feat(webapp): bound the active mint list against the configured shard descriptor keys

computeMintShard now intersects the active shard set with routableKeys (the
RUN_OPS_SHARDS descriptor keys), so a stored key with no descriptor is never
minted into and falls back to gen-1. The empty-set check runs first, so an
unconfigured deployment is unchanged. Inert until the gen-2 write path wires in
resolveMintShard.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: d-cs

apps/webapp/app/v3/runOpsMigration/mintShardAssignment.test.ts

@@ -473,3 +473,37 @@ describe("computeMintShard — the global override wins the complete cutover", (
     );
   });
 });
+
+describe("routableKeys bound (the shard descriptor keys this deployment can route)", () => {
+  it("drops an active key that is not routable, so the hash never returns it", () => {
+    // "z" is in the active list but not configured as a descriptor -> only "a" is selectable.
+    const ids = envIds(200);
+    for (const id of ids) {
+      const shard = computeMintShard({ id }, deps({ set: ["a", "z"] }, { routableKeys: ["a"] }));
+      expect(shard).toBe("a");
+    }
+  });
+
+  it("returns new when the active list holds only non-routable keys (fail-safe to gen-1)", () => {
+    expect(
+      computeMintShard({ id: "env_1" }, deps({ set: ["z"] }, { routableKeys: ["a"] }))
+    ).toBe("new");
+  });
+
+  it("rejects a per-org pin to a non-routable key and falls through to the hash", () => {
+    const shard = computeMintShard(
+      { id: "env_1" },
+      deps({ set: ["a", "z"] }, { ...orgFlags({ runOpsMintShard: "z" }), routableKeys: ["a"] })
+    );
+    expect(shard).toBe("a");
+  });
+
+  it("with no routableKeys given, behaviour is unchanged", () => {
+    const ids = envIds(200);
+    for (const id of ids) {
+      const withBound = computeMintShard({ id }, deps({ set: ["a", "b"] }, { routableKeys: ["a", "b"] }));
+      const without = computeMintShard({ id }, deps({ set: ["a", "b"] }));
+      expect(withBound).toBe(without);
+    }
+  });
+});

apps/webapp/app/v3/runOpsMigration/mintShardAssignment.ts

@@ -19,6 +19,10 @@ export type MintShardDeps = {
   nowMs: number;
   graceMs: number;
   orgFeatureFlags: unknown;
+  // The shard keys this deployment can actually route (the RUN_OPS_SHARDS descriptor keys). The
+  // active set is bounded to these, so a stored key with no descriptor is never minted into.
+  // Undefined means "no bound" (today's behaviour).
+  routableKeys?: readonly string[];
   onPinRejected?: (info: { environmentId: string; pin: string; activeSet: string[] }) => void;
   onOverrideRejected?: (info: { override: string; activeSet: string[] }) => void;
 };
@@ -94,7 +98,17 @@ function hrwSelect(environmentId: string, activeSet: string[]): string {
 // would leak the drain the active list performs, and throwing would fail customer triggers
 // whenever a pinned shard drains.
 export function computeMintShard(environment: { id: string }, deps: MintShardDeps): ShardKey {
-  const activeSet = effectiveMintShardSet(deps.resolution, deps.nowMs, deps.graceMs);
+  const rawActiveSet = effectiveMintShardSet(deps.resolution, deps.nowMs, deps.graceMs);
+  // Empty check BEFORE the bound, so an unconfigured deployment returns "new" exactly as today.
+  if (rawActiveSet.length === 0) {
+    return "new";
+  }
+
+  // Bound the active set to the keys this deployment can route. A stored key with no descriptor is
+  // dropped, never minted into. If nothing survives, fall back to gen-1 (fail-safe, never a throw).
+  const activeSet = deps.routableKeys
+    ? rawActiveSet.filter((key) => deps.routableKeys!.includes(key))
+    : rawActiveSet;
   if (activeSet.length === 0) {
     return "new";
   }
@@ -148,6 +162,7 @@ export type ResolveMintShardDeps = {
   ttlMs: number;
   graceMs: number;
   orgFeatureFlags: unknown;
+  routableKeys?: readonly string[];
   onPinRejected?: (info: { environmentId: string; pin: string; activeSet: string[] }) => void;
   onOverrideRejected?: (info: { override: string; activeSet: string[] }) => void;
   onReadFailed?: (error: unknown) => void;
@@ -200,6 +215,7 @@ export async function resolveMintShardWith(
     nowMs: deps.nowMs,
     graceMs: deps.graceMs,
     orgFeatureFlags: deps.orgFeatureFlags,
+    routableKeys: deps.routableKeys,
     onPinRejected: deps.onPinRejected,
     onOverrideRejected: deps.onOverrideRejected,
   });

apps/webapp/app/v3/runOpsMigration/runOpsMintShard.server.ts

@@ -84,6 +84,8 @@ export async function resolveMintShard(environment: {
     ttlMs: env.RUN_OPS_MINT_FLAG_CACHE_TTL_MS,
     graceMs: env.RUN_OPS_MINT_FLIP_GRACE_MS,
     orgFeatureFlags: environment.orgFeatureFlags,
+    // Bound the active list to the shards this deployment can actually route.
+    routableKeys: env.RUN_OPS_SHARDS.map((shard) => shard.key),
     onPinRejected: reportPinRejected,
     onOverrideRejected: reportOverrideRejected,
     onReadFailed: (error) =>