fix(webapp): retirement removes engine keys before nulling bounds, retired rows leave the dashboard

Engine cleanup runs first and a failure leaves the row bounded so the next
deploy retries, instead of stranding an invisible stale engine limit (worst
case a pause-by-zero) after Postgres already cleared. The Concurrency page
mirrors the limits surface's namespace scoping: boundless anonymous
limit/task rows are retired and hidden while boundless named limits stay
visible as real uncapped rows.

Author: matt-aitken

apps/webapp/app/presenters/v3/QueueListPresenter.server.ts

@@ -87,22 +87,44 @@ function buildQueueListWhere(
 ): Prisma.TaskQueueWhereInput {
   const trimmedQuery = query?.trim();
 
-  return {
+  const common = {
     runtimeEnvironmentId: environmentId,
-    /** Only the dashboard interleaves named limits, and the type filter names queue
-     * shapes, so either condition scopes the list to queue rows; the public queues
-     * API always stays queue-only. */
-    role:
-      includeLimits && !type ? { in: ["QUEUE" as const, "LIMIT" as const] } : ("QUEUE" as const),
-    version: "V2",
+    version: "V2" as const,
     name: trimmedQuery
       ? {
           contains: trimmedQuery,
-          mode: "insensitive",
+          mode: "insensitive" as const,
         }
       : undefined,
     type: type ? typeToDBQueueType[type] : undefined,
   };
+
+  /** Only the dashboard interleaves named limits, and the type filter names queue
+   * shapes, so either condition scopes the list to queue rows; the public queues
+   * API always stays queue-only. Boundless rows in the anonymous limit/task/
+   * namespace are retired (their inline limit moved onto the task's own queue)
+   * and stay hidden; boundless NAMED limits are real uncapped rows and show. */
+  if (includeLimits && !type) {
+    return {
+      ...common,
+      OR: [
+        { role: "QUEUE" as const },
+        {
+          role: "LIMIT" as const,
+          OR: [
+            { name: { not: { startsWith: "limit/task/" } } },
+            { concurrencyLimit: { not: null } },
+            { totalConcurrencyLimit: { not: null } },
+          ],
+        },
+      ],
+    };
+  }
+
+  return {
+    ...common,
+    role: "QUEUE" as const,
+  };
 }
 
 export class QueueListPresenter extends BasePresenter {

apps/webapp/app/v3/services/createBackgroundWorker.server.ts

@@ -426,13 +426,32 @@ async function retireStaleAnonymousConcurrencyLimitRows(
     return;
   }
 
-  /** Each null is guarded on the row's read updatedAt, so a concurrent writer
-   * (an operator override, or another deploy re-creating the limit) wins and
-   * that row is left alone — its own engine sync governs. Engine keys are only
-   * removed for rows this deploy actually retired; a racing limits-surface sync
-   * converges via its freshness re-check against the nulled row. */
+  /** Engine keys go first, and the row's bounds are only nulled once both
+   * removals succeeded: a failed removal leaves the row bounded, so the next
+   * deploy retries the retirement instead of stranding a stale engine limit
+   * (worst case a pause-by-zero) that nothing can see or clear. Each null is
+   * guarded on the row's read updatedAt, so a concurrent writer (an operator
+   * override, or another deploy re-creating the limit) wins and its own engine
+   * sync governs; a racing limits-surface sync converges via its freshness
+   * re-check against the nulled row. */
   for (const row of staleRows) {
-    const retired = await prisma.taskQueue.updateMany({
+    try {
+      await Promise.all([
+        removeQueueConcurrencyLimits(environment, row.name),
+        removeQueueTotalConcurrencyLimits(environment, row.name),
+      ]);
+    } catch (error) {
+      logger.error(
+        "retireStaleAnonymousConcurrencyLimitRows: engine cleanup failed, retrying next deploy",
+        {
+          environmentId: environment.id,
+          queueName: row.name,
+          error,
+        }
+      );
+      continue;
+    }
+    await prisma.taskQueue.updateMany({
       where: { id: row.id, updatedAt: row.updatedAt },
       data: {
         concurrencyLimit: null,
@@ -446,12 +465,6 @@ async function retireStaleAnonymousConcurrencyLimitRows(
         totalConcurrencyLimitOverriddenBy: null,
       },
     });
-    if (retired.count > 0) {
-      await Promise.allSettled([
-        removeQueueConcurrencyLimits(environment, row.name),
-        removeQueueTotalConcurrencyLimits(environment, row.name),
-      ]);
-    }
   }
 }