@@ -126,6 +126,7 @@ export class ConcurrencyLimitsSystem {
                   alreadySynced: {
                     perKey: row.concurrencyLimit,
                     total: row.totalConcurrencyLimit,
+                    paused: row.paused,
                   },
                 })
                   .orElse(() => okAsync(undefined))
@@ -192,14 +193,17 @@ function concurrencyLimitNameFromRow(row: Pick<TaskQueue, "name">): string {
  * match: their limit is queue surface, managed through the queues API.
  */
 function limitRowsWhere(environment: AuthenticatedEnvironment) {
+  const hasBounds = {
+    OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
+  };
   return {
     runtimeEnvironmentId: environment.id,
     OR: [
-      { role: "LIMIT" as const },
+      { role: "LIMIT" as const, ...hasBounds },
       {
         role: "QUEUE" as const,
         concurrencyVersion: "V2" as const,
-        OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
+        ...hasBounds,
       },
     ],
   };
@@ -220,6 +224,7 @@ function findLimitByName(
         runtimeEnvironmentId: environment.id,
         name: `${LIMIT_QUEUE_PREFIX}${name}`,
         role: "LIMIT",
+        OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
       },
     }),
     (error) => ({ type: "other" as const, cause: error })
@@ -237,7 +242,6 @@ function findLimitByName(
           name,
           role: "QUEUE",
           concurrencyVersion: "V2",
-          OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
         },
       }),
       (error) => ({ type: "other" as const, cause: error })
@@ -322,6 +326,7 @@ function applyLimitOverride(
       : (row.concurrencyLimit ?? null);
     data.concurrencyLimitOverriddenAt = now;
     data.concurrencyLimitOverriddenBy = overriddenBy?.id ?? null;
+    data.concurrencyLimitOverridePercent = null;
   }
 
   if (override.total !== undefined) {
@@ -341,6 +346,27 @@ function applyLimitOverride(
  * override markers clear, so an engine failure leaves the markers set and a retry
  * converges instead of being rejected while the overridden limit stays enforced.
  */
+/**
+ * A paused row's pause IS the engine per-key value 0 (the DB concurrencyLimit
+ * column keeps the configured value), so every per-key engine write from this
+ * surface must preserve it — otherwise an override or reset that only touched
+ * `total` would silently resume a queue every other surface still reports as
+ * paused. Named LIMIT rows are never paused (pausing a limit is an override to
+ * `{ total: 0 }`), so they always take the target branch.
+ */
+function perKeyEngineWrite(
+  environment: AuthenticatedEnvironment,
+  row: Pick<TaskQueue, "name" | "paused">,
+  target: number | null | undefined
+) {
+  if (row.paused) {
+    return updateQueueConcurrencyLimits(environment, row.name, 0);
+  }
+  return typeof target === "number"
+    ? updateQueueConcurrencyLimits(environment, row.name, target)
+    : removeQueueConcurrencyLimits(environment, row.name);
+}
+
 function syncResetToEngine(
   environment: AuthenticatedEnvironment,
   row: TaskQueue
@@ -359,10 +385,7 @@ function syncResetToEngine(
     ? row.totalConcurrencyLimitBase
     : row.totalConcurrencyLimit;
 
-  const perKeySync =
-    typeof perKeyTarget === "number"
-      ? updateQueueConcurrencyLimits(environment, row.name, perKeyTarget)
-      : removeQueueConcurrencyLimits(environment, row.name);
+  const perKeySync = perKeyEngineWrite(environment, row, perKeyTarget);
 
   const totalSync =
     typeof totalTarget === "number"
@@ -383,6 +406,7 @@ function resetLimitOverrides(db: PrismaClientOrTransaction, row: TaskQueue) {
     data.concurrencyLimitBase = null;
     data.concurrencyLimitOverriddenAt = null;
     data.concurrencyLimitOverriddenBy = null;
+    data.concurrencyLimitOverridePercent = null;
   }
 
   if (row.totalConcurrencyLimitOverriddenAt !== null) {
@@ -440,7 +464,7 @@ function guardedLimitUpdate(
   );
 }
 
-type SyncedLimitValues = { perKey: number | null; total: number | null };
+type SyncedLimitValues = { perKey: number | null; total: number | null; paused: boolean };
 
