"model budget in the terminal > an admin sets and takes back a grant; a person has no such command" passes every time on a loaded check machine #5239

I haven't reproduced the flake, so this change is a hardening and not a confirmed fix. The cause is a likely race I found by reading the code, not one I saw fail.

Likely cause: the test pressed Enter on the palette and typed into the next prompt as soon as the app reported itself idle. It never checked that the command row or the prompt was on screen. settleApp only waits for the app to go quiet, and the palette's 120 ms and 400 ms search timers sit outside that. On a loaded machine the palette can still be redrawing between Ctrl+K, the typing and Enter. The call that opens each prompt (open) is also shared with the other two tests, so I fixed it in one place. The final "a person has no such command" check is a negative read, so it could pass before the palette had drawn anything.

Change (test/tui-model.test.ts only, no source touched):

• open() now waits for the palette row's hint text to appear before pressing Enter. It then waits for the prompt's text before the caller types.
• The negative check for a person now waits for the palette to draw first, using the helper's existing settleUntil.
• No sleeps or timeouts were widened. What the test promises about the product is unchanged.

Checked:

• bun test --rerun-each 30 test/tui-model.test.ts passes (90 of 90) with the stray CPU spinners below still running (load average about 330).
• bun test test/tui-model.test.ts test/apps.test.ts passes.
• The stray CPU spinners were left over from my own load experiment, because I couldn't signal them from a later command. They will exhaust on their own. They also slowed the runs, so don't read the run times as a regression.
• tsc --noEmit is clean.
• With setAccountGrant temporarily changed to write a wrong amount when taking a grant back, the grant test fails. I reverted that change.

Not done: I did not touch the 5 s default test timeout. The grant test takes about 400 ms on a quiet machine, so the headroom is large.

Closes #5198

I haven't reproduced the flake, so this change is a hardening and not a confirmed fix. The cause is a likely race I found by reading the code, not one I saw fail.

Likely cause: the test pressed Enter on the palette and typed into the next prompt as soon as the app reported itself idle. It never checked that the command row or the prompt was on screen. settleApp only waits for the app to go quiet, and the palette's 120 ms and 400 ms search timers sit outside that. On a loaded machine the palette can still be redrawing between Ctrl+K, the typing and Enter. The call that opens each prompt (open) is also shared with the other two tests, so I fixed it in one place. The final "a person has no such command" check is a negative read, so it could pass before the palette had drawn anything.

Change (test/tui-model.test.ts only, no source touched):

• open() now waits for the palette row's hint text to appear before pressing Enter. It then waits for the prompt's text before the caller types.
• The negative check for a person now waits for the palette to draw first, using the helper's existing settleUntil.
• No sleeps or timeouts were widened. What the test promises about the product is unchanged.

Checked:

• bun test --rerun-each 30 test/tui-model.test.ts passes (90 of 90) with the stray CPU spinners below still running (load average about 330).
• bun test test/tui-model.test.ts test/apps.test.ts passes.
• The stray CPU spinners were left over from my own load experiment, because I couldn't signal them from a later command. They will exhaust on their own. They also slowed the runs, so don't read the run times as a regression.
• tsc --noEmit is clean.
• With setAccountGrant temporarily changed to write a wrong amount when taking a grant back, the grant test fails. I reverted that change.

Not done: I did not touch the 5 s default test timeout. The grant test takes about 400 ms on a quiet machine, so the headroom is large.

The flake is hardened in test/tui-model.test.ts only; I did not reproduce it, so the cause below comes from reading the code. The source is untouched.

Likely cause: the test pressed Enter and typed the next input as soon as the app reported itself idle. It never checked that the palette row or the prompt it opens was on screen. On a loaded machine a frame can lag behind, so the test acted or read before the terminal had drawn the answer.

What the diff does:

• Opening a command: the shared open() waits for the palette row's hint text to appear before pressing Enter. It then waits for the prompt that Enter opens before anything is typed. All three tests use it.
• The "a person has no such command" reads: both person blocks (grant and ceiling) now wait for the palette to echo the typed query before checking that the admin-only hint is absent. Before, that read could pass on a palette that had drawn nothing. This is the change sentinel asked for.
• Wait limits: the wait helper is capped at 4 s, under bun's 5 s per-test timeout. A miss now fails with the helper's "never saw … on screen" dump of the screen instead of a bare test timeout. No budget was widened.

Checked:

• bun test --rerun-each 30 test/tui-model.test.ts passed (90 of 90) while the machine was under heavy CPU load (load average about 330, from spinners I left running).
• bun test test/tui-model.test.ts test/apps.test.ts also passed under that load. I did not rerun this pairing after the final edit.
• After the final edit, --rerun-each 10 passes (30 of 30) and tsc --noEmit is clean.
• With the grant-removal path temporarily changed to write a wrong amount, the grant test fails. I reverted that change.

Not done:

• I did not touch bun's 5 s test timeout. The grant test takes about 400 ms on a quiet machine.
• sentinel noted that a visible palette hint doesn't prove the highlighted row is the command, because async search results can sit in front of the commands. That cannot happen in this test, because the test database has no repos, issues or code to match. Waiting on the prompt text after Enter is the guard that covers it.