Catch yoyaku up with current orchestra, and with what Drupal 11.5 deprecated

yoyaku tracks drupal/orchestra:1.x-dev and drupal/kessai:1.x-dev, and several changes landed there that the test suite and the shipped example did not follow. Two Drupal 11.5 deprecations sit under the next-major lane on top of that. Pipeline 946496 on 1.x was green at e184206d on 3 September 2026, and that same commit fails now.

Two removed methods. InteractionToken::isValid() was deleted as dead code in orchestra 2876c950 (#3620614); it was a one-line convenience over open(), which survives. OrchestraNotificationEvent::getProcessInstanceAttachments() became getAttachments() in 470ea04c (#3620621). Five call sites, all in tests; no production code called either.

A step offered to nobody. Orchestra d91a34b5 (#3620619) stopped opening a step whose audience matched nobody to everyone. The example granted a manager only to its manual-confirm resources, so on every other resource the operator cancellation step named an audience matching nobody: it is held closed, no work item is created and nothing parks there. Four scenarios were reading exactly that, an absent work item and n_cancel_window_operator missing from the parked nodes. The workflow always assumed every resource has an operator, so the seed now grants one per resource.

Layout keys with no schema. Orchestra f65ec944 (#3621295) made flow and node label layout position-only, saying a size there would be written on every save and never read back. The example workflow still shipped width and height on all 34 flow labels and both node labels, so installing it under the strict config schema checking a functional test turns on threw SchemaIncompleteException and every scenario in the class errored before it ran. Node shapes keep their size, which the schema still declares.

A hold smaller than the price. Orchestra 07fc5fa1 (#3620610) refuses to capture more than the payer authorized rather than capturing short. The authorize-then-settle scenario held 10.00 for a resource costing 20.00 collected in full, so the settle step resolved 20.00 due against a 10.00 authorization and declined. The fixture was always wrong; the refusal made it visible. It now holds what the settle step resolves, read from the resolver the step itself uses.

Two Drupal 11.5 deprecations. user_role_grant_permissions() and two BrowserTestBase::xpath() calls, all removed in Drupal 13, kept the next-major phpstan lane red. The replacements core names, RoleInterface::grantPermissions() and getNodeElementsByXpath(), do not exist in 11.3, which this module still supports, so version-neutral equivalents are used instead: grantPermission() one permission at a time, and the Mink call that core's own xpath() makes.

AI-Generated: Yes (Claude Code was used to help draft this issue summary and to write the fixes on the merge request. I reviewed the work, ran the affected test classes and installed both examples against a real site before posting.)