Search Projection Broker Smoke

This proof is local and disposable. It starts isolated PostgreSQL containers for Question Bank and Search plus an isolated NATS JetStream container. It does not use Compose, a caller-provided database, a Gateway route, or a default-route promotion.

Run from the repository root:

SEARCH_PROJECTION_BROKER_SMOKE_CONFIRM=disposable-runtime \
  make test-search-projection-broker-live

The script builds the local question-bank-service and search-service binaries, enables their NATS transport only for that disposable runtime, and proves all of the following for question-bank-service / QUESTION:

• A canonical owner write publishes a redacted copied-index envelope and Search indexes it.
• A newer owner mutation published while Search is stopped is recovered after the durable subscriber restarts.
• Replaying the exact old envelope is idempotent; replaying it with a new event id is recorded stale and cannot overwrite the newer index row.
• A DELETE tombstone removes the copied row; replaying the prior UPSERT remains stale and cannot resurrect it.

Question Bank's lease, retry, terminal-dead state, and concurrent-claim behavior have separate unit and disposable PostgreSQL coverage:

QUESTION_SEARCH_PROJECTION_OUTBOX_POSTGRES_CONFIRM=disposable-postgres \
  make test-question-search-projection-outbox-postgres

The existing SEARCH_REBUILD_WORKER_ENABLED=1 pull worker remains the reconciliation and rollback fallback. Course, exam, and document publishers are not enabled by this proof, and it does not authorize a Gateway or production default-route change.