refactor: fold org-template's action lifecycle + pendingPublish into one union (RD-13)

Before this change, org-template.store.ts held the action lifecycle in an
actionState signal and the publish impact-confirm gate in an independent
pendingPublish signal. The two were representable in combination, so
pendingPublish === true and busy === true could both hold at once. That
state was meaningless: the UI would show the publish-impact confirmation
while a publish was already in flight.

OrgTemplateState.Loaded now carries one action field, a four-variant union
(Idle | ConfirmingPublish | Busy | Failed). ActionStarted overwrites the
field straight to Busy from any prior tag, so ConfirmingPublish and Busy
can never coexist — not by convention, but because one field can only
hold one tag. requestPublish and cancelPublish become dispatches
(PublishRequested/PublishCancelled); as the reducer already no-ops
outside Loaded, this changes no behaviour. The other four commands
(confirmPublish, rollback, proefbrief, flushSave) keep their existing
loaded() guards. busy, lastError and pendingPublish stay on the store as
computed values reading the new union, with byte-identical public
signatures — no file under brief/ui/ changes.

Ran gen:behaviour-spec for the six new reducer cases.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/ssp/src/app/brief/application/org-template.store.ts

@@ -1,6 +1,6 @@
 import { Injectable, computed, effect, inject, signal } from '@angular/core';
 import { createStore } from '@shared/application/store';
-import { ActionState, SaveState } from '@shared/application/action-state';
+import { SaveState } from '@shared/application/action-state';
 import { createDebouncedSave } from '@shared/application/debounced-save';
 import { fromLoadLifecycle } from '@shared/application/remote-data';
 import { UploadAdapter, uploadContentUrl } from '@shared/infrastructure/upload.adapter';
@@ -13,6 +13,7 @@ import {
   SubOrgSummary,
 } from '@brief/domain/org-template';
 import {
+  OrgTemplateActionState,
   OrgTemplateMsg,
   OrgTemplateState,
   initial,
@@ -47,17 +48,23 @@ export class OrgTemplateStore implements PendingSave {
   readonly subOrgs = signal<readonly SubOrgSummary[]>([]);
   readonly selectedSubOrgId = signal<string | null>(null);
 
-  private actionState = signal<ActionState>({ tag: 'Idle' });
-  readonly busy = computed(() => this.actionState().tag === 'Busy');
+  /** The one-shot action lifecycle and the publish impact-confirm gate now live on
+      the machine's `Loaded.action` as one four-variant union (RD-13); these stay as
+      plain `computed`s so the render seam (the editor organism's `input()`s, the
+      page template) keeps a byte-identical boolean/string API. */
+  private action = computed<OrgTemplateActionState>(() => this.loaded()?.action ?? { tag: 'Idle' });
+  readonly busy = computed(() => this.action().tag === 'Busy');
   readonly lastError = computed(() => {
-    const s = this.actionState();
-    return s.tag === 'Failed' ? s.error : null;
+    const a = this.action();
+    return a.tag === 'Failed' ? a.error : null;
   });
+  /** The publish impact-confirm gate (PRD §7h: show N affected letters before POST).
+      Before RD-13 this was an independent boolean, so it could be `true` at the same
+      time `busy` was `true` — representable and meaningless. It is now derived from
+      the same union `busy` reads, so the two are mutually exclusive by construction. */
+  readonly pendingPublish = computed(() => this.action().tag === 'ConfirmingPublish');
   readonly saveState = signal<SaveState>({ tag: 'Idle' });
 
-  /** The publish impact-confirm gate (PRD §7h: show N affected letters before POST). */
-  readonly pendingPublish = signal(false);
-
   readonly remoteData = computed(() => fromLoadLifecycle(this.model()));
 
   private loaded = computed<LoadedState | null>(() => {
@@ -165,60 +172,64 @@ export class OrgTemplateStore implements PendingSave {
       this.store.dispatch({ tag: 'DraftSaved', savedDraft: draft });
     } else {
       this.saveState.set({ tag: 'Error' });
-      this.actionState.set({ tag: 'Failed', error: r.error });
+      this.store.dispatch({ tag: 'ActionFailed', error: r.error });
     }
   }
 
   // --- publish (impact-confirm) / rollback / proefbrief ---
 
+  // RD-13: `requestPublish`/`cancelPublish` are the only two commands here that do
+  // NOT guard on `loaded()` — as dispatches they no-op outside `Loaded` by
+  // construction (the reducer's own guard), so behaviour is unchanged.
   requestPublish() {
-    this.pendingPublish.set(true);
+    this.store.dispatch({ tag: 'PublishRequested' });
   }
   cancelPublish() {
-    this.pendingPublish.set(false);
+    this.store.dispatch({ tag: 'PublishCancelled' });
   }
   async confirmPublish() {
     const s = this.loaded();
     if (!s) return;
-    this.pendingPublish.set(false);
-    this.actionState.set({ tag: 'Busy' });
+    // ActionStarted overwrites `action` straight to Busy, so ConfirmingPublish and
+    // Busy are never simultaneously true (RD-13).
+    this.store.dispatch({ tag: 'ActionStarted' });
     this.debouncedSave.cancel();
     await this.flushSave(); // publish the saved draft — flush any pending edit first
     const r = await this.adapter.publish(s.subOrgId);
     if (!r.ok) {
-      this.actionState.set({ tag: 'Failed', error: r.error });
+      this.store.dispatch({ tag: 'ActionFailed', error: r.error });
       return;
     }
-    this.actionState.set({ tag: 'Idle' });
+    this.store.dispatch({ tag: 'ActionFinished' });
     await this.selectSubOrg(s.subOrgId); // reload: new version, history, unsentBriefs = 0
   }
 
   async rollback(version: number) {
     const s = this.loaded();
     if (!s) return;
-    this.actionState.set({ tag: 'Busy' });
+    this.store.dispatch({ tag: 'ActionStarted' });
     this.debouncedSave.cancel();
     const r = await this.adapter.rollback(s.subOrgId, version);
     if (!r.ok) {
-      this.actionState.set({ tag: 'Failed', error: r.error });
+      this.store.dispatch({ tag: 'ActionFailed', error: r.error });
       return;
     }
-    this.actionState.set({ tag: 'Idle' });
+    this.store.dispatch({ tag: 'ActionFinished' });
     this.store.dispatch({ tag: 'DraftLoaded', view: r.value }); // old version copied into draft
   }
 
   async proefbrief() {
     const s = this.loaded();
     if (!s) return;
-    this.actionState.set({ tag: 'Busy' });
+    this.store.dispatch({ tag: 'ActionStarted' });
     this.debouncedSave.cancel();
     await this.flushSave(); // the proefbrief renders the server's draft
     const r = await this.adapter.proefbrief(s.subOrgId);
     if (!r.ok) {
-      this.actionState.set({ tag: 'Failed', error: r.error });
+      this.store.dispatch({ tag: 'ActionFailed', error: r.error });
       return;
     }
-    this.actionState.set({ tag: 'Idle' });
+    this.store.dispatch({ tag: 'ActionFinished' });
     this.blobPresenter.open(r.value);
   }