fix(webapp): boundless named limits stay cappable, retirement is race-guarded

The retired-row bounds filter applies only to the anonymous limit/task/
namespace: a boundless named limit is a real, deliberately uncapped row
(referenced without a declaration) that stays visible and cappable, while a
boundless anonymous row is retired and falls through to the live queue row.
Each retirement nulls its row guarded on the read updatedAt, so a concurrent
operator override or re-creating deploy wins and keeps its own engine sync;
engine keys are removed only for rows this deploy actually retired.

Author: matt-aitken

apps/webapp/app/v3/services/concurrencyLimitsSystem.server.ts

@@ -190,20 +190,29 @@ function concurrencyLimitNameFromRow(row: Pick<TaskQueue, "name">): string {
  * queue compiles onto that V2 QUEUE row (the design's zero-gate-cost case). Its
  * derived `task/<id>` name resolves here too, so every declared limit is
  * retrievable and overridable through this one surface. V1 queue rows never
- * match: their limit is queue surface, managed through the queues API.
+ * match: their limit is queue surface, managed through the queues API. Only the
+ * anonymous `limit/task/` namespace requires bounds — a boundless row there is
+ * retired (its inline limit moved onto the task's own queue) and must fall
+ * through to the live queue row — while a boundless NAMED limit is a real,
+ * deliberately uncapped row (referenced without a declaration) that stays
+ * visible and cappable.
  */
 function limitRowsWhere(environment: AuthenticatedEnvironment) {
-  const hasBounds = {
-    OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
-  };
   return {
     runtimeEnvironmentId: environment.id,
     OR: [
-      { role: "LIMIT" as const, ...hasBounds },
+      {
+        role: "LIMIT" as const,
+        OR: [
+          { name: { not: { startsWith: `${LIMIT_QUEUE_PREFIX}task/` } } },
+          { concurrencyLimit: { not: null } },
+          { totalConcurrencyLimit: { not: null } },
+        ],
+      },
       {
         role: "QUEUE" as const,
         concurrencyVersion: "V2" as const,
-        ...hasBounds,
+        OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
       },
     ],
   };
@@ -224,7 +233,11 @@ function findLimitByName(
         runtimeEnvironmentId: environment.id,
         name: `${LIMIT_QUEUE_PREFIX}${name}`,
         role: "LIMIT",
-        OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
+        ...(name.startsWith("task/")
+          ? {
+              OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
+            }
+          : {}),
       },
     }),
     (error) => ({ type: "other" as const, cause: error })

apps/webapp/app/v3/services/createBackgroundWorker.server.ts

@@ -420,33 +420,39 @@ async function retireStaleAnonymousConcurrencyLimitRows(
       name: { in: boundedIn(candidateNames) },
       OR: [{ concurrencyLimit: { not: null } }, { totalConcurrencyLimit: { not: null } }],
     },
-    select: { id: true, name: true },
+    select: { id: true, name: true, updatedAt: true },
   });
   if (staleRows.length === 0) {
     return;
   }
 
-  await prisma.taskQueue.updateMany({
-    where: { id: { in: boundedIn(staleRows.map((row) => row.id)) } },
-    data: {
-      concurrencyLimit: null,
-      concurrencyLimitBase: null,
-      concurrencyLimitOverriddenAt: null,
-      concurrencyLimitOverriddenBy: null,
-      concurrencyLimitOverridePercent: null,
-      totalConcurrencyLimit: null,
-      totalConcurrencyLimitBase: null,
-      totalConcurrencyLimitOverriddenAt: null,
-      totalConcurrencyLimitOverriddenBy: null,
-    },
-  });
-
-  await Promise.allSettled(
-    staleRows.flatMap((row) => [
-      removeQueueConcurrencyLimits(environment, row.name),
-      removeQueueTotalConcurrencyLimits(environment, row.name),
-    ])
-  );
+  /** Each null is guarded on the row's read updatedAt, so a concurrent writer
+   * (an operator override, or another deploy re-creating the limit) wins and
+   * that row is left alone — its own engine sync governs. Engine keys are only
+   * removed for rows this deploy actually retired; a racing limits-surface sync
+   * converges via its freshness re-check against the nulled row. */
+  for (const row of staleRows) {
+    const retired = await prisma.taskQueue.updateMany({
+      where: { id: row.id, updatedAt: row.updatedAt },
+      data: {
+        concurrencyLimit: null,
+        concurrencyLimitBase: null,
+        concurrencyLimitOverriddenAt: null,
+        concurrencyLimitOverriddenBy: null,
+        concurrencyLimitOverridePercent: null,
+        totalConcurrencyLimit: null,
+        totalConcurrencyLimitBase: null,
+        totalConcurrencyLimitOverriddenAt: null,
+        totalConcurrencyLimitOverriddenBy: null,
+      },
+    });
+    if (retired.count > 0) {
+      await Promise.allSettled([
+        removeQueueConcurrencyLimits(environment, row.name),
+        removeQueueTotalConcurrencyLimits(environment, row.name),
+      ]);
+    }
+  }
 }
 
 async function createWorkerTask(

apps/webapp/test/concurrencyLimitsSystem.test.ts

@@ -465,6 +465,41 @@ describe("ConcurrencyLimitsSystem", () => {
     expect(updated.concurrencyLimitOverridePercent).toBeNull();
   });
 
+  postgresTest("an uncapped named limit stays visible and cappable", async ({ prisma }) => {
+    const { authEnv, system, environment } = await seedEnvAndLimit(prisma, { total: 25 });
+
+    /** Deploys materialize referenced-but-undeclared names as uncapped LIMIT
+     * rows; only the anonymous limit/task/ namespace treats boundless as
+     * retired. */
+    await prisma.taskQueue.create({
+      data: {
+        friendlyId: `queue_un${environment.slug}`,
+        name: "limit/acme-api",
+        orderableName: "acme-api",
+        projectId: environment.projectId,
+        runtimeEnvironmentId: environment.id,
+        role: "LIMIT",
+        concurrencyVersion: "V2",
+      },
+    });
+
+    const retrieved = await system.limits.retrieve(authEnv, "acme-api");
+    expect(retrieved.isOk()).toBe(true);
+    if (retrieved.isOk()) {
+      expect(retrieved.value.total.current).toBeNull();
+    }
+
+    const capped = await system.limits.override(authEnv, "acme-api", { total: 5 });
+    expect(capped.isOk()).toBe(true);
+    expect(totalSyncMock).toHaveBeenCalledWith(authEnv, "limit/acme-api", 5);
+
+    const listed = await system.limits.list(authEnv, { page: 1, perPage: 50 });
+    expect(listed.isOk()).toBe(true);
+    if (listed.isOk()) {
+      expect(listed.value.map((item) => item.name)).toContain("acme-api");
+    }
+  });
+
   postgresTest("retrieve misses queue-role rows and unknown names", async ({ prisma }) => {
     const { authEnv, system, environment } = await seedEnvAndLimit(prisma, { total: 25 });