fix(run-store): let a resolved sub-redis-only run fall back to Postgres under a global redis-only

The read fallback gate refused Postgres whenever the global dial was redis-only,
before checking the run's own resolved mode. Postgres suppression is org-scoped,
so an org held at dual-write or redis-read while the global dial has advanced to
redis-only keeps its whole log in Postgres, yet every read of its runs threw and
the run hung with its data sitting readable in Postgres.

Check the resolved per-run mode first: a run resolved below redis-only falls
back to Postgres, a run resolved to redis-only still refuses, and only an
unresolved run is governed by the global short-circuit. Two tests cover both
directions and fail on the old ordering.

Author: d-cs

internal-packages/run-store/src/taskRunExecutionSnapshotStore.redisOnlyFallback.test.ts

@@ -438,3 +438,33 @@ describe("redis-only fallback resolves a cold run→org cache authoritatively",
     expect(h.delegateTouched).toContain("findLatestExecutionSnapshot");
   });
 });
+
+// An org held BELOW a global redis-only (dual-write / redis-read) keeps all its rows in Postgres,
+// because suppression is org-scoped. The read gate must serve those rows, not refuse them as though
+// the global dial spoke for this run. A resolved per-run answer wins over the global short-circuit.
+describe("a run held below a global redis-only reads from Postgres, never strands", () => {
+  it("resolves to dual-write while the global dial is redis-only, and falls back to Postgres", async () => {
+    const h = harness({
+      globalMode: "redis-only",
+      anyOrgRedisOnly: () => true,
+      readModeFor: (runId) => (runId === "run_held" ? "dual-write" : undefined),
+    });
+
+    const result = await h.decorated.findLatestExecutionSnapshot("run_held", undefined, "env_held");
+    expect(result).toEqual({ id: "pg_fallback" });
+    expect(h.delegateTouched).toContain("findLatestExecutionSnapshot");
+  });
+
+  it("still refuses Postgres for a run that itself resolves to redis-only under a redis-only dial", async () => {
+    const h = harness({
+      globalMode: "redis-only",
+      anyOrgRedisOnly: () => true,
+      readModeFor: (runId) => (runId === "run_ro" ? "redis-only" : undefined),
+    });
+
+    await expect(
+      h.decorated.findLatestExecutionSnapshot("run_ro", undefined, "env_ro")
+    ).rejects.toThrow("redis brownout");
+    expect(h.delegateTouched).not.toContain("findLatestExecutionSnapshot");
+  });
+});

internal-packages/run-store/src/taskRunExecutionSnapshotStore.ts

@@ -1124,21 +1124,23 @@ export class TaskRunExecutionSnapshotStore extends DelegatingRunStore {
    * at `redis-only` throws while everyone else still falls back.
    */
   async #fallbackAllowed(runId?: string, environmentId?: string): Promise<boolean> {
-    // The global dial preserves today's behaviour exactly: at redis-only Postgres holds nothing.
-    if (this.mode === "redis-only") return false;
-
-    // The run's own org from the sync cache, checked BEFORE the census: a run whose org resolves to
-    // redis-only must throw even when anyOrgRedisOnly (a separate, independently-lagging source) has
-    // not yet caught the enable, or the writing-process window strands it. A concrete non-`redis-only`
-    // mode falls back normally, even when some OTHER org is `redis-only`.
+    // A RESOLVED per-run answer is authoritative and wins over the global dial. Postgres suppression
+    // is org-scoped, so an org resolved BELOW redis-only has its whole log in Postgres even when the
+    // GLOBAL dial has advanced to redis-only; refusing the fallback there would strand a run whose
+    // rows are sitting readable in Postgres. A run resolved TO redis-only still refuses (even when
+    // anyOrgRedisOnly has not caught the enable); a concrete non-`redis-only` mode falls back, even
+    // when a DIFFERENT org is `redis-only`. So this check precedes the global short-circuit below.
     if (runId !== undefined) {
       const resolved = this.modeResolver?.readModeFor?.(runId, environmentId);
       if (resolved === "redis-only") return false;
       if (resolved !== undefined) return true;
     }
 
-    // Org unresolved (cold run→org cache, or no runId). If no org is `redis-only`, this run cannot
-    // be either, so Postgres is a valid answer.
+    // Org unresolved (cold run→org cache, or no runId). At a global redis-only we cannot prove
+    // Postgres holds this run, so refuse rather than serve an empty history as though it were real.
+    if (this.mode === "redis-only") return false;
+
+    // If no org is `redis-only`, this run cannot be either, so Postgres is a valid answer.
     if (this.modeResolver?.anyOrgRedisOnly?.() !== true) return true;
 
     // Some org IS redis-only and the sync cache cannot tell if it is this one. Resolve the run's org