@@ -12,6 +12,7 @@ import { invalidateSnapshotStoreOrgMode } from "~/v3/snapshotStoreMode.server";
 import { selectMintBaselineSource, stampMintKindFlip } from "~/v3/runOpsMigration/mintFlipGrace";
 import { flags as getGlobalFlags } from "~/v3/featureFlags.server";
 import {
+  clearedOrgFlagsPreservingLatch,
   FEATURE_FLAG,
   stampSnapshotStoreOrgEverEnabled,
   validatePartialFeatureFlags,
@@ -114,17 +115,33 @@ export async function action({ request, params }: ActionFunctionArgs) {
     body === null ||
     (typeof body === "object" && !Array.isArray(body) && Object.keys(body).length === 0)
   ) {
-    // Clear all flags. No grace stamp (nothing to flip) and no read-then-write race.
-    try {
-      await prisma.organization.update({
+    // Clear all flags, but preserve the one-way per-org residency latch so an ever-enabled org can
+    // never drop out of the census. Locked read-then-write so a concurrent enabling save (which also
+    // takes FOR UPDATE) can't slip a latch in between the read and the wipe.
+    const updated = await prisma.$transaction(async (tx) => {
+      const rows = await tx.$queryRaw<{ featureFlags: unknown }[]>`
+        SELECT "featureFlags" FROM "Organization" WHERE "id" = ${organizationId} FOR UPDATE`;
+
+      if (rows.length === 0) {
+        return false;
+      }
+
+      const preserved = clearedOrgFlagsPreservingLatch(
+        rows[0].featureFlags as Record<string, unknown> | null
+      );
+
+      await tx.organization.update({
         where: { id: organizationId },
-        data: { featureFlags: Prisma.JsonNull },
+        data: {
+          featureFlags: preserved === null ? Prisma.JsonNull : (preserved as Prisma.InputJsonValue),
+        },
       });
-    } catch (e) {
-      if (e instanceof Prisma.PrismaClientKnownRequestError && e.code === "P2025") {
-        throw new Response("Organization not found", { status: 404 });
-      }
-      throw e;
+
+      return true;
+    });
+
+    if (!updated) {
+      throw new Response("Organization not found", { status: 404 });
     }
 
     controlPlaneResolver.invalidateOrganization(organizationId);
 
@@ -309,6 +309,18 @@ export function stampSnapshotStoreOrgEverEnabled(
   return stamped;
 }
 
+/**
+ * The clear-all counterpart to the one-way per-org latch. Returns the blob to write when wiping an
+ * org's flags: `{ snapshotStoreOrgEverEnabled: true }` if the org was ever enabled (so it stays in
+ * the census), else null to wipe everything. Never resurrects a false or absent latch.
+ */
+export function clearedOrgFlagsPreservingLatch(
+  existingFlags: Record<string, unknown> | null | undefined
+): Record<string, unknown> | null {
+  const latched = (existingFlags ?? {})[FEATURE_FLAG.snapshotStoreOrgEverEnabled] === true;
+  return latched ? { [FEATURE_FLAG.snapshotStoreOrgEverEnabled]: true } : null;
+}
+
 /**
  * One-way global latch. Sets snapshotStoreGlobalModeEverEnabled true when the resulting global dial
  * is past `off`, and carries an already-set latch forward so a save back to `off` never clears it.
 
@@ -10,7 +10,7 @@ import { cachedOrgModeFor, NO_OVERRIDE } from "~/v3/snapshotStoreMode.server";
 export type SnapshotStoreOrgCensusClient = {
   organization: {
     findMany(args: {
-      where: { featureFlags: { path: string[]; not: typeof Prisma.DbNull } };
+      where: { OR: Array<{ featureFlags: { path: string[]; not: typeof Prisma.DbNull } }> };
       select: { id: true; featureFlags: true };
     }): Promise<Array<{ id: string; featureFlags: unknown }>>;
   };
@@ -24,12 +24,16 @@ type OrgCensusSnapshot = {
   redisOnly: boolean;
   /** Orgs with any non-off override. */
   cohort: Set<string>;
+  /** Orgs with the one-way per-org residency latch set true (may be off now, or latch-only). */
+  everEnabled: Set<string>;
 };
 
