Harden dialog accessibility and prevent duplicate actions

[Codex]

Confirm dialog lacked focus management and UI actions could double-trigger on rapid input.

• Dialog accessibility: added initial focus to confirm, focus trap, Escape honoring loading state, aria-describedby, and restores prior focus on close.
• Toast queueing: keep only the last three toasts, clear timers for evicted items, still schedule new toast timeout.
• Action queue: guard decideQueue with an in-flight set to stop concurrent decisions and duplicate toasts.
• Dashboard payments: ref-based in-flight guard blocks rapid double “pay now” submissions while preserving UI state.

Example:

if (pendingDecisionsRef.current.has(id)) return;
pendingDecisionsRef.current.add(id);
try {
  await api.decideQueue(id, decision, sessionId.current);
  // ...
} finally {
  pendingDecisionsRef.current.delete(id);
}

[chatgpt-codex-connector]

Summary

• Verified the finding in Dashboard.tsx and fixed the double-submit race by introducing a synchronous in-flight guard ref (payingIdRef) that is checked before execution and set immediately when confirmation starts. This prevents rapid re-entry before React state updates. ui/src/pages/Dashboard.tsxL1-L37
• Kept the existing UI behavior by continuing to use payingId state for loading indicators, while making the ref the authoritative marker for request-in-flight logic. ui/src/pages/Dashboard.tsxL13-L16 ui/src/pages/Dashboard.tsxL34-L35 ui/src/pages/Dashboard.tsxL94-L95
• Preserved existing success/error/toast/finally behavior and cleared the ref in finally so retries only become possible after the request completes. ui/src/pages/Dashboard.tsxL37-L53
• Committed the change on the current branch with commit ab356f3, and created a follow-up PR record via the make_pr tool as requested.

Testing

• ✅ npm --prefix ui run build

View task →

[chitcommit]

Closing as superseded: this branch was cherry-picked into #21 (commit b0ca82f), so all related fixes are now tracked on the primary PR.