@@ -1333,7 +1333,6 @@ const EnvironmentSchema = z
     // The hard stop, "1" to halt. Separate from MODE because MODE governs births only: turning it
     // down cannot stop a resident run mirroring. Holding this from the environment outranks the
     // snapshotStoreHalt flag, which is the no-deploy control for the same thing.
-    RUN_ENGINE_SNAPSHOT_STORE_HALT: z.string().default("0"),
     RUN_ENGINE_SNAPSHOT_STORE_ORG_MODE_CACHE_TTL_MS: z.coerce.number().int().default(30_000),
     RUN_ENGINE_SNAPSHOT_STORE_ORG_MODE_CACHE_MAX: z.coerce.number().int().default(10_000),
     // No fallback to REDIS_*: this is a distinct durable endpoint and must be set explicitly, or
 
@@ -21,6 +21,12 @@ export type SnapshotStoreBootDeps = {
   ping: () => Promise<boolean>;
   evictionPolicy: () => Promise<EvictionPolicyReport>;
   repairBound: () => boolean;
+  /**
+   * Whether the retired RUN_ENGINE_SNAPSHOT_STORE_HALT still asks for a halt. Only "1" counts: the
+   * old default was "0", which carries no intent, and refusing on it would stop every deployment
+   * that pins the default while asking for nothing.
+   */
+  legacyEnvHalt: boolean;
   log: (message: string, fields?: Record<string, unknown>) => void;
   warn: (message: string, fields?: Record<string, unknown>) => void;
 };
@@ -29,6 +35,15 @@ const PING_TIMEOUT_MS = 5_000;
 const FLAG_READY_TIMEOUT_MS = 10_000;
 
 export async function assertSnapshotStoreBoot(deps: SnapshotStoreBootDeps): Promise<void> {
+  // Checked before anything else, and it does not depend on the dial or the host. The variable no
+  // longer halts anything, so leaving it set means an operator believes the mirror is stopped while
+  // it is running. That is the one failure mode worse than not starting.
+  if (deps.legacyEnvHalt) {
+    throw new Error(
+      "RUN_ENGINE_SNAPSHOT_STORE_HALT is set but no longer does anything; the hard stop is the snapshotStoreHalt feature flag. Set the flag, then unset this variable."
+    );
+  }
+
   const pastOff = deps.mode !== "off";
   // Configuration is validated as soon as a host is set, NOT only past off. The per-organisation
   // override can put one organisation at dual-write while the deployment dial is still off, which is
@@ -199,6 +214,9 @@ export async function assertSnapshotStoreBootFromEnv(): Promise<void> {
     ping: pingSweepClient,
     evictionPolicy: readEvictionPolicy,
     repairBound: () => !!getSnapshotRepairEnqueuer(),
+    // Read raw: the variable is out of the parsed env schema, and the point is to notice a value
+    // nothing consumes any more.
+    legacyEnvHalt: process.env.RUN_ENGINE_SNAPSHOT_STORE_HALT === "1",
     log: (message, fields) =>
       logger.info(message, {
         ...fields,
 
@@ -81,19 +81,23 @@ export function buildSnapshotStoreModeResolver(deps: {
 }
 
 /**
- * The hard stop. Either source halts; only the environment can hold a halt the flag cannot lift,
- * which is what a deployment needs while it resyncs.
+ * The hard stop, and the flag is the whole of it.
+ *
+ * An environment half used to sit beside this, so a deployment could hold a halt the flag could not
+ * lift. It is gone. It converged over a rolling deploy rather than a flag interval, and for the
+ * length of that deploy the fleet is mixed: a halted process writes no transition, then an unhalted
+ * one asserts a head that was never written and forks. A control whose own convergence manufactures
+ * the divergence it exists to stop cannot be the way in. The guaranteed-inert state is an
+ * unconfigured host, which is bootstrap config and stays in the environment.
  */
 export function buildSnapshotStoreHaltCheck(deps: {
   flag: () => boolean | undefined;
-  envHalt: boolean;
 }): () => boolean {
-  return () => deps.envHalt || deps.flag() === true;
+  return () => deps.flag() === true;
 }
 
 export const snapshotStoreHalted = buildSnapshotStoreHaltCheck({
   flag: () => globalFlagsRegistry.current()?.[FEATURE_FLAG.snapshotStoreHalt],
-  envHalt: env.RUN_ENGINE_SNAPSHOT_STORE_HALT === "1",
 });
 
 const DEFAULT_CACHE_MAX = 10_000;
 
@@ -179,4 +179,17 @@ describe("assertSnapshotStoreBoot", () => {
     const d = deps({ mode: "off", hostConfigured: false, completedTtlMs: 0, orphanAgeMs: -1 });
     await expect(assertSnapshotStoreBoot(d)).resolves.toBeUndefined();
   });
+  it("refuses to start when the retired halt environment variable still asks for a halt", async () => {
+    // Fail loud. The variable no longer does anything, so leaving it set means an operator believes
+    // the mirror is stopped when it is running.
+    const d = deps({ legacyEnvHalt: true });
+    await expect(assertSnapshotStoreBoot(d)).rejects.toThrow(/snapshotStoreHalt/i);
+  });
+
+  it("ignores the retired variable when it is pinned at its old default", async () => {
+    // "0" carries no intent, and refusing on it would break every deployment that still pins the
+    // old default while asking for nothing.
+    const d = deps({ legacyEnvHalt: false });
+    await expect(assertSnapshotStoreBoot(d)).resolves.toBeUndefined();
+  });
 });
@@ -8,20 +8,21 @@ import { buildSnapshotStoreHaltCheck } from "~/v3/snapshotStoreMode.server";
 
 describe("the snapshot store halt check", () => {
   it("is not halted by default", () => {
-    expect(buildSnapshotStoreHaltCheck({ flag: () => undefined, envHalt: false })()).toBe(false);
-    expect(buildSnapshotStoreHaltCheck({ flag: () => false, envHalt: false })()).toBe(false);
+    expect(buildSnapshotStoreHaltCheck({ flag: () => undefined })()).toBe(false);
+    expect(buildSnapshotStoreHaltCheck({ flag: () => false })()).toBe(false);
   });
 
   it("halts on the flag, so an incident needs no deploy", () => {
-    expect(buildSnapshotStoreHaltCheck({ flag: () => true, envHalt: false })()).toBe(true);
+    expect(buildSnapshotStoreHaltCheck({ flag: () => true })()).toBe(true);
   });
 
-  it("halts on the environment even when the flag registry is cold", () => {
-    expect(buildSnapshotStoreHaltCheck({ flag: () => undefined, envHalt: true })()).toBe(true);
-  });
-
-  it("cannot be un-halted by the flag once the environment holds it", () => {
-    expect(buildSnapshotStoreHaltCheck({ flag: () => false, envHalt: true })()).toBe(true);
+  it("is the flag and nothing else, so it converges in one flag interval", () => {
+    // The environment half is gone on purpose. It converged over a rolling deploy instead of a
+    // flag interval, and during that window a halted process skips a transition while an unhalted
+    // one asserts a head it cannot see, which forks once per process flip per run. A control whose
+    // own convergence manufactures the divergence it exists to stop is not a control.
+    expect(buildSnapshotStoreHaltCheck({ flag: () => false })()).toBe(false);
+    expect(buildSnapshotStoreHaltCheck({ flag: () => true })()).toBe(true);
   });
 });