v1.6.3

pollen v1.6.3

A small UX patch on top of v1.6.2. Two fixes in one
codepath, no new surface, no behavior changes outside the
bugs they address.

Both fixes are status-bar toast hygiene. pollen's status
line is updated via setStatus() (which just sets the
text) plus a separate statusTick() Cmd that emits a
delayed clearStatusMsg. The two are paired explicitly by
each arm of Update — but two arms had been missing the
tick, leaving toasts stuck on screen until something else
happened to set a new status.

The first miss is the y (copy response body) shortcut in
the response panel. The handler called deliverCopy(),
which sets "copied as response body" (or a clipboard-
fallback string), and then returned m, nil instead of
m, m.statusTick(2 * time.Second). Every other
deliverCopy caller in pollen (cURL copy, fetch copy,
collection ops, history ops) follows the pair-with-tick
pattern. The response-copy arm was an isolated omission.

The second miss is in the v1.6.0 auto-refresh-on-send
path. When the OAuth token is near expiry and a
refresh_token is available, pollen sets "refreshing OAuth
token…" and dispatches the refresh. On success, the
authRefreshedSendMsg handler ran the actual send and
returned. But sendResultMsg never updates the status, so
the "refreshing…" string stayed visible long after the
refresh and the send had completed — strongly suggesting
to the user that the refresh was still in flight. The
success handler now sets "OAuth token refreshed" and uses
tea.Batch to fire both the send and a 2-second tick
independently, so the actual response and the dismissal of
the confirmation toast can race without blocking each
other.

The failure path (authRefreshFailedMsg) was already
correct in v1.6.0 — it replaced the "refreshing…" string
with a "refresh failed: …" error and a tick. Only the
success branch had the trailing-toast bug.

Fixed:

• y in the response panel: status now auto-clears after
  2 seconds, matching every other copy shortcut
• Auto-refresh-on-send success: "refreshing OAuth token…"
  is replaced with "OAuth token refreshed" + 2-second tick
  instead of persisting indefinitely

Notes:

• v1.x SemVer-frozen surface unchanged. No new keybindings,
  no changes to settings/persistence formats
• Audit coverage: 3 Explore agents ran in parallel over the
  entire repo. 7 agent-flagged candidates were rejected as
  false positives after primary-source verification; 1
  more (env.json migration edge case) was downgraded to a
  defensible improvement rather than a real bug. Only the
  two status-toast fixes above remained as confirmed
  defects

See CHANGELOG.md for the full list.