Every witness reads back its effect​

• From ess/34 a compensating refusal (compensates: true beside external:) may delete its addressed row with deletes: and instance:. Its scenario requires the error, no event and the row absent from every immediate view.
• From ess/34 a named when: or when_related: refusal of a command addressing an existing row snapshots that row completely and requires it unchanged. Below it, suites keep their bytes.
• At every format, a further witness of a deleting branch requires the deleted row absent, and a guard's boundary row for a deletes: branch is sent for a row of its own.
• A non-refusing unknown_instance: branch must store no row with the identity it was sent.
• A view row field set from an Optional<T> input through its declared conversion is asserted at the value sent.

The mutation audit covers grants and lists its gaps​

• Two new classes audit actor grants: grant-drop removes one command from one actor's may:, grant-add gives an actor one served command it lacks (#710). Where either is selected, the baseline and every mutant's suite keep their <command>/grant/denied scenarios.
• Each site a selected class excluded or could not mutate is listed with its reason under unmutated_sites, in the text, the report and the manifest (#711). The summary says how many of the sites considered were scored. --fail-on-unmutated makes such a site block exit 0; the default exit status is unchanged.
• error-swap mutates a refusal that carries its error's payload, re-keying the entry to the error swapped in (#709).
• --target interpreted runs synthesized scenarios on the scenario clock run uses, so a model with a now guard is scored.

Go synthesis and the generated explorers​

• Go synthesis copies a required event field into an Optional command input as a pointer, and writes a served component named server or wire under a repaired file name instead of panicking.
• --target clap generates one tree with every group of the components that share a cli.binary; validation refuses a group, command or view two of them both declare.
• The generated explorers agree with the interpreter on an external: branch for a stored row, fail an answer that leaves out a required response member, and explore only the scoped component's commands and views.

Generated servers refuse what their OpenAPI refuses​

• The generated Rust codecs refuse at decode, before anything is stored, a Timestamp that is not an RFC 3339 date-time and a member a closed JSON object does not declare. The server answers 400, or the binding's refusals.malformed, naming the member's path (#707).
• Before, the server stored the text or dropped the member, while the OpenAPI document it serves already refused the body. A struct declaring undeclared_fields: ignored and a Json value stay open.
• The same decoders read the log, so decode_system_event refuses an envelope an older server wrote with a free-text Timestamp or an extra member in a closed struct.
• The generated Go server refuses a top-level JSON command member no input field names, on bound and derived routes, and reads a Timestamp with the same grammar as the Rust server.
• Known limit: an Optional member sent as null is still taken as absent by the generated Rust server, while its served OpenAPI refuses the body. It is tracked as a backlog story.

An authored success act asserts no error​

• An authored act whose outcome: names a branch that declares no error now also requires that no error came back. A target answering the success branch under its own name with an error fails the step; it used to pass on the outcome name alone.
• No suite format moves. A library caller assembling an authored suite by hand selects the format with select_fresh_format_for and runs it with Runner::run_admitted, as the CLI does.

Denied-grant scenarios​

• Synthesis writes <command>/grant/denied for a command acting on an existing row beside a view ranked by order_by (#712).
• <view>/grant/read/denied reads the view as every ungranted actor of the view's own domain, then as no actor. Before, it read one actor of any domain, so a target admitting an ungranted actor of the view's domain passed.

Generated UIs call their binding's routes​

• ess generate ui and ess ui run --tui take --http <binding>: the generated route table carries the method and path the ess-http/1 binding declares, so the UI calls the routes the server generated for the same binding serves (#713).
• A command served on get is sent without a body, and React refuses a path value of . or ...

Renderer fixes​

• The terminal renderer addresses a row action's confirm by the view's row key, and a record's actions see the row the record shows.
• An account menu entry keeps its sets and navigate in React. ess ui check refuses an entry a renderer would drop, an entry that does not read as an action, and sets beside does, navigate or opens.

