The 30-second undo

Beacon's import feature overwrites your state.json. One click, gone. So the button has three things on top of it.

Before the click: a preview dialog. The import endpoint has a sibling, /api/import-preview, that parses and validates the bundle without writing anything. The builder shows you the manifest, the profile name, the widget count. You confirm against what's about to change, not against the filename.

At the click: a backup. The current state.json is copied to state.json.bak.<unix-ms> before the overwrite. The write itself is atomic: copy-then-rename. A crash mid-write leaves either the old file or the new one intact, never something half-written.

After the click: a toast. Thirty seconds. "Undo import." Clicking it hits /api/import-undo, which finds the most-recent backup in the state directory and restores it. Same atomic write on the way back. The toast disappears after thirty seconds, but the bak file stays on disk. If you realize an hour later, you can still restore it from the terminal; the toast is just the in-builder version so you don't have to.

Three layers, in the order they appeared in the code. Pre-flight validation was the first idea. The auto-backup came naturally once import was real. The undo toast was the last addition, and the one I almost cut. "The bak file is enough; an advanced user can restore it manually." That's the engineer's answer. Beacon is sold to people who shouldn't have to be the engineer.

Someone will import the wrong file eventually. The good outcome is they undo it in a second.