featureflags

var (
	SnapshotFeatureFlag                 = NewBoolFlag("use-nfs-for-snapshots", env.IsDevelopment())
	TemplateFeatureFlag                 = NewBoolFlag("use-nfs-for-templates", env.IsDevelopment())
	EnableWriteThroughCacheFlag         = NewBoolFlag("write-to-cache-on-writes", false)
	UseNFSCacheForBuildingTemplatesFlag = NewBoolFlag("use-nfs-for-building-templates", env.IsDevelopment())
	CreateStorageCacheSpansFlag         = NewBoolFlag("create-storage-cache-spans", env.IsDevelopment())
	OrchAcceptsCombinedHostFlag         = NewBoolFlag("orch-accepts-combined-host", false)
	WorkspacesEnabledFlag               = NewBoolFlag("workspacesEnabled", false)

	// FsFreezeViaExecFlag freezes the guest rootfs with `fsfreeze -f /` run through
	// the envd exec API before a filesystem-only pause, for guests whose envd
	// predates the native /fsfreeze endpoint. Off = those guests fall back to a
	// plain guest sync (today's behavior). Falls back to sync per-pause if the
	// guest lacks fsfreeze or the freeze fails.
	FsFreezeViaExecFlag = NewBoolFlag("fsfreeze-via-exec", false)

	// FsOnlyResumeAPIFlag accepts memory:false on resume/connect of a
	// memory-inclusive snapshot (an explicit cold-boot rescue). Off = the
	// request is rejected, never silently downgraded to a memory restore.
	FsOnlyResumeAPIFlag = NewBoolFlag("fs-only-resume-api", false)

	// PrebootFsRecoveryFlag runs a jailed filesystem recovery before every cold
	// boot of a rootfs that was not frozen at pause (fs_quiesced absent/false).
	// Separate from FsOnlyResumeAPIFlag because it also changes the behavior of
	// existing filesystem-only cold boots whose pause fell back to sync.
	PrebootFsRecoveryFlag = NewBoolFlag("preboot-fs-recovery", false)

	// StorageSoftDeleteCheckFlag enables reading the storage-index soft-delete
	// tombstone on header load (one extra GCS Attrs on cold load). Off = no overhead.
	StorageSoftDeleteCheckFlag = NewBoolFlag("storage-soft-delete-check", false)
	// StorageSoftDeleteEnforceFlag makes a soft-deleted object fail the read
	// (fail closed) instead of only emitting a metric + log. Requires the check flag.
	StorageSoftDeleteEnforceFlag = NewBoolFlag("storage-soft-delete-enforce", false)

	// UseMemFdFlag asks Firecracker to back guest memory with a memfd and
	// pass the fd over the UFFD socket; the orchestrator then mmaps it
	// directly instead of using process_vm_readv on pause.
	UseMemFdFlag = NewBoolFlag("use-memfd", true)

	// UseSyncWPFlag asks Firecracker (via use_sync_wp on snapshot load) to
	// register guest memory for SYNCHRONOUS userfault write-protect events,
	// which the orchestrator's serve loop resolves, instead of the kernel's
	// in-place WP_ASYNC clears. Foundation for the copy-on-write background
	// memory snapshot. Default off = WP_ASYNC, today's behavior. Enable only
	// where the deployed FC accepts the use_sync_wp field: FC rejects unknown
	// fields on snapshot load, so a mismatch fails the resume loudly.
	UseSyncWPFlag = NewBoolFlag("use-sync-wp", false)

	// InPlaceCheckpointFlag makes Checkpoint pause, snapshot and resume the
	// SAME Firecracker process (in-place) instead of resuming a fresh sandbox
	// from the new build. Only honored for sandboxes resumed with
	// UseSyncWPFlag on: in-place skips the snapshot re-load that re-arms
	// write-protection, so dirty tracking across repeated checkpoints relies
	// on the sync-WP serve loop; resume-fresh stays the fallback for async
	// sandboxes and when this flag is off.
	InPlaceCheckpointFlag = NewBoolFlag("in-place-checkpoint", false)

	// DeferMemoryExportFlag makes the in-place checkpoint export guest
	// memory through the CoW window instead of the synchronous dirty-RAM
	// copy: the dirty set is write-protect-armed while the VM is paused, the
	// guest resumes immediately, and pages are captured in the background
	// (first guest write to an uncaptured page copies the pre-image before
	// the write proceeds). Only takes effect on the in-place path with a
	// sync-WP UFFD backend. When the VM's balloon runs continuous free-page
	// REPORTING, reporting is PAUSED for the window's lifetime (a REMOVE
	// zapping an uncaptured page would export zeros where pause-time content
	// is owed); requires an FC build with /balloon/reporting — pause failures
	// fall back to the synchronous copy. (The synchronous pre-pause
	// free-page-hinting drain settles before the dirty readout and needs no
	// pause.) Default off = today's synchronous copy.
	DeferMemoryExportFlag = NewBoolFlag("defer-memory-export", false)

