chore(deps)(deps): bump zod from 3.25.76 to 4.3.5 - #27

…nchors (#13556) (#14277)

* docs(adr): migrate rotted line anchors to resolver-gated symbol anchors (#13556)

The #13556 census enumerated every line anchor in `docs/adr/**` — 343 across
35 of the 134 records, plus 52 continuation anchors — and resolved each against
main. Excluding 4 HISTORICAL and 2 EXTERNAL, 243 of 337 live anchors were
broken: 72.1%, declared as a one-way LOWER bound. Rot tracked target-file CHURN
rather than record age: the four hottest targets were 100% broken across 50
anchors. A rotted line anchor does not fail — it silently points a reader at
unrelated code inside the document whose purpose is to be a durable record.

Maintainer ruling 2026-09-01 (总监批 #27), option A: migrate the corpus to
symbol anchors behind a resolver gate that reds on an absent symbol, in ONE
migration with no transition period, sharing a single resolver with #13788.

- `scripts/symbol-anchors.mjs` — the SHARED core: grammar, extractor and the
  resolution rule. A corpus is a `defineCorpus` registration, so #13788 joins
  by registering rather than by forking the resolver.
- `scripts/check-adr-symbol-anchors.mjs` — the `docs/adr/**` registration.
- 469 occurrences rewritten across 35 records: 188 became symbol anchors (173
  resolved at a declaration site, 15 as a quoted data identifier), 211 dropped
  to file level, 15 to cross-repo file level, 10 dead paths lost their number,
  24 duplicate or orphaned continuations were removed, and 6 HISTORICAL /
  EXTERNAL anchors carry an inline exemption marker.

Resolution is deliberately stricter than the census: comments are stripped
before matching, so a symbol named only in a comment does not resolve, and a
token that merely repeats the anchor's own path is refused. That strictness is
what confirms 72.1% was a floor — `object.zod.ts` was credited with
`stateMachines` by the census, and the only occurrence today is a comment
saying that map no longer exists.

Nine spellings of a line reference are recognised, three of which the census's
own extractor could not see: comma and slash lists, the trailing `+` form, bare
anchors in running prose, fenced comment headers, and the tilde form.

⛔ No ADR's decision content changes; only anchor form does. ADR-0113's Context
row is known to state the inverse of today's mechanism — carded as #14193,
deliberately NOT repaired here, with a note in the record pointing at it.

Refs #13556

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Mszp61SetNhQfVGvWh9bNn

* ci(lint): keep the ADR symbol-anchor sweep out of its collector block

`check-step-collectors --self-test` was red on this branch:

    • lint.yml "ADR symbol anchors resolve (no line numbers survive)":
      all green => every command runs (3/2)

The counts are (executed / collected), so three ran where two were collected —
not the reverse. That gate drives the real `run:` block under `bash -e` with a
STUB planted at each collected command's SCRIPT PATH, then holds "all green =>
every command runs" as an equality. The step ended with a bare
`node scripts/check-adr-symbol-anchors.mjs` after the collector's exit guard,
which re-invokes the very stub planted for that script's `--self-test` entry —
a third execution against two collected commands.

Split into two steps: the collector carries the two self-tests and nothing
else, and the production sweep is its own step. That is also the shape both
existing collectors in this file already have, and it restores the property
the split was for — the sweep now runs on its own footing instead of behind
the self-tests' `exit 1`.

⛔ No scope change: `docs/adr/**`, the resolver and its corpus registration are
untouched. Both invocations the gate's own `--self-test` pins in lint.yml are
still present, so the wiring assertion still holds.

Refs #13556

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01Mszp61SetNhQfVGvWh9bNn

---------

Co-authored-by: Claude <[email protected]>

The level axis (#16055) refuses a clause-\xe2\x91\xa1 PR that grades every package
it moves at patch. The declaration is the maintainer's (batch #27), so the
level was the wrong half: @objectstack/rest goes to minor, and the BREAKING
banner carries the breaking-ness the launch window keeps off the level.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

…rs the sanitised 500 UNCLASSIFIED_FAULT (objectstack-ai#15071) (objectstack-ai#17228)

* wip(rest): move the sandbox crash terminal above the code-gated arms

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

* wip(rest): flip the §4 pin, name the door residue, add the changeset

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

* fix(rest): grade the changeset minor and declare the wire break

The level axis (objectstack-ai#16055) refuses a clause-\xe2\x91\xa1 PR that grades every package
it moves at patch. The declaration is the maintainer's (batch objectstack-ai#27), so the
level was the wrong half: @objectstack/rest goes to minor, and the BREAKING
banner carries the breaking-ness the launch window keeps off the level.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

* docs(rest): retire the stale crash-divergence note on `armSentence`

Contract review F1: the "What this deliberately does NOT decide" block in
`armSentence`'s docblock still described the pre-objectstack-ai#15071 world, and after this
PR every clause of it was false. It said a sandboxed CRASH reaches an arm and
is answered at the arm's own declared status, that the divergence against the
unwrap door's sanitised 500 is UNCHANGED, that the pin records it as an
accepted divergence, and that it "carries its own decision card" -- while the
card is this one and it has been executed: the crash terminal now sits above
the code-gated arms, so no crash reaches this function on either door.

Rewritten as a cross-reference rather than a second statement of the ruling.
`isSandboxCrash`'s own docblock carries the maintainer ruling, its fence and
its negative control; a file that states one rule twice is the drift this
finding is made of, so the block now points there and stops.

The second paragraph keeps the surviving divergence visible: what converged is
the no-declared-status case. A crash that DECLARED a 4xx still leaves
`resolveErrorResponse` at that status with the QuickJS wrapper, through a
passthrough this card did not touch -- pinned as an ACCEPTED DIVERGENCE in
`error-response-structured-arm-door-parity.test.ts`. The prose must not read as
"all divergence is gone", because it is not.

Comment lines only -- no executable byte moves. Proven at parser level: both
revisions re-printed with `removeComments: true` hash identically
(sha256 5daab82cdd23e0b93a1dfb420b2a9e3c83786975248504bdbf9907b321005fa7),
with a control leg that flips one identifier and is correctly rejected.

Co-Authored-By: Claude Opus 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_015QE8qk46e5CHJxyQEUjbf8

---------

Co-authored-by: Claude <[email protected]>
Co-authored-by: Claude Opus 5 <[email protected]>