"refused while any admin has a working credential > the stranded admin itself, or another admin, has sign-in with the parent" passes every time on a loaded check machine #5206

Intent: refused while any admin has a working credential > the stranded admin itself, or another admin, has sign-in with the parent in test/first-admin-recovery.test.ts goes red in pulls that never touch it (pull #5193), so good work is parked and the board shows red noise.

Done:

• [ ] the pull names the cause (wall clock, a real sleep, a shared port or directory, a fake clock mixed with Date.now(), a budget measured end to end instead of in the code it guards)
• [ ] bun test --rerun-each 30 test/first-admin-recovery.test.ts passes, and also passes with other test files running beside it (bun test test/first-admin-recovery.test.ts test/apps.test.ts). The pull says how it was checked
• [ ] the test still fails when the behaviour it guards is broken; what it promises about the product is unchanged. A time or resource budget may only move to what the code itself spends, never just get wider

Files: test/first-admin-recovery.test.ts; the source only if the flake is a real race there (then the pull says so). Hint: expiry is built from Date.now() in the test (lines 32-33, 143) and read again later by the code; pass one fixed now.