	// SyncWPTrackerDirtyFlag derives the pause-time dirty set from the
	// orchestrator's page tracker (installs + synchronous WP-fault
	// promotions) instead of Firecracker's GetDirtyMemory pagemap scan,
	// skipping that RPC entirely. Only consulted for sandboxes resumed with
	// UseSyncWPFlag on — under WP_ASYNC the kernel clears protections
	// in-place and the tracker never sees guest writes. Evaluated fresh at
	// each pause, so flipping it off immediately reverts running sandboxes to
	// the pagemap source (kill switch). Burn-in gate before enabling: the
	// dirty-source divergence log (emitted while this flag is off) must
	// show pagemap_only == 0 for sync-WP sandboxes — a nonzero count means
	// the tracker missed a write and would corrupt the snapshot.
	SyncWPTrackerDirtyFlag = NewBoolFlag("sync-wp-tracker-dirty", false)

	// MemfdBackgroundCopyFlag streams the memfd into the snapshot cache on
	// a goroutine so Pause returns as soon as the diff metadata is written.
	// Only takes effect when UseMemFdFlag is also on.
	MemfdBackgroundCopyFlag = NewBoolFlag("memfd-background-copy", true)

	// MemfileDiffDedupFlag enables 4 KiB-page dedup of the memfile diff
	// against the base memfile. bestEffort skips uncached blocks; directIO
	// opens the dedup output with O_DIRECT. The remaining keys budget fetch
	// defragmentation of the deduped diff — fetchRunWindowPages is the
	// uncompressed frame/window size served per backing fetch — see
	// orchestrator block.DedupBudget for semantics (0 = disabled/default).
	MemfileDiffDedupFlag = NewJSONFlag("memfile-diff-dedup", ldvalue.FromJSONMarshal(map[string]any{
		"enabled":                        false,
		"bestEffort":                     false,
		"directIO":                       false,
		"maxFetchWindowsPerBlock":        0,
		"maxPromotedParentPagesPerBlock": 0,
		"maxPagesPerPromotedFrame":       0,
		"blockFaultPct":                  0,
		"fetchRunWindowPages":            0,
	}))

	// MemfdDedupInflightServeFlag lets a resume that overlaps an in-flight
	// memfile dedup serve dirty pages straight from the still-mapped memfd
	// instead of blocking until dedup finishes. It gates both windows: serving
	// via a provisional local header while dedup is still computing the deduped
	// header, and serving during the dedup drain before the compacted diff is
	// ready. Only affects the memfd-dedup path; off restores the prior
	// wait-for-dedup behavior.
	MemfdDedupInflightServeFlag = NewBoolFlag("memfd-dedup-inflight-serve", false)

	// PeerToPeerChunkTransferFlag enables peer-to-peer chunk routing.
	PeerToPeerChunkTransferFlag = NewBoolFlag("peer-to-peer-chunk-transfer", false)
	// PeerToPeerAsyncCheckpointFlag makes Checkpoint upload fire-and-forget instead
	// of synchronous. Only safe to enable after PeerToPeerChunkTransferFlag is ON.
	PeerToPeerAsyncCheckpointFlag = NewBoolFlag("peer-to-peer-async-checkpoint", false)

	// DeferRootfsExportFlag moves the rootfs diff seal (the reflink, which forces a
	// synchronous host->NVMe writeback) off the pause critical path. On the
	// suspend (pause) path, pause() ejects the cache and stops the sandbox, then
	// reflinks the diff in the background — nothing reads the diff until a later
	// resume. On the in-place checkpoint path, pause() swaps a fresh writable
	// cache in, resumes the VM, seals the frozen old cache in the background and
	// folds it back into the writable cache when done. Off by default; falls
	// back to the synchronous export when off or on a non-NBD provider.
	DeferRootfsExportFlag = NewBoolFlag("defer-rootfs-export", false)

