@cat-factory/app 0.190.1 → 0.192.0

package/app/components/layout/InfraSetupBanner.vue

@@ -22,17 +22,36 @@
 // account that also has no storage — an accepted trade-off (the setting stays reachable from
 // account settings, and the SESSION dismissal re-nags on the next load regardless).
 //
-// Freshness note: `infraSetup` is a server projection recomputed only on snapshot (re)load, so a
-// banner clears on the next board load after the operator configures the area via the deep-link,
-// not the instant the config panel saves.
+// Two KINDS of card share this surface, and the difference drives the dismissal fork:
+//   - a setup gap (`not_defined`) is a stable operator decision, so both dismissals are offered;
+//   - an OUTAGE (`unreachable` — configured, but the reachability watcher's live probe can't reach
+//     it) is a health state, so ONLY the session dismissal is offered. A permanent "don't notify me
+//     again" on a transient failure would let one click silence every future outage, and the outage
+//     that matters is always the next one. `isInfraSetupHealthStatus` (contracts) is the single
+//     definition both this component and the store's re-nag logic key off.
+//
+// BOTH dismissals are keyed by the CLAIM, never by the area alone, because the two cards say
+// different things about the same area: silencing "you haven't configured this" must not also
+// silence the outage card raised after the operator configures it and the provider then dies.
+//
+// Freshness note: a setup gap clears on the next board load after the operator configures the area
+// via the deep-link, not the instant the config panel saves — the projection is recomputed on
+// snapshot (re)load. An OUTAGE is different: it arrives and clears live, pushed as an `infraSetup`
+// event by the watcher and applied by `workspace.patchInfraSetup`.
 import { useLocalStorage } from '@vueuse/core'
 import { computed } from 'vue'
 // The localStorage key holding the permanent per-user dismissals lives in `@cat-factory/contracts`
 // (a dependency-free package the SPA and the e2e suite both import), so the key + shape can't drift
 // between this component and the e2e seed in `backend/internal/e2e/tests/helpers.ts` (`pinWorkspace`).
-import { INFRA_SETUP_DISMISSED_STORAGE_KEY } from '@cat-factory/contracts'
+import {
+  INFRA_SETUP_DISMISSED_STORAGE_KEY,
+  type InfraSetupProbedArea,
+  isInfraSetupHealthStatus,
+  isInfraSetupProbedArea,
+} from '@cat-factory/contracts'
 import type { DropdownMenuItem } from '@nuxt/ui'
-import type { InfraSetupArea } from '~/types/domain'
+import type { InfraSetupArea, InfraSetupStatus } from '~/types/domain'
+import { infraSetupDismissalKey, type InfraSetupCardKind } from '~/utils/infraSetup'
 
 const { t } = useI18n()
 const ui = useUiStore()
@@ -75,6 +94,18 @@ const AREA_META: Record<
   },
 }
 
+// Outage titles are keyed over the PROBED areas only, not over every area: `binaryStorage` has no
+// reachability probe, so an entry for it would be copy that ships in every locale and can never
+// render. Each probed area carries its OWN title rather than interpolating the area name into a
+// shared one — a predicate adjective ("is unreachable") agrees with its subject's gender in most of
+// the locales we ship, so `{area} is unreachable` cannot be translated correctly as one string. The
+// outage BODY and action ARE shared, because neither refers back to the area; each locale's body
+// opens with its own fixed subject noun for exactly that reason.
+const UNREACHABLE_TITLE_KEYS: Record<InfraSetupProbedArea, string> = {
+  agentExecutor: 'layout.infraSetupBanner.agentExecutor.unreachableTitle',
+  ephemeralEnvironments: 'layout.infraSetupBanner.ephemeralEnvironments.unreachableTitle',
+}
+
 // Permanent, per-user dismissals: one shared localStorage record keyed BY user id (so it's
 // scoped to the signed-in user and doesn't leak across accounts on a shared browser). No
 // signed-in user (local/auth-off single-user mode) ⇒ the `local` bucket.
@@ -94,30 +125,64 @@ function dismissPermanently(area: InfraSetupArea) {
   }
 }
 
