audreyt · Aug 10, 2026 · Aug 10, 2026 · Aug 10, 2026 · Aug 10, 2026 · Aug 10, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -237,13 +237,24 @@ jobs:
   mutation-gate:
     name: mutation-gate — changed packages only
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    # Budget (2026-08-10): local full six-package ratchet exits 0 in ~828s
+    # (~13m48s) on M-series; this job mutates only packages with `src/`
+    # changes vs origin/main (this branch: worker only — robots + rooms).
+    # Worker alone dominates wall-clock. CI ubuntu runners are slower than
+    # local, and run 31388973185 cancelled the Stryker step at
+    # timeout-minutes:20 with zero score output — a cancelled gate is
+    # indistinguishable from green at a glance and trains people to ignore
+    # it. 45m ≈ ~2.5× the local full-matrix baseline, deliberate headroom
+    # so the gate can finish and report a real score rather than timing out.
+    # Do NOT lower Stryker break thresholds to "fit" a short budget.
+    timeout-minutes: 45
     needs: test
     # Fast PR-gate mutation check. Runs Stryker only on packages whose
     # `src/` changed in the PR, so docs/test/config-only PRs skip it and
-    # single-package PRs stay under ~2 minutes. The full matrix lives in
-    # nightly.yml; see AGENTS.md §5.3 + docs/MUTATION_REPORT.md for the
+    # single-package PRs stay under the budget above. The full matrix lives
+    # in nightly.yml; see AGENTS.md §5.3 + docs/MUTATION_REPORT.md for the
     # ratchet workflow.
+
     steps:
       - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:

diff --git a/AGENTS.md b/AGENTS.md
@@ -19,6 +19,7 @@ line/branch/function/statement coverage on gated packages in CI.
 | User guide + FAQ | [docs.ethercalc.net](https://docs.ethercalc.net) · `packages/docs/` |
 | HTTP API | `API.md` |
 | Self-host hardening | `docs/SELFHOST_HARDENING.md` |
+| Prod upgrade runbook | `docs/migration/PROD_UPGRADE_PLAN.md` |
 | Oracle replay | `tests/oracle/README.md` · `packages/oracle-harness/` |
 | Mutation baselines | `docs/MUTATION_REPORT.md` |
 | Sandstorm `.spk` | `SANDSTORM.md` (manual `spk pack` — app owner signs) |
@@ -117,7 +118,31 @@ spikes/                   Immutable research provenance (not the maintained work
 ## Session log
 
