Admit Account

Where a self-serve account sits between signup and a usable workspace.

Signup is unconditional, so nothing here refuses one: an account moves from PENDING into setup and settles either READY or FAILED.

WAITLISTED is retired and no code writes it. It stays declared only because production rows still hold the value and state coerces on load, so an enum that cannot express it would raise on every such read. Delete it in the contract deploy that narrows the CHECK constraint, once a count of rows holding the value reads zero. That count is the trigger because it measures the only thing keeping the member alive; a source grep cannot, since the retained member is legitimately named by TERMINAL_STATES here and by the status map that has to render a stored row. test_self_serve_unconditional_admission.py carries a strict xfail that turns the suite red once the member is removable and nobody removed it.

SEAT_HOLDING_STATES and the partial index below go out in that same deploy for a different reason — the live index, not the stored rows — and neither retention depends on the other. Deleting this member does not free them, and dropping the index does not free this member.