Fix orchestration document analysis handoffs and recovery

[Paul Lizer (paullizer)]

Summary

• Fully read documents could still produce malformed analysis metadata, making complete-only drafting refuse the input. Manual recovery then reused the same partial producer and repeated that refusal.
• Add explicit response shapes and bounded source-grounded correction within the existing window retry limit. Preserve findings, values, evidence and qualification text; genuine uncertainty and incomplete coverage still block drafting.
• Make manual recovery revisit affected partial producers and repair saved malformed windows while reusing good windows. Preserve same-attempt immutable receipts, current authorization and execution fences; attach retry lineage only to an unregistered bootstrap guard.
• Cover selected and search-discovered sources through actual Markdown/Word publication, add safe hashed correction diagnostics, and document the general fix. Ordinary search/RAG chat and Compose correction remain unchanged. No production deployment or replay was performed.

Linked issue

N/A - the user declined a tracking issue.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.308 -> 0.261.309. No deployer changes.

Testing / validation

Tests ran offline with PYTHONPATH including application\single_app and functional_tests, using an isolated Python 3.12 environment with repository-pinned Flask/Werkzeug and compatible cryptography. No global dependency changes or Azure mutations.

• python -m pytest functional_tests\test_orchestration_document_derivation_reliability.py functional_tests\test_document_analysis_final_results.py functional_tests\test_document_analysis_work_recovery.py functional_tests\test_document_analysis_evidence_matching.py functional_tests\test_document_analysis_attempt_fences.py functional_tests\test_analyze_live_write_fences.py functional_tests\test_orchestration_internal_analysis.py functional_tests\test_orchestration_dependency_runtime.py functional_tests\test_orchestration_dependency_recovery.py functional_tests\test_orchestration_dependency_commit_recovery.py functional_tests\test_orchestration_result_recovery.py functional_tests\test_orchestration_recovery_safety.py functional_tests\test_orchestration_compose_output_retry.py functional_tests\test_orchestration_reason_render_pipeline.py functional_tests\test_workflow_durable_analysis.py -q --tb=short --disable-warnings - 573 passed.
• python -m pytest functional_tests\test_generated_file_structured_renderers.py functional_tests\test_office_file_renderers.py functional_tests\test_orchestration_render_read_failures.py functional_tests\test_orchestration_render_check_cadence.py functional_tests\test_orchestration_render_resume.py functional_tests\test_orchestration_render_waiting_runtime.py -q --tb=short --disable-warnings - 579 passed, 82 subtests passed.
• python functional_tests\test_docs_app_surface_coverage.py - 7 checks passed, inventory current.
• python functional_tests\test_docs_site_quality.py - 6 checks passed.
• git diff --check - passed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Release notes were left unchanged pending user approval. Updated checkpoint recovery and Gather / Reason / Render documentation; added ORCHESTRATION_DOCUMENT_DERIVATION_RELIABILITY_FIX.md with root cause, safeguards, limitations and validation results.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No routes, frontend settings payloads or browser assets were added. Correction does not relax source evidence, completeness, cancellation, access or durable publication guards.