Pull Request

Summary

Two fixes (see commits):

1. action_status_bridge: don't lose / promptly deliver faults when the FaultManager service isn't discovered yet (closes #471)

The bridge silently lost the first fault of a failing action when the FaultManager's report_fault service was not yet discovered at the instant the bridge observed the terminal status (startup discovery window; exposed by DDS timing - failing on Humble, passing on Jazzy).

Root cause: on the healthy -> failed transition apply_message() called the fire-and-forget reporter->report() and then committed last_reported_state_ = kFailed unconditionally. If the service was not ready, FaultReporter dropped the request - but the bridge had already recorded the action as reported. The latched (transient_local) status is delivered to a subscription exactly once and a rescan skips already-subscribed topics, so the dropped report was never retried and the high-severity fault was lost permanently.

Fix:

• Track the latest observed action state (desired_state_) separately from what the FaultManager was told (last_reported_state_); deliver via reconcile() only when they differ and the report is deliverable (service ready; null reporter = unit-test seam), committing only after delivery.
• Deliver as fast as the discovery floor allows: the FaultManager captures its freeze-frame snapshot when it receives the report, so delivery latency makes that snapshot stale. The happy path reports synchronously in the status callback; a deferred report is retried on a dedicated fast retry timer (retry_period_sec, default 50 ms, armed only while pending), decoupled from the slow discovery rescan, so it lands within one short tick of the service appearing. The executor is deliberately not blocked. The README documents this delivery-latency model and its level-triggered boundaries.
• reconcile() holds state_mutex_ across gate -> report -> commit so the status callback and retry timer can't double-report under a multi-threaded executor.
• The prune-vanished heal is gated on service readiness and warns (instead of silently dropping) when a vanished action's heal can't be delivered.
• The shared FaultReporter fire-and-forget contract is unchanged.

2. gateway: fix flaky SSE handler test under ASan

SSEFaultHandlerTest.StreamSnapshotsEntityContextAtEnqueue flaked under AddressSanitizer. enqueue_event() spun for a fixed budget after publishing; under sanitizer slowdown the handler's on_fault_event (which snapshots the owning entity) could run after that budget, so the test cleared the cache before the snapshot was taken and the replayed event omitted x-medkit. Added SSEFaultHandler::events_received() (a monotonic counter, like connected_clients()) and made enqueue_event() wait until the handler has actually consumed the event. Test-only timing fix; no product behavior change.

Issue

• closes [BUG] action_status_bridge loses first fault when FaultManager service not yet discovered (startup race) #471

Type

• Bug fix
• New feature or tests
• Breaking change
• Documentation only

Testing

• action_status_bridge: 31 unit tests pass (incl. deferred raise/heal delivered once the service is ready, and the retry pass not dropping while the service is down); the test_integration launch test passes (raise + heal); linters + clang-tidy clean. CI Pixi (humble) (originally failing) and Humble/Jazzy/Lyrical/TSan green on the prior commits.
• gateway SSE: full test_sse_fault_handler (19 tests) passes; the snapshot test passes 30/30 in a repeat loop; clang-format + clang-tidy clean on the changed files.

Checklist

• Breaking changes are clearly described (and announced in docs / changelog if needed)
• Tests were added or updated if needed
• Docs were updated if behavior or public API changed