Merge remote-tracking branch 'origin/main' into runops-track3-deforward-fks

# Conflicts:
#	apps/webapp/app/presenters/v3/ApiBatchResultsPresenter.server.ts
#	apps/webapp/app/presenters/v3/WaitpointPresenter.server.ts
#	apps/webapp/test/waitpointPresenter.readthrough.test.ts

Author: d-cs

.server-changes/native-build-server-opt-out.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Make the native build server the default in project build settings. It's now opt-out, stored as a new `disableNativeBuildServer` key. Also clarifies in the UI that build settings apply to GitHub-triggered and native build server deployments.

.server-changes/sso-form-content-type.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Return a clear client error when SSO form submissions use an unsupported content type

apps/webapp/app/env.server.ts

@@ -1781,6 +1781,10 @@ const EnvironmentSchema = z
     RUN_OPS_MINT_ENABLED: BoolEnv.default(false),
     RUN_OPS_MINT_FLAG_CACHE_TTL_MS: z.coerce.number().int().default(30_000),
     RUN_OPS_MINT_FLAG_CACHE_MAX_ENTRIES: z.coerce.number().int().default(10_000),
+    // Deterministic wall-clock cutover after a runOpsMintKind flip. Must exceed the sum
+    // of RUN_OPS_MINT_FLAG_CACHE_TTL_MS and the control-plane cache TTL so every process
+    // (stale or fresh) resolves to the same kind for the whole window. See mintFlipGrace.ts.
+    RUN_OPS_MINT_FLIP_GRACE_MS: z.coerce.number().int().default(90_000),
 
     // Session replication (Postgres → ClickHouse sessions_v1). Shares Redis
     // with the runs replicator for leader locking but has its own slot and

apps/webapp/app/presenters/v3/ApiBatchResultsPresenter.server.ts

@@ -1,5 +1,6 @@
 import type { RunOpsPrismaClient } from "@internal/run-ops-database";
 import type { BatchTaskRunExecutionResult } from "@trigger.dev/core/v3";
+import { ownerEngine } from "@trigger.dev/core/v3/isomorphic";
 import {
   $replica,
   type PrismaClientOrTransaction,
@@ -10,7 +11,6 @@ import {
 import type { TaskRunWithAttempts } from "~/models/taskRun.server";
 import { executionResultForTaskRun } from "~/models/taskRun.server";
 import type { AuthenticatedEnvironment } from "~/services/apiAuth.server";
-import { readThroughRun } from "~/v3/runOpsMigration/readThrough.server";
 import { runStore as defaultRunStore } from "~/v3/runStore.server";
 import { BasePresenter } from "./basePresenter.server";
 
@@ -45,11 +45,14 @@ const memberRunSelect = {
 } as const;
 
 /**
- * Split on: the batch row + its item rows resolve new-run-ops first, then the LEGACY RUN-OPS
- * READ REPLICA ONLY (never the legacy primary — there is no such handle); each member run is
- * hydrated independently via readThroughRun keyed on the member runId, so a batch whose members
- * span migrated + abandoned runs returns the complete reachable set (the batch-spanning-the-line
- * read; the dangling-reference termination gate is a separate, adjacent unit).
+ * Split on: the batch row + its members resolve new-run-ops first, then the LEGACY RUN-OPS READ
+ * REPLICA ONLY (never the legacy primary — there is no such handle). Members hydrate via ONE
+ * grouped read against `newClient` for the whole id set, then ONE grouped read against
+ * `legacyReplica` for just the misses that could still be legacy-resident — the same
+ * residency-partitioned shape as the old per-member read-through, but batched instead of fanned
+ * out one query per member. A batch whose members span migrated + abandoned runs returns the
+ * complete reachable set (the batch-spanning-the-line read; the dangling-reference termination
+ * gate is a separate, adjacent unit).
  *
  * Split off (single-DB / self-host): one passthrough read for the batch row + a single store
  * id-set hydrate for the members — no legacy read, no known-migrated probe, no second connection.
@@ -136,7 +139,7 @@ export class ApiBatchResultsPresenter extends BasePresenter {
   // Split: resolve the batch row new-first then off the legacy READ REPLICA only (a batch id may
   // be cuid or run-ops id, and a cuid-shaped id can still have been backfilled onto NEW, so id-shape
   // residency is not authoritative for the row — the new-first-then-legacy probe is), then
-  // hydrate every member run independently via the per-run read-through primitive.
+  // hydrate every member run in ONE grouped new-then-legacy read.
   async #callSplit(
     friendlyId: string,
     env: AuthenticatedEnvironment
@@ -181,45 +184,35 @@ export class ApiBatchResultsPresenter extends BasePresenter {
       };
     }
 
