From c35c74fb18e3949424fc390b8391e4d360cedcbf Mon Sep 17 00:00:00 2001
From: Elrond
 <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
Date: Tue, 29 Sep 2026 17:28:24 -0400
Subject: [PATCH] fix(db): make the lifetime owner cap absolute and rustfmt the
 quota test

Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>
---
 crates/buzz-db/src/store/relay_members.rs | 14 +++++++++-----
 docs/operator-community-deletion.md       |  2 +-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/crates/buzz-db/src/store/relay_members.rs b/crates/buzz-db/src/store/relay_members.rs
index ba0651475c..8f2bcd191e 100644
--- a/crates/buzz-db/src/store/relay_members.rs
+++ b/crates/buzz-db/src/store/relay_members.rs
@@ -606,7 +606,8 @@ pub fn owner_count_advisory_lock_key(pubkey_hex: &str) -> i64 {
 
 /// Lifetime cap on communities a pubkey may own, counting owner-deleted
 /// communities whose tombstones permanently retain their hosts. Bounds
-/// create-then-delete host squatting; never below the active limit.
+/// create-then-delete host squatting. Absolute: it does not scale with
+/// `BUZZ_MAX_COMMUNITIES_PER_OWNER`.
 pub const MAX_LIFETIME_COMMUNITIES_PER_OWNER: i64 = 20;
 
 /// One owner's quota usage, read inside the admitting transaction.
@@ -621,8 +622,8 @@ pub(crate) struct OwnerQuota {
 impl OwnerQuota {
     /// Whether this owner may gain one more community.
     pub fn admits(self) -> bool {
-        let limit = max_communities_per_owner();
-        self.active < limit && self.lifetime < MAX_LIFETIME_COMMUNITIES_PER_OWNER.max(limit)
+        self.active < max_communities_per_owner()
+            && self.lifetime < MAX_LIFETIME_COMMUNITIES_PER_OWNER
     }
 }
 
@@ -1307,11 +1308,14 @@ mod postgres_tests {
     fn owner_quota_admits_only_under_active_and_lifetime_caps() {
         let quota = |active, lifetime| super::OwnerQuota { active, lifetime };
         let limit = super::max_communities_per_owner();
-        let lifetime = super::MAX_LIFETIME_COMMUNITIES_PER_OWNER.max(limit);
+        let lifetime = super::MAX_LIFETIME_COMMUNITIES_PER_OWNER;
         assert!(quota(0, 0).admits());
         assert!(quota(limit - 1, lifetime - 1).admits());
         assert!(!quota(limit, limit).admits(), "active cap");
-        assert!(!quota(0, lifetime).admits(), "tombstones count toward lifetime");
+        assert!(
+            !quota(0, lifetime).admits(),
+            "tombstones count toward lifetime"
+        );
     }
 
     #[test]
diff --git a/docs/operator-community-deletion.md b/docs/operator-community-deletion.md
index 0c0c57afd2..0b2c6dbe5c 100644
--- a/docs/operator-community-deletion.md
+++ b/docs/operator-community-deletion.md
@@ -166,7 +166,7 @@ The relay enforces two per-owner caps on create and on transfer-in, both as
   (`BUZZ_MAX_COMMUNITIES_PER_OWNER`, default 5). A deletion keeps its slot
   until logical completion records `completed_at`.
 - **Lifetime:** live ownership plus every non-aborted owner deletion, including
-  completed ones, capped at 20 (or the active limit if that is higher).
+  completed ones, capped at an absolute 20 regardless of the active limit.
   Deleted communities keep their hosts as permanent tombstones, so this bounds
   create-then-delete host squatting. Aborted deletions restore the community
   and count only through its live membership.