-const visible = computed<InfraSetupArea[]>(() => {
+/** One rendered card: the area plus which CLAIM it is making about it. */
+interface AreaCard {
+  area: InfraSetupArea
+  /** `outage` for a live-health status — drives the copy, the severity styling and the dismissals. */
+  kind: InfraSetupCardKind
+  /** The failing probe's reason, when this session saw the transition that raised the card. */
+  detail?: string
+}
+
+const visible = computed<AreaCard[]>(() => {
   const status = workspace.infraSetup
   if (!status) return []
-  return AREAS.filter(
-    (area) =>
-      status[area] === 'not_defined' &&
-      !ui.infraSetupSessionDismissed.includes(area) &&
-      !dismissedForUser.value.includes(area),
-  )
+  return AREAS.filter((area) => {
+    const kind = cardKind(status[area])
+    if (!kind) return false
+    // Both dismissals are keyed by the CLAIM, not by the area: silencing "you haven't configured
+    // this" must not also silence "you configured it and it is now down". The permanent dismissal
+    // only ever covers a setup gap (`dismissPermanently` is offered nowhere else).
+    if (ui.infraSetupSessionDismissed.includes(infraSetupDismissalKey(area, kind))) return false
+    return !(kind === 'setup' && dismissedForUser.value.includes(area))
+  }).map((area) => ({
+    area,
+    kind: cardKind(status[area])!,
+    ...(workspace.infraSetupDetails[area] ? { detail: workspace.infraSetupDetails[area] } : {}),
+  }))
 })
 
