From 88c6a3231022c1de19fd6cbcca8becbbc16a3341 Mon Sep 17 00:00:00 2001
From: Elrond
 <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Date: Fri, 16 Oct 2026 10:05:57 -0400
Subject: [PATCH] buzz-db: pin every condition of the manifest stamp exemption

Add negatives for a second chunk write and a conflict-upsert stamp, and
require chunk_no = $2 so one chunk's purge cannot stamp the whole request.

Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
---
 crates/buzz-db/tests/observability_source.rs | 30 +++++++++++++-------
 1 file changed, 19 insertions(+), 11 deletions(-)

diff --git a/crates/buzz-db/tests/observability_source.rs b/crates/buzz-db/tests/observability_source.rs
index 466597ec09..813880c6c6 100644
--- a/crates/buzz-db/tests/observability_source.rs
+++ b/crates/buzz-db/tests/observability_source.rs
@@ -2220,10 +2220,11 @@ fn single_table_guard_violations(
                 && header.starts_with("pub async fn mark_manifest_chunk_deleted(")
                 && manifest_writes == 1
                 && manifest_updates == 1
-                && sets.len() == 1
-                && sets[0].0.trim() == "deleted_at = now()"
-                && plain_guard(sets[0].1, "request_id = $1")
-                && plain_guard(sets[0].1, "deleted_at is null");
+                && matches!(sets.as_slice(), [(set, predicate)]
+                    if set.trim() == "deleted_at = now()"
+                        && ["request_id = $1", "chunk_no = $2", "deleted_at is null"]
+                            .iter()
+                            .all(|guard| plain_guard(predicate, guard)));
             let guarded = code.contains("guard_manifest_chunk_write(");
             if deletion_stamp {
                 rule_hits[1].push(name.to_owned());
@@ -2606,6 +2607,17 @@ fn single_table_policy_holds_the_manifest_stamp_to_plain_conjuncts() {
             "chunk_no IN (SELECT chunk_no FROM chunks WHERE request_id = $1 AND deleted_at IS NULL)",
         ),
         ("request_id = $1 AND ", ""),
+        ("chunk_no = $2 AND ", ""),
+        // A second write in the stamp function does not share its exemption.
+        (
+            "deleted_at IS NULL\");",
+            "deleted_at IS NULL\"); query(\"DELETE FROM community_deletion_manifest_keys WHERE request_id = $1\");",
+        ),
+        // The stamp must be a plain UPDATE, not a conflict upsert.
+        (
+            "UPDATE community_deletion_manifest_keys SET",
+            "INSERT INTO community_deletion_manifest_keys (request_id, chunk_no) VALUES ($1, $2) ON CONFLICT (request_id, chunk_no) DO UPDATE SET",
+        ),
     ] {
         let weakened = stamp.replace(from, to);
         assert_ne!(weakened, stamp);
@@ -2616,14 +2628,10 @@ fn single_table_policy_holds_the_manifest_stamp_to_plain_conjuncts() {
             "{weakened}"
         );
     }
-    let guarded_elsewhere = stamp.replace("mark_manifest_chunk_deleted", "restamp");
+    let renamed_stamp = stamp.replace("mark_manifest_chunk_deleted", "restamp");
     assert_eq!(
-        single_table_guard_violations(
-            DELETION_STORE_PATH,
-            &guarded_elsewhere,
-            &mut Default::default()
-        )
-        .len(),
+        single_table_guard_violations(DELETION_STORE_PATH, &renamed_stamp, &mut Default::default())
+            .len(),
         1
     );
     assert_eq!(