[Paul Lizer (paullizer)]

Summary

Excel questions could report comment counts without receiving the available comment text. Worksheet-wide first-row headers also misrepresented title rows and multiple tables.

• Deliver actual notes, threaded roots/replies, saved-cell/formula context and workbook structure through bounded native evidence. Correlate compatibility copies conservatively instead of counting them as independent comments; retain complete supported records in authorized, revision-bound inventory pages.
• Share streaming workbook/table discovery across ingestion, analytical tools, durable replay and previews. Preserve independent table ranges/headers and physical row provenance, clarify ambiguous selections, and cover 50,000- and 100,000-row fixtures without substituting previews for complete analytical reads.
• Add V2 worksheet/table identity, table selection, bounded record navigation and workbook/CSV-specific evidence wording. The investigated Budget and Delivery sheets genuinely have identical populated values; the changes do not invent a switching defect for that case.
• Keep source/scope/version/screening checks, private inventory lifecycle and explicit completeness limits. Update related guides, action references, release notes and application version to 0.261.405.

Compatibility and rollout: Existing authorized retained originals can be inspected without a blanket re-upload or automatic bulk reprocessing. Legacy v1 queued workbook computations must be restarted to pin table/header semantics; completed exports and CSV replay compatibility are retained. Inspection reads saved state only: no formula recalculation, macro/ActiveX/OLE execution or external-link refresh. Nothing has been deployed to beta.

Linked issue

N/A. The user explicitly chose to keep this investigation unfiled.

Release Notes & Latest Features

• New Feature
• Bug Fix
• UI Enhancement
• Breaking Change
• Internal only

Is this visible to end users?

• Yes
• No

Is this admin-facing (Admin Settings, governance, deployment, config)?

• Yes
• No

Should this become a Latest Feature card?

• Yes
• No
• Already added

Screenshot needed for the card?

• Yes
• No
• Attached

Existing accessibility/tabular capability documentation is extended; no separate Latest Feature card is added.

Version bump

• application/single_app/config.py VERSION third segment bumped, or not needed because this is docs-only
• deployers/version.txt bumped, or not needed because deployers/ was not changed

Application: 0.261.404 -> 0.261.405. No deployer files changed.

Testing / validation

• python -m pytest functional_tests\test_excel_native_inspection_chat_evidence.py functional_tests\test_excel_native_images_and_release.py -q -p no:cacheprovider --disable-warnings - 14 passed, rerun on the committed branch before PR creation.
• python -m pytest functional_tests\test_tabular_table_aware_analytics_replay.py functional_tests\test_native_tabular_compute_service.py -q -p no:cacheprovider --disable-warnings - 71 passed.
• python -m pytest functional_tests\test_excel_document_accessibility_extraction.py functional_tests\test_excel_native_inspection_chat_evidence.py functional_tests\test_excel_inventory_persistence.py functional_tests\test_excel_table_discovery_and_scale.py functional_tests\test_excel_preview_route.py functional_tests\test_excel_native_images_and_release.py functional_tests\test_excel_document_delete_sdk_contract.py functional_tests\test_document_accessibility_report_action.py functional_tests\test_tabular_enhanced_citations_schema_summary_fix.py functional_tests\test_tabular_preview_json_sanitization_fix.py -q -p no:cacheprovider --disable-warnings - 103 passed during implementation. Subsequent publication changes are covered by the final 14-pass rerun above.
• python -m pytest -p test_support.cosmos_network_guard functional_tests\test_orchestration_retained_analysis_publication.py functional_tests\test_orchestration_search_result_integrity.py -q -p no:cacheprovider --disable-warnings --tb=short - 34 passed after extending the scoped Analyze fixture's configuration for native inventory storage.
• python .\scripts\check_cosmos_response_boundaries.py - passed: 1,085 owners, 424 doubles, zero review gaps.
• python .\functional_tests\test_docs_app_surface_coverage.py - 7/7 passed, including current generated inventory. python .\functional_tests\test_docs_site_quality.py - 6/6 passed.
• npm --prefix .\application\v2_ui run typecheck and npm --prefix .\application\v2_ui run build - passed during implementation; existing large-bundle warning retained. Styled citation-viewer browser coverage also passed for desktop/mobile, different and identical sheets, five tables, keyboard navigation, error recovery and the 50,000th record.
• git diff --check HEAD^ HEAD - passed. Changed-line/new-file guard APIs checked 24 application files for XSS and 21 for access control, with no findings.

Full regression sign-off is not claimed. python .\scripts\check_cosmos_response_boundaries.py --run-contracts finished with 1,727 passed, 188 failed, 26 errors, and 431 subtests passed. It exposed a shared Analyze fixture configuration dependency fixed here; its affected suites were rerun successfully as noted above. Broader orchestration/workflow failures remain. A representative orchestration model_failed failure was reproduced with every changed runtime module and AST source restored in memory to exact HEAD, independently of this implementation. The full global batch was not rerun after the fixture repair.

The original investigation used the authenticated beta conversation, successful worksheet requests and independent package XML inspection. Local inspection preserved the original workbook bytes; no live reprocessing was started.

Documentation

• Release notes updated, or not needed
• Feature documentation updated, or not needed
• Fix documentation updated, or not needed

Feature/fix documentation, the workbook inspection guide, Document Search and Tabular Processing references, chat controls and extraction settings descriptions cover saved-state limits, paging, source retention and legacy queued-job restart behavior.

Security checklist

• New Flask routes include @swagger_route(security=get_auth_security())
• Settings sent to non-admin frontends use sanitize_settings_for_user()
• Browser JavaScript is served from local SimpleChat static assets only; no CDN-hosted JS
• No secrets, keys, connection strings, or local-only artifacts are included

No new Flask routes or raw frontend settings payloads are introduced. Existing preview authorization/security decorators are retained; inventory references stay private and reads/cursors/caches remain source- and scope-bound. The downloaded investigation workbook and session-only audit artifacts are not committed.