[Paul Lizer (paullizer)]

Summary

• Save accepted Orchestrate questions and their planning state before slow planning starts. Previously, a planner rejection could leave nothing in saved history, so navigating away or refreshing made the question, planning state, and error disappear.
• Detach planning from its observing event stream and hand originally authorized Auto work to the existing server-side execution admission and run-claim path. Manual/review approvals remain required; explicit Stop is submission-scoped and fenced against late workers.
• Restore initial planning, clarification, review, failure, and execution state from saved history, including canonical retries and shared-message/source-ID reconciliation, without duplicating questions or taking over an ordinary chat stream.
• Integrate the latest nine base commits without rewriting history, preserving guided questions, selected-document planning corrections, and conversation attachment isolation. Align their regression fixtures with the combined lifecycle and reviewed-answer flow.

Uses the existing message and orchestration containers; no new deployment resources or settings are required. Process interruption remains an explicit recoverable state, not permission to replay uncertain external effects. This does not reconstruct questions older versions never saved. Nothing has been deployed to Azure.

Linked issue

Fixes #1893

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version relative to the updated base: 0.261.414 -> 0.261.415. No deployer files changed.

Testing / validation

Current-head local validation follows. Offline Python selections used PYTHONPATH containing application\single_app and functional_tests. Browser checks used local Chromium, not the deployed Azure application.

• python .\scripts\check_cosmos_response_boundaries.py --run-contracts - passed: 2,002 tests and 431 subtests, with network blocked; 1,092 owners, 425 doubles, and zero inventory review gaps.
• python -m pytest -q -p test_support.cosmos_network_guard --disable-warnings --tb=short --show-capture=no .\functional_tests\test_orchestration_document_planning_recovery.py .\functional_tests\test_orchestration_planning_persistence.py .\functional_tests\test_guided_user_input_orchestration.py - 96 passed.
• python -m pytest -q --disable-warnings --tb=short --show-capture=no .\ui_tests\test_v2_orchestration_planning_persistence.py .\ui_tests\test_v2_orchestration_planning_retry.py .\ui_tests\test_v2_chat_attachment_isolation.py .\ui_tests\test_v2_guided_user_input.py .\ui_tests\test_v2_new_chat_reset.py - 72 passed.
• python .\ui_tests\test_v2_orchestration_elicitation.py - 6/6 passed using its standalone initialization.
• python .\ui_tests\test_v2_orchestration_run_hydration.py - 7/7 passed using its standalone initialization.
• node .\functional_tests\test_v2_chat_attachment_isolation.mjs - passed.
• npm --prefix .\application\v2_ui run typecheck - passed.
• npm --prefix .\application\v2_ui run build - passed.
• python .\functional_tests\route_tests\test_route_blueprint_policy_inventory.py - 15/15 passed.
• python .\functional_tests\route_tests\test_route_unauthenticated_policy_contract.py - 10/10 passed.
• python .\functional_tests\route_tests\test_route_policy_test_coverage.py - 3/3 passed.
• python .\functional_tests\test_docs_app_surface_coverage.py - 7/7 passed; generated inventory remains current.
• python .\functional_tests\test_docs_site_quality.py - 6/6 passed.
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol --no-pager diff --cached --check - passed.

The 47 generated-inventory conflicts were module hashes only. They were regenerated while retaining runtime-backed reviews only for identical consumer bodies. Planner-only fixtures retain their no-step-execution guard and now verify the approved Auto handoff separately; real detached Auto completion remains covered. Browser fixtures explicitly answer the new pending-input reads and durable Stop acknowledgement without relaxing unexpected-request checks. Domain validators and repository guard rules were not weakened.

Existing clarification coverage requires exactly one saved question with its original acknowledged ID across repeated continuations. A historical-message fixture uses its insertion time instead of a future timestamp, preserving the pre-turn history boundary.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated the orchestration feature/recovery documentation and plan-review guide, and added docs/explanation/fixes/ORCHESTRATION_INITIAL_TURN_PERSISTENCE_FIX.md. Both feature histories were preserved during the base merge. Release notes were offered but left unchanged pending author approval.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

Turn status and cancellation revalidate conversation/question ownership. Normal history exposes public lifecycle hints, not private claim tokens or canonical planning records. No new raw-settings response was introduced.