feat(web): establish Excel Web foundation

[uirmb]

Excel Web foundation — first deployable validation baseline

Independent GenOffice Sheets Web application on top of the validated Word/PPT office:* lifecycle.

Development branch: agent/xlsx-web-foundation.
Base: agent/ppt-web-foundation.
Current head: b89fd931c3cea81c74b15326ffb50d1125c73d9e.

Architecture

• Sheets Web reuses the existing React + Univer renderer; Electron Sheets remains intact.
• Web-specific capabilities live behind the shared OfficeHostApi / office:* iframe protocol.
• XLSX sessions, parsing, IronCalc recalculation and archive assembly live behind the independent Rust xlsx-engine-service; browser save reuses the shared preservation planner.
• Browser code calls only same-origin /xlsx-engine/*; Vite/Nginx owns the Rust proxy.
• Rust stays independent of UC tenants/JWT/FsNode/permissions. UC owns files and authorization; the engine owns spreadsheet processing.
• UC integration is a nested iframe Host translating existing uc-plugin-rpc-* file APIs to office:*.
• File → Open, Insert → Image and future arbitrary-file selection intentionally share the same office:pick-file Host contract; only accept, multiple and mode differ.

Web product shell aligned with Word / PPT

• Excel Web has the same first-position File menu pattern used by Word/PPT, with Excel-green product accent.
• File menu actions: Open, Save, Save As, Save as History Version, Export as XLSX, Exit.
• Open/Save/Save As reuse the existing renderer save/open path; History/Export materialize a preservation snapshot and delegate to the Host without silently replacing the current workbook.
• Dirty File → Exit uses Cancel / Discard and Exit / Save and Exit. Save and Exit grants Host close only after the normal save has actually cleared dirty state.
• Host capabilities drive Open/Save/SaveAs/History/Export/Close/AI/AutoSave Web chrome, matching the Word Web policy model.
• With ai:false, no Genspark AI entry, Copilot dock, AutoSave control or AI-oriented ready text is visible; the normal initial status is Ready / 就绪.
• Demo Host no longer hardcodes 127.0.0.1:5275; URL resolution is ?sheetsUrl → VITE_SHEETS_URL → current hostname on port 5275.

Correlated UC window-close lifecycle

• Shared protocol remains OFFICE_PROTOCOL_VERSION = 1 and now consumed by Sheets Web for Host-driven window close.
• UC sends office:request-close with a transaction requestId; Excel does not reimplement dirty logic and instead enters the same existing File → Exit requestExit() flow.
• Clean workbook: Excel immediately returns office:close-request with the same requestId and reason: window-close.
• Dirty workbook: the existing Save and Exit / Discard and Exit / Cancel dialog is used.
• Save and Exit waits until the normal workbook save really clears dirty before granting the correlated close.
• Discard and Exit grants office:close-request with the same requestId.
• Cancel, Escape, or backdrop cancellation returns office:close-cancelled with the same requestId and reason: user-cancelled.
• Repeated Host office:request-close messages are ignored while one close transaction is pending, so repeated UC × clicks cannot stack dialogs.
• Ordinary File → Exit remains editor-originated and uncorrelated: it still sends the normal office:close-request with reason: file-menu and no requestId.
• A stalled Save-and-Exit that never becomes clean expires the one-shot close attempt instead of leaving UC in waiting-editor indefinitely.

Excel Web capability implemented and browser-verified

• real XLSX open/new/lazy reads, formula discovery and IronCalc recalc
• values/formulas/styles/rich text/formula cached values
• filters, hyperlinks, CF, DV, protection, page setup, notes/comments
• sheet add/duplicate/rename/remove/hide/reorder
• structural row/column insert/remove/move, merge/unmerge, size/hidden/outline and reference preservation
• defined names
• linked chart edits
• image/media reads plus image/visual add/edit
• native tables and x14 sparklines
• Pivot definition read, Pivot cache refreshOnLoad, native Pivot creation and output-layout refresh/expansion with fail-closed overlap protection
• clean-workbook Save As via zero-mutation archive clone
• Host-backed token/read-file flow for workbook open and image insertion
• Web Ctrl/Cmd+S, Ctrl/Cmd+Shift+S and Ctrl/Cmd+O file shortcuts
• UC optimistic version protection: stale normal Save returns VERSION_CONFLICT before saveResultFile; Save As is exempt

All major renderer XLSX save journals have a Web preservation path and browser coverage. Shared planner guards fail closed for unsupported workbook constructs rather than emitting a partially corrupted package.

