@cat-factory/app 0.282.2 → 0.284.0

package/app/stores/execution.ts

@@ -1,8 +1,11 @@
 import { defineStore } from 'pinia'
-import { ref, computed } from 'vue'
+import { computed, shallowRef, triggerRef } from 'vue'
 import type { ExecutionInstance } from '~/types/domain'
 import { createExecutionCommands } from '~/stores/execution/commands'
 import { createPendingGateSelectors } from '~/stores/execution/pendingGates'
+import { createExecutionReconcile } from '~/stores/execution/reconcile'
+import { createWholeRunReads } from '~/stores/execution/wholeRunReads'
+import { useWorkspaceStore } from '~/stores/workspace'
 
 /**
  * Running pipeline instances. The simulation engine lives on the backend: this
@@ -10,9 +13,11 @@ import { createPendingGateSelectors } from '~/stores/execution/pendingGates'
  * call the worker and then refresh the workspace snapshot, since advancing an
  * execution also rolls status/progress up onto its block server-side.
  *
- * The run-control commands live in a cohesive factory ({@link createExecutionCommands}, under
- * `stores/execution/`) that closes over the state assembled here — a size-only split mirroring
- * `stores/board/`, not a new seam.
+ * Three cohesive factories under `stores/execution/` close over the state assembled here, all
+ * size-only splits mirroring `stores/board/` rather than new seams: the snapshot/event reconcile
+ * ({@link createExecutionReconcile}), the human-gate projections
+ * ({@link createPendingGateSelectors}) and the run-control commands
+ * ({@link createExecutionCommands}).
  */
 export const useExecutionStore = defineStore('execution', () => {
   const api = useApi()
@@ -21,115 +26,33 @@ export const useExecutionStore = defineStore('execution', () => {
   // in the store means every caller (board card, drag-drop, menus, restart controls)
   // gets identical handling, including the fire-and-forget ones that never caught.
   const runErrors = usePipelineErrorToast()
-  const instances = ref<ExecutionInstance[]>([])
-  // The workspace whose snapshot last hydrated the cache. Scopes the DROP-preservation
-  // below: a board SWITCH replaces the cache outright instead of leaking the previous
-  // board's runs (an ExecutionInstance carries no workspaceId of its own).
-  let hydratedWorkspaceId: string | null = null
-
-  /** A run's monotonic server revision (bumped on every persisted write; absent = 0). */
-  function revOf(e: ExecutionInstance): number {
-    return e.rev ?? 0
-  }
-
-  /** A finished run — nothing further will execute or emit. Matches `runLive`/`runFailed`. */
-  function isTerminal(status: ExecutionInstance['status']): boolean {
-    return status === 'done' || status === 'failed'
-  }
-
-  /**
-   * Carry forward each step's LLM-metrics rollup (`step.metrics`) when an incoming
-   * instance omits it. Metrics is DERIVED, LIVE-ONLY state: the backend attaches it only
-   * on step-boundary/terminal emits (not on the frequent progress-only running folds — a
-   * perf optimisation that skips the per-run metrics GROUP BY on every poll tick) and
-   * never persists it, so it rides neither the snapshot nor a running-fold event. A plain
-   * REPLACE would blank the per-step metrics bar on every progress tick; per the live-push
-   * coherence rules a REPLACE must not drop live-only state, so preserve the last-known
-   * rollup per step. Steps are positionally stable within a run (same id ⇒ same shape), so
-   * match by index; the agentKind guard is belt-and-suspenders against a reshaped list.
-   */
-  function withPreservedMetrics(
-    incoming: ExecutionInstance,
-    cached: ExecutionInstance | undefined,
-  ): ExecutionInstance {
-    if (!cached) return incoming
-    let changed = false
-    const steps = incoming.steps.map((step, i) => {
-      if (step.metrics != null) return step
-      const prior = cached.steps[i]
-      if (prior?.metrics == null || prior.agentKind !== step.agentKind) return step
-      changed = true
-      return { ...step, metrics: prior.metrics }
-    })
-    return changed ? { ...incoming, steps } : incoming
-  }
-
   /**
-   * Reconcile the cached executions with a server snapshot for `workspaceId`. A snapshot
-   * is authoritative EXCEPT where a live `execution` event already advanced (or ADDED) a
-   * run past what this (possibly stale) read observed — the same two clobber hazards the
-   * `agentRuns` store guards, keyed here on the run's monotonic `rev`:
-   *   - REGRESS: a run present in BOTH — keep the newer-by-`rev` version, so a lagging
