docs: #152 — aligne changelog et roadmap sur la version livrée 2.27.0

Fusionne la section 2.26.0 (jamais publiée) dans 2.27.0 et corrige la ligne index de la roadmap ; suppression du tag local v2.26.0.
feat: #152 viewer XLSX — affichage multi-feuilles, édition des cellules et téléchargement des .xlsx
2026-09-25 20:32:14 -04:00 · 2026-09-25 20:30:45 -04:00 · 2026-09-24 17:13:40 -04:00
20 changed files with 686 additions and 16 deletions
@@ -6,7 +6,7 @@ Format basé sur [Keep a Changelog](https://keepachangelog.com/fr/1.1.0/),
 et [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

 > **En cours de développement** : les changements à venir sont listés dans la section
-> [Unreleased](#unreleased). La dernière version livrée est **2.25.0**.
+> [Unreleased](#unreleased). La dernière version livrée est **2.27.0**.

 ---

@@ -14,6 +14,29 @@ et [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

 ---

+## [2.27.0] — 2026-09-25
+
+### Ajouté
+
+- **#152 — Viewer XLSX** : affichage des fichiers `.xlsx` en tableaux multi-feuilles (onglets,
+  en-têtes A1), édition inline des cellules avec `PUT /api/file/{vault}/xlsx/save` (backup avant
+  écriture, coercion numérique) et téléchargement du fichier d'origine.
+
+---
+
+## [2.25.1] — 2026-09-24
+
+### Corrigé
+
+- **`/api/diagnostics` — erreur 500 « dictionary changed size during iteration ».**
+  Le calcul des statistiques d'index itérait `inv.word_index` et `index` en
+  direct, pendant que l'indexeur les modifiait depuis un autre thread (build au
+  démarrage, hooks incrémentaux) : l'itérateur de dict levait `RuntimeError` et
+  l'endpoint renvoyait 500. Les deux dicts sont désormais **copiés avant
+  itération** (copie atomique sous le GIL), ce qui supprime la course.
+
+---
+
 ## [2.25.0] — 2026-09-24

 ### Ajouté
@@ -4,7 +4,7 @@

 **Porte d'entrée web ultra-léger pour vos vaults Obsidian** — Accédez, naviguez et recherchez dans toutes vos notes Obsidian depuis n'importe quel appareil via une interface web moderne et responsive.

-[![Version](https://img.shields.io/badge/Version-2.25.0-blue.svg)]()
+[![Version](https://img.shields.io/badge/Version-2.27.0-blue.svg)]()
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Docker](https://img.shields.io/badge/Docker-Ready-blue.svg)](https://www.docker.com/)
 [![Python](https://img.shields.io/badge/Python-3.11+-green.svg)](https://www.python.org/)
@@ -85,6 +85,7 @@ Les **guides d'utilisation** pas à pas se trouvent dans [`docs/GUIDES/`](docs/G
 - **🖼️ Images Obsidian** : Support complet des syntaxes d'images Obsidian avec résolution intelligente
 - **🎬 Audio & vidéo** : Lecteurs HTML5 intégrés (`.mp3 .wav .flac .mp4 .webm`…) avec streaming HTTP Range (lecture, déplacement, plein écran) et **lecture persistante** (mini-lecteur flottant / mini-fenêtre vidéo, retour au média ou arrêt à tout moment, contrôles écran verrouillé via Media Session), repli téléchargement si le format n'est pas lisible par le navigateur
 - **🎨 Diagrammes Excalidraw** : Visualiseur/éditeur natif des fichiers `.excalidraw` et `.excalidraw.md` (iframe sandboxée, auto-save, thème clair/sombre, texte des diagrammes indexé pour la recherche)
+- **📊 Tableurs Excel** : les fichiers `.xlsx` s'ouvrent dans un visualiseur dédié — un tableau par feuille avec onglets, en-têtes A1 et édition directe des cellules (`PUT /api/file/{vault}/xlsx/save`, backup automatique), plus le téléchargement du fichier d'origine
 - **🎨 Syntax highlight** : Coloration syntaxique des blocs de code
 - **🌓 Thème clair/sombre** : Toggle persisté en localStorage
 - **📡 Synchronisation temps réel** : Surveillance automatique des fichiers via watchdog avec mise à jour incrémentale de l'index
@@ -975,8 +976,8 @@ Ce projet est sous licence **MIT** — voir le fichier [LICENSE](LICENSE) pour l

 ## 📝 Changelog

-Consultez le [CHANGELOG.md](./CHANGELOG.md) pour l'historique complet de toutes les versions (v1.0.0 → v2.25.0).
+Consultez le [CHANGELOG.md](./CHANGELOG.md) pour l'historique complet de toutes les versions (v1.0.0 → v2.27.0).

 ---

-*Projet : ObsiGate | Version : 2.25.0 | Dernière mise à jour : Septembre 2026*
+*Projet : ObsiGate | Version : 2.27.0 | Dernière mise à jour : Septembre 2026*
@@ -2,7 +2,7 @@

 **Ultra-light web gateway for your Obsidian vaults** — Access, browse, and search all your Obsidian notes from any device via a modern, responsive web interface.

-[![Version](https://img.shields.io/badge/Version-2.25.0-blue.svg)]()
+[![Version](https://img.shields.io/badge/Version-2.27.0-blue.svg)]()
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Docker](https://img.shields.io/badge/Docker-Ready-blue.svg)](https://www.docker.com/)
 [![Python](https://img.shields.io/badge/Python-3.11+-green.svg)](https://www.python.org/)
@@ -84,6 +84,7 @@ Step-by-step **user guides** live in [`docs/GUIDES/`](docs/GUIDES/):
 - **🖼️ Obsidian Images** : Full support for all Obsidian image syntaxes with intelligent resolution
 - **🎬 Audio & video** : Built-in HTML5 players (`.mp3 .wav .flac .mp4 .webm`…) with HTTP Range streaming (play, seek, fullscreen) and **persistent playback** (floating mini-player / mini video window, return to media or stop anytime, lock-screen controls via Media Session), falling back to download when the format is not playable in the browser
 - **🎨 Excalidraw Diagrams** : Native viewer/editor for `.excalidraw` and `.excalidraw.md` files (sandboxed iframe, autosave, dark/light theme, diagram text indexed for search)
+- **📊 Excel Spreadsheets** : `.xlsx` files open in a dedicated viewer — one table per sheet with tabs, A1 headers and inline cell editing (`PUT /api/file/{vault}/xlsx/save`, automatic backup), plus download of the original file
 - **🎨 Syntax Highlight** : Syntax highlighting for code blocks
 - **🌓 Light/Dark Theme** : Toggle persisted in localStorage
 - **📡 Real-time Sync** : Automatic file monitoring via watchdog with incremental index updates
@@ -1150,8 +1151,8 @@ This project is licensed under the **MIT License** - see the [LICENSE](LICENSE)

 ## 📝 Changelog

-See [CHANGELOG.md](./CHANGELOG.md) for the complete version history (v1.0.0 → v2.25.0).
+See [CHANGELOG.md](./CHANGELOG.md) for the complete version history (v1.0.0 → v2.27.0).

