feat(form-builder): retry history table + integration (WS-6)

Per-attempt retry history (timestamp, user, outcome, exception detail
if failed) replaces the counter-only retry_count tracking.

Changes:

- New `form_submission_action_failure_retry_attempts` table (cascade on
  parent delete, nullOnDelete on user). Explicit short FK names
  (`fsafra_failure_fk`, `fsafra_user_fk`) — auto-generated names exceed
  MySQL's 64-char identifier limit.
- New FormSubmissionActionFailureRetryAttempt model + factory +
  succeeded() state.
- Parent FormSubmissionActionFailure gets retryAttempts() HasMany
  relation (latest('attempted_at')).
- New FormFailureRetryService centralises the retry-flow logic. Both
  the API controller and the artisan command delegate to it. Service
  writes a retry_attempt record per attempt; parent's retry_count
  stays as denormalised cache for index-view performance.
- Successful retry: attempt(succeeded) + parent.retry_count++ +
  parent.resolved_at + parent.resolved_by_user_id + parent.resolved_note
  ("Geslaagde retry door {actor.name}" or "Geslaagde retry
  (geautomatiseerd)" for command-line invocation without an actor).
- Failed retry: attempt(failed) with NEW exception details +
  parent.retry_count++. Parent's exception_class/_message stay
  audit-immutable — they represent the FIRST failure.
- canBeRetried() now correctly checks both resolved_at AND
  dismissed_at (sessie 2's open question Q2 closure).
- New FailureNotRetriableException (controller → 422) and
  ParentSubmissionGoneException (controller → 410) for cleaner
  flow control.

12 new tests:
- FormSubmissionActionFailureRetryAttemptTest (5 unit tests)
- RetryFlowProducesRetryAttemptsTest (7 integration tests covering
  succeeded path, failed path, resolved/dismissed blocking,
  multiple-retries chronological ordering, canBeRetried truth tables)

Pre-existing tests touched:
- FormSubmissionActionFailureTest::test_can_be_retried_only_for_open_state
  — updated to reflect Q2 closure (resolved now blocks too).
- Ws6FoundationMigrationTest::test_down_methods_clean_up_columns_and_table
  — child table must drop before parent (FK constraint).
- 5 backfill test step-counts bumped +1 (new migration sits at top).

SCHEMA.md → v2.9. Schema dump regenerated.

Refs: RFC-WS-6.md §3 Q5 addendum, sessie 2 Q2

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

api/app/Models/FormBuilder/FormSubmissionActionFailure.php

@@ -11,6 +11,7 @@ use Illuminate\Database\Eloquent\Concerns\HasUlids;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
 use Illuminate\Database\Eloquent\Model;
 use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
 
 /**
  * RFC-WS-6 §3 (Q5) — audit table for binding-pipeline failures.
@@ -29,6 +30,7 @@ final class FormSubmissionActionFailure extends Model
 {
     /** @use HasFactory<\Database\Factories\FormBuilder\FormSubmissionActionFailureFactory> */
     use HasFactory;
+
     use HasUlids;
 
     protected $table = 'form_submission_action_failures';
@@ -85,6 +87,19 @@ final class FormSubmissionActionFailure extends Model
         return $this->belongsTo(User::class, 'dismissed_by_user_id');
     }
 
+    /**
+     * RFC-WS-6 Q5 addendum (sessie 3c) — per-attempt retry history.
+     * `retry_count` on this model stays as denormalized cache; the
+     * detail UI consumes this relation for per-attempt timeline.
+     *
+     * @return HasMany<FormSubmissionActionFailureRetryAttempt, $this>
+     */
+    public function retryAttempts(): HasMany
+    {
+        return $this->hasMany(FormSubmissionActionFailureRetryAttempt::class, 'form_submission_action_failure_id')
+            ->latest('attempted_at');
+    }
+
     /**
      * @param  Builder<FormSubmissionActionFailure>  $query
      * @return Builder<FormSubmissionActionFailure>
@@ -117,8 +132,14 @@ final class FormSubmissionActionFailure extends Model
         return $this->resolved_at === null && $this->dismissed_at === null;
     }
 
+    /**
+     * Sessie 3c (Q2 closure): a resolved failure also blocks retry —
+     * retrying a closed failure would either no-op or trigger a
+     * spurious state transition. Both are unwanted. Open is the only
+     * retriable state.
+     */
     public function canBeRetried(): bool
     {
-        return $this->dismissed_at === null;
+        return $this->resolved_at === null && $this->dismissed_at === null;
     }
 }

api/app/Models/FormBuilder/FormSubmissionActionFailureRetryAttempt.php

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Models\FormBuilder;
+
+use App\Models\User;
+use Illuminate\Database\Eloquent\Concerns\HasUlids;
+use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+/**
+ * RFC-WS-6.md §3 Q5 addendum — per-attempt retry history.
+ *
+ * Each retry of a FormSubmissionActionFailure produces a row here.
+ * Outcome is 'succeeded' (parent gets resolved_at + system note) or
+ * 'failed' (parent remains open with retry_count incremented; if the
+ * exception details differ from the original, they're captured
+ * per-attempt). Parent's own `exception_class` / `exception_message`
+ * stay audit-immutable — they represent the FIRST failure, not the
+ * latest retry.
+ */
+final class FormSubmissionActionFailureRetryAttempt extends Model
+{
+    /** @use HasFactory<\Database\Factories\FormBuilder\FormSubmissionActionFailureRetryAttemptFactory> */
+    use HasFactory;
+
+    use HasUlids;
+
+    protected $table = 'form_submission_action_failure_retry_attempts';
+
+    protected $fillable = [
+        'form_submission_action_failure_id',
+        'attempted_at',
+        'attempted_by_user_id',
+        'outcome',
+        'exception_class',
+        'exception_message',
+    ];
+
+    /** @var array<string, string> */
+    protected $casts = [
+        'attempted_at' => 'datetime',
+    ];
+
+    /** @return BelongsTo<FormSubmissionActionFailure, $this> */
+    public function failure(): BelongsTo
+    {
+        return $this->belongsTo(FormSubmissionActionFailure::class, 'form_submission_action_failure_id');
+    }
+
+    /** @return BelongsTo<User, $this> */
+    public function attemptedBy(): BelongsTo
+    {
+        return $this->belongsTo(User::class, 'attempted_by_user_id');
+    }
+}