perf(webapp): gate pre-gate idempotency claim by per-org mollifier flag

Addresses Devin's review on PR #3753 (idempotencyKeys.server.ts comment 2026-05-28): when TRIGGER_MOLLIFIER_ENABLED=1 globally during staged rollout, claimOrAwait was issuing a Redis SETNX for every idempotency-keyed trigger — including orgs that had not opted in. Those orgs gain nothing from the claim (the gate always returns pass_through for them, so the buffer is never written to) and PG unique constraint already deduplicates same-key races on the pass-through path.

Wrap the claim block in an additional per-org check using the same in-memory Organization.featureFlags predicate that evaluateGate uses (makeResolveMollifierFlag) — no DB query. Non-opted-in orgs now skip claimOrAwait entirely; opted-in orgs still get the cross-store race coordination.

Regression test added in mollifierClaimResolution.test.ts: with orgFlag=false the concern returns isCached:false with no claim, without calling claimIdempotency at all. The two prior tests now opt the fake org in (organization.featureFlags.mollifierEnabled=true) so they still exercise the resolution branches.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: d-cs

apps/webapp/app/runEngine/concerns/idempotencyKeys.server.ts

@@ -8,8 +8,16 @@ import { shouldIdempotencyKeyBeCleared } from "~/v3/taskStatus";
 import { getMollifierBuffer } from "~/v3/mollifier/mollifierBuffer.server";
 import { findRunByIdWithMollifierFallback } from "~/v3/mollifier/readFallback.server";
 import { claimOrAwait } from "~/v3/mollifier/idempotencyClaim.server";
+import { makeResolveMollifierFlag } from "~/v3/mollifier/mollifierGate.server";
 import type { TraceEventConcern, TriggerTaskRequest } from "../types";
 
+// In-memory per-org mollifier-enabled check, shared with `evaluateGate`
+// (same `Organization.featureFlags` JSON, no DB read). Used to gate the
+// pre-gate claim's Redis round-trip so non-mollifier orgs don't pay it
+// during staged rollout — see the comment above the claim block in
+// handleTriggerRequest.
+const resolveOrgMollifierFlag = makeResolveMollifierFlag();
+
 // Claim ownership context returned to the caller when the
 // IdempotencyKeyConcern won a pre-gate claim. Caller MUST publish the
 // winning runId on pipeline success (`publishClaim`) or release the
@@ -227,7 +235,32 @@ export class IdempotencyKeyConcern {
     // PG-pass-through vs mollify. Skipped for triggerAndWait
     // (resumeParentOnCompletion) — that path bypasses the gate entirely
     // and its existing PG-side dedup is sufficient.
-    if (!request.body.options?.resumeParentOnCompletion) {
+    //
+    // Also gated on the same per-org mollifier flag the gate uses: when
+    // `TRIGGER_MOLLIFIER_ENABLED=1` globally for staged rollout, the buffer
+    // singleton is constructed and `claimOrAwait` would otherwise issue a
+    // Redis SETNX for EVERY idempotency-keyed trigger — including orgs
+    // that haven't opted in. Those orgs never enter the mollify branch
+    // (the gate always returns pass_through for them), so there's no
+    // buffer activity to serialise against; PG's unique constraint
+    // already deduplicates concurrent same-key races. Resolving the org
+    // flag is a pure in-memory read of `Organization.featureFlags` — no
+    // DB query, same predicate the gate uses — keeping the claim's Redis
+    // RTT off the hot path for non-opted-in orgs during incremental
+    // rollout.
+    const claimEligible =
+      !request.body.options?.resumeParentOnCompletion &&
+      (await resolveOrgMollifierFlag({
+        envId: request.environment.id,
+        orgId: request.environment.organizationId,
+        taskId: request.taskId,
+        orgFeatureFlags:
+          ((request.environment.organization?.featureFlags as
+            | Record<string, unknown>
+            | null
+            | undefined) ?? null),
+      }));
+    if (claimEligible) {
       const ttlSeconds = Math.max(
         1,
         Math.min(

