Short answer: choose a remote, cached feature flag as the Node.js kill switch for incident response; it can disable a broken logistics import without waiting for a production rollout, while an environment variable remains the hard-off fallback.

Choice Shutdown path Main signal risk Best fit

Environment variable plus restart Edit configuration, then replace processes Mixed versions can report different states One process where restart is accepted recovery

Remote flag with local cache Change one value; workers read cached state A stale cache delays convergence Multiple workers and scheduled jobs

Recommendation: gate admission into the import pipeline with one remote boolean. Cache its last valid value in each worker, and retain a startup environment variable that can force the feature off.

Stop new imports before they create work, leave accepted jobs alone, and alert on the absence of completed results rather than on the flag value. The flag limits damage. The observability signal proves health.…