Fix memory-aware orchestration request resolution

[Paul Lizer (paullizer)]

Summary

• Prevent self-contained first-turn requests from being rejected as missing historical text merely because they contain transformation/reference words. Use the existing bounded semantic resolver while preserving the no-unrelated-retrieval restriction.
• Supply authorized, bounded, read-only saved memory before initial and resumed clarification decisions. Reuse recall for an unchanged effective request after rechecking access, refresh changed queries, and retain fresh answer-time recall, scope checks, and shared-conversation withholding.
• Add privacy-safe diagnostics, real-boundary regressions, and durable harness repair guidance. Advance the application to 0.261.349 without scenario-specific answer wording or optimistic message-ID workarounds.

The eight supplied UI scenarios all stopped on turn one. Six failures concern transient pending-message selectors and one concerns incidental wording; these harness issues are documented separately from the application fix. This PR neither changes the external harness nor certifies the previously unexecuted later turns.

Linked issue

Refs #1785

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.348 -> 0.261.349. No deployer changes.

Testing / validation

Commands ran from the repository root with PYTHONPATH containing application\single_app and functional_tests. Below, python denotes the isolated session interpreter. Repository-pinned Flask/Werkzeug, Cosmos SDK, and the missing YAMCS client were restored there; an isolated compatible cryptography package resolved the shared installation's OpenSSL incompatibility. Global packages and application requirements were not changed.

• Passed: 320 tests, 83 subtests.

  python -m pytest -q --disable-warnings --tb=short functional_tests\test_orchestration_request_memory_resolution.py functional_tests\test_orchestration_conversation_sources.py functional_tests\test_orchestration_memory_context.py functional_tests\test_orchestration_conversation_context.py functional_tests\test_orchestration_conversation_context_routes.py functional_tests\test_orchestration_harness_routes.py functional_tests\test_orchestration_model_selection.py functional_tests\test_fact_memory_read_only_context.py functional_tests\test_fact_memory_streaming_context_fix.py functional_tests\test_fact_memory_streaming_retrieval_fix.py functional_tests\test_message_metadata_loading_fix.py

• Passed: 1,143 tests, 244 subtests; zero review gaps for 1,067 owners and 412 doubles. Existing route consumers were reviewed, the inventory was refreshed, and the changed planning owner has runtime evidence. Network access is blocked by the contract gate.

  $env:PYTEST_ADDOPTS = '-x --ff'
  python scripts\check_cosmos_response_boundaries.py --run-contracts

• python functional_tests\route_tests\test_route_blueprint_policy_inventory.py - passed, 15 checks.
• python functional_tests\route_tests\test_route_unauthenticated_policy_contract.py - passed, 10 checks.
• python functional_tests\route_tests\test_route_policy_test_coverage.py - passed, 3 checks.
• python functional_tests\test_docs_app_surface_coverage.py - passed, 7 checks; generated application-surface inventory remains current.
• python functional_tests\test_docs_site_quality.py - passed, 6 checks.
• git diff --check and staged whitespace validation - passed.

Deterministic completions verify context delivery and state transitions, not live model compliance. No production deployment or full FED-31 through FED-38 rerun was performed. The harness owner still needs to repair selectors/assertions and rerun all complete sequences, including mixed modes, reloads, and updated-memory/stale-value checks.

Documentation

• Release notes updated, or not needed

• Feature documentation updated, or not needed

• Fix documentation updated, or not needed

• Durable application and harness-owner guidance: docs/explanation/fixes/ORCHESTRATION_REQUEST_MEMORY_RESOLUTION_FIX.md.

• Updated CHAT_ORCHESTRATION.md and docs/reference/logging-tags.md describe early memory resolution, recall lifecycle, and safe diagnostics.

• Release-note changes were offered but not approved while the user was unavailable, so docs/explanation/release_notes.md is unchanged. No additional issue status comment was posted.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) - N/A: no new routes; existing route policy checks pass.
• Settings sent to non-admin frontends use sanitize_settings_for_user() - N/A: no settings response changes.
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS - no browser asset changes.
• No secrets, keys, connection strings, or local-only artifacts are included - session handoff files and the isolated test environment are excluded.