Cell comments and threaded replies

How the text is hidden

Excel keeps comment text outside the worksheet: the classic form in xl/comments1.xml, and the threaded review form modern Excel writes in xl/threadedComments/threadedComment1.xml, under a different element name. The cell shows a corner marker; the words appear on hover or in a side pane. A workbook round-tripped through a current Excel moves from the first shape to the second.

Why a model still reads it

The comment parts are ordinary XML inside the package and their text is plain. Every extractor that walks the package reads them, while a reviewer reading the grid meets only the marker.

What we do about it

Both spellings are read — reading one and not the other would be a one-save bypass. commentBlocks takes <t> where the shape has one and <text> only for the threaded form, skips the sibling <authors> list, and emits each comment as a block with role comment, flags.hiddenAttr set and the invisible reason hidden-attr. The rule xlsx-comment matches on that combination and reports at severity informational with action disclose — recorded for completeness, not as an alarm. visibilityOf grades comment content editing-only.

How often it fires

0% of 200 real workbooks from five national open-data portals (CA, IE, DE, GR, UK), measured 2026-08-21.

This is an alert-volume number and nothing else. It says how often the alarm sounds on documents as found — not how often it is right, and not whether what it found was harmless. Documents as found may themselves carry concealment. Read it against the population named above rather than as a property of documents in general.