fix: guard terminal deferred quit state

internal/tui/model.go

@@ -77,7 +77,7 @@ func (m Model) Init() tea.Cmd { return nil }
 // operation start checks it, so a completion can only belong to the one current
 // operation rather than racing another operation for shared model state.
 func (m Model) busy() bool {
-	return m.operationInFlight() || m.pendingActivation.Kind != 0
+	return m.quitRequested || m.operationInFlight() || m.pendingActivation.Kind != 0
 }
 
 func (m Model) operationInFlight() bool {
@@ -85,6 +85,13 @@ func (m Model) operationInFlight() bool {
 }
 
 func (m Model) Update(message tea.Msg) (tea.Model, tea.Cmd) {
+	// A deferred tea.Quit is queued only after the in-flight completion has
+	// been consumed. Until Bubble Tea processes that QuitMsg, keep the model
+	// terminal so intervening input cannot cancel a confirmation or start a
+	// second mutation.
+	if m.quitRequested && !m.operationInFlight() {
+		return m, nil
+	}
 	if key, ok := message.(tea.KeyMsg); ok && m.operationInFlight() && isQuitKey(key) {
 		m.quitRequested = true
 		return m, nil