Every search request carries an x-ls-token header read from localStorage and an x-ss-token header read from sessionStorage — both stored client-side, never derivable from the request itself. Fixture for the ADR-0021 Web Storage provenance feature.