chore(zod): upgrade zod 4.4.3 to 4.6.5

[jasonhnd]

Closes #642

Part of #635 (order 6). Base preview. Blocked-by order 5 is 3db0f29b (PR #654).

Edits mapped to やること

1. Branch chore/zod-4.6.5 from origin/preview 3db0f29b (order 5 merged). Bun 1.4.2 (1.4.2+744846f84) installed privately at /tmp/bun-1.4.2 and prepended to PATH. Global Bun was not upgraded (bun upgrade was not run). Node v24.20.0. No PUBLIC_GA4_MEASUREMENT_ID / PUBLIC_X_PIXEL_ID / PUBLIC_META_PIXEL_ID.
2. package.json dependencies.zod: ^4.4.3 → ^4.6.5. No schema edits. No other package range changed. Commit c4cd426b.
3. bun install (Bun 1.4.2). Resolved a single zod@4.6.5. lockfileVersion stayed 1. The duplicate astro/zod alias (already zod@4.6.5) is removed. @vercel/cli-config/zod stays zod@4.1.11 (different pin; its lockfile key is not "zod").
4. ETL oracle: normalized sha256 of all files under public/data* is identical on zod 4.4.3 and 4.6.5, and both sides have 616 files. See ETL oracle below.
5. Standard chain below, run after commit c4cd426b so git diff --exit-code is the generated-file check. All exit 0. Results match the dry-run table (typecheck / test / build / REQUIRE_BUILT_ARTIFACTS / verify:gates OK; Playwright 356 passed, 26 skipped, 0 failed; bun audit no vulnerabilities).
6. Docs:
   • CHANGELOG.md ### Changed: - **zod 4.4.3 → 4.6.5** — build-time schemas only; 616 ETL outputs identical (ignoring generated_at). Commit c4cd426b.
   • docs/TOOLCHAIN.md §11 order 6: — done (#655). Follow-up commit 533b3436. zod has no §2 row; none added.

Lockfile diff vs the dry-run table

git diff --numstat 3db0f29b for the bump (before the changelog line):

1	1	package.json
2	4	bun.lock

package.json is one line. bun.lock is 2 insertions and 4 deletions. The dry-run table records bun.lock as (+1 / −3). bun install wrote this lockfile; it was not hand-edited. The three hunks are:

1. Embedded workspace range "zod": "^4.4.3" → "^4.6.5" (+1 / −1).
2. Package entry zod@4.4.3 → zod@4.6.5 (+1 / −1).
3. Removal of "astro/zod": ["zod@4.6.5", ...] and one blank line (−2).

The grep checks in やること step 3 match the table (count 1, zod@4.6.5, lockfileVersion 1).

Lockfile greps

grep -c '"zod": \["zod@' bun.lock
1

grep -n '"zod": \["zod@' bun.lock
911:    "zod": ["zod@4.6.5", "", {}, "sha512-v5l/aFXZQeai4awLbOpSoHecE9UiMrnfx75tEXLjNonXVARxQ5mOeipTjROUchszUNCqnE+hqAMujRsRHsut2Q=="],

grep -n 'lockfileVersion' bun.lock
2:  "lockfileVersion": 1,

bun install log (Bun 1.4.2, after the range bump):

bun install v1.4.2 (744846f84)
Resolving dependencies
Resolved, downloaded and extracted [1]
Saved lockfile

+ zod@4.6.5

1 package installed [101.00ms]

ETL oracle

norm is the Issue's function (strip "generated_at" then shasum -a 256). git stash + bun install built on zod 4.4.3; git stash pop + bun install built on zod 4.6.5. Both bun run build:data runs exited 0 (556 occupations, done in 0.55s / 0.59s).

OLD bdff3823128be03bb9f9e9c27121e045e0da6e14f733bde250faa66ffec00cb3  -
NEW bdff3823128be03bb9f9e9c27121e045e0da6e14f733bde250faa66ffec00cb3  -

OLD      616
NEW      616

Installed after the pop: zod@4.6.5.

Verification (Bun 1.4.2+744846f84, Node v24.20.0)

Chain ran on commit c4cd426b. Each command exit 0.

bun run typecheck

$ node node_modules/@typescript/native/bin/tsc --noEmit

bun run test

bun run test runs build:data then bun test. ETL completed in 0.57s (556 occupations).

bun test v1.4.2 (744846f84)

 1725 pass
 0 fail
Ran 1725 tests across 168 files. [4.33s]

sector.test.ts prints two [og] sectors projection schema mismatch lines to stderr. Same pre-existing negative fixtures noted on #654; the run is 1725 pass / 0 fail.