-   *     refresh (the stream's on-(re)connect resync, the debounced `board`-event refetch)
-   *     can't revert a just-terminal run to `running`. A terminal run emits nothing
-   *     further, so a regression here would strand the UI until an unrelated refresh.
-   *   - DROP: a run a live event just ADDED that the (older) snapshot never saw — keep it
-   *     rather than silently dropping it, but ONLY when it is not the terminal predecessor a
-   *     retry replaced (see below).
+   * Every cached run.
    *
-   * The DROP caveat matters because a retry/restart REPLACES a block's run with a fresh one
-   * under a NEW id (the old run is deleted server-side), so the two attempts can't be
-   * reconciled by id or `rev`. Since there is exactly one run per block, a cached-only run
-   * whose block the snapshot already covers is that superseded predecessor — drop it.
-   * Preserving it would leave the dead `failed` run shadowing the running one in the by-block
-   * projection (`agentRuns.byBlock`, last-write-wins), keeping the failure banner up and its
-   * empty trail hiding the retry's carried-forward failure history.
+   * SHALLOW on purpose. A deep `ref` proxies the whole run graph (run to steps to subtasks to
+   * items), and the swimlane assembly, the cards and the pipeline strips read step fields
+   * constantly, so every one of those reads paid proxy overhead on a structure that is only ever
+   * written through this store. Three write sites keep it coherent, and there are no others:
+   * {@link hydrate} and `cancel` replace the array (which a shallow ref tracks on its own);
+   * {@link upsert} index-assigns or pushes; {@link echoAfter} swaps in a patched copy of ONE run.
+   * The last two announce the change with `triggerRef`.
    *
-   * The drop is gated on the cached run being TERMINAL (`done`/`failed`): only a finished
-   * predecessor is ever superseded. A cached run still `running`/`blocked`/`paused` is a
-   * genuinely live-added run, so it must survive even when a stale reconnect snapshot (fetched
-   * before a retry, resolving late under load — see `useWorkspaceStream`) still lists its
-   * block's now-deleted predecessor. Dropping a live run there would strand the UI showing the
-   * dead attempt — the inverse of the bug this guard fixes — and `rev` can't catch it (the
-   * ids differ).
+   * EVERY WRITE MUST ALSO CHANGE IDENTITY, which `triggerRef` alone does not buy. Nothing under
+   * this ref is a reactive proxy any more, so the only dependency a reader can hold is the ref
+   * itself, and almost every reader holds it through an identity-stable chain
+   * (`computed(() => getInstance(id))` to `steps[i]` to one field). A trigger re-runs the first
+   * computed in that chain, but Vue stops propagating when the recomputed value is `===` the old
+   * one, so a run patched IN PLACE re-reads as unchanged and the chain below it never re-runs.
+   * That is why {@link echoAfter} patches a COPY rather than the cached object.
+   *
+   * A reactivity regression here is SILENT (a card simply stops updating), so a new write path
+   * must replace the array or swap the run it touched, and the store specs are what pin that.
    */
-  function hydrate(next: ExecutionInstance[], workspaceId: string) {
-    const sameWorkspace = hydratedWorkspaceId === workspaceId
-    hydratedWorkspaceId = workspaceId
-    if (!sameWorkspace) {
-      instances.value = next
-      return
-    }
-    const incomingIds = new Set(next.map((e) => e.id))
-    const incomingBlocks = new Set(next.map((e) => e.blockId))
-    const held = new Map(instances.value.map((e) => [e.id, e]))
-    const reconciled = next.map((incoming) => {
-      const current = held.get(incoming.id)
-      if (current && revOf(current) > revOf(incoming)) return current
-      return withPreservedMetrics(incoming, current)
-    })
-    // Preserve a cached-only run UNLESS it is the terminal predecessor a retry replaced: a
-    // finished (`done`/`failed`) run whose block the snapshot now covers under a fresh id.
-    // Gating on the CACHED run being terminal keeps a live `running`/`blocked`/`paused` run
-    // that a stale snapshot happens to omit.
-    const preserved = [...held.values()].filter(
-      (e) => !incomingIds.has(e.id) && !(isTerminal(e.status) && incomingBlocks.has(e.blockId)),
-    )
-    instances.value = [...reconciled, ...preserved]
-  }
+  const instances = shallowRef<ExecutionInstance[]>([])
 
