feat: atomic social local writes, remote review enrichment

SocialCommand methods take events. Local follow ops = one FollowCommand::apply
tx (rows + events). k_ap path (remote, block/unblock): best-effort publish in
CompositeSocialAdapter after k_ap write; not atomic, k_ap owns tx.
save_remote_review takes events, enqueued in same tx via
sqlite::persistence::enqueue_events. Deps drop event_publisher: social
command, ReviewObjectHandler.

Remaining .publish( sites:
announce-only: users/delete_account UserDeleted, person/get + get_credits
PersonEnrichmentRequested, jobs/enrichment_staleness, http-axum search,
ImageStored (sync_poster, poster_sync_handler, image-converter backfill,
update_profile; object storage), federation_event_bridge (handler reaction),
nats relay (transport).
non-atomic by necessity: CompositeSocialAdapter::announce (k_ap-owned write).
Everything else rides its write.

crates/adapters/sqlite/src/lib.rs

@@ -22,7 +22,7 @@ pub use repositories::{
 /// Row helpers shared with the `sqlite-federation` crate (which cannot live
 /// here because it depends on `activitypub`/`k-ap`).
 pub mod persistence {
-    pub use crate::shared::datetime_to_str;
+    pub use crate::shared::{datetime_to_str, enqueue_events};
 }
 
 pub fn create_profile_fields_repo(

crates/adapters/sqlite/src/repositories/social/follow/command.rs

@@ -1,130 +1,126 @@
 use async_trait::async_trait;
 use chrono::Utc;
-use domain::{errors::DomainError, value_objects::FollowStatus};
+use domain::{
+    errors::DomainError,
+    events::DomainEvent,
+    ports::{FollowCommand, FollowWrite},
+};
 
-use crate::shared::datetime_to_str;
+use crate::shared::{datetime_to_str, enqueue_events};
 
 use super::infra_err;
 use super::rows::follow_status_to_str;
 use crate::repositories::social::SqliteSocialRepository;
 
