fix(action_status_bridge): retry deferred fault reports instead of dropping them

[bburda]

Pull Request

Summary

Two fixes (see commits):

1. action_status_bridge: don't lose / promptly deliver faults when the FaultManager service isn't discovered yet (closes #471)

The bridge silently lost the first fault of a failing action when the FaultManager's report_fault service was not yet discovered at the instant the bridge observed the terminal status (startup discovery window; exposed by DDS timing - failing on Humble, passing on Jazzy).

Root cause: on the healthy -> failed transition apply_message() called the fire-and-forget reporter->report() and then committed last_reported_state_ = kFailed unconditionally. If the service was not ready, FaultReporter dropped the request - but the bridge had already recorded the action as reported. The latched (transient_local) status is delivered to a subscription exactly once and a rescan skips already-subscribed topics, so the dropped report was never retried and the high-severity fault was lost permanently.

Fix:

• Track the latest observed action state (desired_state_) separately from what the FaultManager was told (last_reported_state_); deliver via reconcile() only when they differ and the report is deliverable (service ready; null reporter = unit-test seam), committing only after delivery.
• Deliver as fast as the discovery floor allows: the FaultManager captures its freeze-frame snapshot when it receives the report, so delivery latency makes that snapshot stale. The happy path reports synchronously in the status callback; a deferred report is retried on a dedicated fast retry timer (retry_period_sec, default 50 ms, armed only while pending), decoupled from the slow discovery rescan, so it lands within one short tick of the service appearing. The executor is deliberately not blocked. The README documents this delivery-latency model and its level-triggered boundaries.
• reconcile() holds state_mutex_ across gate -> report -> commit so the status callback and retry timer can't double-report under a multi-threaded executor.
• The prune-vanished heal is gated on service readiness and warns (instead of silently dropping) when a vanished action's heal can't be delivered.
• The shared FaultReporter fire-and-forget contract is unchanged.

2. gateway: fix flaky SSE handler test under ASan

SSEFaultHandlerTest.StreamSnapshotsEntityContextAtEnqueue flaked under AddressSanitizer. enqueue_event() spun for a fixed budget after publishing; under sanitizer slowdown the handler's on_fault_event (which snapshots the owning entity) could run after that budget, so the test cleared the cache before the snapshot was taken and the replayed event omitted x-medkit. Added SSEFaultHandler::events_received() (a monotonic counter, like connected_clients()) and made enqueue_event() wait until the handler has actually consumed the event. Test-only timing fix; no product behavior change.

---

Issue

• closes [BUG] action_status_bridge loses first fault when FaultManager service not yet discovered (startup race) #471

---

Type

• Bug fix
• New feature or tests
• Breaking change
• Documentation only

---

Testing

• action_status_bridge: 31 unit tests pass (incl. deferred raise/heal delivered once the service is ready, and the retry pass not dropping while the service is down); the test_integration launch test passes (raise + heal); linters + clang-tidy clean. CI Pixi (humble) (originally failing) and Humble/Jazzy/Lyrical/TSan green on the prior commits.
• gateway SSE: full test_sse_fault_handler (19 tests) passes; the snapshot test passes 30/30 in a repeat loop; clang-format + clang-tidy clean on the changed files.

---

Checklist

• Breaking changes are clearly described (and announced in docs / changelog if needed)
• Tests were added or updated if needed
• Docs were updated if behavior or public API changed

[Copilot]

Pull request overview

Fixes a startup discovery race in ros2_medkit_action_status_bridge where a terminal (latched) ABORTED/CANCELED action status could be observed before the FaultManager report_fault service was discovered, causing the bridge to “commit” the failure locally even though FaultReporter dropped the report—permanently losing the fault.

Changes:

• Split “latest observed” per-action state (desired_state_) from “successfully delivered to FaultManager” state (last_reported_state_), and only commit after delivery via a new reconcile() path.
• Add reconcile_pending() on the existing rescan tick to retry deferred raises/heals once the service becomes ready.
• Add a regression unit test ensuring deferred faults remain pending (not committed/dropped) when the FaultManager service is unavailable; update README to document the behavior.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
src/ros2_medkit_action_status_bridge/src/action_status_bridge_node.cpp	Implements desired-vs-reported reconciliation and rescan-driven retries for deferred fault delivery.
src/ros2_medkit_action_status_bridge/include/ros2_medkit_action_status_bridge/action_status_bridge_node.hpp	Documents the new reconcile model and adds DesiredState / desired_state_ tracking.
src/ros2_medkit_action_status_bridge/test/test_action_status_bridge.cpp	Adds a regression test covering “service unavailable => fault stays pending” behavior.
src/ros2_medkit_action_status_bridge/README.md	Documents deferred delivery + retry semantics during startup discovery.