Course Search Projection Broker Smoke

This proof is local and disposable. It starts isolated PostgreSQL containers for course-service and Search plus isolated NATS JetStream. It does not use Compose, a caller-provided database, a Gateway route, or a default-route promotion.

Run from the repository root:

COURSE_SEARCH_PROJECTION_OUTBOX_POSTGRES_CONFIRM=disposable-postgres \
  make test-course-search-projection-outbox-postgres
COURSE_SEARCH_PROJECTION_BROKER_SMOKE_CONFIRM=disposable-runtime \
  make test-course-search-projection-broker-live

On 2026-07-14 both commands passed. The PostgreSQL proof verifies atomic outbox creation, monotonic per-course/per-organization revisions, copied count coalescing, rollback without an orphan row, old-scope DELETE/new-scope UPSERT on organization move, archive ARCHIVED UPSERT, physical-delete tombstone, and lease/retry/dead state. The broker smoke builds disposable local binaries and verifies:

• A canonical course row creates a redacted COURSE copied-index event and Search indexes it.
• A count-affecting owner mutation published while Search is stopped is recovered after durable subscriber restart.
• Duplicate replay is idempotent; a replay with a fresh event id but old source version is recorded stale and cannot overwrite the newer copied row.
• DELETE /v1/courses/{id} preserves the owner projection as an ARCHIVED UPSERT; it is not a search DELETE.
• Physical deletion emits a DELETE tombstone; a stale earlier UPSERT cannot resurrect the copied row.

The owner transport remains disabled unless COURSE_SEARCH_PROJECTION_EVENT_TRANSPORT=nats is explicitly configured. When enabled, a broker that is unavailable during Course startup leaves the publisher reconnecting and the durable outbox retryable; it does not require a Course process restart before the same persisted envelope can be delivered. Search pull rebuild skips an entity after it has accepted a versioned event, so event-owned recovery uses outbox retry/replay rather than a blind pull overwrite. This evidence does not prove Exam producer transport, browser parity, Gateway behavior, deployed runtime, or default-route promotion.