refactor(db): split channel membership store

[TheSentinel454]

Current reconstructed head

Exact base: codex/issue-7-roster-test-fixtures at 5df440c411be9705eb29a57f0c41f7239767e007
Exact head: codex/issue-7-channel-membership-store at 8ad0782ee311f5f51b714494ce750c5937f127cc

This current head removes crates/buzz-db/tests/store_ownership.rs; no replacement path-sensitive ownership test is introduced. Apart from removing that complete test-file diff, the production patch is byte-for-byte identical to the previously reviewed slice. This remains part of tracker #2 and the #17/#19 acceptance work.

Independent exact-head review from a separate clean Blox workstation found no issues. Current-head evidence passed formatting, strict buzz-db clippy, 111 non-PostgreSQL library tests with 200 PostgreSQL tests ignored, the observability source test, relay consumer compilation, exact ownership/unique-span review checks, and 3 channel and 19 membership PostgreSQL tests on native PostgreSQL where applicable.

Why

Complete the channel ownership slice of tracker #2 and domain issue #7 while preserving the runtime/store boundary established by #6660 and #6668. This child stacks on the test-only fixture prerequisite #6819 above #6777 and carries forward PR #6700's membership/replacement lock timing without changing lock or transaction behavior.

What

• Keep channel lifecycle, metadata, TTL advisory locking, and lifecycle tests in channel.rs
• Move membership/roster records, SQL, advisory-lock helpers, Db methods, focused tests, and datastore spans to a dedicated channel_members.rs
• Preserve existing buzz_db::channel::* paths with compatibility re-exports while exposing the dedicated module
• Move the four roster-fence PostgreSQL tests out of lib.rs

Stack

• Exact base: codex/issue-7-roster-test-fixtures at 21d1b26 (#6819)
• Exact head: codex/issue-7-channel-membership-store at 25138bf
• Tracker: buzz-db: break up lib.rs — move impl Db methods to domain modules TheSentinel454/buzz#2
• Domain: buzz-db: split channel.rs into channel CRUD + membership TheSentinel454/buzz#7
• Test/span acceptance: buzz-db: move lib.rs tests (~4,000 lines) to domain modules TheSentinel454/buzz#17 and buzz-db: consistent #[datastore_span] tracing placement TheSentinel454/buzz#19

Non-goals

• No SQL, schema, retry, timeout, lock ordering, transaction boundary, or client-visible behavior changes
• No change to channel TTL lifecycle ownership merely because lifecycle bootstrap writes an owner membership row
• No store traits, domain-handle redesign, broad PgExecutor migration, raw pool accessor, new crate, or directory-wide reorganization
• No changes to, retargeting of, or merge action on PR Add database pressure observability #6700 or refactor(db): finish replaceable event store extraction #6777

Risk Assessment

Moderate review surface, low semantic risk. The file split is large, but method signatures, SQL, bind order, membership and replacement lock namespaces, transaction boundaries, and span names remain unchanged. Compatibility re-exports preserve existing buzz_db::channel::* consumers.

Blox Verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head 8376e19d0da3ec77550590cd91cc3dfe284d95d6.

• cargo fmt --all --check — passed
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings — passed
• Native PostgreSQL channel lifecycle suite — 3 passed
• Native PostgreSQL membership/roster suite — 17 passed; two pre-existing ignored-test fixture failures reproduced identically on the untouched parent 2de5444: large_roster_reconciliation_candidates_respect_snapshot_count_and_signer and locked_member_snapshot_blocks_post_capture_membership_mutation both receive the migration-0032 23514 invalid-p-tag rejection. This extraction intentionally does not fold a test-behavior fix into the move.
• cargo test -p buzz-relay --lib -- --test-threads=1 — 908 passed, 48 ignored; the existing load-sensitive mesh demo test returned 504, matching the Add database pressure observability #6700/parent baseline
• cargo test -p buzz-relay --lib api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo -- --exact --test-threads=1 — passed

Independent exact-head review: buzz-tornquist-pr-6782-review (2048397) found no remaining critical, important, or minor issues. The full implementation review also independently reproduced both stated PostgreSQL fixture failures on the exact parent and passed the relay library suite (909 passed, 48 ignored).

