Phase 10C: Add contextual goals and structured clarification

[paullizer]

Summary

• Add bounded contextual planning over the current user message and at most two preceding active user turns, with opaque planner refs rebound to exact authorized documents.
• Require one explicit durable choice before prior user text can cross an external retrieval boundary; rebuild and minimize queries from exact user turns at decision, resume, and execution.
• Add one durable server-authored clarification checkpoint with allowlisted questions/options, ETag claims, response leases, claim-generation fencing, exact Retry/Edit recovery, and process-loss reconciliation.
• Make Assist planner-first: one short, non-streaming, non-executing model call owns direct, propose, or clarify. Deterministic requirement classifiers no longer suggest or automatically activate capabilities in Assist.
• Use the exact model selected for the chat turn unless an administrator saves a complete global endpoint/model pair. Incomplete configured selection falls back to that exact turn model, never a catalog default.
• Add dependent enabled global-endpoint/model selectors in Admin Settings, preserving valid unsaved and intentionally cleared selections across catalog edits.

Planner Transport

• Use max_completion_tokens, reasoning_effort=minimal, and strict JSON schema first for Azure/OpenAI planner calls.
• Permit bounded compatibility fallback only for classified HTTP 400 schema, reasoning, or temperature incompatibilities under one wall-clock deadline.
• Treat token-parameter, local type, quota, authentication, network, 5xx, and arbitrary failures as terminal rather than retrying.
• Persist and log only bounded failure classes and variant indexes; prompts, raw errors/responses, endpoints, credentials, deployment/model IDs, and inaccessible inventory remain excluded.

Security

• Assistant, system, tool, evidence, citation, workspace, deleted, masked, generated, inactive, and foreign content cannot become contextual goal input or external query text.
• Source turns are reauthorized from the exact conversation partition during proposal load, decision, resume, worker entry, and immediately before retrieval or execution.
• The planner receives only the server-authorized safe inventory and never receives authorization or execution authority. All options are materialized, approved, reauthorized, executed, evidenced, and finalized by the server.
• Contextual declines remove external selected/automatic closure for the turn without changing saved toolbar state.
• Clarification and response ownership is ETag- and claim-generation-fenced across concurrent requests, Retry/Edit, terminal output, cleanup, and process restart.
• Server-only source IDs, hashes, queries, resume state, clarification linkage, response hashes, endpoint secrets, and raw provider diagnostics are projected out of browser and collaboration surfaces.

Validation

• Exact server-resolved selected-model probe: valid propose in 4.017 seconds, recommending Deep Research with Web Search as the alternative; JSON-object compatibility fallback used; no capability executed.
• Cumulative Phase 9/10A/10B/10C gate: 352 passed, 11 expected environment-gated skips.
• Full-file security gates: BAC 17 files passed, XSS 19 files passed.
• Focused planner/route/Admin suites, Python compile, changed JavaScript syntax, VS Code diagnostics, and staged whitespace checks passed.
• Two independent reviews found and verified fixes for cleared selector restoration, raw resolver identifiers in diagnostics, non-HTTP fallback retries, and non-progressing token-parameter retries.

Documentation

• Bumped the application to 0.250.077 for the planner-first correction.
• Updated CHAT_CAPABILITY_MODEL_PLANNER.md, CHAT_TURN_ORCHESTRATION.md, release notes, functional/UI test headers, and PHASE_10C_PLANNER_FIRST_RUNTIME_FIX.md.

Refs #1021