test: reconcile guards with base-PR production changes

- cancelRun / idempotencyReset NEW-ksuid cases: use a run-ops-shaped friendlyId so the by-friendlyId
  read routes to NEW single-store (the fan-out that masked the fake LEGACY-classifying friendlyId is
  gone; a real NEW run's friendlyId classifies NEW).
- routesBatchGet realtime.v1.batches case: assert the loader now recovers a stale-on-replica batch via
  the owning-primary re-read (reaches streamBatch, 200) instead of a resource-gate 404.

Author: d-cs

apps/webapp/test/routesBatchGetReplicaLag.guard.test.ts

@@ -274,9 +274,11 @@ describe("routes-batch-get callers under a lagging replica", () => {
     }
   );
 
-  // ── realtime.v1.batches loader — findBatchTaskRunByFriendlyId (REPLICA) ─────────────
+  // ── realtime.v1.batches loader — replica miss recovered by the owning-primary re-read ─────────────
+  // The realtime loader re-reads the owning primary on a replica miss (the ShapeStream consumer ignores
+  // x-should-retry, so a 404 here would strand), so a stale-on-replica batch reaches streamBatch.
   heteroRunOpsPostgresTest(
-    "realtime.v1.batches loader: stale-null returns a retryable 404 at the resource gate before streamBatch",
+    "realtime.v1.batches loader: a batch stale on the replica is recovered via the owning-primary re-read (reaches streamBatch, no 404)",
     async ({ prisma14, prisma17 }) => {
       const { router, legacyStore, legacyReplica } = buildLaggingRouter(prisma14, prisma17);
       const suffix = `bget_rt_${seq++}`;
@@ -299,10 +301,11 @@ describe("routes-batch-get callers under a lagging replica", () => {
         context: {} as never,
       })) as Response;
 
+      // Replica was consulted first (the miss)…
       expect(legacyReplica.wasHit("batchTaskRun")).toBe(true);
-      // 404 at the resource gate — the subscription never starts (streamBatch would return a 200 body).
-      expect(res.status).toBe(404);
-      expect(res.headers.get("x-should-retry")).toBe("true");
+      // …then the owning-primary re-read found the live batch, so the subscription starts (streamBatch
+      // returns 200) instead of a resource-gate 404.
+      expect(res.status).toBe(200);
     }
   );
 

internal-packages/run-store/src/runOpsStore.cancelRunReadAfterWrite.replicaLag.test.ts

@@ -192,7 +192,9 @@ describe("run-ops split — cancel-route run lookup vs. a lagging replica (read-
 
       const seed = await seedEnvironment(prisma17, "dedicated", "cancel_new");
       const runId = NEW_RUN_ID; // v1 body → NEW
-      const friendlyId = "run_cancel_new";
+      // friendlyId classifies identically to the id, so a NEW run's friendlyId must be run-ops-shaped
+      // for the by-friendlyId read to route to NEW (single-store; no cross-store fan-out).
+      const friendlyId = `run_${generateRunOpsId()}`;
       await newStore.createRun(
         buildCreateRunInput({
           runId,

internal-packages/run-store/src/runOpsStore.idempotencyResetReadView.replicaLag.test.ts

@@ -194,7 +194,9 @@ describe("run-ops split — idempotency-key reset source-run lookup vs. a laggin
 
       const seed = await seedEnvironment(prisma17, "dedicated", "idem_reset_new");
       const runId = NEW_RUN_ID; // v1 body → NEW
-      const friendlyId = "run_idem_reset_new";
+      // A NEW run's friendlyId must be run-ops-shaped so the by-friendlyId read routes to NEW
+      // (single-store; friendlyId classifies identically to the id).
+      const friendlyId = `run_${generateRunOpsId()}`;
       const idempotencyKey = "user-supplied-key-new";
       await newStore.createRun(
         buildCreateRunInput({