@cat-factory/app 0.190.1 → 0.192.0

package/app/stores/forkDecision.ts

@@ -26,17 +26,20 @@ export const useForkDecisionStore = defineStore('forkDecision', () => {
   const error = ref<string | null>(null)
 
   /**
-   * Reflect an authoritative fork-decision state onto the run's Coder step. A pipeline may
+   * Apply an authoritative fork-decision state to the run's Coder step. A pipeline may
    * carry more than one `coder` step, so target the step this decision is about rather than
    * the first one that happens to hold fork state: prefer the step that is still live
    * (proposing / awaiting the choice / answering), then the current step, and only then fall
-   * back to the first step carrying fork state. The stream corrects any mismatch, but this
-   * keeps the immediate optimistic echo on the right step.
+   * back to the first step carrying fork state.
+   *
+   * Only ever called through {@link ExecutionStore.echoAfter}, which drops the echo when the event
+   * stream already delivered a newer revision — without that guard this assignment silently
+   * regressed the chat thread (see `echoAfter` for the failure it caused).
    */
-  function reflect(executionId: string, state: ForkDecisionStepState | null): void {
-    if (!state) return
-    const instance = execution.getInstance(executionId)
-    if (!instance) return
+  function assign(
+    instance: ReturnType<typeof execution.getInstance> & object,
+    state: ForkDecisionStepState,
+  ): void {
     const isLive = (s: (typeof instance.steps)[number]) =>
       s.agentKind === 'coder' &&
       (s.forkDecision?.status === 'awaiting_choice' ||
@@ -54,8 +57,13 @@ export const useForkDecisionStore = defineStore('forkDecision', () => {
   async function load(executionId: string): Promise<void> {
     error.value = null
     try {
-      const state = await api.getForkDecision(workspace.requireId(), executionId)
-      reflect(executionId, state as ForkDecisionStepState | null)
+      await execution.echoAfter(
+        executionId,
+        () => api.getForkDecision(workspace.requireId(), executionId),
+        (state, instance) => {
+          if (state) assign(instance, state as ForkDecisionStepState)
+        },
+      )
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to load'
     }
@@ -72,8 +80,11 @@ export const useForkDecisionStore = defineStore('forkDecision', () => {
     error.value = null
     choosing.value = true
     try {
-      const state = await api.chooseFork(workspace.requireId(), executionId, choice)
-      reflect(executionId, state as ForkDecisionStepState)
+      await execution.echoAfter(
+        executionId,
+        () => api.chooseFork(workspace.requireId(), executionId, choice),
+        (state, instance) => assign(instance, state as ForkDecisionStepState),
+      )
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to choose'
       throw e
@@ -85,15 +96,24 @@ export const useForkDecisionStore = defineStore('forkDecision', () => {
   /**
    * Send a grounded chat message about the surfaced forks. The reply is computed inline in the
    * durable driver and arrives via the execution stream; the immediate response is the
-   * `answering` state (the human message already appended), which we reflect so the thread shows
-   * the sent turn + a "thinking…" bubble without waiting for the stream.
+   * `answering` state (the human message already appended), echoed so the thread shows the sent
+   * turn + a "thinking…" bubble without waiting for the stream.
+   *
+   * The echo is the RACIEST one in the app and must stay guarded: `chat` emits the one-message
+   * `answering` state and then wakes the driver, which appends the reply and emits again, so with a
+   * canned (no-model) reply the two-message thread frequently reaches the browser first. Applying
+   * this response unconditionally dropped the reply and left the bubble spinning forever, since a
+   * parked run emits nothing more.
    */
   async function chat(executionId: string, text: string): Promise<void> {
     error.value = null
     chatting.value = true
     try {
-      const state = await api.forkChat(workspace.requireId(), executionId, text)
-      reflect(executionId, state as ForkDecisionStepState)
+      await execution.echoAfter(
+        executionId,
+        () => api.forkChat(workspace.requireId(), executionId, text),
+        (state, instance) => assign(instance, state as ForkDecisionStepState),
+      )
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to send message'
       throw e

