Preserve desktop Account labels in downloaded workbooks

HANDOFF.md

@@ -61,16 +61,33 @@ npx playwright test e2e/mobile-sample-workbook-export.spec.ts --workers=1 --retr
 
 The scenario writes exact source hashes, HTML, pixels, console observations and reopened downloads to the configured Playwright output directory. It blocks external requests and uses fallback fonts. Preserve that output before another run. The default browser output path is local test evidence, not a deployment or public certificate.
 
-Historical mobile-freeze holds: its baseline full dependency audit had 29 findings (28 moderate, one development high), and the production subset had 28 moderate findings. That export-only freeze kept the lock unchanged. The later dependency candidate and its current audit/mounted status are described below; these historical receipts are not rewritten. Gemini nightly still lacks its required credential. The old desktop XLSX projection exports blank Account cells despite visible Revenue/COGS labels; this extraction preserves that behavior and does not certify desktop data completeness. Current instructions reference two absent mobile design documents. The inherited half-height mobile dialog requires scrolling; enlarged navigation tabs have reading limitations and transient edit toasts overlap early outcomes. Full visual, responsive, accessibility, performance, provider and production grades remain unassigned.
+Historical mobile-freeze holds: its baseline full dependency audit had 29 findings (28 moderate, one development high), and the production subset had 28 moderate findings. That export-only freeze kept the lock unchanged. The later dependency candidate and its current audit/mounted status are described below; these historical receipts are not rewritten. Gemini nightly still lacks its required credential. The old desktop XLSX projection exported blank Account cells despite visible Revenue/COGS labels; the mobile extraction preserved that behavior and did not certify desktop data completeness. The separate Account repair below addresses those two lookups. Current instructions reference two absent mobile design documents. The inherited half-height mobile dialog requires scrolling; enlarged navigation tabs have reading limitations and transient edit toasts overlap early outcomes. Full visual, responsive, accessibility, performance, provider and production grades remain unassigned.
 
 The retained proof used no provider call, shared backend change, hook activation, original environment read or production deployment. Old branches and dirty worktrees remain preserved.
 
-## Current dependency repair, local review accepted
+## Dependency repair, reviewed and merged
 
-Read the [dependency proof and fresh commands](evidence/shared-dependencies-20260905/README.md) after this handoff. The [independent judgment](evidence/shared-dependencies-20260905/review/E6f_NODEROOM_SHARED_DEPENDENCY_FINAL_JUDGE.md) accepts this local dependency scope. The [encoding addendum](evidence/shared-dependencies-20260905/review/E6f_NODEROOM_DEPENDENCY_PACKAGE_ENCODING_ADDENDUM.md) explains why the final package spelling differs from the earlier raw worker hash. Shared integration is still pending. It restores the two exact NodeSlide file pins required by the immutable release contract and upgrades the coherent 30-package Tiptap cohort to 3.30.4, with only its required ProseMirror model/view minimums. All other lock rows and the nested uuid 14.0.1 remain unchanged.
+Read the [dependency proof and fresh commands](evidence/shared-dependencies-20260905/README.md) after this handoff. The [independent judgment](evidence/shared-dependencies-20260905/review/E6f_NODEROOM_SHARED_DEPENDENCY_FINAL_JUDGE.md) accepts this local dependency scope. The [encoding addendum](evidence/shared-dependencies-20260905/review/E6f_NODEROOM_DEPENDENCY_PACKAGE_ENCODING_ADDENDUM.md) explains why the final package spelling differs from the earlier raw worker hash. [PR 252](https://github.com/HomenShum/NodeRoom/pull/252) merged normally at `034a8f963dfa037d860f5364032319506be3e2e0` after independent review and the premerge shared gates. It restores the two exact NodeSlide file pins required by the immutable release contract and upgrades the coherent 30-package Tiptap cohort to 3.30.4, with only its required ProseMirror model/view minimums. All other lock rows and the nested uuid 14.0.1 remain unchanged.
 