	PersistentVolumesFlag           = NewBoolFlag("can-use-persistent-volumes", env.IsDevelopment())
	SandboxLabelBasedSchedulingFlag = NewBoolFlag("sandbox-label-based-scheduling", false)
	FreePageReportingFlag           = NewBoolFlag("free-page-reporting", false)
	FreezeUserCgroupFlag            = NewBoolFlag("freeze-user-cgroup", env.IsDevelopment())
	// FreezeGuestHierarchyFlag selects the hierarchy walk over the static user/pty list,
	// i.e. whether cgroups the customer created anywhere in the tree are frozen before a
	// pause. Default off: it changes which cgroups are stopped, which is a behaviour
	// change on the pause path.
	//
	// Evaluated here rather than in envd because envd has no LaunchDarkly, so the mode
	// travels on the /freeze call. That also means it can be ON at pause and OFF at the
	// following resume, which is why the thaw discovers what is frozen instead of
	// recomputing what should have been.
	FreezeGuestHierarchyFlag = NewBoolFlag("freeze-guest-hierarchy", false)

	// FreezeGuestHierarchyMaxCgroupsFlag bounds one hierarchy sweep. A safety guard, not
	// a performance one -- the walk is breadth-bounded along a 2-deep chain, so a normal
	// guest visits tens. It exists for a pathological or hostile hierarchy, the guest
	// being the threat model, and truncation is reported rather than swallowed.
	//
	// Safe to lower; the THAW's bound (in envd) is separate and must never be lowered,
	// because a thaw that truncates below what a freeze covered strands a guest frozen.
	FreezeGuestHierarchyMaxCgroupsFlag = NewIntFlag("freeze-guest-hierarchy-max-cgroups", 512)

	// CollapseEnvdHeapFlag makes the orchestrator ask envd to collapse its own
	// anonymous heap into 2 MiB hugepages just before pause, reducing the number
	// of distinct frames envd faults on resume. Off by default; rolled out via LD.
	CollapseEnvdHeapFlag = NewBoolFlag("collapse-envd-heap", false)

	// CollapseEnvdHeapTimeoutMsFlag bounds the pre-pause POST /collapse call, in
	// milliseconds. Collapsing migrates envd's scattered heap pages into
	// hugepages, which is heavier than the freeze sysfs write, so it gets a
	// larger, independent budget. Collapse is best-effort: a cut-short run still
	// helps, so this can be tuned per rollout without redeploying. The fallback
	// (returned when LD is unavailable or the flag is unset) is the default.
	CollapseEnvdHeapTimeoutMsFlag = NewIntFlag("collapse-envd-heap-timeout-ms", 10000) // 10s in milliseconds

	// FreezeUserCgroupTimeoutMsFlag bounds the pre-pause freeze call that
	// FreezeUserCgroupFlag enables, in milliseconds. The call waits for the workload's
	// cgroups to actually stop, and quiesce latency is the guest's cost, not ours: a
	// cgroup whose tasks are idle confirms in single-digit milliseconds, one in
	// continuous I/O has been measured taking seconds. The default keeps the historical
	// budget; raise it once the freeze metrics show how often it is the binding
	// constraint. envd is told to confirm within a margin of this, so one knob moves
	// both halves.
	//
	// The value bounds pause latency directly: a sandbox that will not quiesce holds the
	// pause for this long before we give up on it. That is the cost being traded against
	// snapshotting a running workload, and it is why raising it wants evidence.
	//
	// Effective ceiling of 10s. The shared sandbox HTTP client caps every request at that,
	// so a larger value here is silently truncated to it while the failure is still
	// recorded against the value set here. Tracked separately; until it is lifted, a value
	// above 10s buys nothing and makes the timeout metric misleading.
	FreezeUserCgroupTimeoutMsFlag = NewIntFlag("freeze-user-cgroup-timeout-ms", 2000) // 2s in milliseconds

	// VolumeFallbackToUnmatchedNodesFlag allows volume operations to fall back to
	// orchestrator nodes that don't advertise the volume's type label when every
	// labeled node fails with a retryable error. This is a transitional flag for
	// the volume-label migration: once every node is labeled, unlabeled nodes will
	// fail 100% of the time, so this should be turned off and removed afterwards.
	VolumeFallbackToUnmatchedNodesFlag = NewBoolFlag("volume-fallback-to-unmatched-nodes", true)

	// SandboxVolumeLabelBasedSchedulingFlag enables filtering orchestrator nodes
	// based on the volume types required by the sandbox. When enabled, labels
	// like "persistent-volume-type=nfs" are added to the required node labels
	// for sandbox placement.
	SandboxVolumeLabelBasedSchedulingFlag = NewBoolFlag("sandbox-volume-label-based-scheduling", false)

	NetworkTransformRulesFlag = NewBoolFlag("network-transform-rules", env.IsDevelopment())
	MaxNetworkRuleDomains     = NewIntFlag("max-network-rule-domains", 10)

	BYOPProxyEnabledFlag = NewBoolFlag("byop-proxy-enabled", env.IsDevelopment())