apps/webapp/test/mollifierClaimResolution.test.ts

@@ -10,10 +10,18 @@ vi.mock("~/db.server", () => ({ prisma: {}, $replica: {} }));
 // global mollifier buffer (`getMollifierBuffer`), shared by both
 // `claimOrAwait` and `findBufferedRunWithIdempotency`. Control it via a
 // hoisted handle so each test can script the claim/lookup responses.
-const h = vi.hoisted(() => ({ buffer: null as unknown }));
+const h = vi.hoisted(() => ({ buffer: null as unknown, orgFlag: true }));
 vi.mock("~/v3/mollifier/mollifierBuffer.server", () => ({
   getMollifierBuffer: () => h.buffer,
 }));
+// Stub `mollifierGate.server` so loading the concern doesn't drag in
+// `env.server` (which fails to parse without a populated environment in
+// CI). The concern only uses `makeResolveMollifierFlag` to gate the
+// claim; tests flip `h.orgFlag` to cover both opted-in and opted-out
+// orgs without touching real env or feature-flag wiring.
+vi.mock("~/v3/mollifier/mollifierGate.server", () => ({
+  makeResolveMollifierFlag: () => async () => h.orgFlag,
+}));
 
 import type { MollifierBuffer } from "@trigger.dev/redis-worker";
 import { IdempotencyKeyConcern } from "~/runEngine/concerns/idempotencyKeys.server";
@@ -30,7 +38,16 @@ function makeConcern(prisma: { findFirst: () => Promise<unknown> }) {
 function makeRequest(): TriggerTaskRequest {
   return {
     taskId: "my-task",
-    environment: { id: "env_a", organizationId: "org_1" },
+    environment: {
+      id: "env_a",
+      organizationId: "org_1",
+      // The pre-gate claim is gated by the per-org mollifier flag
+      // (mirroring evaluateGate's gating) so non-opted-in orgs don't pay
+      // the Redis SETNX. Tests covering the claim path must opt this
+      // fake org in, otherwise the concern skips claimOrAwait entirely
+      // and the resolution branches under test never run.
+      organization: { featureFlags: { mollifierEnabled: true } },
+    },
     options: {},
     body: { options: { idempotencyKey: "k-1" } },
   } as unknown as TriggerTaskRequest;
@@ -90,4 +107,37 @@ describe("IdempotencyKeyConcern · claim resolution", () => {
       expect(result.run).toBe(winner);
     }
   });
+
+  it("non-opted-in org skips claimOrAwait entirely (no buffer round-trip, no claim held)", async () => {
+    // Regression guard for the per-org gating that keeps the claim's
+    // Redis SETNX off the hot path for orgs that haven't opted into the
+    // mollifier — even when `TRIGGER_MOLLIFIER_ENABLED=1` globally and
+    // the buffer singleton exists. The concern should NOT touch
+    // `claimIdempotency` for these orgs; PG's unique constraint already
+    // deduplicates same-key races on the pass-through path.
+    h.orgFlag = false;
+    const claimIdempotency = vi.fn(async () => ({ kind: "claimed" as const }));
+    const lookupIdempotency = vi.fn(async () => null);
+    h.buffer = {
+      claimIdempotency,
+      lookupIdempotency,
+    } as unknown as MollifierBuffer;
+
+    const findFirst = vi.fn(async () => null);
+    const concern = makeConcern({ findFirst });
+
+    try {
+      const result = await concern.handleTriggerRequest(makeRequest(), undefined);
+      expect(result.isCached).toBe(false);
+      if (result.isCached === false) {
+        // No claim returned — the caller must NOT publish/release.
+        expect(result.claim).toBeUndefined();
+        expect(result.idempotencyKey).toBe("k-1");
+      }
+      // The headline guarantee: zero Redis claim activity for this org.
+      expect(claimIdempotency).not.toHaveBeenCalled();
+    } finally {
+      h.orgFlag = true; // restore for any later tests in this file
+    }
+  });
 });