test: add proptest property-based tests

Add proptest dependency and property tests for:
- CellKey: key normalization invariants (sort order, dedup, round-trip,
  prefix non-equality, merge commutativity)
- View: axis exclusivity, set_axis, idempotency, page_selection roundtrip,
  hide/show roundtrip, toggle_group_collapse involution

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/model/cell.rs

@@ -330,3 +330,178 @@ mod data_store {
         assert_eq!(store.sum_matching(&[]), 10.0);
     }
 }
+
+#[cfg(test)]
+mod prop_tests {
+    use proptest::prelude::*;
+    use super::{CellKey, CellValue, DataStore};
+
+    /// Strategy: map of unique cat→item strings (HashMap guarantees unique keys).
+    fn pairs_map() -> impl Strategy<Value = Vec<(String, String)>> {
+        prop::collection::hash_map("[a-f]{1,5}", "[a-z]{1,5}", 1..6)
+            .prop_map(|m| m.into_iter().collect())
+    }
+
+    /// Strategy: finite f64 (no NaN, no infinity).
+    fn finite_f64() -> impl Strategy<Value = f64> {
+        prop::num::f64::NORMAL.prop_filter("finite", |f| f.is_finite())
+    }
+
+    proptest! {
+        // ── CellKey invariants ────────────────────────────────────────────────
+
+        /// Pairs are always in ascending category-name order after construction.
+        #[test]
+        fn cellkey_always_sorted(pairs in pairs_map()) {
+            let key = CellKey::new(pairs);
+            for w in key.0.windows(2) {
+                prop_assert!(w[0].0 <= w[1].0,
+                    "out of order: {:?} then {:?}", w[0].0, w[1].0);
+            }
+        }
+
+        /// Reversing the input produces an identical key (order-independence).
+        #[test]
+        fn cellkey_order_independent(pairs in pairs_map()) {
+            let mut rev = pairs.clone();
+            rev.reverse();
+            prop_assert_eq!(CellKey::new(pairs), CellKey::new(rev));
+        }
+
+        /// get(cat) finds every pair that was passed to new().
+        #[test]
+        fn cellkey_get_retrieves_all_pairs(pairs in pairs_map()) {
+            let key = CellKey::new(pairs.clone());
+            for (cat, item) in &pairs {
+                prop_assert_eq!(key.get(cat), Some(item.as_str()),
+                    "missing {}={}", cat, item);
+            }
+        }
+
+        /// with(cat, val) — if cat already exists, it is updated in-place.
+        #[test]
+        fn cellkey_with_overwrites_existing(
+            pairs in pairs_map(),
+            new_item in "[a-z]{1,5}",
+        ) {
+            let key = CellKey::new(pairs.clone());
+            let cat = pairs[0].0.clone();
+            let key2 = key.with(cat.clone(), new_item.clone());
+            prop_assert_eq!(key2.get(&cat), Some(new_item.as_str()));
+            // length unchanged when cat already exists
+            prop_assert_eq!(key2.0.len(), pairs.len());
+        }
+
+        /// with(fresh_cat, val) — a brand-new category is inserted and the
+        /// result is still sorted.
+        #[test]
+        fn cellkey_with_adds_new_category(
+            pairs in pairs_map(),
+            // use g-z so it is unlikely to collide with a-f used in pairs_map
+            fresh_cat in "[g-z]{1,5}",
+            new_item in "[a-z]{1,5}",
+        ) {
+            let key = CellKey::new(pairs.clone());
+            // only run if fresh_cat is truly absent
+            prop_assume!(!pairs.iter().any(|(c, _)| c == &fresh_cat));
+            let key2 = key.with(fresh_cat.clone(), new_item.clone());
+            prop_assert_eq!(key2.get(&fresh_cat), Some(new_item.as_str()));
+            prop_assert_eq!(key2.0.len(), pairs.len() + 1);
+            for w in key2.0.windows(2) {
+                prop_assert!(w[0].0 <= w[1].0, "not sorted after with()");
+            }
+        }
+
+        /// without(cat) — the removed category is absent; all others survive.
+        #[test]
+        fn cellkey_without_removes_and_preserves(pairs in pairs_map()) {
