harden runtime config and docs

docs/wasm-runtime-architecture.md

@@ -26,10 +26,10 @@ gets invoked*.
 
 ```
                           ┌────────────────────────────┐
-        nginx  ──FastCGI──►  worker pool (N processes)  │  /run/uce.sock
+        nginx  ──FastCGI──►  worker pool (N processes)  │  $FCGI_SOCKET_PATH (example `/run/uce/fastcgi.sock`)
    (port 80 etc.)          │  uniform unit renderers    │  (FastCGI + CLI)
                           └─────────────▲──────────────┘
-                                        │ forward render (FastCGI, uce.sock)
+                                        │ forward render (FastCGI, FCGI_SOCKET_PATH)
                                         │
    browser ──raw HTTP / WS──►  ┌────────┴─────────┐
         (HTTP_PORT 8080)       │   WS broker      │  owns HTTP_PORT + every
@@ -48,14 +48,14 @@ gets invoked*.
 | Process | Owns | Renders units? | Source |
 |---|---|---|---|
 | **Parent** | nothing; supervises children | no | `main()`, `init_base_process()` |
-| **Worker** (×`WORKER_COUNT`) | `FCGI_SOCKET_PATH` (`/run/uce.sock`) + `CLI_SOCKET_PATH` | **yes** — the only processes that run wasm | `listen_for_connections()` |
+| **Worker** (×`WORKER_COUNT`) | `FCGI_SOCKET_PATH` (configured socket path; example `/run/uce/fastcgi.sock`) + `CLI_SOCKET_PATH` | **yes** — the only processes that run wasm | `listen_for_connections()` |
 | **WS broker** (×1) | `HTTP_PORT` + every live WS connection + `WS_BROKER_SOCKET_PATH` | no — forwards to the pool | `run_ws_broker()` |
 | **serve_http dispatcher** (×bind) | one custom-server bind address | no — forwards to the pool | `custom_server_http_dispatcher_loop()` |
 | **Proactive compiler** | nothing; pre-compiles units | no | `run_proactive_compiler()` |
 
 **only workers instantiate Wasmtime and run unit code.**
 Every connection-owning process (broker, serve_http dispatcher) forwards the
-request invocation back to a worker over `/run/uce.sock` using the minimal
+request invocation back to a worker via `FCGI_SOCKET_PATH` using the minimal
 FastCGI client in [`src/lib/fcgi_forward.h`](../src/lib/fcgi_forward.h). This is
 forced by Wasmtime: an `Engine`/`Store` cannot be safely re-created across
 `fork()`, and the brokers fork from the parent that already touched the
@@ -137,7 +137,7 @@ Each request gets a fresh **workspace** — a per-request wasm instance tree wit
 the membrane wired in. `wasm_worker_serve(worker, ctx, entry_unit, handler)`
 (`src/wasm/worker.cpp`) is the single entry point for *every* mode:
 
-1. Birth a workspace (CoW-snapshot-based where available).
+1. Birth a request-scoped workspace with fresh per-request state. Current production workers instantiate a fresh workspace for each request; any future snapshot/CoW optimization must preserve that request-isolation contract.
 2. Resolve `entry_unit` + `handler` to an export; components referenced at
    runtime are resolved on demand via the `uce_host_component_resolve` hostcall
    (`component_resolve()` → `__uce_<...>` slot), loading dependency modules
@@ -158,8 +158,7 @@ Wasmtime's own trap signals are not escalated into a native fatal signal (see
 captures the current `WasmWorkspace*`, but `src/lib/sys.cpp::task()` invokes the
 captured callback only in the forked child, before the hostcall stack unwinds in
 that child. The parent request may return and destroy its workspace; the child
-still has its own copy-on-write stack and its own copy of the per-request wasm
-workspace. This means a delayed task callback can run after the spawning request
+is forked from the parent and keeps a private request-context copy of the per-request workspace. This means a delayed task callback can run after the spawning request
 returns without dereferencing the parent's destroyed workspace. It is still a
 callback into the inherited child workspace, not a fresh normal request
 workspace; avoid adding host resources to `WasmWorkspace` that are invalid across
@@ -182,7 +181,7 @@ otherwise (page)         → serve_via_wasm(entry_unit, "render")
 
 The `UCE_*` params are set by whichever broker forwarded the request:
 
-- **Page render**: FastCGI nginx → `/run/uce.sock` directly; no `UCE_*` flags → `render`.
+- **Page render**: FastCGI nginx → `FCGI_SOCKET_PATH` directly; no `UCE_*` flags → `render`.
 - **CLI**: the CLI socket sets `is_cli`.
 - **serve_http**: the custom-server dispatcher sets `UCE_SERVE_HTTP=1` plus
   `UCE_SERVE_HTTP_FUNCTION` and rewrites `SCRIPT_FILENAME` to the configured
@@ -218,7 +217,7 @@ broker loop:
 2. The message rides as `UCE_WS_MESSAGE` (base64) with an **empty STDIN body** —
    a non-empty STDIN makes the FastCGI transport flush a premature response
    before `on_complete` ever runs.
-3. Connect to `/run/uce.sock` (non-blocking) and queue the encoded request in
+3. Connect to `FCGI_SOCKET_PATH` (non-blocking) and queue the encoded request in
    `ws_broker_outbound[fd]` with an enqueue timestamp.
 
 `ws_broker_drain_outbound()` runs after every `process(50)` tick: it finishes
@@ -310,8 +309,10 @@ header free-functions are `inline`. The wasm backend exposes only declarations
 | Key | Default | Meaning |
 |---|---|---|
 | `WASM_BACKEND_VERBOSE` | `0` | Emit `X-UCE-Wasm-*` workspace timing headers (benchmark only). |
-| `FCGI_SOCKET_PATH` | `/run/uce.sock` | Worker pool FastCGI socket (brokers forward here). |
-| `CLI_SOCKET_PATH` | `/run/uce/cli.sock` | Worker CLI socket. |
+| `FCGI_SOCKET_PATH` | runtime-configured (`/run/uce/fastcgi.sock` in this doc) | Worker pool FastCGI socket (brokers forward here). |
+| `CLI_SOCKET_PATH` | `/run/uce/cli.sock` | Worker CLI/admin socket. Keep private; reference `CLI_SOCKET_MODE` is `0600`. |
+| `FCGI_SOCKET_MODE` | `0666` | Permission mode applied to `FCGI_SOCKET_PATH` after bind; set tighter if nginx/Apache can use a trusted group. |
+| `CLI_SOCKET_MODE` | `0600` | Permission mode applied to `CLI_SOCKET_PATH`; set `0660` only for a trusted admin group. |
 | `HTTP_PORT` | `8080` | Raw HTTP + WebSocket port — owned by the WS broker. |
 | `WS_BROKER_SOCKET_PATH` | `/run/uce/ws-broker.sock` | Broker command socket for `ws_*` flushes. |
 | `WS_BROKER_OUTBOUND_TIMEOUT_SECONDS` | `30` | Max lifetime in seconds for queued WS broker forwards before drop. |