package/app/stores/judge.ts

@@ -27,13 +27,16 @@ export const useJudgeStore = defineStore('judge', () => {
    * Reflect an authoritative judge state onto the run's judge step. A pipeline may place more
    * than one judge, so target the step this verdict is about rather than the first one holding
    * judge state: prefer the step still awaiting a decision, then the current step, and only then
-   * fall back to the first step carrying judge state. The stream corrects any mismatch; this
-   * keeps the immediate optimistic echo on the right step.
+   * fall back to the first step carrying judge state.
+   *
+   * Only ever called through {@link ExecutionStore.echoAfter}, which drops the echo when the event
+   * stream already delivered a newer revision — a `bounce` re-arms the producing step, so the
+   * driver is emitting fresh state while this response is still in flight.
    */
-  function reflect(executionId: string, state: JudgeStepState | null): void {
-    if (!state) return
-    const instance = execution.getInstance(executionId)
-    if (!instance) return
+  function assign(
+    instance: ReturnType<typeof execution.getInstance> & object,
+    state: JudgeStepState,
+  ): void {
     const current = instance.steps[instance.currentStep]
     const step =
       instance.steps.find((s) => s.judge?.status === 'awaiting_decision') ??
@@ -46,8 +49,13 @@ export const useJudgeStore = defineStore('judge', () => {
   async function load(executionId: string): Promise<void> {
     error.value = null
     try {
-      const state = await api.getJudgeState(workspace.requireId(), executionId)
-      reflect(executionId, state as JudgeStepState | null)
+      await execution.echoAfter(
+        executionId,
+        () => api.getJudgeState(workspace.requireId(), executionId),
+        (state, instance) => {
+          if (state) assign(instance, state as JudgeStepState)
+        },
+      )
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to load'
     }
@@ -66,11 +74,15 @@ export const useJudgeStore = defineStore('judge', () => {
     error.value = null
     resolving.value = true
     try {
-      const state = await api.resolveJudge(workspace.requireId(), executionId, {
-        choice,
-        ...(feedback ? { feedback } : {}),
-      })
-      reflect(executionId, state as JudgeStepState)
+      await execution.echoAfter(
+        executionId,
+        () =>
+          api.resolveJudge(workspace.requireId(), executionId, {
+            choice,
+            ...(feedback ? { feedback } : {}),
+          }),
+        (state, instance) => assign(instance, state as JudgeStepState),
+      )
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to resolve'
       throw e

package/app/stores/prReview.ts

@@ -20,20 +20,30 @@ export const usePrReviewStore = defineStore('prReview', () => {
 
   /** True while a resolve call is in flight (drives the Finish button spinner / disabled state). */
   const resolving = ref(false)
+  /**
+   * True while a RESUME call is in flight. Kept separate from `resolving` rather than folded into
+   * it: a resume acts during the `reviewing` phase and a resolve during `awaiting_selection`, so
+   * sharing one flag would let either action's spinner appear on the other's controls.
+   */
+  const resuming = ref(false)
   /** The last error message from an action, surfaced inline; cleared on the next action. */
   const error = ref<string | null>(null)
 
   /**
-   * Reflect an authoritative PR-review state onto the run's `pr-reviewer` step. A pipeline could
+   * Apply an authoritative PR-review state to the run's `pr-reviewer` step. A pipeline could
    * carry more than one such step, so target the step this review is about: prefer the step that
    * is still awaiting a selection, then the current step, and only then the first step carrying
-   * review state. The stream corrects any mismatch; this keeps the immediate optimistic echo on
-   * the right step.
+   * review state.
+   *
+   * Only ever called through {@link ExecutionStore.echoAfter}, which drops the echo when the event
+   * stream already delivered a newer revision. `resume` needs that guard most: it returns a
+   * `reviewing` state and then the re-dispatched reviewer starts publishing slice reviews, so an
+   * unguarded echo could put the freshly-captured reports back to what the resume saw.
    */
-  function reflect(executionId: string, state: PrReviewStepState | null): void {
-    if (!state) return
-    const instance = execution.getInstance(executionId)
-    if (!instance) return
+  function assign(
+    instance: ReturnType<typeof execution.getInstance> & object,
+    state: PrReviewStepState,
+  ): void {
     const isLive = (s: (typeof instance.steps)[number]) =>
       s.agentKind === 'pr-reviewer' && s.prReview?.status === 'awaiting_selection'
     const current = instance.steps[instance.currentStep]
@@ -48,8 +58,13 @@ export const usePrReviewStore = defineStore('prReview', () => {
   async function load(executionId: string): Promise<void> {
     error.value = null
     try {
-      const state = await api.getPrReview(workspace.requireId(), executionId)
-      reflect(executionId, state as PrReviewStepState | null)
+      await execution.echoAfter(
+        executionId,
+        () => api.getPrReview(workspace.requireId(), executionId),
+        (state, instance) => {
+          if (state) assign(instance, state as PrReviewStepState)
+        },
+      )
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to load'
     }
@@ -69,11 +84,11 @@ export const usePrReviewStore = defineStore('prReview', () => {
     error.value = null
     resolving.value = true
     try {
-      const state = await api.resolvePrReview(workspace.requireId(), executionId, {
-        action,
-        findingIds,
-      })
-      reflect(executionId, state as PrReviewStepState)
+      await execution.echoAfter(
+        executionId,
+        () => api.resolvePrReview(workspace.requireId(), executionId, { action, findingIds }),
+        (state, instance) => assign(instance, state as PrReviewStepState),
+      )
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to resolve review'
       throw e
@@ -82,13 +97,38 @@ export const usePrReviewStore = defineStore('prReview', () => {
     }
   }
 
