[ac-pplx]

Mechanical move, no functional change. The sandboxes row writes listed below move into pplx-space-sandbox-store with their SQL byte-for-byte; callers keep their locks, transactions and error handling. Everything else is doc comments. Part of the wave-2 stack (2 of 10, on #1329); it lands with the stack.

Summary

Moves the wake path's writes of the sandboxes row from the api and internal-api crates into a new wake module of pplx-space-sandbox-store. One executor-generic function per transition; each doc comment names the fact it writes. Behaviour is unchanged. Callers keep their FOR UPDATE reads, transactions and error mapping. The SQL is byte-identical except for one whitespace change, noted below.

Moved (old → sandbox_store::wake::*):

• api sandbox/lifecycle.rs complete_wake_lifecycle CAS → complete_wake (operation step)
• api sandbox/wake_completion.rs fenced_completion_cas + its redrive_loop call → fenced_completion_cas (private) + complete_redriven_wake (operation step)
• api kubernetes/store/activation_fence.rs K8sStore::clear_command_ready_pending → clear_command_ready_pending (observed projection)
• internal-api data_plane_sessions/service_route.rs clear_sandbox_command_ready_pending → the same clear_command_ready_pending
• api kubernetes/store/execution_rows.rs lease renewal in ensure_active_execution_claim_for_lifecycle → renew_restore_lease_for_execution_claim (operation step)
• api kubernetes/store/pod_placement.rs write in persist_pod_node_placement → record_pod_node_placement (observed projection)

The two command-ready clears were one statement indented differently; they now share one function with the substrate copy's text, so the internal-api copy changes only in leading whitespace. The guards are documented on each function: complete_wake checks no lease, generation or owner, and no locking read precedes it; record_pod_node_placement has no lifecycle predicate and relies on the caller's row lock; the lease renewal checks only token and expiry, under the caller's lock.

Not moved: update_and_fetch_post_wake_sandbox in responses.rs. Its UPDATE … RETURNING * CTE decodes into the api's joined Sandbox row, built from api-owned SANDBOX_COLUMNS/SANDBOX_JOIN_TAIL, which the store can't decode or own; responses.rs stays at 3 in the ratchet.

sql! locators change: the moved statements now carry pplx_space_sandbox_store::wake, which is what pg_stat_activity and query monitoring show.

Baseline: removes the sandbox_writes entries for lifecycle.rs, wake_completion.rs, activation_fence.rs, execution_rows.rs, pod_placement.rs and service_route.rs; the lifecycle.rs file_size cap goes from 1793 to 1775.

Validation

• cargo nextest run --locked --all-features -p pplx-space-db-test-fixtures -p pplx-space-sandbox-store -p pplx-space-internal-api-server: 465 passed, 0 skipped.
• … -p pplx-space-db-test-fixtures -p pplx-space-api: 2160 passed, 1 skipped (an #[ignore] benchmark). Postgres tests ran (no opt-out).
• No test files changed.
• Mutations (local, not committed): dropping lifecycle = 'started' from clear_command_ready_pending fails k8s_store_postgres_behaviors; dropping 'suspending' from complete_wake fails wake_completion_cas_outcome_for_every_prior_lifecycle.
• cargo clippy --locked --all-targets --all-features -p <the 3> -- -D warnings: clean.
• cargo arch --base-baseline <main> --base-architecture <main>: 0 required findings.
• Fresh Kind from this change's code (infra/space/kind/scripts/up.sh, 730 s; later edits change only comments), then scripts/tests/smoke-kind-typed.sh all (3076 s):
  • ECW: 85 passed, 0 failed, 3 inconclusive. ecw.cold_create_environment and ecw.warm_pool_environment needed SPACE_SMOKE_KIND_COLD_RECEIPTS; with it set, both passed.
  • local.restarted_btrfs_send_is_rejected_and_retried needs telemetry mode otel; not run.
  • Native: 35 passed.
• Final head: nextest (fixtures + sandbox-store) 30 passed, 0 skipped; clippy clean; cargo arch 0 required.

Severity and risk

Severity: does not apply (refactor). Risk: low: the same statements, locks and transactions. Roll back by reverting the commit.

Rollout

No migration. Mixed-version pods issue the same statements apart from the locator comment and that whitespace. Monitoring keyed on the old locator paths needs the new one.

Open PRs that will need to rebase

• [space] fence every placement writer against the provider-terminate path #559: placement UPDATE in pod_placement.rs persist_pod_node_placement → wake::record_pod_node_placement (re-apply its new WHERE term and bind there). It also rewrites the unmoved update_and_fetch_post_wake_sandbox, and its sandbox_writes edits are next to the removed lines.
• Fence pod materializations and record worker incarnation #319: moves the persist_pod_node_placement body into a new function; the UPDATE is now wake::record_pod_node_placement.
• [api] rate-limit activations per client key, atomically with the cluster bucket #1131: adds a parameter to ensure_active_execution_claim_for_lifecycle; the lease renewal there is now wake::renew_restore_lease_for_execution_claim. Textual conflict only.
• Add idempotent ECW network policy replacement and live status #1297, [api] record the activating client and label sandbox pods with it #1068: add modules to the store lib.rs; Add idempotent ECW network policy replacement and live status #1297's sandbox_writes hunk is next to the removed entries.

AI assistance: Claude Code (an AI agent) wrote the code, ran the validation and drafted this description.

After the wave-2 restack

This PR is one layer of a 10-PR stack, restacked onto main c5fdf0c7 (which includes #826) and then rebased mechanically onto 42a99002, which changed only baseline context lines, in order #1329 → #1336 → #1338 → #1339 → #1342 → #1347 → #1333 → #1335 → #1328 → #1332. The validation earlier in this description ran at pre-restack heads; this layer's head is e0b4d257.

• [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826: Main's [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 added two code lines to lifecycle.rs, so the file_size cap this layer lowers is now 1777. For every file [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and this stack share, each SQL line [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 added was checked to be present verbatim at the top head, in place or in the store module it moved to.
• At this head: cargo fmt --all -- --check, cargo check --workspace --all-targets --all-features and cargo arch (0 required findings, with main's layers and table-owner rules), and the ratchet and caps this layer changes are recounted exactly.
• At the top of the stack (e90aa284 before that rebase; nextest passed 4370 tests again at 77fbae1e): cargo clippy --workspace --locked --all-targets --all-features -- -D warnings is clean, and SPACE_CI_REQUIRE_TEST_DEPS=1 cargo nextest run --all-features passed 4355 tests across the store, api, internal-api server, cluster-controller server, metrics, db-test-fixtures, common-core, common-svc and portability crates, [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's suites included.
• Kind at the top of the stack, fresh clusters with the otel telemetry mode and CI's cold-receipt directory: scripts/tests/smoke-kind-typed.sh all gave ECW 91/91 and native 42/42, including [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's native.forced_drain_re_places_stopped_sandbox and its re-drain and restarted variants. The Direct substrate lane's all gave ECW 51/51 and native 27/27. No flakes and no reruns.
• Equivalence: apart from the [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 port named above, the PR's own +/- lines and its SQL string literals match its reviewed head (range-diff plus a literal multiset compare).

[github-actions]

Thanks for opening this pull request! A SPACE maintainer will take a look.

CONTRIBUTING.md explains how we review outside contributions.