json-syntax upstream fix for the empty-object CodeMap volume bug (#387 option 3): upstream PR, optional [patch] ruling, ignored regression test

[tamashi095]

Follow-up to #387 (option 3, which that issue asked for in addition to the preflight refusal, not instead). #390 lands the in-tree refusal so no {} document can reach the parser's broken CodeMap through parse_session_json. The parser defect itself remains: json-syntax 0.12.5 never calls parser.end_fragment(i) for an empty object (src/parse/object.rs:26-29; the empty-array branch in src/parse/array.rs does), so the reserved CodeMap entry keeps span = p..p, volume = 0 (src/code_map.rs:15-22) and IterMapped::next advances 2 + 0 instead of 2 + 1 (src/object/mod.rs:795). Any future direct consumer of json_syntax::Value::parse_str in this workspace would hit it.

Scope

1. Open an upstream PR against timothee-haudebourg/json-syntax adding the end_fragment call for the empty-object branch, with a regression test built from the evidence in session aborts the host on untrusted JSON containing an empty object {} (parser CodeMap volume bug, reachable from C API and wasm boot) #387 ({"a":{},"b":1} must give [3] span=5..7 volume=1). Link it here.
2. Until it ships, decide whether to carry a [patch.crates-io] json-syntax = { git = ..., rev = ... } pointing at the fixed commit. This is a Cargo dependency change on a shipped crate and needs an owner ruling (docs/REALTIME_DEPENDENCY_POLICY.md session-parser entry). Default recommendation: do NOT patch before launch; the preflight refusal makes the bug unreachable, and a git dependency adds supply-chain surface a week out. Revisit when upstream releases.
3. Either way, add a crates/session unit test that parses {"a":{},"b":1} through json_syntax::Value::parse_str directly and asserts the CodeMap volume, marked #[ignore] with the reason until the upstream fix is in, so the day the dependency is bumped the test flips and the preflight guard can be reconsidered.

Assignment

Implementer	Sonnet
Verifier	Fable 5.1
Branch	sonnet/391-json-syntax-upstream off main
Land after	#390
Class	N/A (control plane)

Not scheduled before launch except item 1 (the upstream PR costs nothing in-tree).