test: widen property tests to joins, negation, predicates and time travel (#386) - #491

Refs #386 (tracker #383).

What

tests/property_test.rs gains two properties that write a random history and compare random queries with a reference evaluator:

• Histories: 1–16 writes. Each is a batched transact (1–9 facts, tx- and fact-level valid-time windows), a retract, a write transaction mixing both, or a checkpoint. Every generated statement is accepted; rejections stay with the model-based test.
• Queries: 1–3 patterns that share variables (entity joins and ref joins through ?e in value position, ?a, constants, _), an optional not / not-join, an optional comparison predicate (< <= > >= = !=), and :as-of N, :valid-at T, both, or :any-valid-time.
• Backends: in memory, and a file with checkpoints inside the history, queried on the open handle and again after a reopen (default options or page_cache_size(4)).
• Comparison: a sorted multiset when the find covers every variable and no pattern has _ (each binding is then a distinct row), and a set otherwise.
• Errors: a write, checkpoint, reopen or query error fails the case. The three existing properties no longer count a query error as an empty result.

The temporal reference model of tests/model_based_test.rs (#385) moves unchanged to tests/reference_model/mod.rs, so both tests share the #435/#477 rules.

Checking the test catches bugs

Each of these mutations fails the test: :valid-at inclusive at :valid-to; < evaluated as <=; a predicate type error that keeps the row; the on-disk read skipping retractions; the on-disk read not hiding a triple's older transactions; in the reference, not ignoring :as-of; in the reference, patterns ignoring their attribute.

With the model-based generators, only 16% of queries returned any rows. The histories here favor small integers and entities and drop the hot triple, so about 35% return rows, over 13 visible facts on average.

Findings (no engine change in this PR)

• Expression arguments can't be #uuid literals (PRS-070, documented), so predicate constants exclude refs. The two new regression seeds come from that.
• Non-aggregate queries return one row per binding, not a set: [:find ?e :where [?e :c ?v]] gives one row per ?v. The test compares as sets whenever a projection could repeat rows, so it holds whichever way that goes.

CI

Normal CI runs 256 in-memory and 25 file-backed cases. The nightly property_test job drops from 8,000,000 to 1,000,000 cases: 1M in memory (~3 ms each), 100k file-backed (~57 ms each) and 1M of each one-pattern property, about 1.6 h locally.

Also

docs/TEST_COVERAGE.md was left empty by the merge of main into v3 (d61b9a4, #488). The first commit restores v3's version.

Spec: docs/superpowers/specs/2026-10-08-wider-property-tests-design.md. A v2.x backport to main follows as a separate PR (spec §9).

🤖 Generated with Claude Code

https://claude.ai/code/session_012wXxZguv7PgKQjMMH4yJ5h