Search Pull Worker PostgreSQL Restart Proof

Scope

This disposable proof starts the real search-service binary with its environment-created projection freshness worker, one fresh PostgreSQL database, and four local HTTP owner fixtures. It does not use a Gateway route, a caller database, an existing Compose stack, or a legacy source write.

Each owner fixture serves two pages for one copied entity type: question, course, exam, or document. The first process has a one-page cap, so it writes four PARTIAL checkpoints with nextPage=2 and four copied documents. After it stops, a new search-service process reads those persisted cursor/page checkpoints, requests page two, then writes four SYNCED checkpoints with nextPage=1 plus the second copied document from each owner.

Command

SEARCH_PROJECTION_PULL_WORKER_POSTGRES_CONFIRM=disposable-postgres \
  make test-search-projection-pull-worker-postgres

The runner verifies search_documents, search_sync_states, native /v1/search, native /v1/sync-state/{sourceService}/{entityType}, and the worker's structured latencyMs logs. It removes the disposable container and processes on exit while keeping an artifact under output/qa/search-projection-pull-worker-postgres-<timestamp>/.

Latest Local Evidence

On 2026-07-15, the command passed with artifact output/qa/search-projection-pull-worker-postgres-26524-1784068465/summary.json. The first process wrote four PARTIAL checkpoints and four documents. After restart, all four persisted cursor/page checkpoints reached SYNCED, native reads returned two documents for each COURSE, DOCUMENT, EXAM, and QUESTION, and the copied entity summary was COURSE:2,DOCUMENT:2,EXAM:2,QUESTION:2. The worker logs included a per-owner latencyMs value, so this recovery proof is suitable as a local measurement baseline but does not justify a production cadence change.

Boundary

This proves local owner-source pull recovery and latency observability only. It does not promote a public route: legacy /api/public/catalog* remains a course/document/exam composition surface, not a search-service target. Browser parity, production owner latency, broker end-to-end delay, and default Gateway promotion remain separate gates.