 Per-session history is in `docs/historic/REWRITE_ULTRAPLAN.md` §14 (append-only,
-newest last). Latest: full security audit of `main` against prod
+newest last). Latest: operator runbook for upgrading production
+`ethercalc.net` to `main` (`docs/migration/PROD_UPGRADE_PLAN.md` plus
+`DELTA_AUDIT.md`, `SKEW_AND_RECONNECT.md`, `PREFLIGHT_RESULTS.md`,
+`INVENTORY.md`). Read-only probes overturned the assumed
+`0.20260717.0`/`149ebcf` baseline — `GET /_auth/whoami` returns
+`{"uid":null,"enabled":true}`, root HTML serves `./static/passkey/ui.js`,
+and `/static/index-bootstrap.js` is 404 — so production sits in
+`[d2afa90, b7d8840)` with passkeys/`AuthDO`/ACL/private rooms already live
+and the security-audit page-script extraction not. The original Phase-2
+`ETHERCALC_AUTH="0"` soak would have failed `authEnabled()`, nulled every
+session principal, and 403'd every private room; corrected plan is a single
+gradual ramp with `AUTH="1"` throughout (three-phase analysis kept as
+Appendix A). Candidate-range checks that made the simpler plan safe:
+`wrangler.toml` declares only `v1`/`v2`, all three D1 migrations are
+byte-identical, and `lib/authorize.ts` is byte-identical. Exposed
+regression: `ec_sess` → `__Host-ec_sess` with no dual-read (silent logout
+at rollout). Search-indexing policy restored after an accidental
+dual-purpose-commit revert (`ae86756` → `c789249`; only `/` stays
+indexable; robots.txt has no `Disallow` so crawlers can still observe
+`noindex`). Tip `327fa3d`: worker 53/1526 node + 13/197 workers-pool at
+100% coverage (2706/1936/298/2416); mutation ratchet exit 0 in 828s,
+`@ethercalc/worker` +0.03pp, `robots.ts` 100% (9/0). Open: six
+`[OPERATOR-VERIFY]` items (chiefly `CURRENT_PROD_VERSION_ID` via
+`wrangler deployments list`) and the staging rehearsal.
+Prior: full security audit of `main` against prod
 `ethercalc.net`, with every confirmed finding fixed at its owning boundary —
 stored DOM XSS in the client graph panel, multi-sheet `postMessage`/TOC trust,
 per-message WS/Socket.IO authentication and attachment-room binding (no more
@@ -140,7 +165,3 @@ fail-closed Helm passkey anchors.
 Mutation floors re-measured: worker 90.21, shared 99.69, socketio-shim 84.68,
 migrate 90.38, oracle-harness 83.46, client 77.61 — equivalent mutants carry
 written `// Stryker disable` justifications rather than padded tests.
-Prior: merged passkey accounts + private sheets (Phase A) from
-`feat/passkey-permissions` (PR #841) — WebAuthn `AuthDO` relying party,
-RoomDO-enforced `meta:access`/`meta:acl` private rooms, principal-threaded
-routes, dependency-free passkey UI, WS session-expiry enforcement.
diff --git a/API.md b/API.md
@@ -100,13 +100,21 @@ To find out which command corresponds to which spreadsheet actions,
 perform the actions on the web interface and check the _Audit_ tab
 for the recorded commands.
 
+Command batches that would push the sheet's declared area past the 200,000-cell limit are rejected with `413`. The same limit applies over WebSocket, where the connection closes with code `1008` and reason `Command exceeds sheet limits`.
+
 + Request (application/json)
 + Response 202
 
     ```json
     {"command": "..."}
     ```
 
++ Response 413 (text/plain)
+
+    ```text
+    command exceeds sheet limits
+    ```
+
 ## Append Rows [POST]
 
 Takes a CSV structure that contains fields to be appended to the first column after the last row.

diff --git a/Changes.txt b/Changes.txt
@@ -34,6 +34,13 @@ Security
 - Made staging deploy validation pass `--config wrangler.toml` explicitly, so
   Vite's generated production-config redirect cannot silently ignore
   `--env staging`.
+- Room URLs stay unlisted by design: every non-landing response now carries
+  `X-Robots-Tag: noindex, nofollow, noarchive`, and only `/` remains
+  indexable. `GET /robots.txt` returns a real robots file (Allow: `/` only)
+  instead of falling through the `/:room` catch-all as app HTML. The robots
+  file deliberately carries no `Disallow` directive — `Disallow` forbids
+  fetching, so a crawler blocked from a URL can never observe its `noindex`
+  header and already-indexed rooms would be stranded permanently.
 
 Tooling
 - Migrated the repository interface to Vite+ 0.2.4: package operations use
@@ -54,6 +61,10 @@ Tooling
 - Hardened self-host Docker builds against local-state leakage: build context
   excludes dependencies, Vite/Wrangler output, secrets, migration dumps, and
   persistent room data; the smoke gate asserts the resulting image is clean.
+- Fixed `scripts/ratchet-verify.sh` mutation score parsing in `jq` and `node`
+  branches by computing the score from mutant status counts rather than reading
+  a non-existent `mutationScore` property, resolving an unconditional parse
+  error (exit 2) during mutation ratchet audits.
 
 Integration
 - Prepared the headless adapter for the next SocialCalc release: bundle
@@ -68,6 +79,12 @@ Integration
   measured 920px cutoff, avoiding overlap with SocialCalc's expanded menu while
   preserving fixed top-right chrome on wider sheets.
 
