Closes the remaining half-migrations surfaced red-teaming the #1321 multi-tenant
relay against the #1285 isolation model:
- BUG-1 (ship-blocker): community auto-seed ON CONFLICT(host) now targets the
lower(host) index so closed-mode (NIP-43) boot no longer FATALs on a fresh DB.
- BUG-2: align runtime partition naming with the seeded partition names.
- BUG-3: scope the legacy pubkey_allowlist gate (is_pubkey_allowed,
has_allowlist_entries, add/remove/list) and its relay_members backfill by
community_id across buzz-db, auth.rs, media.rs, relay_members.rs; scope the
git .names disk registry under .names/<community>/ in side_effects.rs.
- BUG-5 (ship-blocker): reaction.rs was never migrated to multi-tenant — every
reaction 500'd on an ON CONFLICT that omitted community_id. Thread CommunityId
through all reaction.rs queries, fix the ON CONFLICT to the full scoped PK
(community_id, event_created_at, event_id, pubkey, emoji), and scope every
read/list/remove path; update the Db shims and ingest.rs/side_effects.rs call
sites to pass tenant.community().
Test harness: normalize the workflow-confinement REST 400 {error} envelope and
add a scoped pointer helper in e2e_git.rs; add ignored Postgres regression
reactions_are_scoped_to_community.
Verified: fmt/build/diff-check green; buzz-db 75/0 + 37 ignored (serial) green;
test_nip29_standard_client_flow RED at #1321 -> GREEN. Clean-context reviewed.
Co-authored-by: Tyler Longwell <tlongwell@block.xyz>
Signed-off-by: Tyler Longwell <tlongwell@block.xyz>
