Summary

• add a reusable async fresh-package transaction with bounded validation and atomic publication
• add strict resource-accounted xlsx.batch/1 plans and a shared transactional XLSX mutation SDK
• expose canonical office create xlsx and office batch commands with versioned JSON results, capability discovery, and stable errors
• reuse the strict plan parser in the legacy XLSX CLI
• harden XLSX read/write resource limits, namespace-aware OOXML relationships, and preservation-safe drawing round trips

Why

This closes the X3 parity gap with OfficeCLI while keeping mutation safety, limits, and publication semantics in one future-proof transaction boundary. It uses moonbitlang/async throughout and introduces no C stubs.

Impact

Agents can now create validated XLSX packages and apply bounded multi-operation scripts atomically. Creation is no-replace by default, separate batch outputs require explicit overwrite, dry runs perform full validation, zero-op in-place batches preserve source bytes, and changed batches report full-workbook rewrite preservation evidence.

The exact CI-tested head is 591654d1 with merge base 7082fa3d. Later
main movement is confined to disjoint pdflite changes.

Validation

• moon info && moon fmt — clean, with no source or .mbti drift
• moon check --target native
• moon check --target wasm
• moon check --target js
• moon test --target native
• moon test --target wasm
• moon test --target js
• focused Office XLSX transaction tests on native and Wasm — 13/13 on each target
• direct-read unused-relationship resource-budget regression on native, Wasm, and JavaScript
• native CLI build for XLSX, DOCX, Office, and pdflite
• Office CLI Cram — 147/147
• Microsoft DocumentFormat.OpenXml SDK acceptance through the native workspace suite
• exact-head GitHub CI, including macOS and Windows transactional-editing jobs
• fresh independent Codex CLI review found a relationship-preflight resource-budget blocker; 591654d1 fixes it and adds exact regression coverage

Closes #162