Appending an absent optional element​

• The interpreted target appends null for an absent or null element of {append: input.<field>} over a List<Optional<T>>, as generated Rust and Go already append None and nil. Synthesis expects that null in the view row.
• Before, the interpreted target refused the command as unsupported.
• An element over a list of required elements is unchanged.

Binding refusal scenarios compare event identities​

• A synthesized binding refusal scenario covers a refusal the binding's policy drops, escalates or retries a bounded number of times. It now compares the identity fields of the trigger's event with the instances its invocation was sent, as the other binding scenarios do since 0.82.0.
• It also compares them with each id the invocation was sent as a literal for a field of an entity's identity type, such as the id a trigger naming no related row is sent. That holds where it sends another publisher of the event, or a trigger naming a row arranged so the predicate refuses it.
• Before, it expected that event by shape alone, so a target publishing a wrong id there passed.
• The suite bytes of seven fixture models move; the changelog names them.

A row set beside named rows, on every refusal order​

• A command guarding on a row set beside rows its input names (ess/32) is witnessed on every refusal order.
• A refusal over a named row that also carries a when: is held beside the row set's rows with a send that holds that when:. Where the when: equates two inputs, that send names one row twice. Where no such send stands, the refusal is witnessed on its related row alone, so its row-set branch is no longer refused.
• A row-set refusal is held beside a later refusal whose when: compares the named rows. Where only a creator sent one row twice lays the selected row, that is how it is laid.
• A forall on the accepting branch is held on a selected row the forall passes, and its default refusal on a selected row naming the send's own rows. A target refusing on any selected row now fails, at ess/31 too.

No-view input refusals tell the record's state apart​

• These are input refusals on a command that addresses an existing record, on a model where no identity view shows the row.
• The arranged half of such a refusal tells the arranged state apart from every other state. Where the first branch addressing the record from that state also runs from other states, the scenario sends the shortest sequence a bounded search finds that does tell them apart. Where the bound stops the search first, that sequence is extended one send at a time past it. It is drawn from the command's branches and from other commands whose input names only that record, with a wrong_state: refusal among the answers. A free-text input beside the identity names no record.
• A refusal beside held-state branches reads the record back after each held-state send, through sends from that state that tell it apart from every other state. The command's own branches come first, its held-state refusals among them.
• A target that moves the record on refusal and publishes nothing now fails both. Before, they required only the error and no event, and such a target passed.
• Where the sends tried leave states untold, the scenario is withdrawn and refused as ESS-SYNTH-001, naming the states left. Where no send has a valid input, it names every branch tried.
• A model with an identity view keeps its suite bytes. The test model occurrence-clock-offers.yaml, which has none, moves its suite bytes: its AcceptOffer/outcome/malformed scenario reads the offer back in each of its three states, with its scenario count and refusals unchanged.

Binding scenarios compare event identities​

• Synthesized binding scenarios compare the identity fields of the trigger's event with the instances its invocation was sent, or with the row it acts on. That covers flow, mapping, delivery, on-failure, a bounded retry's attempts and final failure, an unbounded retry selected per refusal, and a condition's negative witnesses.
• The comparison also holds where the binding arranges a row before it, as command scenarios have done since beyond10x/ess#273.
• A target that publishes another identity in the event now fails these scenarios. Before, it passed them.
• A model whose binding triggers carry no captured instance into their event keeps its suite bytes.

The arranged half of a refusal probes the record​

• This is the arranged half of an input refusal, on a command that addresses an existing record, where no identity view shows the arranged row. After the refused send, the scenario sends a valid input for that record. That input belongs to the first branch that addresses the record from the state it was arranged in, and the scenario requires that branch to answer.
• A target that moves the record out of every state that branch runs from on refusal, or otherwise changes what it answers, and publishes nothing, now fails. Before, the scenario required only the error and no event, and such a target passed. A move between two states that branch runs from is still not seen.
• Where no such branch has a valid send, the scenario is withdrawn and refused as ESS-SYNTH-001, naming the branches tried (beyond10x/ess#209).
• A model with an identity view keeps its suite bytes.

