Keep FastCGI available during restarts

2026-07-16 22:00:08 +00:00
parent 93c701c6c7
commit caffb3f404
16 changed files with 192 additions and 41 deletions
@@ -145,6 +145,25 @@ module lives in the configured writable cache root rather than beside the
 possibly root-owned deployed `core.wasm`; freshness still uses the deployed
 artifact's metadata.

+Packaged deployments use systemd socket activation for FastCGI. The socket unit
+owns `/run/uce/fastcgi.sock`; UCE validates and adopts the single named listener
+after exec. The listener therefore remains connectable and queues requests while
+the service and its post-fork workers restart. Direct launches without systemd
+activation retain the existing configured Unix/TCP listener behavior.
+On termination the parent asks render workers to close their listeners, finish
+accepted connections within the bounded worker drain interval, and only then
+exits. This prevents an accepted FastCGI request from being reset at handoff;
+the socket unit queues later connections for the replacement workers.
+The graceful signal handler belongs to the parent and render workers. Generic
+`task()` children restore default termination signals after fork so
+`task_kill()` and `server_stop()` retain their immediate stop contract.
+
+Epoch interruption measures uninterrupted guest CPU segments. The common
+hostcall membrane re-arms the store deadline after every native call, excluding
+blocking I/O, process waits, hashing, and other host work without weakening a
+guest loop that makes no hostcalls. Keeping this at the membrane also covers new
+hostcalls without per-import timeout bookkeeping.
+
 `request_perf()` reports worker module-cache hits and misses and divides a miss
 into artifact lookup, wasm read, custom-section parse, serialized-module
 deserialization or wasm compilation, and immutable import classification. This