-  /**
-   * Insert or replace a single execution instance pushed by the event stream.
-   * Monotonic by `rev`: an out-of-order/stale event can't regress a run a newer
-   * write already advanced (same guard as {@link hydrate}).
-   */
-  function upsert(instance: ExecutionInstance) {
-    const i = instances.value.findIndex((e) => e.id === instance.id)
-    if (i >= 0) {
-      if (revOf(instance) >= revOf(instances.value[i]!))
-        instances.value[i] = withPreservedMetrics(instance, instances.value[i]!)
-    } else instances.value.push(instance)
-  }
+  // Snapshot/event reconcile: `hydrate`, `upsert` and the two shared predicates
+  // (`stores/execution/reconcile.ts`).
+  const { revOf, isTerminal, hydrate, upsert } = createExecutionReconcile(instances)
 
   const byId = computed(() => {
     const map = new Map<string, ExecutionInstance>()
@@ -169,9 +92,21 @@ export const useExecutionStore = defineStore('execution', () => {
     const before = byId.value.get(executionId)
     const revBefore = before ? revOf(before) : -1
     const state = await send()
-    const instance = byId.value.get(executionId)
+    const i = instances.value.findIndex((e) => e.id === executionId)
+    const instance = i >= 0 ? instances.value[i]! : undefined
     if (!instance || revOf(instance) !== revBefore) return state
-    apply(state, instance)
+    // `apply` MUTATES what it is handed, so hand it a COPY and swap that copy in. Patching the
+    // cached objects in place would leave every identity-stable reader
+    // (`computed(() => getInstance(id))` to `steps[i]`) recomputing to the same object, which
+    // Vue treats as no change and stops propagating: the trigger would reach the first computed
+    // in the chain and nothing below it. The steps are copied too, because most echoes write a
+    // step's sub-state and the readers hold the STEP, not the run.
+    const patched: ExecutionInstance = { ...instance, steps: instance.steps.map((s) => ({ ...s })) }
+    apply(state, patched)
+    instances.value[i] = patched
+    // An index assignment is invisible to a shallow ref. This is the one seam every action
+    // store's `assign` goes through, which is what makes one trigger enough.
+    triggerRef(instances)
     return state
   }
 
@@ -179,6 +114,17 @@ export const useExecutionStore = defineStore('execution', () => {
     return id ? byId.value.get(id) : undefined
   }
 
+  // The WHOLE-RUN read behind the step-detail overlays: when a prose reader has to ask for the run
+  // the board snapshot only projected, and what it is told while the answer is missing
+  // (`stores/execution/wholeRunReads.ts`). A cohesive collaborator over bound callbacks, the same
+  // shape as the reconcile above.
+  const wholeRunReads = createWholeRunReads({
+    cached: (id) => byId.value.get(id),
+    workspaceId: () => useWorkspaceStore().workspaceId,
+    fetch: (workspaceId, executionId) => api.getExecution(workspaceId, executionId),
+    apply: upsert,
+  })
+
   /**
    * Each block's run, indexed once per change to `instances` instead of scanned per lookup.
    *
@@ -230,6 +176,7 @@ export const useExecutionStore = defineStore('execution', () => {
     echoAfter,
     byId,
     getInstance,
+    ...wholeRunReads,
     getByBlock,
     ...pendingGates,
     ...commands,

package/app/stores/kaizen.spec.ts

@@ -43,26 +43,41 @@ describe('kaizen store — live-push clobber guards', () => {
     expect(store.byExecution.exec1).toHaveLength(1)
   })
 