 #[async_trait]
-impl domain::ports::FollowCommand for SqliteSocialRepository {
-    async fn add_follow(
+impl FollowCommand for SqliteSocialRepository {
+    async fn apply(
         &self,
-        follower_id: uuid::Uuid,
-        target_actor_url: &str,
-        status: FollowStatus,
+        writes: &[FollowWrite],
+        events: &[DomainEvent],
     ) -> Result<(), DomainError> {
-        let uid = follower_id.to_string();
-        let status_str = follow_status_to_str(&status);
-        let now = datetime_to_str(&Utc::now().naive_utc());
-        sqlx::query(
-            "INSERT INTO ap_following (local_user_id, remote_actor_url, follow_activity_id, created_at, status)
-             VALUES (?1, ?2, '', ?3, ?4)
-             ON CONFLICT(local_user_id, remote_actor_url) DO UPDATE SET status = excluded.status",
-        )
-        .bind(&uid)
-        .bind(target_actor_url)
-        .bind(&now)
-        .bind(status_str)
-        .execute(&self.pool)
-        .await
-        .map_err(infra_err)?;
-        Ok(())
-    }
-
-    async fn update_follow_status(
-        &self,
-        follower_id: uuid::Uuid,
-        target_actor_url: &str,
-        status: FollowStatus,
-    ) -> Result<(), DomainError> {
-        let uid = follower_id.to_string();
-        let status_str = follow_status_to_str(&status);
-        sqlx::query(
-            "UPDATE ap_following SET status = ?1 WHERE local_user_id = ?2 AND remote_actor_url = ?3",
-        )
-        .bind(status_str)
-        .bind(&uid)
-        .bind(target_actor_url)
-        .execute(&self.pool)
-        .await
-        .map_err(infra_err)?;
-        Ok(())
-    }
-
-    async fn remove_follow(
-        &self,
-        follower_id: uuid::Uuid,
-        target_actor_url: &str,
-    ) -> Result<(), DomainError> {
-        let uid = follower_id.to_string();
-        sqlx::query("DELETE FROM ap_following WHERE local_user_id = ?1 AND remote_actor_url = ?2")
-            .bind(&uid)
-            .bind(target_actor_url)
-            .execute(&self.pool)
-            .await
-            .map_err(infra_err)?;
-        Ok(())
-    }
-
-    async fn add_follower(
-        &self,
-        local_user_id: uuid::Uuid,
-        follower_actor_url: &str,
-        status: FollowStatus,
-    ) -> Result<(), DomainError> {
-        let uid = local_user_id.to_string();
-        let status_str = follow_status_to_str(&status);
-        let now = datetime_to_str(&Utc::now().naive_utc());
-        sqlx::query(
-            "INSERT INTO ap_followers (local_user_id, remote_actor_url, status, created_at, follow_activity_id)
-             VALUES (?1, ?2, ?3, ?4, '')
-             ON CONFLICT(local_user_id, remote_actor_url) DO UPDATE SET status = excluded.status",
-        )
-        .bind(&uid)
-        .bind(follower_actor_url)
-        .bind(status_str)
-        .bind(&now)
-        .execute(&self.pool)
-        .await
-        .map_err(infra_err)?;
-        Ok(())
-    }
-
-    async fn update_follower_status(
-        &self,
-        local_user_id: uuid::Uuid,
-        follower_actor_url: &str,
-        status: FollowStatus,
-    ) -> Result<(), DomainError> {
-        let uid = local_user_id.to_string();
-        let status_str = follow_status_to_str(&status);
-        sqlx::query(
-            "UPDATE ap_followers SET status = ?1 WHERE local_user_id = ?2 AND remote_actor_url = ?3",
-        )
-        .bind(status_str)
-        .bind(&uid)
-        .bind(follower_actor_url)
-        .execute(&self.pool)
-        .await
-        .map_err(infra_err)?;
-        Ok(())
-    }
-
-    async fn remove_follower_record(
-        &self,
-        local_user_id: uuid::Uuid,
-        follower_actor_url: &str,
-    ) -> Result<(), DomainError> {
-        let uid = local_user_id.to_string();
-        sqlx::query("DELETE FROM ap_followers WHERE local_user_id = ?1 AND remote_actor_url = ?2")
-            .bind(&uid)
-            .bind(follower_actor_url)
-            .execute(&self.pool)
-            .await
-            .map_err(infra_err)?;
-        Ok(())
+        let mut tx = self.pool.begin().await.map_err(infra_err)?;
+        for write in writes {
+            apply_write(&mut tx, write).await?;
+        }
+        enqueue_events(&mut tx, events).await?;
+        tx.commit().await.map_err(infra_err)
     }
 }
+
+async fn apply_write(
+    tx: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
+    write: &FollowWrite,
+) -> Result<(), DomainError> {
+    let now = datetime_to_str(&Utc::now().naive_utc());
+    match write {
+        FollowWrite::AddFollow {
+            follower_id,
+            target_actor_url,
+            status,
+        } => {
+            sqlx::query(
+                "INSERT INTO ap_following (local_user_id, remote_actor_url, follow_activity_id, created_at, status)
+                 VALUES (?1, ?2, '', ?3, ?4)
+                 ON CONFLICT(local_user_id, remote_actor_url) DO UPDATE SET status = excluded.status",
+            )
+            .bind(follower_id.to_string())
+            .bind(target_actor_url)
+            .bind(&now)
+            .bind(follow_status_to_str(status))
+            .execute(&mut **tx)
+            .await
+        }
+        FollowWrite::UpdateFollowStatus {
+            follower_id,
+            target_actor_url,
+            status,
+        } => {
+            sqlx::query(
+                "UPDATE ap_following SET status = ?1 WHERE local_user_id = ?2 AND remote_actor_url = ?3",
+            )
+            .bind(follow_status_to_str(status))
+            .bind(follower_id.to_string())
+            .bind(target_actor_url)
+            .execute(&mut **tx)
+            .await
+        }
+        FollowWrite::RemoveFollow {
+            follower_id,
+            target_actor_url,
+        } => {
+            sqlx::query(
+                "DELETE FROM ap_following WHERE local_user_id = ?1 AND remote_actor_url = ?2",
+            )
+            .bind(follower_id.to_string())
+            .bind(target_actor_url)
+            .execute(&mut **tx)
+            .await
+        }
+        FollowWrite::AddFollower {
+            local_user_id,
+            follower_actor_url,
+            status,
+        } => {
+            sqlx::query(
+                "INSERT INTO ap_followers (local_user_id, remote_actor_url, status, created_at, follow_activity_id)
+                 VALUES (?1, ?2, ?3, ?4, '')
+                 ON CONFLICT(local_user_id, remote_actor_url) DO UPDATE SET status = excluded.status",
+            )
+            .bind(local_user_id.to_string())
+            .bind(follower_actor_url)
+            .bind(follow_status_to_str(status))
+            .bind(&now)
+            .execute(&mut **tx)
+            .await
+        }
+        FollowWrite::UpdateFollowerStatus {
+            local_user_id,
+            follower_actor_url,
+            status,
+        } => {
+            sqlx::query(
+                "UPDATE ap_followers SET status = ?1 WHERE local_user_id = ?2 AND remote_actor_url = ?3",
+            )
+            .bind(follow_status_to_str(status))
+            .bind(local_user_id.to_string())
+            .bind(follower_actor_url)
+            .execute(&mut **tx)
+            .await
+        }
+        FollowWrite::RemoveFollowerRecord {
+            local_user_id,
+            follower_actor_url,
+        } => {
+            sqlx::query(
+                "DELETE FROM ap_followers WHERE local_user_id = ?1 AND remote_actor_url = ?2",
+            )
+            .bind(local_user_id.to_string())
+            .bind(follower_actor_url)
+            .execute(&mut **tx)
+            .await
+        }
+    }
+    .map_err(infra_err)?;
+    Ok(())
+}

