Quality release: restores the worker mutation-testing floor (Stryker break ≥ 90) with three targeted regression tests, no source or config changes.
Worker mutation-floor fixes
- CSV formula neutralisation's numeric regex: pins the integer/decimal/exponent digit-run branches (
-12,+.55,+1e10,-1e-10) and the trigger-led non-numeric case (+5xyz), closing mutants that would silently mis-quote or under-quote CSV cell values. - Rate-limit config parsing: pins the
rps <= 0boundary against a numerically-zero-but-non-canonical"0.0"input, closing a mutant that would loosen the boundary and admit a zero rate. - RoomDO seed migration: pins the batched log/audit/chat key loop bounds against an off-by-one mutant that would write a spurious trailing key.
Also in this release
- SocialCalc 3.1.0 compatibility (client security model migration —
untrustedContent/securityPolicy.sanitizeHtml, dropped the regex-injectedsanitizeHTMLpatch) shipped in 0.20260716.0 and is included here unchanged.
Verification
- CI (typecheck, 100% coverage across all gated packages, workers-pool integration,
wrangler deploy --dry-run, self-host Docker + nginx-proxy smoke, Playwright e2e, Helm lint): run #29582527969 — green - LemmaScript (Dafny + Lean): run #29582527702 — green
- Nightly full Stryker matrix (worker/shared/client/socketio-shim/migrate/oracle-harness) + oracle replay + staging dry-run, re-run explicitly against this release commit: run #29582796886 — green,
mutation (worker)restored to break ≥ 90
Artifacts
- npm:
ethercalc@0.20260717.0(OIDC-signed provenance) - Docker:
audreyt/ethercalc:0.20260717.0(also tagged:latest, multi-arch amd64/arm64)
Production Worker deployment (ethercalc.net) is a separate manual gate and was not performed as part of this release.