[ac-pplx]

Stacked on #388. Each update_state_from conversion stacked on #388 wrote its own StateWriteOutcome → Status helper, with different names, message text and policies. This adds one shared mapping and one best-effort writer in service/cleanup_support.rs, with no production callers. The conversions rebase onto this PR and delete their copies. The legacy require_state_write for update_state stays unchanged.

API

• require_state_write_from(result, context) -> Result<(), Status> is the primary mapping.
• state_write_result(outcome) -> Result<SandboxState, StateWriteRejected> is the typed form. It returns the overwritten state, or one of FromState { found }, Guard { refusal: StateWriteGuard, found } and Missing. into_status(context) turns a rejection into a status.
  • A caller that answers one case differently (for example warm start with FailedPrecondition) matches that case and passes the rest to into_status.
  • Guard carries found for callers that decide by edge.from().contains(found).
• update_state_from_best_effort(db, sandbox_id, edge) -> Option<StateWriteOutcome> is update_state_best_effort for update_state_from, with a wildcard-free match.
  • It logs with the same message text and field names, except that outcome is logged with Debug (?outcome), where the legacy function uses Display.
  • Only Applied marks the sandbox dirty.
  • None means a poisoned connection (failure signalled) or a database error.

Messages

Outcome	Code	Message
Applied { from }	—	Ok(()) (state_write_result: Ok(from))
Refused { refusal: FromState, found }	Aborted	{context}: sandbox state write was superseded: sandbox is {found}
Refused { refusal: Quarantined, .. }	Aborted	{context}: sandbox state write was not applied: blocked_by_quarantine
Refused { refusal: CleanupOwned, .. }	Aborted	{context}: sandbox state write was not applied: superseded_by_cleanup_episode
Missing	Aborted	{context}: sandbox state write was not applied: missing
database error	Internal	{context}: {error}

The guard, missing and database-error rows are byte-for-byte what require_state_write returns for update_state, at 8f12bd6 and now.

Dead-code expectations

Outside tests the new items are #[cfg_attr(not(test), expect(dead_code, ...))]. Adopting require_state_write_from leaves several expectations unfulfilled at once: the function, StateWriteRejected, StateWriteGuard, state_write_result and the impl. unfulfilled_lint_expectations is warn-by-default and an error only under CI's clippy -D warnings, so the adopting conversion must drop those attributes. update_state_from_best_effort keeps its own expectation until a caller uses it.

Deferred: StateWriteGuard duplicates StateWriteRefusal::{Quarantined, CleanupOwned}, and the legacy SandboxStateWriteOutcome is a third copy. The fix nests them: generic_state_write_refusal -> Option<StateWriteGuard> and StateWriteRefusal::Guard(StateWriteGuard). PR 6, which retires the legacy enum, does that, so this PR doesn't churn #388's types under the rebasing siblings.

Tests (service/cleanup_support/tests.rs)

• Wildcard-free matches over every StateWriteOutcome × StateWriteRefusal × state assert the typed rejection and the exact code and message. The refusal list itself comes from a wildcard-free successor match, so a new variant does not compile until it is swept.
• On the same row, the new mapping and the update_state caller path return the same status, and every row stays unchanged. The rows are a quarantined row, a stopping row revived to started, a cleanup_required row with a delete_row intent, and a missing row. The row's own state is in the from-set, so the guard is what refuses. The messages are also checked against literals copied from 8f12bd6.
• The best-effort writer:
  • applies a write and marks only that sandbox dirty;
  • returns the refusal and changes nothing for a from-state refusal (stopped), a cleanup-owned row and a missing row;
  • returns None and changes nothing on a database error.
• A poisoned connection returns None and changes nothing. It also wakes the dirty-outbox worker, which exits on the poisoned connection and fails its critical-task guard. The test pauses the clock and only yields, so the worker's poll timer cannot fire and only the signal can wake it.
• No assertions on log fields, severity or text.

Validation

Check	Result
cargo fmt --all -- --check	pass
cargo clippy --workspace --locked --all-targets -- -D warnings	pass
cargo arch	pass, 0 required findings; the only advisories are on files this PR does not touch
SPACE_CI_REQUIRE_TEST_DEPS=1 cargo nextest run -p pplx-space-sbx-mgr ×3	1630/1630 passed each run. The 1 skip is the #[ignore] root-only distinct_service_uids_can_exchange_downloads; 0 dependency skips
Mutation proof (20 mutants: every mapping arm swapped, both status codes, the from-state text, the database-error code, a swallowed rejection, found dropped from Guard, and each best-effort dirty, return and poison-signal arm)	20/20 killed
Kind	not run: no production callers

🤖 Generated with Claude Code