Isolate CLI workers and module serialization

docs/setup.md

@@ -192,6 +192,8 @@ FCGI_SOCKET_PATH=/run/uce/fastcgi.sock
 FCGI_SOCKET_MODE=0666
 CLI_SOCKET_PATH=/run/uce/cli.sock
 CLI_SOCKET_MODE=0600
+CLI_WORKER_COUNT=2
+CLI_WORKER_MAX_REQUESTS=8
 
 SITE_DIRECTORY=/var/www/html
 HTTP_DOCUMENT_ROOT=/var/www/html
@@ -209,6 +211,7 @@ WASM_MEMORY_LIMIT_BYTES=536870912
 WASM_EPOCH_DEADLINE_TICKS=200
 WASM_EPOCH_PERIOD_MS=50
 WASM_INVOCATION_TIMEOUT_MS=30000
+WASM_SERIALIZE_TIMEOUT_SECONDS=120
 MYSQL_PERSISTENT_POOL_SIZE=8
 MYSQL_PERSISTENT_POOL_IDLE_TIMEOUT_SECONDS=300
 
@@ -224,6 +227,8 @@ Important settings:
 
 - `FCGI_SOCKET_PATH` is the Unix socket used for normal `.uce` requests. Set it explicitly and keep this value and the web-server `fastcgi_pass` path identical. The reference config uses `/run/uce/fastcgi.sock`; if you choose `/run/uce.sock`, use it in both places.
 - `CLI_SOCKET_PATH` is a local HTTP-over-Unix socket used by `scripts/uce-cli` and test/admin units. Keep it private (`CLI_SOCKET_MODE=0600`) unless you intentionally delegate admin/test execution to a trusted Unix group (`0660`).
+- `CLI_WORKER_COUNT` adds a transport-isolated CLI/test renderer pool. Use at least `2` on a live site so broad test/admin unit loads cannot evict or page out public FastCGI workers' hot modules and a CLI unit can make one nested CLI call without self-deadlocking. `0` preserves the legacy shared pool; dedicated CLI workers are additional to `WORKER_COUNT` and retain their own Wasmtime engine, module cache, and persistent connector pool.
+- `CLI_WORKER_MAX_REQUESTS` recycles each dedicated CLI worker after this many completed connections (default `8`, maximum `1024`); `0` disables recycling. Public FastCGI workers are not request-count recycled, preserving their warmed module caches. Recycling bounds the module set retained by broad test and administration runs while allowing one CLI invocation/test group to finish uninterrupted.
 - `FCGI_SOCKET_MODE` and `CLI_SOCKET_MODE` are octal permission modes applied after socket bind. Prefer tightening `FCGI_SOCKET_MODE` to `0660` when nginx/Apache can share a trusted group with the UCE worker.
 - `SITE_DIRECTORY` is the public site tree to scan for `.uce` files. Use `/var/www/html` when the web root is outside the runtime tree; relative paths are resolved from the runtime working directory. Installed regression gate scripts derive their temporary test root from this setting unless `UCE_TEST_SITE_DIRECTORY` is explicitly provided.
 - `HTTP_DOCUMENT_ROOT` is the root used by the built-in HTTP/WebSocket listener when it resolves upgrade requests. Set it to the same web root as nginx/Apache.
@@ -267,6 +272,12 @@ Important settings:
   Wasmtime's serialized-module deserialization call is also synchronous and
   cannot be interrupted; if it stalls, the timeout is reported after that call
   returns rather than at the nominal wall-clock boundary.
+  Proactive and offline serialization instead runs in a short-lived child
+  bounded by `WASM_SERIALIZE_TIMEOUT_SECONDS` (default `120`, clamped to
+  `1`–`3600`), so each unit releases its pooling allocator arenas and threads
+  on exit instead of accumulating them in the long-lived scanner. Serialization
+  holds the unit compile lock and rechecks the wasm artifact identity before
+  publication; timed-out/failed children leave no dead temporary artifact.
   Initial/final descriptor identity, unique selected metadata sections, and
   strict 64-bit LEB high-bit validation reject changed or ambiguous artifacts.
 
@@ -301,6 +312,7 @@ The server binary accepts only these process modes:
 ```bash
 bin/uce_fastcgi.linux.bin             # start the server
 bin/uce_fastcgi.linux.bin --precompile
+bin/uce_fastcgi.linux.bin --serialize-module /absolute/unit.uce.wasm
 bin/uce_fastcgi.linux.bin --help
 ```