 ---

-*Project: ObsiGate | Version: 2.25.0 | Last updated: September 2026*
+*Project: ObsiGate | Version: 2.27.0 | Last updated: September 2026*
@@ -1 +1 @@
-2.25.0
+2.27.0
@@ -65,6 +65,7 @@ SUPPORTED_EXTENSIONS = {
    ".sh", ".bash", ".zsh", ".fish", ".bat", ".cmd", ".ps1",
    ".json", ".yaml", ".yml", ".toml", ".xml", ".csv",
    ".cfg", ".ini", ".conf", ".env", ".pdf",
+    ".xlsx",
    ".html", ".css", ".scss", ".less",
    ".java", ".c", ".cpp", ".h", ".hpp", ".cs", ".go", ".rs", ".rb",
    ".php", ".sql", ".r", ".m", ".swift", ".kt",
@@ -559,6 +560,12 @@ def _scan_vault(
                    raw = ""
                    title = fpath.stem.replace("-", " ").replace("_", " ")
                    content_preview = ""
+                elif ext == ".xlsx":
+                    # #152 — binary workbook: metadata only, the viewer renders
+                    # it (parity with _index_single_file_sync).
+                    raw = ""
+                    title = fpath.stem.replace("-", " ").replace("_", " ")
+                    content_preview = ""
                else:
                    raw = fpath.read_text(encoding="utf-8", errors="replace")
                    title = fpath.stem.replace("-", " ").replace("_", " ")
@@ -947,6 +954,10 @@ def _index_single_file_sync(vault_name: str, vault_path: str, file_path: str, va
            # #108 — binary media: metadata only, never read the bytes.
            raw = ""
            content_preview = ""
+        elif ext == ".xlsx":
+            # #152 — binary workbook: metadata only (parity with _scan_vault).
+            raw = ""
+            content_preview = ""
        else:
            raw = fpath.read_text(encoding="utf-8", errors="replace")
            content_preview = raw[:200].strip()
@@ -125,6 +125,9 @@ from backend.services.mutations import (
 from backend.services.mutations import (
    edit_file as service_edit_file,
 )
+from backend.services.mutations import (
+    edit_xlsx_cells as service_edit_xlsx_cells,
+)
 from backend.services.mutations import (
    move_path as service_move_path,
 )
@@ -211,6 +214,10 @@ class FileContentResponse(BaseModel):
    stream_url: str | None = Field(default=None, description="Byte-range streaming URL under /api/media (audio/video)")
    media_mime: str | None = Field(default=None, description="MIME type for audio/video files")
    is_csv: bool | None = Field(default=None, description="True for CSV files")
+    is_xlsx: bool | None = Field(default=None, description="True for Excel .xlsx files")
+    xlsx_sheets: list[dict[str, Any]] | None = Field(
+        default=None, description="Rendered xlsx sheets [{name, html}]"
+    )
    is_json: bool | None = Field(default=None, description="True for JSON files")
    is_excalidraw: bool | None = Field(default=None, description="True for Excalidraw diagram files")
    excalidraw_data: dict[str, Any] | None = Field(default=None, description="Excalidraw diagram data (elements, appState, files)")
@@ -1843,6 +1850,41 @@ async def api_file_save(
    return {"status": "ok", "vault": result["vault"], "path": result["path"], "size": result["size"]}


+@app.put("/api/file/{vault_name}/xlsx/save", response_model=FileSaveResponse)
+async def api_file_xlsx_save(
+    vault_name: str,
+    path: str = Query(..., description="Relative path to the .xlsx file"),
+    body: dict = Body(..., description='{"sheet": str, "cells": {"A1": value}}'),
+    current_user=Depends(require_auth),
+):
+    """Apply cell edits to an .xlsx workbook.
+
+    Expects a JSON body with ``sheet`` and ``cells`` (A1 references to new
+    scalar values, max 500 per request). A backup is created before the
+    workbook is rewritten.
+    """
+    if not check_vault_access(vault_name, current_user):
+        raise HTTPException(status_code=403, detail=f"Accès refusé à la vault '{vault_name}'")
+
+    sheet = body.get("sheet")
+    cells = body.get("cells")
+    if not isinstance(sheet, str) or not sheet:
+        raise HTTPException(status_code=400, detail="Feuille manquante")
+    if not isinstance(cells, dict) or not cells or len(cells) > 500:
+        raise HTTPException(status_code=400, detail="Cellules invalides (1 à 500 par requête)")
+    for ref, value in cells.items():
+        if not isinstance(ref, str) or not isinstance(value, (str, int, float, bool, type(None))):
+            raise HTTPException(status_code=400, detail=f"Cellule invalide: {ref!r}")
+
+    result = service_edit_xlsx_cells(vault_name, path, sheet, cells)
+    log_file_save(
+        current_user["username"], vault_name, path,
+        sum(len(str(v)) for v in cells.values()),
+        current_user.get("_request_ip", "unknown"),
+    )
+    return {"status": "ok", "vault": result["vault"], "path": result["path"], "size": result["size"]}
+
+
@app.delete("/api/file/{vault_name}", response_model=FileDeleteResponse)
 async def api_file_delete(vault_name: str, path: str = Query(..., description="Relative path to file"), current_user=Depends(require_auth)):
    """Delete a file from the vault.
@@ -2439,6 +2481,32 @@ async def api_file(vault_name: str, path: str = Query(..., description="Relative
            logger.error(f"PDF read error for {path}: {e}")
            raise HTTPException(status_code=500, detail=f"Error reading PDF: {e!s}")

