Fix HNS result cleanup and workflow deletion recovery

[Paul Lizer (paullizer)]

Summary

• Workflow deletion failed with HTTP 500 because private result cleanup treated ADLS Gen2 directory entries as invalid result files. Read-only inspection confirmed zero-byte hdi_isfolder=true entries inside both affected live workflow cleanup scopes.
• Accept only explicitly identified, empty directories at the permitted hashed path depths. Delete verified files first, then re-read directories and delete deepest-first with ETag conditions and no recursive deletion. Preserve integrity checks, scope isolation, runtime fences, and retryable cleanup failures.
• Return safe JSON deletion errors and cancellation conflicts, and withhold deletion-fenced saved previews instead of failing run-history reads. Also allow the existing aggregate completion_tokens and xml_schema_source_count telemetry fields so telemetry does not fail Analyze runs.

This targets the workspace-selected paullizer-react-v2-ui integration branch. Nothing has been deployed or deleted from production. After deployment, retry Delete on partially deleted workflows; Cancel cannot restore their tombstoned runtime. No schema migration or new setting is required.

Linked issue

N/A. The user declined issue creation.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.304 -> 0.261.305. No deployer changes.

Testing / validation

Python commands used an isolated Python 3.12 validation environment ($python) with repository-pinned Flask/Werkzeug and a compatible OpenSSL dependency. $env:PYTHONPATH="$PWD\application\single_app;$PWD\functional_tests" was set. The shared Python installation was not changed.

• & $python -m pytest -q functional_tests\test_workflow_result_store.py functional_tests\test_workflow_delete_recovery_routes.py functional_tests\test_saved_analysis_service.py functional_tests\test_group_workflow_fixture_parity.py functional_tests\test_workflow_saved_results_container_access.py functional_tests\test_workflow_run_history_source_recheck_fix.py functional_tests\route_tests\test_workflow_repeat_policy.py -p no:cacheprovider --tb=short - 211 passed, 112 subtests passed.
• & $python -m pytest -q functional_tests\test_mixed_source_hardening.py functional_tests\test_workflow_cancellation.py -k 'telemetry or request_persists or early_cancellation or deleting_workflow or durable_runtime_conflicts or cancellation_contracts' -p no:cacheprovider --tb=short - 8 passed, 21 deselected.
• & $python -m pytest -q functional_tests\test_log_injection_codeql_alerts_fix.py -p no:cacheprovider --tb=short - 44 passed, including cold imports.
• node --test functional_tests\test_v2_workflow_run_action_clients.mjs - 14 passed.
• & $python functional_tests\route_tests\test_route_blueprint_policy_inventory.py - 14/14 passed.
• & $python functional_tests\route_tests\test_route_unauthenticated_policy_contract.py - 9/9 passed.
• & $python functional_tests\route_tests\test_route_policy_test_coverage.py - 3/3 passed.
• & $python functional_tests\test_docs_app_surface_coverage.py - 7/7 passed, inventory current.
• & $python functional_tests\test_docs_site_quality.py - 6/6 passed.
• git -c core.whitespace=blank-at-eol,blank-at-eof,space-before-tab,cr-at-eol --no-pager diff --cached --check - passed.

An optimized-Python probe also confirmed the new telemetry test still executes its emitters with assertions disabled. Read-only live storage diagnostics verified directory markers and zero size in both listings and fresh property reads; no payloads were read or objects changed.

Known baseline failures: & $python -m pytest -q functional_tests\test_mixed_source_hardening.py functional_tests\test_workflow_cancellation.py -p no:cacheprovider --tb=short produced 19 passed, 10 failed. The same ten failures were reproduced before this fix. They involve stale AST harness dependencies, missing Azure configuration, and older evidence/runner expectations; they are documented and not reported as passing.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added docs/explanation/fixes/WORKFLOW_DELETE_HNS_DIRECTORY_FIX.md; updated durable-execution documentation and workflow troubleshooting guidance. Release-note approval was requested, but the user was unavailable, so release notes remain unchanged.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new routes, settings responses, or browser assets were introduced. Existing personal ownership and group management checks remain intact.