-// The dismiss dropdown: the product wants the user asked WHICH kind of dismissal on close.
-function dismissMenu(area: InfraSetupArea): DropdownMenuItem[][] {
+/** Which card an area's status raises, or null when it raises none (`configured`/`not_applicable`). */
+function cardKind(status: InfraSetupStatus): InfraSetupCardKind | null {
+  if (isInfraSetupHealthStatus(status)) return 'outage'
+  return status === 'not_defined' ? 'setup' : null
+}
+
+/** The card's title key: the per-area outage title for an outage, else the setup-gap title. */
+function titleKey(card: AreaCard): string {
+  return card.kind === 'outage' && isInfraSetupProbedArea(card.area)
+    ? UNREACHABLE_TITLE_KEYS[card.area]
+    : AREA_META[card.area].titleKey
+}
+
+/**
+ * The dismiss dropdown: the product wants the user asked WHICH kind of dismissal on close. An
+ * outage offers the session option ONLY — see the fork note at the top of this file.
+ */
+function dismissMenu(card: AreaCard): DropdownMenuItem[][] {
+  const session = {
+    label: t('layout.infraSetupBanner.dismiss.session'),
+    icon: 'i-lucide-clock',
+    onSelect: () => ui.dismissInfraSetupForSession(card.area, card.kind),
+  }
+  if (card.kind === 'outage') return [[session]]
   return [
     [
-      {
-        label: t('layout.infraSetupBanner.dismiss.session'),
-        icon: 'i-lucide-clock',
-        onSelect: () => ui.dismissInfraSetupForSession(area),
-      },
+      session,
       {
         label: t('layout.infraSetupBanner.dismiss.permanent'),
         icon: 'i-lucide-bell-off',
-        onSelect: () => dismissPermanently(area),
+        onSelect: () => dismissPermanently(card.area),
       },
     ],
   ]
@@ -135,42 +200,81 @@ function dismissMenu(area: InfraSetupArea): DropdownMenuItem[][] {
       role="status"
       aria-live="polite"
     >
+      <!-- An OUTAGE reads red, a setup gap amber: one is something breaking now, the other is
+           something never switched on, and a reader has to be able to tell at a glance. -->
       <div
-        v-for="area in visible"
-        :key="area"
-        class="pointer-events-auto w-full max-w-3xl rounded-2xl border-2 border-amber-500/70 bg-amber-950/95 p-5 shadow-2xl backdrop-blur"
-        :data-testid="`infra-setup-banner-${area}`"
+        v-for="card in visible"
+        :key="card.area"
+        class="pointer-events-auto w-full max-w-3xl rounded-2xl border-2 p-5 shadow-2xl backdrop-blur"
+        :class="
+          card.kind === 'outage'
+            ? 'border-red-500/70 bg-red-950/95'
+            : 'border-amber-500/70 bg-amber-950/95'
+        "
+        :data-testid="`infra-setup-banner-${card.area}`"
+        :data-infra-status="card.kind === 'outage' ? 'unreachable' : 'not_defined'"
       >
         <div class="flex items-start gap-4">
-          <UIcon :name="AREA_META[area].icon" class="mt-0.5 h-9 w-9 shrink-0 text-amber-400" />
+          <UIcon
+            :name="card.kind === 'outage' ? 'i-lucide-plug-zap' : AREA_META[card.area].icon"
+            class="mt-0.5 h-9 w-9 shrink-0"
+            :class="card.kind === 'outage' ? 'text-red-400' : 'text-amber-400'"
+          />
           <div class="min-w-0 flex-1">
             <div class="flex items-start justify-between gap-3">
-              <h2 class="text-lg font-semibold text-amber-100">
-                {{ t(AREA_META[area].titleKey) }}
+              <h2
+                class="text-lg font-semibold"
+                :class="card.kind === 'outage' ? 'text-red-100' : 'text-amber-100'"
+              >
+                {{ t(titleKey(card)) }}
               </h2>
-              <UDropdownMenu :items="dismissMenu(area)" :content="{ align: 'end' }">
+              <UDropdownMenu :items="dismissMenu(card)" :content="{ align: 'end' }">
                 <UButton
                   color="neutral"
                   variant="ghost"
                   size="xs"
                   icon="i-lucide-x"
                   :aria-label="t('common.close')"
-                  :data-testid="`infra-setup-dismiss-${area}`"
+                  :data-testid="`infra-setup-dismiss-${card.area}`"
                 />
               </UDropdownMenu>
             </div>
-            <p class="mt-1 text-sm text-amber-200/90">
-              {{ t(AREA_META[area].bodyKey) }}
+            <p
+              class="mt-1 text-sm"
+              :class="card.kind === 'outage' ? 'text-red-200/90' : 'text-amber-200/90'"
+            >
+              {{
+                card.kind === 'outage'
+                  ? t('layout.infraSetupBanner.unreachable.body')
+                  : t(AREA_META[card.area].bodyKey)
+              }}
+            </p>
+            <!-- The failing probe's OWN reason, when this session saw the transition that raised the
+                 card: a refused connection, a rejected token and a timeout need different fixes, and
+                 the generic body cannot tell them apart. Absent after a reload (it rides the live
+                 event, never the deduped notification), so it is an addition to the copy above and
+                 never the only thing that explains the card. -->
+            <p
+              v-if="card.detail"
+              class="mt-2 truncate font-mono text-xs text-red-300/80"
+              :title="card.detail"
+              :data-testid="`infra-setup-detail-${card.area}`"
+            >
+              {{ t('layout.infraSetupBanner.unreachable.reason', { detail: card.detail }) }}
             </p>
             <div class="mt-4">
               <UButton
-                color="warning"
+                :color="card.kind === 'outage' ? 'error' : 'warning'"
                 variant="solid"
                 icon="i-lucide-settings"
-                :data-testid="`infra-setup-configure-${area}`"
-                @click="AREA_META[area].onConfigure()"
+                :data-testid="`infra-setup-configure-${card.area}`"
+                @click="AREA_META[card.area].onConfigure()"
               >
-                {{ t(AREA_META[area].actionKey) }}
+                {{
+                  card.kind === 'outage'
+                    ? t('layout.infraSetupBanner.unreachable.action')
+                    : t(AREA_META[card.area].actionKey)
+                }}
               </UButton>
             </div>
           </div>