+Bug fixes
+- Fixed `POST /_/:room` returning `202` on Durable Object command rejections,
+  which silently discarded writes. The route now propagates the DO status and
+  response body (such as `413 command exceeds sheet limits` when a batch exceeds
+  200,000 cells).
+
 ==============================================================================
 0.20260717.0 — 2026-07-17
 ==============================================================================

diff --git a/bun.lock b/bun.lock
diff --git a/docs/historic/REWRITE_ULTRAPLAN.md b/docs/historic/REWRITE_ULTRAPLAN.md
@@ -457,6 +457,7 @@ Append one entry per session.
 | 2026-07-16 | tooling | **Migrated the repository interface to Vite+ 0.2.4.** `vp install/add/remove/update` now owns package operations; `vp run`/`vp exec` own task and binary orchestration; package Vite/Vitest imports, scripts, contributor docs, e2e child processes, and CI/deploy/nightly/release workflows were migrated. Root `vite.config.ts` aggregates package Vitest projects and replaces Biome with Vite+ Oxlint while preserving the three-rule/no-formatter contract; Biome and its lockfile graph were removed. `bun@1.3.14` remains pinned as the underlying package manager/native runtime, with direct Bun confined to Bun-native scripts/tests and Docker or packed-package paths where Vite+ is not shipped. Verified frozen install, `vp check`, all-package typecheck, 2,208 aggregated Vitest tests, the full `vp run test` workflow, asset builds, and 15 Playwright e2e tests. | (this commit) |
 | 2026-08-03 | security-audit | **Full-branch security audit of `main` against prod `ethercalc.net`, fixes landed at the owning boundary.** Closed: stored DOM XSS in the client graph panel (persisted `graphrange`/named-range values reached `innerHTML`; now `textContent` plus a built Hide-Help control, removing the last inline `onclick`); multi-sheet TOC/`postMessage` trust (origin+source checked in `index.html`, `SheetFrame` targets its own origin, TOC links validated by `isSafeMultiSheetLink`); WS/Socket.IO authentication and memory (per-message `verifyAuth` on every state-changing frame, attachment-room binding instead of client-supplied `parsed.room`, per-socket rate window, message/frame/chat/cell caps in `@ethercalc/shared`, bounded handshake sessions with teardown in the shim); unbounded ingestion (auth and suffix-import bodies now pass the shared size guard; ZIP archive/sheet/cell/column caps; bounded cross-sheet hydration; chunked-snapshot metadata validation); `/_timetrigger` no longer a public metadata/side-effect endpoint, and the scheduler no longer treats refusals as fires or deletes non-fired rows; session/identity (`__Host-ec_sess`, AuthDO-side revocation with monotonic windows, per-IP ceremony rate limits, challenge capacity cap, session expiry enforced on live sockets); trust-proxy correctness (`CF-Connecting-IP` honoured only from the trusted edge, nginx now replaces rather than appends forwarding headers, bucket eviction); room-ID entropy restored to ≥62 bits; creation-limit classifier extended to private/form/multi-import routes; `no-store` on authenticated/private responses plus global security headers; export sanitizer allowlist mirrored to the client policy. Root HTML page scripts were extracted to five tracked files under `static/` (`index-bootstrap`, `index-l10n`, `start-bootstrap`, `start-page`, `panels`) with a `requiredFiles` assertion in `scripts/build-assets.ts`, since the whole-directory copy checks no individual names — note the app CSP still needs `script-src 'unsafe-inline'` for SocialCalc's toolbar, so this is hygiene, not yet a boundary. Infra: compat date 2024-11-12 → 2026-07-21 (capnp in lockstep), `run_worker_first`, pinned base image, read-only/no-new-privileges containers, `automountServiceAccountToken: false`, Helm passkey trust anchors that fail closed, with `scripts/check-helm-hardening.sh` covering both. Verification: `vp check`, all-package typecheck, 1499 worker-node + 194 workers-pool + the remaining package suites, 100% worker coverage, 47/47 Playwright e2e, `wrangler deploy --dry-run`, helm lint/template matrix, self-host and proxy smoke. Mutation floors re-measured: worker 90.21 (break 90), shared 99.69 (99), socketio-shim 84.68 (84), migrate 90.38 (90), oracle-harness 83.46 (83), client 77.61 (77); provably equivalent mutants carry written `// Stryker disable` justifications instead of padded tests. | (working tree) |
