[JacobStephens2]

Summary

Closes #1258.

 click Dismiss / Undo
+  show “Dismissing…” / “Taking back dismissal…” immediately
+  keep feedback and prevent repeat submits through live updates
   save the existing Dismissal action
+  preserve errors and allow retry on failure
   refresh Command details and Inbox

Updates the manual, generated manual page, and hand-written Console descriptions.

Evidence

• Before: node --test --test-name-pattern='Dismiss and Undo show pending feedback' console/tests/inbox.test.cjs failed waiting for pending feedback (2000 ms timeout).
  After: node --test --test-name-pattern='Dismiss' console/tests/inbox.test.cjs passes all 3 Dismissal tests, including delayed Dismiss/Undo, live refresh, duplicate submit, and failure/retry cases.
• cargo build --locked passes. npm test --prefix console: 78 passed. Site browser/generation checks: 49 passed.
• Final required validation: /usr/bin/time -p scripts/affected-tests main passed, including 49 site checks and the selected cargo nextest run: 2606 passed, 58 skipped (8 slow). Total wall time: 1633.71 seconds (27m 14s), including site checks and compilation. Rust test compilation took 2m 24s; nextest reported 1364.833 seconds of test execution.
• All CI checks passed for 5345d81eccc578fe0c12e8236caeed8096ffc682, including Linux Rust, Console, site, macOS gate, and release builds: CI run.

Test seams

• Console browser interaction with Command details: delayed Dismiss/Undo HTTP responses, live refresh during a pending request, and failed requests followed by retry.

Review coverage

Independent Standards and Spec reviews used git diff main...HEAD, with main fixed at fa2d80dcde66ad964b8c883f81d1f3d540358206. Both read all 7 changed files, including the generated site/docs/index.html hunk. No generated-output exclusions. Unread changed files: none on either axis. Standards: one optional low-priority test-duplication heuristic; no hard violations. Spec: no findings.

Unaddressed findings

Standards

• S1 — optional Duplicated Code heuristic: keep the explicit fixture setup and record-driven live refresh in the two browser scenarios. This is a test-readability decision: the pending-request case and failure/retry case show their own Arrange steps, and the existing pageFor helper owns shared browser-context cleanup. The repeated blocks contain no product logic. Evidence: pending-request setup, failure/retry setup, and shared page helper. The reviewer explicitly accepts local setup for readability. No behavioral defect was alleged; no Spec or Day shift decision is deferred.

Spec

None.

Security

None. Reviewed git diff fa2d80dcde66ad964b8c883f81d1f3d540358206...HEAD (client pending-dismissal feedback in src/console/assets/console.js plus tests/docs) with supporting code (src/console/dismiss.rs, src/console/auth.rs, src/console/peek.html). No introduced finding: server error text and pending messages render only via textContent (no HTML sink in console.js); the POST still sends the full form including the CSRF field and middleware still enforces it (src/console/auth.rs); CSP keeps frame-ancestors 'none'; the new duplicate-submit guard only removes a double-POST race. Local sink check passes; no PoC failure to fix, so no code change from this review.

Security review outcome

No unaddressed introduced findings.

Merge Danger

Door: two-way

Revert the commit to restore the previous browser feedback; durable Dismissals and server actions use the existing implementation.

Blast Radius: Console

Command-details Dismiss/Undo feedback and browser tests, plus documentation.

Built with codex · gpt-6.1-sol · xhigh