-  it('a slower stale loadForExecution never clobbers a newer one (monotonic guard)', async () => {
-    // Two loads race for the same execution: the FIRST-issued resolves LAST with a stale list.
-    // Without the ticket guard its REPLACE would overwrite the fresher second result.
+  // Two loads of ONE run can no longer race: the run window and the run's grading badge both
+  // load on open, and they are coalesced onto a single request. That is what retired the
+  // per-execution load ticket, so this pins the property the ticket used to buy.
+  it('coalesces concurrent loads of the same run onto one request', async () => {
     const deferred: Array<(r: { gradings: KaizenGrading[] }) => void> = []
     vi.stubGlobal('useApi', () => ({
       getKaizenForExecution: () =>
         new Promise<{ gradings: KaizenGrading[] }>((res) => deferred.push(res)),
     }))
     const store = useKaizenStore()
-    const first = store.loadForExecution('exec1') // issued #1 (stale)
-    const second = store.loadForExecution('exec1') // issued #2 (fresh)
+    const first = store.loadForExecution('exec1')
+    const second = store.loadForExecution('exec1')
+    expect(deferred).toHaveLength(1)
 
-    deferred[1]!({ gradings: [grading({ id: 'fresh' })] })
-    deferred[0]!({ gradings: [grading({ id: 'stale' })] })
+    deferred[0]!({ gradings: [grading({ id: 'fresh' })] })
     await Promise.all([first, second])
 
     expect(store.byExecution.exec1).toHaveLength(1)
     expect(store.byExecution.exec1![0]!.id).toBe('fresh')
   })
 
+  it('re-asks once the first load has settled (coalescing, not caching)', async () => {
+    let calls = 0
+    vi.stubGlobal('useApi', () => ({
+      getKaizenForExecution: () => {
+        calls++
+        return Promise.resolve({ gradings: [grading({ id: `g${calls}` })] })
+      },
+    }))
+    const store = useKaizenStore()
+    await store.loadForExecution('exec1')
+    await store.loadForExecution('exec1')
+    expect(calls).toBe(2)
+  })
+
   it('a grading pushed live mid-load survives the load (merge, not blind-replace)', async () => {
     // A load is in flight (server response predates the newest grading); a live `upsert` lands
     // its grading; then the load resolves. A blind replace would drop the live-only grading.
@@ -97,18 +112,19 @@ describe('kaizen store — live-push clobber guards', () => {
     expect(store.byExecution.exec1![0]!.summary).toBe('live')
   })
 
-  it('loadOverview preserves a live-pushed grading in history (merge, newest-first)', async () => {
+  it('loadOverview preserves a grading pushed while its fetch was in flight (merge, newest-first)', async () => {
+    const deferred: Array<(r: { gradings: KaizenGrading[]; verified: [] }) => void> = []
     vi.stubGlobal('useApi', () => ({
       getKaizenOverview: () =>
-        Promise.resolve({
-          gradings: [grading({ id: 'old', createdAt: 1, updatedAt: 1 })],
-          verified: [],
-        }),
+        new Promise<{ gradings: KaizenGrading[]; verified: [] }>((res) => deferred.push(res)),
     }))
     const store = useKaizenStore()
-    // A grading arrives live before the overview list is fetched.
+    // Opening the SCREEN is what makes `history` a list anything reads, so the race starts here:
+    // the grading arrives live while the overview fetch is still out.
+    const load = store.loadOverview()
     store.upsert(grading({ id: 'live', createdAt: 9, updatedAt: 9 }))
-    await store.loadOverview()
+    deferred[0]!({ gradings: [grading({ id: 'old', createdAt: 1, updatedAt: 1 })], verified: [] })
+    await load
 
     const ids = store.history.map((g) => g.id)
     expect(ids).toContain('live')
@@ -117,6 +133,53 @@ describe('kaizen store — live-push clobber guards', () => {
     expect(ids[0]).toBe('live')
   })
 
