buzz-db: enforce five single-table guards in app writers (phase 1)

crates/buzz-db/src/store/channel.rs

@@ -1417,7 +1417,8 @@ async fn update_channel_on(
     }
     if policy_changed {
         sqlx::query(
-            "UPDATE communities SET artifact_policy_modified_at=clock_timestamp() WHERE id=$1",
+            "UPDATE communities SET artifact_policy_modified_at=clock_timestamp() \
+             WHERE id=$1 AND deletion_state = 'active'",
         )
         .bind(community_id.as_uuid())
         .execute(tx.conn())
@@ -1838,10 +1839,13 @@ async fn soft_delete_on(w: &mut ChannelSettingsWriter<'_>) -> Result<()> {
         .bind(channel_id)
         .execute(w.tx.conn())
         .await?;
-    sqlx::query("UPDATE communities SET artifact_policy_modified_at=clock_timestamp() WHERE id=$1")
-        .bind(community_id.as_uuid())
-        .execute(w.tx.conn())
-        .await?;
+    sqlx::query(
+        "UPDATE communities SET artifact_policy_modified_at=clock_timestamp() \
+         WHERE id=$1 AND deletion_state = 'active'",
+    )
+    .bind(community_id.as_uuid())
+    .execute(w.tx.conn())
+    .await?;
     Ok(())
 }
 

crates/buzz-db/src/store/community.rs

@@ -486,17 +486,23 @@ impl Db {
             crate::observability::WriterOperation::EventWrite,
         )
         .await?;
-        sqlx::query(
+        let affected = sqlx::query(
             r#"
             UPDATE communities
             SET icon = $2
-            WHERE id = $1
+            WHERE id = $1 AND deletion_state = 'active' AND deleted_at IS NULL
             "#,
         )
         .bind(community_id.as_uuid())
         .bind(icon)
         .execute(&mut *connection)
-        .await?;
+        .await?
+        .rows_affected();
+        if affected != 1 {
+            return Err(DbError::AccessDenied(format!(
+                "community {community_id} is missing or write-fenced"
+            )));
+        }
         Ok(())
     }
 
@@ -818,7 +824,7 @@ impl Db {
         }
         let row = sqlx::query(
             "UPDATE communities SET archived_at = COALESCE(archived_at, now()) \
-             WHERE id = $1 RETURNING id, host, archived_at",
+             WHERE id = $1 AND deletion_state = 'active' RETURNING id, host, archived_at",
         )
         .bind(community_id)
         .fetch_one(&mut *tx)
@@ -885,10 +891,12 @@ impl Db {
             tx.rollback().await?;
             return Ok(UnarchiveCommunityResult::DeletionPending);
         }
-        sqlx::query("UPDATE communities SET archived_at = NULL WHERE id = $1")
-            .bind(community_id)
-            .execute(&mut *tx)
-            .await?;
+        sqlx::query(
+            "UPDATE communities SET archived_at = NULL WHERE id = $1 AND deletion_state = 'active'",
+        )
+        .bind(community_id)
+        .execute(&mut *tx)
+        .await?;
         tx.commit().await?;
         Ok(UnarchiveCommunityResult::Unarchived(
             UnarchivedCommunityRecord {

crates/buzz-db/src/store/community_auth.rs

@@ -412,7 +412,8 @@ impl Db {
             .await?;
         let generation = old_generation + 1;
         sqlx::query(
-            "UPDATE communities SET policy_generation = $2, requires_nip_fi = $3 WHERE id = $1",
+            "UPDATE communities SET policy_generation = $2, requires_nip_fi = $3 \
+             WHERE id = $1 AND deletion_state = 'active'",
         )
         .bind(request.community_id)
         .bind(generation)