crates/adapters/sqlite/src/shared.rs

@@ -13,7 +13,7 @@ use domain::{
 /// THE outbox write path: inserts one `event_queue` row per event, each with a
 /// fresh `EventId`, inside the caller's transaction so a change and the events
 /// announcing it commit or roll back together.
-pub(crate) async fn enqueue_events(
+pub async fn enqueue_events(
     tx: &mut sqlx::Transaction<'_, sqlx::Sqlite>,
     events: &[domain::events::DomainEvent],
 ) -> Result<(), DomainError> {

crates/adapters/sqlite/tests/cascade_test.rs

@@ -11,7 +11,8 @@ use domain::models::{
     WatchEvent, WatchEventSource, WatchlistEntry, WebhookToken,
 };
 use domain::ports::{
-    FollowCommand, UserProfileFieldsRepository, WatchEventCommand, WebhookTokenRepository,
+    FollowCommand, FollowWrite, UserProfileFieldsRepository, WatchEventCommand,
+    WebhookTokenRepository,
 };
 use domain::testing::{
     MOVIE_CASCADE_TABLES, USER_CASCADE_TABLES, USER_CASCADE_TABLES_OUTSIDE_STORE, test_goal,
@@ -184,11 +185,21 @@ async fn seed_user_with_dependents(
         domain::value_objects::InstanceIdentity::new("https://md.example"),
     );
     social
-        .add_follow(user_id.value(), REMOTE_ACTOR, FollowStatus::Accepted)
-        .await
-        .unwrap();
-    social
-        .add_follower(user_id.value(), REMOTE_ACTOR, FollowStatus::Accepted)
+        .apply(
+            &[
+                FollowWrite::AddFollow {
+                    follower_id: user_id.value(),
+                    target_actor_url: REMOTE_ACTOR.into(),
+                    status: FollowStatus::Accepted,
+                },
+                FollowWrite::AddFollower {
+                    local_user_id: user_id.value(),
+                    follower_actor_url: REMOTE_ACTOR.into(),
+                    status: FollowStatus::Accepted,
+                },
+            ],
+            &[],
+        )
         .await
         .unwrap();
     // No repository in this crate owns these two tables (federation crate).