+  // The growth this gate exists to stop: a session that never opens the Kaizen screen must not
+  // accumulate one history entry per grading the workspace produces. The per-RUN cache, which the
+  // run windows read without loading first, keeps taking them.
+  it('does not fold a stream-pushed grading into history before the screen asks for it', () => {
+    const store = useKaizenStore()
+    store.upsert(grading({ id: 'g1' }))
+    expect(store.history).toEqual([])
+    expect(store.gradingsFor('exec1').map((g) => g.id)).toEqual(['g1'])
+  })
+
+  // A board SWITCH is the third writer nothing ordered against. `reset()` clears the caches, but
+  // the reads already out kept their handles: the previous board's gradings landed in the
+  // switched-to board's caches, and with `historyLoaded` back to false nothing re-asked, so it
+  // never corrected itself.
+  it('discards an overview load whose board was switched away mid-flight', async () => {
+    const deferred: Array<(r: { gradings: KaizenGrading[]; verified: [] }) => void> = []
+    vi.stubGlobal('useApi', () => ({
+      getKaizenOverview: () =>
+        new Promise<{ gradings: KaizenGrading[]; verified: [] }>((res) => deferred.push(res)),
+    }))
+    const store = useKaizenStore()
+    const load = store.loadOverview()
+    store.reset()
+    deferred[0]!({ gradings: [grading({ id: 'other-board' })], verified: [] })
+    await load
+
+    expect(store.history).toEqual([])
+    // The screen never got its answer, so it must still read as un-asked rather than as loaded
+    // and empty: the next open re-asks against the board it is now on.
+    expect(store.verified).toEqual([])
+  })
+
+  it('discards a per-run load whose board was switched away mid-flight', async () => {
+    const deferred: Array<(r: { gradings: KaizenGrading[] }) => void> = []
+    vi.stubGlobal('useApi', () => ({
+      getKaizenForExecution: () =>
+        new Promise<{ gradings: KaizenGrading[] }>((res) => deferred.push(res)),
+    }))
+    const store = useKaizenStore()
+    const load = store.loadForExecution('exec1')
+    store.reset()
+    deferred[0]!({ gradings: [grading({ id: 'other-board' })] })
+    await load
+
+    expect(store.byExecution).toEqual({})
+  })
+
   it('a slower stale loadOverview never clobbers a newer one', async () => {
     const deferred: Array<(r: { gradings: KaizenGrading[]; verified: [] }) => void> = []
     vi.stubGlobal('useApi', () => ({

package/app/stores/kaizen.ts

@@ -2,6 +2,7 @@ import { defineStore } from 'pinia'
 import { computed, ref } from 'vue'
 import type { KaizenGrading, KaizenVerifiedCombo } from '~/types/domain'
 import { useWorkspaceStore } from '~/stores/workspace'
+import { useSingleFlight } from '~/composables/useSingleFlight'
 
 /**
  * Kaizen state: per-run gradings (for the run-window status surface) and the
@@ -16,6 +17,18 @@ export const useKaizenStore = defineStore('kaizen', () => {
   const byExecution = ref<Record<string, KaizenGrading[]>>({})
   /** Recent grading history for the Kaizen screen. */
   const history = ref<KaizenGrading[]>([])
+  /**
+   * Whether the Kaizen SCREEN has ASKED for its history (set when the load starts, so a grading
+   * pushed while that fetch is in flight still lands). `upsert` folds a stream-pushed grading into
+   * {@link history} only once it has: the screen is a full-panel overlay most sessions never open,
+   * and folding into a list nothing has read makes it a per-session accumulator of every grading
+   * the workspace produced. The screen loads on open, so an OPEN screen still updates live, which
+   * is the same gate `observability.appendCall` applies for the same reason.
+   *
+   * `byExecution` is deliberately NOT gated the same way: it is keyed per run, the run windows
+   * read it without loading first, and a board switch now drops it (see `reset`).
+   */
+  const historyLoaded = ref(false)
   /** The verified-combo library for the Kaizen screen. */
   const verified = ref<KaizenVerifiedCombo[]>([])
   const loadingOverview = ref(false)
@@ -23,14 +36,28 @@ export const useKaizenStore = defineStore('kaizen', () => {
   /** 503 ⇒ the Kaizen feature isn't configured on this deployment. */
   const available = ref<boolean | null>(null)
 
