Exam Search Projection Broker Smoke

This proof is local and disposable. It starts isolated PostgreSQL containers for exam-service and Search plus isolated NATS JetStream. It does not use Compose, a caller-provided database, a Gateway route, or a default-route promotion.

Run from the repository root:

EXAM_SEARCH_PROJECTION_OUTBOX_POSTGRES_CONFIRM=disposable-postgres \
  make test-exam-search-projection-outbox-postgres
EXAM_SEARCH_PROJECTION_BROKER_SMOKE_CONFIRM=disposable-runtime \
  make test-exam-search-projection-broker-live

On 2026-07-14 both commands passed. The PostgreSQL proof verifies atomic outbox creation, monotonic per-exam/per-organization revisions, copied question/access-link/assignment count coalescing, rollback without an orphan row, redaction, physical-delete tombstone, lease/retry/dead state, and the concurrent parent/child trigger ordering that prevents a higher source version from carrying a stale parent title. The broker smoke builds disposable local binaries and verifies:

• A canonical exam row creates a redacted EXAM copied-index event and Search indexes it.
• A copied snapshot-count mutation published while Search is stopped is recovered after durable subscriber restart.
• Duplicate replay is idempotent; a replay with a fresh event id but old source version is recorded stale and cannot overwrite the newer copied row.
• CLOSED remains an owner UPSERT; it is not a search DELETE.
• Physical deletion emits a DELETE tombstone; a stale earlier UPSERT cannot resurrect the copied row.

The owner transport remains disabled unless EXAM_SEARCH_PROJECTION_EVENT_TRANSPORT=nats is explicitly configured. When enabled, a broker that is unavailable during Exam startup leaves the publisher reconnecting and the durable outbox retryable; it does not require an Exam process restart before recovery. Search pull rebuild skips an entity after it has accepted a versioned event, so event-owned recovery uses outbox retry/replay rather than a blind pull overwrite. Existing publish/snapshot workflows can commit several canonical transactions; this proof guarantees an outbox event for each committed mutation instead of claiming one transaction for the complete workflow. It does not prove browser parity, Gateway behavior, a deployed runtime, or default-route promotion.