feat(deletion): add durable whole-community deletion

Cargo.toml

@@ -15,6 +15,7 @@ members = [
     "crates/buzz-test-client",
     "crates/buzz-ws-client",
     "crates/buzz-admin",
+    "crates/buzz-deletion",
     "crates/buzz-workflow",
     "crates/buzz-media",
     "crates/buzz-cli",
@@ -134,6 +135,7 @@ schemars = { version = "1", default-features = false }
 buzz-core = { path = "crates/buzz-core" }
 buzz-conformance = { path = "crates/buzz-conformance" }
 buzz-db = { path = "crates/buzz-db" }
+buzz-deletion = { path = "crates/buzz-deletion" }
 buzz-auth = { path = "crates/buzz-auth" }
 buzz-pubsub = { path = "crates/buzz-pubsub" }
 buzz-search = { path = "crates/buzz-search" }

crates/buzz-admin/Cargo.toml

@@ -13,6 +13,7 @@ path = "src/main.rs"
 
 [dependencies]
 buzz-db = { workspace = true }
+buzz-deletion = { workspace = true }
 buzz-core = { workspace = true }
 buzz-auth = { workspace = true }
 buzz-pubsub = { workspace = true }

crates/buzz-admin/src/deletions.rs

@@ -0,0 +1,19 @@
+//! Thin `buzz-admin deletions` adapter.
+
+pub use buzz_deletion::Command as DeletionsCommand;
+
+/// Delegate to the shared durable deletion engine.
+pub async fn run(command: DeletionsCommand) -> anyhow::Result<i32> {
+    buzz_deletion::run(command).await
+}
+
+#[cfg(test)]
+mod tests {
+    use clap::Parser;
+
+    #[test]
+    fn continuous_worker_command_is_not_exposed() {
+        let command = crate::Cli::try_parse_from(["buzz-admin", "deletions", "worker"]);
+        assert!(command.is_err());
+    }
+}

crates/buzz-admin/src/main.rs

@@ -20,6 +20,8 @@
 //! newest timestamp and collide on the bumped second. run.sh serialization is
 //! the guard against parallel adds (e.g. `xargs -P`).
 
+mod deletions;
+
 use std::sync::Arc;
 
 use anyhow::Result;
@@ -81,6 +83,11 @@ enum Command {
         #[command(subcommand)]
         command: ProductFeedbackCommand,
     },
+    /// Durable CLI-only whole-community deletion control plane.
+    Deletions {
+        #[command(subcommand)]
+        command: deletions::DeletionsCommand,
+    },
     /// Emit kind:39000/39002 events for channels missing them.
     ///
     /// Channels created via direct SQL (seed scripts, pre-migration data) won't
@@ -148,6 +155,7 @@ async fn run(cli: Cli) -> Result<i32> {
         Command::ProductFeedback {
             command: ProductFeedbackCommand::List { limit },
         } => cmd_list_product_feedback(limit).await,
+        Command::Deletions { command } => deletions::run(command).await,
         Command::ReconcileChannels { relay_key } => {
             reconcile_channels(relay_key).await?;
             Ok(0)

crates/buzz-db/src/channel.rs

@@ -1508,6 +1508,7 @@ pub async fn reap_expired_ephemeral_channels(pool: &PgPool) -> Result<Vec<Reaped
            AND ch.archived_at IS NULL \
            AND ch.deleted_at IS NULL \
            AND c.archived_at IS NULL \
+           AND community_write_allowed(ch.community_id) \
          RETURNING ch.community_id, c.host, ch.id",
     )
     .fetch_all(pool)