Harden export preview handling

docs/API_CONTRACTS.md

@@ -1010,14 +1010,22 @@ Returns one persisted export record.
 ### GET `/api/v1/exports/{export_id}/content`
 
 Returns the stored JSON artifact content through the standard API envelope.
+HTML report artifacts are intentionally download-only through `/download`.
+Calling `/content` for `project_report_html` returns:
+
+```text
+code: EXPORT_CONTENT_UNSUPPORTED
+message: Export content preview is only available for JSON and GeoJSON artifacts. Download HTML report artifacts instead.
+```
 
 ### GET `/api/v1/exports/{export_id}/download`
 
-Downloads the stored JSON/GeoJSON export artifact as a raw file response with
-`application/json` content type and a `Content-Disposition` attachment
-filename. This endpoint intentionally does not use the JSON envelope because
-it is a browser/file-download path; callers that need canonical API JSON should
-use `/content`.
+Downloads the stored JSON/GeoJSON/HTML export artifact as a raw file response
+with a `Content-Disposition` attachment filename. JSON and GeoJSON artifacts
+use `application/json`; HTML report artifacts use `text/html`. This endpoint
+intentionally does not use the JSON envelope because it is a browser/file-download
+path; callers that need canonical API JSON should use `/content` for JSON/GeoJSON
+artifacts.
 
 ### POST `/api/v1/exports/yolo`
 

docs/CODEX_EXECUTION_LOG.md

@@ -1,3 +1,25 @@
+## Sprint 38 Export Center preview hardening (2026-06-17)
+
+Changed:
+- Hardened the export content preview path so HTML report artifacts return `EXPORT_CONTENT_UNSUPPORTED` instead of a generic JSON parse failure.
+- Updated the frontend Export Center to offer JSON preview only for JSON/GeoJSON artifacts.
+- HTML project report artifacts now display as download-only in the export list.
+- Extracted export preview rendering from `frontend/src/App.tsx` into `frontend/src/components/exports/ExportPreview.tsx`.
+- Updated API/frontend docs, changelog and TODO status.
+
+Validation:
+- `cd backend && python -m pytest tests/test_sprint17_export_foundation.py -q` passed: 10 tests.
+- `cd frontend && npm run typecheck` passed.
+
+Open:
+- Full release readiness and Tower redeploy/browser smoke are still recommended before treating this pass as deployed.
+
+Limitations:
+- This pass does not add new export formats, PDF reports, provider fetching, AI inference or migrations.
+
+Next recommended pass:
+- Run the full readiness gate, frontend build and Tower deploy smoke; then continue with shared workbench orchestration decomposition or export cleanup/history filtering.
+
 ## Sprint 37 Tower PostgreSQL collation maintenance (2026-06-17)
 
 Changed:

docs/TODO.md

@@ -50,7 +50,8 @@ This file now starts with the current implementation status. Older preparation/b
 - [x] QA/QC results and map workspace component decomposition.
 - [x] Docker Compose port/storage/database configuration via `.env` defaults for Unraid.
 - [x] Single-container `geointel` Unraid compose/template runtime.
-- [ ] Further frontend component decomposition for export preview and shared workbench orchestration.
+- [x] Export preview component decomposition and HTML report download-only UX hardening.
+- [ ] Further frontend shared workbench orchestration decomposition.
 
 ## Sprint 8 status