The verdict dialog only reached the VLANs tab, so a predicted lockout on the other
guarded paths still surfaced as a generic "failed" message with the reasoning lost.
Every surface that can push a guarded change now explains the refusal:
- SwitchPortDiagram — port VLAN (PVID / tagged / untagged, the shape of the real
incident), bond create and destroy, and the bridge vlan-filtering toggle.
- RoutingTab — static route add and delete.
- SystemConfigTab — IP address add and remove.
- SecurityTab — /ip/service enable/disable. This route also has an older hard
refusal that returns 409 with a reason but no verdict; that text is now shown
instead of a generic error, where previously it was swallowed entirely.
Supporting changes: confirm_lockout threaded through the affected API methods
(DELETE routes send it as a request body), and deviceName threaded down to
SwitchPortDiagram, RoutingTab and SecurityTab so the typed confirmation can ask
for the actual device name.
Verified the shipped bundle contains the dialog and the typed-confirm prompt.
Full CI preflight green; 152 backend tests pass.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2GT-RichandClaude Opus 4.8
d67698bac9