refactor(db): move thread store ownership

[TheSentinel454]

Current reconstructed head

Exact base: codex/issue-2-event-query-store at 02d75823c301f935d767d15d7c70b031c7a0d35f
Exact head: codex/issue-2-thread-store at 15bf0e76286540a4102193b70a7058735df79f60

This current head removes crates/buzz-db/tests/store_ownership.rs; no replacement path-sensitive ownership test is introduced. Apart from removing that complete test-file diff, the production patch is byte-for-byte identical to the previously reviewed slice. This remains part of tracker #2 and the #17/#19 acceptance work.

Independent exact-head review from a separate clean Blox workstation found no issues. Current-head evidence passed formatting, strict buzz-db clippy, 111 non-PostgreSQL library tests with 200 PostgreSQL tests ignored, the observability source test, relay consumer compilation, exact ownership/unique-span review checks, and 10 thread PostgreSQL tests on native PostgreSQL where applicable.

Why

Continue tracker #2 by moving thread persistence ownership out of lib.rs while preserving the runtime/read-routing boundary introduced by the parent event/query slice and PR #6700. This child stacks on #6788.

What

• Move the seven thread-facing Db APIs into thread.rs: thread metadata insert/lookup/decrement, reply reads, summary reads, and channel-window reads (including its request-scoped ReadSession variant)
• Keep the SQL functions, thread records, and ten focused PostgreSQL tests beside those wrappers in thread.rs
• Preserve the replica route predicates, fence proof, terminal-page writer verification, fallback behavior, metric labels, and exactly one datastore span per logical operation
• Keep route_read, ReadSession, route proofs, connection/session state, and the cross-cutting routing tests in lib.rs
• Add the repository-prescribed inline sadscan suppression for the unchanged local PostgreSQL test fixture URI after moving content caused that existing fixture to be scanned by the commit hook

Stack

• Exact base: codex/issue-2-event-query-store at ce2d9b3 (#6788)
• Exact head: codex/issue-2-thread-store at d43426e
• Tracker: buzz-db: break up lib.rs — move impl Db methods to domain modules TheSentinel454/buzz#2
• Domain issue: none; this is a remaining thread-domain slice identified by the tracker ledger
• Test/span acceptance: buzz-db: move lib.rs tests (~4,000 lines) to domain modules TheSentinel454/buzz#17 and buzz-db: consistent #[datastore_span] tracing placement TheSentinel454/buzz#19

Non-goals

• No SQL, schema, locking, transaction, routing, retry, timeout, pagination, or client-visible behavior changes
• No movement of route_read, route proof/session infrastructure, or cross-cutting routing tests out of lib.rs
• No store traits, domain-handle redesign, broad PgExecutor migration, raw pool accessor, new crate, or directory-wide reorganization
• No changes to, retargeting of, or merge action on parent PRs or PR Add database pressure observability #6700

Risk Assessment

Low. The wrapper bodies moved intact. The only path qualifications are required by their new module; the route decision, fence-wall post-verification, writer fallback, SQL functions, binds, and public Db signatures are unchanged.

Blox Verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head 6ad4db60d06329478d51aa650f1123e762ba7eb8.

• cargo fmt --all --check and git diff --check — passed
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings — passed
• Native PostgreSQL: DATABASE_URL=postgres://buzz:…@localhost:5432/buzz cargo test -p buzz-db thread::tests:: -- --ignored --test-threads=1 — 10 passed
• Native PostgreSQL: six ignored replica/thread/channel-window routing checks passed; the seventh relevant routing predicate test is non-ignored and passed in the DB unit suite
• cargo test -p buzz-relay --lib -- --test-threads=1 — final rerun 909 passed, 48 ignored. An initial run had one unrelated mesh-demo timeout (908 passed, 1 failed); the exact failed test passed on immediate rerun before the full green rerun
• Commit-time formatting, sadscan (with reviewed inline false-positive suppression), attribution, and sign-off hooks — passed

Independent exact-head review: buzz-tornquist-pr-6789-review (2050687) checked clean detached head 6ad4db60d06329478d51aa650f1123e762ba7eb8 over exact merge-base a8a0975585d691fff554cae16ee3b1fc811b8366. No actionable findings at any severity. SQL hashes were identical; wrapper hashes matched after only path/whitespace normalization; runtime route/session/proof ownership and all cross-cutting tests remained in lib.rs; and the sadscan suppression was verified to be scoped to the pre-existing local fixture URI. Independent fmt, diff checks, clippy, 108 DB tests, 10/10 thread PostgreSQL tests, 11 relevant routing/predicate tests, and 909 relay tests all passed on PostgreSQL 17.11 with migrations 1–32.

Generated with Codex

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

• Workstation: buzz-tornquist-pr-6789-final-review (2057623), fresh shallow checkout
• Base: ff7f57fafe20354b1608683edb056f3f6486fdb6
• Head: a03619b3f5e2c981de704be13f609f117eaf6fa1
• Findings: none

Reviewed thread metadata/reply/window Db wrappers and focused tests moving to thread.rs. Cross-cutting route selection and read-session internals remain in lib.rs. The convenience channel-window method continues to delegate to the session-returning method, with exactly one get_channel_window span across the logical operation. Reply counters, pagination/tie ordering, route proof behavior, SQL, and public signatures are retained.

Verification: format and diff checks passed; buzz-db --all-targets clippy passed with -D warnings; DB lib tests passed (111 passed, 200 PostgreSQL tests ignored); ownership (7/7) and observability (1/1) guards passed; all 10 thread PostgreSQL tests passed on native PostgreSQL 17 with migrations 1-32 successful; relay lib test target compiled successfully. Final worktree was detached at the exact head and clean.

Complete evidence archive SHA-256: 96a80e2feee6bc153fb8afabcdee04f4b820fb9f70b5310db5b92da67997f9e4.

Comment-addressed restack

Review follow-up on #6777 removed only the low-value replaceable ownership source test. This PR was restacked onto its rewritten parent; its production patch is unchanged.

• Exact base: ce2d9b3d8f599cf1c0dfe4abb8f2a8c116a0d329
• Exact head: d43426ed89b89d49e44a75f4a4e1e57f4915c087
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Per-layer patch-ID and tree audits confirm this PR’s production diff is unchanged from its pre-comment head.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict Clippy, DB lib 111 passed / 200 ignored, current ownership/observability guards, 10 thread PostgreSQL tests, and relay compilation.