Hi Evan,
This is an interesting side effect that is really worth considering. At the beginning of the Orekit project, events were mainly intended for the use case of simple operational forecasts where everything was only dependent on current state and no cross coupling between events. However, we clearly observed that since these events were available, projects used them also to implement some mission logic with side effects. One example was for example the attitude sequences (switching from day to night attitude at eclipse entry and switching back, pointing to a target when it becomes visible…). These use cases were not expected but this move must be taken into account, it corresponds to users needs.
Looking at your analysis, I also find option 3 is the cleaner solution. As we intend to publish a major version next year (9.3 to be release soon will probably be the last in the 9.x series), then changing a public interface
like Action is something that can be done for 10.0.