bun run test:consistency

[OK] projections pass L3 consistency checks

bun run build

[check-lockfile-sync] OK — 14 deps match between package.json and bun.lock.
[check-analytics-config] OK — 6 script-src origins ok, 11 connect-src origins ok, 0 frame-src origins ok, 5 PUBLIC_* env vars documented.
[check-nested-html-comments] OK — scanned 71 files, no nested HTML comments.
23:55:04 [build] ✓ Completed in 6.83s.
23:55:04 [build] 844 page(s) built in 6.94s
23:55:04 [build] Complete!
[subset-fonts] 2 font files, serif=1102 sans=2399 unique codepoints, 302 KiB total
[check-geo-freshness] OK - GPT 6 SOL 2026-09-23, 556 occupations, mean=4.55
[check-rendered-leaks] OK — scanned 844 pages, no leaked tokens.
[compute-csp-hashes] OK — script-src/style-src already up to date (24 inline-script + 36 inline-style hash(es), 844 HTML files scanned).

The 844 route lines are omitted. CSP hashes unchanged.

REQUIRE_BUILT_ARTIFACTS=1 bun test scripts/home-css-loading.test.ts src/site/models-built.test.ts

bun test v1.4.2 (744846f84)
 10 pass
 0 fail
Ran 10 tests across 2 files. [91.00ms]

bun run verify:gates

[OK] projections pass L3 consistency checks
[check-geo-freshness] OK - GPT 6 SOL 2026-09-23, 556 occupations, mean=4.55
[check-model-redirects] OK - 12 bare model slug(s) redirect to their latest run
[check-analytics-spec] OK — 36 events / 46 params match analytics/spec.yaml (5 dynamic emit sites declared).
[check-architecture] no Edge entries — plane C is nodejs/Bun (TOOLCHAIN §9)
[check-architecture] ✓ all enforced layer boundaries respected
[check-doc-links] OK — 58 tracked Markdown files, 99 local link/image target(s)
[verify-occupation-routes] 556 occupations own 556 unique, indexable routes
✅ Internal-link integrity passed — every NEW href resolves; 0 pre-known broken targets remain (TODO).
✅ JSON-LD validation passed — all 843/844 pages structurally valid.
[diff-seo-baseline] capturing current dist-astro/ …
✓ URL set (urls.txt) — 844 URLs
✓ data file paths (data-files.txt) — 616 files
✓ sitemap.xml — 5002 lines
✓ image-sitemap.xml — 3897 lines
✓ SEO metadata (seo-metadata.jsonl) — 844 URLs compared
✓ OG / Twitter meta (og-meta.jsonl) — 844 URLs compared
✓ JSON-LD (json-ld.jsonl) — 844 URLs compared
✓ internal links + anchors (internal-links.jsonl) — 844 URLs compared
✅ SEO baseline clean — no drift.
[check-page-class] ✓ Page Class System invariants respected
[check-design-sync] OK — Design.md §21.2 and design-tokens.ts agree
[check-type-scale] OK — every font-size on a conformant surface is a scale token (0 warning(s))
[check-heading-rules] OK — no conformant surface sets heading type (0 warning(s))
[check-surface-coverage] OK — every file carrying design declarations belongs to a surface
[check-contrast] OK — 33 role × background combinations satisfy §2.2
[check-role-color] OK — every checked role uses its §4.7 colour token
[check-color-tokens] OK — no palette tint written raw
[compute-csp-hashes] OK — script-src has 24 inline-script hash(es) and matches dist-astro/.

bun x playwright test --reporter=line

Running 382 tests using 12 workers
  26 skipped
  356 passed (21.2s)

bun audit

bun audit v1.4.2 (744846f84)

No vulnerabilities found (checked 439 packages) [155.00ms]

git diff --exit-code

(empty)
exit=0

Issue #642 does not list vercel inspect or a preview curl. Those checks are not in this PR.

CI

gh pr checks 655 on head 533b3436:

quality	pass	3m46s	https://github.com/jasonhnd/jobs/actions/runs/36016662344/job/107691138510
Vercel	pass	0	https://vercel.com/zkscio/jobs/5tF33v288MsZ3EYrDCaiP7NPJ3zX	Canceled by Ignored Build Step
Vercel Preview Comments	pass	0	https://vercel.com/github

The head commit is docs-only (docs/TOOLCHAIN.md), so scripts/vercel-ignore-build.sh skipped that build (exit 0 → skip). The code commit c4cd426b deployed: Vercel status Deployment has completed at https://vercel.com/zkscio/jobs/e5oZi5RVRYVChh9eMsYjLwCJ5cbo. quality on c4cd426b was cancelled by the follow-up push (concurrency.cancel-in-progress); the run that passed is the head run above.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
jobs	Ready	Preview	Sep 24, 2026 2:58pm UTC