Validation names the file​

• ess specify validate on a specification of several files names the file a refusal was read from. Before, it named <document> whenever the refused declaration's name was written in more than one file, as a name declared in two files is.
• A refusal made while a file is read is cited in that file. One checked after assembly is cited in the file of the copy assembly kept, which is the second when the first does not convert. A name written twice in one file names the file and no line.
• The library's Specification::assemble_traced and resolve::diagnose_traced return and read that record; diagnose_locating is unchanged.

Generated types​

• An Optional<Binary64> field declared presence: null_when_absent or omitted_or_null is realized as Rust and Go, in a declared struct and in a command's input or response root. Its Binary64 location is the number member of the field's anyOf [number, null]; before, it was the property, and realization was refused as model_binary64_layout.
• The TypeScript report names its model_binary64 obligation at that member.
• --root <command>.response on a command that declares no response is refused as unknown_root, naming the command and saying it declares no response, as --all-commands leaves it out. Before, it generated an empty object type.

Name aliases in the published schema​

• schemas/generated/ess.schema.json admits a binding's name written id: and a component's written component:, the aliases the parser already reads, each with the same charset as name:. Before, it refused every document that spelt a name that way.
• Writing both spellings, or neither, is refused, as the parser refuses it. Parsing is unchanged.

Synthesis​

• A when_related: branch is no longer sent for a related row that only a step setting off a binding selects, where that binding's command writes a field or the state the guard reads, or removes the row. Such a row is passed over for one no binding rewrites; where none is found, the branch is refused as ESS-SYNTH-003 naming the step, the binding and the command it invokes.
• A when_related: command whose input is chosen for an external branch, where the precedence plan reads the related row's exists: false before the addressed row's existence or held state, sends its unknown-identity scenario and its held-state refusals beside a present related row. Before, it sent a reference no row carries and the target answered exists: false instead of the refusal.
• A model with such a command and no wrong_state: moves its suite bytes: its held-state refusals now name a present row, so the held state is what refuses them. Every other model keeps its bytes.
• A wrong-state scenario of a command reading stored fields is sent to a row its moving branch's own when_subject: holds on, and to a row holding a value in every field a sibling's stored guard reads, so no absent field stops selection before the wrong-state answer. Where no reachable row serves, the scenario is refused as ESS-SYNTH-003 naming the guard.
• A model whose bindings write nothing a related guard reads keeps its suite bytes.

Generated types for an HTTP binding​

• ess generate types takes --http <binding> (and --refines), compiled as ess generate --kind openapi --http compiles it (beyond10x/ess#656).
• Under it each <command>.input is the request body the bound OpenAPI document publishes, without the fields its route carries in the path, so the Rust, Go and TypeScript types decode that body.
• A command whose route publishes no body (encoded query, or every field in the path) has no input root: --root <command>.input is refused as unpublished_body, naming the command and why, and --all-commands leaves it out.
• Responses and view rows are unchanged, and without --http every generated file keeps its bytes.

Short names for every command and view​

• ess generate types --names short combines with --all-commands and --all-views (beyond10x/ess#409).
• A command's input or response and a view's row are named by their owner's last segment and the member: demo.notes.Create.input is CreateInput and demo.notes.ByOwner.row is ByOwnerRow. Before, every input shortened to Input and every row to Row, and two commands or views were refused as short_name_collision.
• Declared type and event short names are unchanged, and two commands of one name in two domains are still refused, naming both.

Input-type rules in Entity Runtime​

• Entity Runtime lowering no longer drops the invariants: and prefix: of a command input's type unless every accepting branch stores the input in a field of that type.
• An update holds them as operation preconditions over $args.input.<field>, lowered as a guard is, so an ordering over a Timestamp becomes before/after.
• A creation, which has no precondition in entity-core, and an ordering over text, which entity-core cannot decide, are refused as InputInvariantUnsupported, naming the input.

