test(search): validate focused live document search

docs/branch-review-ledger.md

@@ -1149,3 +1149,4 @@ Records before 2026-07-28 were written by hand and had drifted: 146 lines carrie
 | 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `62ddd24dc8ad223cde67373ea35e18aee6065057` | CI green closeout | APPROVE. Hosted Production UI + PR required PASS on product tip `e5543dc6`. Codex/CodeRabbit threads resolved (0 open). Unique delta: diagnosis-detail S: locator + heading hierarchy contract. RAM-guard owned by main #1307. | Hosted Static/Unit/Safety/Advisory/Production UI/PR required PASS; Build/Container skipped (unchanged); Bugbot clean; no provider-backed checks. |
 | 2026-07-28 | PR #1294 / `execute-typography-fixes-clean-2` | `f64fa84a8010008917619c16aac79e4f172a70ff` | Ledger dedupe after main sync | Removed 2 exact duplicate #1307 rows introduced by merge=union during main sync (kept first copies). Hosted required checks green on prior product tip `e5543dc6`; this tip is ledger hygiene + docs-only main sync. | `check:branch-review-ledger` PASS after dedupe; no provider-backed checks. |
 | 2026-07-28 | PR #1310 / claude/branch-review-ledger-fixes-42575f | 7c870c139211a419fe8b4dfacae3195a7a7caa2b | PR babysit: CI + Codex P2s + Bugbot-equivalent | Hosted PR required SUCCESS on 7c870c13. Fixed 3 Codex P2s (exact scope match, supersede mints distinct scope, verify full SHAs via git rev-parse) plus n/a-embedded hex and parenthetical ref-token false matches. 3 review threads replied+resolved. Mergeable; 0 behind main. Hosted Cursor Bugbot check not produced — bot-authored bugbot run/cursor review comments ignored; local Bugbot-style review done and defects fixed. | check:branch-review-ledger PASS; vitest repo-hygiene 25/25; lint; typecheck; full vitest 4133 pass; hosted Static/Unit/Build/Safety/PR-required SUCCESS. No provider-backed gates. |
+| 2026-07-28 | codex/universal-search-live-test-fix | 9f5994069cddb8a58308d9d5acb9403948a7f617 | live universal-search owner test handoff | APPROVE. Test-only fix aligns live owner coverage with the intentional federated and focused document timeout contract; no production behavior changed. | Node TypeScript syntax PASS; git diff --check PASS; full local gates blocked by an active exclusive repository lease; hosted required checks pending; no live provider tests run. |

tests/universal-search-owner.live.test.ts

@@ -29,33 +29,50 @@ describe("GET /api/search/universal (live owner auth)", () => {
     });
     if (error) throw new Error(`Live owner-auth sign-in failed: ${error.message}`);
     const token = data.session?.access_token;
-    expect(token).toBeTruthy();
-
-    const { GET } = await import("../src/app/api/search/universal/route");
-    const response = await GET(
-      new Request("http://localhost/api/search/universal?q=acamprosate&limit=3", {
-        headers: { Authorization: `Bearer ${token}` },
-      }),
-    );
-    expect(response.status).toBe(200);
-
-    const payload = (await response.json()) as {
+    type SearchPayload = {
       demoMode?: boolean;
       publicAccess?: boolean;
       groups: Array<{ kind: string; error?: boolean; items: Array<{ href: string }> }>;
     };
-    expect(payload.demoMode).toBeUndefined();
-    expect(payload.publicAccess).toBeUndefined();
 
-    const medications = payload.groups.find((group) => group.kind === "medications");
-    expect(medications?.error).toBeUndefined();
-    expect(medications?.items.length ?? 0).toBeGreaterThan(0);
-    expect(medications?.items[0]?.href).toContain("/medications/");
+    try {
+      expect(token).toBeTruthy();
+
+      const { GET } = await import("../src/app/api/search/universal/route");
+      const response = await GET(
+        new Request("http://localhost/api/search/universal?q=acamprosate&limit=3", {
+          headers: { Authorization: `Bearer ${token}` },
+        }),
+      );
+      expect(response.status).toBe(200);
+
+      const payload = (await response.json()) as SearchPayload;
+      expect(payload.demoMode).toBeUndefined();
+      expect(payload.publicAccess).toBeUndefined();
+
+      const medications = payload.groups.find((group) => group.kind === "medications");
+      expect(medications?.error).toBeUndefined();
+      expect(medications?.items.length ?? 0).toBeGreaterThan(0);
+      expect(medications?.items[0]?.href).toContain("/medications/");
 
-    const documents = payload.groups.find((group) => group.kind === "documents");
-    expect(documents?.error).toBeUndefined();
+      // Federated search intentionally gives documents a short latency budget. Prove the
+      // authenticated document path separately so a valid federated timeout is not a failure.
+      const focusedResponse = await GET(
+        new Request("http://localhost/api/search/universal?q=acamprosate&limit=3&domains=documents", {
+          headers: { Authorization: `Bearer ${token}` },
+        }),
+      );
+      expect(focusedResponse.status).toBe(200);
 
-    const signOut = await supabase.auth.signOut();
-    if (signOut.error) throw new Error(`Live owner-auth sign-out failed: ${signOut.error.message}`);
+      const focusedPayload = (await focusedResponse.json()) as SearchPayload;
+      expect(focusedPayload.demoMode).toBeUndefined();
+      expect(focusedPayload.publicAccess).toBeUndefined();
+      const documents = focusedPayload.groups.find((group) => group.kind === "documents");
+      expect(documents).toBeDefined();
+      expect(documents?.error).toBeUndefined();
+    } finally {
+      const signOut = await supabase.auth.signOut();
+      if (signOut.error) throw new Error(`Live owner-auth sign-out failed: ${signOut.error.message}`);
+    }
   });
 });