[BREAKING] Fix cross-worker settings consistency and Redis Explorer

[Bionic711]

Summary

• Fix admin settings alternating between old and saved values across workers, and prevent stale metadata writes from overwriting unrelated changes. Workers now read shared Redis settings on every lookup, or Cosmos directly when Redis is disabled.
• Add Cosmos ETag-conditional writes, field-only auxiliary updates, and a single Redis publication record containing the settings, revision, and session token. Durable pending markers and fenced publication prevent interrupted or expired writers from publishing older snapshots.
• Remove startup snapshot publication, guard logging re-entrancy, and reject stale admin forms. Correct Redis Explorer's references to removed cache constants, recognize current/legacy keys, and retain credential/session-token redaction.
• Operational compatibility change: reject settings saves when configured Redis is unavailable, retaining Cosmos read fallback. Deploy all web workers and the scheduler together; older workers do not participate in the new protocol. Redis configuration changes require coordinated restarts. A database commit followed by publication failure is explicitly unconfirmed, not guaranteed rolled back.

Linked issue

Fixes #1477

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Release notes include the settings-consistency fix under v0.261.025, the Redis Explorer correction under v0.261.026, and the bootstrap import-boundary correction under v0.261.027.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application version: 0.261.024 -> 0.261.027. No deployer files changed.

Testing / validation

Validated against current origin/Development before publication:

• Python syntax compilation: 235 files passed, including every top-level application/single_app/*.py file covered by the GitHub workflow and changed tests.
• python scripts/check_swagger_routes.py <changed route files>: 7 route-owning files passed.
• python scripts/check_xss_sinks.py --full-file <changed application files>: 20 files passed.
• python scripts/check_broken_access_control.py --full-file <changed application Python files>: 19 files passed.
• git diff --check and staged whitespace checks: passed.
• python -B -m pytest -q --disable-warnings -p no:cacheprovider with the following isolated group: 155 passed, 1 skipped:
  • functional_tests/test_app_settings_store_consistency.py
  • functional_tests/test_app_settings_auxiliary_writers.py
  • functional_tests/test_cosmos_wave2a_chat_bootstrap_cache.py
  • functional_tests/test_document_action_capability_settings.py
  • functional_tests/test_settings_secrets_exposure_hardening.py
  • functional_tests/test_public_workspace_display_name_settings.py
  • The route Blueprint inventory, unauthenticated contract, and route policy coverage tests under functional_tests/route_tests/.
  • ui_tests/test_admin_settings_save_consistency.py
• Separate pytest invocation for Redis service detection, client factory, Entra token authentication, and test_cosmos_wave5a3_redis_monitoring.py: 33 passed.
• Direct standalone execution of all eight regression scripts passed: app-settings cache versioning, Content Understanding extraction, Cosmos Wave 1 fallback, Redis monitoring/Explorer, get-settings merge-bool regression, settings deep-merge persistence, tabular parity migration, and logging recursion guard.
• Redis Explorer tests exercise both Azure Managed Redis (TLS 10000) and Azure Cache for Redis (TLS 6380), with key/managed-identity authentication and app-cache/session clients, including pagination and secret redaction. External Redis/Cosmos I/O is simulated; this is not live end-to-end validation of both services.

CodeQL correction in 3faf396 / v0.261.027:

• Cache helpers now consume the caller's settings plus explicit runtime dependencies, with no reverse imports into config/settings/logging/Redis factory. Both web and scheduler startup are wired through the settings owner.
• All stateful settings operations in the affected tests execute outside assertions. New test_app_settings_import_boundaries.py checks real cold imports, normal/-O startup probes with network/config imports blocked, and the full cache dependency graph.
• Follow-up validation: 69 focused bootstrap/store/Redis tests passed, 140 writer/migration/route tests passed and 1 live UI test skipped; standalone extraction/logging/merge scripts passed. Syntax230 files, full-file XSS/BAC5 files, Swagger and diff checks passed.
• Python, test, and PR-prep instructions now require explicit dependency/lifecycle validation and inspection of CodeQL alerts, not just analysis-job success.
• Hosted CodeQL run 34398785015 completed successfully on final commit 4b0c836. Alerts #2732 (assert side effect), #2733 (cyclic import), and #2734 (unused test import) are fixed; the PR merge ref has zero open CodeQL alerts, all review threads are resolved, and all PR checks passed. Final one-line cleanup revalidated with 31 boundary/store tests.

Known validation caveats accepted for this draft:

• Authenticated UI test skipped: no configured admin browser storage state/test environment. Live stale-form and multi-worker save/reload confirmation remain required.
• Combined-run test isolation problem: running all selectors together produced five Redis credential-test failures because the existing Content Understanding tests replace sys.modules["azure.identity"] without restoring it. Redis and application groups pass in separate processes; standalone regressions pass. No application workaround was added for this test-stub contamination.
• Documentation coverage: 6/7, due to pre-existing unrelated inventory drift: the generated chat upload control label includes XSD but committed docs/_data/app_surface.yml does not. This unrelated file was left unchanged. Documentation site quality: 6/6 passed.
• Cosmos fallback still uses Session consistency; this does not claim global strong consistency during Redis outages. Live deployment validation and coordinated rollout are required before this draft is marked ready.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

docs/admin/scale.md documents the new read/write behavior, Redis failure policy, interrupted-save handling, coordinated deployment/restart requirements, and current versus legacy Explorer keys. Regression docstrings document the deterministic failure scenarios. No separate new feature page or Latest Feature card is needed.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No routes were added; changed route decorators and policy contracts passed validation. Existing frontend sanitization boundaries are retained. The admin revision field is escaped, and Explorer tests verify nested credentials and Cosmos session tokens remain redacted. No cloud configuration changes or deployments were performed by the PR-preparation workflow.