-    // Per-member fan-out: each member may live on a different DB, so a single nested include cannot
-    // cross the seam. Promise.all preserves batchRun.items order, unchanged from today.
-    const memberResults = await Promise.all(
-      batchRun.items.map(async (item) => {
-        const result = await readThroughRun<TaskRunWithAttempts>({
-          runId: item.taskRunId,
-          environmentId: env.id,
-          readNew: (client) =>
-            client.taskRun.findFirst({
-              // runops-routed-ok: per-member readThrough fan-out
-              where: { id: item.taskRunId },
-              select: memberRunSelect,
-            }) as Promise<TaskRunWithAttempts | null>,
-          readLegacy: (replica) =>
-            replica.taskRun.findFirst({
-              // runops-routed-ok: per-member readThrough fan-out
-              where: { id: item.taskRunId },
-              select: memberRunSelect,
-            }) as Promise<TaskRunWithAttempts | null>,
-          deps: {
-            splitEnabled: true,
-            // Pass the SAME resolved handles the batch row used, so the batch row and its members
-            // never resolve against different DBs. (Letting these fall through to readThroughRun's
-            // own module-level defaults would diverge from the batch read's resolved handles.)
-            newClient,
-            legacyReplica,
-            isPastRetention: this.readThrough?.isPastRetention,
-          },
-        });
+    const taskRunIds = batchRun.items.map((item) => item.taskRunId);
 
-        // not-found / past-retention members are omitted (matches today's drop-undefined behavior);
-        // the dangling-reference termination gate (separate unit) governs whether that's permitted.
-        if (result.source === "not-found" || result.source === "past-retention") {
-          return undefined;
-        }
+    const newRows = (await newClient.taskRun.findMany({
+      where: { id: { in: taskRunIds } },
+      select: memberRunSelect,
+    })) as TaskRunWithAttempts[];
+    const runsById = new Map(newRows.map((run) => [run.id, run]));
 
-        return executionResultForTaskRun(result.value);
-      })
+    // A run-ops id can only live on NEW, so only misses that AREN'T run-ops-shaped are candidates
+    // for the legacy probe — mirrors readThroughRun's per-id "NEW residency skips legacy" rule.
+    const legacyCandidateIds = taskRunIds.filter(
+      (id) => !runsById.has(id) && ownerEngine(id) !== "NEW"
     );
+    if (legacyCandidateIds.length > 0) {
+      const legacyRows = (await legacyReplica.taskRun.findMany({
+        where: { id: { in: legacyCandidateIds } },
+        select: memberRunSelect,
+      })) as TaskRunWithAttempts[];
+      for (const run of legacyRows) {
+        runsById.set(run.id, run);
+      }
+    }
+
+    // not-found members are omitted (matches today's drop-undefined behavior); the
+    // dangling-reference termination gate (separate unit) governs whether that's permitted.
+    const memberResults = batchRun.items.map((item) => {
+      const run = runsById.get(item.taskRunId);
+      return run ? executionResultForTaskRun(run) : undefined;
+    });
 
     return {
       id: batchRun.friendlyId,

apps/webapp/app/presenters/v3/ApiRetrieveRunPresenter.server.ts

@@ -164,17 +164,13 @@ export class ApiRetrieveRunPresenter {
         collect(child.lockedToVersionId);
       }
 
+      const lockedWorkersByVersionId =
+        await controlPlaneResolver.resolveRunLockedWorkersByVersionIds([...distinctVersionIds]);
       const versionById = new Map<string, string | null>(
-        await Promise.all(
-          [...distinctVersionIds].map(
-            async (id) =>
-              [
-                id,
-                (await controlPlaneResolver.resolveRunLockedWorker({ lockedToVersionId: id }))
-                  ?.lockedToVersion?.version ?? null,
-              ] as const
-          )
-        )
+        [...distinctVersionIds].map((id) => [
+          id,
+          lockedWorkersByVersionId.get(id)?.lockedToVersion?.version ?? null,
+        ])
       );
 
       const resolveVersion = (id: string | null): { version: string } | null => {

apps/webapp/app/presenters/v3/WaitpointPresenter.server.ts

@@ -11,6 +11,12 @@ import { waitpointStatusToApiStatus } from "./WaitpointListPresenter.server";
 
 export type WaitpointDetail = NonNullable<Awaited<ReturnType<WaitpointPresenter["call"]>>>;
 