	// SandboxIamTokensFlag gates the sandbox IAM workload token configuration
	// (iam.tokens) per team during beta.
	SandboxIamTokensFlag = NewBoolFlag("enable-sandbox-iam-tokens", env.IsDevelopment())

	// CustomerSecretsFlag gates the customer-facing secret management routes
	// per project during rollout. It falls back to off, so a deployment that
	// cannot reach LaunchDarkly keeps the routes dark.
	CustomerSecretsFlag = NewBoolFlag("customer-secrets", false)

	DisableLegacyTeamMutationsFlag = NewBoolFlag("disable-legacy-team-mutations", false)

	// V4HeaderForUncompressedFlag forces the V4 header layout on uncompressed
	// uploads. Independent of compress-config: it changes the header format,
	// not whether data is compressed.
	V4HeaderForUncompressedFlag = NewBoolFlag("v4-header-for-uncompressed", false)

	// HeaderV5WriteFlag makes Pause emit V5 headers. When enabled it also
	// supersedes V4HeaderForUncompressedFlag for uncompressed uploads.
	HeaderV5WriteFlag = NewBoolFlag("header-v5-write", false)

	// ResumeOriginNodeRemapFlag enables repointing a snapshot's origin_node_id to
	// the fallback node a resume timed out on. The node's local cache is warming
	// from the in-progress snapshot pull, so pinning the retry to it avoids
	// re-pulling the snapshot onto yet another node.
	ResumeOriginNodeRemapFlag = NewBoolFlag("resume-origin-node-remap", false)

	// ExpirationIndexHealerFlag enables the API's Redis expiration index healer
	// loop, which re-adds sandboxes missing from the global expiration ZSET
	// (a missing member is never seen by the evictor and would live forever).
	// Checked on every heal tick, so it can be toggled without a redeploy.
	// On by default; acts as a kill switch if a heal pass misbehaves.
	ExpirationIndexHealerFlag = NewBoolFlag("expiration-index-healer", true)

	// BuildEnsureFreeDiskSpace grows the rootfs after build steps and before finalize.
	BuildEnsureFreeDiskSpace = NewBoolFlag("build-ensure-free-disk-space", false)

	// BuildExt4DirIndex keeps the htree directory index that mkfs.ext4 enables by
	// default on the rootfs. Read at mkfs time, so it governs only rootfs images
	// built after the flip.
	BuildExt4DirIndex = NewBoolFlag("build-ext4-dir-index", false)
)

var (
	MaxSandboxesPerNode = NewIntFlag("max-sandboxes-per-node", 200)
	// The LD keys keep the legacy "gcloud-" prefix, but the limits apply to uploads on all storage providers.
	StorageConcurrentUploadLimit  = NewIntFlag("gcloud-concurrent-upload-limit", 8)
	StorageMaxUploadTasks         = NewIntFlag("gcloud-max-tasks", 16)
	ClickhouseBatcherMaxBatchSize = NewIntFlag("clickhouse-batcher-max-batch-size", 1000)
	ClickhouseBatcherMaxDelay     = NewIntFlag("clickhouse-batcher-max-delay", 1000) // 1s in milliseconds
	ClickhouseBatcherQueueSize    = NewIntFlag("clickhouse-batcher-queue-size", 1000)
	BestOfKSampleSize             = NewIntFlag("best-of-k-sample-size", 3)                           // Default K=3
	BestOfKMaxOvercommit          = NewIntFlag("best-of-k-max-overcommit", 400)                      // Default R=4 (stored as percentage, max over-commit ratio)
	BestOfKAlpha                  = NewIntFlag("best-of-k-alpha", 50)                                // Default Alpha=0.5 (stored as percentage for int flag, current usage weight)
	EnvdInitTimeoutMilliseconds   = NewIntFlag("envd-init-request-timeout-milliseconds", 50)         // Timeout for envd init request in milliseconds
	EnvdTimeoutMilliseconds       = NewIntFlag("envd-timeout-milliseconds", envdTimeoutFallbackMs()) // Timeout for waiting for envd on resume; falls back to ENVD_TIMEOUT env var (default 10s)
	// GuestSyncTimeoutMs overrides the mandatory pre-pause guest-sync deadline
	// for filesystem-only snapshots, in milliseconds. 0 (default) derives the
	// timeout from guest RAM; a positive value pins it.
	GuestSyncTimeoutMs = NewIntFlag("guest-sync-timeout-milliseconds", 0)
	// PauseAdmissionGraceMs gates the pause/checkpoint snapshot-admission
	// pre-flight, in milliseconds. Negative (default) disables the pre-flight;
	// 0 probes the parent header's readiness without waiting; a positive value
	// waits up to that long before refusing retryably.
	PauseAdmissionGraceMs = NewIntFlag("pause-admission-grace-milliseconds", -1)
	// PauseRefusalRestoreFlag gates the API-side restore of a retryably
	// refused pause: record kept, routing re-registered, state back to
	// Running. Off (default), a refused pause still ends today's way — the
	// record is removed, the live sandbox is reaped as an orphan shortly
	// after, and the pause endpoint answers today's generic error rather than
	// a 503 whose retry could not succeed.
	PauseRefusalRestoreFlag       = NewBoolFlag("pause-refusal-restore", false)
	MaxCacheWriterConcurrencyFlag = NewIntFlag("max-cache-writer-concurrency", 10)

