fix(run-ops split): resolve org-membership authz on primary + full split deps for waitpoint detail

Route the org-membership authorization gate through the primary client on the
debug, run-inspector, and idempotency-key-reset routes so it matches the cancel
and replay paths and never authorizes against lagging replica state. Restore the
primary-DB org fallback in the replay action's RBAC scope resolver so the scope
is never resolved without an org during replica lag. Pass the full split-read
deps to WaitpointPresenter on the detail route so a waitpoint resident on the new
run-ops DB resolves the same way it does on the list route.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: d-cs

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.waitpoints.tokens.$waitpointParam/route.tsx

@@ -11,6 +11,12 @@ import { useProject } from "~/hooks/useProject";
 import { findProjectBySlug } from "~/models/project.server";
 import { findEnvironmentBySlug } from "~/models/runtimeEnvironment.server";
 import { WaitpointPresenter } from "~/presenters/v3/WaitpointPresenter.server";
+import {
+  runOpsNewReplicaClient,
+  runOpsLegacyReplica,
+  runOpsSplitReadEnabled,
+  type PrismaClientOrTransaction,
+} from "~/db.server";
 import { requireUserId } from "~/services/session.server";
 import { cn } from "~/utils/cn";
 import { EnvironmentParamSchema, v3WaitpointTokensPath } from "~/utils/pathBuilder";
@@ -45,7 +51,11 @@ export const loader = async ({ request, params }: LoaderFunctionArgs) => {
   }
 
   try {
-    const presenter = new WaitpointPresenter(undefined, undefined, {});
+    const presenter = new WaitpointPresenter(undefined, undefined, {
+      newClient: runOpsNewReplicaClient as unknown as PrismaClientOrTransaction,
+      legacyReplica: runOpsLegacyReplica as unknown as PrismaClientOrTransaction,
+      splitEnabled: runOpsSplitReadEnabled,
+    });
     const result = await presenter.call({
       friendlyId: waitpointParam,
       environmentId: environment.id,

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.$runParam.idempotencyKey.reset.tsx

@@ -1,5 +1,5 @@
 import { type ActionFunction, json } from "@remix-run/node";
-import { $replica, prisma } from "~/db.server";
+import { prisma } from "~/db.server";
 import { jsonWithErrorMessage, jsonWithSuccessMessage } from "~/models/message.server";
 import { logger } from "~/services/logger.server";
 import { requireUserId } from "~/services/session.server";
@@ -31,7 +31,7 @@ export const action: ActionFunction = async ({ request, params }) => {
       return jsonWithErrorMessage({}, request, "Run not found");
     }
 
-    const authorizedProject = await $replica.project.findFirst({
+    const authorizedProject = await prisma.project.findFirst({
       where: { id: taskRun.projectId, organization: { members: { some: { userId } } } },
       select: { id: true },
     });

apps/webapp/app/routes/resources.runs.$runParam.ts

@@ -2,7 +2,7 @@ import { LoaderFunctionArgs } from "@remix-run/server-runtime";
 import { MachinePresetName, prettyPrintPacket, TaskRunError } from "@trigger.dev/core/v3";
 import { typedjson, UseDataFunctionReturn } from "remix-typedjson";
 import { RUNNING_STATUSES } from "~/components/runs/v3/TaskRunStatus";
-import { $replica } from "~/db.server";
+import { $replica, prisma } from "~/db.server";
 import { requireUserId } from "~/services/session.server";
 import { v3RunParamsSchema } from "~/utils/pathBuilder";
 import { machinePresetFromName, machinePresetFromRun } from "~/v3/machinePresets.server";
@@ -82,7 +82,7 @@ export const loader = async ({ request, params }: LoaderFunctionArgs) => {
     throw new Response("Not found", { status: 404 });
   }
 
-  const authorizedProject = await $replica.project.findFirst({
+  const authorizedProject = await prisma.project.findFirst({
     where: { id: run.projectId, organization: { members: { some: { userId } } } },
     select: { id: true },
   });

apps/webapp/app/routes/resources.taskruns.$runParam.debug.ts

@@ -1,7 +1,7 @@
 import { type LoaderFunctionArgs } from "@remix-run/node";
 import { typedjson } from "remix-typedjson";
 import { z } from "zod";
-import { $replica } from "~/db.server";
+import { $replica, prisma } from "~/db.server";
 import { requireUserId } from "~/services/session.server";
 import { marqs } from "~/v3/marqs/index.server";
 import { engine } from "~/v3/runEngine.server";
@@ -42,7 +42,7 @@ export async function loader({ request, params }: LoaderFunctionArgs) {
   // Authorize on the control-plane DB, keyed by the run's project — a non-member (or
   // unresolvable project) is indistinguishable from not-found (both 404), matching the
   // original scoped where.
-  const authorizedProject = await $replica.project.findFirst({
+  const authorizedProject = await prisma.project.findFirst({
     where: { id: run.projectId, organization: { members: { some: { userId } } } },
     select: { id: true },
   });

apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts

@@ -282,7 +282,20 @@ async function resolveRunOrganizationId(runParam: string): Promise<string | null
     return entry.orgId;
   }
 
-  return null;
+  // Replica lag with the buffer entry already drained: the run can exist in the
+  // primary while both lookups above miss. Fall back to the primary so the RBAC
+  // scope is never resolved without an org (which would let the role check run
+  // unscoped under the RBAC plugin). Keyed by friendlyId so routing still applies.
+  const primaryRun = await runStore.findRun(
+    { friendlyId: runParam },
+    { select: { runtimeEnvironmentId: true } },
+    prisma
+  );
+  if (!primaryRun) {
+    return null;
+  }
+  const primaryEnv = await controlPlaneResolver.resolveEnv(primaryRun.runtimeEnvironmentId);
+  return primaryEnv?.organizationId ?? null;
 }
 
 export const action = dashboardAction(