[ac-pplx]

Mechanical move, no functional change. The sandboxes row writes listed below move into pplx-space-sandbox-store with their SQL byte-for-byte; callers keep their locks, transactions and error handling. Everything else is doc comments. Part of the wave-2 stack (7 of 10, on #1347); it lands with the stack.

Summary

PublishNodeState wrote the sandboxes row inline in four internal-API places. Each statement moves into pplx-space-sandbox-store with its SQL text byte-for-byte; only the binds change. Each new function's doc names the fact it writes and any unusual guards. Callers keep the publication transaction, candidate locks (FOR UPDATE), recordset serialization and error mapping.

• published_state::converge_stopped_sandboxes (statement) → ingest::converge_published_stopped (observed projection; has no evacuation exemption)
• published_state::update_activity_timestamps (statement) → ingest::advance_published_activity (observed projection; checks only active_node_id)
• published_state::DELETE_ABSENT_STOPPED_SANDBOXES → ingest::delete_published_absent_stopped (inference; its FOR UPDATE OF s stays inside the statement)
• sandbox_quarantine_store::apply_activation_rollback_candidates (UPDATE sandboxes) → new quarantine::converge_activation_rollback (observed projection). It returns bool, where the caller previously checked rows_affected() != 1; id is the primary key, so the two are equivalent.

architecture-baseline.toml: both files' pattern_ratchet.sandbox_writes entries are removed (3 and 1). The file_size cap for published_state.rs drops from 3658 to 3504; the old cap was already stale at 3632. The internal-api AGENTS.md now points the stopped projection at pplx_space_sandbox_store::ingest. No test files change (git diff --stat $(git merge-base origin/main HEAD) HEAD -- '*test*' '*/tests/*' is empty).

sql! locators change: these four statements now report pplx_space_sandbox_store::ingest / ::quarantine in pg_stat_activity and query monitoring, instead of the internal-api modules.

Validation

• cargo nextest run -p pplx-space-sandbox-store -p pplx-space-internal-api-server -p pplx-space-internal-api-svc: 431 passed, 0 skipped. Postgres ran in a container.
• cargo nextest run -p pplx-space-api -p pplx-space-template-mgr: 1865 passed, 1 failed, 1 skipped (an opt-in #[ignore] benchmark). The failure, routes::e2b::tests::detail_reports_authoritative_federated_ownership_not_metadata, is a JSON key-order snapshot mismatch. Under this package selection it fails the same way on origin/main, and it passes in CI's full workspace test run.
• cargo clippy -p pplx-space-sandbox-store -p pplx-space-internal-api-server --all-targets -- -D warnings: clean.
• cargo arch, plus --base-baseline/--base-architecture from main: 0 required findings.
• Mutation proof (each one local only, then reverted):
  • Dropping 'started' from the stopped convergence fails node_publication_converges_only_from_its_source_lifecycles.
  • Dropping s.lifecycle = 'stopped' from the absent delete fails absent_report_deletes_only_a_stopped_direct_row and absent_stopped_delete_decides_on_the_row_committed_while_it_waits.
  • Dropping the node check from the activity advance fails publish_sandbox_state_updates_activity_clocks_without_touching_updated_at.
  • Always clearing placement_changed_at in the rollback fails activation_rollback_receipts_converge_stable_targets_with_attempt_fence.
• Fresh Kind from this change before its review fixes, which edit only doc comments (install-fc-vendor.sh, up.sh): up in 628 s.
• scripts/tests/smoke-kind-typed.sh all: ECW 85 passed, 0 failed, 3 inconclusive; native 35 passed, 0 failed; wall 3126 s.
  • ecw.cold_create_environment and ecw.warm_pool_environment passed on rerun once SPACE_SMOKE_KIND_COLD_RECEIPTS and a token file were set.
  • local.restarted_btrfs_send_is_rejected_and_retried needs otel telemetry and was not run.

Severity and risk

Severity: does not apply (refactor). Risk is low: same SQL text and binds, same transaction. Roll back by reverting the commit.

Rollout

No migration. Old and new pods issue identical statements; only the locator comment differs.

Open PRs that will need to rebase

• [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 edits the converge_stopped_sandboxes statement: crates/libs/internal/api/server/src/published_state.rs → crates/libs/sandbox/store/src/ingest.rs (converge_published_stopped). [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 also exempts a restoring row marked for a stopped re-placement, so its rebase has to update that function's doc sentence "it does not exempt a row marked for the node-drain redrive" as well.

Not covered

• The rollback's active_node_id = $2 guard has no test: weakening it fails nothing. The candidate selection already requires s.active_node_id = $1 under FOR UPDATE in the same transaction, so no test through the publication can observe it.
• The Kind run doesn't show which moved statements it reached. The absent-stopped delete matches only Direct-substrate rows, and the rollback convergence runs only on a node's activation-rollback receipt. The Postgres-backed tests named under Validation cover both.

AI assistance: Claude Code (an AI agent) wrote the code change, ran the validation and drafted this description.

After the wave-2 restack

This PR is one layer of a 10-PR stack, restacked onto main c5fdf0c7 (which includes #826) and then rebased mechanically onto 42a99002, which changed only baseline context lines, in order #1329 → #1336 → #1338 → #1339 → #1342 → #1347 → #1333 → #1335 → #1328 → #1332. The validation earlier in this description ran at pre-restack heads; this layer's head is 042daad2.

• [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826: Main's [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 added a restoring/stopped exclusion to converge_stopped_sandboxes. It is carried into ingest::converge_published_stopped, byte-identical to main's statement, and the store doc now describes it. For every file [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and this stack share, each SQL line [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 added was checked to be present verbatim at the top head, in place or in the store module it moved to.
• At this head: cargo fmt --all -- --check, cargo check --workspace --all-targets --all-features and cargo arch (0 required findings, with main's layers and table-owner rules), and the ratchet and caps this layer changes are recounted exactly.
• At the top of the stack (e90aa284 before that rebase; nextest passed 4370 tests again at 77fbae1e): cargo clippy --workspace --locked --all-targets --all-features -- -D warnings is clean, and SPACE_CI_REQUIRE_TEST_DEPS=1 cargo nextest run --all-features passed 4355 tests across the store, api, internal-api server, cluster-controller server, metrics, db-test-fixtures, common-core, common-svc and portability crates, [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's suites included.
• Kind at the top of the stack, fresh clusters with the otel telemetry mode and CI's cold-receipt directory: scripts/tests/smoke-kind-typed.sh all gave ECW 91/91 and native 42/42, including [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's native.forced_drain_re_places_stopped_sandbox and its re-drain and restarted variants. The Direct substrate lane's all gave ECW 51/51 and native 27/27. No flakes and no reruns.
• Equivalence: apart from the [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 port named above, the PR's own +/- lines and its SQL string literals match its reviewed head (range-diff plus a literal multiset compare).

[github-actions]

Thanks for opening this pull request! A SPACE maintainer will take a look.

CONTRIBUTING.md explains how we review outside contributions.