Delete the process deployment path

[SaladDay]

Summary

Web setup is the only way a sandbox deployment is configured in production: Core builds its runtime provider only through NewDeferredRuntimeProvider, which always loads the Web-written setup. The process-configured deployment path, its "Local" node and the direct-capacity accounting were reachable only from tests. This change deletes them and ports the tests to the production seam. It is T3a in the architecture audit; the user decided (D1) to do it now, on main.

• Deleted:

  • ProcessDeployment, the selection arms of ConfigureProcess (now RequireUnclaimed), configureManager and its local node;
  • SetProcessDeployment/SetRuntimeManagerDeployment and their queries;
  • the Local* fields, ErrLocalNodeConfigured and the runtime_local_node_configured error;
  • the empty-mode fallback; RuntimeProvider now requires Mode and ProviderKind;
  • the direct-capacity path: MaxActive/MaxRetained in the suspension policy, computeCapacity*, the ProviderKind == ""/NodeID == "" branches, and CountComputeReservations/CountRetainedAllocations.

• Derived columns dropped (migration 000093):

  • web_managed (always true once an installation is recorded);
  • local_node_id;
  • admission_paused (always equal to reset_clear IS NOT NULL).

  Every CHECK constraint that mentioned them is rewritten in terms of installation_id IS NOT NULL. The upgrade refuses any row the derivations don't hold for, and any live node with an empty Core address. Down restores the columns and constraints.

• Dead branches deleted after the derivation: the "paused for provider maintenance" admission branch, the paused arms of placement, three enrollment checks that a reset check already covers, and the unreachable resource guard in the nil arm.

• NewDeferredRuntimeProvider takes a required prepare.

• Web: the "file-managed local node" logic in NodeList.tsx and two unused "Local nodes" strings are deleted.

• Tests: they use the production seam through shared helpers (webDeployment, webRuntimes, startWebWorker, enrollNode). Each keeps its acceptance meaning; the maintenance cases became reset cases.

Behaviour

• No production behaviour change. Every deleted check was implied by one that remains.
• The upgrade refuses a deployment configured outside Web setup, or a live node without a Core address.

Not in this change

The kept_at / empty-mode rule in seven allocation queries stays. An unclaimed deployment still admits hosted Sessions, so deleting the rule properly needs its own change: refuse hosted admission while unclaimed, then delete the Keep path and the kept_at column.

Review

A fresh-context blind review found no must-fix. Its verdict was "merge after fixes". Both should-fixes (the dead Registry.IsNode, and a stale sentence in console-api-usage.md en/zh) and its nits (a stale test name, a redundant test case, the unused locale strings, a migration error message that names the cause) are fixed in this commit.

Checks

• go build ./..., module vet, sqlc diff (clean) and make check-openapi.
• DB tests for deployment, execution, deploymentpg, placementpg, sessionpg, processconfig, cmd/server and api: 1818 passed, 0 skipped.
• tests/integration: 157 passed. The official-client tests ran with the pinned SDK.
• Migration 000093 applied up and down on a scratch database.
• Web: typecheck and vitest.
• check-names.py.

Net: non-test −232, sqlc −68, tests −477.

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}