+// Single-sourced display bound for a waitpoint's connected run friendlyIds.
+export const CONNECTED_RUNS_DISPLAY_LIMIT = 5;
+
+// Over-read connection rows on the FK-free dedicated join so danglers don't cost a display slot.
+export const CONNECTED_RUNS_CONNECTION_SCAN_LIMIT = CONNECTED_RUNS_DISPLAY_LIMIT * 5;
+
 export class WaitpointPresenter extends BasePresenter {
   constructor(
     prisma?: PrismaClientOrTransaction,
@@ -56,8 +62,8 @@ export class WaitpointPresenter extends BasePresenter {
 
   // Connected-run friendlyIds gathered across BOTH stores. The run<->waitpoint join co-locates with
   // the RUN (written on the run's DB), so the waitpoint's own store misses a cross-DB connection.
-  // The run-store fans the connection lookup out to both DBs and resolves each run id on its owning
-  // DB (by id-shape residency), so we get the union without joining across the seam.
+  // The run-store fans the connection lookup out to both DBs (bounded there) and resolves each run
+  // id on its owning DB (by id-shape residency), so we get the union without joining across the seam.
   async #connectedRunFriendlyIds(waitpointId: string): Promise<string[]> {
     const runIds = await this.runStore.findWaitpointConnectedRunIds(waitpointId);
     if (runIds.length === 0) {
@@ -66,7 +72,7 @@ export class WaitpointPresenter extends BasePresenter {
     const runs = await this.runStore.findRuns({
       where: { id: { in: runIds } },
       select: { friendlyId: true },
-      take: 5,
+      take: CONNECTED_RUNS_DISPLAY_LIMIT,
     });
     return runs.map((run) => run.friendlyId);
   }

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.settings.integrations/route.tsx

@@ -5,6 +5,7 @@ import { json } from "@remix-run/server-runtime";
 import React, { useCallback, useEffect, useRef, useState } from "react";
 import { typedjson, useTypedFetcher, useTypedLoaderData } from "remix-typedjson";
 import { z } from "zod";
+import { InlineCode } from "~/components/code/InlineCode";
 import { MainHorizontallyCenteredContainer } from "~/components/layout/AppLayout";
 import { Button } from "~/components/primitives/Buttons";
 import { CheckboxWithLabel } from "~/components/primitives/Checkbox";
@@ -130,6 +131,8 @@ const UpdateBuildSettingsFormSchema = z.object({
     .refine((val) => !val || val.length <= 500, {
       message: "Pre-build command must not exceed 500 characters",
     }),
+  // Positive checkbox in the UI ("Use native build server"). It is checked by
+  // default; we store the inverse as `disableNativeBuildServer`.
   useNativeBuildServer: z
     .string()
     .optional()
@@ -177,7 +180,8 @@ export const action = dashboardAction(
       installCommand: installCommand || undefined,
       preBuildCommand: preBuildCommand || undefined,
       triggerConfigFilePath: triggerConfigFilePath || undefined,
-      useNativeBuildServer: useNativeBuildServer,
+      // Native build server is the default, so we only persist the opt-out.
+      disableNativeBuildServer: useNativeBuildServer ? undefined : true,
     });
 
     if (resultOrFail.isErr()) {
@@ -379,6 +383,11 @@ export default function IntegrationsSettingsPage() {
 