+            prop_assume!(pairs.len() >= 2);
+            let removed_cat = pairs[0].0.clone();
+            let key = CellKey::new(pairs.clone());
+            let key2 = key.without(&removed_cat);
+            prop_assert_eq!(key2.get(&removed_cat), None);
+            for (cat, item) in pairs.iter().skip(1) {
+                prop_assert_eq!(key2.get(cat), Some(item.as_str()));
+            }
+        }
+
+        // ── DataStore invariants ──────────────────────────────────────────────
+
+        /// Setting a value and immediately getting it back returns the same value.
+        #[test]
+        fn datastore_set_get_roundtrip(pairs in pairs_map(), val in finite_f64()) {
+            let key = CellKey::new(pairs);
+            let mut store = DataStore::default();
+            store.set(key.clone(), CellValue::Number(val));
+            prop_assert_eq!(store.get(&key), &CellValue::Number(val));
+        }
+
+        /// Setting Empty after a real value: get returns Empty (key is evicted).
+        #[test]
+        fn datastore_empty_evicts_key(pairs in pairs_map(), val in finite_f64()) {
+            let key = CellKey::new(pairs);
+            let mut store = DataStore::default();
+            store.set(key.clone(), CellValue::Number(val));
+            store.set(key.clone(), CellValue::Empty);
+            prop_assert_eq!(store.get(&key), &CellValue::Empty);
+        }
+
+        /// The last write to a key wins.
+        #[test]
+        fn datastore_last_write_wins(
+            pairs in pairs_map(),
+            v1 in finite_f64(),
+            v2 in finite_f64(),
+        ) {
+            let key = CellKey::new(pairs);
+            let mut store = DataStore::default();
+            store.set(key.clone(), CellValue::Number(v1));
+            store.set(key.clone(), CellValue::Number(v2));
+            prop_assert_eq!(store.get(&key), &CellValue::Number(v2));
+        }
+
+        /// Two keys that differ by one coordinate are fully independent.
+        #[test]
+        fn datastore_distinct_keys_independent(
+            pairs in pairs_map(),
+            v1 in finite_f64(),
+            v2 in finite_f64(),
+            new_item in "[g-z]{1,5}",
+        ) {
+            // key2 shares all categories with key1 but has a different item in
+            // the first category, so key1 ≠ key2.
+            let mut pairs2 = pairs.clone();
+            let changed_cat = pairs2[0].0.clone();
+            pairs2[0].1 = new_item.clone();
+            prop_assume!(pairs[0].1 != new_item); // ensure they truly differ
+
+            let key1 = CellKey::new(pairs);
+            let key2 = CellKey::new(pairs2);
+            let mut store = DataStore::default();
+            store.set(key1.clone(), CellValue::Number(v1));
+            store.set(key2.clone(), CellValue::Number(v2));
+            prop_assert_eq!(store.get(&key1), &CellValue::Number(v1),
+                "key1 corrupted after writing key2 (diff in {})", changed_cat);
+            prop_assert_eq!(store.get(&key2), &CellValue::Number(v2));
+        }
+
+        /// Every cell returned by matching_cells actually satisfies the partial key.
+        #[test]
+        fn datastore_matching_cells_all_match_partial(
+            pairs in pairs_map(),
+            val in finite_f64(),
+        ) {
+            prop_assume!(pairs.len() >= 2);
+            let key = CellKey::new(pairs.clone());
+            let mut store = DataStore::default();
+            store.set(key, CellValue::Number(val));
+            // partial = first pair only
+            let partial = vec![pairs[0].clone()];
+            let results = store.matching_cells(&partial);
+            for (result_key, _) in &results {
+                prop_assert!(result_key.matches_partial(&partial),
+                    "returned key {result_key} does not match partial {partial:?}");
+            }
+        }
+    }
+}