 | 2026-08-03 | security-audit/follow-up | **Closed the final Host-derived CSP seam caught during delivery review.** `index.ts` had built `connect-src ws(s)://…` from `new URL(request.url).host`, even though the same file correctly forbids using attacker-controlled `Host` for cross-origin redirects. New pure `lib/csp.ts#websocketAuthority` anchors the WebSocket authority on `ETHERCALC_ORIGIN` (including configured scheme/port), falling back to the request host only for self-hosts without a valid configured origin. Ten Node tests pin configured/fallback/scheme/port/invalid-origin lanes. Live `wrangler dev` probes with `Host: attacker.test` and `Host: evil.example:1337` both retained `connect-src 'self' wss://ethercalc.net`. Post-fix worker typecheck, 100% coverage, mutation 90.21 ≥ 90, and `vp check` passed; Stryker restored cleanly with no instrumentation markers. | (working tree) |
+| 2026-08-10 | prod-upgrade | **Operator runbook for upgrading production `ethercalc.net` to `main`.** Deliverable `docs/migration/PROD_UPGRADE_PLAN.md` with companions `DELTA_AUDIT.md`, `SKEW_AND_RECONNECT.md`, `PREFLIGHT_RESULTS.md`, `INVENTORY.md`. Central finding overturned the original premise: production is not tag `0.20260717.0` / `149ebcf`. Read-only probes (`GET /_auth/whoami` → `{"uid":null,"enabled":true}`, a route absent at `149ebcf`; root HTML serves `./static/passkey/ui.js`; `GET /static/index-bootstrap.js` is 404) bound production to `[d2afa90, b7d8840)` — passkeys, `AuthDO`, ACL, and private rooms are already live; the security-audit page-script extraction is not. That mattered because the original three-phase cutover set `ETHERCALC_AUTH="0"` in Phase 2 as a safety soak; against real production that fails `authEnabled()`, nulls every session principal, and 403s every existing private room to its owner — a self-inflicted outage. Corrected plan is a single gradual ramp with `AUTH="1"` throughout; superseded three-phase analysis preserved as Appendix A. Verified constraints that made the simpler plan safe: across the whole candidate range `wrangler.toml` declares only `v1`/`v2` (no lifecycle change), all three D1 migration files are byte-identical (blob OIDs match), and `lib/authorize.ts` is byte-identical (no declassification on rollback). A real regression the corrected baseline exposed: `lib/session.ts` renames the session cookie `ec_sess` → `__Host-ec_sess` with no dual-read, so every signed-in passkey user is silently logged out at rollout and an open tab on a private room can fail to reconnect. Search-indexing policy restored and shipped (`c789249`): a worker session misread the originating commit's `docs(migration):` subject, judged the bundled production code accidental, and reverted it in `ae86756`; recovered in `c789249` with all four blobs verified byte-identical to the originals (cautionary for dual-purpose commits). Measurements at tip `327fa3d`: worker suites 53 files / 1526 tests (node), 13 / 197 (workers-pool), 100% coverage (2706/1936/298/2416); mutation ratchet exit 0 in 828s with every audited package under 1pp of its break floor and `@ethercalc/worker` at +0.03pp — `robots.ts` itself scored 100% (9 killed / 0 survived). Still open: six `[OPERATOR-VERIFY]` items needing live Cloudflare access, chiefly `wrangler deployments list` to pin `CURRENT_PROD_VERSION_ID` (needed for the rollback target, not for the ramp's safety), and the staging rehearsal. | (this branch) |
 
 ---