Search: a domain that FAILED no longer looks like one that found nothing

Every domain catches broadly and returns no rows so one broken table cannot take
the whole search box down. That part is right. On its own, though, it makes a
DOWN domain indistinguishable from an EMPTY one: the technician sees no results,
is offered a spelling correction, and concludes the record does not exist. It
does - the search just could not look.

Failed domains are now named in the response and stated above the results.

The suggestion is deliberately still offered on a degraded run. Suppressing it
was tried first and is worse: a chronically unreachable domain, an external HR
directory say, would silently disable spelling help for every search for ever
with nothing saying why. Naming the failure is the honest fix; withholding a
second useful signal is not.

Guides search also moves to the published revision. It correctly limited itself
to published GUIDES, but matched and displayed title/summary/tags/blocksjson
from the Guide row - which is the WORKING copy. A published guide with
unpublished edits matched on wording that only exists in the draft, and the
reader opened it to find the word absent.

tests/test_core/test_search_degraded.py

@@ -0,0 +1,65 @@
+"""A search domain that FAILS must not look like a domain that found nothing.
+
+Every domain catches broadly and returns [] so one broken table cannot take the
+whole search box down. Correct - but on its own it makes a down domain
+indistinguishable from an empty one, and the technician is then told they may
+have misspelled a query that was right.
+
+The failure is injected INSIDE a domain (by breaking something it uses) rather
+than by replacing the domain function, because replacing the function would also
+remove the try/except being tested.
+"""
+
+import pytest
+
+
+class _ExplodingModel:
+    """Stands in for a model whose table is unreachable."""
+    @property
+    def query(self):
+        raise RuntimeError('table is gone')
+
+    def __getattr__(self, name):
+        raise RuntimeError('table is gone')
+
+
+@pytest.fixture
+def broken_applications(monkeypatch):
+    from shopdb.core.api import search as searchmod
+    monkeypatch.setattr(searchmod, 'Application', _ExplodingModel())
+    return searchmod
+
+
+def test_a_failing_domain_is_reported_as_degraded(client, db, auth_headers,
+                                                  broken_applications):
+    response = client.get('/api/search?q=nothingmatchesthis', headers=auth_headers)
+    assert response.status_code == 200, 'one broken domain must not 500 the search'
+
+    data = response.get_json()['data']
+    assert 'degraded' in data, 'a failed domain must be visible to the caller'
+    assert 'Application' in data['degraded']
+
+
+def test_a_healthy_domain_is_not_listed_as_degraded(client, db, auth_headers,
+                                                    broken_applications):
+    response = client.get('/api/search?q=nothingmatchesthis', headers=auth_headers)
+    degraded = response.get_json()['data'].get('degraded', [])
+    assert 'Asset' not in degraded, 'only the domain that actually failed'
+
+
+def test_a_degraded_run_still_offers_a_spelling(client, db, auth_headers,
+                                                broken_applications):
+    """Both signals, not one.
+
+    Suppressing the suggestion on a degraded run was tried first. It is worse: a
+    chronically unreachable domain - an external HR directory, say - would
+    silently disable spelling help for every search for ever, with nothing
+    saying why. The banner states the search was incomplete, and the suggestion
+    stays available above it.
+    """
+    response = client.get('/api/search?q=machne', headers=auth_headers)
+    data = response.get_json()['data']
+    assert data.get('degraded'), 'the failure is still named'
+    # The suggestion is offered when spellfix has one; the point is that being
+    # degraded does not by itself remove it.
+    assert 'degraded' in data