[ac-pplx]

Mechanical move, no functional change. The sandboxes row writes listed below move into pplx-space-sandbox-store with their SQL byte-for-byte; callers keep their locks, transactions and error handling. Everything else is doc comments, plus one test's pg_stat_activity match pattern updated to the moved statement's new module path. Part of the wave-2 stack (4 of 10, on #1338); it lands with the stack.

Problem
The Kubernetes substrate's store wrote the control-plane sandboxes row with inline SQL in kubernetes/store/restore_lease.rs (8 statements) and kubernetes/store/pod_tracking.rs (4 statements and an artifact-marker renderer call). Every write of the row belongs in pplx-space-sandbox-store.

Change
All 13 ratchet matches move into two new store modules, one function per transition: 12 statements plus the clear_current_local_artifact_marker_assignments renderer call. The SQL text is byte-for-byte the same, and each statement is built the way it was, including its portability and routability fragments. Binds keep their order and Postgres types. The claims keep their unused parameters (the evacuation claim's $4, the user claim's $5), so each statement is prepared with the same parameter list.

The claims, the completion and the release take impl PgExecutor and still run on the pool. The reverts and the pod-tracking writes take &mut Transaction because they rely on the caller's row lock. These stay in the Kubernetes store: the revert's lock and evidence read, the ownership snapshot, the transactions and the execution writes. The K8sStore methods now call the store.

Each function's doc names the fact it writes, its guards, and what its caller must have done first:

• Operation step: both restore claims, the markerless lease claim, the completion, the release, the three reverts and both unplaces.
• Inference: the three recoveries.
• The reverts and unplaces have no lifecycle predicate of their own; they rely on the caller's lock.

Moved (api/…/kubernetes/store/ → pplx_space_sandbox_store::):

• restore_lease.rs::begin_restore_lifecycle_for (user arm) → restore_lease::claim_user_restore
• restore_lease.rs::begin_restore_lifecycle_for (evacuation arm) → restore_lease::claim_evacuation_restore
• ::claim_markerless_restoring_restore_lease → restore_lease::claim_markerless_restoring_lease
• ::complete_owned_user_restore → restore_lease::complete_owned_user_restore
• ::release_user_restore_lease → restore_lease::release_user_restore_lease
• ::revert_restore_claim_to_suspended, 3 arms → restore_lease::revert_restore_claim_{retiring_placement,clearing_placement_clock,lifecycle}
• RestoreClaimRow → restore_lease::RestoreClaimRow
• pod_tracking.rs::clear_pod_tracking_in, 2 statements → pod_tracking::unplace_after_pod_teardown{,_preserving_placement_clock}
• ::recover_markerless_restoring_after_execution_cleanup_in → pod_tracking::recover_markerless_restoring_after_execution_cleanup
• ::recover_started_with_current_suspend_snapshot_in (with clear_current_local_artifact_marker_assignments) → pod_tracking::recover_started_after_{execution_retired,failed_recovery}

sql! locators: the moved statements' locators now name pplx_space_sandbox_store::restore_lease and ::pod_tracking. Queries in pg_stat_activity and query monitoring that filter on the old kubernetes::store module path stop matching them.

Test change: in concurrent_wakes_for_one_sandbox_hold_one_claim_connection, one pg_stat_activity pattern changes from %kubernetes::store% to %pplx_space_sandbox_store::restore_lease:%, because that test finds the claim by its sql! locator. No other test or in-repo monitor keys on a moved statement's locator.

Ratchet: in sandbox_writes, both entries are removed (pod_tracking.rs 5, restore_lease.rs 8). No file_size entries were affected.

Validation (base 37cdc80d, head 064ffba1)

• cargo nextest run -p pplx-space-sandbox-store -p pplx-space-api -p pplx-space-cluster-controller-server --all-features: 3360 passed, 1 skipped (an #[ignore] benchmark). Postgres setup ran, with no dependency skips.
• cargo clippy on the same three packages with --all-targets --all-features -- -D warnings: clean.
• cargo arch --base-baseline … --base-architecture …: exit 0, 0 required findings. The 111 advisory findings are pre-existing, and none are in touched files.
• Test files: git diff 37cdc80d --stat -- '*test*' shows only kubernetes/tests.rs | 2 +- (the pattern above).
• The claim-herd test against the moved code, before its pattern edit: fails with Elapsed(()) (no contender found). After the edit: passes.
• Mutation checks, all reverted afterwards:
  • Dropping AND evacuation_restore_target IS NULL from the user claim's restoring arm fails k8s_store_postgres_behaviors (begin_restore_lifecycle_preserves_retry_and_marker_claim_rules).
  • Dropping AND s.lifecycle = 'restoring' from the markerless recovery fails cleanup_recoveries_revert_only_their_stored_lifecycles.
  • Dropping AND restore_lease_token = $2 from the owned completion fails k8s_store_postgres_behaviors (owned_restore_completion_tests.rs).
• Kind, fresh cluster: infra/space/kind/scripts/up.sh took 4:36. The space-api and space-cluster-controller images carry revision 064ffba14f0f.
• SPACE_SMOKE_KIND_COLD_RECEIPTS=<tmpdir> scripts/tests/smoke-kind-typed.sh all, wall time 51:46:
  • ECW: 87 passed, 0 failed, 1 inconclusive.
  • Native: 35/35 passed.
  • The inconclusive one is local.restarted_btrfs_send_is_rejected_and_retried: it needs the otel telemetry mode, and the bench runs datadog.