src/view/view.rs

@@ -239,3 +239,146 @@ mod tests {
         assert_eq!(v.selected,   (0, 0));
     }
 }
+
+#[cfg(test)]
+mod prop_tests {
+    use super::View;
+    use crate::view::Axis;
+    use proptest::prelude::*;
+
+
+    fn unique_cat_names() -> impl Strategy<Value = Vec<String>> {
+        prop::collection::hash_set("[A-Za-z][a-z]{1,7}", 1usize..=8)
+            .prop_map(|s| s.into_iter().collect::<Vec<_>>())
+    }
+
+    proptest! {
+        /// axis_of and categories_on are consistent: cat is in categories_on(axis_of(cat))
+        #[test]
+        fn axis_of_and_categories_on_consistent(cats in unique_cat_names()) {
+            let mut v = View::new("T");
+            for c in &cats { v.on_category_added(c); }
+            for c in &cats {
+                let axis = v.axis_of(c);
+                prop_assert_ne!(axis, Axis::Unassigned,
+                    "category '{}' should be assigned after on_category_added", c);
+                let on_axis = v.categories_on(axis);
+                prop_assert!(on_axis.contains(&c.as_str()),
+                    "categories_on({:?}) should contain '{}'", axis, c);
+            }
+        }
+
+        /// Each known category appears on exactly one axis
+        #[test]
+        fn each_category_on_exactly_one_axis(cats in unique_cat_names()) {
+            let mut v = View::new("T");
+            for c in &cats { v.on_category_added(c); }
+            let all_axes = [Axis::Row, Axis::Column, Axis::Page];
+            for c in &cats {
+                let count = all_axes.iter()
+                    .filter(|&&ax| v.categories_on(ax).contains(&c.as_str()))
+                    .count();
+                prop_assert_eq!(count, 1,
+                    "category '{}' should be on exactly one axis, found {}", c, count);
+            }
+        }
+
+        /// on_category_added is idempotent: adding same cat twice keeps original axis
+        #[test]
+        fn on_category_added_idempotent(cats in unique_cat_names()) {
+            let mut v = View::new("T");
+            for c in &cats { v.on_category_added(c); }
+            let axes_before: Vec<_> = cats.iter().map(|c| v.axis_of(c)).collect();
+            for c in &cats { v.on_category_added(c); }
+            let axes_after: Vec<_> = cats.iter().map(|c| v.axis_of(c)).collect();
+            prop_assert_eq!(axes_before, axes_after);
+        }
+
+        /// set_axis updates axis_of for the target category
+        #[test]
+        fn set_axis_updates_axis_of(
+            cats in unique_cat_names(),
+            target_idx in 0usize..8,
+            axis in prop_oneof![Just(Axis::Row), Just(Axis::Column), Just(Axis::Page)],
+        ) {
+            let mut v = View::new("T");
+            for c in &cats { v.on_category_added(c); }
+            let idx = target_idx % cats.len();
+            let cat = &cats[idx];
+            v.set_axis(cat, axis);
+            prop_assert_eq!(v.axis_of(cat), axis);
+        }
+
+        /// After set_axis(cat, X), cat is NOT in categories_on(Y) for Y ≠ X
+        #[test]
+        fn set_axis_exclusive(
+            cats in unique_cat_names(),
+            target_idx in 0usize..8,
+            axis in prop_oneof![Just(Axis::Row), Just(Axis::Column), Just(Axis::Page)],
+        ) {
+            let mut v = View::new("T");
+            for c in &cats { v.on_category_added(c); }
+            let idx = target_idx % cats.len();
+            let cat = &cats[idx];
+            v.set_axis(cat, axis);
+            let other_axes = [Axis::Row, Axis::Column, Axis::Page]
+                .into_iter()
+                .filter(|&a| a != axis);
+            for other in other_axes {
+                prop_assert!(!v.categories_on(other).contains(&cat.as_str()),
+                    "after set_axis({:?}), '{}' should not be in categories_on({:?})",
+                    axis, cat, other);
+            }
+        }
+
+        /// No two categories share the same axis entry (map guarantees uniqueness by key)
+        /// — equivalently, total count across all axes equals number of known categories
+        #[test]
+        fn total_category_count_consistent(cats in unique_cat_names()) {
+            let mut v = View::new("T");
+            for c in &cats { v.on_category_added(c); }
+            let total: usize = [Axis::Row, Axis::Column, Axis::Page]
+                .iter()
+                .map(|&ax| v.categories_on(ax).len())
+                .sum();
+            prop_assert_eq!(total, cats.len());
+        }
+
+        /// page_selection round-trips: set then get returns the same value
+        #[test]
+        fn page_selection_roundtrip(
+            cat in "[A-Za-z][a-z]{1,7}",
+            item in "[A-Za-z][a-z]{1,7}",
+        ) {
+            let mut v = View::new("T");
+            v.set_page_selection(&cat, &item);
+            prop_assert_eq!(v.page_selection(&cat), Some(item.as_str()));
+        }
+
+        /// hide/show round-trip: hiding then showing leaves item visible
+        #[test]
+        fn hide_show_roundtrip(
+            cat in "[A-Za-z][a-z]{1,7}",
+            item in "[A-Za-z][a-z]{1,7}",
+        ) {
+            let mut v = View::new("T");
+            v.hide_item(&cat, &item);
+            prop_assert!(v.is_hidden(&cat, &item));
+            v.show_item(&cat, &item);
+            prop_assert!(!v.is_hidden(&cat, &item));
+        }
+
+        /// toggle_group_collapse is its own inverse
+        #[test]
+        fn toggle_group_collapse_involutive(
+            cat in "[A-Za-z][a-z]{1,7}",
+            group in "[A-Za-z][a-z]{1,7}",
+        ) {
+            let mut v = View::new("T");
+            let initial = v.is_group_collapsed(&cat, &group);
+            v.toggle_group_collapse(&cat, &group);
+            v.toggle_group_collapse(&cat, &group);
+            prop_assert_eq!(v.is_group_collapsed(&cat, &group), initial);
+        }
+    }
+}