 /**
  * Re-syncs the engine from fresh reads of the row until the enforced values stop
@@ -475,14 +499,13 @@ function compensateEngineFromFreshRow(
           !fresh ||
           (lastSynced !== null &&
             fresh.concurrencyLimit === lastSynced.perKey &&
-            fresh.totalConcurrencyLimit === lastSynced.total)
+            fresh.totalConcurrencyLimit === lastSynced.total &&
+            fresh.paused === lastSynced.paused)
         ) {
           return;
         }
         await settleBothEngineWrites(
-          typeof fresh.concurrencyLimit === "number"
-            ? updateQueueConcurrencyLimits(environment, fresh.name, fresh.concurrencyLimit)
-            : removeQueueConcurrencyLimits(environment, fresh.name),
+          perKeyEngineWrite(environment, fresh, fresh.concurrencyLimit),
           typeof fresh.totalConcurrencyLimit === "number"
             ? updateQueueTotalConcurrencyLimits(
                 environment,
@@ -491,7 +514,11 @@ function compensateEngineFromFreshRow(
               )
             : removeQueueTotalConcurrencyLimits(environment, fresh.name)
         );
-        lastSynced = { perKey: fresh.concurrencyLimit, total: fresh.totalConcurrencyLimit };
+        lastSynced = {
+          perKey: fresh.concurrencyLimit,
+          total: fresh.totalConcurrencyLimit,
+          paused: fresh.paused,
+        };
       }
     })(),
     (error) => ({ type: "other" as const, cause: error })
@@ -504,10 +531,7 @@ function compensateEngineFromFreshRow(
  * both keys sync unconditionally, unlike queue rows.
  */
 function syncLimitToEngine(environment: AuthenticatedEnvironment, row: TaskQueue) {
-  const perKeySync =
-    typeof row.concurrencyLimit === "number"
-      ? updateQueueConcurrencyLimits(environment, row.name, row.concurrencyLimit)
-      : removeQueueConcurrencyLimits(environment, row.name);
+  const perKeySync = perKeyEngineWrite(environment, row, row.concurrencyLimit);
 
   const totalSync =
     typeof row.totalConcurrencyLimit === "number"
 
@@ -387,9 +387,68 @@ async function createWorkerTasks(
       if (entry) entries.push(entry);
     }
   }
+
+  await retireStaleAnonymousConcurrencyLimitRows(metadata.tasks, environment, prisma);
+
   return entries;
 }
 
+/**
+ * A task whose inline limit no longer compiles to its anonymous LIMIT row (the
+ * limit moved onto the task's own default queue, or was removed) leaves that
+ * row behind, where it would shadow the live task/<id> name on the
+ * concurrency-limits surface and keep stale engine keys. Retiring clears the
+ * row's bounds and override state — dropping it from listing and name
+ * resolution so the queue-row fallback resolves — and removes its engine keys.
+ */
+async function retireStaleAnonymousConcurrencyLimitRows(
+  tasks: TaskResource[],
+  environment: AuthenticatedEnvironment,
+  prisma: PrismaClientOrTransaction
+): Promise<void> {
+  const candidateNames = tasks
+    .filter((task) => !(task.concurrency?.inline && task.queue?.name))
+    .map((task) => anonymousConcurrencyLimitQueueName(task.id));
+  if (candidateNames.length === 0) {
+    return;
+  }
+
+  const staleRows = await prisma.taskQueue.findMany({
+    where: {
+      runtimeEnvironmentId: environment.id,
+      role: "LIMIT",
+      name: { in: candidateNames },
+      OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
+    },
+    select: { id: true, name: true },
+  });
+  if (staleRows.length === 0) {
+    return;
+  }
+
+  await prisma.taskQueue.updateMany({
+    where: { id: { in: staleRows.map((row) => row.id) } },
+    data: {
+      concurrencyLimit: null,
+      concurrencyLimitBase: null,
+      concurrencyLimitOverriddenAt: null,
+      concurrencyLimitOverriddenBy: null,
+      concurrencyLimitOverridePercent: null,
+      totalConcurrencyLimit: null,
+      totalConcurrencyLimitBase: null,
+      totalConcurrencyLimitOverriddenAt: null,
+      totalConcurrencyLimitOverriddenBy: null,
+    },
+  });
+
+  await Promise.allSettled(
+    staleRows.flatMap((row) => [
+      removeQueueConcurrencyLimits(environment, row.name),
+      removeQueueTotalConcurrencyLimits(environment, row.name),
+    ])
+  );
+}
+
 async function createWorkerTask(
   task: TaskResource,
   queues: Array<TaskQueue>,
 
@@ -344,8 +344,14 @@ describe("ConcurrencyLimitsSystem", () => {
       const v1 = await system.limits.retrieve(authEnv, "task/legacy-task");
       expect(v1.isErr()).toBe(true);
 
+      /** Boundless V2 queues stay out of the list but resolve by name, so an
+       * operator can still cap an undeclared task through this surface. */
       const boundless = await system.limits.retrieve(authEnv, "task/unbounded-task");
-      expect(boundless.isErr()).toBe(true);
+      expect(boundless.isOk()).toBe(true);
+      if (boundless.isOk()) {
+        expect(boundless.value.perKey.current).toBeNull();
+        expect(boundless.value.total.current).toBeNull();
+      }
 
       const listed = await system.limits.list(authEnv, { page: 1, perPage: 50 });
       expect(listed.isOk()).toBe(true);
@@ -355,6 +361,110 @@ describe("ConcurrencyLimitsSystem", () => {
     }
   );
 