Synthesis fix​

• A when: guard on the identity input of a row a branch is sent for, below a non-creating unknown_instance: or on the subject the branch acts on, is decided on the identity of the row the scenario arranges, a compound guard by its identity parts (beyond10x/ess#645, beyond10x/ess#693).
• The row's creator is steered onto an identity that keeps the branch; where none does, the branch is refused as ESS-SYNTH-003 naming the guard. Before, the scenario was sent a row of another identity and the target answered another branch.
• A related row's boundary run that would create a second row under such an identity gives way to the next branch answering there, where the whole scenario was refused as ESS-SYNTH-001.
• A boundary run that sends such an identity input another value, or follows a branch that deleted the row, is sent a row of that identity, or is refused naming the guard and not sent. Before, it was sent an identity no row carries and the target answered unknown.

Nested-member claims​

• From ess-scenario/6 a claim in an act's response:, an event's payload:, an error's fields: or a row may name one member of a nested value by its dotted path, checkpoint.checkpoint_id: cp-1, under one rule on all four surfaces: a field is claimed whole or by its paths, not both.
• A response path is carried by ess-conformance/62 and /63; event, error and row paths compile to dotted keys older suites already read, so those suites keep their format.
• A partial nested literal in a response: is refused as ESS-AUTHOR-014, naming each member it leaves out at its path.

Binary64 through a conformance suite​

• A model that reaches a Binary64 in an entity's fields, a command's input or response, an event's or error's fields, or a view now synthesizes, authors and runs a suite at ess-conformance/62 (coverage /63).
• Rust, Go and TypeScript compare it by its nearest binary64 under IEEE equality (-0 equals 0); a token with no finite image, such as 1e400, is refused by name. An authored Binary64 literal of magnitude 2^53 or more is refused as ESS-AUTHOR-015, because view and event assertions compare an integer token exactly.
• A Binary64 reached through an entity identity, a view parameter, an actor attribute, a binding or a conversion is still refused (ESS-AUTHOR-036).

Authored inputs meet their type​

• From ess-scenario/6 an act's literal input that its declared type refuses, at any depth and beside an $instance reference, is refused as ESS-AUTHOR-015 at its member path.
• A refusal guard that only out-of-type inputs meet is refused as ESS-SYNTH-003, naming the field, the type and the constraint.

Synthesis fixes​

• Both branches of a != or == guard that compares an input with its own example: are written, for text, Uuid, Timestamp, Duration and Bytes, and for a struct member a structured example reaches.
• An input-guarded refusal beside exhaustive held-state branches, and the byte-length children of an any over alphabet-bounded texts, are witnessed where they were refused.
• An accepting branch read after unknown_instance: is arranged with its row stored first; guards on related identities, parent rows and cascades get the rows they read.
• An authored scenario that repeats a key in a mapping is refused as ESS-AUTHOR-047.

Structured input examples​

• An input typed as a struct (open or closed), a Map<…> or Json, through any newtype or Optional, may carry an example:. Synthesis sends it at the plain instance; a struct example reaches synthesis through its declared members, so a guard reading one keeps the scenario that refutes it.
• An open struct's example keeps the members it does not declare, and the interpreted target now admits those members in a command input at every format.

Rows a deployment provides​

• An entity may declare provided: true: the deployment holds its rows, and no command of the specification need create one.
• Where a when_related: {via: input.<field>} guard reads such a row and no declared outcome creates it, the scenario resolves an entity fixture {name, type, entity, state} before it runs (suite formats ess-conformance/60 and /61). The interpreted target creates the row; the Go and TypeScript runtimes pass the entity and state to their fixture provider.
• fixture_inputs: is refused over every input a guard reads, including the identity a related-row guard reads.

Lifecycle summaries​

• A transition may carry a one-line summary:, and a state may carry one in its mapping form, {name, wire?, summary?}. ess verify diff reports a moved transition summary as transition-summary-changed (ess-diff/22), compatible.
• A flat summary:, wire:, display: or code: on a named type is refused with a message naming naming: {summary: …}.

HTTP bindings​

• A route may declare alike: groups of outcomes whose answers are equal, so two outcomes share a status and a body instead of being refused as indistinguishable; OpenAPI writes one response naming every member (#652).
• An outcome may answer a String field as text/plain with encoding: text. A route may declare its own refusals:, a literal or empty body for empty, and body: array for a view that is not paged (#673).

