chore(deps): bump json-schema-faker to 0.6.3 (measured behavior-neutral)

[nzneit]

Re-pins json-schema-faker from 0.6.2 to 0.6.3 (released 2026-08-01), exact as before, and records the measurements behind it as D-020.

The bump is adopted on measured neutrality, not on its changelog. Its headline items are inert here: dependentSchemas/dependentRequired support cannot help a validator that validates under draft-07, where both are post-draft-07 keywords offbook already surfaces as a dialect-mismatch diagnostic (D-018). What it does buy is robustness in places an adopter's spec can reach and the fixture corpus cannot: trampolined recursive schema walks (a self-referencing $ref currently degrades to an F5 drop-and-surface), $defs resolution scoping, and registration of nested local definitions.

Measured

A/B against 0.6.2 over the same channel schemas, same options, same seed derivation as src/engine/faker.ts:

probe	0.6.2	0.6.3
R-027 corpus (8 fixtures, 14 channels, 25 seeds each)	0/350 recheck failures	0/350
same-seed draw equality across versions	350 identical, 0 divergent
D-018 draft-07 tuple (items: [...])	10/10 invalid	10/10 invalid, byte-identical

The 0.6.2 half reproduces D-008 exactly, so the R-027 tripwire's pinned counts needed no edit and D-008's verdict survives the bump untouched.

The byte-identical result is what licensed the bump. A faker that drew valid-but-different data would still have broken every pinned expectation and put the R-029 determinism gate at risk, without ever failing the Ajv recheck. In a repo whose central promise is seeded determinism, that is the bar a dependency bump has to clear.

The tuple defect is unfixed, and it is upstream's

The D-018 shape still fails 10/10 seeds, byte-identically, unchanged by additionalItems: false or minItems: 2. New detail: it reproduces at library defaults with no options set, so it is upstream's items-as-array handler and not something alwaysFakeOptionals/failOnInvalidTypes provokes. Upstream has no open issue for it; #678 (closed) was the request for prefixItems, which is what landed.

The alternative this opens, documented but not implemented

The faker draws the 2020-12 spelling of the same tuple correctly:

prefixItems: [{type:string},{type:number}]  ->  ["B0PkGq", 249.489]
items:       [{type:string},{type:number}]  ->  [{"0":"B0PkGq","1":249.489}, ...]

So the gap is a spelling gap, not a capability gap. Probing a draw-time-only rewrite (rewrite the copy handed to the faker, recheck the drawn payload against the original untouched draft-07 schema) moves four tuple shapes from 10/10 invalid to 0/10 invalid, with plain non-tuple arrays unaffected: top-level tuple, tuple nested in a property, tuple + additionalItems: false, tuple-of-tuples.

D-020 records this as an option, not a decision. It is deliberately not implemented here: it belongs to the L1 tuple fork D-018 left open, not to a version bump, and that fork now reads three-way rather than two-way. Its costs are recorded with the same weight as its benefit, since whoever resolves the fork needs both: it is a recursive walk over an adopter's schema inside offbook (the shape R1 exists to keep out), the probe keys off the literal key name items where a correct implementation must be schema-position-aware, and it must map additionalItems onto 2020-12's items.

One consequence for an earlier entry

0.6.3 adds generateSync/createGeneratorSync (upstream #854), which retires D-003's factual premise without retiring its decision. D-003 kept Faker async partly because "the 0.6.x rewrite is async-only"; that was accurate when written (verified: 0.6.2 exports no sync entry point) and is now false. The async Faker stands unchanged: frozen contract type, consumers already await, no user-visible gain in churning it. But contracts.md §3 and D-003 both asserted the async-only fact as current, so they now state it as the reason it was chosen instead.

Doc sweep

Version references updated in build-plan.md §1, design.md §4, R-027, and the three source comments that named 0.6.2. docs/plans/, docs/superpowers/, and docs/archive/ are left alone: they are historical execution records, and the m0 plan's own AMENDMENT convention gives them notes rather than edits.

Gates

check-docs, lint, typecheck, demo-app:build, and full bun test all exit 0 (432 pass, 0 fail).