feat(admin): add community archive commands

[TheSentinel454]

Why

Operators need reversible community archive and restore controls without entering the destructive deletion workflow, while retaining exact host, current-owner, and deployment-community safety guards.

What

• add buzz-admin communities archive and buzz-admin communities unarchive as single-operator commands with required operator identity and reason evidence
• normalize and validate bare host authorities, require the asserted current owner pubkey, and refuse archival of the configured deployment community
• reuse the idempotent database lifecycle mutations and publish ConnControl::DisconnectCommunity after archive only
• emit JSON evidence for successful and committed-but-propagation-pending results, returning a retryable nonzero exit when Redis publication fails or reaches zero subscribers
• cover parser requirements, absence of deletion approval arguments, validation, evidence, and propagation classification

Risk Assessment

Moderate: this operator-only CLI changes community admission state and archive sends a live disconnect command. Exact host/current-owner matching, a protected deployment-host guard, idempotent mutations, and reversible unarchive constrain the blast radius.

References

• docs/plans/2026-08-31-buzz-admin-community-archive.md

Generated with Codex

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is cb3144999bebc4939cb15b2200b373281d493b52...4b604647ed59c7f3bc09b3ef30130c9bef14b72f.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 4b604647ed59c7f3bc09b3ef30130c9bef14b72f to authorize a new review.
Any previous review applies only to its recorded range.

[TheSentinel454]

@codex review

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-08-31T15:54:01.349309Z	66653d5	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 66653d52e3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[wpfleger96]

🤖 Combined review at c9190f52447b65673862a7cc63efcdde5a2a32c5. The lifecycle guards, idempotency, archive-transition fence, row locking, rolling-deployment compatibility, and negative command paths look sound. Current-head CI is green. I found one user-visible blocker in live verification and one test-wiring gap:

1. IMPORTANT / Correctness — archive closes connected clients with the false reason community deleted. A release-built relay accepted a WebSocket connection to the active community, and buzz-admin communities archive then persisted the archive and published its fenced disconnect successfully. The client received close code 1008 with reason community deleted, even though the same community could immediately be restored with unarchive. That tells clients a reversible state transition was permanent destruction. Please carry the lifecycle cause through ConnControl/CommunityConnectionControl, use an archive-specific close reason for archive-triggered disconnects, and retain community deleted only for permanent deletion. Add a user-visible regression that asserts the close reason for both transitions while preserving old/new payload compatibility during rolling deployment.

2. MINOR / Correctness — the two exact archive-fencing regressions are not executed by CI. archive_disconnect_fence_tracks_the_exact_archive_transition and inactive_community_fence_holds_the_row_lock_through_disconnect are ignored PostgreSQL tests, but no Backend Integration filter in .github/workflows/ci.yml selects them. The green job therefore does not prove these race fences. Please add exact buzz-db selectors so both run in CI.

The rest of the live matrix passed: archive persistence and fresh-connection rejection, idempotent re-archive, unarchive and immediate reconnect, stale delayed-command rejection after unarchive, owner/host/deployment-community guards, and retryable propagation evidence for zero subscribers or unavailable Redis.