Fix M365 review placement and add editable draft lifecycle

[Paul Lizer (paullizer)]

Summary

• Follow up on merged Fix orchestrated email review flow and Cosmos response contracts #1751: review cards could appear above the initiating request and move after orchestration completed. Bind saved user-message identity to conversation/turn/run and preserve each new card beneath its producing request, including list-before-stream discovery.
• Add a shared owner-only email/calendar editor with rendered five-line previews, direct edits, AI suggestions, and bounded durable history. Applying an AI suggestion changes only the working copy; Save and Send remain explicit.
• Send new manual-review email drafts by their immutable Outlook message ID instead of sending a second payload and retaining an unsent duplicate. Resolve Sent Items links through bounded read-only polling without enabling resend after unknown outcomes or link failures.
• Calendar edits remain local until approval creates the event and sends invitations. Historical records and automatic/delayed delivery retain compatibility; no migration, mailbox cleanup, deployment, or live outbound action was performed.

Linked issue

N/A - user requested no associated issue. Follow-up to merged #1751.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.324 -> 0.261.325. No deployer changes.

Testing / validation

All Graph/model outbound actions were mocked. Python backend runs used the pinned environment, application/test PYTHONPATH, cached tokenizer, and network guard.

• .\.venv\pinned\Scripts\python.exe -m pytest -q --disable-warnings -p test_support.cosmos_network_guard .\functional_tests\test_m365_pending_review.py .\functional_tests\test_m365_pending_delivery.py .\functional_tests\test_m365_action_card_api.py .\functional_tests\test_m365_pending_action_provenance.py .\functional_tests\test_editor_assist_core.py .\functional_tests\test_orchestration_operation_runtime.py .\functional_tests\test_chat_content_checks.py .\functional_tests\test_orchestration_conversation_context_routes.py - passed: 211 tests, 10 subtests. Final timezone-metadata follow-up rerun of review/provenance/card suites passed: 91 tests.
• .\.venv\pinned\Scripts\python.exe .\scripts\check_cosmos_response_boundaries.py --run-contracts - passed: 680 tests, 231 subtests; 1,051 owners and 394 doubles with zero review gaps. Final inventory freshness check also passed.
• node --test --test-reporter=dot .\functional_tests\test_v2_pending_review_logic.mjs .\functional_tests\test_v2_m365_pending_actions_logic.mjs .\functional_tests\test_v2_m365_pending_actions_store.mjs .\functional_tests\test_v2_m365_pending_actions_stream.mjs .\functional_tests\test_v2_orchestration_streaming_surface.mjs - passed: 126 tests.
• .\.venv\Scripts\python.exe -m pytest -q .\ui_tests\test_v2_m365_pending_action_cards.py .\ui_tests\test_v2_m365_review_placement.py .\ui_tests\test_v2_pending_review_editor.py - passed: 47 desktop/mobile browser tests, including stable DOM placement, direct/AI editing, reopened suggestions, timezone instants, and sent-link outcomes.
• npm run build in application\v2_ui - passed TypeScript and Vite production build; existing bundle-size warning remains.
• .\.venv\pinned\Scripts\python.exe .\functional_tests\route_tests\test_route_blueprint_policy_inventory.py, test_route_unauthenticated_policy_contract.py, and test_route_policy_test_coverage.py - passed: 15, 10, and 3 checks respectively.
• check_broken_access_control.py --full-file with all changed Python application paths and check_xss_sinks.py --full-file with all changed application paths - passed: 13 and 27 files respectively.
• .\.venv\pinned\Scripts\python.exe .\scripts\build_docs_inventory.py, .\.venv\pinned\Scripts\python.exe .\functional_tests\test_docs_app_surface_coverage.py, and .\.venv\pinned\Scripts\python.exe .\functional_tests\test_docs_site_quality.py - passed regeneration plus 7 coverage and 6 quality checks.
• git diff --check - passed.

Known unrelated limitation: the older test_orchestration_plan_revision_routes.py cold-import fixture lacks cosmos_settings_container; it was not modified. Real HTTP planning/context regression coverage passes.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Updated the Microsoft 365 guide/chat-control reference and added pending-review feature and lifecycle/placement fix documentation. Release-note update was offered but the user was unavailable; release notes remain unchanged.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

Review/history/assist are owner-authorized and manual-review scoped. Existing configured content screening remains applicable to edited material. Conditional editing/delivery claims and uncertain-outcome no-replay behavior are preserved; Sent Items lookup cannot revert accepted delivery.