[ac-pplx]

Mechanical move, no functional change. The sandboxes row writes listed below move into pplx-space-sandbox-store with their SQL byte-for-byte; callers keep their locks, transactions and error handling. Everything else is doc comments. Part of the wave-2 stack (6 of 10, on #1342); it lands with the stack.

Summary

Five UPDATE sandboxes statements were still inline in the api, though every write of the row belongs to pplx-space-sandbox-store. They move into three new store modules. The SQL text is unchanged except for binds, and each function is named for its transition, with a doc comment on the fact it writes:

• api::controllers::sandbox::updates set_network_policy → sandbox_store::intent::set_network_policy_override (intent; generation check is the only guard)
• updates set_snapshots_enabled_desired → intent::set_snapshots_enabled_desired (intent; id only)
• responses maybe_update_sandbox_lifecycle → action_stamp::stamp_action_lifecycle (operation step)
• responses maybe_update_sandbox_state → action_stamp::stamp_action_state (operation step)
• substrate persist_optional_current_local_artifact → artifact_marker::set_current_local_artifact (observed projection; id only, relies on the caller's row lock)

action_stamp holds the lifecycle dispatcher's post-action stamps. Their guard refuses only terminal rows (failed, quarantined, deleted, cleanup_required), so a stamp can overwrite an in-flight lifecycle (deleting, stopping, suspending, suspended). This move keeps that behaviour as it is. The module docs state it, the existing characterization table pins it as a known defect, and a later behaviour change fixes it.

The api functions keep their signatures, error mapping and logging. The FOR UPDATE lock, the deleting-snapshot check, the transactions and the reconcile enqueues stay at the call sites. Store functions take the caller's executor and return sqlx::Error. The marker takes (LocalArtifactId, ArtifactKind) instead of the api's PublishedLocalArtifact and binds the same values.

sql! locators change. The moved statements' locators now name the store modules, and that path is what appears in pg_stat_activity and query monitoring.

architecture-baseline.toml: sandbox_writes goes to 2 for updates.rs and 1 for responses.rs, and the substrate/mod.rs entry is removed. The substrate/mod.rs file_size cap goes from 2089 to 2064.

Not moved

• crates/libs/placement/machine/src/postgres.rs: completion_sql and two claim files in postgres/sql/ (user_restore_claim.sql, evacuation_restore_claim.sql) write sandboxes, and the third, claim_miss_snapshot.sql, only reads it. None of them has a production caller. They are left as they are for a separate decision; this PR does not touch crates/libs/placement.
• The rollback deletes in updates.rs and the post-wake update in responses.rs belong to other moves.

Open PRs that will need to rebase

• Add idempotent ECW network policy replacement and live status #1297 rewrites set_network_policy (moving it to controllers/sandbox/network_policy.rs and a store network_policy module). Its statement is now updates.rs → sandbox_store::intent::set_network_policy_override.
• [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 replaces maybe_update_sandbox_state with maybe_mark_started_after_start and changes its SQL. The statement is now responses.rs → sandbox_store::action_stamp::stamp_action_state.
• These PRs edit the same files but none of the moved statements:
  • updates.rs: api: move the create path's sandboxes writes into sandbox-store #1329, api: permalaunch space-api-timeout-lock-bypass #1178, [api] rate-limit activations per client key, atomically with the cluster bucket #1131, [api] record the activating client and label sandbox pods with it #1068, [space] fence every placement writer against the provider-terminate path #559 and [space-api] preserve CommandIdle template default across ECW lifecycle endpoints #538.
  • responses.rs: [api] record the activating client and label sandbox pods with it #1068 and [space] fence every placement writer against the provider-terminate path #559.
  • substrate/mod.rs: [cluster-controller] record pod-create intent so the pod-less drain give-up can release a stalled recovery #1323, [api] trigger a stopped sandbox's runtime upgrade from a test hook, and smoke it on Kind #1322, api: cap each client's live sandboxes, counted from the pod reflector and a Redis pending set #1172, [api] rate-limit activations per client key, atomically with the cluster bucket #1131, [api] record the activating client and label sandbox pods with it #1068, api: refuse a cold create with a 503 when every eligible node's network slots are held #1061, [space] fence every placement writer against the provider-terminate path #559, Bound reconnect recovery on unpublished local suspends #350 and api: decide admission pool claims for the create's owner; collect refused claims promptly #168.
• Sibling store moves also add lines to sandbox/store/src/lib.rs and architecture-baseline.toml.