	// BuildCacheMaxUsagePercentage the maximum percentage of the cache disk storage
	// that can be used before the cache starts evicting items.
	BuildCacheMaxUsagePercentage = NewIntFlag("build-cache-max-usage-percentage", 85)
	BuildProvisionVersion        = NewIntFlag("build-provision-version", 0)

	// NBDConnectionsPerDevice the number of NBD socket connections per device
	NBDConnectionsPerDevice = NewIntFlag("nbd-connections-per-device", 1)

	// NBDAsyncWriteZeroesFlag, when enabled, handles NBD WRITE_ZEROES/TRIM
	// commands in a goroutine instead of inline on the dispatch read loop.
	// Inline handling can stall the read loop via head-of-line blocking on the
	// shared write lock (when a reply writer is blocked on a full socket send
	// buffer), which makes the kernel time out the NBD connection and surfaces
	// as guest I/O errors. Disabled by default.
	NBDAsyncWriteZeroesFlag = NewBoolFlag("nbd-async-write-zeroes", false)

	// MemoryPrefetchMaxFetchWorkers is the maximum number of parallel fetch workers per sandbox for memory prefetching.
	// Fetching is I/O bound so we can have more parallelism.
	MemoryPrefetchMaxFetchWorkers = NewIntFlag("memory-prefetch-max-fetch-workers", 16)

	// MemoryPrefetchMaxCopyWorkers is the maximum number of parallel copy workers per sandbox for memory prefetching.
	// Copy uses uffd syscalls, so we limit parallelism to avoid overwhelming the system.
	MemoryPrefetchMaxCopyWorkers = NewIntFlag("memory-prefetch-max-copy-workers", 8)

	// MemoryPrefetchCoalesceMaxMB caps how many contiguous prefetch blocks are
	// merged into a single source.Slice fetch (in MiB of extent size). 0
	// disables coalescing: every block is fetched individually, matching
	// today's behavior. The copy phase is unaffected either way — it always
	// installs one page at a time, because Userfaultfd.Prefault installs a
	// single page per call.
	MemoryPrefetchCoalesceMaxMB = NewIntFlag("memory-prefetch-coalesce-max-mb", 0)

	// ResumePrefetchSourceFlag selects which trace the resume prefetcher
	// replays:
	//   "init"     — only the build-time / harvested read-hot init trace
	//                (meta.Prefetch.Memory), prefaulted. Preserves today's
	//                behavior, so this is the default and a no-op-equivalent.
	//   "last-cycle" — only the sandbox's own pause diff (the pages the last
	//                resume→pause cycle wrote), derived from the memfile header
	//                and replayed fetch-only.
	//   "both"     — init first (prefaulted), then last-cycle (fetch-only) behind
	//                a barrier, so the large last-cycle fetch stays off the
	//                resume-critical path.
	//   "off"      — kill switch, no resume prefetch.
	// Unknown values fall back to "init".
	ResumePrefetchSourceFlag = NewStringFlag("resume-prefetch-source", "init")

	// ResumeLastCyclePrefetchMaxMiBFlag caps how much of the last-cycle diff a single
	// resume prefetches, in MiB. -1 (the default, negative = no limit per the
	// codebase convention) is uncapped; the recorded diff is small by
	// construction, so this exists to throttle the heavy-churn tail against the
	// shared object-store pool without a redeploy. A non-negative N keeps the
	// first N MiB of blocks in offset order and leaves the rest to demand-fault.
	ResumeLastCyclePrefetchMaxMiBFlag = NewIntFlag("resume-last-cycle-prefetch-max-mib", -1)

	// PauseResumePrefetchHarvestFlag makes the orchestrator, after a pause
	// snapshot is durable, run a throwaway warm resume of the just-written
	// artifact (driven by envd /init, workload frozen, egress denied) to record
	// the resume page-fault trace and turn it into a prefetch mapping. Off by
	// default; the harvest is best-effort and never affects the pause result.
	PauseResumePrefetchHarvestFlag = NewBoolFlag("pause-resume-prefetch-harvest", false)

