[ac-pplx]

Mechanical move, no functional change. The sandboxes row writes listed below move into pplx-space-sandbox-store with their SQL byte-for-byte; callers keep their locks, transactions and error handling. Everything else is doc comments, plus three store tests that pin the moved statements. Part of the wave-2 stack (1 of 10, on main); it lands with the stack.

Summary

The api controller finalized a created sandboxes row, and deleted a failed create's row, with inline SQL. This moves those six statements into the store's create module (now pub mod). SQL is byte-for-byte except for binds. Callers keep transactions, error handling and logging. The store functions take any executor, and every bind encodes the same Postgres type as before. The api keeps finalize_created_sandbox as a wrapper that converts OperationId.

Moved (old → new):

• api::controllers::sandbox::queries::finalize_created_sandbox's UPDATE → sandbox_store::create::finalize_created (operation step; the WHERE CAS is the guard).
• queries::create_with_sandbox_id_inner's UPDATE … SET active_node_id → create::record_created_placement (observed projection; id only).
• 2× DELETE FROM sandboxes WHERE id = $1 in create_with_sandbox_id_inner and 2× in updates::rollback_created_sandbox → create::delete_failed_create (operation step; no lifecycle predicate).

sql! locators change: the two UPDATEs now carry /*pplx_space_sandbox_store::create:<line>*/ (seen in pg_stat_activity and query monitoring). The DELETE still has none.

Baseline: sandbox_writes drops queries.rs (4 → gone) and lowers updates.rs (4 → 2). queries.rs's file_size cap drops from 2571 to 2527; updates.rs stays at 1008 (already over on main, advisory).

Validation

At ce4ec1989:

• SQL text vs. old, by script: 6/6 identical.
• cargo nextest run -p pplx-space-sandbox-store -p pplx-space-api --all-features: 2168 passed, 1 config skip, 0 dependency skips.
• Mutation (reverted): dropping AND restore_lease_token = $6 fails create_postgres_tests::create_finalization_accepts_operation_leased_restoring_state.
• cargo clippy --workspace --all-features -D warnings: clean.
• Kind, fresh cluster, images at this head. Up 24m54s; scripts/tests/smoke-kind-typed.sh all 52m07s: ECW 85 passed, 0 failed, 3 inconclusive; native 35 passed. The cold and warm-pool create scenarios passed rerun with SPACE_SMOKE_KIND_COLD_RECEIPTS; local.restarted_btrfs_send_is_rejected_and_retried needs otel mode (unrelated).

At 3e6c98eb (final), which differs only in store doc comments and new store tests; compiled statements are identical apart from sql! locator line numbers:

• cargo nextest run -p pplx-space-sandbox-store --all-features: 22 passed, 0 skipped (Postgres ran), incl. the new tests/create_finish_tests.rs: delete_failed_create_removes_the_row_whatever_its_lifecycle, record_created_placement_records_the_node_on_any_lifecycle, finalize_created_records_command_readiness_on_a_creating_row.
• Mutations, each alone, reverted: M1 AND lifecycle <> 'deleting' fails delete_failed_create_…; M2 dropping placement_changed_at = NOW() fails record_created_placement_…; M3 .bind(command_ready) fails finalize_created_records_….
• Store clippy (--all-targets --all-features -D warnings), store rustdoc (-D warnings), cargo fmt --check, cargo check -p pplx-space-api --all-features: clean. cargo arch vs. main's baseline: 0 required. No existing test changed.

Severity and risk

Severity: n/a (refactor). Risk: low; statements, binds and caller handling are unchanged. Revert to roll back.

Rollout

Old and new pods issue the same statements bar locator comments. No migration.

Not covered

• No api test reaches delete_failed_create through a failed create, and the Kind runs were not checked for one. The new store tests pin the statement itself; its four call sites differ from main only in the call.
• record_created_placement runs in the Direct create tests, but only the new store test asserts its effect, because finalize_created rewrites active_node_id afterwards.

Open PRs that will need to rebase

• [space] fence every placement writer against the provider-terminate path #559 changes the moved statements:
  • the finalize_created_sandbox UPDATE → create::finalize_created. It takes any executor, so it can run on [space] fence every placement writer against the provider-terminate path #559's fence transaction (&mut *tx).
  • the post-create placement UPDATE → create::record_created_placement, which can run on that transaction too.
  • the substrate-failure DELETE and the two rollback_created_sandbox DELETEs → create::delete_failed_create. [space] fence every placement writer against the provider-terminate path #559 replaces them with guarded deletes (lifecycle <> 'deleting', lifecycle = 'deleting', and a creating/restoring delete that checks for an active execution), which delete_failed_create does not express. Those need store functions too, or a reviewed baseline entry: after this PR, queries.rs has no sandbox_writes entry and updates.rs is capped at 2.
• [api] record the activating client and label sandbox pods with it #1068 edits insert_unplaced in sandbox/store/src/create.rs. That function wasn't moved, so this is a file-level overlap only.
• api: close six admin API gaps the admin console works around #1303 edits sandbox/store/src/tests.rs's use super::{…} next to the new mod line; file-level only.

AI assistance: Claude Code (an AI agent) wrote the code change and this description.

After the wave-2 restack

This PR is one layer of a 10-PR stack, restacked onto main c5fdf0c7 (which includes #826) and then rebased mechanically onto 42a99002, which changed only baseline context lines, in order #1329 → #1336 → #1338 → #1339 → #1342 → #1347 → #1333 → #1335 → #1328 → #1332. The validation earlier in this description ran at pre-restack heads; this layer's head is 4a6d0e9e.

• [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826: Main's [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and the commits since the previous restack touched nothing this layer moves, so the commit is unchanged apart from its new base (git range-diff shows =). For every file [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and this stack share, each SQL line [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 added was checked to be present verbatim at the top head, in place or in the store module it moved to.
• At this head: cargo fmt --all -- --check, cargo check --workspace --all-targets --all-features and cargo arch (0 required findings, with main's layers and table-owner rules), and the ratchet and caps this layer changes are recounted exactly.
• At the top of the stack (e90aa284 before that rebase; nextest passed 4370 tests again at 77fbae1e): cargo clippy --workspace --locked --all-targets --all-features -- -D warnings is clean, and SPACE_CI_REQUIRE_TEST_DEPS=1 cargo nextest run --all-features passed 4355 tests across the store, api, internal-api server, cluster-controller server, metrics, db-test-fixtures, common-core, common-svc and portability crates, [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's suites included.
• Kind at the top of the stack, fresh clusters with the otel telemetry mode and CI's cold-receipt directory: scripts/tests/smoke-kind-typed.sh all gave ECW 91/91 and native 42/42, including [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's native.forced_drain_re_places_stopped_sandbox and its re-drain and restarted variants. The Direct substrate lane's all gave ECW 51/51 and native 27/27. No flakes and no reruns.
• Equivalence: apart from the [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 port named above, the PR's own +/- lines and its SQL string literals match its reviewed head (range-diff plus a literal multiset compare).

[github-actions]

Thanks for opening this pull request! A SPACE maintainer will take a look.

CONTRIBUTING.md explains how we review outside contributions.