+  /**
+   * Resume a review stuck mid-`reviewing`: the reviewer is re-dispatched for only the slices that
+   * never reported, and the already-captured reports are fed back in so the finished slices are
+   * re-aggregated rather than re-reviewed. Rejected (409) unless the review is still `reviewing`.
+   */
+  async function resume(executionId: string): Promise<void> {
+    error.value = null
+    resuming.value = true
+    try {
+      await execution.echoAfter(
+        executionId,
+        () => api.resumePrReview(workspace.requireId(), executionId),
+        (state, instance) => assign(instance, state as PrReviewStepState),
+      )
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : 'Failed to resume review'
+      throw e
+    } finally {
+      resuming.value = false
+    }
+  }
+
   /** Dismiss a finding entirely: it's removed from the review (and the selection). Stays parked. */
   async function dismiss(executionId: string, findingId: string): Promise<void> {
     error.value = null
     resolving.value = true
     try {
-      const state = await api.dismissPrReviewFinding(workspace.requireId(), executionId, findingId)
-      reflect(executionId, state as PrReviewStepState)
+      await execution.echoAfter(
+        executionId,
+        () => api.dismissPrReviewFinding(workspace.requireId(), executionId, findingId),
+        (state, instance) => assign(instance, state as PrReviewStepState),
+      )
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to dismiss finding'
       throw e
@@ -110,15 +150,14 @@ export const usePrReviewStore = defineStore('prReview', () => {
     error.value = null
     resolving.value = true
     try {
-      const state = await api.challengePrReviewFinding(
-        workspace.requireId(),
+      await execution.echoAfter(
         executionId,
-        findingId,
-        {
-          question,
-        },
+        () =>
+          api.challengePrReviewFinding(workspace.requireId(), executionId, findingId, {
+            question,
+          }),
+        (state, instance) => assign(instance, state as PrReviewStepState),
       )
-      reflect(executionId, state as PrReviewStepState)
     } catch (e) {
       error.value = e instanceof Error ? e.message : 'Failed to challenge finding'
       throw e
@@ -127,5 +166,5 @@ export const usePrReviewStore = defineStore('prReview', () => {
     }
   }
 
-  return { resolving, error, load, resolve, dismiss, challenge }
+  return { resolving, resuming, error, load, resolve, resume, dismiss, challenge }
 })

package/app/stores/ui/modals.ts

@@ -2,6 +2,11 @@ import { ref } from 'vue'
 import type { DocumentSourceKind, InfraSetupArea, TaskSourceKind } from '~/types/domain'
 import type { InfrastructureTab, ProviderConnectionKind } from '~/types/providerConnections'
 import type { PendingContext } from '~/composables/useContextLinking'
+import {
+  infraSetupDismissalKey,
+  type InfraSetupCardKind,
+  type InfraSetupDismissalKey,
+} from '~/utils/infraSetup'
 import {
   DEFAULT_PROVISION_DEEP_LINK_PARAM,
   DEFAULT_PROVISION_DEEP_LINK_VALUE,
@@ -820,18 +825,35 @@ function createAiOnboardingModals() {
   const aiSetupDismissed = ref(false)
   const aiPresetDismissed = ref(false)
 
