[ac-pplx]

Mechanical move, no functional change. The sandboxes row writes listed below move into pplx-space-sandbox-store with their SQL byte-for-byte; callers keep their locks, transactions and error handling. Everything else is doc comments. Part of the wave-2 stack (3 of 10, on #1336); it lands with the stack.

Problem
crates/libs/api/src/controllers/substrate/kubernetes/store/suspend.rs still wrote the sandboxes row itself: 8 lines that pattern_ratchet.sandbox_writes counts. The crate boundary says every write of the row belongs in pplx-space-sandbox-store.

Change
The four statements behind those 8 lines move into a new module, pplx_space_sandbox_store::suspend. Moved functions (all api …/kubernetes/store/suspend.rs → sandbox/store/src/suspend.rs):

• claim_suspend_execution: the suspend claim CAS → suspend::claim. Operation step. The started/paused loop stays at the caller.
• persist_or_accept_suspend_commit: the committed-artifact UPDATE → suspend::record_committed_artifact. Operation step. Its only guard is lifecycle = 'suspending', and it re-assigns that same value.
• K8sStore::finalize_suspended_sandbox_in, removed (both callers now call the store directly) → suspend::finalize_with_committed_artifact. Operation step. It matches the row by id only and relies on the caller's row locks.
• finalize_missing_suspending_pod_with_current_snapshot: the final UPDATE → suspend::finalize_missing_pod_from_current_snapshot. Inference. It matches by id only and relies on the caller's lock, its eligibility select, and the execution it already retired.

SQL text is byte-for-byte the same, including the CAS guards and the interpolated pplx_space_sandbox_portability fragments. Each statement is still built the same way. The binds carry the same primitive values: typed ExecutionGeneration, PodUid, LocalArtifactId, ArtifactKind and SandboxLifecycle are converted inside the store. The FOR UPDATE reads, transactions, execution-row writes and slot deletes stay with the callers. The store functions are impl PgExecutor. No test files changed.

architecture-baseline.toml: the suspend store's sandbox_writes entry (= 8) is removed. Neither file has a file_size entry.

sql! locators: the moved statements now carry the store module's path, so they show up under a new name in pg_stat_activity and query monitoring.

Validation

• cargo nextest run --all-features -p pplx-space-sandbox-store -p pplx-space-api with the shared Postgres: 2168 passed, 1 skipped (an #[ignore] benchmark). 77 Kubernetes suspend-path Postgres tests ran.
• Mutation check: I removed AND lifecycle = 'suspending' from record_committed_artifact and suspend_lifecycle_matrix_tests::suspend_claim_and_commit_move_only_their_stored_lifecycles failed. With the guard restored it passes; the mutation was not committed.
• cargo clippy --locked -p pplx-space-sandbox-store -p pplx-space-api --all-targets --all-features -- -D warnings is clean. A lib-only clippy and check of the store is clean. cargo fmt --check is clean.
• cargo arch, with and without --base-baseline: 0 required findings. The 110 advisory findings were already there and involve none of these files.
• Kind, fresh cluster from this commit (every image at d9d1265f): up.sh took 10m08s. scripts/tests/smoke-kind-typed.sh all took 51m23s.
  • Native pass: 35/35 passed.
  • ECW pass: 85 passed, 0 failed, 3 inconclusive because of how I set up the bench.
  • ecw.cold_create_environment (14s) and ecw.warm_pool_environment (22s) passed on rerun with SPACE_SMOKE_KIND_COLD_RECEIPTS and a token file, as CI sets them.
  • local.restarted_btrfs_send_is_rejected_and_retried passed (40s) after re-running up.sh with SPACE_KIND_TELEMETRY_MODE=otel.

Risk and rollback: the statements are unchanged, so revert the commit to roll back. Mixed versions: old and new api pods send identical SQL; only the locator comment differs.