 Normal install, the unchanged fresh mounted consumer, 51 notebook/export scenarios, both TypeScript checks, build and 29 unchanged memory browser cases passed. The production audit now has zero findings; full audit retains one high development-only Browserslist finding. The real installed library prototype canary changes from 1,025 unsafe before cases to zero after, without claiming a NodeRoom exploit or executed browser handler.
 
 The dedicated notebook provenance browser spec remains unresolved: 3/3 failed on both preserved old and new built output, and only the 375 px failure matched exactly. Different artifact selection/steps at desktop and 320 px prevent a no-regression claim. All six screenshots/traces and original assertions are retained. This candidate has no notebook UI repair or full visual grade.
 
-The unchanged full shared gates and actual new-commit check are still required before integration; the historical de9 commit-message failure remains. The Windows native Office deadline, absent nightly credential and separately planned desktop Account-label repair are open. Current dependency proof does not replace the original mobile export source/lock bindings or authorize a deployment.
+The historical de9 commit-message failure remains recorded; published history was not rewritten. The Windows native Office deadline and absent nightly credential remain open. The merged dependency proof does not replace the original mobile export source/lock bindings or certify a deployment.
+
+## Desktop Account export, independently reviewed local proof
+
+A reviewer could see Revenue, COGS, Gross profit, OpEx and Net income in the desktop Q3 variance grid but receive five blank Account cells in the downloaded workbook. Both canonical export branches read `__account`; the existing seed and renderer store those values as `__label`. This candidate changes only those two field lookups. It preserves the visible grid, mobile projection, shared download transport and generic uploaded-workbook behavior.
+
+From the fresh local entry above, open `?mode=memory&surface=desktop`, enter the sample room and dismiss its walkthrough. In Room chat, send `@nodeagent recompute the Q3 variance column`. Wait for the committed variance response, edit the Revenue note, then select **Export XLSX**. The downloaded workbook must contain all five visible Account labels. Edit the note again and export a second file; the new file must contain the later note while the first file remains unchanged.
+
+The source-bound worker proof on merged `034a8f9` passed the normal build, the Convex TypeScript check, design audit, ten affected workbook/dialog scenarios and all three existing-plus-new `excel-grid` browser cases with the unchanged 30-second test budget. Current- and sibling-sheet component scenarios reopen eight serialized workbooks across repeated edits and duplicate activation. Temporarily restoring only the two old lookups makes both label scenarios fail; the exact repaired bytes were restored before the final proof. The actual 1440 px desktop journey saved two XLSX files: all five Account cells match the grid, the other 25 cells and all 30 cell styles match the preserved baseline, and the later note does not alter the earlier file. Both component cases use a typed mocked store plus a replaced browser download-dispatch boundary, while retaining the real Artifact projection and ExcelJS serialization. Only the current canonical sheet has this repair's actual memory-engine browser journey; the sibling-sheet fixture is not a browser-certified uploaded canonical workbook.
+
+After installing Chromium and starting the built preview as above, replay the affected checks in the second terminal:
+
+```powershell
+npx vitest run tests/artifactXlsxExport.test.ts tests/mobileSampleWorkbookExport.test.ts tests/mobileSheetDialog.test.tsx
+npx playwright test e2e/excel-grid.spec.ts --output test-results/desktop-account
+```
+
+Keep the three `PLAYWRIGHT_*` variables shown above so the browser uses that built preview. Preserve the output before another run; one unchanged uploaded-grid scenario also writes `test-results/uploaded-workbook-shared-grid.png`. The new Account scenario retains both downloaded workbooks and its screenshot. The [portable desktop proof](evidence/desktop-account-20260905/README.md) contains the matched source, grid, PNG, XLSX and raw failure records. Its independent source judgment passes 22 checks and separately verifies the actual ZIP/XML contents. Seven redundant archives/inventories remain listed in local custody; the portable verifier does not claim those bytes are available to a fresh recipient. Normal shared CI and integration of this desktop slice remain subsequent checks. The browser proof used fallback fonts and the memory engine, with no provider or native Office execution. Its base-commit build stamp is supplemented by exact working-source hashes. These checks do not close the inherited notebook failures, full floor/native Excel timeout, production behavior or whole-product grades.