	// PauseResumePrefetchConsumeFlag controls whether a harvested mapping is
	// persisted into the pause artifact metadata (and therefore replayed on the
	// customer's next resume). When off, the harvest still runs and emits its
	// trace-size metrics but does NOT write the mapping, so resumes are
	// unaffected — letting us validate harvest behaviour with no customer-visible
	// change before enabling prefetch on resume. Off by default.
	PauseResumePrefetchConsumeFlag = NewBoolFlag("pause-resume-prefetch-consume", false)

	// PauseResumePrefetchHarvestTimeoutMsFlag bounds the throwaway harvest resume
	// (slot-hold cap), in milliseconds. The harvest is best-effort: a cut-short
	// run is discarded (the build is simply re-harvested on its next pause), so
	// erring short is cheap. A normal warm harvest completes in a few seconds; the
	// default leaves headroom for a large warm resume to fully drain while keeping
	// the worst-case slot hold modest. Tunable per rollout via LD; the fallback
	// (returned when LD is unavailable or the flag is unset) is the default.
	PauseResumePrefetchHarvestTimeoutMsFlag = NewIntFlag("pause-resume-prefetch-harvest-timeout-ms", 15000) // 15s

	// TCPFirewallMaxConnectionsPerSandbox is the maximum number of concurrent TCP firewall
	// connections allowed per sandbox. Negative means no limit.
	TCPFirewallMaxConnectionsPerSandbox = NewIntFlag("tcpfirewall-max-connections-per-sandbox", -1)

	// SandboxMaxIncomingConnections is the maximum number of concurrent HTTP proxy
	// connections allowed per sandbox. Negative means no limit.
	SandboxMaxIncomingConnections = NewIntFlag("sandbox-max-incoming-connections", -1)

	// BuildBaseRootfsSizeLimitMB is the maximum size of the base rootfs filesystem created from the OCI image, in MB.
	BuildBaseRootfsSizeLimitMB = NewIntFlag("build-base-rootfs-size-limit-mb", 25000)

	// MinAutoResumeTimeoutSeconds is the minimum auto-resume timeout in seconds.
	// This prevents thrashing from very short timeouts.
	MinAutoResumeTimeoutSeconds = NewIntFlag("minimum-autoresume-timeout", 300)

	// BuildReservedDiskSpaceMB is the amount of disk space in MB reserved for root on the guest filesystem.
	// Reserved blocks are only usable by root (uid 0), protecting the guest OS from disk-full conditions.
	BuildReservedDiskSpaceMB = NewIntFlag("build-reserved-disk-space-mb", 256)

	// MaxStartingInstancesPerNode limits concurrent sandbox start/resume operations on a single orchestrator node.
	// Must be > 0.
	MaxStartingInstancesPerNode = NewIntFlag("max-starting-instances-per-node", 3)

	// MaxConcurrentEvictions caps the number of sandbox evictions that can run
	// in parallel per API instance. Excess items remain expired in the store
	// and are picked up by the next eviction tick. Must be > 0; non-positive
	// values are ignored at refresh time.
	MaxConcurrentEvictions = NewIntFlag("max-concurrent-evictions", 256)

	// AutoPauseOverstayBudgetMs is how long the evictor keeps retrying a memory
	// snapshot for an expired auto-pause sandbox the node refuses, counted from
	// the first refusal of the current episode, before it requests a
	// filesystem-only snapshot instead (no memory parent, so it cannot be
	// refused for one). Same sign convention as PauseAdmissionGraceMs:
	// negative = never degrade (retry for as long as the node refuses), 0 = no
	// retries (degrade at the first refusal), positive = the budget. Only ever
	// consulted on a refusal, and refusals only reach the evictor with
	// PauseRefusalRestoreFlag on, so it is inert until that flag is.
	AutoPauseOverstayBudgetMs = NewIntFlag("auto-pause-overstay-budget-milliseconds", 120000)

	// MaxConcurrentSnapshotUpserts limits concurrent UpsertSnapshot calls (pause + snapshot template paths).
	// 0 or negative disables throttling (unlimited concurrency).
	MaxConcurrentSnapshotUpserts = NewIntFlag("max-concurrent-snapshot-upserts", 0)
	// MaxConcurrentSandboxListQueries limits concurrent GetSnapshotsWithCursor calls in the sandbox list path.
	// 0 or negative disables throttling (unlimited concurrency).
	MaxConcurrentSandboxListQueries = NewIntFlag("max-concurrent-sandbox-list-queries", 0)
	// MaxConcurrentSnapshotBuildQueries limits concurrent GetSnapshotBuilds calls (e.g. sandbox delete).
	// 0 or negative disables throttling (unlimited concurrency).
	MaxConcurrentSnapshotBuildQueries = NewIntFlag("max-concurrent-snapshot-build-queries", 0)

