Issue #3611505: Engine exactly-once, notification side-effect isolation, and audit completeness

Frank Mablyrequested to merge
issue/orchestra-3611505:3611505-engine-exactly-once-notification into 1.x

Fixes the pre-alpha12 audit findings in the engine timeout, park and resume paths.

  • E1: the timeout claim now refuses a deadline re-armed to the future on the cron sweep (mirrors the WAITING branch), while the operator "fire now" still fires ahead of the deadline (threaded through a due-only flag).
  • G1: the park-path notification dispatchers (ParkNotificationDispatcher, TaskNotificationDispatcher) now guard their audience/link/notify work, so a notification-config error can no longer roll back the committed park and dead-letter the token.
  • I1: resumeWithResult() returns signal()'s real outcome, so a lost race reports FALSE instead of an unconditional TRUE (no double-fired onResumed()).
  • E2: a persistently throwing timeout action now backs off (deferred deadline) instead of hot-looping every cron run.
  • E3: the authored status is cleared/recorded on completion at any structurally terminal node (no outgoing flows), not only a literal end node.
  • G2/G3: the parked/completed audit records carry the authored status (permanent bucket); the started record carries the initiator (transient/purgeable bucket, since a uid is personal data).

Discriminating kernel tests added (status cleared on cancel and on non-end terminal completion, resumeWithResult return value, throwing-subscriber park survival). French translations follow in the docs MR (#3611508), which moves the stranded strings.

Merge request reports