 export type SnapshotStoreOrgCensus = {
   anyOrgReadEnabled(): boolean;
   anyOrgRedisOnly(): boolean;
   isCohortMember(organizationId: string): boolean;
+  /** DEFINITE never-enabled: census loaded AND the org is not in the ever-enabled set. */
+  orgDefinitelyNeverEnabled(organizationId: string): boolean;
   /** Force one load and await it. For tests and boot; the interval drives it in production. */
   refresh(): Promise<void>;
   stop(): void;
@@ -38,17 +42,20 @@ export type SnapshotStoreOrgCensus = {
 /** Classifies each org's blob exactly as the per-org resolver does (via cachedOrgModeFor). */
 function classify(rows: Array<{ id: string; featureFlags: unknown }>): OrgCensusSnapshot {
   const cohort = new Set<string>();
+  const everEnabled = new Set<string>();
   let readEnabled = false;
   let redisOnly = false;
   for (const row of rows) {
     const flags = row.featureFlags as Record<string, unknown> | null | undefined;
+    // Strict: only an explicit true latches, matching stampSnapshotStoreOrgEverEnabled.
+    if (flags?.[FEATURE_FLAG.snapshotStoreOrgEverEnabled] === true) everEnabled.add(row.id);
     const mode = cachedOrgModeFor(flags?.[FEATURE_FLAG.snapshotStoreOrgMode]);
     if (mode === NO_OVERRIDE || mode === "off") continue;
     cohort.add(row.id);
     if (mode === "redis-read" || mode === "redis-only") readEnabled = true;
     if (mode === "redis-only") redisOnly = true;
   }
-  return { readEnabled, redisOnly, cohort };
+  return { readEnabled, redisOnly, cohort, everEnabled };
 }
 
 export function createSnapshotStoreOrgCensus(
@@ -61,12 +68,20 @@ export function createSnapshotStoreOrgCensus(
     intervalMs: opts?.intervalMs ?? env.GLOBAL_FLAGS_RELOAD_INTERVAL_MS,
     autoStart: opts?.autoStart ?? process.env.NODE_ENV !== "test",
     load: async () =>
-      // WHERE bounds transfer to orgs that HAVE the key; cachedOrgModeFor still filters off /
-      // NO_OVERRIDE out of the cohort in code, so classification stays identical to the resolver.
+      // WHERE returns orgs with EITHER key, so an ever-enabled org that is now off (or holds only
+      // the latch after a clear) still returns. Classification stays in code, identical to the resolver.
       classify(
         await client.organization.findMany({
           where: {
-            featureFlags: { path: [FEATURE_FLAG.snapshotStoreOrgMode], not: Prisma.DbNull },
+            OR: [
+              { featureFlags: { path: [FEATURE_FLAG.snapshotStoreOrgMode], not: Prisma.DbNull } },
+              {
+                featureFlags: {
+                  path: [FEATURE_FLAG.snapshotStoreOrgEverEnabled],
+                  not: Prisma.DbNull,
+                },
+              },
+            ],
           },
           select: { id: true, featureFlags: true },
         })
@@ -85,6 +100,12 @@ export function createSnapshotStoreOrgCensus(
     anyOrgReadEnabled: () => registry.current()?.readEnabled ?? true,
     anyOrgRedisOnly: () => registry.current()?.redisOnly ?? false,
     isCohortMember: (organizationId) => registry.current()?.cohort.has(organizationId) ?? false,
+    // FALSE cold/never-loaded: not-definite means the caller (10c) must NOT skip. Only a loaded
+    // census whose ever-enabled set excludes the org yields a definite "never enabled".
+    orgDefinitelyNeverEnabled: (organizationId) => {
+      const snapshot = registry.current();
+      return snapshot ? !snapshot.everEnabled.has(organizationId) : false;
+    },
     refresh: async () => {
       // A failed reload keeps the last-good snapshot; swallow so accessors stay safe.
       try {
 
@@ -91,7 +91,7 @@ describe("snapshot store org census", () => {
     expect(census.isCohortMember("org_a")).toBe(true);
   });
 
-  it("bounds the query to orgs that have the override key present", async () => {
+  it("bounds the query to orgs that have EITHER the mode or the latch key present", async () => {
     const calls: FindManyArgs[] = [];
     const census = createSnapshotStoreOrgCensus(
       {
@@ -106,7 +106,10 @@ describe("snapshot store org census", () => {
     await census.refresh();
 
