Add M4B serial workflow loops and exact Collect

[Paul Lizer (paullizer)]

Summary

• Extend the existing v3 runner with serial/nested For each over frozen authorized documents, complete saved records, or workspace queries, and exact paged Collect with execution/item/attempt-scoped identities, coverage, and provenance.
• Add a 500-item default, administrator-configurable from 1–5,000, with lower authored limits, explicit over-limit errors, and admitted policies that remain unchanged for active runs. Query selection distinguishes exhaustive metadata/keyword matches from explicit ranked Best N documents.
• Add usable personal/group V2 List authoring and paged run inspection, current-document native Analyze, local-runner eligibility, explicit saved-record reporting, and retained-data pauses when safe splitting is unavailable. Preserve V1/V2/M4A behavior and the existing lease, storage, authorization, and publication boundaries.
• Document the supported slice and bump the application to 0.261.117. Repeat until, publication/index-readiness extensions, generic aggregate publication, hosted-agent loops, cumulative spending caps, and Flow editing remain deferred.

Target branch: paullizer-react-v2-ui. The fetched target remains 36826e54, including both M4A commits and its paged per-document result follow-up. No deployment, permission change, live workflow execution, or live test publication was performed.

Linked issue

No associated issue; the owner requested that this work remain without a new issue. Builds on merged M4A PR #1496; it does not reopen or duplicate that work.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Release-note changes were offered but not confirmed while the owner was unavailable, so docs/explanation/release_notes.md is unchanged. Feature/admin/user documentation is included.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.116 → 0.261.117. No deployer files changed.

Testing / validation

• Integrated targeted backend matrix: 971 tests and 492 subtests passed, covering new loops/Collect plus retained definition, durable-runtime, source/result, model-context, native Analyze, publication, and fence contracts. Later integration refinements passed their focused selections; these overlapping counts are not added together.
• Actual 0/1/10/100/500-item runs; nested iteration/restart/approval isolation; zero/multiple records; duplicate business-key errors; frozen membership; and a multi-node run exceeding 1,000 execution records.
• Production-backed native per-item Analyze and Collect, current-source revocation, both result backends, bounded hierarchical indexes, >8 MiB collection/reporting cases, and a middle-only sentinel beyond 12,000 characters without upload/indexing.
• 118 closed local browser tests passed for the real V2 SPA and Classic/V2 admin surfaces, including shared-document recipient scope, reporting opt-in, candidate-limit notices, paging, draft preservation, keyboard/mobile interactions, and privacy/error states.
• npm --prefix .\application\v2_ui run typecheck and npm --prefix .\application\v2_ui run build passed. Browser runs used the isolated pinned Python environment and cleared Playwright cloud service variables.
• Route policy suites, changed-route Swagger checks, final changed-tree XSS/access-control guardrails (60 files, zero findings), Python compilation, and whitespace checks passed.
• Documentation inventory regenerated; coverage 7/7 and site quality 6/6 passed. The generated inventory has no semantic change to commit.

The global Flask/Werkzeug mismatch was resolved only in a session-local test environment using repository pins; global dependencies were not changed. Existing dependency deprecation and Vite bundle-size warnings remain non-blocking. No live-deployment acceptance is claimed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added docs/explanation/features/WORKFLOW_FOR_EACH_COLLECT.md; updated workflow guides, admin limits, structured-flow, data-flow, and result-reader documentation. The explicit saved_record_report mode permits qualitative batching without silently changing arbitrary task semantics; originals remain durable.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

Non-admin workflow responses expose existing explicit non-secret editor/history projections rather than raw settings. Current workflow/group/source access, frozen membership, exact execution/attempt identity, and write fences remain enforced at their operation boundaries. Private journal data and raw report checkpoints are not browser projections.