package/app/components/layout/NotificationsInbox.vue

@@ -88,6 +88,10 @@ const META: Record<Notification['type'], { icon: string; color: Accent }> = {
   // sealed). Not block-scoped; "act" drops the listed stale ciphertexts so they can be re-entered
   // (or restore the previous key to recover them instead).
   key_drift: { icon: 'i-lucide-key-round', color: 'error' },
+  // A configured infrastructure connection stopped answering its live probe. Not block-scoped and
+  // nothing to act on from here — the fix is on the provider's side, and the card clears itself when
+  // the reachability watcher sees it answer again; "act" just marks it read.
+  infra_unreachable: { icon: 'i-lucide-plug-zap', color: 'error' },
 }
 
 // Per-type primary-action label. An exhaustive Record keyed off the notification
@@ -114,6 +118,7 @@ const ACTION_KEYS: Record<Notification['type'], string> = {
   platform_health: 'layout.notifications.action.platform_health',
   budget_paused: 'layout.notifications.action.budget_paused',
   key_drift: 'layout.notifications.action.key_drift',
+  infra_unreachable: 'layout.notifications.action.infra_unreachable',
 }
 
 /** The localized primary-action label for a notification (te()-guarded against a

package/app/components/prReview/PrReviewWindow.vue

@@ -7,6 +7,10 @@
 // findings to a Fixer that commits fixes onto the PR branch), `Post` (publish them as inline PR
 // review comments), or `Finish` (just record the curated selection). Fix/Post act on the
 // selection, so they require at least one selected finding.
+//
+// While the review is still RUNNING it also offers `Resume`, which re-dispatches a review that
+// appears stuck for only the slices that never reported (see `canResume` for why it is always
+// offered rather than gated on an activity heuristic).
 import { computed, ref, watch } from 'vue'
 import { useResultView } from '~/composables/useResultView'
 import { useExecutionStore } from '~/stores/execution'
@@ -208,6 +212,25 @@ async function onResolve(action: PrReviewResolution): Promise<void> {
   await prReview.resolve(id, activeSelectedIds.value, action).catch(() => {})
 }
 
+/**
+ * RESUME a review that appears stuck. Offered throughout the `reviewing` phase — including the
+ * neutral "planning" sub-state, since a wedge is just as possible before a plan is reported as
+ * after — because the whole complaint this answers is that a stuck review had no visible
+ * affordance at all. Deliberately NOT hidden behind a staleness heuristic: `lastActivityAt` freezes
+ * on a long silent turn (a single completion emits no tool call and grows no subagent transcript),
+ * so the platform cannot tell a wedged review from a quiet-but-working one, and hiding the control
+ * until it thinks it can would put it out of reach in exactly the case that motivated it.
+ */
+const canResume = computed(
+  () => status.value === 'reviewing' && !prReview.resuming && access.canExecuteRuns.value,
+)
+
+async function onResume(): Promise<void> {
+  const id = instanceId.value
+  if (!id || !canResume.value) return
+  await prReview.resume(id).catch(() => {})
+}
+
 // Per-finding CHALLENGE: the open finding's id (its inline concern box is showing) + the drafted
 // concern text. Dispatching moves the whole review to `challenging` until the verdict lands.
 const challengeForId = ref<string | null>(null)
@@ -273,7 +296,7 @@ async function onDismiss(id: string): Promise<void> {
           <div
             v-if="planning"
             data-testid="pr-review-planning"
-            class="flex h-full flex-col items-center justify-center gap-2 py-10 text-center text-slate-400"
+            class="flex flex-1 flex-col items-center justify-center gap-2 py-10 text-center text-slate-400"
           >
             <UIcon name="i-lucide-loader-circle" class="h-8 w-8 animate-spin opacity-60" />
             <p class="text-sm text-slate-200">{{ t('prReview.reviewing.planning.title') }}</p>
@@ -395,6 +418,37 @@ async function onDismiss(id: string): Promise<void> {
               </ul>
             </template>
           </div>
+
+          <!-- Nudge a review that looks stuck. Present in BOTH reviewing sub-states, and never
+               gated on a staleness guess: the heartbeat freezes on a long silent turn, so nothing
+               here can tell wedged from quiet-but-working (see `canResume`). Re-reviews only the
+               slices that never reported; the finished ones are re-aggregated from their captured
+               reports. -->
+          <div class="mt-4 border-t border-slate-800 pt-3">
+            <p
+              v-if="prReview.error"
+              data-testid="pr-review-resume-error"
+              class="mb-2 rounded-md bg-rose-500/10 px-3 py-2 text-[12px] text-rose-300"
+            >
+              {{ prReview.error }}
+            </p>
+            <div class="flex items-start justify-between gap-3">
+              <p class="min-w-0 text-[11px] text-slate-500">{{ t('prReview.resume.hint') }}</p>
+              <UButton
+                data-testid="pr-review-resume"
+                size="xs"
+                color="neutral"
+                variant="soft"
+                icon="i-lucide-rotate-ccw"
+                :loading="prReview.resuming"
+                :disabled="!canResume"
+                :title="access.canExecuteRuns.value ? undefined : t('access.noRunExecute')"
+                @click="onResume"
+              >
+                {{ t('prReview.resume.action') }}
+              </UButton>
+            </div>
+          </div>
         </div>
 