+    # === Excel .xlsx: render sheets as HTML tables (binary, before read_text) ===
+    if ext == ".xlsx":
+        try:
+            from backend.xlsx_reader import render_sheets
+
+            sheets = render_sheets(file_path)
+            size = file_path.stat().st_size
+            return {
+                "vault": vault_name,
+                "path": path,
+                "title": file_path.name,
+                "tags": [],
+                "frontmatter": {},
+                "html": sheets[0]["html"] if sheets else "",
+                "raw_length": size,
+                "extension": ext,
+                "is_markdown": False,
+                "is_xlsx": True,
+                "xlsx_sheets": sheets,
+                "unsupported": False,
+                "size_bytes": size,
+            }
+        except Exception as e:
+            logger.error(f"XLSX read error for {path}: {e}")
+            raise HTTPException(status_code=500, detail=f"Error reading XLSX: {e!s}")
+
    # === Images: return as viewable image ===
    if is_image(ext):
        size = file_path.stat().st_size
@@ -4231,7 +4299,9 @@ async def api_diagnostics(current_user=Depends(require_admin)):
    vault_stats = {}
    total_files = 0
    total_tags = 0
-    for vname, vdata in index.items():
+    # Snapshot both dicts first: the indexer mutates them from background
+    # threads, and iterating a live dict raises "dictionary changed size".
+    for vname, vdata in list(index.items()):
        file_count = len(vdata.get("files", []))
        tag_count = len(vdata.get("tags", {}))
        vault_stats[vname] = {"file_count": file_count, "tag_count": tag_count}
@@ -4239,7 +4309,8 @@ async def api_diagnostics(current_user=Depends(require_admin)):
        total_tags += tag_count

    # Memory estimate for inverted index
-    word_index_entries = sum(len(docs) for docs in inv.word_index.values())
+    word_index = inv.word_index.copy()
+    word_index_entries = sum(len(docs) for docs in word_index.values())
    mem_estimate_mb = round(
        (sys.getsizeof(inv.word_index) + word_index_entries * 80
         + len(inv.doc_info) * 200
@@ -4253,7 +4324,7 @@ async def api_diagnostics(current_user=Depends(require_admin)):
            "vaults": vault_stats,
        },
        "inverted_index": {
-            "unique_tokens": len(inv.word_index),
+            "unique_tokens": len(word_index),
            "total_postings": word_index_entries,
            "documents": inv.doc_count,
            "sorted_tokens": len(inv._sorted_tokens),
@@ -181,6 +181,10 @@ _ENDPOINT_EXAMPLES: dict[tuple[str, str], dict[str, Any]] = {
        "request": {"path": "notes/Accueil.md", "content": "# Accueil\n\nMis à jour."},
        "response": {"status": "ok", "vault": "TestVault", "path": "notes/Accueil.md", "size": 26},
    },
+    ("put", "/api/file/{vault_name}/xlsx/save"): {
+        "request": {"sheet": "Budget", "cells": {"B1": "250"}},
+        "response": {"status": "ok", "vault": "TestVault", "path": "data/budget.xlsx", "size": 1},
+    },
    ("post", "/api/search/replace"): {
        "request": {"query": "Python", "replacement": "Python 3", "vault": "all", "dry_run": True},
        "response": {"matches": [{"vault": "TestVault", "path": "note1.md", "title": "Python", "match_count": 3}], "total_matches": 3, "dry_run": True},
@@ -14,6 +14,7 @@ from __future__ import annotations

 import logging
 import os
+import re
 import shutil
 from collections.abc import Callable
 from pathlib import Path
@@ -223,6 +224,102 @@ def edit_file(
    return {"success": True, "vault": vault_name, "path": rel_path, "size": len(content)}


+# Cell reference like "A1" / "AB42" (Excel A1 notation, up to 3 letters / 8 digits).
+_XLSX_CELL_RE = re.compile(r"^[A-Z]{1,3}[1-9][0-9]{0,7}$")
+# ponytail: bare int/float coercion mirrors what Excel does when you type a
+# number; dates/booleans stay text (upgrade path: parse locale dates too).
+_XLSX_INT_RE = re.compile(r"^[+-]?\d+$")
+_XLSX_FLOAT_RE = re.compile(r"^[+-]?(?:\d+\.\d*|\.\d+)$")
+
+
+def _coerce_xlsx_value(value: Any) -> Any:
+    """Turn the string sent by the cell editor back into a scalar."""
+    if not isinstance(value, str):
+        return value
+    text = value.strip()
+    if text == "":
+        return None
+    if _XLSX_INT_RE.match(text):
+        return int(text)
+    if _XLSX_FLOAT_RE.match(text):
+        return float(text)
+    return value
+
+
+def edit_xlsx_cells(
+    vault_name: str,
+    path: str,
+    sheet: str,
+    cells: dict[str, Any],
+    *,
+    backup: bool = True,
+) -> dict[str, Any]:
+    """Apply a batch of cell edits to an ``.xlsx`` workbook.
+
+    Raises:
+        ServiceError: ``not_found`` (404), ``read_only`` (403) or
+        ``invalid`` (400) for a bad sheet, cell reference or value.
+
+    ponytail: openpyxl round-trips values/formulas/styles but drops charts,
+    images and pivot tables; use the SheetJS path if a workbook needs those.
+    """
+    root = get_vault_root(vault_name)
+    _ensure_writable(root)
+    file_path = resolve_safe_path(root, path)
+
+    if not file_path.exists() or not file_path.is_file():
+        raise ServiceError(
+            f"File not found: {path}",
+            code="not_found",
+            status=404,
+            details={"vault": vault_name, "path": path},
+        )
+    if file_path.suffix.lower() != ".xlsx":
+        raise ServiceError(
+            f"Not an .xlsx file: {path}", code="invalid", status=400
+        )
+    if not cells:
+        raise ServiceError("No cells to update", code="invalid", status=400)
+    for ref in cells:
+        if not isinstance(ref, str) or not _XLSX_CELL_RE.match(ref):
+            raise ServiceError(
+                f"Invalid cell reference: {ref!r}", code="invalid", status=400
+            )
+
+    from openpyxl import load_workbook
+
+    try:
+        wb = load_workbook(file_path)
+    except Exception as exc:
+        raise ServiceError(
+            f"Cannot open workbook: {exc}", code="invalid", status=400
+        ) from exc
+    if sheet not in wb.sheetnames:
+        raise ServiceError(
+            f"Unknown sheet: {sheet}",
+            code="invalid",
+            status=400,
+            details={"sheets": wb.sheetnames},
+        )
+
+    rel_path = _rel(root, file_path)
+    if backup:
+        create_backup(file_path, vault_name, rel_path)
+
+    ws = wb[sheet]
+    for ref, value in cells.items():
+        ws[ref].value = _coerce_xlsx_value(value)
+    wb.save(file_path)
+
+    logger.info(f"XLSX cells saved: {vault_name}/{rel_path} [{sheet}] +{len(cells)}")
+    return {
+        "success": True,
+        "vault": vault_name,
+        "path": rel_path,
+        "size": len(cells),
+    }
+
+
 def append_to_file(
    vault_name: str,
    path: str,
@@ -0,0 +1,86 @@
+"""Render ``.xlsx`` workbooks as HTML tables for the viewer (#xlsx).
+
+Read-only: formulas are shown as their text (``data_only=False``) so a
+round-trip through the viewer never depends on Excel's cached values.
+Write-side lives in ``backend.services.mutations.edit_xlsx_cells``.
+"""
+
+from __future__ import annotations
+
+import html
+from datetime import date, datetime
+from pathlib import Path
+from typing import Any
+
+from openpyxl import load_workbook
+from openpyxl.utils import get_column_letter
+
+# ponytail: hard caps bound the rendered grid (500 rows x 40 cols per sheet).
+# Raise them, or paginate per sheet, if a real workbook needs more.
+MAX_ROWS = 500
+MAX_COLS = 40
+
+
+def _fmt(value: Any) -> str:
+    if value is None:
+        return ""
+    if isinstance(value, datetime):
+        return value.strftime("%Y-%m-%d %H:%M")
+    if isinstance(value, date):
+        return value.isoformat()
+    return str(value)
+
+
+def _trim(grid: list[list[str]]) -> list[list[str]]:
+    """Drop trailing empty rows and columns (openpyxl pads to max_col)."""
+    while grid and not any(grid[-1]):
+        grid.pop()
+    if not grid:
+        return grid
+    width = 0
+    for row in grid:
+        for i in range(len(row) - 1, -1, -1):
+            if row[i]:
+                width = max(width, i + 1)
+                break
+    return [row[:width] for row in grid]
+
+
+def _table(grid: list[list[str]]) -> str:
+    if not grid:
+        return "<p><em>Feuille vide</em></p>"
+    n_cols = max(len(row) for row in grid)
+    out = [
+        (
+            '<div class="csv-table-wrapper"><table class="csv-table xlsx-table">'
+            '<thead><tr><th class="xlsx-corner"></th>'
+        )
+    ]
+    out += [f"<th>{get_column_letter(c)}</th>" for c in range(1, n_cols + 1)]
+    out.append("</tr></thead><tbody>")
+    for r, row in enumerate(grid, start=1):
+        out.append(f'<tr><th class="xlsx-rownum">{r}</th>')
+        for c, val in enumerate(row, start=1):
+            ref = f"{get_column_letter(c)}{r}"
+            out.append(f'<td data-cell="{ref}">{html.escape(val)}</td>')
+        out.append("</tr>")
+    out.append("</tbody></table></div>")
+    return "".join(out)
+
+
+def render_sheets(file_path: Path) -> list[dict[str, str]]:
+    """Return ``[{"name": sheet_title, "html": table_html}, ...]``."""
+    wb = load_workbook(str(file_path), read_only=True, data_only=False)
+    try:
+        sheets = []
+        for ws in wb.worksheets:
+            grid = [
+                [_fmt(v) for v in row]
+                for row in ws.iter_rows(
+                    min_row=1, max_row=MAX_ROWS, max_col=MAX_COLS, values_only=True
+                )
+            ]
+            sheets.append({"name": ws.title, "html": _table(_trim(grid))})
+        return sheets
+    finally:
+        wb.close()
@@ -2626,7 +2626,7 @@ dependencies = [

