refactor(db): move push store ownership

[TheSentinel454]

Current reconstructed head

Exact base: codex/issue-2-user-dm-store at 4664593b6f5f90394bc0d2432b26822dbede9c44
Exact head: codex/issue-2-push-store at 5c274541d7156073b80b3d860b6feac89b632226

This current head removes crates/buzz-db/tests/store_ownership.rs; no replacement path-sensitive ownership test is introduced. Apart from removing that complete test-file diff, the production patch is byte-for-byte identical to the previously reviewed slice. This remains part of tracker #2 and the #17/#19 acceptance work.

Independent exact-head review from a separate clean Blox workstation found no issues. Current-head evidence passed formatting, strict buzz-db clippy, 111 non-PostgreSQL library tests with 200 PostgreSQL tests ignored, the observability source test, relay consumer compilation, exact ownership/unique-span review checks, and all 16 push PostgreSQL tests against reset databases on native PostgreSQL where applicable.

Why

Continue tracker #2 by making push lease, matcher, and durable wake-outbox persistence wholly owned by push.rs. The records, SQL, transaction/lock instrumentation, and focused tests already lived there; this child moves the remaining Db APIs and datastore spans out of lib.rs. This PR stacks on #6796.

What

• Move all fourteen push-facing Db APIs and their datastore spans into push.rs
• Preserve push lease acceptance, matcher claim/retry/reap, wake enqueue/claim/revalidate/complete/retry/fail, and endpoint-generation disable signatures and behavior
• Keep the push records/outcomes, SQL, row parsing, transaction boundaries, advisory-lock timing, and sixteen PostgreSQL tests in push.rs
• Keep insert_event_with_serving_write_guard in lib.rs because it composes deletion serving-write admission with general event insertion across domains
• Keep runtime read routing and its proofs/tests in lib.rs

Stack

• Exact base: codex/issue-2-user-dm-store at d6abdf9 (#6796)
• Exact head: codex/issue-2-push-store at 453cef1
• Tracker: buzz-db: break up lib.rs — move impl Db methods to domain modules TheSentinel454/buzz#2
• Domain issue: none; this is a remaining push-domain slice identified by the extraction ledger
• Test/span acceptance: buzz-db: move lib.rs tests (~4,000 lines) to domain modules TheSentinel454/buzz#17 and buzz-db: consistent #[datastore_span] tracing placement TheSentinel454/buzz#19

Non-goals

• No SQL, schema, locking, transaction, retry, timeout, lease, matcher, outbox, or client-visible behavior changes
• No movement of deletion serving-write admission or general event insertion into push ownership
• No store traits, domain-handle redesign, broad PgExecutor migration, raw pool accessor, new crate, or directory-wide reorganization
• No changes to, retargeting of, or merge action on parent PRs or PR Add database pressure observability #6700

Risk Assessment

Moderate operational surface, low semantic risk. The fourteen wrappers and spans moved intact and still call the same push SQL functions with the same pool, arguments, return types, and ordering. The transaction and advisory-lock implementations introduced or instrumented by #6700 remain untouched.

Blox Verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head 75c2b99aa388c0e78d20facea4c31672a78dad2b.

• cargo fmt --all --check and git diff --check — passed
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings — passed
• cargo test -p buzz-db --quiet — 108 passed, 200 ignored
• Native PostgreSQL push tests — all 16 passed across the module run plus isolated exact reruns: 13 passed in the full ordered suite, and the remaining 3 passed individually against fresh databases
• The full ordered push suite's three failures are inherited test-state coupling: the exact parent reproduces the same three failures and messages on a fresh database after an earlier test deliberately leaves a tenant quiescing; this PR does not change those tests or behavior
• cargo test -p buzz-relay --lib -- --test-threads=1 — 909 passed, 48 ignored
• Commit-time formatting, sadscan, attribution, and sign-off hooks — passed

Independent exact-head Blox review completed on buzz-tornquist-pr-6797-review (2051998) with no actionable findings.

Generated with Codex

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

Outcome

No actionable findings.

Reviewed exact direct-parent range 48822f008819089618593edcee78bb468a21ec05..d9cf07bd5aa3cdeb0cdcc9019caf0ec40e9f0438 on fresh Blox workstation buzz-tornquist-pr-6797-final-review (ID 2057636). Fourteen push Db wrappers retain their parameters, return types, SQL delegates, fencing/transaction behavior, and single spans after moving to push.rs. Cross-domain serving-write orchestration stays runtime-owned.

Verification

• Formatting, range/worktree diff checks, touched-crate clippy, and clean-tree checks passed.
• Non-PostgreSQL push selection completed with all 16 PostgreSQL tests intentionally ignored.
• Relay consumer compile passed.
• Native PostgreSQL 17: all 16 push tests passed, each against a freshly migrated database so stateful limits/fences could not leak between cases.
• Exact head and merge-base were rechecked.

No code edits or external mutations were made. Buzz relay credentials/ownership reporting were unavailable under the documented fallback. The workstation was deleted after artifact transfer.

Artifacts

• Diff SHA-256: 7c2d3d3cb33889502dc39010fa6a160c5420f6f8d9068fcabc39e4514819478d
• Verification log SHA-256: 0fd7545d32123520c165aa50656f7fac9a5a2cd5d11c2785def309c6a5c85828
• Artifact archive SHA-256: 41f3bf23a47a0ba9f3ed2c95c2254ad5ac8de1a03922f1a2ae4bde4e00cfc9eb

Comment-addressed restack

Review follow-up on #6777 removed only the low-value replaceable ownership source test. This PR was restacked onto its rewritten parent; its production patch is unchanged.

• Exact base: d6abdf916ea53ad59e9f1d909db5256a06c2a661
• Exact head: 453cef19ea440444e458f95f1cb71b88ddd0eb5a
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Per-layer patch-ID and tree audits confirm this PR’s production diff is unchanged from its pre-comment head.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict buzz-db Clippy, current ownership/observability guards, all 16 stateful push PostgreSQL tests on reset databases, and relay compilation.

[TheSentinel454]

🤖 Superseded by #6987, which consolidates the remaining issue #2 store-extraction stack onto merged #6782. #6987 is an open draft at the independently reviewed exact head, and all exact-head CI checks are green. This PR remains available for review history; please continue review on #6987.