         <!-- A resolution is executing: the Fixer is committing / comments are being posted. -->

package/app/components/slack/SlackPanel.vue

@@ -43,6 +43,7 @@ const ROUTABLE = computed<{ type: NotificationType; label: string }[]>(() => [
   { type: 'pr_review_ready', label: t('slack.routable.pr_review_ready') },
   { type: 'initiative', label: t('slack.routable.initiative') },
   { type: 'platform_health', label: t('slack.routable.platform_health') },
+  { type: 'infra_unreachable', label: t('slack.routable.infra_unreachable') },
 ])
 
 /** Notification-role options for a mapped member (drives who gets @-mentioned). */
@@ -75,6 +76,7 @@ const routes = reactive<Record<NotificationType, SlackRoute>>({
   budget_paused: { enabled: false, channel: '' },
   // In-app only (not in ROUTABLE), but the map is exhaustive over the type.
   key_drift: { enabled: false, channel: '' },
+  infra_unreachable: { enabled: false, channel: '' },
 })
 const mentionsEnabled = ref(false)
 // Editable member rows carry a client-only stable `uid` (see `slackMemberMapping`) so

package/app/composables/api/prReview.ts

@@ -3,6 +3,7 @@ import {
   dismissPrReviewFindingContract,
   getPrReviewContract,
   resolvePrReviewContract,
+  resumePrReviewContract,
 } from '@cat-factory/contracts'
 import type { ApiContext } from './context'
 
@@ -32,6 +33,15 @@ export function prReviewApi({ send, ws }: ApiContext) {
         body,
       }),
 
+    // Re-trigger a review stuck mid-`reviewing`: only the slices that never reported are
+    // re-reviewed. No body — the engine derives what to redo from what it observed.
+    resumePrReview: (workspaceId: string, executionId: string) =>
+      send(resumePrReviewContract, {
+        pathPrefix: ws(workspaceId),
+        pathParams: { executionId },
+        body: {},
+      }),
+
     // Dismiss a parked finding entirely (drops it + prunes it from the selection).
     dismissPrReviewFinding: (workspaceId: string, executionId: string, findingId: string) =>
       send(dismissPrReviewFindingContract, {

package/app/composables/useWorkspaceStream.ts

@@ -111,6 +111,12 @@ export function useWorkspaceStream() {
       // inspector's "Test environment creation" control shows the live stage + final
       // outcome in place without a refetch. No board block.
       environmentTest.upsert(event.run)
+    } else if (event.type === 'infraSetup') {
+      // The reachability watcher found a configured infrastructure area dead (or answering again) —
+      // patch that one area so the setup banner appears/clears immediately. A full refresh would
+      // pay the whole snapshot aggregate for a one-field delta, and the projection the snapshot
+      // recomputes already folds the same recorded state.
+      workspace.patchInfraSetup(event.area, event.status, event.detail)
     } else if (event.type === 'notification') {
       // A PR needs a merge decision, a pipeline finished, or CI gave up — patch the
       // inbox + per-block badge in place (resolved ones drop out of the inbox).

