Remove the six labkit rack cohort feature flags

Problem

The six flags below are all default_enabled: true on master and only exist to stage the labkit rack rollout. They are dead controls once the soak finishes, and until they go, spec/support/rate_limiter_labkit_rack_shadow.rb has to force them off for the whole spec suite.

config/feature_flags/beta/rate_limiter_use_labkit_rack_cohort_{1,2,3}.yml
config/feature_flags/beta/rate_limiter_use_labkit_rack_cohort_{1,2,3}_enforce.yml

Split out of Remove the Rack::Attack middleware from the req... (#29543) at @hardikgala's suggestion on Add labkit rack rate-limit request-spec coverage (gitlab-org/gitlab!252185 - merged). The middleware cleanup in Remove the Rack::Attack middleware from the req... (#29543) does not depend on the soak, so keeping the flags there would hold that work back until 19.5 or 19.6.

When

The default-on change shipped in 19.4 (Default-enable the labkit rack cohort flags for... (gitlab-org/gitlab!250401 - merged), merged 2026-08-17, 4f658da34304). Default-enable the labkit rack cohort flags for... (#29540 - closed) says to soak for at least one milestone before removing the flags.

Decided: 19.6. Self-managed only receives the code when 19.4 ships, so the soak runs through 19.5 and removal lands in 19.6. Agreed at standup and confirmed by @nindurkar on 2026-09-03. The ChatOps check confirms GitLab.com only; the calendar soak exists because self-managed cannot be observed directly.

Check all six are still enabled everywhere first:

/chatops gitlab run feature get rate_limiter_use_labkit_rack_cohort_1

Status

Merge request	State
Draft: Remove the six labkit rack cohort featur... (gitlab-org/gitlab!256308)	Draft, held until master reaches 19.6.0-pre
Draft: Remove the dead per-entry cohort metadat... (gitlab-org/gitlab!253719)	Draft, targets the above
Draft: Add Geo/Workhorse-JWT and rejection-path... (gitlab-org/gitlab!253721)	Draft, targets the above

Remove the six labkit rack cohort feature flags (gitlab-org/gitlab!253596 - merged) was the original. It merged into 19.5 by mistake on 2026-09-17 and was reverted in Revert "Merge branch 'hgala/29663-remove-labkit... (gitlab-org/gitlab!256150 - merged). Its review history remains the reference: 15 review threads, all resolved, approved by @ashs2, @sankalp_gl, @nindurkar and @reprazent.

Scope

Line numbers are from master at the time of writing.

• The six YAML files above.
• lib/gitlab/rack_attack/labkit_rate_limit/throttle_registry.rb: shadow_enabled? (:177), enforce_enabled? (:186), flag_basis (:172), and cohorts (:149) if nothing still needs it.
• lib/gitlab/middleware/labkit_rack_rate_limit.rb: three call sites, :97, :124 and :178. The shadow-off, observe and enforce states collapse to enforce-only.
• spec/support/rate_limiter_labkit_rack_shadow.rb: delete. Remove the labkit rack shadow comparison machinery (#29541 - closed) says to keep it until this lands.
• Specs that read the flags or cohorts: spec/requests/rack_attack_headers_spec.rb:212, and the specs Add labkit rack rate-limit request-spec coverage (gitlab-org/gitlab!252185 - merged) adds, which stub cohort_1 and cohort_1_enforce. spec/requests/labkit_rack_rate_limit_fully_enforced_spec.rb also reads cohorts, but Remove the Rack::Attack middleware from the req... (#29543) already covers deleting it, since the safelist is what it tests.

Boundary with Remove the Rack::Attack middleware from the req... (#29543)

Removing the flags makes fully_enforced? (throttle_registry.rb:196) always true. Its two callers are lib/gitlab/rack_attack.rb:125 and the middleware at :97, and the first is the safelist that turns Rack::Attack into a pass-through.

Remove the Rack::Attack middleware from the req... (#29543) already owns removing both safelists, so either:

1. This issue leaves fully_enforced? in place returning true, and Remove the Rack::Attack middleware from the req... (#29543) deletes it with the safelists.
2. This issue deletes fully_enforced? and the safelist too, and Remove the Rack::Attack middleware from the req... (#29543) keeps only the middleware-stack work.

Leaning to 1, since the point of the split is to unblock Remove the Rack::Attack middleware from the req... (#29543) and option 2 hands part of it back. Easy to change if the reviewer prefers otherwise.

Related: Default-enable the labkit rack cohort flags for... (#29540 - closed), Remove the labkit rack shadow comparison machinery (#29541 - closed), Remove the Rack::Attack middleware from the req... (#29543), Add labkit rack rate-limit request-spec coverage (gitlab-org/gitlab!252185 - merged)