The free producer must never emit an IR the schema rejects. If it does, the constructor and the contract have drifted.

(require '[clojure.test.check.clojure-test :refer [defspec]]
         '[clojure.test.check.properties :as prop]
         '[clojure.test.check.generators :as gen]
         '[pocket-es.dsl :as dsl])

(defn free-ir
  "Mirror of run-free!'s IR constructor (CLJS side builds the JS equivalent)."
  [text]
  {:query {:multi_match {:query text
                         :fields ["title^3" "keywords^2" "description"
                                  "headings^2" "terms"]}}
   :size 200})

(defspec free-mode-ir-always-valid 500
  (prop/for-all [s gen/string]
    (nil? (dsl/explain (free-ir s)))))

A failure here is finding #2 from the L7 review: a field in the fan-out (terms) absent from the closed set. The schema's +fields+ and ::boost already include terms; this test is what keeps them in sync.

mode      = #pes-json-toggle:checked ? "json" : "free"
freeShown = getComputedStyle('#pes-input').display    != "none"
jsonShown = getComputedStyle('#pes-json-input').display != "none"
hitCount  = document.querySelectorAll('#pes-results .pes-hit').length
errShown  = !!document.querySelector('#pes-results .pes-error')
size      = 200 in free mode; parsed .size or engine default in json mode

• INV-5, surface exclusivity – always (mode = "free" implies freeShown and not jsonShown)= and always (mode = "json" implies jsonShown and not freeShown)=.
• INV-9, bounded results – always (hitCount < size)=.
• Error visibility (the anti-silent-failure property) – in JSON mode, now (textarea holds malformed JSON) implies eventually-within 1s (errShown). This is the property that would have caught the silent-empty-results bug: a malformed-but-parseable IR must surface an error, never render as zero hits.
• INV-6, no auto-translation – now (toggle flips) implies (query text in the newly active surface is unchanged from its prior value) – i.e. flipping the toggle does not rewrite what the user typed.
• Liveness – always (typing a non-empty common term in free mode implies eventually (hitCount > 0)) for terms known to be in the corpus.

Bound runs with --time-limit, not a step count; keep the boundary on the search surface origin.

# real-browser drive (watch the run); managed-chromium path also works
chromium --remote-debugging-port=9992 &
bombadil test-external --remote-debugger http://localhost:9992 \
  --create-target --time-limit 120 \
  http://localhost:8000/research/pocket-es/

Pure UI; no contract. Already verified end-to-end (Playwright): toggle exists, default unchecked, free input visible / textarea hidden, mode swap, ?j=1 URL sync, invalid-JSON inline error, valid JSON query returns hits, Tab-complete (skeleton seed + prefix completion). Bombadil: INV-5 only.

• [X] gmake cljs builds clean (0 warnings)
• [X] bundle gzip delta acceptable (32KB → 35KB)
• [X] manual: toggle sits right of the cluster line, adds no vertical row

1. Author src/pocket_es/dsl.cljc (tangled from query-surface-spec).
2. Measure malli gzip first (L7 finding): if malli.core + malli.error adds >3KB gzip, ship a hand-rolled valid?=/=explain in CLJS and keep malli build-time-only for the JSON-Schema emit. Record the number here.
3. Wire run-structured! to validate via dsl/explain in the JSON branch and render inline; pass the JS object to search unchanged (INV-8).
4. Tests: test.check INV-2, INV-3, generator sanity (clojure -M:test).
5. Bombadil: add the error-visibility property.
6. [ ] dsl/explain returns nil on valid IR, humanized errors on invalid
7. [ ] INV-2 spec passes at 500 iterations (free-mode IR always valid)
8. [ ] INV-8: a console call pocketES.search(parsed) and the UI path produce identical results (no double-convert regression)
9. [ ] malformed-but-parseable IR (, ={query:{bool:{}}}) shows an inline error, never zero silent hits

1. mode atom (:free default), URL-synced via j; restore on init + popstate.
2. Textarea swap; Tab-complete over the closed vocabulary; suppress completion inside JSON string literals (L7 finding: ma| in a value must not become match).
3. Clear the shared debounce timer on mode switch (L7 finding).
4. Tests: unit for URL round-trip (INV-7); bombadil INV-5/6/9.
5. [ ] reload at ?q…&j=1= restores JSON mode + textarea contents
6. [ ] back/forward restores mode and query
7. [ ] flipping the toggle does not rewrite typed text (INV-6)
8. [ ] Tab inside a string value does not corrupt the value

Gated on the refutation condition: a recurring hand-typed bool blob. Until then, do not build. When built: simple and lucene producers compile to the same IR; INV-4 print/parse round-trip property; reuse one recursive-descent parser with two configs.