[ac-pplx]

Summary

#714 added has_live_network_policy_gateway as a public sbx-mgr store reader and called it from the server. #715 (typed db::read views) and #721 (old readers non-public outside tests) landed after it without a view for it, so #721 left it public. It was the one flat crate::db sandbox reader that production code outside the store still called directly.

• Accessor: SandboxView::live_network_policy_gateway() is one call to the reader, with the same id, strictness and error. It answers whether a row has netgtw_pid IS NOT NULL AND pool_template IS NULL, and returns false without a row.
• Call site: the server's template network-policy update (sandbox_network_policy.rs) now calls crate::db::read::sandbox_view(&db, &sandbox.id).live_network_policy_gateway(). The connection guard, lock scope and map_err text are unchanged.
• Narrowed reader: has_live_network_policy_gateway is declared with db_private_outside_tests!. The store's own &tx callers in update_network_policy_override and clear_local_network_policy and its tests keep using it.
• Tests: the accessor table in store/src/db/read/tests.rs checks the view and the old reader against fixed expectations. On the main row, which has a registered gateway, they are [T, T, F, T] across Accepting, CorruptJson, MissingRow and PreviousWithoutCurrent. On the paused row, which has none, they are [F, F, F, F].

Validation

At b43d9dc6:

Check	Result
bash ci/scripts/run-rust-checks.sh fmt	pass
bash ci/scripts/run-rust-checks.sh clippy, including all three sbx-mgr production feature sets	pass
cargo arch, with the base baseline, renames and architecture from main	pass; 0 required findings, none in the changed files
SPACE_CI_REQUIRE_TEST_DEPS=1 cargo nextest run --locked over pplx-space-sbx-mgr, -sbx-mgr-store, -db-migrate, -db-migrator, -db-test-fixtures	1962 passed, 1 skipped (the #[ignore]d transfer_directory::tests::distinct_service_uids_can_exchange_downloads)
Mutation: accessor returns Ok(true)	fails: live_network_policy_gateway without a gateway on Accepting (True vs False)
Mutation: accessor returns Ok(false)	fails: live_network_policy_gateway on Accepting (False vs True)
Production clippy (no test-support) with the server call reverted to crate::db::has_live_network_policy_gateway	fails: E0603 function has_live_network_policy_gateway is private; passes again once restored

Kind was not run.

Severity and risk

Severity: does not apply (an API-boundary cleanup). Risk: low. The production read runs the same statement on the same connection guard. Roll back by reverting this commit.

AI assistance: Claude Code drafted the code, tests and this description.

[github-actions]

Thanks for opening this pull request! A SPACE maintainer will take a look.

CONTRIBUTING.md explains how we review outside contributions.