 [[package]]
 name = "obsigate-desktop"
-version = "2.25.0"
+version = "2.27.0"
 dependencies = [
 "chrono",
 "env_logger",
@@ -1,6 +1,6 @@
 [package]
 name = "obsigate-desktop"
-version = "2.25.0"
+version = "2.27.0"
 description = "ObsiGate Desktop — Porte d'entrée native pour vos vaults Obsidian"
 authors = ["Bruno Charest"]
 edition = "2021"
@@ -1,7 +1,7 @@
 {
  "$schema": "https://raw.githubusercontent.com/nicedoc/obsigate/main/desktop/tauri.conf.schema.json",
  "productName": "ObsiGate",
-  "version": "2.25.0",
+  "version": "2.27.0",
  "identifier": "com.obsigate.desktop",
  "build": {
    "frontendDist": "../frontend",
@@ -188,6 +188,7 @@ Avant de corriger quoi que ce soit, un agent IA doit :
 | *BUG-076* | [🟡 IMPORTANT] Assistant IA : après une action de l'agent, l'arborescence et le document ouvert ne sont pas rafraîchis dynamiquement | 🟢 corrigé | P1 | 📱 frontend | IA | `frontend/js/bookslm.js` | Mode agent : créer/supprimer un fichier ou dossier, modifier le document ouvert → l'UI ne bouge pas | `frontend/js/bookslm.js` : `MUTATING_TOOLS`/`FILE_WRITE_TOOLS`, refresh d'arborescence débouncé sur event `tool`, `_notifyFileWritten` étendu (xlsx/docx/csv/pdf). Tests : `tests/frontend/ai.test.mjs`, `tests/frontend/editor-inline.test.mjs` | Aucun refresh explicite sur les événements `tool` mutateurs (repose uniquement sur le watcher SSE) ; `_notifyFileWritten` ignore les créations de documents (xlsx/docx/csv/pdf) |
 | *BUG-077* | [🟡 IMPORTANT] Assistant IA : aucun bouton « Stop » pour arrêter l'exécution de l'agent à tout moment | 🟢 corrigé | P1 | 📱 frontend | IA | `frontend/js/bookslm.js` | Mode agent : lancer une longue tâche → le bouton Envoyer est désactivé, impossible d'arrêter (seule la fermeture du panneau abort) | `frontend/js/bookslm.js` + `frontend/style.css` : bouton d'envoi → Stop (`_syncSendButton`/`_stopGeneration`/`_markStopped`), i18n `ai.stop`/`ai.stopped`. Tests : `tests/frontend/ai.test.mjs` (+2) | `_abortCtrl` n'est déclenché que par `close()` ; aucun signal d'arrêt côté client pendant le stream |
 | *BUG-078* | [🟡 IMPORTANT] Fichiers de code : la coloration syntaxique (highlight.js) disparaît — les feuilles de thème sont basculées à partir de la **clé** de thème au lieu du **mode** | 🟢 corrigé | P1 | 📱 frontend | IA | `frontend/js/themes.js`, `frontend/js/ui.js`, `tests/frontend/unit.test.mjs` | Ouvrir un fichier `.py`/`.sh`/`.ps1`/`.yml` : le code s'affiche en texte brut, sans couleurs | `frontend/js/themes.js` : `applyTheme` bascule `hljs-theme-dark`/`hljs-theme-light` selon le **mode** (`isDark`). `frontend/js/ui.js` : `initTheme`/`applyTheme` résolvent le mode persisté (`obsigate-theme-mode`) au lieu de traiter la clé (`defaut-obsigate`) comme un mode. Test : `unit.test.mjs` (+1). | Les deux feuilles étaient désactivées car `defaut-obsigate !== "dark"` et `!== "light"` ; résultat **non déterministe** selon l'ordre `UI.initTheme()` (clé) / `Sync.init()` → `themes.initThemes()` (mode). Vérifié Playwright : 5/5 chargements colorés (`.py`), sépia/contraste élevé sur la palette claire |
+| *BUG-079* | `GET /api/diagnostics` → 500 « dictionary changed size during iteration » (stats d'index) | 🟢 corrigé | P1 | ⚙️ backend | IA | `backend/main.py` | Charger la page de diagnostic pendant une indexation : `GET /api/diagnostics` → 500 | `backend/main.py` (`api_diagnostics`) : snapshot avant itération — `list(index.items())` et `inv.word_index.copy()` (copie C atomique sous le GIL) ; test de non-régression `tests/test_api_main.py::TestConfig::test_diagnostics_concurrent_index_writes` | Le handler itérait les dicts en direct alors que l'indexeur les modifiait depuis un autre thread (rebuild initial dans `_search_executor`, hooks incrémentaux `add_document`/`remove_document`) → `RuntimeError` dans le générateur → 500. Test déterministe (`RaceDict` fait grossir le dict en cours d'itération) : échoue sans le correctif, passe avec. Vérifié : pytest 1305 passed / 6 skipped, ruff 0, mypy 0 |

