fix(webapp): strict boolean kill switch, bound reload interval, cuid bucket test

Author: nicktrn

apps/webapp/app/env.server.ts

@@ -164,10 +164,10 @@ const EnvironmentSchema = z
     COMPUTE_BACKING_MAP: z.string().default("{}"),
     // How often each replica reloads the global flags snapshot from the DB.
     // Sets kill/ramp propagation latency.
-    GLOBAL_FLAGS_RELOAD_INTERVAL_MS: z.coerce.number().int().default(5000),
+    GLOBAL_FLAGS_RELOAD_INTERVAL_MS: z.coerce.number().int().min(1000).default(5000),
     // Max time the first trigger blocks waiting for the initial flags load
     // before falling back to defaults (off = container, the safe direction).
-    GLOBAL_FLAGS_READY_TIMEOUT_MS: z.coerce.number().int().default(5000),
+    GLOBAL_FLAGS_READY_TIMEOUT_MS: z.coerce.number().int().min(0).default(5000),
     WORKER_ENABLED: z.string().default("true"),
     GRACEFUL_SHUTDOWN_TIMEOUT: z.coerce.number().int().default(60000),
     DISABLE_SSE: z.string().optional(),

apps/webapp/app/v3/featureFlags.ts

@@ -30,7 +30,11 @@ export const FeatureFlagCatalog = {
   // globally and per-org (org wins). Defaults to "electric" when unset.
   // "shadow" serves Electric but diffs the native path in the background.
   [FEATURE_FLAG.realtimeBackend]: z.enum(["electric", "native", "shadow"]),
-  [FEATURE_FLAG.computeMigrationEnabled]: z.coerce.boolean(),
+  // Strict z.boolean() (not z.coerce.boolean()): coercion turns the string "false"
+  // into true, which would silently flip this kill switch / per-org exclude the wrong
+  // way if written as a string via the admin PAT route. The admin toggle sends a real
+  // boolean, so this only rejects the dangerous stringified case.
+  [FEATURE_FLAG.computeMigrationEnabled]: z.boolean(),
   [FEATURE_FLAG.computeMigrationFreePercentage]: z.coerce.number().int().min(0).max(100),
   [FEATURE_FLAG.computeMigrationPaidPercentage]: z.coerce.number().int().min(0).max(100),
 };

apps/webapp/test/computeBucket.test.ts

@@ -1,4 +1,5 @@
 import { describe, it, expect } from "vitest";
+import cuid from "cuid";
 import { hashBucket } from "~/utils/computeBucket";
 
 describe("hashBucket", () => {
@@ -25,4 +26,21 @@ describe("hashBucket", () => {
     expect(under10).toBeGreaterThan(700);
     expect(under10).toBeLessThan(1300);
   });
+
+  // Org ids are `@default(cuid())` primary keys (e.g. "cjld2cjxh0000qzrmn831i7rn"),
+  // not the synthetic sequential ids above. cuids share a "c" prefix + timestamp/counter
+  // structure, so verify the hash still spreads *real-shaped* ids evenly across deciles
+  // (so a percentage dial maps to ~that fraction of actual orgs, not just of the id space).
+  it("distributes cuids evenly across all 10 deciles", () => {
+    const ids = Array.from({ length: 20000 }, () => cuid());
+    const counts = new Array(10).fill(0);
+    for (const id of ids) {
+      counts[Math.floor(hashBucket(id) / 10)]++;
+    }
+    // Expected ~2000 per decile; allow a wide band so it isn't flaky.
+    for (const count of counts) {
+      expect(count).toBeGreaterThan(1700);
+      expect(count).toBeLessThan(2300);
+    }
+  });
 });