Cut the round trips a message costs the engine

Measured with `make bench-engine` against a real Redis: 103.6 -> 164.4
messages a second on a five-node chain (p50 latency 2125 -> 1171 ms) and
34.8 -> 63.2 on a fan-out of twenty. Against the memory backend, which is
what a pip install runs on, 262 -> 626.

The two that bought most of it:

- `StateBackend.record` puts a published value, its timestamp, its series
  and its version counter in one round trip. They were four calls building
  four pipelines, and a value crossing an edge pays them twice. A released
  rate-limit hold rides along instead of a DEL per port.
- the readiness check reads a node's inputs and hands them to the node,
  rather than reading the triggering ones to count them and having the node
  read the same keys again a moment later.

`apply_outputs` was a second copy of `_record_outputs` and is now the same
code plus the event that distinguishes it.

The rest, each small:

- `_derive` builds a node-by-id map and a `consumes` index, so dispatching
  an item and publishing a value stop scanning every node in the
  installation.
- `read_all` is memoised against the store revision — it sits on the
  publish path, so a dashboard slider was reading and validating every
  flow file per value. Same mechanism `_wiring` already uses.
- the `message_value` source block is built once per node instead of per
  emission.
- both timer threads ask the queue to promote only when something is
  actually due, which takes an idle engine from ~4 Redis round trips a
  second to one.
- the shared httpx client is bounded (32 connections, one retry); its
  default pool is 100 with no per-host cap, so one slow endpoint could
  take it and every other sender node with it.
- the MQTT and delay nodes no longer log a line per message at INFO.

Robustness, in the same pass:

- `MemoryWorkQueue._done` was a set nothing ever removed from — one entry
  per non-idempotent node per item, for the life of the process, in the
  default configuration. Capped, the way the Redis side expires its
  markers.
- a saturated engine can claim from the due lane past the cascade limit.
  The capacity gate sits in front of the claim, so the due lane's priority
  — decided inside it — did not apply while every slot was held: a motor's
  stop was not behind the long nodes, it was unread. Only after a slot has
  genuinely failed to free for half a second, and briefly, so the backlog
  is not starved in turn.
- `reclaim_stale` dispatches through that same gate. It could return sixty
  entries and push in-flight far past the limit the gate exists to hold.
- a flow's nodes are stopped together rather than one after another. Each
  gets `NODE_STOP_TIMEOUT`, so a flow whose broker was unreachable took
  five seconds per node — long enough to outlast `REBUILD_WAIT` and 503
  the deploy.
- the worker pool and the HTTP client are closed on a thread, not on the
  event loop, and a run closes the state backend it built (on Redis, a
  client and a connection pool per run).
- the five background tasks say something when they die. Each catches
  exceptions inside its loop, so one raised anywhere else left the engine
  serving with no metrics, no alerts or no artifact sweep, silently.

`tests/flow/test_round_trips.py` counts the state operations one message
costs — four, where it was about eleven — because none of the above would
fail a behavioural test if it were undone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6hPWS6YEbT1P8LxhhFb2T

backend/fluksio/flow/store.py

@@ -116,6 +116,10 @@ class FlowStore:
         #: it therefore counts from zero per process and misses an edit made on
         #: disk behind the API, which no writer here does.
         self.revision = 0
+        #: `read_all` memoised against that revision — see the method.
+        self._read_all: list[FlowDef] = []
+        self._read_all_at = -1
+        self._read_all_lock = threading.Lock()
         if not (self.root / ".git").exists():
             self._git("init", "-q")
             self._commit("Initialise flow store", allow_empty=True)
@@ -394,15 +398,25 @@ class FlowStore:
         return FlowDef.model_validate_json(path.read_text())
 
     def read_all(self) -> list[FlowDef]:
-        """Every published flow — what the engine runs."""
-        flows = []
-        for path in sorted(self.root.glob("*/flow.json")):
-            name = path.parent.name
-            try:
-                flows.append(self.read_flow(name))
-            except Exception:
-                logger.exception("Skipping unreadable flow '%s'", name)
-        return flows
+        """Every published flow — what the engine runs.
+
+        Cached against `revision`, because this sits on the publish path: a
+        dashboard slider moving asked every flow's file to be read and
+        validated again, per value. The list is rebuilt on the next commit,
+        and returned as a copy so a caller sorting it cannot disturb the next.
+        """
+        with self._read_all_lock:
+            if self._read_all_at != self.revision:
+                flows = []
+                for path in sorted(self.root.glob("*/flow.json")):
+                    name = path.parent.name
+                    try:
+                        flows.append(self.read_flow(name))
+                    except Exception:
+                        logger.exception("Skipping unreadable flow '%s'", name)
+                self._read_all = flows
+                self._read_all_at = self.revision
+            return list(self._read_all)
 
     def write_flow(self, flow: FlowDef) -> bool:
         """Publish a flow directly. Returns False when nothing actually changed."""