Document Search Projection Broker Smoke

This proof is local and disposable. It starts isolated PostgreSQL containers for document-service and Search plus isolated NATS JetStream. It does not use Compose, a caller-provided database, a Gateway route, or a default-route promotion.

Run from the repository root:

DOCUMENT_SEARCH_PROJECTION_OUTBOX_POSTGRES_CONFIRM=disposable-postgres \
  make test-document-search-projection-outbox-postgres
DOCUMENT_SEARCH_PROJECTION_BROKER_SMOKE_CONFIRM=disposable-runtime \
  make test-document-search-projection-broker-live

On 2026-07-14 both commands passed. The PostgreSQL proof verifies atomic outbox creation, monotonic per-document revisions, old-scope DELETE plus new-scope UPSERT on organization move, archive and physical-delete DELETE tombstones, rollback without an orphan row, and lease/retry/dead state. The broker smoke builds disposable local binaries and verifies:

• A canonical document row creates a redacted DOCUMENT copied-index event and Search indexes it.
• A newer owner mutation published while Search is stopped is recovered after durable subscriber restart.
• Duplicate replay is idempotent; a replay with a fresh event id but old source version is recorded stale and cannot overwrite the newer copied row.
• POST /v1/admin/documents/{id}/archive produces a DELETE tombstone; a stale pre-archive UPSERT cannot resurrect the row.

The owner transport remains disabled unless DOCUMENT_SEARCH_PROJECTION_EVENT_TRANSPORT=nats is explicitly configured. When enabled, a broker that is unavailable during Document startup leaves the publisher reconnecting and the durable outbox retryable; it does not require a Document process restart before recovery. The pull rebuild worker remains rollback/reconciliation. This evidence does not prove Course or Exam producer transport, browser parity, Gateway behavior, deployed runtime, or default-route promotion.