0.51.0

Added

• ess_ui::binding: the route table between an ess-ui/1 document and the HTTP surface ESS
  synthesizes, built by ess_ui_check::binding(document, sources) from ess_gen::http::routes
  for what the document names. It refuses by node path a name no network component serves, a
  non-scalar view parameter, a paged view, and state held in server or server_session.
  ess_ui::binding::classify(status, body) reads a served command's answer (Accepted, Refused,
  NotGranted, Malformed, Unfinished, Transport); its cases are recorded from the gatepass Rust and
  Go servers in crates/ui/ess-ui/tests/vectors/answers.json. ess ui check --model reports
  read_params: a read binding a parameter the view does not declare, and a required parameter
  left unbound (#311).

Changed

• Breaking for a generated React project: ess generate ui --target react emits a plain React
  project. Its only runtime dependencies are react and react-dom; react-router, Vite and
  @vitejs/plugin-react are gone. Routing is a generated runtime/router.tsx over the History API
  (Link, Redirect, Outlet, useLocation, useNavigate, useSearchParams with
  react-router's signatures), and routes.ts gains matchPage. dev, build and preview run
  esbuild 0.28 (tsc --noEmit stays the checker), serve on 127.0.0.1 and keep serving without
  stdin; index.html moves to www/. Aliases written as paths and aliases with encoded segments
  route as before, and the image primitive type-checks against @types/react 19.3
  (#315).
• Breaking for a Rust realization that implemented such a command's …Behavior obligation:
  generated Rust servers select an existing_instance: refusal beside a creation, and a creating
  unknown_instance: branch beside an update, by looking the input identity up in the storage
  port before dispatch. Generated<P> now runs that command's behaviour and no longer forwards it
  to P. A command whose lookup would not match its creations stays an obligation. Go, Web and
  Clap still refuse both forms by name (#310).

Fixed

• Generated output committed with its .ess-output regenerates in another checkout (a clone, a
  second worktree, CI, any umask) when its owned files still have their recorded bytes. A
  regeneration that changes nothing leaves state.json byte-identical, and the first one that
  writes records the new root. A state carried without matching files refuses, lists them, and
  prints the steps to re-enroll with ess generate output adopt. A root replaced by a copy
  mid-transaction refuses recovery there (#306).
• Synthesis is no longer slowed by commands that read the caller: each such command cost two whole
  syntheses, and now costs one focused run; witness searches are answered once per model. One
  downstream specification goes from 151 s to 6 s with byte-identical suites (#301).
• An entity whose identity type has one value (a one-variant enum, or a newtype whose invariants
  admit one value) synthesizes as a singleton: existence scenarios use the one row, a second
  create is witnessed as existing_instance, decoys are left out, rows that reference it share it,
  and a command acting on it is sent by a second caller (#287).
• Synthesis no longer sends an optional input a boundary row leaves out, so a scenario can no
  longer require an accepting branch for an input that an enum-and-presence refusal claims; a step
  whose input an earlier branch takes is withdrawn and refused as ESS-SYNTH-019
  (#280).
• A suite is admitted with every number it was written with: a value just below 2^53 (an
  invariant bound such as 9007199254740991) was read back one lower, so the scenario at that bound
  failed a correct target (#251).
• Inside nested quantifiers, a binder on the right of a comparison is the binder, not a text
  literal; a quoted or shorthand word naming a binder is refused (#289).
• ess-cli/1 callables may declare invalid_input: <code>, naming one of their declared errors:
  a typed shape failure, or an unparsable, empty or rejected dynamic payload, then answers that
  code with {} data and exit 2. A dynamic payload repeating a key is refused before the
  validator runs (#274).