private-networking: controller reads links from the table, retire the projection

crates/data-plane-controller/src/job/executor.rs

@@ -393,7 +393,6 @@ async fn fetch_row_state(
             logs_token,
             data_plane_name,
             data_plane_fqdn,
-            private_links AS "private_links: Vec<sqlx::types::Json<stack::PrivateLink>>",
             pulumi_key AS "pulumi_key",
             pulumi_stack AS "pulumi_stack!"
         FROM data_planes
@@ -411,12 +410,23 @@ async fn fetch_row_state(
     config.model.name = Some(row.data_plane_name);
     config.model.fqdn = Some(row.data_plane_fqdn);
 
-    // The controller reads desired links from the `private_links` column, which
-    // the `data_plane_private_links` trigger keeps projected from the per-link
-    // rows. Reading the table directly is deferred to the contract change that
-    // drops this column, so the controller has no deploy-ordering dependency on
-    // the agent-api cutover.
-    config.model.private_links = row.private_links.into_iter().map(|link| link.0).collect();
+    // Desired links are read directly from `data_plane_private_links`, ordered
+    // deterministically. The id is intentionally not handed to est-dry-dock;
+    // only the link `config` is, preserving the prior wire shape.
+    let link_rows = sqlx::query!(
+        r#"
+        SELECT config AS "config!: sqlx::types::Json<stack::PrivateLink>"
+        FROM data_plane_private_links
+        WHERE data_plane_id = $1
+        ORDER BY created_at, id
+        "#,
+        row.data_plane_id as models::Id,
+    )
+    .fetch_all(pool)
+    .await
+    .context("failed to fetch data-plane private links")?;
+
+    config.model.private_links = link_rows.into_iter().map(|r| r.config.0).collect();
 
     let stack = if let Some(key) = row.pulumi_key {
         stack::PulumiStack {

supabase/migrations/20260618130000_data_plane_private_links_cutover.sql

@@ -0,0 +1,42 @@
+-- Cutover step for `data_plane_private_links`: the data-plane controller now
+-- reads desired links from the table directly, so the transition projection
+-- into the `data_planes.private_links` column is no longer needed. Replace the
+-- trigger function with a wake-only version that still sends the controller a
+-- converge promptly on any link change.
+--
+-- The now-unused `private_links` column is intentionally left in place. Dropping
+-- it together with the legacy `*_link_endpoints` columns (all four are projected
+-- by the `data_planes_overview` view and the agent-api endpoint resolvers) is a
+-- single follow-up cleanup, so the reporting view is recreated once rather than
+-- per column.
+--
+-- Deploy ordering: roll out the controller binary that reads links from the
+-- table before applying this migration, so a controller still reading the
+-- column keeps seeing projected updates until it is replaced.
+
+begin;
+
+create or replace function internal.on_data_plane_private_links_change() returns trigger
+    language plpgsql security definer
+    set search_path to ''
+    as $$
+declare
+    v_controller_task_id public.flowid;
+begin
+    select dp.controller_task_id into v_controller_task_id
+    from public.data_planes dp
+    where dp.id = coalesce(new.data_plane_id, old.data_plane_id);
+
+    if v_controller_task_id is not null then
+        perform internal.send_to_task(
+            v_controller_task_id,
+            '00:00:00:00:00:00:00:00'::public.flowid,
+            '"converge"'::json
+        );
+    end if;
+
+    return null;
+end;
+$$;
+
+commit;