Prove the JustDummies generator invariants with a property-based suite

[Reefact]

Summary

JustDummies claims that every value it builds satisfies every constraint declared on it, for every legal combination of constraint arguments — a universal quantification. The example suite proved that claim by sampling: it pinned the constraint arguments (Between(10, 20), WithLength(12)) and varied only the drawn values, instantiating the claim at a handful of hand-picked points. This adds JustDummies.PropertyTests, which generates the constraint arguments too and quantifies over them, and moves the invariants that belong there out of the example suite.

Type of change

• Bug fix
• New feature
• Breaking change
• Refactoring
• Analyzer / diagnostic change
• Tests
• Documentation
• Build / CI / tooling

Changes

• Added JustDummies.PropertyTests (FsCheck + xUnit v3), nested under the tests solution folder and added to the .NET Framework 4.7.2 floor job in ci.yml.
• 210 properties across twelve families: interval algebra for every integer width and the continuous types, lattice constraints (MultipleOf, WithScale, WithGranularity — whose anchor differs per type), string shape, collections, composition, explicit pools, temporal types with the offset dimension, seeded determinism, URIs, and the net8-only generators.
• Regular-expression round trip: patterns are generated recursively over the supported subset — nested alternation, named and non-capturing groups, negated classes, ranges, lazy and bounded quantifiers, \x/\u escapes — and every value drawn from one is checked against the real .NET engine as oracle. Sampling the generator shows 100 distinct patterns per run averaging ~82 characters, so this fuzzes the home-grown engine rather than re-pinning a corpus.
• Shared PropertyTestSupport.cs: ordered bound pairs, edge-biased numeric generators (FsCheck's own cluster near zero, so the domain ends would almost never be drawn), and per-case multi-draw helpers.
• Pruned JustDummies.UnitTests from 535 to 519 tests, removing only what a property strictly subsumes. Each pruned class carries a note saying which half of its contract it keeps.
• Two draws assembled a 64-bit word by or-ing shifted fields (CS0675); the fields are disjoint, so they are summed instead.

Testing

• dotnet build FirstClassErrors.sln
• dotnet test FirstClassErrors.sln
• Analyzer tests pass (FirstClassErrors.Analyzers.UnitTests)

Additionally run locally, since a plain dotnet test does not cover them:

• dotnet build JustDummies.PropertyTests -c Release -f net472 -p:EnableNet472Floor=true — succeeds, as does the same for JustDummies.UnitTests.
• Negative control: a deliberately false property was added, confirmed to fail, and removed — the harness detects a broken property rather than passing vacuously.

Whole solution green, no warnings. JustDummies.UnitTests 519, JustDummies.PropertyTests 210.

Documentation

• Public API / error documentation updated
• README / doc/ updated
• French translation (doc/handwritten/for-users/README.fr.md) updated if user-facing behavior changed
• No documentation change required

No public API changed and no user-facing behavior changed, so the user-facing README and its French translation are untouched. New maintainer documentation:

• doc/handwritten/for-maintainers/WritingJustDummiesTests.{en,fr}.md — where a new test belongs and how to write it, reduced to one question: does the assertion have an input space? Indexed in the maintainer README.
• Pointers from CONTRIBUTING.md, CLAUDE.md and AGENTS.md, so the rule is found before a test is written rather than after.

Architecture decisions

• No architectural decision in this pull request
• New decision recorded — ADR-0040, Split the JustDummies test bed between an example suite and a property suite
• Supersedes an existing ADR — successor proposed, status not flipped: ADR-____
• ⚠️ Conflicts with an existing ADR — flagged for the maintainer: ADR-____

Drafted as Proposed; the maintainer then explicitly instructed acceptance, applied in bee8c2c (status flipped in both language versions and in the index, Date unchanged).

Two notes for the reviewer:

• Adding a *.PropertyTests project is not what the ADR records — neither existing one has an ADR. What it records is the boundary, and the fact that tests are actively moved out of the example suite.
• ADR-0040 leaves one follow-up: the July audit flagged that ADR-0025 cites "a property test" against the real regex engine while what existed was a fixed-seed oracle test. That claim is now literally true, but ADR-0025 is Accepted and is left untouched — only the maintainer amends or supersedes it.

Reviewer notes — deliberate limits

• The pruning is conservative: 3 files of 26. The signed/unsigned suites interleave a sampled invariant with a conflict-message assertion inside the same method, so removing the loop would take the assertion with it. Splitting them is a rewrite, not a prune, and was not done unprompted.
• The dated regression for Dummies: AnyDecimal never generates the upper half of a range #206 was kept, although the new property covers the same ground over all intervals. The property proves the class of defect; the regression pins the coordinates where it actually occurred. ADR-0040 records this as the rule.
• Some properties were deliberately omitted rather than guessed: OneOf combined with an interval (the conflict surface there is value-dependent), and strict bounds on decimal near MaxValue (the 1E-28 exclusion nudge vanishes in rounding there — documented behavior, not a defect).

Related issues

Relates to #206 — the decimal interval defect whose class is now quantified rather than pinned to one interval.

---

Generated by Claude Code