Validation

At this head (rebased on main):

• cargo clippy --locked -p pplx-space-sandbox-store -p pplx-space-api -p pplx-space-placement --all-targets --all-features -- -D warnings: clean.
• cargo arch --base-baseline <main baseline> --base-architecture <main ARCHITECTURE.toml>: 0 required findings.
• cargo nextest run --locked -p pplx-space-sandbox-store -p pplx-space-api -p pplx-space-placement --all-features, with the shared Postgres and Redis setup scripts: 2232 passed, 1 skipped (an #[ignore] local benchmark), no dependency skips. The PR edits no test files.
• Mutation check: dropping 'quarantined' from the stamp_action_lifecycle guard fails post_action_stamps_write_every_stored_lifecycle_but_the_terminal_ones. Reverted.
• A fresh Kind cluster from this head (infra/space/kind/scripts/up.sh, 7m12s), then scripts/tests/smoke-kind-typed.sh all (51m48s):
  • ECW: 85 passed, 0 failed, 3 inconclusive.
  • Native: 35 passed.
  • The inconclusive ecw.cold_create_environment and ecw.warm_pool_environment needed SPACE_SMOKE_KIND_COLD_RECEIPTS. Both passed when rerun with it set.
  • local.restarted_btrfs_send_is_rejected_and_retried needs the otel telemetry mode and was not run.

Severity and risk

Severity: does not apply (a refactor with no behaviour change).

Risk: low. Each statement, its binds and its transaction are unchanged, so old and new pods issue the same SQL during a rollout. Only the sql! locator text differs. Rollback: revert this commit.

AI assistance: an AI agent (Claude Code) wrote the code change and this description.

After the wave-2 restack

This PR is one layer of a 10-PR stack, restacked onto main c5fdf0c7 (which includes #826) and then rebased mechanically onto 42a99002, which changed only baseline context lines, in order #1329 → #1336 → #1338 → #1339 → #1342 → #1347 → #1333 → #1335 → #1328 → #1332. The validation earlier in this description ran at pre-restack heads; this layer's head is 54c3ba53.

• [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826: Main's [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 rewrote maybe_update_sandbox_state as maybe_mark_started_after_start, which also drops a disk artifact pin. This layer moves [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's statement as action_stamp::stamp_started_after_start(executor, id), byte-identical to main's, and maybe_mark_started_after_start keeps [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's doc and log and calls it. For every file [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 and this stack share, each SQL line [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 added was checked to be present verbatim at the top head, in place or in the store module it moved to.
• At this head: cargo fmt --all -- --check, cargo check --workspace --all-targets --all-features and cargo arch (0 required findings, with main's layers and table-owner rules), and the ratchet and caps this layer changes are recounted exactly.
• At the top of the stack (e90aa284 before that rebase; nextest passed 4370 tests again at 77fbae1e): cargo clippy --workspace --locked --all-targets --all-features -- -D warnings is clean, and SPACE_CI_REQUIRE_TEST_DEPS=1 cargo nextest run --all-features passed 4355 tests across the store, api, internal-api server, cluster-controller server, metrics, db-test-fixtures, common-core, common-svc and portability crates, [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's suites included.
• Kind at the top of the stack, fresh clusters with the otel telemetry mode and CI's cold-receipt directory: scripts/tests/smoke-kind-typed.sh all gave ECW 91/91 and native 42/42, including [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826's native.forced_drain_re_places_stopped_sandbox and its re-drain and restarted variants. The Direct substrate lane's all gave ECW 51/51 and native 27/27. No flakes and no reruns.
• Equivalence: apart from the [cluster-controller] re-place an evacuated stopped sandbox as stopped on another node, materialized by the shim without a VM #826 port named above, the PR's own +/- lines and its SQL string literals match its reviewed head (range-diff plus a literal multiset compare).

[github-actions]

Thanks for opening this pull request! A SPACE maintainer will take a look.

CONTRIBUTING.md explains how we review outside contributions.