Fix rapid Tab leaking into the host after a final-word accept

[FuJacob]

Summary

Rapid Tab presses leaked into the focused app and moved focus out of the field. Accepting the last word of a suggestion exhausts the buffer, which synchronously clears the session and hides the overlay and then regenerates the continuation asynchronously. A fast second Tab landing in that gap found no active session and no visible overlay, so the accept-tap preflight (which keys on overlay visibility) declined and the tap forwarded the original Tab to the host as a real key. Slow tabbing was always fine because regeneration finished and re-showed ghost text before the next press. Short completions (maxPredictionTokens: 8) make the exhausting boundary common, so the second quick Tab was routinely the one that leaked.

This keeps the accept tap owning Tab across the regeneration window: a fast follow-up press is swallowed (never forwarded to the host) and queued, and the next continuation that lands accepts its first word, so rapid Tabbing keeps inserting words across the exhaustion boundary instead of jumping focus away.

Validation

# build
xcodebuild build -project Cotabby.xcodeproj -scheme Cotabby \
  -destination 'platform=macOS' -derivedDataPath build/DerivedData
# ** BUILD SUCCEEDED **

# lint (changed files)
swiftlint lint Cotabby/App/Coordinators/SuggestionCoordinator*.swift \
  CotabbyTests/SuggestionCoordinatorAcceptanceTests.swift
# Done linting! Found 0 violations, 0 serious in 4 files.

# tests
xcodebuild test -project Cotabby.xcodeproj -scheme Cotabby \
  -destination 'platform=macOS' -derivedDataPath build/DerivedData CODE_SIGNING_ALLOWED=NO
# ** TEST SUCCEEDED **  Executed 578 tests, with 4 tests skipped and 0 failures

Three new tests in SuggestionCoordinatorAcceptanceTests lock down the fix:

• test_rapidSecondAcceptDuringRegenerationIsConsumedNotPassedThrough: a fast second Tab during regeneration is consumed (returns true) and queued, never forwarded to the host.
• test_postExhaustionWindowReleasesAcceptKeyWhenOverlayHides: any teardown that hides the overlay releases the window, so Tab can never be trapped in the field.
• test_queuedPostExhaustionAcceptInsertsNextWordWhenContinuationArrives: the queued Tab accepts the continuation's first word once it lands.

Not verified end to end in this environment (no live rapid-Tab reproduction against a real text field); the behavior is covered at the coordinator boundary by the unit tests above.

Linked issues

Refs #478 (addresses item 2, "tabs jump off" on fast double-Tab; the optional-cat-image and suggestion-quality items in that issue are out of scope here).

Risk / rollout notes

• Behavior change to the existing accept flow: after a final-word accept, the accept tap keeps owning Tab during the brief regeneration window instead of releasing it immediately.
• This re-enters the "active tap while the overlay is hidden" territory that issue [Bug] Messing with Davinci Resolve #328 cares about, but only while the user is actively tabbing in the field. The window self-releases at the regeneration terminal (suggestion shown, or overlay hidden by any teardown) and is hard-bounded by a token-keyed 0.8s backstop, so it cannot trap Tab or persist when idle.
• A queued Tab accepts the next continuation's first word as soon as it generates, so the second word appears slightly after the keypress (it does not exist until the model produces it). Bounded to one queued accept per regeneration so mashing Tab cannot run away.
• No schema, settings, or project.yml/pbxproj changes. New source and test files are auto-discovered by folder.

Greptile Summary

This PR fixes the "rapid Tab jumps focus out of the field" bug: accepting the last buffered word tears down the session and regenerates asynchronously, leaving a gap where a fast follow-up Tab found no active session and no visible overlay, so the accept tap forwarded it to the host as a real key. The fix keeps the coordinator owning Tab across that regeneration gap, queues any Tab that arrives in it, and flushes the queued accept as the continuation's first word once the new suggestion is on screen.

• Three new instance flags (isPostExhaustionAcceptanceArmed, hasQueuedPostExhaustionAccept, postExhaustionAcceptanceGeneration) drive the window; a generation-keyed 0.8 s backstop timer guarantees Tab can never be permanently trapped even if regen stalls.
• armPostExhaustionAcceptance() is called in the .exhausted branch after hideOverlay() so it always follows the .hidden state callback that clears the previous window; clearPostExhaustionAcceptanceWindow() is wired into every teardown path through the single onStateChange(.hidden) catch-all.
• Three new unit tests lock down the fix boundary: rapid Tab is consumed not forwarded, any overlay-hide teardown releases the window, and a queued Tab correctly inserts the continuation's first word on arrival.

