Keep warm wasm workers alive

docs/wasm-runtime-architecture.md

@@ -159,6 +159,13 @@ suspend the native SIGSEGV/SIGILL recovery handler around the wasm call so that
 Wasmtime's own trap signals are not escalated into a native fatal signal (see
 `serve_via_wasm` in `handle_complete`).
 
+Render workers are long-lived. The generic FastCGI transport retains a legacy
+eight-connection recycle default, but `listen_for_connections()` disables it
+for the UCE pool: recycling a healthy worker discards its Wasmtime engine and
+module cache, adding a visible cold-start request. Request state remains bounded
+by the fresh workspace and the normal per-request database/resource cleanup;
+faulted workers still exit and are replaced by the parent.
+
 ### Task callbacks and workspace lifetime
 
 `task()` and `task_repeat()` are fork-backed. The `uce_host_task_spawn` hostcall
@@ -333,7 +340,10 @@ header free-functions are `inline`. The wasm backend exposes only declarations
   in-runtime CLI suite (`site/tests/cli_runner.uce`) plus the site test pages and
   `scripts/test_dependency_invalidation.sh`. The latter changes a transitive
   `#load`, then replaces a warmed worker artifact while preserving its
-  whole-second mtime to prove both compiler and worker caches invalidate it.
+  whole-second mtime to prove both compiler and worker caches invalidate it. It
+  also sends 48 requests and asserts the observed worker PID set does not exceed
+  `WORKER_COUNT`, guarding against accidental reintroduction of request-count
+  recycling.
   `scripts/test_cold_component_deadline.sh` separately compiles a deliberately
   cold component that exceeds the development epoch window and proves the
   parent request still renders it.