[TheSentinel454]

Stack (merge bottom-up): main ← #8320 (phase 1 + catalog expand) ← this PR (0090). 0087–0089 are taken by #8326 / #8323 / #8211, and #8696 also claims 0087. The migration.rs count assumes those land first; I'll renumber/rebase on restack.

Important

Hold: do not merge until #8320 is deployed in every environment. #8320 now carries both the application guards and the catalog expand (cdc88edd). Before the expand, validate_serving_catalog (boot at main.rs, and readiness) required the enabled communities_deletion_tombstone trigger, so a pod without it fails boot and readiness once 0090 has run.

Rollout order: deploy #8320 fleet-wide with no rollback expected below it, then merge this. With autoMigrate=true, 0090 runs at startup under a 5s lock timeout and a failure stops startup. With BUZZ_AUTO_MIGRATE=false, deploy this binary first and then run buzz-admin migrate. Both orders are safe because the expand already tolerates the objects being present or absent.

What

Migration 0090_drop_single_table_guards.sql drops five triggers and their functions. #8320 moved each invariant into the application writers:

Trigger (table)	Function
trg_channels_community_id_immutable (channels)	channels_community_id_immutable()
communities_deletion_tombstone (communities)	enforce_community_tombstone()
community_deletion_request_retargeting_guard (community_deletion_requests)	prevent_community_deletion_request_retargeting()
community_deletion_approval_removal_guard (community_deletion_approvals)	prevent_community_deletion_approval_removal()
community_deletion_manifest_keys_guard (community_deletion_manifest_keys)	protect_community_deletion_manifest_keys()

Desired state (schema/) drops the five functions and four trigger files, plus the channels trigger declaration. The universal write fence on channels stays. Both boot paths stay catalog-equivalent: the pgschema-vs-migration parity check now also compares columns, key and FK shapes, and the remaining triggers on all five tables.

Executor GUCs stay because assert_community_write_allowed still reads them through the universal write fence. transition_community and every phase-1 app guard are byte-identical to #8320. scripts/reconcile-schema-after-pgschema.sql has no entries for these objects.

Tests

• buzz-db: enforce five single-table guards in app writers (phase 1) #8320's six single_table_guard_*_without_trigger PG tests no longer need to disable a trigger. They are now plain app-path tests with the same assertions.
• New per-test regressions for the desired-template and migration boot paths assert that none of the ten objects exist, including disabled triggers and function overloads.
• Deleted assertions that only exercised raw SQL against the triggers: retarget, rewrite and approval mutation, frozen-manifest rewrite, and tombstone DELETE. The app-path coverage for each remains.
• The expand regression in buzz-db: enforce five single-table guards in app writers (phase 1) #8320 migrates through 0086, validates serving, readiness and the deletion lifecycle, drops the five guards, then validates again.
• Gates on a Blox workstation at the pre-trim tree, which differs only in docs and comments: cargo fmt --check and cargo clippy --workspace --all-targets -D warnings are clean, buzz-db --lib 212/212 and observability_source 38/38 pass, and the PostgreSQL packages pass: buzz-db 750, relay 641, admin 10, audit 7, deletion 40, push-gateway 12, search 29 and workflow 6. Three buzz-db tests hang on this host; I reproduced the same hangs on the clean phase-1 base and excluded only those from the local run.

What got simpler

Ten database behavior objects and nine desired-state files are gone (about 150 lines). Runtime catalog validation is now one lock-function lookup instead of a trigger join. Each rule has a single owner, the application writer.

🤖 Generated with Claude Code