EtherCalc Files

Quality release: restores the worker mutation-testing floor (Stryker break ≥ 90) with three targeted regression tests, no source or config changes.

Worker mutation-floor fixes

• CSV formula neutralisation's numeric regex: pins the integer/decimal/exponent digit-run branches (-12, +.55, +1e10, -1e-10) and the trigger-led non-numeric case (+5xyz), closing mutants that would silently mis-quote or under-quote CSV cell values.
• Rate-limit config parsing: pins the rps <= 0 boundary against a numerically-zero-but-non-canonical "0.0" input, closing a mutant that would loosen the boundary and admit a zero rate.
• RoomDO seed migration: pins the batched log/audit/chat key loop bounds against an off-by-one mutant that would write a spurious trailing key.

Also in this release

• SocialCalc 3.1.0 compatibility (client security model migration — untrustedContent/securityPolicy.sanitizeHtml, dropped the regex-injected sanitizeHTML patch) shipped in 0.20260716.0 and is included here unchanged.

Verification

• CI (typecheck, 100% coverage across all gated packages, workers-pool integration, wrangler deploy --dry-run, self-host Docker + nginx-proxy smoke, Playwright e2e, Helm lint): run [#29582527969] — green
• LemmaScript (Dafny + Lean): run [#29582527702] — green
• Nightly full Stryker matrix (worker/shared/client/socketio-shim/migrate/oracle-harness) + oracle replay + staging dry-run, re-run explicitly against this release commit: run [#29582796886] — green, mutation (worker) restored to break ≥ 90

Artifacts

• npm: ethercalc@0.20260717.0 (OIDC-signed provenance)
• Docker: audreyt/ethercalc:0.20260717.0 (also tagged :latest, multi-arch amd64/arm64)

Production Worker deployment (ethercalc.net) is a separate manual gate and was not performed as part of this release.