-  // Monotonic load-ordering guard. Both loads REPLACE state that also arrives live over the
-  // stream (`upsert`), so a slower/staler fetch resolving AFTER a newer one — or after a live
-  // push — would clobber the fresher gradings (the CLAUDE.md live-push out-of-order hazard,
-  // the same one `stores/provisioningLogs.ts` guards). Each load takes a ticket; only the
-  // newest-issued one commits. NOT reactive — pure bookkeeping the UI never reads.
+  /**
+   * One in-flight per-run read. The run window and the run's grading badge both load on open, so
+   * a single click asked for the same gradings twice. Coalescing them also retires the
+   * per-execution half of the ticket below: two loads of one run can no longer overlap.
+   */
+  const loads = useSingleFlight<string, void>()
+
+  // Monotonic load-ordering guard for the OVERVIEW, which is not coalesced (it takes no key and
+  // the screen can legitimately re-ask). It REPLACES state that also arrives live over the stream
+  // (`upsert`), so a slower/staler fetch resolving AFTER a newer one would clobber the fresher
+  // history (the CLAUDE.md live-push out-of-order hazard, the same one
+  // `stores/provisioningLogs.ts` guards). Each load takes a ticket; only the newest-issued one
+  // commits. NOT reactive: pure bookkeeping the UI never reads.
   let loadTicket = 0
   let latestOverviewLoad = 0
-  const latestExecLoad = new Map<string, number>()
+
+  // Which BOARD the in-flight reads belong to, bumped by `reset()`. Distinct from the ticket
+  // above, which orders overview loads AGAINST EACH OTHER: a switch invalidates every read of
+  // either kind, and an overview load must not cancel an unrelated per-run one. Without it a
+  // board switch mid-load committed the previous board's gradings into the switched-to board's
+  // caches, with `historyLoaded` back to false so nothing ever re-asked and corrected it.
+  let boardGeneration = 0
 
   /**
    * Fold a freshly-loaded grading list into the live cache WITHOUT dropping live-only rows:
@@ -65,14 +92,22 @@ export const useKaizenStore = defineStore('kaizen', () => {
   async function loadOverview() {
     const ws = useWorkspaceStore()
     loadingOverview.value = true
+    // Mark the screen ENGAGED before awaiting, not after: `upsert` folds into `history` only
+    // once it is, and a grading pushed while this fetch is in flight is exactly what the
+    // reconcile below exists to keep.
+    historyLoaded.value = true
     const seq = ++loadTicket
     latestOverviewLoad = seq
+    const generation = boardGeneration
     try {
       const overview = await api.getKaizenOverview(ws.requireId())
+      // `available` is a DEPLOYMENT fact rather than a per-board one, so it is recorded even by a
+      // read whose board is gone: what the deployment wires did not change under the switch.
       available.value = true
-      // A newer overview load superseded this one while it was in flight — discard the staler
-      // result so it can't clobber the fresher history (and any grading live-pushed since).
-      if (latestOverviewLoad !== seq) return
+      // A newer overview load superseded this one while it was in flight, or the board it was
+      // asked for is gone. Either way the result must not land: it would clobber the fresher
+      // history, or seed the switched-to board with the previous one's gradings.
+      if (latestOverviewLoad !== seq || generation !== boardGeneration) return
       verified.value = overview.verified
       // History is newest-first; live-pushed gradings are the newest, so prepend the survivors.
       const { reconciled, liveOnly } = reconcileWithLive(overview.gradings, history.value)
@@ -86,18 +121,23 @@ export const useKaizenStore = defineStore('kaizen', () => {
     }
   }
 
