[Paul Lizer (paullizer)]

Summary

• Multipart chat uploads could receive login/logout redirects instead of structured authentication errors: the clients did not request JSON, and idle-expiration handling recognized only /api/ paths.
• Shared V2 multipart uploads and classic chat uploads now request JSON. Idle-expired JSON callers receive the existing 401 response, including requires_reauth, without changing authorization, CSRF checks, idle activity tracking, or browser-navigation redirects.
• Preserve the existing V2 sign-in notice and unsent draft. Neither session verification nor an uncertain upload failure automatically replays the file; retry remains explicit. Add functional and browser regressions and bump the application to 0.261.354.
• This fixes a locally reproduced, general response-contract defect, not a confirmed cause of the reported FED-21 failures. Read-only Azure investigation found no recorded upload POST or auth redirect in either incident window. No live upload, deployment, or Azure configuration change was performed. External harness findings remain separate session artifacts; no external harness code is changed.

Linked issue

N/A. The user explicitly requested no issue creation.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Release notes were left unchanged because the optional update was not approved. No new feature card or visual redesign is included.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.353 -> 0.261.354 after integrating the current V2 base. Matching upload regression and documentation versions were aligned when resolving the version conflict. No deployer changes.

Testing / validation

The new regressions failed before the fix: four Node checks detected the missing Accept header; both normal/optimized Flask probes detected the unexpected 302. Final results after integrating the current V2 base:

Command	Result
node --test .\functional_tests\test_v2_app_session_recovery.mjs	Passed, 29/29
python -m pytest .\functional_tests\test_upload_auth_response_contract.py .\ui_tests\test_chat_upload_session_responses.py .\ui_tests\test_v2_chat_image_uploads.py -q	Passed, 25/25; 2 normal/optimized Python probes with external I/O blocked and 23 local Chromium cases
python -X utf8 .\functional_tests\test_idle_logout_timeout.py	Passed, 4/4
python .\functional_tests\route_tests\test_route_blueprint_policy_inventory.py	Passed, 15/15
python .\functional_tests\route_tests\test_route_unauthenticated_policy_contract.py	Passed, 10/10
python .\functional_tests\route_tests\test_route_policy_test_coverage.py	Passed, 3/3
npm --prefix .\application\v2_ui run build -- --outDir ..\..\ui_tests\artifacts\orchestration-plan-editor	Passed, TypeScript and production build; large-bundle warning only
node --check .\application\single_app\static\js\chat\chat-input-actions.js	Passed
python .\functional_tests\test_docs_app_surface_coverage.py	Passed, 7/7; generated inventory current
python .\functional_tests\test_docs_site_quality.py	Passed, 6/6
git diff --check and git diff --cached --check	Passed

Browser coverage exercises real components/stores and classic upload JavaScript with controlled HTTP, including desktop/mobile draft preservation, explicit retry after sign-in, successful upload, permission denial, and network failure. The reused image-upload HTTP fixture now answers the current pending-credential discovery request. The Flask probe executes real authentication decorators and the actual idle function source independently of unrelated app startup; it does not claim full bootstrap/import-cycle coverage. Original live FED-21 reproduction remains unverified.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Added docs/explanation/fixes/UPLOAD_AUTH_RESPONSE_NEGOTIATION_FIX.md and upload recovery guidance in docs/guides/upload-and-manage-documents.md. No new capabilities or controls; no inventory changes needed. Release notes intentionally remain unchanged as noted above.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No production routes or frontend settings payloads were added. Existing authentication/role checks, upload limits, CSRF boundaries, credentials, cancellation signals, and browser-generated multipart boundaries are preserved. Upstream Easy Auth/network failures remain outside this Flask response contract.