Import and generated types​

• OpenAPI import admits open objects, the empty and true schemas as JSON values, and a nullable anyOf/oneOf pair as an optional value (#647).
• ess generate schema types-bundle --integer-format-widths realizes int32 and int64 at native width (#648).
• ess generate types --declared-field-order keeps the order the specification declares, and --rust-box-only-recursion boxes only the references that close a cycle (#661). Without these options the output keeps its bytes.
• Rust and web synthesis accept a response field that shares a name with an input field (#659).

Validation and mutation​

• ess specify validate refuses a when: branch whose input guard implies the guard of an input-guarded refusal answered before it, as unreachable_branch (#702). Before, only synthesis reported it.
• ess verify conform mutate scores a precedence swap of two guards no input selects together as equivalent, also for wide enums, membership lists and disjunctions (#703).

Since 0.70.0​

• 0.76.0: schemas publish entity invariants and Binary64, text length and distinct-list bounds as keywords; a defined / not defined pair of branches is exhaustive without a default; ess-composition/5 compares events, commands, constraints and variant attributes; HTTP bindings name operation ids and servers.
• 0.75.0: the workspace builds on its declared minimum Rust version again, and seeded synthesis explains the seeds it cannot use.
• 0.74.0: seeds are admitted for models whose actors declare caller attributes.
• 0.71.0 to 0.73.0: synthesis covers more set updates, deletes, bindings and related-row guards that it refused before.

Rows the input names, beside a row set​

From ess/32 one command may guard on rows its input names, when_related: {via: input.<field>, …}, beside a row-set guard, when_related: {entity, where, …}. "Connect two ports that exist and face the right way, unless a wire already leaves the source" is one command. A missing named row answers first, then every refusal over a present named row or a row set in declaration order, then the accepting branches (#554).

More in ess/32​

• A struct may declare fields: [], open or closed (#649).
• A lifecycle state may declare its wire spelling, states: [{name: Indexing, wire: indexing}], and two variants of one enum spelled alike on the wire are refused (#639).

Conformance and generated code​

• ess verify conform synthesize no longer stops with InvalidReplay at ess/26 and later.
• A view may publish a Decimal, compared by value; such a suite is ess-conformance/58 or /59.
• A create-or-update command beside a related-row refusal gets a scenario for every branch (#641).
• The synthesized Rust server decodes published events and returns the events a call published.
• A variant's code: names its generated identifier, and a dotted label such as call.started synthesizes (#662).
• ess generate types --check compares what it would write with --out (#654).

Values computed by typed expressions​

From ess/27 a value in sets:, an event's payload: or an error's payload: may be computed by an expression, {expr: "<expression>"}, and a view field may be computed from its source row, such as expr: "ended_at - started_at". Arithmetic over Integer and Decimal is exact, / is an Optional<Decimal> that is absent at a zero divisor, round rounds a quotient once, and Timestamp - Timestamp is a Duration. Synthesis runs the branch again on inputs worth checking the figure on: a zero divisor and a rounding tie either way (#560).

A guard may read a fact through a digest or encoding function: challenge != base64url(sha256(ascii(input.verifier))) states a PKCE S256 check as a held-row predicate (#584).

One precedence order​

Under ess/27 a branch answers in the order of what it must read: the request alone, then whether the addressed record exists, then what it holds, then the rows around it, then the accepting branches (#554). Every guard pair once refused for want of an order now validates, such as when_related: beside when_subject: or wrong_state: (#282).

More in ess/27​

• shorthand: <field> on a struct type lets a value be written as that one field (#594).
• An each: entry of affects: may move or delete the row each element names (#596).
• A binding condition may compare a Boolean leaf with true or false.