Engine production baseline

• raw workbook/request limits: 100 MiB / 384 MiB defaults with HTTP 413 handling
• idle session TTL: 3600s default, 60s sweep
• endpoint-isolated workspaces with startup crash-orphan cleanup and graceful cleanup
• bounded heavy-work admission: default 4 slots, 15s pre-execution queue timeout, HTTP 503 on saturation
• X-Request-Id correlation and JSON request logs with operational fields only
• low-cardinality Prometheus-text /metrics
• /health exposes admission capacity/availability
• systemd/Nginx/environment/runbook templates and deployment smoke script under deploy/xlsx-engine/

Current validation

• Sheets Web File UI Add Linux (AppImage) packaging target genspark-ai/genoffice#14 (31579469890): success — File UI plus correlated Host close transaction, including clean close, dirty cancel, duplicate suppression, discard, and save-before-close.
• Sheets Web E2E #193 (31578850014): success on the immediately preceding production-code head — typecheck, Web unit tests, Rust build/session/open/save, five-fixture preservation corpus, production builds and Chromium. The current head only adds the File UI workflow label after that production code.
• Sheets Web Engine Limits Sync snapshot (2026-08-12) genspark-ai/genoffice#87 (31579469764): success.
• UC Web OS XLSX Host Sheets: Delete and Backspace clear only the first cell in a multi-cell selection genspark-ai/genoffice#73 (31579469926): success.
• Sheets Web Pivot Add E2E Should show its reasoning / searching/ tokens so that while geberating a doc - it dosent look a black box. genspark-ai/genoffice#97 (31579469894): success.
• Sheets Web Bundle Audit feat: implement local token masking guardrails in agent execution loop genspark-ai/genoffice#32 (31579469848): success as a measurement workflow.
• Sheets Web Production Audit Sync snapshot (2026-08-05) genspark-ai/genoffice#34 (31579469849): report generated successfully; see dependency note below.

Compatibility and preservation

• Five generated compatibility fixtures run through shared planner → Rust manifest/read/scan/save → OOXML SHA256 preservation.
• Browser tests cover advanced save journals including chart/image/table/sparkline/Pivot and Pivot overlap fail-closed behavior.
• A genuine Microsoft Excel / WPS / LibreOffice-produced compatibility corpus is still required before calling broad real-application compatibility complete.

Release audit facts

• Current measured Sheets Web bundle is approximately 15.67 MB raw / 4.77 MB gzip / 4.24 MB brotli. The largest JS chunk is approximately 7.9 MB raw / 2.21 MB gzip. This is a performance debt, not a correctness blocker for local/test deployment validation.
• The targeted runtime dependency audit reports high findings fanning out through the Univer dependency graph from the nested nanoid 5.1.11 advisory. This is not represented as security-clean; a scoped lockfile-safe remediation should be validated before public production release.

Remaining platform/release work

• integrate the reference UC bridge into the actual UC Web OS plugin repository/source, including the UC idle → waiting-editor → allow-once window-close state machine
• map UC office:pick-file to the same UC system picker used by File → Open for workbook/image/other file selection
• add genuine Excel/WPS/LibreOffice-created compatibility files and round-trip them
• remediate the nested nanoid advisory and rerun all gates
• reduce initial Web bundle using proven lazy-loading boundaries, especially AI and locale assets
• tune Engine admission/session limits using production telemetry
• screen capture, PDF export, AI and attachments remain outside this Excel Web foundation milestone

This branch is suitable for local/test-environment deployment and manual Excel acceptance. The PR intentionally remains Draft and is not merged while the remaining public-production/platform work is completed.