapshotOrFinishedRun(
       this.prisma,
       runId,
       this.runStore,
-      undefined,
-      organizationId
+      organizationId,
+      { id: true }
     );
+    if (finishedRun) {
+      // The run finished and its snapshot state expired, so any concurrency slot it holds has leaked.
+      this.logger.warn("RunEngine.repairRun: snapshot state expired, run already finished", {
+        runId,
+      });
+
+      if (!dryRun) {
+        await this.worker.enqueueOnce({
+          id: `repair-in-progress-run:${runId}`,
+          job: "repairSnapshot",
+          payload: { runId, snapshotId: null, executionStatus: "FINISHED" },
+          availableAt: new Date(Date.now() + this.repairSnapshotTimeoutMs),
+        });
+      }
+
+      return {
+        action: "repairSnapshot",
+        runId,
+        snapshotStatus: "FINISHED",
+        snapshotId: null,
+      };
+    }
 
     if (
       snapshot.executionStatus === "QUEUED" ||
@@ -3173,13 +3196,57 @@ export class RunEngine {
     executionStatus,
   }: {
     runId: string;
-    snapshotId: string;
+    /** null when scheduled for a finished run whose snapshot state had already expired. */
+    snapshotId: string | null;
     executionStatus: string;
   }) {
     return await this.runLock.lock("handleRepairSnapshot", [runId], async () => {
       // No snapshot mirror in off-only mode, so the repair heals only the queue below. The M1+
       // rebuild reintroduces a mirror-repair step here.
-      const latestSnapshot = await getLatestExecutionSnapshot(this.prisma, runId, this.runStore);
+      const { snapshot: latestSnapshot, finishedRun } =
+        await getLatestExecutionSnapshotOrFinishedRun(
+          this.prisma,
+          runId,
+          this.runStore,
+          undefined,
+          {
+            id: true,
+            queue: true,
+            concurrencyKey: true,
+            runtimeEnvironmentId: true,
+          }
+        );
+      if (finishedRun) {
+        // The run is finished whichever snapshot the job was queued from (a live one that has since
+        // finished and expired, or none when queued after expiry), so its slot has leaked either way.
+        this.logger.warn("RunEngine.handleRepairSnapshot: snapshot state expired, run finished", {
+          runId,
+          snapshotId,
+          repairExecutionStatus: executionStatus,
+        });
+
+        const env = await this.controlPlaneResolver.resolveEnv(finishedRun.runtimeEnvironmentId);
+        if (!env) {
+          this.logger.error("RunEngine.handleRepairSnapshot FINISHED environment not found", {
+            runId,
+          });
+          return;
+        }
+
+        await this.#clearRunFromConcurrencySets({
+          runId,
+          orgId: env.organizationId,
+          queue: finishedRun.queue,
+          concurrencyKey: finishedRun.concurrencyKey ?? undefined,
+          env: {
+            id: env.id,
+            type: env.type,
+            project: { id: env.projectId },
+            organization: { id: env.organizationId },
+          },
+        });
+        return;
+      }
 
       if (latestSnapshot.id !== snapshotId) {
         this.logger.log(
@@ -3264,8 +3331,7 @@ export class RunEngine {
             return;
           }
 
-          // We need to clear this run from the current concurrency sets
-          await this.runQueue.clearMessageFromConcurrencySets({
+          await this.#clearRunFromConcurrencySets({
             runId,
             orgId: latestSnapshot.organizationId,
             queue: taskRun.queue,
@@ -3291,6 +3357,13 @@ export class RunEngine {
     });
   }
 
+  async #clearRunFromConcurrencySets(
+    params: Parameters<RunQueue["clearMessageFromConcurrencySets"]>[0]
+  ) {
+    // We need to clear this run from the current concurrency sets
+    await this.runQueue.clearMessageFromConcurrencySets(params);
+  }
+
   /**
    * Applies `defaultMaxTtl` to a run's TTL:
    * - No max configured → pass through as-is.