Open PRs that will need to rebase

• Bound reconnect recovery on unpublished local suspends #350: adds ensure_local_suspend_restore_source above finish_suspended_execution in the old suspend.rs. It touches no moved statement; only the surrounding text changes.
• sandbox-store: move the restore-lease and pod-tracking sandbox row writes into the store #1339 (the restore-lease and pod-tracking move) rewraps the same pplx_space_sandbox_portability import block in kubernetes/store.rs. Whichever of the two lands second keeps both removals. It also drops clear_current_local_artifact_marker_assignments if nothing under kubernetes/store/ still calls it. With both PRs applied as they stand, nothing does: this change moves the missing-pod finalization's call and sandbox-store: move the restore-lease and pod-tracking sandbox row writes into the store #1339 moves the pod-tracking one.
• credmgr: scope volume DEKs to the node running the sandbox #128, [api] restore full snapshots only onto CPU-compatible hosts, behind a default-off gate #176, Fence pod materializations and record worker incarnation #319, [space] fence every placement writer against the provider-terminate path #559, [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826, [api] record the activating client and label sandbox pods with it #1068, [api] rate-limit activations per client key, atomically with the cluster bucket #1131, [api] trigger a stopped sandbox's runtime upgrade from a test hook, and smoke it on Kind #1322 and [cluster-controller] record pod-create intent so the pod-less drain give-up can release a stalled recovery #1323 edit kubernetes/store.rs outside that import block. None of them adds a use of SuspendedTargetNodeAssignment, suspended_k8s_finalization_sql or write_current_local_artifact_marker_assignments, the three names this change drops from it.
• In the store's lib.rs, cluster-controller: gauge sandboxes wedged in a transient lifecycle #1332 inserts pub mod stuck; at the place where this change inserts pub mod suspend;. Add trusted lifecycle registration and advisory candidate inventory #579, [api] record the activating client and label sandbox pods with it #1068, Add idempotent ECW network policy replacement and live status #1297 and api: close six admin API gaps the admin console works around #1303 add lines elsewhere in that file. The sibling moves sandbox-store: move the node drain's sandbox row writes into the store #1328, api: move the create path's sandboxes writes into sandbox-store #1329, sandbox-store: move the publish path's stopped, activity, absent-delete and rollback writes #1333, sandbox-store: move the orphan, tombstone and remaining sweeper row writes into the store #1335, sandbox-store: move the wake path's writes of the sandboxes row into a wake module #1336 and sandbox-store: move the restore-lease and pod-tracking sandbox row writes into the store #1339 each add their own pub mod line.

AI assistance: an AI agent (Claude) wrote this change and its validation; a human reviews it.

After the wave-2 restack

This PR is one layer of a 10-PR stack, restacked onto main c5fdf0c7 (which includes #826) and then rebased mechanically onto 42a99002, which changed only baseline context lines, in order #1329 → #1336 → #1338 → #1339 → #1342 → #1347 → #1333 → #1335 → #1328 → #1332. The validation earlier in this description ran at pre-restack heads; this layer's head is 7d6d00ca.

• [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826: Main's [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and the commits since the previous restack touched nothing this layer moves, so the commit is unchanged apart from its new base (git range-diff shows =). For every file [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and this stack share, each SQL line [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 added was checked to be present verbatim at the top head, in place or in the store module it moved to.
• At this head: cargo fmt --all -- --check, cargo check --workspace --all-targets --all-features and cargo arch (0 required findings, with main's layers and table-owner rules), and the ratchet and caps this layer changes are recounted exactly.
• At the top of the stack (e90aa284 before that rebase; nextest passed 4370 tests again at 77fbae1e): cargo clippy --workspace --locked --all-targets --all-features -- -D warnings is clean, and SPACE_CI_REQUIRE_TEST_DEPS=1 cargo nextest run --all-features passed 4355 tests across the store, api, internal-api server, cluster-controller server, metrics, db-test-fixtures, common-core, common-svc and portability crates, [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's suites included.
• Kind at the top of the stack, fresh clusters with the otel telemetry mode and CI's cold-receipt directory: scripts/tests/smoke-kind-typed.sh all gave ECW 91/91 and native 42/42, including [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's native.forced_drain_re_places_stopped_sandbox and its re-drain and restarted variants. The Direct substrate lane's all gave ECW 51/51 and native 27/27. No flakes and no reruns.
• Equivalence: apart from the [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 port named above, the PR's own +/- lines and its SQL string literals match its reviewed head (range-diff plus a literal multiset compare).

[github-actions]

Thanks for opening this pull request! A SPACE maintainer will take a look.

CONTRIBUTING.md explains how we review outside contributions.