+  postgresTest(
+    "a retired anonymous LIMIT row falls through to the live queue row",
+    async ({ prisma }) => {
+      const { authEnv, system, environment } = await seedEnvAndLimit(prisma, { total: 25 });
+
+      await prisma.taskQueue.create({
+        data: {
+          friendlyId: `queue_rl${environment.slug}`,
+          name: "limit/task/send-email",
+          orderableName: "send-email",
+          projectId: environment.projectId,
+          runtimeEnvironmentId: environment.id,
+          role: "LIMIT",
+          concurrencyVersion: "V2",
+        },
+      });
+      await prisma.taskQueue.create({
+        data: {
+          friendlyId: `queue_ql${environment.slug}`,
+          name: "task/send-email",
+          orderableName: "send-email-q",
+          projectId: environment.projectId,
+          runtimeEnvironmentId: environment.id,
+          role: "QUEUE",
+          concurrencyVersion: "V2",
+          concurrencyLimit: 1,
+          totalConcurrencyLimit: 10,
+        },
+      });
+
+      const retrieved = await system.limits.retrieve(authEnv, "task/send-email");
+      expect(retrieved.isOk()).toBe(true);
+      if (retrieved.isOk()) {
+        expect(retrieved.value.total).toMatchObject({ current: 10 });
+      }
+
+      const listed = await system.limits.list(authEnv, { page: 1, perPage: 50 });
+      expect(listed.isOk()).toBe(true);
+      if (listed.isOk()) {
+        expect(listed.value.filter((item) => item.name === "task/send-email")).toHaveLength(1);
+      }
+    }
+  );
+
+  postgresTest("overrides and resets preserve a queue pause in the engine", async ({ prisma }) => {
+    const { authEnv, system, environment } = await seedEnvAndLimit(prisma, { total: 25 });
+
+    await prisma.taskQueue.create({
+      data: {
+        friendlyId: `queue_p${environment.slug}`,
+        name: "task/paused-task",
+        orderableName: "paused-task",
+        projectId: environment.projectId,
+        runtimeEnvironmentId: environment.id,
+        role: "QUEUE",
+        concurrencyVersion: "V2",
+        concurrencyLimit: 1,
+        totalConcurrencyLimit: 10,
+        paused: true,
+      },
+    });
+
+    const overridden = await system.limits.override(authEnv, "task/paused-task", { total: 20 });
+    expect(overridden.isOk()).toBe(true);
+    expect(totalSyncMock).toHaveBeenCalledWith(authEnv, "task/paused-task", 20);
+    /** The pause IS the per-key engine value 0; the sync must rewrite 0, never
+     * the configured limit and never a removal. */
+    expect(perKeySyncMock).toHaveBeenCalledWith(authEnv, "task/paused-task", 0);
+    expect(perKeySyncMock).not.toHaveBeenCalledWith(authEnv, "task/paused-task", 1);
+    expect(perKeyRemoveMock).not.toHaveBeenCalledWith(authEnv, "task/paused-task");
+
+    perKeySyncMock.mockClear();
+    const reset = await system.limits.reset(authEnv, "task/paused-task");
+    expect(reset.isOk()).toBe(true);
+    expect(perKeySyncMock).toHaveBeenCalledWith(authEnv, "task/paused-task", 0);
+    expect(perKeySyncMock).not.toHaveBeenCalledWith(authEnv, "task/paused-task", 1);
+  });
+
+  postgresTest("a perKey override clears a stale percent override source", async ({ prisma }) => {
+    const { authEnv, system, environment } = await seedEnvAndLimit(prisma, { total: 25 });
+
+    const row = await prisma.taskQueue.create({
+      data: {
+        friendlyId: `queue_pc${environment.slug}`,
+        name: "task/percent-task",
+        orderableName: "percent-task",
+        projectId: environment.projectId,
+        runtimeEnvironmentId: environment.id,
+        role: "QUEUE",
+        concurrencyVersion: "V2",
+        concurrencyLimit: 50,
+        concurrencyLimitBase: 100,
+        concurrencyLimitOverriddenAt: new Date(),
+        concurrencyLimitOverridePercent: 50,
+      },
+    });
+
+    const overridden = await system.limits.override(authEnv, "task/percent-task", { perKey: 3 });
+    expect(overridden.isOk()).toBe(true);
+    const updated = await prisma.taskQueue.findFirstOrThrow({ where: { id: row.id } });
+    expect(updated.concurrencyLimit).toBe(3);
+    expect(updated.concurrencyLimitOverridePercent).toBeNull();
+  });
+
   postgresTest("retrieve misses queue-role rows and unknown names", async ({ prisma }) => {
     const { authEnv, system, environment } = await seedEnvAndLimit(prisma, { total: 25 });