Improve conversation deletion recovery diagnostics and regression coverage

[Paul Lizer (paullizer)]

Summary

• Conversation deletion failed because HNS directory entries were rejected during private execution-result cleanup, not because of a Microsoft 365 authentication change. Builds on merged Fix HNS result cleanup and workflow deletion recovery #1726; this PR contains only the conversation-specific follow-up.
• Return trusted JSON errors that distinguish integrity, storage, pending-action cancellation, and other cleanup failures. Bulk deletion preserves existing fields and adds per-conversation failure details.
• Log safe cleanup stages, exception classes, application codes, and hashed correlations without provider text or tracebacks. Preserve fail-closed history deletion, durable producer fences, and generated-file cleanup rules; partial storage cleanup remains retryable.
• Add 42 real-route regression cases and restore legacy ownership-test imports on success and setup failures. Document recovery and bump the application to 0.261.306. No production data was manually deleted or deployment performed.

Linked issue

N/A - no associated issue. Related merged PR: #1726.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.305 -> 0.261.306. No deployer changes.

Testing / validation

Validation used an ignored local virtual environment with repository-pinned Flask/Werkzeug and a compatible OpenSSL package. No dependency manifests or global Python packages were changed. For application imports, each shell set $env:PYTHONPATH = Join-Path (Get-Location) 'application\single_app' and $env:PYTHONIOENCODING = 'utf-8'.

• .\.venv\Scripts\python.exe -m pytest -q --tb=short --disable-warnings .\functional_tests\test_workflow_result_store.py .\functional_tests\test_orchestration_deletion_enrollment.py .\functional_tests\test_orchestration_cleanup_bootstrap.py .\functional_tests\test_orchestration_output_cleanup.py .\functional_tests\test_orchestration_output_deletion_pipeline.py .\functional_tests\test_orchestration_output_lifecycle.py .\functional_tests\test_orchestration_initial_claim_recovery.py .\functional_tests\test_conversations_read_ownership_authorization.py .\functional_tests\test_conversation_delete_hns_directory_cleanup.py .\functional_tests\test_saved_analysis_service.py .\functional_tests\test_m365_conversation_lifecycle.py - passed: 541 tests and 112 subtests.
• .\.venv\Scripts\python.exe -m pytest -q --tb=short --disable-warnings .\functional_tests\test_conversation_delete_hns_directory_cleanup.py .\functional_tests\test_conversations_read_ownership_authorization.py - passed: 52 tests in reverse fixture order.
• .\.venv\Scripts\python.exe .\functional_tests\test_conversations_read_ownership_authorization.py - passed: 10/10 checks.
• .\.venv\Scripts\python.exe -m pytest -q --tb=short --disable-warnings .\functional_tests\test_conversations_read_ownership_authorization.py .\functional_tests\test_conversation_delete_hns_directory_cleanup.py .\functional_tests\route_tests\test_route_blueprint_policy_inventory.py - passed: 66 tests after the final version update.
• .\.venv\Scripts\python.exe .\functional_tests\route_tests\test_route_blueprint_policy_inventory.py - passed: 14/14 checks.
• .\.venv\Scripts\python.exe .\functional_tests\route_tests\test_route_unauthenticated_policy_contract.py - passed: 9/9 checks.
• .\.venv\Scripts\python.exe .\functional_tests\route_tests\test_route_policy_test_coverage.py - passed: 3/3 checks.
• .\.venv\Scripts\python.exe .\functional_tests\test_docs_app_surface_coverage.py - passed: 7/7 checks; generated inventory is current.
• .\.venv\Scripts\python.exe .\functional_tests\test_docs_site_quality.py - passed: 6/6 checks.
• git --no-pager diff --check - passed before commit.

Production investigation was read-only. Live deletion after deployment and the full repository suite were not run.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added docs/explanation/fixes/CONVERSATION_DELETE_HNS_CLEANUP_FIX.md and administrator troubleshooting guidance. Release-note and issue-creation offers were made; the user was unavailable, so release notes and external issues were left unchanged. No new application surfaces require inventory changes.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new routes, settings payloads, or browser assets. Ownership checks remain before cleanup, foreign/missing bulk targets have indistinguishable failure details, and cleanup errors never return provider exception text.