Fix unrelated M365 banners and preserve drafts during session recovery

[Paul Lizer (paullizer)]

Summary

• Prevent optional background outgoing-action lookup failures from creating an M365 permission banner in unrelated React V2 conversations. Keep background discovery and contextual recovery for real saved actions and references.
• Distinguish confirmed SimpleChat session expiry from M365 reconnect/consent, conversation access denials, and connectivity failures. Use deduplicated read-only verification with a five-second timeout and a 15-second automatic-check cooldown for ambiguous transport failures.
• Show one app-level recovery notice without unmounting the chat, clearing the composer, or resetting an open schedule form. Preserve identity/race guards and never automatically replay a failed operation; new API writes stay blocked until recovery.

The original incident's token-versus-network cause remains unconfirmed without its request trace. No backend authorization, OAuth permissions, session lifetime, delivery policy, or classic UI behavior changes.

Linked issue

N/A. No associated issue; issue creation was declined.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.337 to 0.261.338. No deployer changes.

Testing / validation

• node --test .\functional_tests\test_v2_app_session_recovery.mjs .\functional_tests\test_v2_bootstrap_refresh_logic.mjs .\functional_tests\test_v2_workflow_plan_replay_client.mjs .\functional_tests\test_v2_access_restriction_and_safety_warning_logic.mjs - passed, 29 Node test results, including all 14 bootstrap checks.
• python .\functional_tests\test_v2_m365_pending_actions.py - passed, 15/15 checks; executed 32 logic, 44 store, 43 stream, and 19 session-recovery runtime tests without skips.
• python -m pytest .\ui_tests\test_v2_m365_pending_action_cards.py .\ui_tests\test_v2_workflow_plan_replay_card.py -q - passed, 28 tests. After expanding transport-failure and layout coverage, python -m pytest .\ui_tests\test_v2_workflow_plan_replay_card.py -q passed all 12 tests.
• npm --prefix .\application\v2_ui run typecheck - passed.
• npm --prefix .\application\v2_ui run build -- --outDir ..\..\ui_tests\artifacts\orchestration-plan-editor - passed; existing bundle-size warning only. Build artifacts are not committed.
• python .\scripts\build_docs_inventory.py - passed; regenerated inventory has no content changes.
• python .\functional_tests\test_docs_app_surface_coverage.py - passed, 7/7 checks.
• python .\functional_tests\test_docs_site_quality.py - passed, 6/6 checks.
• python .\scripts\check_xss_sinks.py .\application\v2_ui\src\components\layout\SessionNotice.tsx .\application\v2_ui\src\components\layout\AppShell.tsx .\application\v2_ui\src\components\chat\PendingActionSlots.tsx .\application\v2_ui\src\lib\apiClient.ts .\application\v2_ui\src\stores\appSessionStore.ts - passed for all five modules.
• Impeccable mechanical UI detector - passed with no findings.
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol diff --check - passed.

Browser coverage uses real React components and mocked HTTP boundaries, including desktop/mobile recovery, retained draft DOM, preserved schedule fields, confirmed expiry after rejected fetches, contextual action warnings, and no automatic POST replay. This is not a live-production reproduction of the original upstream failure.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Release notes remain unchanged: approval was requested, but the user was unavailable. Updated pending-action feature documentation, the chat-controls reference, getting-started recovery guidance, and the versioned fix analysis.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No Flask routes or settings payloads were added or changed. Existing provider authentication, conversation authorization, terms-of-use, and account-restriction behavior is preserved.