e2e/excel-grid.spec.ts

@@ -130,3 +130,53 @@ test("uploaded workbook renders in the shared Sheet 1 grid, not the false Excel-
 
   await page.screenshot({ path: "test-results/uploaded-workbook-shared-grid.png", fullPage: false });
 });
+
+test("a reviewer reopens every visible Account label after current-sheet edits and repeated exports", async ({ page }, testInfo) => {
+  await page.setViewportSize({ width: 1440, height: 960 });
+  const origin = new URL(String(testInfo.project.use.baseURL)).origin;
+  await page.route("**/*", route => {
+    const url = new URL(route.request().url());
+    return url.origin === origin || ["data:", "blob:"].includes(url.protocol)
+      ? route.continue() : route.abort("blockedbyclient");
+  });
+  await enterDemoRoom(page);
+  const chat = page.getByTestId("public-chat-panel");
+  await chat.getByTestId("chat-composer").fill("@nodeagent recompute the Q3 variance column");
+  await chat.getByTestId("chat-send").click();
+  await expect(chat.getByText("Committed r_rev +24%, r_cogs +27.5%, r_gp +21.7%, r_ni +22.4%. Lock released.", { exact: true })).toBeVisible();
+  const table = page.locator('table.r-sheet[data-noderoom-surface="workSurface.sheet"]').first();
+  const labels = await table.locator("tbody td.label").allTextContents();
+  expect(labels).toEqual(["Revenue", "COGS", "Gross profit", "OpEx", "Net income"]);
+  const stableNumbers = await table.locator("tbody tr").filter({ has: page.locator("td.label") }).evaluateAll(rows =>
+    rows.map(row => [...row.querySelectorAll("td.num .r-val-num")].map(cell => cell.textContent)),
+  );
+  const files: string[] = [];
+  for (const [index, note] of ["Reviewer note: checked source", "Reviewer note: revised before handoff"].entries()) {
+    await page.locator('[data-cell-key="r_rev__note"] button').click();
+    await page.locator("input.r-cell-input").fill(note);
+    await page.locator("input.r-cell-input").press("Enter");
+    await expect(page.locator('[data-cell-key="r_rev__note"]')).toContainText(note);
+    const event = page.waitForEvent("download");
+    await page.getByTestId("artifact-export-xlsx").click();
+    const download = await event;
+    expect(await download.failure()).toBeNull();
+    const file = testInfo.outputPath(`review-${index + 1}-${download.suggestedFilename()}`);
+    await download.saveAs(file);
+    files.push(file);
+    const reopened = new ExcelJS.Workbook();
+    await reopened.xlsx.readFile(file);
+    const sheet = reopened.worksheets[0];
+    expect(sheet.getRow(1).values).toEqual([undefined, "Account", "Q2", "Q3", "Variance", "Note"]);
+    expect(labels.map((_, row) => sheet.getCell(row + 2, 1).value)).toEqual(labels);
+    expect(labels.map((_, row) => [sheet.getCell(row + 2, 2).value, sheet.getCell(row + 2, 3).value])).toEqual(stableNumbers);
+    expect(sheet.getCell("D2").value).toBe("+24%");
+    expect(sheet.getCell("E2").value).toBe(note);
+    await expect(page.getByTestId("artifact-export-xlsx-status")).toContainText("Downloaded");
+    await testInfo.attach(`review-${index + 1}.xlsx`, { path: file, contentType: "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" });
+  }
+  const first = new ExcelJS.Workbook();
+  await first.xlsx.readFile(files[0]);
+  expect(first.worksheets[0].getCell("E2").value).toBe("Reviewer note: checked source");
+  expect(await table.locator("tbody td.label").allTextContents()).toEqual(labels);
+  await page.screenshot({ path: testInfo.outputPath("desktop-account-current-export.png"), caret: "initial" });
+});