-  // Infra-setup banner: per-SESSION dismissals, one flag per area, cleared on workspace switch
-  // exactly like the AI-onboarding flags (a dismissal in one workspace must not suppress the
-  // independent prompt for another). The PERMANENT "don't notify me again" dismissal is per-USER
-  // and persists in localStorage from the banner component; this only covers "hide for now".
-  const infraSetupSessionDismissed = ref<InfraSetupArea[]>([])
-  function dismissInfraSetupForSession(area: InfraSetupArea) {
-    if (!infraSetupSessionDismissed.value.includes(area))
-      infraSetupSessionDismissed.value = [...infraSetupSessionDismissed.value, area]
+  // Infra-setup banner: per-SESSION dismissals, cleared on workspace switch exactly like the
+  // AI-onboarding flags (a dismissal in one workspace must not suppress the independent prompt for
+  // another). The PERMANENT "don't notify me again" dismissal is per-USER and persists in
+  // localStorage from the banner component; this only covers "hide for now".
+  //
+  // Keyed by area AND KIND, not by area alone: the two cards an area can raise are different
+  // claims. Dismissing "you haven't configured this" for the session must not also silence the
+  // OUTAGE card that appears after the operator configures it and the provider then dies — the same
+  // asymmetry that makes the permanent dismissal setup-gap-only, one tier down.
+  const infraSetupSessionDismissed = ref<InfraSetupDismissalKey[]>([])
+  function dismissInfraSetupForSession(area: InfraSetupArea, kind: InfraSetupCardKind) {
+    const key = infraSetupDismissalKey(area, kind)
+    if (!infraSetupSessionDismissed.value.includes(key))
+      infraSetupSessionDismissed.value = [...infraSetupSessionDismissed.value, key]
   }
   function resetInfraSetupDismissals() {
     infraSetupSessionDismissed.value = []
   }
+  /**
+   * Drop an area's OUTAGE session dismissal — called when that area RECOVERS, so a transient health
+   * state (`unreachable`) re-nags the next time it fails. Without it, "hide for now" on one outage
+   * would quietly cover every later outage for the rest of the session, which is precisely the
+   * semantics `isInfraSetupHealthStatus` exists to keep away from a health state. The area's
+   * setup-gap dismissal is left alone: recovery says nothing about that claim.
+   */
+  function clearInfraSetupSessionDismissal(area: InfraSetupArea) {
+    const key = infraSetupDismissalKey(area, 'outage')
+    infraSetupSessionDismissed.value = infraSetupSessionDismissed.value.filter((k) => k !== key)
+  }
 
   // Default-test-environment banner: a single per-SESSION dismissal, cleared on workspace switch
   // like the flags above. There is deliberately no PERMANENT dismissal here (unlike the
@@ -889,6 +911,7 @@ function createAiOnboardingModals() {
     infraSetupSessionDismissed,
     dismissInfraSetupForSession,
     resetInfraSetupDismissals,
+    clearInfraSetupSessionDismissal,
     defaultProvisionDismissed,
     dismissDefaultProvision,
     resetDefaultProvisionDismissal,