     expect(calls).toHaveLength(1);
-    expect(calls[0].where.featureFlags.path).toEqual(["snapshotStoreOrgMode"]);
+    expect(calls[0].where.OR.map((clause) => clause.featureFlags.path)).toEqual([
+      ["snapshotStoreOrgMode"],
+      ["snapshotStoreOrgEverEnabled"],
+    ]);
     // The WHERE only bounds rows; classification is unaffected.
     expect(census.isCohortMember("org_a")).toBe(true);
     expect(census.anyOrgRedisOnly()).toBe(true);
@@ -122,3 +125,74 @@ describe("snapshot store org census", () => {
     expect(census.isCohortMember("org_a")).toBe(true);
   });
 });
+
+describe("snapshot store org census — definite ever-enabled set", () => {
+  // A: latched but dialled back to off. B: at redis-read and latched. C: has the mode key but off,
+  // never latched. D: not returned by the query at all.
+  const rows = [
+    {
+      id: "org_a",
+      featureFlags: { snapshotStoreOrgMode: "off", snapshotStoreOrgEverEnabled: true },
+    },
+    {
+      id: "org_b",
+      featureFlags: { snapshotStoreOrgMode: "redis-read", snapshotStoreOrgEverEnabled: true },
+    },
+    { id: "org_c", featureFlags: { snapshotStoreOrgMode: "off" } },
+  ];
+
+  it("marks only orgs outside the ever-enabled set as definitely never enabled", async () => {
+    const census = build(rows);
+
+    await census.refresh();
+
+    expect(census.orgDefinitelyNeverEnabled("org_a")).toBe(false);
+    expect(census.orgDefinitelyNeverEnabled("org_b")).toBe(false);
+    expect(census.orgDefinitelyNeverEnabled("org_c")).toBe(true);
+    // Never returned by the query, so it is not in the set: definitely never enabled.
+    expect(census.orgDefinitelyNeverEnabled("org_d")).toBe(true);
+  });
+
+  it("treats a latched-but-off org as ever-enabled yet outside the read cohort", async () => {
+    const census = build(rows);
+
+    await census.refresh();
+
+    expect(census.orgDefinitelyNeverEnabled("org_a")).toBe(false);
+    expect(census.isCohortMember("org_a")).toBe(false);
+    // org_a is off; only org_b (redis-read) enables reads.
+    expect(census.anyOrgReadEnabled()).toBe(true);
+    expect(census.isCohortMember("org_b")).toBe(true);
+  });
+
+  it("reports nobody as definitely-never before the first load (cold)", () => {
+    const census = build(rows);
+
+    // Deliberately NOT refreshed: not-definite, so the caller must not skip anyone.
+    expect(census.orgDefinitelyNeverEnabled("org_a")).toBe(false);
+    expect(census.orgDefinitelyNeverEnabled("org_c")).toBe(false);
+    expect(census.orgDefinitelyNeverEnabled("org_d")).toBe(false);
+  });
+
+  it("keeps the last-good ever-enabled set when a later load fails", async () => {
+    let calls = 0;
+    const client: SnapshotStoreOrgCensusClient = {
+      organization: {
+        findMany: async () => {
+          calls += 1;
+          if (calls === 1) return rows;
+          throw new Error("control plane unreachable");
+        },
+      },
+    };
+    const census = createSnapshotStoreOrgCensus({ replica: client }, { autoStart: false });
+
+    await census.refresh();
+    expect(census.orgDefinitelyNeverEnabled("org_c")).toBe(true);
+    expect(census.orgDefinitelyNeverEnabled("org_b")).toBe(false);
+
+    await expect(census.refresh()).resolves.toBeUndefined();
+    expect(census.orgDefinitelyNeverEnabled("org_c")).toBe(true);
+    expect(census.orgDefinitelyNeverEnabled("org_b")).toBe(false);
+  });
+});
@@ -1,5 +1,6 @@
 import { describe, expect, it } from "vitest";
 import {
+  clearedOrgFlagsPreservingLatch,
   FEATURE_FLAG,
   stampSnapshotStoreOrgEverEnabled,
   withoutOrgForbiddenSnapshotKeys,
@@ -44,6 +45,24 @@ describe("stampSnapshotStoreOrgEverEnabled (one-way per-org latch)", () => {
   });
 });
 
+describe("clearedOrgFlagsPreservingLatch (clear-all keeps the one-way latch)", () => {
+  it("preserves the latch when the org was ever enabled", () => {
+    expect(clearedOrgFlagsPreservingLatch({ [LATCH]: true, [MODE]: "off" })).toEqual({
+      [LATCH]: true,
+    });
+  });
+
+  it("wipes to null when the org never latched", () => {
+    expect(clearedOrgFlagsPreservingLatch({ [MODE]: "off" })).toBeNull();
+    expect(clearedOrgFlagsPreservingLatch({})).toBeNull();
+    expect(clearedOrgFlagsPreservingLatch(null)).toBeNull();
+  });
+
+  it("never treats a false latch as latched", () => {
+    expect(clearedOrgFlagsPreservingLatch({ [LATCH]: false })).toBeNull();
+  });
+});
+
 describe("orgEverEnabled reader", () => {
   function clientReturning(flags: unknown) {
     return {