Allow Content Screening to stay enabled with an empty policy

[Paul Lizer (paullizer)]

Summary

• Allow administrators to enable Content Screening before choosing checks. First activation creates an enabled empty baseline only when no policy exists; existing policies are preserved.
• Keep new uploads on the normal processing path when no effective baseline or workspace checks apply. Existing enrollment, holds, review decisions, and publication requirements remain enforced.
• Allow empty policies to save in both classic and React V2, preserve policy drafts across activation, refresh creation ETags safely, and explain empty-policy states without implying that content passed screening.
• Update the directly related documentation and application version to 0.261.114. Target: paullizer-react-v2-ui on origin.

Linked issue

N/A — this work remains session-scoped at the administrator's request.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Release notes were deliberately left unchanged at the administrator's request.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.113 → 0.261.114. No deployer changes.

Testing / validation

• Complete content-screening functional suite: 643 tests and 688 subtests passed, using isolated service boundaries.
• Existing route-policy coverage: 14 checks passed.
• V2 production build, 30 screening logic checks, and 8 rendering checks passed.
• Classic/V2 browser workflows and shared policy parity cover first activation, enabled-empty saves, later rule insertion, workspace-only checks, draft preservation, concurrency, and visible failures. Final classic disable coverage waits for the actual configuration and policy responses and passes for both clean and dirty drafts.
• Documentation inventory/quality checks, scoped XSS/access guardrails, JavaScript syntax checks, and whitespace checks passed.

No deployment or live Azure mutations were performed. Enhanced Citations/storage prerequisites and configured scanner validation remain enforced.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated docs/admin/security.md, docs/guides/review-screened-documents.md, and docs/explanation/features/CONTENT_SCREENING_FRAMEWORK.md; added docs/explanation/fixes/CONTENT_SCREENING_EMPTY_POLICY_FIX.md. The regenerated surface inventory has no semantic changes. Release-note updates were declined.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new routes or raw settings exposure. Existing route authorization and held-document protections are retained.