package/app/stores/workspace/infraSetup.ts

@@ -0,0 +1,77 @@
+import { ref } from 'vue'
+import { applyInfraSetupTransition, isInfraSetupHealthStatus } from '@cat-factory/contracts'
+import type { InfraSetup, InfraSetupArea, InfraSetupStatus } from '~/types/domain'
+
+// The workspace store's infra-setup slice: the per-area setup/health projection the setup banner
+// renders, and the live `infraSetup` event patch the reachability watcher pushes into it. Its own
+// collaborator rather than more lines in the store body, because it is the one slice with RULES
+// (which prior state a probe verdict may overwrite, and what a recovery does to a dismissal) instead
+// of a plain assign-from-snapshot.
+
+/**
+ * Create the infra-setup slice. `hydrate` takes the authoritative projection off a snapshot;
+ * `patchInfraSetup` applies one live transition.
+ */
+export function createInfraSetupState() {
+  /**
+   * Per-area infrastructure-setup status (ephemeral environments / agent executor / binary
+   * storage) from the snapshot, driving the infra-setup banner. Null on an older backend that
+   * doesn't compute it (⇒ no banner).
+   */
+  const infraSetup = ref<InfraSetup | null>(null)
+  /**
+   * The failing probe's own operator-facing reason per area ("connect ECONNREFUSED …", "HTTP 401"),
+   * from the live `infraSetup` event only — a refused connection reads very differently from a
+   * rejected token, and it is the one thing on the banner that says WHY.
+   *
+   * Deliberately NOT on the snapshot: the reason varies between passes and the notification card is
+   * content-deduped, so persisting it there would re-toast the inbox for the whole outage. The
+   * consequence is that a reload mid-outage renders the banner with no reason line, which is honest
+   * (this session never saw the probe) and is why the reason is an ADDITION to the copy rather than
+   * a replacement for it.
+   */
+  const infraSetupDetails = ref<Partial<Record<InfraSetupArea, string>>>({})
+
+  function hydrate(next: InfraSetup | null | undefined) {
+    infraSetup.value = next ?? null
+    // The reasons belong to the live pushes this session observed, so an authoritative snapshot
+    // supersedes them: keeping one would caption a freshly-read status with a stale probe.
+    infraSetupDetails.value = {}
+  }
+
+  /**
+   * Patch ONE infra area's status from a live `infraSetup` event, so the setup banner appears (or
+   * clears) the moment the reachability watcher notices rather than on the next snapshot load.
+   *
+   * A targeted upsert, deliberately not a `refresh()`: this is a one-field delta on a projection
+   * the snapshot recomputes wholesale, and a coalesced full refresh here would pay the ~18-read
+   * aggregate for it. A no-op before the first snapshot has landed — `hydrate` is about to set the
+   * authoritative projection, which already carries the recorded outage.
+   *
+   * The write goes through contracts' `applyInfraSetupTransition`, the SAME rule the backend's
+   * snapshot fold uses, so live and reloaded state cannot disagree: only a `configured` area may
+   * become `unreachable`. Assigning unconditionally (as this once did) rendered a red "check that
+   * the service is running" banner over a `not_applicable`/`not_defined` area, which then vanished
+   * on the next reload — a banner that contradicts the projection is worse than a late one.
+   *
+   * Recovering an area also drops its OUTAGE session dismissal, so a health state re-nags when it
+   * recurs (see `isInfraSetupHealthStatus`): without this, dismissing one outage would silence the
+   * next one for the rest of the session.
+   */
+  function patchInfraSetup(area: InfraSetupArea, status: InfraSetupStatus, detail?: string) {
+    const current = infraSetup.value
+    if (!current) return
+    const next = applyInfraSetupTransition(current, area, status)
+    // Refused by the shared rule (the projection out-ranks this probe), so nothing about the area
+    // changed and its reason must not be captioned onto a status it does not describe.
+    if (next === current) return
+    infraSetup.value = next
+    infraSetupDetails.value = { ...infraSetupDetails.value, [area]: detail }
+    // `useUiStore` is resolved through the auto-import at CALL time, as it was in the store body
+    // this moved out of: the ui store is only needed on a recovery, and reaching for it lazily keeps
+    // this slice constructible before pinia has that store (and stubbable in the store unit tests).
+    if (!isInfraSetupHealthStatus(status)) useUiStore().clearInfraSetupSessionDismissal(area)
+  }
+
+  return { infraSetup, infraSetupDetails, hydrate, patchInfraSetup }
+}

