docs(architecture): describe the single-environment runtime, without invented figures

[os-zhuang]

Fixes#64

architecture.mdx described runtime behaviour with the hosted,
many-environments-per-instance model, on a page whose subject is the
single-environment runtime a customer deploys from the release bundle.

The figures are removed, not restated

No authoritative measurement of the shipped image was available here, so the
numbers were removed and the shape is described instead. This repository is
the docs site; it holds no benchmark, no runtime source, and no measurement
artifact for the licensed image, and the image itself is behind licensed
registry credentials. Adapting the hosted figures by reasoning about them was
explicitly out of bounds, and it is the defect being fixed: a range with a unit
reads as measured.

Provenance, for the record: the figures entered the tree in 393f3d3 — the
initial import of the pre-July free-runtime era — and were never sourced by any
later commit (git log -S finds no other author).

Gone:

Was	Why it could not stay
Per-kernel warmup (first request to a project) — 50-300ms	"First request to a project" is not an event a single-environment reader has
Memory footprint — ~150MB base; ~10-30MB per active project kernel	Describes a different product's memory profile, per active project kernel
Concurrent app kernels per instance	Not a dimension this shape scales on — replicas are
Cold start — ~1 second, Warm request latency — sub-10ms, Steps 4-8 typically execute in 5ms	Same class: unsourced runtime measurements. Keeping two rows while deleting the others would have made the survivors read as the verified ones

The section is now a table of where each cost comes from and what to measure
it as — time-to-/api/v1/ready, the container's RSS under your own load, and
so on.

The model, not just three cells

The hosted model was load-bearing across the page, so the prose around the
table moved with it. Verified against the shipped pages that are the authority
for the deployment shape — deploy/index, deploy/docker,
deploy/kubernetes, deploy/air-gapped (#62/#63) and
reference/environment-variables:

• One app per deployment.OS_ARTIFACT_URL is "the one variable that
  selects the app", and metadata "is scoped to the deployment, not to an
  organization". Organizations that share a walled deployment share its app.
• No per-request app resolution.Hostname → project resolution and
  Get or build per-project kernel from LRU left the request path; the kernel
  is built at startup and readiness gates traffic behind it.
• Scale is replicas, not kernels. Past one replica the cluster driver and
  identical shared secrets become mandatory (deploy/docker).
• The diagram box Per-project ObjectKernel (LRU cached) is now
  ObjectKernel — this deployment's app.
• reference/environment-variables calls this shape a "single-environment
  runtime"; the page now matches that vocabulary.

Two bounded in-place corrections, named because they are not in the card

Both are the same defect class — the page asserting a runtime shape the product
does not have — and both are pinned by a shipped page, so they were corrected
rather than filed:

1. "fits in a Lambda-like environment" → "fits in a long-lived container or
   VM". resources/faq.mdx already states the opposite and is the newer claim:
   "The runtime is a long-lived Node process — designed for containers or VMs,
   not stateless functions."
2. "If you're running an internal app marketplace with many tenants and
   apps" → "If you publish apps that several deployments install". The
   catalog is real (build/marketplace.mdx, build/packages.mdx); the
   many-apps-per-runtime framing around it was not.

Also: the diagram's HTTP dispatcher row was one character wider than every
other row on main. All rows are now 55 characters.

Verification

Run on the final commit, 6711c94:

Check	Result
pnpm turbo run type-check --continue	1 successful, 1 total (--force, 0 cached)
pnpm turbo run build	1 successful, 740 static pages, 0 cached
pnpm turbo run test	0 tasks — no package in this repo defines a test script
node .github/scripts/check-translations.mjs	✓ gate passed
check-translation-ownership.mjs	0 translation artifacts touched, 1 other file

The rendered page was read out of the build output
(.next/server/app/en/docs/architecture.html), not just the diff — which is
how a scripted re-pad that had clobbered step 2 of the request path got caught
before the commit.

Note on the translation gate. The freshness table is byte-identical before
and after this change (verified by running the gate in a second worktree at
origin/main): stale 1/3/3/3/3/3, missing 17/40/41/40/40/40, gate passes on
both. The six architecture.* locale siblings were deleted in #63 under
the AGENTS.md rule that a stale translation is worse than a missing one, so
this page has no siblings left to move into the stale column — it is already in
missing, and already on the worklist.

| Locale | Stale | Missing | Guide-stale |
|:-- | --:| --:| --:|
| zh-Hans | 1 | 17 | 0 |
| ja | 3 | 40 | 0 |
| de | 3 | 41 | 0 |
| es | 3 | 40 | 0 |
| fr | 3 | 40 | 0 |
| ko | 3 | 40 | 0 |

No locale file is touched by this PR.

---

Generated by Claude Code

[os-zhuang]

Merged as 3b5160c under a direct maintainer instruction, quoted verbatim for the audit trail: 「ci 绿了就合并」.

Updated from main before merging so it was re-checked against the repaired gate rather than the swallowed one. That run is the first time the new output validator ran on a real PR: it reported the 91 pre-existing corpus findings and passed, which is the designed behaviour — fidelity rules block only on locale files a PR changes, and this PR changes none.

Verified on main after landing: the invented runtime figures return 0 matches.

---

Generated by Claude Code