revert(seinode): restore the create-only spec.nodeConfig rule (spec 013 reverted)

[bdchatham]

Summary

Reverts #608 (21ae61d), the temporary spec 013 switch. Every non-frozen arctic-1 SeiNode moved to spec.nodeConfig in place on 2026-10-08 (PLT-1410: 46 nodes in prod, prod-euw1, prod-use2, and harbor). The frozen nodes stay controller-configured by decision.

• CRD rule. The rule is again has(self.nodeConfig) == has(oldSelf.nodeConfig), so spec.nodeConfig is again fixed at creation.
• SyncStatefulSet. It no longer deletes and creates again a StatefulSet whose podManagementPolicy differs. It also no longer waits for a terminating StatefulSet.
• Spec 013. The document stays and is marked Reverted. The runbook (sei-protocol/runbooks#168) cites it for a later in-place move.

Why this is safe to roll

• No pod template changes. In feat(seinode): let a running node switch to nodeConfig (spec 013, temporary) #608, noderesource.go changed only a comment, so the rendered StatefulSet is the same. A controller roll restarts no SeiNode pod.
• No live object depends on the removed path. Every switched node already has a Parallel StatefulSet that matches its desired policy. Every controller-configured node, including the frozen ones, matches OrderedReady.
• The restored rule accepts every existing node. No update to an existing SeiNode adds or removes nodeConfig.

Verification

• gofmt -l .: no files.
• go vet ./...: clean.
• staticcheck ./...: only the SA1019 client.Apply deprecation notes, which main also has.
• make manifests: no drift.
• Unit tests (go test with coverage, go1.26.0): pass. make test-modules: pass.
• make test-integration (envtest): pass.
• Not run locally: golangci-lint (the local binary is built with go1.25 and refuses a go1.26.0 module) and govulncheck (the run errored on the package pattern). CI runs lint.

Rollout

The rollout comes after the PLT-1410 peer-ID waves finish, so a controller restart cannot stall a wave's gate. It is one cell at a time, through the platform controller pin.

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Touches SeiNode admission and StatefulSet sync semantics, but rollout is intended to be safe because migrated nodes already match desired policy and no template behavior changes on controller restart.

Overview
Reverts the temporary spec 013 in-place nodeConfig switch (#608) after the arctic-1 migration. spec.nodeConfig is again fixed at creation: admission uses has(self.nodeConfig) == has(oldSelf.nodeConfig), so updates that add or remove the field are rejected (not only removal).

SyncStatefulSet no longer recreates StatefulSets when podManagementPolicy would change. The orphan-delete path, wait while a terminating StatefulSet exists, and effectivePodManagementPolicy are removed; comments now state that policy follows nodeConfig and cannot change on an existing StatefulSet.

Docs mark spec 013 as Reverted; tests drop switch/recreate coverage and envtest TestNodeConfig_CreateOnly now expects adding nodeConfig to an existing node to fail.

^{Reviewed by Cursor Bugbot for commit e6501f4. Bugbot is set up for automated code reviews on this repo. Configure here.}

[seidroid]

This reverts #608. spec.nodeConfig is fixed at creation again, through has(self.nodeConfig) == has(oldSelf.nodeConfig), and SyncStatefulSet no longer recreates a StatefulSet with orphan propagation or waits for a terminating one. It touches the same ten files as #608, the CRD output matches the marker, and the remaining impostor-recovery path is unchanged, so nothing blocks; codex's reading found nothing, which agrees with this review but added no finding of its own.

Non-blocking

• Removing the recreate-and-wait path makes this rollout safe only if no node is still mid-switch in any cell when the new controller starts. A node in that state would have spec.nodeConfig but still an OrderedReady StatefulSet, or have its old StatefulSet still terminating under the orphan delete. Every reconcile of such a node would then fail its Apply against the immutable podManagementPolicy, or patch the terminating object, and no code path would recover it. The description puts the rollout after the PLT-1410 waves, but nothing enforces that order, so check the live state per cell before bumping the pin: every nodeConfig SeiNode's StatefulSet is Parallel and none is terminating.

_{seidroid review · decision approve · session 5005721810e046afbdc7316ff5f48a7e · turn resp_claude_466510bcf693a09c1abad0d991451883 · item fa505833065d50019774ac982fcf8186}

Findings: 0 blocking | 1 non-blocking | 0 posted inline