	MinChunkerReadSizeKB = NewIntFlag("min-chunker-read-size-kb", 16)

	// MaxParallelBuildReadSegments limits concurrent backing reads within one fragmented build read.
	// 1 or lower keeps the existing serial path.
	MaxParallelBuildReadSegments = NewIntFlag("max-parallel-build-read-segments", 1)
)

var (
	BuildFirecrackerVersion = NewStringFlag("build-firecracker-version", env.GetEnv("DEFAULT_FIRECRACKER_VERSION", DefaultFirecrackerVersion))
	BuildKernelVersion      = NewStringFlag("build-kernel-version", env.GetEnv("DEFAULT_KERNEL_VERSION", DefaultKernelVersion))
	// BuildEnvdVersion selects which staged envd binary a template build bakes
	// into the rootfs — the envd counterpart of BuildKernelVersion /
	// BuildFirecrackerVersion, same default mechanism. "promoted" (the
	// fallback) is the node-local promoted binary; a concrete version id
	// (e.g. v0.7.0, or a git SHA while those age out) selects a staged binary
	// (the flat envd.<id> sibling or the release bucket's <id>/envd layout,
	// see build/core/envd.ResolveBuildBinary). A pinned target that is not
	// staged FAILS the build rather than silently baking a different envd —
	// feature gates key on the baked version, so a silent substitute
	// misgates. The build-site LD context carries template/team, so cohort
	// canaries come for free.
	BuildEnvdVersion = NewStringFlag("build-envd-version", env.GetEnv("DEFAULT_ENVD_VERSION", DefaultEnvdVersion))
	BuildIoEngine    = NewStringFlag("build-io-engine", "Sync")

	// BuildKernelCmdlineArgs supplies extra guest kernel command line parameters at
	// template build time, keyed on team, as a command line fragment:
	//
	//	psi=1
	//	psi=1 nokaslr
	//
	// Empty (the default) is the command line every sandbox has always booted with, so a
	// team that is not targeted is unaffected. Adding a parameter is a flag edit — no
	// orchestrator change and no deploy.
	//
	// Parsed the way the kernel parses a command line: whitespace separates parameters,
	// the first '=' separates a name from its value, and a parameter with no '=' has an
	// empty value. The orchestrator rejects the whole fragment if it sets a parameter it
	// reserves (init, clocksource, root, ip, console, rootflags, panic, reboot, loglevel,
	// quiet — see packages/orchestrator/pkg/sandbox/fc), falling back to the default
	// command line rather than failing the build. The parsed parameters are recorded in
	// the template's metadata and replayed when a filesystem-only snapshot cold-boots, so
	// a snapshot keeps booting the way it was built even if this flag later changes.
	BuildKernelCmdlineArgs = NewStringFlag("build-kernel-cmdline-args", "")

	// EnvdUpgradeTargetFlag drives the resume-time envd live-upgrade.
	// Multivariate string:
	//   "off"        (fallback) — no upgrade; dev has no LD so this is inert & safe.
	//   "promoted"   — track the node-local promoted envd (HOST_ENVD_PATH); upgrade
	//                  whenever it differs from the sandbox's built-with version
	//                  (no per-publish flag edits needed).
	//   "<version>"  — pin a specific staged binary, in either layout beside the
	//                  promoted one: the flat /fc-envd/envd.<version> sibling or
	//                  the release bucket's /fc-envd/<version>/envd directory.
	//                  Release names may carry dots and hyphens (v0.7.0,
	//                  v0.8.0-rc1); legacy git-SHA suffixes keep resolving while
	//                  the old envd.<sha> objects age out.
	// The resume-site LD context carries envd-version/team/template, so %-ramp
	// and cohort canaries come for free. The fallback is env-overridable
	// (ENVD_UPGRADE_TARGET) so it can be exercised where there is no LD (dev),
	// mirroring build-firecracker-version's DEFAULT_FIRECRACKER_VERSION.
	EnvdUpgradeTargetFlag = NewStringFlag("envd-upgrade-target", env.GetEnv("ENVD_UPGRADE_TARGET", "off"))
	// EnvdOfflineUpgradeTargetFlag drives the OFFLINE envd upgrade of a
	// filesystem-only snapshot: at cold-boot resume the rootfs binary is rewritten
	// (jailed debugfs) before the guest boots, reaching envd too old to self-upgrade
	// (< MinEnvdVersionForUpgrade). Same value grammar and resolver as
	// EnvdUpgradeTargetFlag ("off" / "promoted" / "<version>"); a SEPARATE flag so
	// the newer/riskier offline mechanism ramps independently of the live path. The
	// fallback is env-overridable (ENVD_OFFLINE_UPGRADE_TARGET) for dev, where there
	// is no LD. Default off.
	EnvdOfflineUpgradeTargetFlag = NewStringFlag("envd-offline-upgrade-target", env.GetEnv("ENVD_OFFLINE_UPGRADE_TARGET", "off"))
	// FsOnlyResumeCPUModelFlag restricts where a filesystem-only snapshot may be
	// resumed: placement keeps only nodes reporting this CPU model, on top of the
	// build-compatibility rule every sandbox is already subject to. The value is
	// a bare CPU model as /proc/cpuinfo reports it — machineinfo.IceLakeModel is
	// "106" (n2), machineinfo.EmeraldRapidsModel is "207" (n4).
	//
	// Empty (the default) turns the restriction off, leaving filesystem-only
	// snapshots on the cross-generation rule a memory restore uses. A deployment
	// with no LaunchDarkly therefore keeps placing them exactly as before, rather
	// than needing an LD rule to unpin itself. Memory snapshots never read it.
	FsOnlyResumeCPUModelFlag = NewStringFlag("fs-only-resume-cpu-model", "")

