refactor(db): move relay membership store ownership

[TheSentinel454]

Current reconstructed head

Exact base: codex/issue-2-workflow-runs-approval-store at 1db9c199a2e0029e38228a9bf9ecb78d8d61ab16
Exact head: codex/issue-2-relay-members-store at 349a3d9bff5a9b292ef61fea1705f155ea1c405d

This current head removes crates/buzz-db/tests/store_ownership.rs; no replacement path-sensitive ownership test is introduced. Apart from removing that complete test-file diff, the production patch is byte-for-byte identical to the previously reviewed slice. This remains part of tracker #2 and the #17/#19 acceptance work.

Independent exact-head review from a separate clean Blox workstation found no issues. Current-head evidence passed formatting, strict buzz-db clippy, 111 non-PostgreSQL library tests with 200 PostgreSQL tests ignored, the observability source test, relay consumer compilation, exact ownership/unique-span review checks, and 10 relay-membership PostgreSQL tests on native PostgreSQL where applicable.

Summary

Continue tracker #2 by making relay_members.rs own the relay-membership persistence boundary. The roster records, SQL, allowlist backfill, and focused PostgreSQL tests already lived there; this child moves the remaining Db APIs and datastore spans out of lib.rs, including the bounded routed membership read and the locked NIP-43 snapshot reconciliation/publication operations.

has_admin_or_owner was the one pre-existing unspanned facade; it now has a fixed-name, no-cardinality datastore span.

Stack

• Tracker: TheSentinel454/buzz#2
• Test ownership acceptance: #17
• Span ownership acceptance: #19
• Exact base: codex/issue-2-workflow-runs-approval-store at 723b40d (#6799)
• Exact head: codex/issue-2-relay-members-store at 75a5146

Domain moved

• Thirteen canonical relay-roster facades and spans: membership lookup/list/add/claim, policy acceptance, guarded removal, role update, owner bootstrap/check/transfer, and allowlist backfill
• Bounded routed is_relay_member orchestration, preserving the writer fallback and route metrics exactly
• NIP-43 snapshot reconciliation and transaction-locked publication, preserving PR Add database pressure observability #6700 transaction timing and membership advisory-lock boundaries

crates/buzz-db/src/lib.rs falls from 4,621 to 4,259 lines.

Non-goals

• Relay-invite mint/claim/reaping ownership; that is the next independent stack child
• Authentication allowlist semantics or schema
• Membership, ownership-limit, SQL, locking, transaction, retry, routing, or client-visible behavior changes
• Generic store traits, raw pool access, executor migration, or crate reorganization

Risk

Moderate review surface, low semantic risk. Existing SQL helpers and focused tests remain byte-for-byte in relay_members.rs; the facade methods and NIP-43 orchestration moved intact. The bounded permission-read routing and NIP-43 transaction/advisory-lock timing are unchanged. The only additive instrumentation is the missing fixed-name has_admin_or_owner span required by #19; it adds no dynamic labels or sensitive fields.

Blox verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head 14924657e84d5d516fb0022e0681cbe18391ea77.

• cargo fmt --all --check
• git diff --check c74438e849c57d4840122d674edf1a989a54d37c..HEAD
• cargo clippy -p buzz-db --all-targets -- -D warnings
• cargo clippy -p buzz-relay --all-targets -- -D warnings
• cargo test -p buzz-db --lib: 108 passed, 200 ignored
• cargo test -p buzz-db --test observability_source: 1 passed
• Native PostgreSQL 17.11, migrations 1–32 already applied: bounded routed membership proof passed; relay-members suite passed 9 of 10 in the default environment
• The remaining owner-limit test fails identically on the exact parent because it provisions three communities while the production default is now five; it passes on this head with BUZZ_MAX_COMMUNITIES_PER_OWNER=3. No behavior/test correction is included in this pure-move PR.
• cargo test -p buzz-relay --lib: 909 passed, 48 ignored
• Signed commit hooks passed

Independent exact-head Blox review: no findings. Review artifacts were preserved before teardown.

Remaining tracker work

Next: relay invites, followed by moderation/product feedback, git registry and archived identities, usage/admin/maintenance, deletion ownership, and the final runtime-boundary audit.

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

Outcome

No actionable findings.

Reviewed exact direct-parent range acbcc4abe1a9ab035eb9ffcf87a3d380d5ce1b6e..245c08f24df4e77c0e8486f9aa7abcc70d784e7b on fresh Blox workstation buzz-tornquist-pr-6804-final-review (ID 2057733). Relay membership wrappers, membership records, NIP-43 reconciliation/publication orchestration, SQL ownership, and spans are co-located in relay_members.rs. The bounded permission route and writer fallback are preserved. The NIP-43 transaction timer still observes the entire lock/read/build/write/commit-or-rollback lifecycle, with the membership advisory-lock metric unchanged. The cross-cutting route proof remains in lib.rs. has_admin_or_owner receives its required single fixed-name datastore span; no SQL or client-visible semantics change.

Verification

• Formatting, range/worktree diff checks, touched-crate clippy, and clean-tree checks passed.
• Non-PostgreSQL relay-members tests: 2 passed, 10 ignored.
• Relay consumer compile passed.
• Native PostgreSQL 17: all 10 relay-members tests passed, covering community confinement, invite policy evidence, owner bootstrap, and ownership transfer outcomes.
• Exact head and merge-base were rechecked.

No code edits or external mutations were made. Buzz relay credentials/ownership reporting were unavailable under the documented fallback. The workstation was deleted after artifact transfer.

Artifacts

• Diff SHA-256: ae343c6cd3b07a1f4fcbc87e7d6c32cec0d9d2c7e5155e446e18183637e1047e
• Verification log SHA-256: 1e176f227c9d451e48f7df57b0161806953560a490164dc4839719fa9bac65d3
• Artifact archive SHA-256: b51336e789070f8fd3a3dde4492ace58a8f2e3a1f634155a3a32e23c03f5bb95

Comment-addressed restack

Review follow-up on #6777 removed only the low-value replaceable ownership source test. This PR was restacked onto its rewritten parent; its production patch is unchanged.

• Exact base: 723b40d924744483328cf436f8d946e8176e3aba
• Exact head: 75a5146da1e7886e7ad7e5a957e56288d42e8d61
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Per-layer patch-ID and tree audits confirm this PR’s production diff is unchanged from its pre-comment head.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict buzz-db Clippy, current ownership/observability guards, relay-members tests (2 unit plus 10 PostgreSQL), and relay compilation.