fix(csv): neutralize formula-leading session export cells

[seonghobae]

Verified successor closure

This branch is closed only after separating unrelated concurrent dependency changes and fully inheriting its valid CSV contract into canonical session-export lane #574.

• predecessor exact head: 82c1956ec703220d5ed28fd4acaa497918bc16e3
• verified successor: #574@9dbc8747ec584a39c34393d7e33171b31df54428
• common protected base: developmental@2fa92012bcf80acc1f921a4bafea76b3b1424b46

Before closure, the concurrent package.json/pnpm-lock.yaml security delta was removed from this CSV branch by exact-blob restoration rather than discarded: CVE-2026-40345 has canonical dependency lane #525, and Browserslist CVE-2026-73088/73089 already have patched-version dependency work outside the CSV owner path. The generated Sentinel regression, lost CHANGELOG entry, reduced fixtures and reduced JSDoc from the intervening commit were also repaired before disposition.

#574 now preserves every valid predecessor behavior/test/contract delta: ASCII and full-width formula initiators, TAB/CR/LF, leading whitespace including NBSP and BOM/U+FEFF, delimiter-containing formula text, quote/delimiter containment, empty/already-text/null/undefined cases, numeric formatting, buyer-visible CHANGELOG evidence and the residual-risk statement that CSV output is not a universal spreadsheet sandbox.

The predecessor's lib/server/csv/export.ts location is not an independent semantic delta. There is one current caller, the session export route; #574 keeps the encoder beside that bounded route instead of creating a broader shared abstraction before a second owner/use case exists. The route imports the canonical helper and its regression suite executes that same production function.

#574 remains Draft and must satisfy its own unchanged-head CI/security/review evidence. No predecessor check or approval transfers. This is verified-successor consolidation, not a merge-ready claim and not PR-count reduction by source loss.

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T21:24:09.977346Z	8649468	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.