Required: the runtime never generates a runId. Multi-tenant
hosts mint ${tenantId}_${uuid} server-side (createRunRouter) so the
runId carries its tenant everywhere it becomes a key (D1 snapshot row,
DO name, R2 segment, grant-list predicate). A generation fallback here
would let any caller that forgets to mint create a bare, tenant-less
run — unreachable by tenant purge and un-ownable by every actor.
Required: the runtime never generates a runId. Multi-tenant hosts mint
${tenantId}_${uuid}server-side (createRunRouter) so the runId carries its tenant everywhere it becomes a key (D1 snapshot row, DO name, R2 segment, grant-list predicate). A generation fallback here would let any caller that forgets to mint create a bare, tenant-less run — unreachable by tenant purge and un-ownable by every actor.