mirror of
https://github.com/block/buzz.git
synced 2026-11-12 12:22:06 +00:00
b44e79b7fa
Phase 1 of BUZZ-318. The five single-table guard triggers stay for mixed-version pods; their invariants now also hold in the application writers, so a later PR can drop them. - communities lifecycle: begin_quiescing, fence, purge_postgres and abort go through one transition_community state machine over a locked snapshot (deleted_at one-way, generation monotonic, deleted rows rejected). set_community_icon only updates an active, undeleted row. - community_deletion_requests: both initial inventory freezes require an unfrozen, unblocked submitted row in the UPDATE predicate; the destructive-manifest freeze refuses a frozen row with missing JSON. - community_deletion_manifest_keys: append, pre-freeze clear and verified cleanup check the request row via guard_manifest_chunk_write. - channels.community_id and community_deletion_approvals hold by construction; a Rust source policy in observability_source.rs forbids retenanting, lifecycle writes outside the transition helper, community DELETE, request retargeting, approval UPDATE/DELETE and unguarded manifest writers. Five PG tests each disable only their own trigger and exercise the app path's rejected and permitted mutations. Signed-off-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz>