[Paul Lizer (paullizer)]

Summary

• Strip invisible Unicode format characters (Cf, such as U+200C ZWNJ, U+200B ZWSP, and U+FEFF BOM) and trailing punctuation in extract_urls_from_text() and normalize_review_url() so pasted URLs do not fail url_fetch with HTTP 404.
• Mitigate and validate PPTX slide layout overflow across prepare_generated_slide_deck() and render_prepared_pptx(): wrap URL/hyphen tokens at / and -, step single-line slide titles down from 30pt (to 14pt min) when needed to fit PREPARED_SLIDE_TITLE_HEIGHT, and deterministically fit SlideTextBox and SlideTable font sizes and unoccupied vertical slide height while rejecting un-fittable overflow during compose so _compose_correction can retry before persistence.
• Preserve OfficeRenderError error codes and retryability in output_failure() instead of collapsing them into generic ValueError -> output_invalid.

Linked issue

N/A

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Testing / validation

• python -m pytest functional_tests/test_pptx_render_file_mitigation.py -q — passed (16 passed)
• python -m pytest functional_tests/test_office_file_renderers.py functional_tests/test_generated_file_office_bridge.py functional_tests/test_orchestration_compose_output_retry.py functional_tests/test_orchestration_dependency_runtime.py -q — passed (355 passed)
• python -m pytest functional_tests/test_orchestration_output_lifecycle.py functional_tests/test_orchestration_output_checkpoint_storage.py functional_tests/test_orchestration_output_configuration.py -q — passed (485 passed)
• python scripts/check_broken_access_control.py — passed (0 findings)
• python scripts/check_cosmos_response_boundaries.py — passed (1069 owners, 417 doubles, 0 review gaps)

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included