T1: tests stop sharing state they don't own

- JobQueue takes an optional scope, so a test's worker leases and reaps only its own jobs.
- The dead-host delivery test runs alone (Exclusive), on its own jobs, and cleans up the
  breaker rows it trips; the breaker has tests of its own on unique hosts.
- Index and migration tests run alone: they drop indexes and rewrite every post.
- DomainBlocks.Load replaces reflection and a database-wide block in tests.
- Harness.Outgoing sees only deliveries queued since the harness started: Peer ports are
  reused within a run, which made the circle test flaky.
- Two pure-logic tests leave Mongo-gated classes, so CI runs them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ELjqpznMFMNrJoJUj6K5p2

CLAUDE.md

@@ -316,7 +316,7 @@ cd /var/www/privapub.thepra.dev && sudo -u www-data ASPNETCORE_ENVIRONMENT=Produ
   stored as an edit date on every remote post. Write `(T?)null`. It has shipped four times (`MastodonParams.Bool/Int`,
   `NoteParser.Int`, `NoteParser.Time`).
 - ActivityPub output is built with `System.Text.Json.Nodes` in `ActivityPubRenderer`, not typed models. Inbound
-  documents are read through `InboxService.Id`/`Value`, which handle string, object and array.
+  documents are read through `ActivityJson.Id`/`Value`, which handle string, object and array.
 - Libraries chosen for the roadmap: HtmlSanitizer, Markdig (`DisableHtml`), NSign (RFC 9421 inbound), OpenIddict +
   OpenIddict.MongoDb, NetVips, Blurhash.Core, FFMpegCore. No ImageSharp (licence key enforced), no MassTransit.
 
@@ -327,7 +327,16 @@ without `PRIVAPUB_TEST_MONGOD=1`. CI runs the unit tests only (the box's mongods
 
 - `Support/Peer` is an in-process HTTP server answering on two origins (`127.0.0.1` and `localhost`), so origin rules
   can be tested; `Support/RemoteActor` signs real deliveries with its own key.
-- Inbox scenarios go through `InboxService.Receive` with a signed request, not through the private handlers.
+- Inbox scenarios go through `InboxReceiver.Receive` with a signed request, not through the private handlers.
+- All test classes share one database and run in parallel, so a test touches only rows it made:
+  - random names and GUIDs;
+  - `Harness.Outgoing` sees only deliveries queued since that harness started, because Peer ports are reused;
+  - a worker gets a scoped `new JobQueue(j => ...)` so it never leases another test's jobs;
+  - domain blocks are set with `DomainBlocks.Load`, never written to the database.
+
+  A test that must change something database-wide (drop indexes, run a migration over every post, let deliveries to
+  `localhost` fail and trip its breaker) goes in `[Xunit.Collection(nameof(Exclusive))]`, which runs alone, and
+  cleans up after itself. Pure logic belongs in an unconditional unit test, not in a Mongo-gated class.
 
 Beyond the tests, verify by building, running locally, and exercising:
 - the client API (sign up, create an avatar, a group, a post);
@@ -337,7 +346,7 @@ Interop is checked against real servers, starting with the workstation's own pas
 
 ```bash
 DOTNET=~/.dotnet/dotnet tools/pasture/run.sh up   # podman: PrivaPub + the latest GoToSocial + Mongo, behind Caddy
-tools/pasture/interop.sh                          # 25 checks, each side driven through its own Mastodon API
+tools/pasture/interop.sh                          # 33 checks, each side driven through its own Mastodon API
 tools/pasture/run.sh down
 ```