benecaster_notice_dismissed

Fires from NoticeManager::dismiss() (added feature/invalid-token-monitoring) — the notification system’s first public action, and the single path every dismissal takes, including the bell panel’s dismiss button via POST /notices/{id}/dismiss.

⚠ Fires on the transition only. A repeat dismissal of an already-dismissed notice, a notice ID that does not exist, or a failed database write all fire nothing — so each call is a fresh acknowledgement by a person. It does not fire when a notice is deleted (NoticeManager::delete()), when it expires, or when a health check clears its own notice because the underlying condition resolved — those are the system tidying up, not the operator acknowledging.

Notice IDs are namespaced by the code that published them; match on your own prefix. Core’s own listener is Security\InvalidTokenMonitor, which matches benecaster_invalid_token_alert_{show_id}_{unix time} and, when that is the show’s current alert, clears the show’s failure count and swaps the rest of its 24-hour cooldown for a one-hour quiet period.

<?php
add_action( 'benecaster_notice_dismissed', function ( string $notice_id ): void {
    // Only security alerts, e.g. the invalid-token spike alert.
    if ( ! str_starts_with( $notice_id, 'benecaster_invalid_token_alert_' ) ) {
        return;
    }

    $user = wp_get_current_user();
    my_ops_alert( sprintf(
        '%s acknowledged security alert %s at %s',
        $user->exists() ? $user->user_login : 'unknown user',
        $notice_id,
        wp_date( 'Y-m-d H:i T' ) // Site time, from a real UTC timestamp.
    ) );
} );