package/app/stores/execution.spec.ts

@@ -186,3 +186,90 @@ describe('execution store metrics preservation (live-only rollup)', () => {
     expect(step.metrics?.calls).toBe(5)
   })
 })
+
+// Regression for the optimistic-echo CLOBBER. `upsert`/`hydrate` are monotonic by `rev`, but an
+// action store's echo used to reach into the cached run and assign a step's sub-state directly,
+// comparing nothing — so a slow HTTP response overwrote state the stream had already advanced, and
+// no later event restored it. `echoAfter` closes that by capturing the run's `rev` before the
+// request and re-reading it after.
+//
+// The fork-decision chat is the case that caught it in CI: `chat` emits the one-message `answering`
+// state and then wakes the driver, which appends the reply and emits again. With a canned (no-model)
+// reply the two-message thread routinely lands first, and echoing the response dropped the reply
+// permanently — a parked run emits nothing more.
+describe('execution store echoAfter (optimistic-echo guard)', () => {
+  let store: ReturnType<typeof useExecutionStore>
+  beforeEach(() => {
+    store = useExecutionStore()
+  })
+
+  const run = (rev: number, chat: unknown[]): ExecutionInstance =>
+    ({
+      id: 'e1',
+      blockId: 'b1',
+      rev,
+      currentStep: 0,
+      steps: [{ agentKind: 'coder', forkDecision: { status: 'answering', chat } }],
+    }) as unknown as ExecutionInstance
+
+  const chatOf = () =>
+    (store.getInstance('e1')!.steps[0] as unknown as { forkDecision: { chat: unknown[] } })
+      .forkDecision.chat
+
+  it('applies the echo when nothing newer arrived while the request was in flight', () => {
+    store.hydrate([run(1, ['human'])], 'ws1')
+    return store
+      .echoAfter(
+        'e1',
+        async () => ({ status: 'answering', chat: ['human', 'echoed'] }),
+        (state, instance) => {
+          ;(instance.steps[0] as unknown as { forkDecision: unknown }).forkDecision = state
+        },
+      )
+      .then(() => expect(chatOf()).toEqual(['human', 'echoed']))
+  })
+
+  it('DROPS the echo when the stream delivered a newer revision first', async () => {
+    store.hydrate([run(1, ['human'])], 'ws1')
+    // The driver's reply lands (rev 2, two messages) while the chat POST is still in flight...
+    await store.echoAfter(
+      'e1',
+      async () => {
+        store.upsert(run(2, ['human', 'assistant reply']))
+        return { status: 'answering', chat: ['human'] }
+      },
+      (state, instance) => {
+        ;(instance.steps[0] as unknown as { forkDecision: unknown }).forkDecision = state
+      },
+    )
+    // ...so the one-message response must not put the thread back. Unguarded, this was ['human'],
+    // the reply was gone, and the "thinking…" bubble spun forever.
+    expect(chatOf()).toEqual(['human', 'assistant reply'])
+  })
+
+  it('still returns the response body when the echo is dropped', async () => {
+    store.hydrate([run(1, [])], 'ws1')
+    const returned = await store.echoAfter(
+      'e1',
+      async () => {
+        store.upsert(run(5, ['newer']))
+        return 'body'
+      },
+      () => {
+        throw new Error('apply must not run')
+      },
+    )
+    expect(returned).toBe('body')
+  })
+
+  it('skips the echo for a run the cache does not hold, rather than throwing', async () => {
+    const returned = await store.echoAfter(
+      'missing',
+      async () => 'body',
+      () => {
+        throw new Error('apply must not run')
+      },
+    )
+    expect(returned).toBe('body')
+  })
+})

package/app/stores/execution.ts

@@ -130,6 +130,44 @@ export const useExecutionStore = defineStore('execution', () => {
     } else instances.value.push(instance)
   }
 