-  async function loadForExecution(executionId: string) {
+  function loadForExecution(executionId: string): Promise<void> {
+    return loads.run(executionId, () => fetchForExecution(executionId))
+  }
+
+  async function fetchForExecution(executionId: string) {
     const ws = useWorkspaceStore()
+    const generation = boardGeneration
     loadingExecution.value = new Set(loadingExecution.value).add(executionId)
-    const seq = ++loadTicket
-    latestExecLoad.set(executionId, seq)
     try {
       const { gradings } = await api.getKaizenForExecution(ws.requireId(), executionId)
       available.value = true
-      // A newer load for this execution (or a live `upsert`) may have landed while this fetch
-      // was in flight — discard a superseded load, and merge rather than blind-replace so a
-      // grading pushed live mid-flight isn't dropped.
-      if (latestExecLoad.get(executionId) !== seq) return
+      // The board this run belongs to is gone, so its gradings have no cache left to land in.
+      if (generation !== boardGeneration) return
+      // Two loads of one run can no longer overlap (`loads` coalesces them), so the per-execution
+      // ticket this used to carry had nothing left to order and is gone. What remains is the live
+      // race: a grading pushed via `upsert` while this fetch was out, which the merge keeps rather
+      // than blind-replacing over.
       const { reconciled, liveOnly } = reconcileWithLive(
         gradings,
         byExecution.value[executionId] ?? [],
@@ -122,18 +162,36 @@ export const useKaizenStore = defineStore('kaizen', () => {
       ? current.map((g) => (g.id === grading.id ? grading : g))
       : [...current, grading]
     byExecution.value = { ...byExecution.value, [grading.executionId]: nextRun }
-    // Keep the screen history live too (newest first), if it's been loaded.
+    // Keep the screen history live too (newest first), but ONLY once the screen has loaded it.
+    // Prepending unconditionally made `history` grow one entry per grading for the session's
+    // lifetime on every board, for a screen most sessions never open.
+    if (!historyLoaded.value) return
     const inHistory = history.value.some((g) => g.id === grading.id)
     if (inHistory) history.value = history.value.map((g) => (g.id === grading.id ? grading : g))
     else history.value = [grading, ...history.value]
   }
 
+  /**
+   * Drop everything scoped to a board. Called on a board SWITCH: gradings are keyed by run and a
+   * run belongs to one board, so without this `byExecution` grows a key per run of every board the
+   * session visits and the screen shows the previous board's history until it reloads.
+   * `available` survives: whether the deployment wires Kaizen at all is not a per-board fact.
+   */
+  function reset() {
+    boardGeneration += 1
+    byExecution.value = {}
+    history.value = []
+    historyLoaded.value = false
+    verified.value = []
+  }
+
   const isLoadingExecution = (executionId: string) => loadingExecution.value.has(executionId)
   const verifiedCount = computed(() => verified.value.filter((c) => c.verified).length)
 
   return {
     byExecution,
     history,
+    reset,
     verified,
     available,
     loadingOverview,