Conformance​

• ess verify conform diff --from <suite> --to <suite> says which scenarios two suites add, remove and change, and --format json writes an ess-suite-diff/1 document (#572).
• ess verify conform synthesize --check compares what it would write with what is committed (#571).
• Suites ess-conformance/52 and /53 state the event catalog once at the root instead of in every scenario, check a value type's invariants inside a view's lists, maps, optionals and unions, and await a command the system issues itself (#570, #542).

An authored act states its caller​

An act in an ess-scenario/5 document states the caller its command is sent as, under caller:. Each attribute value is a literal of its declared type, or {$instance: name} for an instance arranged with setup:. A command that records {caller: account_id} now runs from an authored scenario on the interpreted target and the generated Go and TypeScript runners.

• ess verify conform author refuses an attribute the act's actor: does not declare (ESS-AUTHOR-013), a required attribute the command reads that the act leaves unstated (ESS-AUTHOR-014), and an instance captured at run time (ESS-AUTHOR-015), naming the attribute and the command.
• An act with no caller: sends none, and its suite keeps its bytes. ess-scenario/1 to /4 refuse the key.
• A suite step that reaches a caller attribute nothing supplied is still unsupported, now with a reason naming the attribute and caller:.

Synthesis​

• A command whose branches a stored field of its subject selects (when_subject:) gets its scenarios even when no view observes that field; synthesis used to refuse each with ESS-SYNTH-001. A model with an immediate view covering the guarded fields keeps its suite byte for byte (#496).
• A when_related: guard that reads a member of a struct input is decided against the key the subject was created under, where it used to choose a row against a key the search made up. A struct sent as a literal keeps its scenarios byte for byte (#521).

A CLI result carries JSON as JSON​

A CLI result field may now be typed Json, alone or under Optional, List or a String-keyed Map. The generated adapter writes the value as JSON, so a caller parses the answer once instead of decoding JSON text out of a JSON answer.

• The result check accepts any JSON value in that field and refuses a reply outside the declared shape as cli_result.
• A Json input field is refused: an argv word has no JSON spelling a binding declares. A Json error field is refused too.
• Generated CLI packages carry new src/wire.rs bytes, so ess generate cli --check reports drift until they are regenerated (beyond10x/ess#468).

An optional generated value comes from the implementation​

{generated: true} on a value of type Optional<T> used to be filled absent every time. From 0.55.0 the generated Rust and Go behaviours read it from a context port that answers an optional T, so a value that is absent only when there is nothing to report can reach the event.

• The port is generate_optional_<t> returning Option<T> in Rust and GenerateOptional<T> returning *T in Go. A context that implements the port adds the method; the generated demonstration context answers it absent.
• A field nothing sets stays absent and asks no port (beyond10x/ess#467).

Branches selected by whether the record exists​

A command with an existing_instance: refusal beside a creation, or a creating unknown_instance: branch beside an update, needs to know whether the record is already stored. Until now the generated Rust server owed such a command as an obligation. From 0.51.0 it looks the input identity up in the storage port before dispatch and selects the branch itself.

• A command whose lookup would not match its creations (another entity, another input field, an identity that is not an input) stays an obligation.
• Go, Web and Clap still refuse both forms by name.
• If your realization implemented one of these commands' …Behavior obligation, Generated<P> now runs the generated behaviour and no longer forwards that command to it (beyond10x/ess#310).

Committed output regenerates in another checkout​

Generated output committed with its .ess-output now regenerates in a clone, a second worktree or CI, under any umask, when its owned files still have their recorded bytes:

• a regeneration that changes nothing leaves state.json byte-identical, and the first one that writes records the new root;
• a state carried without matching files refuses, lists them, and prints the steps to re-enroll with ess generate output adopt;
• a root replaced by a copy mid-transaction refuses recovery there (beyond10x/ess#306).

Aggregates over a when_related-guarded creator​

Until now, an aggregate view over rows created by a command with a when_related guard was refused with ESS-SYNTH-017: synthesis could not create the rows the view counts, because each needed a related row the guard would accept. From 0.50.0 the view gets its <view>/aggregate scenario:

• each row's related row is arranged first, and rows given one value of the guard's input share it;
• every input a guard predicate compares with the related row's owner link names an owner that is arranged too;
• a group key read from a related row's owner link holds one owner per value, so a target that groups under the wrong owner fails.