+  /**
+   * Run an action that returns a run's authoritative sub-state and apply that state to the cached
+   * run as an OPTIMISTIC ECHO — but only when the event stream has not delivered a newer revision
+   * while the request was in flight.
+   *
+   * WHY THIS EXISTS. {@link upsert} and {@link hydrate} are monotonic by `rev`, so a stale stream
+   * event can never regress a run. An action store's echo bypassed both: it reached into the cached
+   * instance and assigned `step.forkDecision` / `step.prReview` / `step.judge` / `step.followUps`
+   * directly, with nothing comparing revisions. That is a live-push CLOBBER in its optimistic-echo
+   * form, and it loses state that no later event restores.
+   *
+   * The fork-decision chat is the case that caught it. `chat` records the human turn and wakes the
+   * durable driver, which computes the reply and re-parks — two separate emits. With no model wired
+   * the reply is canned, so the driver routinely emits the two-message thread BEFORE the browser has
+   * even processed the HTTP response carrying the one-message `answering` state. Echoing that
+   * response then dropped the reply back off the thread, permanently: the run is parked, so nothing
+   * emits again. It read as a hung "thinking…" bubble to a user and as a flaky spec in CI.
+   *
+   * The guard is the run's own `rev`, captured BEFORE the request and re-read after. Any advance
+   * means the stream has already delivered this write (or something later), so the echo has nothing
+   * left to add and is skipped. Unchanged means the echo is still the freshest thing available,
+   * which is exactly what it is for. Taking the request as a thunk keeps the capture-then-compare
+   * ordering here rather than at four call sites that each have to remember it.
+   */
+  async function echoAfter<T>(
+    executionId: string,
+    send: () => Promise<T>,
+    apply: (state: T, instance: ExecutionInstance) => void,
+  ): Promise<T> {
+    const before = byId.value.get(executionId)
+    const revBefore = before ? revOf(before) : -1
+    const state = await send()
+    const instance = byId.value.get(executionId)
+    if (!instance || revOf(instance) !== revBefore) return state
+    apply(state, instance)
+    return state
+  }
+
   const byId = computed(() => {
     const map = new Map<string, ExecutionInstance>()
     for (const e of instances.value) map.set(e.id, e)
@@ -248,6 +286,7 @@ export const useExecutionStore = defineStore('execution', () => {
     instances,
     hydrate,
     upsert,
+    echoAfter,
     byId,
     getInstance,
     getByBlock,

package/app/stores/followUps.ts

@@ -33,7 +33,7 @@ export const useFollowUpsStore = defineStore('followUps', () => {
     acting.value = next
   }
 
-  /** Run one decide action, reflecting the returned state onto the run's Coder step. */
+  /** Run one decide action, echoing the returned state onto the run's Coder step. */
   async function act(
     executionId: string,
     itemId: string,
@@ -42,13 +42,19 @@ export const useFollowUpsStore = defineStore('followUps', () => {
     error.value = null
     mark(itemId, true)
     try {
-      const state = await call(workspace.requireId())
-      // Reflect the authoritative state immediately (the stream will also echo it).
-      const instance = execution.getInstance(executionId)
-      const step = instance?.steps.find((s) => s.followUps?.enabled)
-      if (step && state && typeof state === 'object') {
-        step.followUps = state as typeof step.followUps
-      }
+      // Echo the authoritative state immediately (the stream also delivers it), but only when the
+      // stream has not already delivered something NEWER — deciding a follow-up can re-arm the run,
+      // so the driver emits while this response is still in flight. See `execution.echoAfter`.
+      await execution.echoAfter(
+        executionId,
+        () => call(workspace.requireId()),
+        (state, instance) => {
+          const step = instance.steps.find((s) => s.followUps?.enabled)
+          if (step && state && typeof state === 'object') {
+            step.followUps = state as typeof step.followUps
+          }
+        },
+      )
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Action failed'
       throw e