fix(workflows): pin the deployed-state hint to the active version

`loadDeployedWorkflowState` asks Postgres to withhold the version blob for the
version id it hinted for the workflow, but the hint was written on every
materialize miss, by-id reads included, and never on a cache hit. An execution
or webhook loading an older version by id repointed the hint away from the
active one, and a rollback to a version still in the cache left it on the
version rolled back from, so each later active read pulled the full blob again
until the hint expired. The hint is now written only by the active read, on
every successful return, hit or miss, and `materializeDeploymentState` no
longer touches it.

Autopsy: the cache tests only ever read the active version, one version per
workflow or one cutover, so the hint always matched; no test interleaved a
by-id read or returned to a cached version, and the integration test checks
answers, which stay correct when the hint is stale (it costs bytes, not
correctness). The two new cases queue the withheld row a correct hint produces
and fail on the old code with NoActiveDeploymentError.

Author: waleedlatif1

apps/sim/lib/workflows/persistence/utils.test.ts

@@ -817,6 +817,44 @@ describe('Database Helpers', () => {
       expect(dbChainMockFns.where).toHaveBeenCalledTimes(1)
     })
 
+    /**
+     * The hint naming the version Postgres may withhold used to follow the last
+     * materialize miss, by-id reads included, so an execution of an older version
+     * repointed it and the next active reads pulled the full blob again until the
+     * entry expired. `state: null` stands in for the row Postgres returns when it
+     * withholds the blob for the hinted version.
+     */
+    it('keeps withholding the active state after a by-id read of another version', async () => {
+      queueActiveVersion('dv-active', buildDeployedState())
+      await dbHelpers.loadDeployedWorkflowState('wf-hint', 'workspace-1')
+
+      queueTableRows(schemaMock.workflowDeploymentVersion, [
+        { id: 'dv-older', state: buildDeployedState() },
+      ])
+      await dbHelpers.loadWorkflowDeploymentVersionState('wf-hint', 'dv-older', 'workspace-1')
+
+      queueActiveVersion('dv-active', null)
+      const deployed = await dbHelpers.loadDeployedWorkflowState('wf-hint', 'workspace-1')
+
+      expect(deployed.deploymentVersionId).toBe('dv-active')
+      expect(mockSanitizeAgentToolsInBlocks).toHaveBeenCalledTimes(2)
+    })
+
+    it('withholds the active state again after a rollback to a version still cached', async () => {
+      queueActiveVersion('dv-a', buildDeployedState())
+      await dbHelpers.loadDeployedWorkflowState('wf-rollback', 'workspace-1')
+      queueActiveVersion('dv-b', buildDeployedState())
+      await dbHelpers.loadDeployedWorkflowState('wf-rollback', 'workspace-1')
+      queueActiveVersion('dv-a', buildDeployedState())
+      await dbHelpers.loadDeployedWorkflowState('wf-rollback', 'workspace-1')
+
+      queueActiveVersion('dv-a', null)
+      const deployed = await dbHelpers.loadDeployedWorkflowState('wf-rollback', 'workspace-1')
+
+      expect(deployed.deploymentVersionId).toBe('dv-a')
+      expect(mockSanitizeAgentToolsInBlocks).toHaveBeenCalledTimes(2)
+    })
+
     it('invalidateDeployedStateCache(id) forces a rebuild on the next call', async () => {
       queueActiveVersion('dv-inv', buildDeployedState())
       queueActiveVersion('dv-inv', buildDeployedState())

apps/sim/lib/workflows/persistence/utils.ts

@@ -146,9 +146,12 @@ const deployedStateCache = new LRUCache<
 })
 
 /**
- * The version id each workflow last cached, so the active-version read can ask
- * Postgres to withhold a `state` this process already holds. Only a hint: a
- * stale or evicted entry costs a re-read, never a wrong answer.
+ * The active version id each workflow last resolved to, so the active-version
+ * read can ask Postgres to withhold a `state` this process already holds. Only
+ * {@link loadDeployedWorkflowState} writes it: a by-id read of an older version
+ * (an execution or webhook admitted before a cutover) must not repoint it away
+ * from the active one. Only a hint: a stale or evicted entry costs a re-read,
+ * never a wrong answer.
  */
 const cachedVersionByWorkflow = new LRUCache<string, string>({
   max: DEPLOYED_STATE_CACHE_MAX_ENTRIES,
@@ -272,7 +275,6 @@ export async function materializeDeploymentState(
   if (options.cache === false) return deployedState
   /** The cached entry is shared, so each caller gets its own copy. */
   deployedStateCache.set(version.id, { workflowId, state: deployedState })
-  cachedVersionByWorkflow.set(workflowId, version.id)
   return structuredClone(deployedState)
 }
 
@@ -311,20 +313,25 @@ export async function loadDeployedWorkflowState(
       throw new NoActiveDeploymentError(workflowId)
     }
 
+    let deployedState: DeployedWorkflowData
     if (active.id === cachedVersionId && active.state == null) {
       // Served from the cache, or re-read by id if the entry was evicted since the hint.
-      return loadWorkflowDeploymentVersionState(workflowId, active.id, providedWorkspaceId)
-    }
-
-    if (!active.state) {
+      deployedState = await loadWorkflowDeploymentVersionState(
+        workflowId,
+        active.id,
+        providedWorkspaceId
+      )
+    } else if (!active.state) {
       throw new NoActiveDeploymentError(workflowId)
+    } else {
+      deployedState = await materializeDeploymentState(
+        workflowId,
+        active,
+        await resolveWorkspaceId(workflowId, providedWorkspaceId)
+      )
     }
-
-    return materializeDeploymentState(
-      workflowId,
-      active,
-      await resolveWorkspaceId(workflowId, providedWorkspaceId)
-    )
+    cachedVersionByWorkflow.set(workflowId, active.id)
+    return deployedState
   } catch (error) {
     // An undeployed workflow is an outcome each caller handles, not a load failure.
     if (!(error instanceof NoActiveDeploymentError)) {