Stabilize Analyze planning, downloads, and mobile chat

[Paul Lizer (paullizer)]

Summary

Target: paullizer-react-v2-ui. Analyze stabilization only; the separate M4A workflow implementation is not included.

• Retry failed planning with the original prompt, model/agent, document/scope context, and approval mode instead of posting a temporary message ID to the saved-message API. Pinned documents no longer force an unwanted Search step; unusable plans remain explicit failures.
• Download generated CSV/Markdown through the correct artifact reader, preserving conversation participation, source/screening checks, approval/publication state, and reference/hash validation before and after reading. Workspace-linked files use their admitted representation. Both UIs keep download errors in chat; exact-origin CORS exposes attachment filenames for separately hosted V2.
• Keep narrow-screen navigation and conversation drawers from pushing results off-screen. Add fresh three-document, cross-UI, evidence, actual-download-byte, saved-follow-up, cancellation, and recovery regressions.

Linked issue

No associated issue; the user declined creating one. This builds on the integrated Analyze and screening baselines from #1483, #1484, #1485, and #1494.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped to 0.261.115. The target advanced to 0.261.114 before publication, so this avoids reusing its version.
• deployers/version.txt bump not needed; deployers/ was not changed.

Testing / validation

Published revision: 4876f1161e7c5d57f9ab83494fa70b54e6305974, incorporating React V2 baseline 5af5fc8a.

• npm --prefix .\application\v2_ui run build passed, including TypeScript compilation; existing large-bundle warning remains.
• 56 focused functional/browser cases passed using the repository-pinned environment: test_chat_artifact_download_bytes.py, test_orchestration_planner_failure_diagnostics.py, test_analyze_three_document_smoke.py, test_v2_artifact_download_cors.py, test_v2_orchestration_planning_retry.py, and test_chat_three_document_smoke.py.
• Regenerated the documentation inventory; 27 documentation/route-policy cases passed, including all three route-policy suites.
• Earlier validation on the screened c1a41709 baseline passed 200 affected browser cases plus two fresh three-document cross-UI cases; 99 focused backend tests plus 61 subtests. The broader 315-case selection had 305 passes plus 142 passing subtests and 10 baseline workflow failures, documented below.

Known limits, not an all-green or live-acceptance claim:

• Ten existing workflow runner/fixture failures remain on this branch: two pending/uncertain publication projection expectations, one outdated revocation-error expectation, and seven legacy handoff fixtures missing the integrated screening callable. Their fixes belong to the separately coordinated M4A workstream and are not bundled into this PR. Workflow engine/schema/result-store code is unchanged relative to the target.
• The fresh Supplier/Terms/Governance fixture exercises the real producer, saved readers, exports, and both UIs with deterministic provider/transport boundaries. It checks all factual anchors and saved-data reuse without another source pass; it is not a live gpt-4o quality claim.
• The inspected Azure target was still configured for 0.261.107-f007187d. Fresh deployed acceptance and controlled second-account checks remain blocked pending an explicitly authorized matching environment. No deployment, real workspace publication, or live permission changes were made.

Documentation

• Release notes updated with user approval under 0.261.115.
• Analyze and plan-recovery guides, feature documentation, and chat-control reference updated.
• Root causes, exact baselines, regression evidence, and remaining boundaries documented in docs/explanation/fixes/ANALYZE_STABILIZATION_FIX.md.

Security checklist

• Existing Flask routes retain Swagger/auth decorators; no new routes introduced. Route-policy checks passed.
• No raw settings are newly exposed to non-admin frontends.
• Browser JavaScript remains locally served; no CDN runtime dependencies added.
• No secrets, keys, connection strings, or local-only test artifacts included.