feat: garde-fous d'écriture des classeurs Excel #153 (P0)

L'édition d'un .xlsx pouvait détruire une partie du classeur, le
concurrencer en silence, ou diffuser une injection de formule.

- BUG-085 : inspect_workbook() détecte ce qu'un round-trip openpyxl perd
  (valeurs calculées en cache, slicers, contrôles, connexions, custom
  XML, signature, commentaires enrichis, macros) → xlsx_lossy_features
  exposé en lecture, bandeau FR/EN, et 409 xlsx_lossy_content sans
  `force` (confirmation explicite puis reprise). Périmètre réel
  revalidé : graphiques, images et TCD survivent au round-trip.
- BUG-086 : écriture atomique (fichier .tmp + os.replace) : un plantage
  ne peut plus tronquer le classeur, le backup reste intact.
- BUG-087 : verrou par fichier autour du read-modify-write (timeout 15 s,
  409 conflict) ; endpoint xlsx/save devenu synchrone pour que
  l'attente s'exécute dans le threadpool.
- BUG-088 : une saisie en '=' ou '@' est stockée en texte, sauf opt-in
  `allow_formula` ou le bouton f(x) de la visionneuse. Le handler
  ServiceError expose désormais code + details, que api() propage.
- BUG-084 : la suppression d'une vault purge enfin l'index inversé
  (documents fantômes qui continuaient de matcher) et is_stale() devient
  is_ready(), le nom étant trompeur (la staleness n'existe plus).

Tests : 1390 pytest, 10 JSDOM (xlsx-viewer.test.mjs, branché au CI),
3 E2E Playwright, suite E2E complète verte, ruff/mypy 0.

🤖 Generated with Codebuff
Co-Authored-By: Codebuff <[email protected]>

backend/routers/config.py

@@ -481,7 +481,7 @@ async def api_diagnostics(current_user=Depends(require_admin)):
             "total_postings": word_index_entries,
             "documents": inv.doc_count,
             "sorted_tokens": len(inv._sorted_tokens),
-            "is_stale": inv.is_stale(),
+            "is_ready": inv.is_ready(),
             "memory_estimate_mb": mem_estimate_mb,
         },
         "config": _load_config(),

backend/routers/files_read.py

@@ -241,7 +241,7 @@ async def api_file(vault_name: str, path: str = Query(..., description="Relative
     # === Excel .xlsx: render sheets as HTML tables (binary, before read_text) ===
     if ext == ".xlsx":
         try:
-            from backend.xlsx_reader import render_sheets
+            from backend.xlsx_reader import inspect_workbook, render_sheets
 
             sheets = render_sheets(file_path)
             size = file_path.stat().st_size
@@ -257,6 +257,9 @@ async def api_file(vault_name: str, path: str = Query(..., description="Relative
                 "is_markdown": False,
                 "is_xlsx": True,
                 "xlsx_sheets": sheets,
+                # #153 A1 — parts a save would drop; the viewer warns and asks
+                # for an explicit confirmation before forcing the write.
+                "xlsx_lossy_features": inspect_workbook(file_path),
                 "unsupported": False,
                 "size_bytes": size,
             }

backend/routers/files_write.py

@@ -114,17 +114,35 @@ async def api_file_save(
 
 
 @router.put("/api/file/{vault_name}/xlsx/save", response_model=FileSaveResponse)
-async def api_file_xlsx_save(
+def api_file_xlsx_save(
     vault_name: str,
     path: str = Query(..., description="Relative path to the .xlsx file"),
-    body: dict = Body(..., description='{"sheet": str, "cells": {"A1": value}}'),
+    body: dict = Body(
+        ...,
+        description=(
+            '{"sheet": str, "cells": {"A1": value}, '
+            '"allow_formula": false, "force": false}'
+        ),
+    ),
     current_user=Depends(require_auth),
 ):
     """Apply cell edits to an .xlsx workbook.
 
     Expects a JSON body with ``sheet`` and ``cells`` (A1 references to new
-    scalar values, max 500 per request). A backup is created before the
-    workbook is rewritten.
+    scalar values, max 500 per request) plus two optional boolean flags:
+
+    * ``allow_formula`` — keep values starting with ``=``/``@`` as real
+      formulas. Off by default (#153 A4): such a value is stored as text so a
+      later Excel session cannot execute it (DDE).
+    * ``force`` — write a workbook carrying features openpyxl cannot re-serialize
+      (slicers, form controls, connections, custom XML, signature, cached formula
+      results). Without it the call fails **409** ``xlsx_lossy_content`` and the
+      client asks the user to confirm (#153 A1).
+
+    A backup is created before the workbook is rewritten, and the new archive
+    swaps in atomically. Declared as a sync endpoint on purpose: the openpyxl
+    round-trip and the per-file lock wait (#153 A3) then run in the threadpool
+    instead of blocking the event loop.
     """
     if not check_vault_access(vault_name, current_user):
         raise HTTPException(status_code=403, detail=f"Accès refusé à la vault '{vault_name}'")
@@ -138,8 +156,16 @@ async def api_file_xlsx_save(
     for ref, value in cells.items():
         if not isinstance(ref, str) or not isinstance(value, (str, int, float, bool, type(None))):
             raise HTTPException(status_code=400, detail=f"Cellule invalide: {ref!r}")
+    flags: dict[str, bool] = {}
+    for name in ("allow_formula", "force"):
+        raw = body.get(name, False)
+        if not isinstance(raw, bool):
+            raise HTTPException(status_code=400, detail=f"Flag invalide: {name}")
+        flags[name] = raw
 
-    result = service_edit_xlsx_cells(vault_name, path, sheet, cells)
+    result = service_edit_xlsx_cells(
+        vault_name, path, sheet, cells, **flags
+    )
     log_file_save(
         current_user["username"], vault_name, path,
         sum(len(str(v)) for v in cells.values()),