[sbc1-code]

Zod 3.25.76 accumulates an error for every invalid array element before applying a size limit; the current high advisory blocks the unchanged release gate. Use official Zod 4.6.7, and integrate the Typography-scoped postcss-selector-parser 6.1.5 backport reviewed in #149. No patched stable Zod 3.x release was found. This is an investigated major dependency change.

The branch retains the original #149 commit 81e6069b and the separate Zod candidate 27b4d1d3 as ancestors. Neither source branch is rewritten or closed. Current collector snapshots are preserved; only six dependency/test/runbook files differ from the integration base.

Compatibility review:

• The only application schema consumer found is blog frontmatter, used by the index builder and two draft generators. No browser/API validation consumer was found in inspected code.
• SDK 0.98.0 explicitly accepts Zod ^3.25.0 || ^4.0.0; the dependency graph resolves the same 4.6.7 instance. SDK and all other package versions stay unchanged.
• Seven new CLI tests run the actual builder, both anomaly templates and the real SDK/client in temporary fixtures. SDK fetch is intercepted with synthetic responses and a dummy key, without inherited credentials or external LLM requests.
• EN/ES mocked tool responses preserve forced draft/human-review flags. Invalid metadata retains flattened field diagnostics; missing tool responses write no draft. Builder draft exclusion and human-review publication gates remain enforced.
• Five schema regressions preserve defaults, explicit values and validation boundaries. A controlled 10000-invalid-tag input produces one size issue, versus 10001 issues under the old version. All 36 checked-in posts retain identical normalized metadata.

Integrated validation:

• Clean local npm ci, build and full npm test PASS: 148 unit tests, 416 browser navigations, including existing EN/ES mobile/desktop and missing/zero/stale-data regressions.
• All 25 generated JS/CSS assets are byte-identical to baseline. Local entry JS 61.81/62 KiB gzip, CSS 19.09/20 KiB; budgets unchanged.
• Exact-head remote CI also PASS: push40080729545 and PR40080745643, each 148 unit tests and 416 browser navigations. PR CI tested merge 16ab47bf4b05286fb6ee6c5688421146058cb5fe against main f5d7a2f1dc4b6a8dbf9fe5da75838f0ec6a2c70a. CI entry JS 61.99/62 KiB, CSS 19.11/20 KiB.
• Current full audit: 2 moderate, 0 high/critical. Omit-dev: zero entries. The existing audit gate passes with no policy, accepted-advisory or threshold changes.

Sources and remaining limits:

• Zod advisory, maintainer size-bound fix, 4.6.7 release, migration guide.
• Parser maintainer advisory and official 6.1.5 release identify the patched backport. The global reviewed record still lists all <7.1.6; the two moderate package entries remain visible.
• The Zod fix leaves unbounded collections unchanged. Mocked generation does not validate live provider behavior, and bounded source review is not a complete security certification.
• Draft review only. Exact integrated Linux/Node22 CI passed; final review remains before release; no merge/deployment, security-setting or credential changes in this pass.