refactor(db): finish replaceable event store extraction

[TheSentinel454]

Why

Finish the replaceable-event slice of tracker #2 and domain issue #6 without disturbing the runtime/store boundary established by #6660 and #6668. PR #6700 has merged; this PR now targets current main containing its replacement lock and transaction observability.

What

• Move Db::replace_addressable_event, its SQL, lock/transaction instrumentation, and focused addressable/parameterized replacement tests from lib.rs to replaceable.rs
• Preserve the transaction-required parameterized API, replacement ordering, rollback semantics, mention indexing, and exactly one datastore span per public operation
• Keep implementation and focused PostgreSQL tests co-located; follow-up review removed the dedicated replaceable ownership source guard as low value

Stack

• Exact base: main at f249710
• Exact head: codex/issue-6-finish-replaceable-store at da01840
• Tracker: buzz-db: break up lib.rs — move impl Db methods to domain modules TheSentinel454/buzz#2
• Domain: buzz-db: extract replaceable-event logic from lib.rs TheSentinel454/buzz#6
• Test/span acceptance: buzz-db: move lib.rs tests (~4,000 lines) to domain modules TheSentinel454/buzz#17 and buzz-db: consistent #[datastore_span] tracing placement TheSentinel454/buzz#19

Non-goals

• No SQL, schema, retry, timeout, lock ordering, transaction boundary, or client-visible behavior changes
• No store traits, domain-handle redesign, PgExecutor migration, raw pool accessor, new crate, or directory reorganization
• No changes to, retargeting of, or merge action on PR Add database pressure observability #6700

Risk Assessment

Low. This is a mechanical ownership move with unchanged signatures and SQL. The primary review risk is losing or nesting instrumentation, covered by exact moved PostgreSQL tests and the cumulative production-diff audit.

Blox Verification

Author workstation: buzz-tornquist-issue-2-store-stack (2046520), exact head 2de5444e14606ce6912d1bb932bc88bffa379a77.

• cargo fmt --all --check — passed
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings — passed
• cargo test -p buzz-db --quiet — 108 passed, 200 ignored; both integration source guards passed
• Native PostgreSQL: cargo test -p buzz-db replaceable::tests:: -- --ignored --test-threads=1 — 11 passed
• cargo test -p buzz-relay --lib api::mesh_demo::tests::demo_join_forwarded_arm_round_trips_echo -- --exact --test-threads=1 — passed
• Full serial relay suite was also exercised: 908 tests passed but the existing load-sensitive mesh demo test returned 504 under suite load, matching PR Add database pressure observability #6700's documented baseline; it passed in isolation and this diff does not touch that subsystem

Independent exact-head Blox review: buzz-tornquist-pr-6777-review (2047422) at 2de5444e14606ce6912d1bb932bc88bffa379a77.

• Review findings — none (critical, important, or minor)
• cargo fmt --all --check and the ownership guard — passed
• cargo clippy -p buzz-db -p buzz-relay --all-targets -- -D warnings — passed
• cargo test -p buzz-db --quiet — 108 passed, 200 ignored; source guards passed
• Native PostgreSQL moved suite — 11 passed
• cargo test -p buzz-relay --lib — 909 passed, 48 ignored

Generated with Codex

Superseded pre-comment restack verification

PR #6700 merged before publication completed. This layer was restacked onto current main through the exact parent named above; the final cumulative tip is 2ddcc8a. Cumulative author gates passed: formatting and diff checks; buzz-db and buzz-relay all-target clippy with -D warnings; DB lib 111 passed / 200 ignored; ownership 22/22; observability 1/1; the full isolated PostgreSQL domain matrix; and relay lib 910 passed / 49 ignored.

• Workstation: buzz-tornquist-pr-6777-final-review (2057617), fresh shallow checkout
• Base: f24971033178926153b49d320bd876d15d9cb2bf
• Head: ffbeaaf00810aa359ab85818ff4820f92263e45f
• Findings: none

Reviewed base..head for the replaceable-store extraction. The addressable replacement SQL, stale/duplicate outcomes, advisory-lock ordering, transaction rollback/commit boundaries, mention-index atomicity, and public Db signature are retained in replaceable.rs. The PR #6700 transaction timer remains around the same logical transaction through TransactionTimer::observe, and the public operation has exactly one datastore span. Focused addressable and parameterized tests moved with the implementation; the ownership guard excludes duplicates from lib.rs.

Verification: format and diff checks passed; buzz-db --all-targets clippy passed with -D warnings; DB lib tests passed (111 passed, 200 PostgreSQL tests ignored); ownership (1/1) and observability (1/1) guards passed; all 11 replaceable PostgreSQL tests passed on native PostgreSQL 17 with migrations 1-32 successful; relay lib test target compiled successfully. Final worktree was detached at the exact head and clean.

Complete evidence archive SHA-256: e37f92bbde4e2343196085095b3093b1bc78196be58bc86826325e0e1639d7ea.

Comment-addressed restack

Review follow-up removed the dedicated replaceable_store_has_single_ownership source test as requested. No production code changed.

• Exact base: f24971033178926153b49d320bd876d15d9cb2bf
• Exact head: da018405cc83605362125c2d5e5a3f91492431ac
• Final cumulative tip: 6fa2f104d42c6ba85bdf62e7ccb74ceaf4a84f67
• Focused PR verification: formatting and diff checks passed; strict buzz-db/buzz-relay Clippy passed; DB lib 111 passed / 200 ignored; all 11 replaceable PostgreSQL tests passed.
• Cumulative Blox gate: formatting and diff checks; strict buzz-db/buzz-relay Clippy; DB lib 111 passed / 200 ignored; ownership 21/21; observability 1/1; every moved PostgreSQL test; relay lib 910 passed / 49 ignored.
• Independent re-review at this exact head: no findings; fresh exact-parent/head Blox review passed fmt/diff, strict buzz-db Clippy, DB lib 111 passed / 200 ignored, manual one-owner/one-span replacement checks, observability, 11 replaceable PostgreSQL tests, and relay compilation.

[wpfleger96]

🤖 Combined review from three independent passes (source review ×2 + live E2E) at exact head da01840.

One item before merge — PR title: CONTRIBUTING.md requires Conventional Commits format for PR titles since the repo squash-merges, so this title would land a nonconforming subject on main. Suggest: refactor(db): finish replaceable event store extraction.

No code findings. Evidence across the passes:

• Move fidelity: the replace_addressable_event body in replaceable.rs differs from the removed lib.rs code only by rustfmt rewrapping and module-local access to event_replacement_lock_key; all 11 focused PostgreSQL tests relocated 1:1, and coordinate_delete_spares_head_newer_than_the_deletion correctly remains in lib.rs beside soft_delete_by_coordinate, which it exercises.
• Instrumentation: exactly one datastore_span moved (lib.rs 206→205, replaceable.rs 1→2) — no lost or nested spans; advisory-lock keying, SQL predicates/binds, rollback/commit boundaries, and mention indexing are unchanged.
• Test-helper duplication in the new module matches the established per-module pattern across the other buzz-db modules.
• Live E2E against a relay built at this head: the CI-unselected NIP-38 user-status suite (5/5) and NIP-16 kind-0 profile replacement journey (1/1) passed, with direct Postgres inspection confirming exactly one live row per replaced coordinate and stale-write resistance.
• CI fully green at this head; main has no crates/buzz-db drift since the merge-base.