 ### TODOs techniques (améliorations / nouvelles tâches)

@@ -271,6 +272,7 @@ Avant de corriger quoi que ce soit, un agent IA doit :
 | 2026-09-24 | BUG-074 → BUG-077 | Correction | `backend/agent/loop.py`, `backend/bookslm_routes.py`, `frontend/js/bookslm.js`, `frontend/style.css`, `frontend/index.html`, `frontend/locales/{fr,en}.json`, `frontend/sw.js`, `tests/test_agent_loop.py`, `tests/test_bookslm.py`, `tests/frontend/ai.test.mjs`, `tests/frontend/editor-inline.test.mjs`, `CHANGELOG.md`, `docs/ISSUES_TODOLIST.md` | **Lot assistant IA (mode agent)** : (BUG-075) confirmation par lot — `pending.actions` regroupe toutes les mutations d'un tour LLM, un unique bouton « Tout approuver (N) » envoie `confirm_all` (`ToolContext.confirmed`) et n'interrompt plus à chaque action ; les lectures du lot s'exécutent aussitôt. (BUG-074) résumé du bloc d'étapes avec titre de la 1re action + compteur limité aux actions, reprise diffusée dans le même message (fini le « 1 étape » fragmenté). (BUG-076) refresh de l'arborescence débouncé sur les events `tool` mutateurs + `_notifyFileWritten` étendu aux documents (xlsx/docx/csv/pdf). (BUG-077) le bouton d'envoi devient « Stop » pendant le stream (abort SSE, tâche serveur annulée à la déconnexion, marqueur « Exécution arrêtée. »). Guide/i18n FR/EN + `ai.stop`/`ai.stopped`/`ai.confirm_actions`/`ai.action_apply_all` ; `SW_VERSION` v25. Vérifié : pytest 1304 passed / 6 skipped, ruff/mypy 0, validate-imports 40 modules, unit 11/11, ai 100/100, editor-inline 44/44, mobile-editor 35/35, ai-sidebar 6/6, forge 32/32, pane-manager 9/9, sw 8/8. | 🟢 corrigé (en attente vérif utilisateur) |

 | 2026-09-24 | #115, #117, BUG-078 | Feature + correction | `frontend/js/themes.js`, `frontend/js/ui.js`, `frontend/js/viewer.js`, `frontend/js/config.js`, `frontend/index.html`, `frontend/style.css`, `frontend/popout.html`, `frontend/locales/{fr,en}.json`, `frontend/icons/avatar/*` (nouveau), `tests/frontend/unit.test.mjs`, `tests/frontend/toolbar-order.test.mjs`, `tests/frontend/settings-order-avatar.test.mjs`, `docs/features/viewer-toolbar-highlight-avatars.md` (nouvelle), `docs/ROADMAP.md`, `CHANGELOG.md` | **#115** barre d'outils de lecture épinglée : `viewer.js`/`popout.html` sortent `.file-actions` de `.file-header` dans un `.file-toolbar` enfant direct de `.content-area` (`position: sticky; top: 0`), masqué en mode lecture. **BUG-078** coloration syntaxique : le basculement des feuilles highlight.js suit le **mode** (`themes.applyTheme` + `ui.initTheme/applyTheme` lisent `obsigate-theme-mode`) au lieu de la clé de thème qui désactivait les deux feuilles. **#117** avatars prédéfinis : galerie de 12 images (`frontend/icons/avatar/`) dans `#cfg-profile`, clic → recadrage 256 px (pipeline import) + `PATCH /api/auth/me`, avatars actifs surlignés (`obsigate-avatar-preset`), import personnalisé et suppression conservés. Vérifié : Playwright (coloration 5/5 déterministe, toolbar épinglée à `barTop` constant au défilement), `unit.test.mjs` 12/12, `toolbar-order` 13/13, `settings-order-avatar` 12/12, JSDOM editor-inline/pane-manager/mobile-editor/image-viewer/pdf-viewer/config-mobile/media-viewer/excalidraw verts, pytest 1304 passed / 6 skipped, ruff/mypy 0, validate-imports 40 modules. | 🟢 corrigé (en attente vérif utilisateur) |
+| 2026-09-24 | BUG-079 | Correction | `backend/main.py`, `tests/test_api_main.py`, `CHANGELOG.md`, `docs/ISSUES_TODOLIST.md` | **BUG-079** : `GET /api/diagnostics` renvoyait 500 « dictionary changed size during iteration ». Le handler itérait `inv.word_index.values()` et `index.items()` en direct alors que l'indexeur les modifiait depuis un autre thread (rebuild initial dans `_search_executor`, hooks incrémentaux `add_document`/`remove_document`) → `RuntimeError` dans le générateur. Correctif : **snapshot avant itération** (`list(index.items())`, `inv.word_index.copy()`) — copie C atomique sous le GIL, pas de verrou ajouté. Test de non-régression déterministe (`RaceDict` fait grossir le dict pendant l'itération ; échoue sans le correctif, passe avec). Vérifié : pytest 1305 passed / 6 skipped, ruff 0, mypy 0 (80 fichiers), validate-imports 40 modules, unit 12/12. | 🟢 corrigé (en attente vérif utilisateur) |

