Property-test Markdown frontmatter parsing

[adewale]

What

• Add a structured Hypothesis property for TOML frontmatter plus arbitrary Markdown bodies.
• Assert exact metadata, body preservation, and body-line accounting through the production parser.
• Add Hypothesis to the locked development dependency group.
• Update the locked Wrangler toolchain to 4.137.0, which carries fixed Undici and Sharp releases required by the repository's high-severity audit gate.
• Record the TOML/Markdown generator and oracle rule in docs/lessons-learned.md.

Why

Example source files combine two grammars at one trust boundary. The existing unittest suite covered examples but did not generate escaping, Unicode, empty values, and arbitrary Markdown combinations with shrinking.

The hosted audit began rejecting Wrangler 4.114.0 after high-severity Undici advisories were published, then rejected Wrangler 4.127.1 after the Sharp/libheif advisory landed. Wrangler 4.137.0 is the current release selected by npm's remediation and resolves both dependency chains.

How

The generator builds valid TOML string fields with variable frontmatter height and an independent Markdown body, then calls _split_frontmatter and checks both sides of the boundary exactly. A deterministic example covers escaped metadata, delimiter-shaped metadata, and a later +++ Markdown line. The test remains collectable by the repository's unittest runner. The project lesson preserves the need to reach the valid-frontmatter path without rebuilding the production parser as the oracle.

Testing

• Full Python suite: 225 tests passed
• Ruff passed
• The focused property passed 5,000 generated cases plus the deterministic delimiter case
• Mutation checks confirmed the property fails if _split_frontmatter hardcodes body line 5 or searches backward for the closing delimiter
• Clean npm install succeeded, Wrangler reports 4.137.0, and npm audit --audit-level=high found 0 vulnerabilities
• Hosted Verify passed under Node 22, including locked installs, Worker startup, browser checks, format checks, and the high-severity npm audit

Risk

No application-runtime code changes. The Worker development toolchain moves within Wrangler 4.x and CI exercises it under the repository's required Node 22 runtime.