docs(changelog): reconcile and promote [Unreleased] to [4.0.3]

[bpamiri]

Release-cut reconciliation ahead of the 4.0.3 GA.

What

• Rename # [Unreleased] → # [4.0.3](…) => 2026-06-09 with a summary blurb, matching the 4.0.2 promotion format (docs(changelog): promote develop [Unreleased] to [4.0.2] #2824).
• Consolidate the duplicated ### Changed / ### Fixed sections (accumulated from incremental entry additions) into one Added/Changed/Fixed trio, same order as the 4.0.2 block.
• Drop the byte-identical duplicate Public global helpers (env, model, findAll, …) are URL-invokable as controller actions — protectedControllerMethods is never populated #2844 (protectedControllerMethods) entry.
• Add the missing consolidated entry for the 24-command CLI audit sweep (fix(cli): repair broken commands and correct command docs (CLI audit) #2882, fix(cli): CLI audit follow-ups (test exit codes, deploy flags, release channel, guide fixes) #2883, fix(cli): generate enum() emission, view-gen warnings, route-dup message #2884, fix(cli): warn when wheels start's pinned port is already taken #2885).
• Fix the separator below the promoted block to exactly --- (3 dashes) so release.yml's release-notes awk extraction terminates correctly (the chore: prep CHANGELOG for v4.0.0 GA #2606/chore(release): prep CHANGELOG for v4.0.1 GA #2768 footgun).

Verification

Mirrored release.yml's Validate Release Checklist locally:

• awk range /^# \[4\.0\.3\]/,/^---$/ extracts the 4.0.3 block with zero bleed into the 4.0.2 section
• no => TBD on the 4.0.3 heading
• wheels.json on develop already reads 4.0.3 (clean, no snapshot suffix)

Why now

Doing the promotion on develop before cutting release/4.0.3-to-main avoids the 4.0.2 back-port dance (#2824), where the rename lived only on the squash-merged release branch and develop kept stale [Unreleased] entries.

🤖 Generated with Claude Code

[wheels-bot]

Wheels Bot — Reviewer A

This PR performs a changelog reconciliation ahead of the 4.0.3 GA: it renames [Unreleased] to [4.0.3], consolidates duplicated ### Changed/### Fixed sections, drops the byte-identical duplicate #2844 entry, adds the missing CLI audit sweep entry (#2882-#2885), and fixes the block-terminating separator from five dashes (-----) to exactly three (---) so release.yml's awk extraction closes correctly. The diff is CHANGELOG.md-only; no production code is touched. Verdict: approve.

Correctness

The five claimed edits all land as described:

1. Version heading renamed with correct link and date (2026-06-09), matching the 4.0.2 promotion format. The summary blurb claims (ArgSpec overhaul, sibling-server guard, PostgreSQL FK fix, Oracle DDL, protectedControllerMethods, column-casing, reload password) all correspond to entries in the consolidated sections.
2. Duplicate section collapse — the second ### Changed block (the CLI user-error-paths entry, #2890) and the second ### Fixed header were removed; their entries are preserved in the consolidated block.
3. Duplicate #2844 entry dropped — protectedControllerMethods appeared twice in the old ### Fixed sections; exactly one instance remains.
4. Missing CLI audit entry added — the A full audit of the CLI's 24 commands bullet was absent from any prior ### Fixed section; it now appears, matching #2882-#2885.
5. Separator fix — the terminating separator below the 4.0.3 block changed from ----- (five dashes) to --- (three dashes).

The separator fix is the highest-risk item. Verified with release.yml's own awk pattern against the post-merge CHANGELOG — the range /^# \[4\.0\.3\]/,/^---$/ ends at the --- on line 67 and the very next line is a blank before # [4.0.2]. Zero bleed into the prior release block. The ---- (four-dash) decorative separators around the rebrand note at lines 8 and 19 do not match ^---$ and are correctly left alone.

Commits

Single commit: docs(changelog): reconcile and promote [Unreleased] to [4.0.3]

• Type docs, scope changelog, header 61 chars, not ALL-CAPS — all valid per commitlint.
• Body explains each of the five edits and the motivation for the pre-release timing.
• Signed-off-by: Peter Amiri <peter@alurium.com> matches the git author identity — DCO satisfied.
• Co-Authored-By: Claude Fable 5 present.

No Cross-engine, Tests, or Security sections apply to a documentation-only CHANGELOG edit.

[wheels-bot]

Wheels Bot — Reviewer B (round 1)

A's review checks out across all five claimed edits. No sycophancy, no false positives, no missed issues. Convergence: aligned on approve.

Sycophancy

None detected. A backed each finding with a specific diff reference — no bare LGTM or unsupported approval.

False positives

None detected. Verified each claim against the diff and the merged file:

1. Version heading: # [Unreleased] → # [4.0.3](...) => 2026-06-09 — confirmed.
2. Duplicate section collapse: the two ### Changed / ### Fixed headers removed; CLI user-error-paths entry preserved in the consolidated ### Changed; all ### Fixed entries consolidated under one header — confirmed.
3. Duplicate Public global helpers (env, model, findAll, …) are URL-invokable as controller actions — protectedControllerMethods is never populated #2844 entry dropped: the second protectedControllerMethods bullet (old file line ~58) removed; one instance remains in the consolidated ### Fixed — confirmed.
4. Missing CLI audit entry added: the "full audit of the CLI's 24 commands" bullet is present in the new ### Fixed block — confirmed.
5. Separator fix: ----- → ---; the merged file has --- at line 66, followed by a blank line, then # [4.0.2] — confirmed. The four-dash decorative separators at lines 7 and 18 do not match ^---$ and were left untouched — confirmed.

A's claim that the version summary blurb's items "all correspond to entries in the consolidated sections" extends to the column-casing and reload-password items, which were not visible in the diff (they were already in the file from prior PRs). Verified against the merged file: both entries are present at lines 59-60 of the final CHANGELOG — no false positive.

Missed issues

None detected. The diff is CHANGELOG.md-only; cross-engine, test, security, and .ai/wheels/ update concerns do not apply. Commit header is 61 chars, type docs, scope changelog, not ALL-CAPS — commitlint clean. DCO sign-off email matches the git author identity.

Verdict alignment

A's approve is consistent with the findings: every claimed edit verified, documentation-only change, no actionable issues outstanding.

Convergence

Aligned on approve. A's review is accurate and complete for a CHANGELOG-only reconciliation PR. No changes needed.