 ---

@@ -1,6 +1,6 @@
 # ObsiGate — Roadmap

-> **Version :** 2.25.0 | **Dernière mise à jour :** 2026-09-24
+> **Version :** 2.27.0 | **Dernière mise à jour :** 2026-09-25
 > **Ce fichier ne contient que le travail à venir** (🔵 En cours + ⚪ Backlog) et un index compact
 > vers les fonctionnalités livrées.
 > - **Méthode de livraison à appliquer pour toute tâche : [DELIVERY_WORKFLOW.md](./DELIVERY_WORKFLOW.md)**
@@ -126,6 +126,7 @@

 | # | Domaine / fonctionnalité | Version | Détails |
 |---|---|---|---|
+| 152 | Viewer XLSX — affichage multi-feuilles, édition des cellules, téléchargement | 2.27.0 | [archive](./archive/COMPLETED_v1-v2.md) |
 | BUG-047 | Versionnage — source unique `VERSION` + bump SemVer automatique au commit (hooks + tag) | 2.3.0 | [DEVELOPMENT_AND_RELEASES.md](./DEVELOPMENT_AND_RELEASES.md) |
 | 90 | Barre d'actions du document — regroupement fonctionnel + spacers | 2.3.0 | [archive](./archive/COMPLETED_v1-v2.md) |
 | 89 | Drag & drop complet de fichiers/dossiers & intégration Assistant IA | 2.3.0 | [features/drag-and-drop-ai.md](./features/drag-and-drop-ai.md) |
@@ -404,6 +404,21 @@ Deux compléments au bouton « Ajouter » de l'assistant IA.

 ---

+## #152 — Viewer XLSX : affichage, édition, téléchargement ✅ TERMINÉ
+
+Les fichiers `.xlsx` s'ouvrent dans un dédié : un tableau HTML par feuille (onglets en cas de
+multi-feuilles, en-têtes A1, cellules `contenteditable`), bouton **Enregistrer** actif dès la
+première modification et téléchargement du fichier d'origine.
+
+| Aspect | Détail |
+|---|---|
+| Lecture | `backend/xlsx_reader.py` — openpyxl `read_only`, formules affichées comme texte, plafond 500×40 cellules par feuille |
+| Écriture | `PUT /api/file/{vault}/xlsx/save` → `services/mutations.edit_xlsx_cells` (backup avant écriture, refs A1 validées, `str`→`int`/`float`, 500 cellules max par requête) |
+| Frontend | `renderXlsxViewer` dans `frontend/js/viewer.js` (onglets, cellules sales, Entrée/Échap, collage monoligne) |
+| Limite connue | Le round-trip openpyxl conserve valeurs/formules/styles mais perd graphiques, images et tableaux croisés |
+
+---
+
 ## Grosses fonctionnalités — fiches dédiées

 | # | Feature | Version | Fiche |
@@ -995,6 +995,110 @@ export function renderVideoViewer(area, data) {
 }


+// ── Excel .xlsx — sheet tabs + editable cells ─────────────────────────────
+// Cells are contenteditable; edits are collected per sheet and sent to
+// PUT /api/file/{vault}/xlsx/save. Formula cells show their text and are
+// saved back as formulas (no client-side recalculation — ceiling accepted).
+function renderXlsxViewer(area, data) {
+  const sheets = data.xlsx_sheets || [];
+  const tabs = sheets.length > 1
+    ? `<div class="xlsx-tabs">${sheets.map((s, i) =>
+        `<button class="xlsx-tab${i === 0 ? " active" : ""}" data-sheet="${i}">${escapeHtml(s.name)}</button>`
+      ).join("")}</div>`
+    : "";
+  const panels = sheets.map((s, i) =>
+    `<div class="xlsx-panel" data-sheet="${i}"${i === 0 ? "" : ' style="display:none"'}>${s.html}</div>`
+  ).join("");
+
+  area.innerHTML = `
+    <div class="xlsx-viewer">
+      <div class="xlsx-toolbar">
+        ${tabs}
+        <span class="xlsx-toolbar-actions">
+          <button class="btn-action" id="xlsx-save-btn" disabled>${t("common.save")}</button>
+          <button class="btn-action" id="xlsx-download-btn">
+            <i data-lucide="download" style="width:14px;height:14px"></i> ${t("viewer.download")}
+          </button>
+        </span>
+      </div>
+      <div class="xlsx-panels">${panels}</div>
+    </div>`;
+
+  const saveBtn = area.querySelector("#xlsx-save-btn");
+  const panelEls = [...area.querySelectorAll(".xlsx-panel")];
+  const dirtyCount = () => area.querySelectorAll("td.xlsx-dirty").length;
+  const refreshSaveState = () => { saveBtn.disabled = dirtyCount() === 0; };
+
+  // Editable cells: Enter blurs, Escape reverts, paste stays single-line.
+  area.querySelectorAll(".xlsx-table td").forEach((td) => {
+    td.contentEditable = "true";
+    td.spellcheck = false;
+    td.dataset.orig = td.textContent;
+    td.addEventListener("input", () => {
+      td.classList.add("xlsx-dirty");
+      refreshSaveState();
+    });
+    td.addEventListener("keydown", (e) => {
+      if (e.key === "Enter") { e.preventDefault(); td.blur(); }
+      if (e.key === "Escape") {
+        td.textContent = td.dataset.orig;
+        td.classList.remove("xlsx-dirty");
+        refreshSaveState();
+      }
+    });
+    td.addEventListener("paste", (e) => {
+      e.preventDefault();
+      const text = (e.clipboardData || window.clipboardData).getData("text").replace(/\r?\n/g, " ");
+      document.execCommand("insertText", false, text);
+    });
+  });
+
+  area.querySelectorAll(".xlsx-tab").forEach((tab) => {
+    tab.addEventListener("click", () => {
+      const idx = tab.dataset.sheet;
+      area.querySelectorAll(".xlsx-tab").forEach((x) => x.classList.toggle("active", x === tab));
+      panelEls.forEach((p) => { p.style.display = p.dataset.sheet === idx ? "" : "none"; });
+    });
+  });
+
+  saveBtn.addEventListener("click", async () => {
+    // One PUT per sheet (dirty cells can span tabs before a save).
+    const jobs = panelEls
+      .map((panel) => {
+        const cells = {};
+        panel.querySelectorAll("td.xlsx-dirty").forEach((td) => { cells[td.dataset.cell] = td.textContent; });
+        return { sheet: sheets[Number(panel.dataset.sheet)].name, cells };
+      })
+      .filter((job) => Object.keys(job.cells).length);
+    if (!jobs.length) return;
+    saveBtn.disabled = true;
+    try {
+      for (const job of jobs) {
+        await api(`/api/file/${encodeURIComponent(data.vault)}/xlsx/save?path=${encodeURIComponent(data.path)}`, {
+          method: "PUT",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify(job),
+        });
+      }
+      area.querySelectorAll("td.xlsx-dirty").forEach((td) => {
+        td.classList.remove("xlsx-dirty");
+        td.dataset.orig = td.textContent;
+      });
+      refreshSaveState();
+      showToast(t("editor.saved"), "success");
+    } catch (err) {
+      refreshSaveState();
+      showToast(`${t("editor.save_error")}: ${err.message || err}`, "error");
+    }
+  });
+
+  area.querySelector("#xlsx-download-btn").addEventListener("click", () => {
+    window.open(`/api/file/${encodeURIComponent(data.vault)}/download?path=${encodeURIComponent(data.path)}`, "_blank");
+  });
+
+  safeCreateIcons();
+}
+
 export function renderFile(data) {
  // #93 — An inline edition session (#editor-container mounted in the content
  // area) is destroyed by this very re-render: release it first so the editor
@@ -1058,6 +1162,12 @@ export function renderFile(data) {
    return;
  }

