Talk to the broker over one line per process, keep what a run reads, and run infra copies side by side

[qfeuilla]

Round 7 of the deploy fixes: the broker is reached over one connection per process instead of one request per call, workers keep what a run reads between runs, and infra copies of one node start and stop side by side.

What changed

One line to the broker. Every process (worker, listener, supervisor, the dispatcher's admin calls) keeps one WebSocket to the broker, and every JSON call rides it, numbered and answered in any order through the same router and checks a request gets. A call the broker holds (a wait for journal rows, a claim) costs it nothing, so twenty busy runs no longer fill a broker instance. File bytes stay ordinary requests.

Workers keep what does not change. The broker pushes, down that line, the notices a worker may see (its project's infra copies, its project's and tenant's connections), routed once per project and tenant. A worker keeps infra addresses and the connections it opened, published and read back, and drops them on a notice. Per-firing credentials are never kept; expiring tokens only until they are due a refresh. A publish that changes nothing writes nothing.

Fewer trips. A worker's claim returns the run's journal in the same statement. The dispatcher keeps install picks and instance values, the broker keeps route-gate verifiers, each dropped only for the project or tenant a change names. A refused token is counted and checked in one trip.

Infra. Commands on different copies of one node run side by side (one copy's commands still in order), in a scale-to-zero supervisor's pass too, with leases renewed while long commands run. A cloud stop waits until the machine is off and fails if something started it again. weft activate turns back on only the triggers an infra stop took down; the editor shows that button; the reactivate choice is asked for exactly the triggers being turned on, and the dispatcher refuses to decide kept work for nobody.

Schema runner. A group whose DDL changed is checked against the database before its DDL runs, so a replaced function or trigger needs its migration like a column does. Migrations: *_notices_for_held_copies.sql for access_grant, infra_node, project.

Builds and CLI. Each image says when it is built (only if it succeeded) and a long build says it goes on; Cloud Build compiles in the baked target instead of copying it into an empty cache. weft status hints keep --on, and runs are counted apart from setup runs.

Assistants. Tangle's running and connections skills are split into running, debugging, connections, people in the loop and public address, in all eleven folders. The Claude, Kilo and Codex setups carry the same rules and git guards.

Checked

• cargo clippy --workspace --all-targets --locked -D warnings, workspace unit tests, the named db tests (schema agreement and guard included), extension compile and tests, weft-graph tests.
• e2e: postgres, the four lifecycle transitions touched (infra stop, partial reactivate, suspension across reactivate), both instance tests, api_auth, api_reply, live_chat, human_form.
• Not run here: the GCP stop wait and the Cloud Build cache argument only show on a cloud install.

🤖 Generated with Claude Code