fix(api): avoid universal NDJSON stream errors and unify stream error propagation

[BigSimmo]

Summary

• Emit a redacted structured NDJSON error when universal search fails asynchronously, close the server stream, and have the client reject with a stable generic error.
• Cancel an open response body when that error event is consumed so upstream stream work is released rather than remaining attached.
• Add focused server and consumer regression coverage without changing search ranking, clinical content, authentication, privacy, or provider configuration.

Verification

• Focused Web Streams adversarial harness: 9/9 passed, covering split chunks, progressive groups, completion parity, abort cancellation, truncation, structured errors, cancellation failure, delayed cancellation, partial results, and server cancellation.
• Exact-head Static PR checks passed, including formatting, lint, typecheck, ledger integrity, documentation, and repository contracts.
• Exact-head Build and bundle-budget checks passed.
• Exact-head Unit coverage and coverage-inventory gates passed.
• Exact-head Safety/config, SAST, Semgrep, Gitleaks, GitGuardian, and secret-scan checks passed.
• The repository-triggered Lighthouse budget passed; every graded route remained within tolerance after confirmation sampling of one transient first measurement.

Risk and rollout

• Risk: Low. The change is limited to the universal-search NDJSON error path and cleanup of an open response body. Successful group and completion events are unchanged.
• Rollback: Revert the PR commits to restore the prior generic stream-failure behaviour.
• Provider or production effects: None. No deployment, live evaluation, credentialed provider call, database change, or production mutation was performed.

Clinical Governance Preflight

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Notes

• No clinical decision-support, retrieval-order, ranking, source-selection, or content behaviour changed.
• Branch was updated by merging the latest main; no rebase, force-push, deployment, release, or auto-merge modification was performed.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:22 minutes

Limit details: You’ve used all 1 included review currently available under your plan. You completed 90 included PR reviews in the past 7 days; at that activity level, included reviews refill at 1 review per hour.

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 318d57a0-da32-466b-bdc8-f89b6e2f61c5

📥 Commits

Reviewing files that changed from the base of the PR and between 27f6b60 and 149db19.

📒 Files selected for processing (5)

• docs/branch-review-records/2f102c68fe61b45d4dbfd9b43a1ca1d14a753cf9a1522a6298f9286d8835adfd.record.md
• src/app/api/search/universal/route.ts
• src/lib/universal-search-stream.ts
• tests/universal-search-stream.test.ts
• tests/universal-search.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

CI triage

CI failed on this PR. Automated classification of the 2 failed job(s):

• Static PR checks — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.
• PR required — needs investigation: inspect the failing step and uploaded diagnostics; rerun only after classifying the cause.

Compared with main CI run #11163 (success).

Classification is evidence routing, not permission to ignore a failure. Exact quarantined Playwright identities remain governed by the flake ledger.

[BigSimmo]

Final Codex review summary

• Final state: PR fix(api): avoid universal NDJSON stream errors and unify stream error propagation #2002 was externally squash-merged by the repository’s existing auto-merge workflow at 2026-08-16 12:37:23 UTC. Codex did not invoke merge and did not arm, disarm, pause, cancel, or modify auto-merge.
• Reviewed head:149db191031fa4b74faf823abea0298f89115a36
• Latest base included before merge:27f6b60429ab56a0e4a779b5b16c35e9cce630db
• Merge commit on main:a96dcbb6280ab6889c3b443be4d348950786a809
• Tree integrity: the merge commit tree 2e5a44f20aeb9619cd4cb722d9de781627f5c891 exactly matches the reviewed head tree. main points to the merge commit.
• Branch update and merge-tree: latest main was merged into the PR branch without rebase or force-push. Before external merge, the PR was current with base, mergeable, and had a clean merge-tree.

Issues fixed and dispositioned

• Preserved the PR’s redacted structured NDJSON error event and stable client-side rejection contract.
• Fixed one reproducible PR-introduced P2: consuming a structured stream error now cancels an otherwise-open response body, releasing upstream stream/network work.
• Added focused regression coverage for error rejection and cancellation.
• Corrected the changed-file formatting failure and completed the repository’s clinical-governance PR preflight. No P0 or P1 defects were found.

Adversarial review and threads

• CodeRabbit and the separate Codex reviewer were unavailable because of review limits, so a distinct manual adversarial pass was performed and disclosed.
• The final diff was re-read and the cancellation fix was challenged against cancellation rejection and delayed cancellation. The original generic error remains prompt and is not masked.
• Review threads: none. Submitted reviews: none. Existing rate-limit, Supabase-skip, and superseded CI-triage bot comments were non-actionable.

Verification

• Focused local Web Streams harness: 9/9 passed, covering split chunks, progressive groups, completion parity, abort cancellation, truncation, structured errors, cancellation failure, delayed cancellation, partial results, and server cancellation.
• Exact-head required aggregate PR required: success.
• Exact-head PR policy, PR mergeability, Static PR checks, Safety and config checks, Unit coverage, Build, and the repository-triggered Lighthouse budget: success.
• Exact-head SAST, Semgrep, Secret Scan, Gitleaks, and GitGuardian: success.
• Scope-inapplicable UI, visual-baseline, migration replay, container, release-browser, and Supabase-preview paths were skipped by repository routing. No deployment, production test, live evaluation, credentialed provider call, or release was run.

Blockers and residual risk

• Blockers: none at merge.
• Residual risk: low and limited to unexercised live/provider environments, which were outside scope and not required for this transport-layer error-path change.

The requested unmerged-state sentence — “The PR was not merged. Final merge is left to the user.” — became inapplicable because the repository’s existing auto-merge completed externally after all required checks passed.