+  // Handle Excel .xlsx — editable table view (display / edit / download)
+  if (data.is_xlsx) {
+    renderXlsxViewer(area, data);
+    return;
+  }
+
  // Handle Excalidraw — render in iframe editor
  if (data.is_excalidraw) {
    renderExcalidraw(area, data, data.vault, data.path);
@@ -10924,6 +10924,69 @@ body.desktop-mode .editor-container {
  background: var(--surface);
 }

+/* ── XLSX Viewer ── */
+.xlsx-toolbar {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin-bottom: 8px;
+  flex-wrap: wrap;
+}
+.xlsx-toolbar-actions {
+  margin-left: auto;
+  display: flex;
+  gap: 8px;
+}
+.xlsx-tabs {
+  display: flex;
+  gap: 4px;
+  flex-wrap: wrap;
+}
+.xlsx-tab {
+  border: 1px solid var(--border);
+  background: var(--surface);
+  color: var(--text-secondary);
+  border-radius: 4px;
+  padding: 4px 10px;
+  font-size: 0.8rem;
+  cursor: pointer;
+}
+.xlsx-tab.active {
+  background: var(--accent, #4a90d9);
+  border-color: var(--accent, #4a90d9);
+  color: #fff;
+}
+.xlsx-table th.xlsx-corner,
+.xlsx-table th.xlsx-rownum {
+  background: var(--surface);
+  color: var(--text-secondary);
+  font-weight: 400;
+  text-align: right;
+  padding: 6px 8px;
+  border-bottom: 2px solid var(--border);
+  border-right: 1px solid var(--border-light, var(--border));
+  position: sticky;
+  left: 0;
+  z-index: 1;
+}
+.xlsx-table th.xlsx-corner {
+  left: 0;
+  top: 0;
+  z-index: 2;
+}
+.xlsx-table td[contenteditable] {
+  cursor: text;
+  min-width: 40px;
+  white-space: pre-wrap;
+}
+.xlsx-table td[contenteditable]:focus {
+  outline: 2px solid var(--accent, #4a90d9);
+  outline-offset: -2px;
+}
+.xlsx-table td.xlsx-dirty {
+  background: rgba(255, 196, 0, 0.18);
+}
+
 /* ── JSON Viewer ── */
 .json-viewer {
  font-family: 'JetBrains Mono', 'Fira Code', 'Consolas', monospace;
@@ -1,6 +1,6 @@
 {
  "name": "obsigate",
-  "version": "2.25.0",
+  "version": "2.27.0",
  "description": "**Porte d'entrée web ultra-léger pour vos vaults Obsidian** — Accédez, naviguez et recherchez dans toutes vos notes Obsidian depuis n'importe quel appareil via une interface web moderne et responsive.",
  "main": "patch.js",
  "directories": {
@@ -460,6 +460,39 @@ class TestConfig:
        # Should have some diagnostic info
        assert len(data) > 0

+    def test_diagnostics_concurrent_index_writes(self, client):
+        """Regression: word_index mutated while the handler iterates it raised
+        "dictionary changed size during iteration" -> 500."""
+        from backend.search import get_inverted_index
+
+        inv = get_inverted_index()
+        original = inv.word_index
+
+        class RaceDict(dict):
+            """dict whose .values() grows the dict mid-iteration, exactly like
+            the indexer writing from another thread."""
+            def values(self):
+                it = iter(dict.values(self))
+                first = next(it, _SENTINEL)
+                if first is _SENTINEL:
+                    return iter(())
+                self["__injected__"] = {"__injected_doc__": 1}
+
+                def gen():
+                    yield first
+                    yield from it  # raises RuntimeError: dict changed size
+                return gen()
+
+        _SENTINEL = object()
+        inv.word_index = RaceDict(original)
+        try:
+            resp = client.get("/api/diagnostics")
+            assert resp.status_code == 200, resp.text
+            assert "memory_estimate_mb" in resp.json()["inverted_index"]
+        finally:
+            inv.word_index = original
+            original.pop("__injected__", None)
+