               <div>
                 <Header2 spacing>Build settings</Header2>
+                <Hint className="mb-2">
+                  These settings apply to deployments triggered from GitHub and to CLI deployments
+                  run with the <InlineCode variant="extra-small">--native-build-server</InlineCode>{" "}
+                  flag.
+                </Hint>
                 <div className="w-full rounded-sm border border-grid-dimmed p-4">
                   <BuildSettingsForm buildSettings={buildSettings ?? {}} />
                 </div>
@@ -426,21 +435,24 @@ function BuildSettingsForm({ buildSettings }: { buildSettings: BuildSettings })
   const navigation = useNavigation();
 
   const [hasBuildSettingsChanges, setHasBuildSettingsChanges] = useState(false);
+  // The native build server is enabled by default; it's only off when the
+  // project has explicitly opted out via `disableNativeBuildServer`.
+  const nativeBuildServerEnabled = buildSettings?.disableNativeBuildServer !== true;
   const [buildSettingsValues, setBuildSettingsValues] = useState({
     preBuildCommand: buildSettings?.preBuildCommand || "",
     installCommand: buildSettings?.installCommand || "",
     triggerConfigFilePath: buildSettings?.triggerConfigFilePath || "",
-    useNativeBuildServer: buildSettings?.useNativeBuildServer || false,
+    useNativeBuildServer: nativeBuildServerEnabled,
   });
 
   useEffect(() => {
     const hasChanges =
       buildSettingsValues.preBuildCommand !== (buildSettings?.preBuildCommand || "") ||
       buildSettingsValues.installCommand !== (buildSettings?.installCommand || "") ||
       buildSettingsValues.triggerConfigFilePath !== (buildSettings?.triggerConfigFilePath || "") ||
-      buildSettingsValues.useNativeBuildServer !== (buildSettings?.useNativeBuildServer || false);
+      buildSettingsValues.useNativeBuildServer !== nativeBuildServerEnabled;
     setHasBuildSettingsChanges(hasChanges);
-  }, [buildSettingsValues, buildSettings]);
+  }, [buildSettingsValues, buildSettings, nativeBuildServerEnabled]);
 
   const [buildSettingsForm, fields] = useForm({
     id: "update-build-settings",
@@ -529,7 +541,7 @@ function BuildSettingsForm({ buildSettings }: { buildSettings: BuildSettings })
               {...getInputProps(fields.useNativeBuildServer, { type: "checkbox" })}
               label="Use native build server"
               variant="simple/small"
-              defaultChecked={buildSettings?.useNativeBuildServer || false}
+              defaultChecked={nativeBuildServerEnabled}
               onChange={(isChecked) => {
                 setBuildSettingsValues((prev) => ({
                   ...prev,
@@ -538,8 +550,8 @@ function BuildSettingsForm({ buildSettings }: { buildSettings: BuildSettings })
               }}
             />
             <Hint>
-              Native build server builds do not rely on external build providers and will become the
-              default in the future. Version 4.2.0 or newer is required.
+              Native build server builds don't rely on external build providers and are used by
+              default. Requires version 4.2.0 or newer.
             </Hint>
             <FormError id={fields.useNativeBuildServer.errorId}>
               {fields.useNativeBuildServer.errors}

apps/webapp/app/routes/admin.api.v1.feature-flags.ts

@@ -1,8 +1,9 @@
 import type { ActionFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { prisma } from "~/db.server";
+import { env } from "~/env.server";
 import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
-import { makeSetMultipleFlags } from "~/v3/featureFlags.server";
+import { applyGlobalMintKindFlip, makeSetMultipleFlags } from "~/v3/featureFlags.server";
 import { validatePartialFeatureFlags } from "~/v3/featureFlags";
 
 export async function action({ request }: ActionFunctionArgs) {
@@ -24,9 +25,19 @@ export async function action({ request }: ActionFunctionArgs) {
       );
     }
 
-    const featureFlags = validationResult.data;
-    const setMultipleFlags = makeSetMultipleFlags(prisma);
-    const updatedFlags = await setMultipleFlags(featureFlags);
+    // Derived grace-stamp fields are computed server-side; never trust them from the body.
+    const {
+      runOpsMintKindPrev: _ignoredPrev,
+      runOpsMintKindFlippedAt: _ignoredFlippedAt,
+      ...requestedFlags
+    } = validationResult.data;
+
+    // A global mint-kind flip stamps its grace window under a lock (applyGlobalMintKindFlip);
+    // any other flag save writes directly.
+    const updatedFlags =
+      requestedFlags.runOpsMintKind !== undefined
+        ? await applyGlobalMintKindFlip(prisma, requestedFlags, env.RUN_OPS_MINT_FLIP_GRACE_MS)
+        : await makeSetMultipleFlags(prisma)(requestedFlags);
 
     return json({
       success: true,