fix(console): expose disabled state while scan details load

[seonghobae]

Scan rows use role="button" and suppress pointer/Enter/Space activation while a detail request is in flight. aria-busy alone describes an element being updated; it does not communicate that the button-like row is temporarily inoperable. WAI-ARIA 1.2 defines aria-disabled for a perceivable but non-operable element and expects the disabled presentation to match the state.

This branch now keeps both states distinct: aria-busy="true" communicates the pending update, while aria-disabled="true" is the activation contract used by pointer/keyboard guards and the disabled visual state. Both attributes are removed on completion and on explicit close/focus restoration.

TDD lineage:

• test-only dd2e33aa254bab840cf4b6223989a9fced7e866e requires aria-disabled set/cleanup alongside the existing busy-state contract. Hosted Tests for that generation were still queued when the production descendant landed, so it is not claimed as hosted RED.
• production 5cad14bf125bbf3af0df29dded4b087c2aa90c07 implements the minimal semantic state and cleanup without changing request ordering or detail rendering.

Remaining acceptance before Ready: exact-head Tests/Security/SAST/CodeQL plus real-browser pointer, Enter, Space, focus restoration, success/error/cancel behavior and accessibility-tree evidence at current head. No screenshot/E2E evidence is claimed yet.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Warning

Review limit reached

Next included review available in 16 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 86eb24dd-d959-493e-911b-8753c4d34ff9

📥 Commits

Reviewing files that changed from the base of the PR and between e71d37e and 5cad14b.

📒 Files selected for processing (3)

• .jules/palette.md
• scanner/dashboard/console.html
• tests/test_console_detail_loading_contract.py

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[seonghobae]

Exact-head verification update for 5cad14bf125bbf3af0df29dded4b087c2aa90c07: Tests run 34368689998 is now SUCCESS; Security Process 34368689787, OpenSSF Evidence Coverage 34368689713, Pinned HTTPS Coverage 34368689915, Retention Audit Coverage 34368690104, and Scan path context coverage 34368690001 are also SUCCESS. SAST 34368689683, Security Scan 34368689766, and CodeQL PR 34368689661 are still queued, so this remains Draft.

Standards basis: WAI-ARIA 1.2 defines aria-disabled as the state for an element that remains perceivable but is not operable, while aria-busy indicates that an element is being updated. The row has explicit role="button", so keeping busy and disabled as separate states matches the interaction contract rather than treating aria-busy as a disabling primitive.

Material-UI Delivery Gate at this head: intentionality PASS; functional completeness PARTIAL (source contract + exact-head Tests GREEN, browser activation matrix pending); content appropriateness PASS; resilience PARTIAL (keyboard guards present, live browser/focus/error evidence pending); evidence FAIL/PENDING for current-head screenshot/AX-tree/E2E; distinctiveness N/A. Do not mark Ready until the remaining exact-head checks and real-browser pointer/Enter/Space/focus/success/error evidence are terminal.