feat(quickcheck): companion property-testing package (RFC #115, Option C)

[bobzhang]

Implements Option C from the RFC in #115 — a companion package that exposes
reusable quickcheck support for TomlValue while keeping the core parser free
of any quickcheck dependency. Parse-only consumers pay nothing; only importers
of bobzhang/toml/quickcheck take on moonbitlang/quickcheck and its
transitive weight.

The design constraint (why a newtype, not impl Arbitrary for TomlValue)

A companion package cannot implement Arbitrary/Shrink directly on
TomlValue: both the traits (moonbitlang/core/quickcheck,
moonbitlang/quickcheck/shrink) and the type (bobzhang/toml) are foreign
to it, so the impl violates the orphan rule (compiler error 4061). Only core
itself (Option B) could add a bare impl — at the cost of pulling quickcheck into
core's runtime deps.

The idiomatic escape hatch is the same one moonbitlang/quickcheck's own
modifiers package uses (Positive, NonEmptyArray, ...): wrap the value in a
local newtype that carries the trait instances.

Public API

pub fn roundtrippable_document() -> @gen.Gen[@toml.TomlValue]  // safe fragment
pub fn shrink_document(@toml.TomlValue) -> Iter[@toml.TomlValue]
pub fn round_trips(@toml.TomlValue) -> Bool                    // parse(v.to_string()) == v
pub(all) struct RoundTrippable(@toml.TomlValue)                // + Arbitrary + Shrink impls

The generated fragment covers every primitive, homogeneous arrays, nested
tables, and adversarial keys (quoted, dotted, and negative-exponent-like keys
that collide with the float grammar). It deliberately excludes floats and
mixed-type arrays so that exact == after a round-trip is meaningful.

Two idioms shown

Trait-driven — quick_check_fn reads the generator/shrinker off the newtype:

@qc.quick_check_fn(fn(doc : @quickcheck.RoundTrippable) {
  @quickcheck.round_trips(doc.inner())
}, max_success=100)

Explicit generators — hand them to forall_shrink directly:

@qc.quick_check(@qc.forall_shrink(
  @quickcheck.roundtrippable_document(),
  @quickcheck.shrink_document,
  fn(value) { @quickcheck.round_trips(value) },
), max_success=100)

Notes

• RoundTrippable mirrors the internal qc_model SimpleValue proxy, but as a
  newtype over the real TomlValue rather than a parallel type + conversions
  — a possible path to retiring that proxy later (not done here).
• Trade-off to keep in mind: round-trip safety now lives in the generator
  rather than in a restricted type, so the fragment is a convention, not a
  type-level guarantee. This is a fuzzing/law generator, not a full-TomlValue
  Arbitrary (floats/mixed arrays are out of scope by design).

Testing

• New package: 4 tests (trait-driven + explicit idioms, plus two README
  doc-tests), 500 cases each in the test file.
• moon check clean (zero warnings), moon fmt, moon info committed.
• Full workspace suite: 413 passed.

Closes the implementation side of #115 (the decision itself is still open there).

🤖 Generated with Claude Code