Fix orchestration reasoning compatibility and capability context

[Paul Lizer (paullizer)]

Summary

• Fix the unsupported reasoning setting that broke plan editing, Auto, and Review → Run. Authorized canonical model policies now drive both orchestration and ordinary chat: Luna's stale Minimal becomes Low, supported explicit None is preserved, and narrowly scoped provider recovery reports Model default accurately.
• Show requested-to-effective adjustments in classic and V2 controls, live responses, saved messages, and plan/run surfaces. Preserve preference identities, approval holds, revision concurrency, cancellation, and the previous valid plan after a failed edit.
• Send every Orchestrate request through capability-aware planning. Selected controls/resources are positive requirements; unchecked controls are neutral. Keep enabled/authorized capabilities available without topic heuristics or forced research, and report real planner/catalog failures instead of fabricating successful answer-only plans.
• Restore authorized agent discovery and bounded read-only memory context. Recheck actual conversation audience and memory scope before publishing output; do not inject automatic saved memory into shared/hidden conversations or write/backfill memory during planning.

This PR targets paullizer-react-v2-ui, the session's existing base containing the earlier plan-editor and conversation-context work. Always-planning intentionally adds a planner call for short Orchestrate requests. No deployment, Azure configuration change, API-version migration, or live model-quality evaluation was performed.

Linked issue

No linked issue.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped: 0.261.103 → 0.261.104
• deployers/version.txt not needed because deployers/ was not changed

Testing / validation

Focused coverage	Result
Canonical reasoning, orchestration model binding, ordinary-chat runtime	65 passed, 147 subtests
Conversation routes, revision routes, and memory integration	93 passed, 25 subtests
V2 reasoning controls, plan editor, approval persistence, and browser-to-Flask editor/Run	67 passed
Classic runtime notices, thinking placeholder, and Stop	7 passed

• npm --prefix .\application\v2_ui run typecheck and the V2 production build succeeded.
• python .\functional_tests\test_v2_reasoning_effort_persistence.py passed 10 real frontend behavior checks and 5 canonical projection checks. Additional existing exclusivity, orchestration, memory, and route-policy suites passed.
• python .\scripts\build_docs_inventory.py, python .\functional_tests\test_docs_app_surface_coverage.py, and python .\functional_tests\test_docs_site_quality.py completed successfully.
• Changed Python files compiled; changed classic JavaScript syntax and patch whitespace checks passed.

The browser-to-Flask regression edits the playlist plan to add Web Search, visibly corrects stale Luna Minimal, and executes once. Provider/storage boundaries are controlled: this establishes integration contracts, not live model-selection or answer quality. Regression coverage also reproduces and fixes stale notices when newer resolution metadata clears a prior adjustment.

Documentation

• Release notes updated
• Orchestration feature documentation, user guide, chat controls, and fact-memory reference updated
• Reasoning-compatibility and capability-context fix documentation added

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security()) — no new routes; existing route policies retained
• Settings sent to non-admin frontends use sanitize_settings_for_user(); model capabilities use an allowlisted public projection
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included