 # ═══════════════════════════════════════════════════════════════════
 # Dashboard
@@ -0,0 +1,152 @@
+"""Display / edit / download for .xlsx files (viewer + PUT xlsx/save)."""
+
+from __future__ import annotations
+
+from pathlib import Path
+
+import pytest
+
+openpyxl = pytest.importorskip("openpyxl")
+
+VAULT = "TestVault"
+
+
+@pytest.fixture
+def xlsx_file(test_vault_dir: str) -> str:
+    from openpyxl import Workbook
+
+    path = Path(test_vault_dir) / "budget.xlsx"
+    wb = Workbook()
+    ws = wb.active
+    ws.title = "Budget"
+    ws["A1"] = "Poste"
+    ws["B1"] = 100
+    ws["A2"] = "Total"
+    ws["B2"] = "=B1*2"
+    notes = wb.create_sheet("Notes")
+    notes["A1"] = "hello"
+    wb.save(path)
+    return str(path)
+
+
+# ── Display ───────────────────────────────────────────────────────────────
+
+
+class TestXlsxDisplay:
+    def test_renders_all_sheets(self, client, xlsx_file):
+        resp = client.get(f"/api/file/{VAULT}", params={"path": "budget.xlsx"})
+        assert resp.status_code == 200
+        data = resp.json()
+        assert data["is_xlsx"] is True
+        assert data["unsupported"] is False
+        assert [s["name"] for s in data["xlsx_sheets"]] == ["Budget", "Notes"]
+
+        first = data["xlsx_sheets"][0]["html"]
+        assert "Poste" in first
+        assert 'data-cell="B1"' in first
+        assert "=B1*2" in first  # formula kept as text (data_only=False)
+        assert 'data-cell="A1"' in data["xlsx_sheets"][1]["html"]
+
+    def test_corrupt_xlsx_returns_500(self, client, test_vault_dir):
+        bad = Path(test_vault_dir) / "corrupt.xlsx"
+        bad.write_bytes(b"this is not a zip archive")
+        resp = client.get(f"/api/file/{VAULT}", params={"path": "corrupt.xlsx"})
+        assert resp.status_code == 500
+
+
+# ── Index parity (tree visibility) ────────────────────────────────────────
+
+
+class TestXlsxIndexing:
+    def test_xlsx_in_supported_extensions(self):
+        from backend.indexer import SUPPORTED_EXTENSIONS
+
+        assert ".xlsx" in SUPPORTED_EXTENSIONS
+
+    def test_xlsx_indexed_metadata_only(self, test_vault_dir, xlsx_file):
+        from backend.indexer import _index_single_file_sync
+
+        info = _index_single_file_sync(VAULT, test_vault_dir, xlsx_file)
+        assert info is not None
+        assert info["extension"] == ".xlsx"
+        assert info["content"] == ""  # binary: never read into TF-IDF
+        assert info["title"]  # filename-derived title
+
+
+# ── Edit ──────────────────────────────────────────────────────────────────
+
+
+class TestXlsxSave:
+    def _save(self, client, body, path="budget.xlsx"):
+        return client.put(
+            f"/api/file/{VAULT}/xlsx/save",
+            params={"path": path},
+            json=body,
+        )
+
+    def test_save_updates_cell_with_number_coercion(self, client, xlsx_file):
+        resp = self._save(client, {"sheet": "Budget", "cells": {"B1": "250"}})
+        assert resp.status_code == 200
+        assert resp.json()["status"] == "ok"
+
+        from openpyxl import load_workbook
+
+        wb = load_workbook(xlsx_file)
+        assert wb["Budget"]["B1"].value == 250  # int, not "250"
+
+    def test_save_leaves_other_sheets_and_formulas(self, client, xlsx_file):
+        resp = self._save(client, {"sheet": "Budget", "cells": {"A1": "Titre", "B1": 42}})
+        assert resp.status_code == 200
+
+        from openpyxl import load_workbook
+
+        wb = load_workbook(xlsx_file)
+        assert wb["Budget"]["B2"].value == "=B1*2"
+        assert wb["Notes"]["A1"].value == "hello"
+
+    def test_save_empty_string_clears_cell(self, client, xlsx_file):
+        resp = self._save(client, {"sheet": "Budget", "cells": {"A1": ""}})
+        assert resp.status_code == 200
+
+        from openpyxl import load_workbook
+
+        assert load_workbook(xlsx_file)["Budget"]["A1"].value is None
+
+    def test_save_creates_backup(self, client, xlsx_file):
+        from backend.services.backups import get_backup_dir
+
+        resp = self._save(client, {"sheet": "Budget", "cells": {"A1": "backup-me"}})
+        assert resp.status_code == 200
+        backup_dir = Path(get_backup_dir(VAULT, "budget.xlsx"))
+        assert backup_dir.is_dir()
+        assert list(backup_dir.glob("*.bak"))
+
+    def test_unknown_sheet_400(self, client, xlsx_file):
+        resp = self._save(client, {"sheet": "Nope", "cells": {"A1": "x"}})
+        assert resp.status_code == 400
+
+    def test_invalid_cell_ref_400(self, client, xlsx_file):
+        resp = self._save(client, {"sheet": "Budget", "cells": {"A-1": "x"}})
+        assert resp.status_code == 400
+
+    def test_wrong_extension_400(self, client, test_vault_dir):
+        (Path(test_vault_dir) / "note.md").write_text("# hi\n", encoding="utf-8")
+        resp = self._save(client, {"sheet": "Sheet", "cells": {"A1": "x"}}, path="note.md")
+        assert resp.status_code == 400
+
+    def test_missing_file_404(self, client):
+        resp = self._save(client, {"sheet": "Budget", "cells": {"A1": "x"}}, path="absent.xlsx")
+        assert resp.status_code == 404
+
+    def test_too_many_cells_400(self, client, xlsx_file):
+        cells = {f"A{i}": i for i in range(1, 502)}
+        resp = self._save(client, {"sheet": "Budget", "cells": cells})
+        assert resp.status_code == 400
+
+    def test_nested_value_400(self, client, xlsx_file):
+        resp = self._save(client, {"sheet": "Budget", "cells": {"A1": {"nested": 1}}})
+        assert resp.status_code == 400
+
+    def test_missing_sheet_field_400(self, client, xlsx_file):
+        resp = self._save(client, {"cells": {"A1": "x"}})
+        assert resp.status_code == 400
Author	SHA1	Message	Date
bruno	c36c299466	docs: #152 — aligne changelog et roadmap sur la version livrée 2.27.0 Fusionne la section 2.26.0 (jamais publiée) dans 2.27.0 et corrige la ligne index de la roadmap ; suppression du tag local v2.26.0.	2026-09-25 20:32:14 -04:00
bruno	8611416670	feat: #152 viewer XLSX — affichage multi-feuilles, édition des cellules et téléchargement des .xlsx - backend/xlsx_reader.py : rend openpyxl en tableaux HTML (plafond 500x40 par feuille) - PUT /api/file/{vault}/xlsx/save : service edit_xlsx_cells (backup avant écriture, refs A1 validées) - frontend : renderXlsxViewer (onglets, contenteditable, sauvegarde par feuille) - docs : CHANGELOG [Unreleased], Roadmap index #152, archive, README FR/EN, exemple OpenAPI	2026-09-25 20:30:45 -04:00
bruno	e20fd6bf97	fix: /api/diagnostics 500 « dictionary changed size during iteration » — snapshot des dicts avant itération BUG-079 CI / lint (push) Successful in 2m3s Details CI / security (push) Successful in 1m27s Details CI / test (push) Successful in 4m22s Details CI / build (push) Successful in 1m22s Details CI / e2e (push) Successful in 13m36s Details	2026-09-24 17:13:40 -04:00
@@ -1 +1 @@
 .25.0
 .27.0