refactor(db): separate runtime and store modules

Signed-off-by: OpenAI Codex <codex@openai.com>

crates/buzz-db/src/runtime/migration.rs

@@ -1000,7 +1000,7 @@ mod tests {
             .contains("CREATE INDEX relay_invites_expires_at_idx ON relay_invites (expires_at)"));
         assert!(!relay_invites.contains("_operator_global_tables"));
 
-        let desired_schema = include_str!("../../../schema/schema.sql");
+        let desired_schema = include_str!("../../../../schema/schema.sql");
         assert!(
             desired_schema.contains("CREATE TABLE join_policy_acceptances"),
             "desired-state schema must include join-policy evidence used by invite claims",
@@ -1201,7 +1201,7 @@ mod tests {
             .sql
             .as_str()
             .contains("error_code"));
-        assert!(include_str!("../../../schema/schema.sql").contains("error_code          TEXT"));
+        assert!(include_str!("../../../../schema/schema.sql").contains("error_code          TEXT"));
     }
 
     #[test]
@@ -1372,7 +1372,7 @@ mod tests {
         let migrator_run_to = ["MIGRATOR", ".run_to("].concat();
 
         let manifest_dir = std::path::Path::new(env!("CARGO_MANIFEST_DIR"));
-        let this_file = manifest_dir.join("src/migration.rs");
+        let this_file = manifest_dir.join("src/runtime/migration.rs");
         let crates_dir = manifest_dir.parent().expect("workspace crates dir");
         // The push gateway migrates its own dedicated authority database; it
         // never holds relay tenant tables, so it is exempt from the relay

crates/buzz-db/src/runtime/replica_fence.rs

@@ -19,13 +19,13 @@
 //!    observes `token >= M` on its own connection has, by WAL/storage replay
 //!    order, also replayed every commit that preceded M's commit; every
 //!    transaction then partitions into exactly three buckets:
-//!      (a) finished before the activity scan — its commit precedes `M`'s
-//!          commit, so the replica session has replayed it;
-//!      (b) open at the activity scan — represented by `xact_start`, so it is
-//!          bounded by the `oldest_xact_start` term;
-//!      (c) started after the activity scan — its deferred floor guard runs
-//!          after `S`, so it cannot commit a row with
-//!          `created_at < S - floor`.
+//!    (a) finished before the activity scan — its commit precedes `M`'s
+//!    commit, so the replica session has replayed it;
+//!    (b) open at the activity scan — represented by `xact_start`, so it is
+//!    bounded by the `oldest_xact_start` term;
+//!    (c) started after the activity scan — its deferred floor guard runs
+//!    after `S`, so it cannot commit a row with
+//!    `created_at < S - floor`.
 //!    There is no fourth bucket. Each committed token `M` therefore proves a
 //!    **fence wall** of `min(oldest_xact_start, S) - floor - clock_margin`:
 //!    every channel-window row with `created_at <= fence_wall(M)` is present

crates/buzz-db/src/store/channel_members.rs

@@ -2944,7 +2944,7 @@ mod tests {
             .connect(&scratch_url)
             .await
             .expect("connect desired-schema scratch db");
-        sqlx::raw_sql(include_str!("../../../schema/schema.sql"))
+        sqlx::raw_sql(include_str!("../../../../schema/schema.sql"))
             .execute(&pool)
             .await
             .expect("apply desired-state schema");

crates/buzz-db/src/store/community.rs

@@ -602,7 +602,7 @@ mod tests {
     #[test]
     fn community_implementation_tests_and_spans_have_single_owners() {
         let community_source = include_str!("community.rs");
-        let lib_source = include_str!("lib.rs");
+        let lib_source = include_str!("../lib.rs");
         let operations = [
             "lookup_community_by_host",
             "is_community_active",

crates/buzz-db/src/store/mod.rs

@@ -0,0 +1,52 @@
+//! Domain-owned persistence implementations.
+
+/// Explicit deployment-global admin report reads.
+pub mod admin_moderation;
+/// Community-scoped authentication allowlist persistence.
+pub mod allowlist;
+/// API token storage and lookup.
+pub mod api_token;
+/// Relay-scoped archived identity persistence (NIP-IA).
+pub mod archived_identities;
+/// Channel lifecycle and metadata persistence.
+pub mod channel;
+/// Channel membership and roster persistence.
+pub mod channel_members;
+/// Community lifecycle and host-map persistence.
+pub mod community;
+/// Durable whole-community deletion lifecycle and PostgreSQL adapter.
+pub mod deletion;
+/// Direct message channel persistence.
+pub mod dm;
+/// Event storage and retrieval.
+pub mod event;
+/// Home feed queries.
+pub mod feed;
+/// Git repository name registry (NIP-34 kind:30617).
+pub mod git_repo;
+/// Community moderation: reports, bans/timeouts, audit actions.
+pub mod moderation;
+/// Monthly table partition management.
+pub mod partition;
+/// Buzz product-feedback sidecar persistence.
+pub mod product_feedback;
+/// Community-scoped push lease and durable wake-outbox persistence.
+pub mod push;
+/// Reaction persistence.
+pub mod reaction;
+/// Use-limited relay invite persistence (v2 opaque tokens).
+pub mod relay_invite;
+/// Relay-level membership persistence (NIP-43).
+pub mod relay_members;
+/// Event-reminder delivery query, claim, and release persistence.
+pub mod reminder;
+/// Replaceable-event persistence and coordinate locking.
+pub mod replaceable;
+/// Thread metadata persistence.
+pub mod thread;
+/// Per-community usage rollup queries for Prometheus gauges.
+pub mod usage;
+/// User profile persistence.
+pub mod user;
+/// Workflow, run, and approval persistence.
+pub mod workflow;

crates/buzz-db/tests/observability_source.rs

@@ -1,6 +1,6 @@
 #[test]
 fn database_metrics_and_slow_logs_exclude_sensitive_or_unbounded_fields() {
-    let implementation = include_str!("../src/observability.rs");
+    let implementation = include_str!("../src/runtime/observability.rs");
     let datastore_macro = include_str!("../../buzz-datastore-tracing/src/lib.rs");
     let instrumentation = format!("{implementation}\n{datastore_macro}");