0.19.0

Changed

• Rust/Web workspace emitters and synthesis facades now return checked Result
  values. Complete ess-target-failure/1 refusals carry the neutral plan and
  source-located causes before any artifacts are written. Callers must handle the
  fallible API; successful plans and generated bytes retain their contract.
• Sliced provenance uses the explicit slice-sha256/2: digest profile. Regenerate
  older sliced artifacts when adopting this release. Semantic diff/impact now
  accounts for previously omitted constructs, served views and reusable row shapes.

Added

• Source-pinned normalization library with strict ess-normalization/1 recipes,
  explicit external dispatch, ordered input/output schema boundaries, separate
  missing/null behavior, lazy choices, case-sensitive string-prefix selection,
  signed-integer overflow policies, collection
  mapping and distinct-category counts. Every branch checks before reference execution.
  schema normalize-check checks and canonicalizes recipes; schema normalize-run
  executes an explicit branch without overwriting any input. The JSON text boundary
  refuses duplicate keys and numbers that cannot round-trip without precision loss.
  The Rust library API also emits standalone normalization crates with an
  ess-normalization-target/1 provenance report. Go/TypeScript normalization targets
  and a target-generation CLI remain pending; structural libraries are not application decoders.

• Complete JSON Schema document-root import (schema import-document), preserving
  the root record, local definition closure and original source locations through
  validation and all three data targets. Explicit ess-schema-bundle/2 root identity
  is replay-checked; component-bundle /1 bytes remain unchanged. Conflicting root
  names, incompatible dialects and unsupported resource references refuse.

• Direct ESS-model data realization (generate types) with explicit qualified roots
  or all-type selection. Reuses the existing schema wire mapping and shared native/TS
  targets, refuses wire-key collisions and records model versus bundle input provenance
  in ess-types-report/3. Model invariants, map-key validation and TypeScript nominal
  identity limitations remain explicit obligations, not silently claimed behavior.

• Root-selected structural type planning over checked schema bundles and accounted
  Go, Rust and TypeScript data-only targets (schema types-bundle). Requiredness, nullable values,
  reference siblings, open objects and prefix tuples retain explicit shape, source
  provenance and runtime obligations. Native packages include presence-aware JSON
  codecs, exact number retention and explicit package/module identity in the versioned
  target report. Application decoder semantics remain separate from these structural targets.

• Qualified schema-only component import with explicit JSON Schema 2020-12 interpretation,
  source-byte retention, complete local reference closure and persisted replay checks.
  schema import-bundle, project-bundle and validate-bundle do not fabricate a service,
  apply decoder defaults or silently accept unsupported schema semantics.

• Authored site pages resolve links against explicitly included source documents and
  --asset UTF-8 downloads. --front-page preserves an override's source location;
  --strict-links refuses unpublished local targets with source-line diagnostics
  before output is written. Downloads share the existing output containment checks.

• A source-backed format/digest catalogue and historical maturity outlook, together
  with preserved configuration and invariant planning from older worktrees.

Fixed

• CI explicitly provisions the WASM compiler target required by generated-workspace
  feasibility checks, including the shared release gate.

• Kubernetes imports reject malformed Secret shapes and redact failed subprocess
  diagnostics before credential-bearing values reach output.

• CLI generation preflights complete destination sets, including composed outputs,
  to reject containment and alias collisions before writes.

• Persisted delivery documents and standalone conformance reports validate claims
  through generic deserialization as well as explicit readers. Existing conformance
  formats remain current; the successor coverage formats are designs, not shipped APIs.

• Checked infrastructure model transformations preserve owning handles and resolved
  reference membership. TypeScript projection checks one final binding namespace.

• Rust/Web feasibility checks reject generated name, path, recursive layout and
  incompatible binding representations. Web dependency-module and outcome-arm
  buffer/encoder collisions are checked in their actual scopes; legal names elsewhere
  remain valid. Delivery-arm checks also account for the actual ordering of local
  bindings without rejecting legal first-input transformations. Web workspaces with
  no published events emit a valid empty event log. Supported Integer, Boolean and
  Bytes map-key decoders borrow nested diagnostic paths correctly in HTTP/Web output.

• Specification validation refuses colliding effective wire field names across structs,
  entity identity/state/fields, command inputs, event/error payloads, view rows and
  separate view parameters before any projection can silently overwrite a property.

• Long unbroken identifiers in authored prose wrap within narrow site viewports,
  including links and emphasized text; code listings retain horizontal scrolling.

• Authored Markdown mermaid fences in generated HTML sites now use the bundled
  diagram renderer, just like generated diagrams. Other fenced code remains a
  listing, and diagram source remains escaped and readable without JavaScript.