crates/adapters/sqlite/tests/repositories/outbox_writes_test.rs

@@ -712,3 +712,85 @@ async fn a_failing_enqueue_rolls_back_the_watch_event_save() {
     assert!(result.is_err());
     assert_eq!(count(&pool, "watch_events").await, 0);
 }
+
+fn follow_writes(user_id: &UserId) -> Vec<domain::ports::FollowWrite> {
+    use domain::{ports::FollowWrite, value_objects::FollowStatus};
+    vec![
+        FollowWrite::AddFollower {
+            local_user_id: user_id.value(),
+            follower_actor_url: "https://md.example/users/other".into(),
+            status: FollowStatus::Pending,
+        },
+        FollowWrite::AddFollow {
+            follower_id: user_id.value(),
+            target_actor_url: "https://md.example/users/other".into(),
+            status: FollowStatus::Pending,
+        },
+    ]
+}
+
+fn follow_requested(user_id: &UserId) -> DomainEvent {
+    DomainEvent::FollowRequested {
+        follower: user_id.clone(),
+        target: domain::value_objects::FollowTarget::Handle("@other@md.example".into()),
+    }
+}
+
+fn social_repo(pool: &SqlitePool) -> sqlite::SqliteSocialRepository {
+    sqlite::SqliteSocialRepository::new(
+        pool.clone(),
+        domain::value_objects::InstanceIdentity::new("https://md.example"),
+    )
+}
+
+#[tokio::test]
+async fn a_local_follow_writes_both_rows_and_its_event_in_one_commit() {
+    use domain::ports::FollowCommand;
+    let (pool, user) = pool_with_user().await;
+
+    social_repo(&pool)
+        .apply(&follow_writes(user.id()), &[follow_requested(user.id())])
+        .await
+        .unwrap();
+
+    assert_eq!(count(&pool, "ap_followers").await, 1);
+    assert_eq!(count(&pool, "ap_following").await, 1);
+    assert_eq!(count(&pool, "event_queue").await, 1);
+}
+
+#[tokio::test]
+async fn a_failing_enqueue_rolls_back_both_follow_rows() {
+    use domain::ports::FollowCommand;
+    let (pool, user) = pool_with_user().await;
+    fail_event_inserts(&pool).await;
+
+    let result = social_repo(&pool)
+        .apply(&follow_writes(user.id()), &[follow_requested(user.id())])
+        .await;
+
+    assert!(result.is_err());
+    assert_eq!(count(&pool, "ap_followers").await, 0);
+    assert_eq!(count(&pool, "ap_following").await, 0);
+}
+
+#[tokio::test]
+async fn a_failing_follow_write_rolls_back_the_rows_already_applied() {
+    use domain::ports::{FollowCommand, FollowWrite};
+    let (pool, user) = pool_with_user().await;
+    let mut writes = follow_writes(user.id());
+    // An unknown local user violates the ap_following foreign key after the
+    // follower row was already written.
+    writes.push(FollowWrite::AddFollow {
+        follower_id: uuid::Uuid::new_v4(),
+        target_actor_url: "https://md.example/users/other".into(),
+        status: domain::value_objects::FollowStatus::Pending,
+    });
+
+    let result = social_repo(&pool)
+        .apply(&writes, &[follow_requested(user.id())])
+        .await;
+
+    assert!(result.is_err());
+    assert_eq!(count(&pool, "ap_followers").await, 0);
+    assert_eq!(count(&pool, "event_queue").await, 0);
+}