	DefaultPersistentVolumeType = NewStringFlag("default-persistent-volume-type", "")
	BuildNodeInfo               = NewJSONFlag("preferred-build-node", ldvalue.Null())
	FirecrackerVersions         = NewJSONFlag("firecracker-versions", ldvalue.FromJSONMarshal(FirecrackerVersionMap))

	// ClickhouseReadEndpointFlag selects which ClickHouse DSN to use for reads.
	// "" (empty) → singular CLICKHOUSE_CONNECTION_STRING (self-managed default).
	// "0", "1", ... → index into CLICKHOUSE_CONNECTION_STRINGS
	ClickhouseReadEndpointFlag = NewStringFlag("clickhouse-read-endpoint", "")

	// ClickhouseWriteFanoutFlag: when false, drop writes to alternate
	// ClickHouse endpoints (CLICKHOUSE_CONNECTION_STRINGS). Default DSN
	// is unaffected.
	ClickhouseWriteFanoutFlag = NewBoolFlag("clickhouse-write-fanout", false)
)

var BlockDriveThrottleConfig = NewJSONFlag("block-drive-throttle-config", ldvalue.FromJSONMarshal(map[string]any{
	"ops":       map[string]any{"bucketSize": -1, "oneTimeBurst": 0, "refillTimeMs": 1000},
	"bandwidth": map[string]any{"bucketSize": -1, "oneTimeBurst": 0, "refillTimeMs": 1000},
}))

var CleanNFSCache = NewJSONFlag("clean-nfs-cache", ldvalue.Null())

var CompressConfigFlag = NewJSONFlag("compress-config", ldvalue.FromJSONMarshal(map[string]any{
	"compressBuilds":     false,
	"compressionType":    "",
	"compressionLevel":   0,
	"frameSizeKB":        0,
	"minPartSizeMB":      0,
	"frameEncodeWorkers": 0,
	"encoderConcurrency": 0,
}))

var FirecrackerVersionMap = map[string]string{
	"v1.10":   DefaultFirecrackerV1_10Version,
	"v1.12":   DefaultFirecrackerV1_12Version,
	"v1.14":   DefaultFirecrackerV1_14Version,
	"v1.14-0": DefaultFirecrackerV1_14_0Version,
}

var FreePageHintingConfig = NewJSONFlag("free-page-hinting-config", ldvalue.Null())

var LogsReadConfigFlag = NewBoolFlag("logs-read-config", logsReadConfigFallback())

var LogsWriteConfigFlag = NewJSONFlag("logs-write-config", ldvalue.Null())

var RateLimitConfigFlag = NewJSONFlag("rate-limit-config", ldvalue.Null())

var ReclaimConfigFlag = NewJSONFlag("guest-pause-reclaim", ldvalue.Null())

var TCPFirewallEgressThrottleConfig = NewJSONFlag("tcpfirewall-egress-throttle-config", ldvalue.FromJSONMarshal(map[string]any{
	"ops":       map[string]any{"bucketSize": -1, "oneTimeBurst": 0, "refillTimeMs": 1000},
	"bandwidth": map[string]any{"bucketSize": -1, "oneTimeBurst": 0, "refillTimeMs": 1000},
}))

var TrackedTemplatesForMetrics = NewJSONFlag("tracked-templates-for-metrics", ldvalue.FromJSONMarshal(defaultTrackedTemplates))