fix(relay): close legacy sockets after community FI upgrades

crates/buzz-db/src/store/community_auth.rs

@@ -112,7 +112,7 @@ const RECEIPT: &str = "SELECT u.*, true AS requires_nip_fi,
         AND EXISTS (SELECT 1 FROM community_nip_fi_issuers i
             WHERE i.community_id = c.id AND i.issuer = u.expected_issuer)
     THEN 'pending' ELSE 'unavailable' END AS state,
-    ARRAY['registry_baseline_unverified']::text[] AS pending_reasons
+    ARRAY['connection_closure_unverified']::text[] AS pending_reasons
     FROM community_auth_upgrades u
     LEFT JOIN communities c ON c.id = u.target_community_id
     WHERE u.operation_id = $1";

crates/buzz-relay/src/api/operator.rs

@@ -3243,7 +3243,7 @@ mod postgres_tests {
         assert_eq!(record["state"], "pending");
         assert_eq!(
             record["pending_reasons"],
-            serde_json::json!(["registry_baseline_unverified"])
+            serde_json::json!(["connection_closure_unverified"])
         );
         // A fresh signed retry recovers the same tuple despite the lost response.
         let retry =

crates/buzz-relay/src/main.rs

@@ -1962,7 +1962,7 @@ async fn run_community_revalidator(
         if closed > 0 {
             tracing::info!(
                 closed,
-                "closed sockets for inactive communities during lifecycle revalidation"
+                "closed sockets for inactive communities or required authentication policy"
             );
         }
     })

crates/buzz-relay/src/nip_fi_policy.rs

@@ -11,7 +11,7 @@ use buzz_auth::{DenialClass, NipFiMode};
 use buzz_db::community_auth::CommunityAuthPolicy;
 use futures_util::future::{BoxFuture, FutureExt};
 
-const POLICY_READ_BUDGET: std::time::Duration = std::time::Duration::from_millis(500);
+pub(crate) const POLICY_READ_BUDGET: std::time::Duration = std::time::Duration::from_millis(500);
 
 /// Host policy source, shared by admission and discovery.
 pub(crate) trait PolicySource: Send + Sync {

crates/buzz-relay/src/nip_fi_test_hooks.rs

@@ -154,6 +154,7 @@ macro_rules! make_hook {
     };
 }
 
+make_hook!(community_registration_hook, before_community_registration);
 make_hook!(auth_commit_hook, before_auth_commit);
 make_hook!(event_ingest_hook, before_event_ingest);
 make_hook!(req_registration_hook, before_req_registration);

crates/buzz-relay/src/router.rs

@@ -2792,6 +2792,9 @@ mod tests {
         );
     }
 
+    #[path = "policy_sweep_postgres_tests.rs"]
+    mod policy_sweep;
+
     // ── F6: document fallback (postgres-only) ───────────────────────────────────
     //
     // A no-`Accept` plain GET / to a successfully mapped host must bypass the
@@ -3193,7 +3196,7 @@ mod tests {
             }
         }
 
-        async fn real_db_state() -> Option<Arc<AppState>> {
+        pub(super) async fn real_db_state() -> Option<Arc<AppState>> {
             let db_url = crate::test_support::database_url();
             let pool = sqlx::PgPool::connect(&db_url).await.ok()?;