evidence/desktop-account-20260905/.gitattributes

@@ -0,0 +1 @@
+* -text

evidence/desktop-account-20260905/README.md

@@ -0,0 +1,21 @@
+# Desktop Account export evidence
+
+A reviewer could read five Account labels in the Q3 grid but receive blank labels in the downloaded workbook. The exporter read `__account` while the existing sheet and renderer used `__label`. Two field lookups now read the existing labels; no grid or transport redesign was needed.
+
+Start with the [repository handoff](../../HANDOFF.md). The [independent source judgment](review/E6f_NODEROOM_DESKTOP_ACCOUNT_FINAL_JUDGE.md.txt) accepts this bounded repair after 22 checks. The [worker receipt](review/E6f_NODEROOM_DESKTOP_ACCOUNT_REPAIR_RECEIPT.md.txt) retains the commands, early failures and final source bindings. Shared CI and integration of this desktop slice are subsequent checks; this packet is not their receipt.
+
+Compare the actual [before grid](operator/before/change-boundary.png) and [after grid](operator/after/change-boundary.png). Both show the five labels. The file defect is demonstrated by the actual XLSX files listed in the [copy map](raw-copy-map.json), then independently reopened through [ZIP/XML inspection](judge/independent-zip-xml.json). Exactly A2:A6 change to the labels; the other 25 values/formulas and all 30 styles, including raw styles.xml, match. Later note exports change E2 while prior files remain byte-exact.
+
+The normal build including root TypeScript, Convex TypeScript, design audit, ten affected scenarios and three unchanged-budget browser cases passed. Restoring only the old lookups makes both label scenarios fail. Both component cases use a typed mocked store plus a replaced browser download-dispatch boundary, while retaining the real Artifact projection and ExcelJS serializer. Only the current canonical sheet has this repair's actual memory-engine browser journey. The sibling fixture is not an uploaded-canonical-workbook browser certificate; the separate existing generic-uploaded-grid case remains a limited compatibility check.
+
+From the repository root, verify portable custody with Python 3 and Git:
+
+```powershell
+python evidence/desktop-account-20260905/verify.py
+```
+
+The verifier checks every included payload and the four current source identities, accepting Git's declared source line-ending normalization. Packet payloads are binary-attributed and must remain raw-byte exact. It does not execute historical scripts or rerun the app. Replay the application commands in HANDOFF.md after the normal fresh installation and built-preview setup there.
+
+The [original inventory](original-inventory.json) lists all 133 original operator files, including seven large build archives or whole-checkout/index inventories retained only in local custody. Of those 133 files, 126 are included here. All 21 independent judge files and both worker/judge reports are also included. The independent reviewer verified the original retained-only bytes, but a fresh recipient cannot verify unavailable local archives; this verifier explicitly reports that boundary. Historical code, HTML and Markdown have inert `.txt` suffixes. Absolute paths inside historical receipts identify original custody, not portable commands.
+
+Evidence covers the local memory engine and bounded repeated exports, not a long-duration or multi-user load certificate. Actual matched workbooks have scalar values/strings; formula/cache/number-format behavior is covered by the component fixtures. Fallback fonts and one desktop width limit visual conclusions. One blocked external-resource console event is preserved; no zero-console claim. The base build stamp identifies merged 034a8f9, supplemented by exact uncommitted source bindings. Existing notebook failures, Windows native Excel timeout, missing nightly credential and development advisory remain open. No native Office, provider, production workbook journey, whole-product grade or human acceptance is claimed.

evidence/desktop-account-20260905/judge/actual-head.bin

@@ -0,0 +1,2 @@
+034a8f963dfa037d860f5364032319506be3e2e0
+8fbd0d5d0ca31a71a70c45208ba8a5fd6a64a831