Reduce V2 group-switch latency and add bootstrap phase timing

[Paul Lizer (paullizer)]

Summary

• Group switching unnecessarily waited for the complete V2 bootstrap, whose observed production median was approximately 5.1 seconds. Confirm the saved selection through authenticated GET /api/v2/scope instead, retaining preflight and final access checks, draft protection, and read-only recovery after ambiguous writes.
• Preserve catalogs during scope confirmation, reject malformed or competing selections, and prevent overlapping bootstrap responses from restoring an old selection. Bootstrap and scope reads use no-store; other requests retain their existing cache behavior.
• Add flat numeric bootstrap phase timings to Application Insights, regression coverage, and documentation. The review follow-up standardizes all scope response tuples and brings the application version to 0.261.306.

Initial-load optimization is intentionally deferred. This change is not deployed, and production switch improvements remain unmeasured. Browser cache-lock attribution is a hypothesis, not an established root cause.

Linked issue

Refs #1725

That P1 issue tracks the broader backend bootstrap optimization and should remain open after this quick fix merges.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.304 -> 0.261.306, including the 0.261.305 quick fix and 0.261.306 response-contract review follow-up. No deployer changes.

Testing / validation

Python backend tests used a session-local environment with repository-pinned Flask 3.1.3 and Werkzeug 3.1.6. Backend and browser tests use isolated storage/HTTP fixtures, not live Azure performance measurements. Backend, route-policy, and documentation checks were rerun for the review fix; the JavaScript, build, and browser results below cover the original quick fix, whose frontend code is unchanged by the follow-up.

• python -m pytest functional_tests\test_v2_scope_and_bootstrap_timings.py functional_tests\test_v2_group_workspace_context.py functional_tests\test_v2_bootstrap_branding_and_navigation.py functional_tests\test_v2_admin_settings_live_shell_refresh.py -q --tb=short --disable-warnings - 117 passed, 16 existing return-value warnings. Includes three new response-tuple cases for success, missing identity, and storage failure.
• node functional_tests\test_v2_bootstrap_refresh_logic.mjs - 14/14 passed; node functional_tests\test_v2_group_workspace_context_logic.mjs - 30 checks passed.
• npm run build from application\v2_ui - passed, including TypeScript; existing large-bundle warning remains out of scope. Generated local static assets are not committed.
• $env:PYTHONPATH="$PWD;$PWD\ui_tests\fixtures;$PWD\ui_tests"; python -m pytest ui_tests\test_v2_group_workspace_shell.py -q --tb=short - 30 passed, including desktop/mobile switching without an extra bootstrap request.
• python functional_tests\route_tests\test_route_blueprint_policy_inventory.py && python functional_tests\route_tests\test_route_unauthenticated_policy_contract.py && python functional_tests\route_tests\test_route_policy_test_coverage.py - 14/14, 9/9, and 3/3 passed.
• python functional_tests\test_docs_app_surface_coverage.py && python functional_tests\test_docs_site_quality.py - 7/7 and 6/6 passed; regenerated inventory has no semantic change.
• python scripts\check_broken_access_control.py application\single_app\route_backend_v2.py - passed.
• python scripts\check_xss_sinks.py application\single_app\route_backend_v2.py application\v2_ui\src\lib\apiClient.ts application\v2_ui\src\lib\endpoints.ts application\v2_ui\src\lib\types.ts application\v2_ui\src\stores\bootstrapStore.ts application\v2_ui\src\stores\groupWorkspaceStore.ts - passed for the original quick fix; python scripts\check_xss_sinks.py application\single_app\route_backend_v2.py also passed for the review follow-up.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added docs/explanation/fixes/V2_GROUP_SWITCH_LATENCY_FIX.md, including timing-query instructions and production-validation limitations. Updated release notes and logging-tag reference. No new user-facing feature page is needed.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

The new endpoint returns only the caller's identity and authorized active-scope fields, never raw settings or catalogs. Storage failures return an explicit 503. Phase-timing events contain numeric durations, not identities, settings, or catalog contents.