Where a row still cannot be arranged, the refusal names the reason (beyond10x/ess#272).

Served surfaces enforce actor grants​

In a specification that declares actors, the generated server's dispatch and handle (Rust) and dispatch (Go) take the caller your realization authenticated the request as, and serve / Serve<Component> take an authenticate function that returns it. admit (Rust) and Admit (Go) expose the check on its own.

Before a command runs, a request with no caller, or with an actor the specification does not grant the command, gets 403 {"refused": "not granted", "actor": <name or null>}. A command no actor is granted is refused to every caller; views are not grant-checked. The OpenAPI contract of a served component declares the refusal on every command.

For served components the synthesized suite adds <command>/grant/denied, which borrows a scenario whose send the command accepts and requires that the target's event log grows by nothing, and <command>/grant/admitted/<actor> where a granted actor would otherwise never send its command. Authored scenarios can expect the refusal with refused: not_granted. How a request proves its actor stays the realization's job.

A related row's state in when_related​

From ess/20, a when_related predicate may read the related row's held lifecycle state as state, as a when_subject predicate reads the subject's: when_related: {via: input.candidate, predicate: state != Accepted}. Earlier formats refuse the path with unsupported_format_version naming ess/20. Synthesis arranges a related row of an entity already being arranged one level deep, in its initial state; suites for earlier formats are unchanged.

Synthesis and diff fixes​

• A value copied from a related row through the input a when_related guard reads gets its success scenario, between other accepted rows, so a target copying from the wrong one fails.
• An aggregate view grouped by a key copied from a related row gets its <view>/aggregate scenario.
• A when_related guard over the via field of an owns relation is witnessed on both sides.
• A scenario sending a command that reads the caller also runs with the callers swapped and a fresh caller-supplied identity.
• A branch with a when: beside a when_subject: gets its scenarios when a later sibling shares its when:.
• ess verify diff reports a declaration added or removed on one side only as that addition or removal, not unclassified-changed.

UI tests by node path​

An ess-ui-test/1 file tests an ess-ui/1 document. Each step is one line: open a page, select a node by its canonical node path (a row by its key), type, choose, act, page, expect text, rows or a section's state, play a live event, advance time, or expect a command with given input. A test can replace the document's fixtures.

ess ui test --path <document> <tests…> runs the tests headless against the terminal renderer and writes ess-ui-test-report/1. --playwright <out> writes a Playwright spec for the generated React project from the same file; it selects [data-ui-path], and a step the terminal cannot check is test.fixme in the spec with the same reason, so one file has one verdict. The reference compares the language with selector-based browser tests.

Reports from an outside runner​

ess verify conform report --suite <suite> --results <results.json> --implementation <name> --report-out <path> writes an ess-conformance-report/2 from the per-scenario results of a runner written in any language. Coverage, the suite reference and policy come from ESS's own admission of the suite; the producer profile, external-scenario-status/1, says ESS executed nothing. aep 0.66.0 records such a report as evidence.

A served 501 says whether the effect was committed​

Every served 501 body carries committed: false for an unmet obligation, where nothing was written, and true when the command took effect and delivering what it published failed. Rust shells see the second case as Refused::Undelivered.

Also​

• ess ui check --model <dir> reads the specification through the directory's ess-inputs.yaml.
• An ess that delegates to a pinned release says so on stderr for every command (ESS_TOOLCHAIN_QUIET=1 silences it).

UI documents​

An ess-ui/1 document describes an application's shells, pages, sections, widgets, reads, commands, live channels and where each piece of state is held, without naming a renderer. Its schema is data, schemas/ui/ess-ui.schema.yaml, and the reference is rendered from it by ess ui docs.

