M4C-3: add finite Repeat-until workflows

[Paul Lizer (paullizer)]

Summary

Target: paullizer-react-v2-ui, not Development. Based on the freshly fetched M4C-2 merge 80f889034cde1f64d027692b363954d1af7fdcfb.

• Add serial, post-body Repeat until with named typed state, exact source receipts, mixed lifetime iteration identities, and durable recovery through the existing runner, lease, schema-2 journal and result stores.
• Require an explicit authored batch size. The separate administrator ceiling defaults to 25 and supports 1–1,000; new runs reject over-policy definitions without clamping. Exhaustion pauses, and authorized manual continuation grants another same-sized batch without resetting lifetime identities, the 5,000-admission budget, or the original elapsed deadline.
• Preserve current source authorization, accepted-partial coverage, locally metered loop/report runners, exact saved-record JSON exports, immutable artifact digests, the sole publication ledger, and existing submitted/approved/indexed-ready completion semantics.
• Complete personal/group V2 List authoring, exact nested-loop/state inspection, strict capability/response guards, Classic/V2 admin controls, regression coverage, and documentation. Application version: 0.261.120.

Linked issue

No associated issue was requested. Follows the merged workflow slices #1496, #1498, #1499 and #1501; no merged work is replayed.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Release-note batching, Latest Feature, and card-media decisions remain explicitly deferred to the owner. No historical announcements were silently backfilled.

Version bump

• application/single_app/config.py VERSION third segment bumped: 0.261.119 → 0.261.120
• deployers/version.txt bump not needed: no deployer files changed

Testing / validation

All service-dependent execution and browser checks used fictional, closed fixtures. No live workflow, destination publication, deployment, or permission change was performed.

• Final frozen-tree browser selection: 191 passed, 1 deselected. Covers Repeat (92), legacy editor (8), Classic/V2 admin (10), control runtime (9), and For-each (72). Files: test_v2_workflow_repeat_until.py, test_v2_workflow_editor.py, test_workflow_loop_admin_limits.py, test_v2_workflow_control_runtime.py, and test_v2_workflow_loops.py under ui_tests/.
• Final Repeat execution/recovery/state/publication/route-policy plus production dispatcher selection: 71 passed, 1 deselected (-k 'not real_thousand'). The closed-fixture audit observed zero DNS/connect attempts.
• Separate actual threshold test: 1 passed — 1,000 committed rounds, exhaustion, explicit continuation, lifetime round 1,001, and cold history/state authorization. Run with python -m pytest functional_tests/test_workflow_repeat_execution.py -k real_thousand.
• Earlier broader backend regression selection: 562 passed plus 63 subtests. This overlaps the focused selection; counts are not additive.
• V2 typecheck/production build, standalone local-browser assets (4/4), docs coverage (7/7), docs site quality (6/6), route policies, access/XSS guardrails, Python syntax and whitespace checks passed.

Known baseline exception: ui_tests/test_v2_workflow_loops.py::test_revoked_record_refresh_clears_the_previous_page was deliberately deselected and left unchanged. Its expected alert is inside an intentionally unmounted panel. The separate three configuration-dependent Office-export tests remain outside this slice. This is not a claim that the entire repository suite is green.

Documentation

• Release notes updated, or not needed — deferred pending the owner's coordinated announcement decision
• Feature documentation updated: docs/explanation/features/WORKFLOW_REPEAT_UNTIL.md, related workflow contracts, admin reference, and user guides
• Separate fix documentation not needed: the feature document includes recovery/integration behavior and regression evidence

The documentation surface inventory was regenerated and checked; it has no semantic change.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) and existing scoped access policies
• Non-admin settings projection remains sanitized; private state/result references and provider locators are not exposed
• Browser JavaScript is served from local SimpleChat static assets only; no CDN, dynamic-import, or worker-script additions
• No secrets, connection strings, session artifacts, local environments, or generated SPA build files are included

Scope boundaries

M5A read-only Flow, M5B visual authoring, Control Center Workflow Monitoring, cumulative run-token/spend caps, additional export formats, orchestration output, and live rollout acceptance remain separate work. No second scheduler, exporter framework, publication ledger, or model-prose control state is introduced.