Generated with Codex

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

• Workstation: buzz-tornquist-pr-6782-final-review (2057620), fresh shallow checkout
• Base: c60e793eadde79d9eab9f48bbb2ede0ad4831f9b
• Head: fa09b6c81c4db3b3e1940a2117a97ab2186e49f7
• Findings: none

Reviewed both commits in base..head. Channel lifecycle/metadata, TTL transitions, and their lock rationale remain in channel.rs; membership authorization, roster fencing/snapshots, membership advisory locking, membership records, and focused tests move together to channel_members.rs. SQL, transaction, and lock sequences are preserved.

Verification: format and diff checks passed; buzz-db --all-targets clippy passed with -D warnings; DB lib tests passed (111 passed, 200 PostgreSQL tests ignored); ownership (2/2) and observability (1/1) guards passed; native PostgreSQL 17 passed 3 channel lifecycle tests plus 19 membership/roster tests with migrations 1-32 successful; relay lib test target compiled successfully. Final worktree was detached at the exact head and clean.

Complete evidence archive SHA-256: 81ae374095f649ca7a25d8b9a4fc864257b7925d1b44657a69ca111523adf36e.

Comment-addressed restack

Review follow-up on #6777 removed only the low-value replaceable ownership source test. This PR was restacked onto its rewritten parent; its production patch is unchanged.

• Exact base: 21d1b265c133292e6707e766cd4204e6a43f08af
• Exact head: 25138bfd6588e046170dbdbc4ed953bdc3cf7ed1
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Per-layer patch-ID and tree audits confirm this PR’s production diff is unchanged from its pre-comment head.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict Clippy, DB lib 111 passed / 200 ignored, current ownership/observability guards, 3 channel plus 19 membership PostgreSQL tests, and relay compilation.

[wpfleger96]

🤖 Combined review from three independent passes (two source reviews + one E2E test run at exact head 8ad0782): no blocking findings; two MINOR (non-blocking) notes below.

Verified clean:

• Pure split confirmed independently by both source reviews: every production/helper/test function body byte-identical after relocation; all 29 Db wrappers keep their signatures, delegation, docs, and all 28 datastore span names; the buzz_channel_membership: advisory-lock namespace, SQL, bind order, and transaction boundaries are unchanged. Sole visibility change is row_to_channel_record → pub(crate), which is the right narrow seam.
• Compat re-exports in channel.rs cover all 24 moved public items, so existing buzz_db::channel::* consumers are unaffected.
• The PR body's mention of removing tests/store_ownership.rs is stale relative to this diff — that file is already absent at the exact base, so this PR contains no test-file deletion.
• E2E at head on fresh Postgres: relocated channel::tests:: 3/3, new channel_members::tests:: 19/19 (including all four roster-fence cases), cargo check -p buzz-relay passes. Three unrelated full-suite failures reproduce identically at the parent commit and predate this stack.

MINOR (non-blocking):

1. ~170 lines of Postgres test scaffolding (setup_pool, make_test_community, create_test_channel, scratch-DB helpers) are now duplicated between the two modules' test mods — and a third copy lands in #6784. A shared #[cfg(test)] helper module would collapse them; fine as a stack-wide follow-up rather than a change here.
2. MemberRole is re-exported from both channel and channel_members, leaving two equivalent import paths. Harmless; worth consolidating whenever the compat re-exports are eventually retired.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 57216c942f171db305135bcb6a4ede2d87e0be8a...ffb06a01220d7d5d99245593c51d932e1c0df98a.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review ffb06a01220d7d5d99245593c51d932e1c0df98a to authorize a new review.
Any previous review applies only to its recorded range.