• ess ui load --path <document> loads a document and prints how many pages and addressed nodes it holds, or names the node that refuses it.
• ess ui check --path <document> [--model <specification>] runs every check the schema declares and, with a model, checks that each view, command and event the document names exists and that some actor may read each section. Each finding names its canonical node path; any error exits 1.
• ess ui run --tui --path <document> runs the document in the terminal, answering reads from its fixtures and playing live events from a fixture script.
• ess generate ui --target react writes a Vite + React + TypeScript project.

examples/partner-portal/ is a complete document to start from.

Generated servers answer with what a command published​

A served command's answer now lists published: the events it emitted, in emit order, each as {event, payload}. The OpenAPI contract types the list item by item. SystemEvent::name and wire::encode_system_event name and encode any system event, so a runner needs no hand-kept table. Request.headers keeps the request's headers in arrival order; a shell that builds a Request literal must add the field.

Delivery is tracked per binding. A binding whose obligation is unmet holds the event in its own list and tries again on a later pump; every other binding receives the event once, and an at_most_once binding is never delivered twice. A command whose effect is committed but whose events could not be delivered is answered 501, now declared on every command, and must not be retried. The generated Go server serialises dispatch, so concurrent requests are safe.

Fixed​

ess verify diff no longer reports unclassified-changed beside an added or regrouped aggregate view (beyond10x/ess#256).

Instance references inside structured values​

{$instance: …} may now sit inside a list, a map value, a struct member or a union payload of an authored step, at any depth, wherever the declared type at that position is the instance's identity type. ring_sequence: [{$instance: a}, {$instance: b}] is accepted for a list of identities, so a command taking several identities can be authored. A reference at a position of another type is refused as ESS-AUTHOR-022, naming the position, such as labels[1] or pair.note. Inside an event payload or an error it is refused as ESS-AUTHOR-021.

A suite that carries such a value is written as ess-conformance/32, or /33 with coverage. The Rust runner resolves it; Go and TypeScript generation refuse such a suite and name the Rust runner.

An external answer the act does not state​

An authored act that names an external: branch under outcome: now tells the target which answer to give for that one call, as a synthesized scenario does. Before, no target could satisfy the act reliably.

An act whose error, response or event claims hold only on an external: answer it does not state is refused with ESS-AUTHOR-037, which names every such branch as command/branch. That includes answers reached through a binding's call to another command, which an act cannot state; those claims are left to synthesis.

One order for refusals​

A refusal guarded only by the input may sit beside branches that depend on the record's held state, so "this value is refused whatever the record's state" can be written on a command that acts on an existing record. One order now answers every command: a related row's existence checks; then refusals guarded by the input, first declared first; then the existence of the addressed row; then the held state; then accepting and external branches in declaration order. The interpreter, synthesis and the seeded explorer in the Go and TypeScript packages all follow it, as Entity Runtime does, so a target that refuses a bad input in any state no longer disagrees with the explorer.

Synthesis​

Synthesis now witnesses several guards it refused before with ESS-SYNTH-003:

• a guard over an optional field the creating command leaves absent, read as absent until a later command sets it;
• exists and forall over a stored map's values, and over a stored list compared with an input, on rows that hold several entries, so a target reading only the first or last entry fails;
• invariants over the members of a struct input, which every input synthesis sends now meets;
• equality between one input and a member of another.

Mutants no scenario could kill​

A guard mutant that leaves its outcome's guard satisfied by no input is equivalent (ESS-MUTATE-005) and names the guard it left dead. A mutant on an outcome whose scenario the baseline already refused at synthesis is unwitnessed and names that refusal. Neither is scored survived any more.

Overlapping guards​

Of two accepting guarded branches that both hold, the first declared answers; input-guarded refusals are still taken first, and an external: branch takes its place in the same order. The interpreter answers this way, and synthesis sends each overlap and requires the first branch.

Synthesis​

Synthesis witnesses a guard comparing a link field with an input, and a branch selected by a stored counter at its limit, each side of it, so an off-by-one limit fails. A suite from a model whose actors declare attributes: records that model's digests.

Relations and deltas​

via: may name the entity's own identity, a one-to-one link keyed by the same id. ess verify diff names a newtype's prefix: added, removed or changed.