package/app/stores/workspace.spec.ts

@@ -236,3 +236,132 @@ describe('workspace store cold-open speculative snapshot', () => {
     expect(ws.access).toBeNull()
   })
 })
+
+// The reachability watcher pushes ONE area's transition as an `infraSetup` event, which the stream
+// applies through `patchInfraSetup`. Two properties matter and neither is visible from the backend:
+// the patch is TARGETED (a full refresh here would pay the whole snapshot aggregate for a one-field
+// delta), and recovering an area drops its SESSION dismissal so a health state re-nags when it
+// recurs — without which dismissing one outage would silence every later one for the session.
+describe('workspace store infraSetup patching', () => {
+  /** A ui-store stub recording which areas had their session dismissal cleared. */
+  function stubUiStore() {
+    const cleared: string[] = []
+    vi.stubGlobal('useUiStore', () => ({
+      clearInfraSetupSessionDismissal: (area: string) => cleared.push(area),
+    }))
+    return cleared
+  }
+
+  async function openBoard(infraSetup: Record<string, string>) {
+    const snap = {
+      ...snapshot('ws1', [block('f1')]),
+      infraSetup,
+    } as unknown as WorkspaceSnapshot
+    const getWorkspace = vi.fn().mockResolvedValue(snap)
+    vi.stubGlobal('useApi', () => ({ getWorkspace }))
+    const ws = useWorkspaceStore()
+    await ws.switchTo('ws1')
+    return { ws, getWorkspace }
+  }
+
+  it('patches one area without refetching the snapshot', async () => {
+    stubUiStore()
+    const { ws, getWorkspace } = await openBoard({
+      agentExecutor: 'configured',
+      ephemeralEnvironments: 'configured',
+      binaryStorage: 'not_defined',
+    })
+    ws.patchInfraSetup('agentExecutor', 'unreachable')
+    expect(ws.infraSetup).toEqual({
+      agentExecutor: 'unreachable',
+      ephemeralEnvironments: 'configured',
+      binaryStorage: 'not_defined',
+    })
+    // One fetch: the initial switchTo. The live patch triggered no snapshot refresh.
+    expect(getWorkspace).toHaveBeenCalledTimes(1)
+  })
+
+  it('clears the area session dismissal on RECOVERY so the next outage re-nags', async () => {
+    const cleared = stubUiStore()
+    const { ws } = await openBoard({
+      agentExecutor: 'unreachable',
+      ephemeralEnvironments: 'configured',
+      binaryStorage: 'configured',
+    })
+    ws.patchInfraSetup('agentExecutor', 'configured')
+    expect(ws.infraSetup?.agentExecutor).toBe('configured')
+    expect(cleared).toEqual(['agentExecutor'])
+  })
+
+  it('leaves the session dismissal alone while the area is still unreachable', async () => {
+    const cleared = stubUiStore()
+    const { ws } = await openBoard({
+      agentExecutor: 'configured',
+      ephemeralEnvironments: 'configured',
+      binaryStorage: 'configured',
+    })
+    ws.patchInfraSetup('agentExecutor', 'unreachable')
+    expect(cleared).toEqual([])
+  })
+
+  it('is a no-op before the first snapshot has landed', () => {
+    // An event can arrive before the projection exists; `hydrate` is about to set the authoritative
+    // one (which already folds the recorded outage), so inventing a partial projection here would
+    // render a banner from a single field with the other areas unknown.
+    stubUiStore()
+    const ws = useWorkspaceStore()
+    ws.patchInfraSetup('agentExecutor', 'unreachable')
+    expect(ws.infraSetup).toBeNull()
+  })
+
+  it('refuses to mark an area unreachable that the projection does not call configured', async () => {
+    // The live patch honours the SAME rule as the backend's snapshot fold
+    // (`applyInfraSetupTransition`). Assigning unconditionally rendered a red "check that the
+    // service is running" banner over a `not_applicable`/`not_defined` area — which then vanished on
+    // the next reload, because the projection out-ranks the probe. A banner that contradicts the
+    // projection is worse than a late one.
+    stubUiStore()
+    const { ws } = await openBoard({
+      agentExecutor: 'not_applicable',
+      ephemeralEnvironments: 'not_defined',
+      binaryStorage: 'configured',
+    })
+    ws.patchInfraSetup('agentExecutor', 'unreachable')
+    ws.patchInfraSetup('ephemeralEnvironments', 'unreachable')
+    expect(ws.infraSetup?.agentExecutor).toBe('not_applicable')
+    expect(ws.infraSetup?.ephemeralEnvironments).toBe('not_defined')
+    // A refused patch must not caption its reason onto a status it does not describe.
+    expect(ws.infraSetupDetails).toEqual({})
+  })
+
+  it('keeps the probe reason for the banner, and drops it on recovery', async () => {
+    // The reason is the one thing on the banner that says WHY (a refused connection reads very
+    // differently from a rejected token), and it rides the live event only — the notification card
+    // is content-deduped, so persisting it there would re-toast the inbox for the whole outage.
+    stubUiStore()
+    const { ws } = await openBoard({
+      agentExecutor: 'configured',
+      ephemeralEnvironments: 'configured',
+      binaryStorage: 'configured',
+    })
+    ws.patchInfraSetup('agentExecutor', 'unreachable', 'connect ECONNREFUSED 10.0.0.4:6443')
+    expect(ws.infraSetupDetails.agentExecutor).toBe('connect ECONNREFUSED 10.0.0.4:6443')
+    ws.patchInfraSetup('agentExecutor', 'configured')
+    expect(ws.infraSetupDetails.agentExecutor).toBeUndefined()
+  })
+
+  it('drops live probe reasons when an authoritative snapshot lands', async () => {
+    stubUiStore()
+    const { ws } = await openBoard({
+      agentExecutor: 'configured',
+      ephemeralEnvironments: 'configured',
+      binaryStorage: 'configured',
+    })
+    ws.patchInfraSetup('agentExecutor', 'unreachable', 'HTTP 502')
+    expect(ws.infraSetupDetails.agentExecutor).toBe('HTTP 502')
+    await ws.refresh()
+    // A reload mid-outage renders the banner with no reason line, which is honest: this session
+    // never saw the probe, and captioning a fresh status with a stale reason would not be.
+    expect(ws.infraSetupDetails).toEqual({})
+  })
+})

