Add durable workflow publication completion policies (M4C-1)

[Paul Lizer (paullizer)]

Summary

• Add one optional completion policy for existing native Analyze artifacts in version-3 durable workflows: Submitted, Approved, or Indexed and ready. New publication tasks default to Submitted; omitted policies preserve existing behavior.
• Reuse the existing publication ledger, destination identities, runner and lease for durable reconciliation. Preserve achieved completion snapshots across crashes, distinguish approval from native processing/index readiness, and pause uncertain effects without creating duplicate documents or resending completed notifications.
• Add capability-aware V2 List authoring and safe execution/attempt inspection, including keyboard/mobile coverage and explicit saved-completion observations.
• Add regression coverage and documentation, and bump the application patch version to 0.261.118.

Target: paullizer-react-v2-ui, based on 42ab58b96da8677c338fcc04448ef09eec031e03 with merged M4A #1496, its paged follow-up, and M4B #1498. This PR contains only M4C-1. Generic Collect/saved-output publication, Repeat until, and Flow remain separate slices. Existing loop limits and the owner's deferral of a cumulative run-token/spend cap are unchanged.

Linked issue

N/A - the owner chose to keep this slice issue-free. The merged PRs above are baseline references, not unresolved issues.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

No new administrator toggle, deployment setting, scheduler, or container is introduced. Existing destination approval roles and screening rules remain enforced.

Should this become a Latest Feature card?

• Yes
• No
• Already added

Not decided; no Latest Feature card is included in this slice.

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.117 -> 0.261.118. No deployer files changed.

Testing / validation

• Focused backend coverage in test_workflow_publication_completion.py, test_workflow_structured_publication.py, and test_publication_native_processing.py: actual native Analyze results, personal/group/public destinations, Cosmos/Blob storage, delayed approval/index visibility, source revocation, lost acknowledgements, byte integrity, and exact native screening release proof.
• Final structured publication selection: 26 passed, including crashes after success but before task-result caching, followed by approval, rejection, cancellation, or destination deletion. Completed snapshots remain unchanged while current authorization is rechecked.
• Existing publication/durable-run compatibility selection: 115 passed and 34 subtests. Shared structured execution, loop identities, result storage and lease selection: 351 passed and 93 subtests. These selections overlap other focused runs and are not a combined suite total.
• Local Chromium: 74 cases passed (59 publication cases and 15 existing runtime/recovery/legacy-publication regressions); two initial concurrent navigation timeouts passed on serial retry. 9 focused display/attempt cases passed after the saved-observation wording update; counts overlap.
• npm --prefix .\application\v2_ui run typecheck and npm --prefix .\application\v2_ui run build passed. Existing lockfile dependencies were restored locally; dependency manifests are unchanged.
• Route-policy suites passed (20 tests). Changed-tree Python parsing, access-control and XSS guardrails passed with no findings; whitespace checks passed.
• python .\scripts\build_docs_inventory.py, documentation surface coverage (7/7) and site quality (6/6) passed. The regenerated inventory has no logical changes.

All workflow/document fixtures were fictional with external service boundaries closed. Both Azure Playwright service settings were cleared for local browser runs. No deployment, live permission changes, private production workflow invocation, or live document publication was performed.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added docs/explanation/features/WORKFLOW_PUBLICATION_COMPLETION.md and updated workflow guides, the workflow admin reference, and related Analyze/structured-flow documentation. Release notes were offered, but approval was unavailable, so docs/explanation/release_notes.md remains unchanged. Recovery fixes introduced within this feature are documented and covered with the feature's regressions.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new routes or raw settings responses were added. Existing modified routes retain their Blueprint/auth/Swagger policies. Source, artifact and destination authorization is rechecked at sensitive boundaries; private receipt/processing evidence is excluded from public projections.