package/app/stores/notifications.spec.ts

@@ -0,0 +1,65 @@
+import { describe, it, expect, beforeEach } from 'vitest'
+import { useNotificationsStore } from '~/stores/notifications'
+import type { Notification } from '~/types/domain'
+
+/**
+ * The live-write map is what stops a lagging refresh clobbering a card that arrived while its
+ * snapshot was in flight. `hydrate` forgets whatever a snapshot has reconciled, which is what
+ * bounds it, so the case that needed a second bound is a long stream period with NO refresh in it.
+ */
+function card(id: string): Notification {
+  return {
+    id,
+    workspaceId: 'ws1',
+    blockId: 'blk1',
+    kind: 'review_wait',
+    status: 'open',
+    title: id,
+    body: '',
+    createdAt: 1,
+  } as unknown as Notification
+}
+
+describe('notifications live-write map', () => {
+  let store: ReturnType<typeof useNotificationsStore>
+  beforeEach(() => {
+    store = useNotificationsStore()
+  })
+
+  it('keeps the newest in-flight writes and forgets the oldest past the bound', () => {
+    for (let i = 0; i < 250; i++) store.upsert(card(`n${i}`))
+    // A refresh whose snapshot predates every one of those writes: what it re-inserts is exactly
+    // what the map still remembers.
+    store.hydrate([], 0)
+    const kept = store.open.map((n) => n.id)
+    expect(kept).toHaveLength(200)
+    expect(kept).toContain('n249')
+    expect(kept).not.toContain('n0')
+  })
+
+  // The bound evicts by the map's INSERTION order, which is only write order because a rewritten
+  // key is re-inserted. A bare `set` keeps a key in its original slot, so the entries rewritten
+  // most (a card whose run keeps advancing, exactly the ones still in flight) would sit at the
+  // head and be evicted FIRST, losing the protection while settled entries survived.
+  it('evicts by write order, so a rewritten card outlives older untouched ones', () => {
+    store.upsert(card('rewritten'))
+    for (let i = 0; i < 199; i++) store.upsert(card(`n${i}`))
+    // Rewriting it makes it the NEWEST write, and the next card is what pushes the map over.
+    store.upsert(card('rewritten'))
+    store.upsert(card('newest'))
+
+    store.hydrate([], 0)
+    const kept = store.open.map((n) => n.id)
+    expect(kept).toContain('rewritten')
+    expect(kept).toContain('newest')
+    // The oldest write that was never touched again is the one that goes.
+    expect(kept).not.toContain('n0')
+  })
+
+  it('still protects a write the in-flight refresh could not have seen', () => {
+    const baseline = store.hydrateBaseline()
+    store.upsert(card('live'))
+    store.hydrate([], baseline)
+    expect(store.open.map((n) => n.id)).toEqual(['live'])
+  })
+})

package/app/stores/notifications.ts

@@ -43,6 +43,31 @@ export const useNotificationsStore = defineStore('notifications', () => {
   /** Last live write per id: the notification to keep, or `null` once it was resolved. */
   const liveWrites = new Map<string, { seq: number; value: Notification | null }>()
 
+  /**
+   * How many in-flight live writes {@link liveWrites} may hold.
+   *
+   * {@link hydrate} forgets every write a snapshot has already reconciled, which is what keeps the
+   * map bounded by what is genuinely in flight. A long stream period that carries only TARGETED
+   * events triggers no hydrate at all, so the map grew one entry per notification for the session.
+   * The bound is on the OLDEST write, and it is safe to drop them: an entry only ever protects a
+   * write from a refresh whose snapshot predates it, and a refresh that far behind resolved long
+   * ago.
+   *
+   * Insertion order is sequence order only because {@link upsert} RE-INSERTS a key it already
+   * holds. A bare `set` on an existing key keeps that key's original slot, so a notification
+   * rewritten many times (exactly the ones still in flight) would sit at the head of the map and
+   * be the FIRST evicted, losing its clobber protection while older, settled entries survived.
+   */
+  const MAX_LIVE_WRITES = 200
+
+  function trimLiveWrites() {
+    while (liveWrites.size > MAX_LIVE_WRITES) {
+      const oldest = liveWrites.keys().next()
+      if (oldest.done) return
+      liveWrites.delete(oldest.value)
+    }
+  }
+
   /**
    * Baseline for {@link hydrate}: capture this BEFORE a refresh's snapshot fetch and pass it
    * back in, so a notification written live while the fetch was in flight survives the hydrate.
@@ -73,7 +98,11 @@ export const useNotificationsStore = defineStore('notifications', () => {
    */
   function upsert(notification: Notification) {
     const isOpen = notification.status === 'open'
+    // Delete before setting, so the map's insertion order stays WRITE order and the trim above
+    // evicts the genuinely oldest entry rather than the most recently rewritten one.
+    liveWrites.delete(notification.id)
     liveWrites.set(notification.id, { seq: ++liveSeq, value: isOpen ? notification : null })
+    trimLiveWrites()
     if (!isOpen) {
       remove(notification.id)
       return