package/app/stores/workspace.ts

@@ -2,7 +2,6 @@ import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
 import type {
   BudgetCaps,
-  InfraSetup,
   SpendStatus,
   WorkspaceAccess,
   WorkspaceListItem,
@@ -11,6 +10,7 @@ import type {
 import { useAccountsStore } from '~/stores/accounts'
 import { useBoardStore } from '~/stores/board'
 import { applySnapshotToStores, resetPerBoardCaches } from '~/stores/workspace/hydrate'
+import { createInfraSetupState } from '~/stores/workspace/infraSetup'
 import { markBoot } from '~/utils/bootMarks'
 import { retryWhileBackendUnreachable } from '~/utils/backendReady'
 
@@ -50,12 +50,14 @@ export const useWorkspaceStore = defineStore(
     const userSpend = ref<SpendStatus | null>(null)
     /** Operator hard ceilings on the account/user budget tiers (null until first load). */
     const budgetCaps = ref<BudgetCaps | null>(null)
-    /**
-     * Per-area infrastructure-setup status (ephemeral environments / agent executor / binary
-     * storage) from the snapshot, driving the infra-setup banner. Null on an older backend that
-     * doesn't compute it (⇒ no banner).
-     */
-    const infraSetup = ref<InfraSetup | null>(null)
+    // The infra-setup slice (the banner's projection + the live reachability patch), extracted
+    // because it is the one slice with RULES rather than a plain assign-from-snapshot.
+    const {
+      infraSetup,
+      infraSetupDetails,
+      hydrate: hydrateInfraSetup,
+      patchInfraSetup,
+    } = createInfraSetupState()
     /**
      * The signed-in caller's resolved workspace-RBAC access to the ACTIVE board — their
      * effective role + the permission set it grants, from the auth gate's resolution
@@ -92,7 +94,7 @@ export const useWorkspaceStore = defineStore(
       accountSpend.value = snapshot.accountSpend ?? null
       userSpend.value = snapshot.userSpend ?? null
       budgetCaps.value = snapshot.budgetCaps ?? null
-      infraSetup.value = snapshot.infraSetup ?? null
+      hydrateInfraSetup(snapshot.infraSetup)
       access.value = snapshot.access ?? null
       // Keep the board list in step (e.g. a freshly created board, or a rename). The
       // snapshot's `workspace` carries no `viewerRole` (that's a `GET /workspaces` list
@@ -283,6 +285,8 @@ export const useWorkspaceStore = defineStore(
       userSpend,
       budgetCaps,
       infraSetup,
+      infraSetupDetails,
+      patchInfraSetup,
       access,
       init,
       switchTo,

package/app/utils/infraSetup.ts

@@ -0,0 +1,29 @@
+import type { InfraSetupArea } from '~/types/domain'
+
+// Shared vocabulary for the infra-setup banner's two card kinds, used by the banner itself and by
+// the ui store's session-dismissal book-keeping.
+
+/**
+ * Which CLAIM an infra-setup card is making about an area. They share one banner surface but they
+ * are not interchangeable, and every dismissal rule keys off the difference:
+ *  - `setup` — "you never configured this". A stable operator decision, so it may be dismissed
+ *    permanently as well as for the session.
+ *  - `outage` — "you DID configure it, and a live probe cannot reach it". A health state, so it is
+ *    session-dismissible only and must re-nag on recurrence.
+ */
+export type InfraSetupCardKind = 'setup' | 'outage'
+
+/** A session-dismissal key: one area's one KIND of card. */
+export type InfraSetupDismissalKey = `${InfraSetupArea}:${InfraSetupCardKind}`
+
+/**
+ * The session-dismissal key for one area's card kind. A composite key rather than a bare area,
+ * because dismissing the setup nag must not silence the outage card that a later failure raises for
+ * the same area — a different claim about a different state.
+ */
+export function infraSetupDismissalKey(
+  area: InfraSetupArea,
+  kind: InfraSetupCardKind,
+): InfraSetupDismissalKey {
+  return `${area}:${kind}`
+}