[rlrs]

Plan item P13: one-off cleanups for hosts first set up before the move to UCloud.

What goes

• Relay networking (relay_network.py, direct_network.py): retiring per-sandbox ucloud_relay_<slot> nft tables (in the table rebuild and in per-sandbox removal) and per-interface FORWARD -i <if> -j ACCEPT rules (_remove_legacy_relay_accepts, and the check in relay policy removal).
• vm_init: the block that stops and deletes the ucloud-sandbox-heartbeat timer and service. Nothing else in vm_init changes.
• Hibernation store: the shared lock on the root-wide .store.lock, which only excluded a process from before 2026-09-08. The per-incarnation locks stay.
• gVisor distribution: the non-pinned-commit branches of distribution_files and installed_sidecar_fingerprints. Both now refuse any commit other than GVISOR_COMMIT, and require the build manifest and the companion binaries. The if companions guards in boot_config_sha256 and in deploy staging go with them.
• Resident memory sampling, agent and noded together: the container-id fallback for bundles without linux.cgroupsPath. The sampler now takes the expected cgroup path as a required argument, and a bundle without one is not sampled. The Python/Rust parity cases are updated to match.
• .ucloud-overlay.json schema 1: Docker-store bundles were still written as schema 1. They are now written as schema 2, like host-EROFS bundles, and only schema 2 is read.
• Tests: the tests for each retired cleanup are deleted. test_deploy now builds the complete pinned distribution in its plan fixture.

Evidence

From the read-only evidence pass on 2026-10-24, on all six live workers: no ucloud_relay_<n> tables, no per-interface FORWARD ACCEPT rules, no heartbeat units, no old overlay schema, and UCLOUD_DIRECT_RUNSC_COMMIT equal to the pinned GVISOR_COMMIT (W4). Production workers use host-EROFS environments (immutable-environment-host-erofs-v1). Their bundles were already schema 2 and always name their cgroup.

Compatibility and rollback

• No config keys change, so deployment.json keeps loading as it is.
• A pinned install keeps the same boot fingerprint, because its companions were already bound.
• Rollback to 0.10.0 needs nothing. 0.10.0 reads schema-2 bundles, and its cleanups find nothing to do.
• A Docker-store host (not production) with parked schema-1 bundles must wake or delete them before upgrading. CHANGELOG ## Unreleased says so.

Checks

• uv run ruff check sandboxes tests scripts: clean.
• scripts/check_test_rules.py --update: the baseline went down by 3.
• Full suite with PostgreSQL: 246 modules, 2477 tests, 2451 pass, 26 skip.
• cargo test --locked for noded passes, including resident_python_parity. test_relay_network_linux (linux tier) was edited but not run here.

🤖 Generated with Claude Code