Confidence Score: 5/5

Safe to merge. The change is well-scoped to the coordinator boundary, has a hard-bounded backstop that prevents any Tab-trapping regression, and the new state is cleaned up through a single, authoritative teardown path.

The fix is mechanically sound: the ordering invariant (arm always follows a clear from the .hidden callback) is preserved and documented, the generation token correctly invalidates stale backstop timers, and all known teardown paths reach clearPostExhaustionAcceptanceWindow through onStateChange(.hidden). The only observation is a missing log when an in-flight queued Tab is silently dropped by an early-return path in apply() (stale echo, empty result, etc.), which affects debuggability but not correctness.

No files require special attention.

Important Files Changed

Filename	Overview
Cotabby/App/Coordinators/SuggestionCoordinator+Acceptance.swift	Core of the fix: adds post-exhaustion acceptance window arm/clear/release/flush methods; swallows rapid Tab presses during regen and queues them for the next continuation; integrates armPostExhaustionAcceptance() call after the .exhausted branch's hideOverlay, correctly ordering it after the .hidden state change so re-arming always follows a clean clear.
Cotabby/App/Coordinators/SuggestionCoordinator.swift	Adds three new state variables for the post-exhaustion window; extends shouldConsumeAcceptKeyProvider to also return true while isPostExhaustionAcceptanceArmed; clears the window on every .hidden overlay state transition as the single catch-all teardown path.
Cotabby/App/Coordinators/SuggestionCoordinator+Prediction.swift	Single four-line change: calls flushQueuedPostExhaustionAcceptIfNeeded() at the very end of apply()'s success path, after the new session and overlay are live — correct placement since any earlier call would race with startSession.
CotabbyTests/SuggestionCoordinatorAcceptanceTests.swift	Adds three focused tests covering the main fix contract: rapid Tab consumed and queued, window releases Tab on any overlay-hide teardown, and queued Tab inserts the next word when the continuation arrives. Happy path of the flush is well-covered.

Sequence Diagram

sequenceDiagram
    participant User
    participant InputMonitor
    participant Coordinator
    participant OverlayController
    participant Engine

    Note over User,Engine: Slow Tab (no issue — regen finishes before next press)
    User->>InputMonitor: Tab (final word)
    InputMonitor->>Coordinator: acceptCurrentSuggestion()
    Coordinator->>OverlayController: hideOverlay → onStateChange(.hidden)
    OverlayController-->>Coordinator: clearPostExhaustionAcceptanceWindow()
    Coordinator->>Coordinator: armPostExhaustionAcceptance() [re-asserts interception]
    Coordinator->>Engine: schedulePredictionAfterHostPublishDelay()
    Engine-->>Coordinator: apply(result) → presentOverlay → flushQueuedPostExhaustionAcceptIfNeeded()
    Note over Coordinator: No queued Tab → window cleared, normal flow resumes
    User->>InputMonitor: Tab (next word, overlay visible)
    InputMonitor->>Coordinator: acceptCurrentSuggestion() → inserts next word

    Note over User,Engine: Rapid Tab (the bug this PR fixes)
    User->>InputMonitor: Tab (final word)
    InputMonitor->>Coordinator: acceptCurrentSuggestion()
    Coordinator->>OverlayController: hideOverlay → onStateChange(.hidden)
    OverlayController-->>Coordinator: clearPostExhaustionAcceptanceWindow()
    Coordinator->>Coordinator: "armPostExhaustionAcceptance() [isPostExhaustionAcceptanceArmed=true]"
    Coordinator->>Engine: schedulePredictionAfterHostPublishDelay()
    User->>InputMonitor: Tab (rapid, regen in flight)
    InputMonitor->>Coordinator: shouldConsumeAcceptKeyProvider() → true (armed)
    InputMonitor->>Coordinator: acceptCurrentSuggestion()
    Note over Coordinator: No active session, but isPostExhaustionAcceptanceArmed=true
    Coordinator->>Coordinator: "hasQueuedPostExhaustionAccept=true, return true (swallowed)"
    Engine-->>Coordinator: apply(result) → presentOverlay
    Coordinator->>Coordinator: flushQueuedPostExhaustionAcceptIfNeeded()
    Coordinator->>Coordinator: clearPostExhaustionAcceptanceWindow()
    Coordinator->>Coordinator: acceptCurrentSuggestion() → inserts first word of continuation

Loading

_{Reviews (2): Last reviewed commit: "Cancel post-exhaustion backstop on relea..." | Re-trigger Greptile}