0.85.0

Every witness reads back its effect, and the mutation audit covers grants and lists its gaps.
3 added, 3 changed, 10 fixed.

Changed

• Format ess/34: a compensating refusal (compensates: true beside external:) may delete its addressed row with deletes: and instance:; the interpreted target removes the row and answers the error, and its scenario requires the error, no event and the row absent from every immediate view. Below ess/34 the delete keeps its refusal_mutated_state, now naming ess/34; from ess/34 the missing_declaration of a compensation declaring no change names deletes: in its message and hint. From ess/34 a named when: or when_related: refusal of a command addressing an existing row snapshots that row completely and requires it unchanged; below it suites keep their bytes. At every format, a further witness of a deleting branch (a conjunct of a compound guard's complement) requires the deleted row absent instead of present (#581, #585, #587; story:every-witness-reads-back-its-outcome-effect).
• ess verify conform mutate lists each site a selected class excluded or left without a live mutant, with its reason, under unmutated_sites in the report (ess-mutation-report/8) and the manifest (ess-mutation-manifest/7), and as unmutated <id> (<reason>): … lines beside the stillborn mutants. The summary line gives ; S of N site(s) scored. transition-to takes the first other state the model admits, or lists the transition as no_admissible_state. sets-retarget retargets a creating or Optional write that has no sibling input of its type to a literal, or lists it as unobserved_field where nothing in the model reads the field, so no target could tell the literal apart. Where the selected classes find only unmutated sites, the ESS-MUTATE-003 refusal prints each one. --fail-on-unmutated makes such a site, or a stillborn mutant, block exit 0. The default exit status is unchanged, and a report or manifest that lists no such site keeps its format and bytes (story:the-mutation-audit-reports-the-sites-it-could-not-mutate).
• ess verify conform mutate audits actor grants with two new classes, grant-drop (one command removed from one actor's may:) and grant-add (one served command added to an actor that lacks it). Where either is selected, which the default selection does, the baseline and every mutant's suite keep their <command>/grant/denied scenarios, a grant-drop mutant's refusal is sent as the actor that lost the grant, and a grant-add mutant's suite sends the command as the actor that gained it, also where an actor carrying attributes holds it. A grant of the system actor (system_actor) or of a command nothing serves (command_not_served), and a grant-add no scenario can be sent for (attributed_holder), is listed as an unmutated site. A grant mutant takes ess-mutation-manifest/7 and ess-mutation-report/8. A selection without a grant class keeps its baseline, its bytes and its ids (story:the-mutation-audit-covers-actor-grants).
• The precedence section of docs/design/cross-record-and-stored-field-guards.md states how an input refusal and an unknown_instance: or exists: false branch are ordered in each format: the input refusal answers first from ess/27, ess/29 refuses either declared above it naming both and the order, and below ess/29 either order validates. No behaviour changes. Validation and the interpreter already agreed, and so did both explorers on the unknown_instance: pair; they leave a when_related: command out. Tests now pin it (story:unknown-instance-and-input-guard-agree-on-order).
• The scenario of a non-refusing unknown_instance: branch reads every immediate view of the addressed entity afterwards and requires no row with the identity it sent, so a no-op that stores a row fails; where no such view exists a note names the scenario and the entity. ESS-COMMAND-005 for an instance: without an effect now names deletes among the effects, and its hint names deletes: and unknown_instance: true, refuses: false (story:a-delete-may-have-a-no-op-branch-that-emits-nothing).
• CI: the test archives are built with their symbol tables stripped, about a quarter smaller, and each archive download attempt may take 40 minutes instead of 30, so a shard on a slow runner gets its archive.
• The generated explorer (Go and TypeScript) no longer expects an arranged external: branch where a branch the stored row selects (its held state, or a predicate over its fields) holds. The interpreter answers the held state first, as the precedence order does, so a target in that order failed exploration naming the external branch (story:explorer-and-interpreter-agree-on-external-cause-for-stored-record).
• 9 more in the changelog.

Every change: CHANGELOG.md § 0.85.0