tui: TestApplyKeysApproveSheet fails only on CI — y/n overlay key handling races the free-text path

[linhdmn]

Evidence

CI-Go on e510828 (#269 merge): TestApplyKeysApproveSheet fails on BOTH ubuntu and macos (loop_state_test.go:313: free-text answer = "no" and :319: empty answer note = "nothing selected"), while the identical test passes 30+ consecutive runs locally on the exact same SHA (-count=30, shuffle, 5× full suite). Environment-dependent, not timing-flaky.

Mechanism (evidence-backed — supersedes the earlier DecodeKeys guess in the edit history)

Both observed failure lines require pickPausedTask(l.snap) to return "" at the test's LATER g presses (rows 3/4), i.e. snap.Status.Ask is gone by then:

• :319 note = "nothing selected": g opens no overlay → the following \r falls to the detail path → no selectable item → note "nothing selected" (loopimpl.go:536) — instead of the overlay's "approve: empty answer".
• :313 answer = "no": row 3's free-text keystrokes are swallowed (no overlay), so lastApproveAnswer keeps row 2's "no".

So an earlier successful approval leaves the loop's snapshot WITHOUT Status.Ask by the time the next g lands. The clear is asynchronous somewhere in the submit path (submitOverlayLocked → countingTransport.PostJSON /approve, and/or a follow-up status poll overwriting snap.Status with a response that carries no ask) — slow CI runners lose the race between that update and the test's next keypress; fast local runs win, hence 30+ local greens on the same SHA.

Ruled out: DecodeKeys chunk-splitting / pendingInput carry-over (decoder is mechanical; it cannot produce overlay==nil at the empty-answer row).

Where to fix

The Ask lifecycle belongs to the /approve submit path (PR #268's area, author mid-flight on loopimpl.go). Options: (a) make the post-approval snapshot update synchronous w.r.t. submitOverlayLocked, (b) have countingTransport's canned /status keep ask set, or (c) pin the test's expectations against the intended lifecycle (does an answered ask stay visible to g?).

Repro

Fails on CI runners since #268/#269; passes locally on darwin. Full log: run 34334461588. Related: #262 (CI load flakes), PR #270 (the deterministic main-reds, merged).

[linhdmn]

Root cause closed out in two local commits on the #271 worktree (TASK-mtughujt-3pf8):

ae8dd16 — test doubles were themselves racy. A go test -race sweep showed 14 DATA RACE reports across 9 tests: bufEnv (stdout buffer, raw-mode counters, attach log, geometry) and countingTransport.polls are written by the loop's poller/input goroutines and read from the test goroutine with no synchronization. Under go test ./... parallel-package load the tui package runs ~2.5× slower than standalone (6.2s vs 2.5s) — the exact regime where these torn reads surface as environment-dependent plain-mode failures (both CI agents, 0 local reproductions: same signature as this issue). All doubles are now mutex-guarded behind accessor methods; go test -race -count=5 -shuffle=on ./internal/tui is clean.

154ec88 — load-hardening wave. The remaining gate flakes were deadline/assertion tightness, not races:

• TestLoopPollCadence: 3s deadline vs 2s poll chain (1s slack) → 8s; runWaitFor failure budget 3s → 10s.
• TestGuardExplicitZeroBackoffRetriesImmediately (internal/cli): the elapsed > 1s wall-clock bound was breached by the correct zero-backoff path (3.5s) under load. Replaced with a deterministic assertion: RunGuard's own retry log (guard.go:282) reports the computed delay — "in 0ms" is exact for a delivered zero base delay, ≥1500ms for the DEFAULT_BACKOFF fallback regression.
• internal/config tests scrub the DEVAGENT_* resilience env overrides (Fixes config: Load() tests are not hermetic against DEVAGENT_* resilience env vars #280) — worker sessions inherit them from the daemon's dispatch env and runRepoTests doesn't clear cmd.Env.
• internal/workers: cold-start budget 1500→5000ms (observed a ColdStart kill at 1.5s under load); kill contracts unchanged.

Verified: go test -count=1 ./... exit 0, 4 fresh runs including 2 under genuine 10-core CPU saturation.

[linhdmn]

Close-out on devagent/TASK-mtujb6oq-351c (main + ae8dd16 + 154ec88 + 6882e2e).

Verification record (per the earlier under-pressurized -count=5 claims, all iterations quantified):

• First post-merge -race -count=5 sweep: 1 unattributed failure (log lost to tail), then ~50 clean race iterations including 2 saturated count=10 runs.
• -race -count=30 -shuffle=on -v under 6-core saturation finally reproduced it: 14 DATA RACE reports, one class — SetMono/palette-global writes vs headerLines reads from zombie 2s poll chains: ApplyKeys-driven tests submit overlays without Run, so submitOverlayLocked → pollNowLocked → go l.poll() (guarded only by stopped) polled and re-armed for the rest of the binary, racing later tests. A second sweep surfaced 2 more reports (executeKill's l.note write vs the kill test's bare field read).
• Product fix (6882e2e): l.running guards on poll()/pollNowLocked()/drawLocked() — no dashboard, no poll/draw; production semantics unchanged (RunOneShot renders its own frame). TestApplyKeysKillFlow now waits on the mu-held note write; TestApplyKeysApproveSheet pins tr.polls == 0 for non-Run loops (CI's plain go test would otherwise never catch a regression).
• Final state on 6882e2e: -race -count=30 -shuffle=on -v saturated → 4590/4590 PASS, 0 FAIL, 0 DATA RACE; saturated count=10 sweep clean; approve-sheet hammer -count=50 -race clean; go test -count=1 ./... 29/29 fresh and under saturation.

The ae8dd16 'test-only change' claim is superseded — the final fix is a product lifecycle guard. PRD footer records all three layers.

[linhdmn]

Fixed on main and verified locally; closing so the selfbuild loop can re-pick.

Landed as:

• 98a30bd fix(workers): no-progress clock defers to the cold-start window — closes the loaded-box startup kill (issue tui: TestApplyKeysApproveSheet fails only on CI — y/n overlay key handling races the free-text path #271 class). Root cause: the no-progress silence clock started before the worker emitted its first meaningful line, so a slow fork+exec inside a cold-start window breached the 1.5s silence budget (WatchdogFired=true ClockResets=0 MeaningfulBytes=0) despite the 5s cold-start budget. The silence clock now defers until the first meaningful line (or an absent cold-start budget), matching the Q31 'coldStartMs is the binding budget' contract; pinned by TestSpawnCliStreaming_NoProgressClockDefersToColdStart.
• 40a1bac docs(prd): tui: TestApplyKeysApproveSheet fails only on CI — y/n overlay key handling races the free-text path #271 footer stamp
• f30c170 test(tui): hermetic RunOneShot + killDone slack — closes the last tui: TestApplyKeysApproveSheet fails only on CI — y/n overlay key handling races the free-text path #271 environment dependencies
• 154ec88 test: load-harden the repo test gate (fixes config: Load() tests are not hermetic against DEVAGENT_* resilience env vars #280, same environment-dependent class)

Verification: go test -race -count=30 -shuffle=on -v ./internal/tui and go test -count=1 ./... exit 0, fresh and under CPU saturation.