Risk and rollback: the statements and their order inside each transaction are unchanged. Roll back by reverting the commit.

Mixed-version: old and new pods send identical SQL; only the locator comments differ.

Open PRs that will need to rebase:

• [space] fence every placement writer against the provider-terminate path #559 adds an UPDATE sandboxes and a DELETE FROM sandboxes to kubernetes/store/pod_tracking.rs and raises that file's entry to 7. With the entry gone, archcheck's no_crossing rule flags them (not listed_no_growth), so they belong in pplx_space_sandbox_store::pod_tracking.
• sandbox-store: move the Kubernetes suspend writes of the sandboxes row into the store #1338 rewrites the same pplx_space_sandbox_portability import block in kubernetes/store.rs. Once both land, clear_current_local_artifact_marker_assignments has no user in the api crate, so whichever lands second must drop it from that import, or clippy -D warnings fails.
• [api] record the activating client and label sandbox pods with it #1068, [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and Fence pod materializations and record worker incarnation #319 edit kubernetes/store/pod_tracking.rs ([api] record the activating client from Direct's start, wake and restore receipts #1175 is stacked on [api] record the activating client and label sandbox pods with it #1068); none touches a moved function. sandbox-store: move the wake path's writes of the sandboxes row into a wake module #1336 rewrites the doc comment on the complete_owned_user_restore wrapper in kubernetes/store/restore_lease.rs; its hunk doesn't overlap this PR's.
• Add trusted lifecycle registration and advisory candidate inventory #579, [api] record the activating client and label sandbox pods with it #1068, Add idempotent ECW network policy replacement and live status #1297, api: close six admin API gaps the admin console works around #1303 and the sibling moves sandbox-store: move the node drain's sandbox row writes into the store #1328, api: move the create path's sandboxes writes into sandbox-store #1329, cluster-controller: gauge sandboxes wedged in a transient lifecycle #1332, sandbox-store: move the publish path's stopped, activity, absent-delete and rollback writes #1333, sandbox-store: move the orphan, tombstone and remaining sweeper row writes into the store #1335, sandbox-store: move the wake path's writes of the sandboxes row into a wake module #1336, sandbox-store: move the Kubernetes suspend writes of the sandboxes row into the store #1338, sandbox-store: move the Direct substrate's restore-lease and receipt writes into a direct module #1342 and sandbox-store: move five api writes of sandboxes into the store #1347 edit sandbox/store/src/lib.rs near the module list.

AI assistance: an AI agent (Claude Code) wrote this change and its validation.

After the wave-2 restack

This PR is one layer of a 10-PR stack, restacked onto main c5fdf0c7 (which includes #826) and then rebased mechanically onto 42a99002, which changed only baseline context lines, in order #1329 → #1336 → #1338 → #1339 → #1342 → #1347 → #1333 → #1335 → #1328 → #1332. The validation earlier in this description ran at pre-restack heads; this layer's head is b70c03b5.

• [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826: Main's [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and the commits since the previous restack touched nothing this layer moves, so the commit is unchanged apart from its new base (git range-diff shows =). For every file [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and this stack share, each SQL line [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 added was checked to be present verbatim at the top head, in place or in the store module it moved to.
• At this head: cargo fmt --all -- --check, cargo check --workspace --all-targets --all-features and cargo arch (0 required findings, with main's layers and table-owner rules), and the ratchet and caps this layer changes are recounted exactly.
• At the top of the stack (e90aa284 before that rebase; nextest passed 4370 tests again at 77fbae1e): cargo clippy --workspace --locked --all-targets --all-features -- -D warnings is clean, and SPACE_CI_REQUIRE_TEST_DEPS=1 cargo nextest run --all-features passed 4355 tests across the store, api, internal-api server, cluster-controller server, metrics, db-test-fixtures, common-core, common-svc and portability crates, [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's suites included.
• Kind at the top of the stack, fresh clusters with the otel telemetry mode and CI's cold-receipt directory: scripts/tests/smoke-kind-typed.sh all gave ECW 91/91 and native 42/42, including [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's native.forced_drain_re_places_stopped_sandbox and its re-drain and restarted variants. The Direct substrate lane's all gave ECW 51/51 and native 27/27. No flakes and no reruns.
• Equivalence: apart from the [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 port named above, the PR's own +/- lines and its SQL string literals match its reviewed head (range-diff plus a literal multiset compare).

[github-actions]

Thanks for opening this pull request! A SPACE maintainer will take a look.

CONTRIBUTING.md explains how we review outside contributions.