Cut the round trips a message costs the engine

Measured with `make bench-engine` against a real Redis: 103.6 -> 164.4
messages a second on a five-node chain (p50 latency 2125 -> 1171 ms) and
34.8 -> 63.2 on a fan-out of twenty. Against the memory backend, which is
what a pip install runs on, 262 -> 626.

The two that bought most of it:

- `StateBackend.record` puts a published value, its timestamp, its series
  and its version counter in one round trip. They were four calls building
  four pipelines, and a value crossing an edge pays them twice. A released
  rate-limit hold rides along instead of a DEL per port.
- the readiness check reads a node's inputs and hands them to the node,
  rather than reading the triggering ones to count them and having the node
  read the same keys again a moment later.

`apply_outputs` was a second copy of `_record_outputs` and is now the same
code plus the event that distinguishes it.

The rest, each small:

- `_derive` builds a node-by-id map and a `consumes` index, so dispatching
  an item and publishing a value stop scanning every node in the
  installation.
- `read_all` is memoised against the store revision — it sits on the
  publish path, so a dashboard slider was reading and validating every
  flow file per value. Same mechanism `_wiring` already uses.
- the `message_value` source block is built once per node instead of per
  emission.
- both timer threads ask the queue to promote only when something is
  actually due, which takes an idle engine from ~4 Redis round trips a
  second to one.
- the shared httpx client is bounded (32 connections, one retry); its
  default pool is 100 with no per-host cap, so one slow endpoint could
  take it and every other sender node with it.
- the MQTT and delay nodes no longer log a line per message at INFO.

Robustness, in the same pass:

- `MemoryWorkQueue._done` was a set nothing ever removed from — one entry
  per non-idempotent node per item, for the life of the process, in the
  default configuration. Capped, the way the Redis side expires its
  markers.
- a saturated engine can claim from the due lane past the cascade limit.
  The capacity gate sits in front of the claim, so the due lane's priority
  — decided inside it — did not apply while every slot was held: a motor's
  stop was not behind the long nodes, it was unread. Only after a slot has
  genuinely failed to free for half a second, and briefly, so the backlog
  is not starved in turn.
- `reclaim_stale` dispatches through that same gate. It could return sixty
  entries and push in-flight far past the limit the gate exists to hold.
- a flow's nodes are stopped together rather than one after another. Each
  gets `NODE_STOP_TIMEOUT`, so a flow whose broker was unreachable took
  five seconds per node — long enough to outlast `REBUILD_WAIT` and 503
  the deploy.
- the worker pool and the HTTP client are closed on a thread, not on the
  event loop, and a run closes the state backend it built (on Redis, a
  client and a connection pool per run).
- the five background tasks say something when they die. Each catches
  exceptions inside its loop, so one raised anywhere else left the engine
  serving with no metrics, no alerts or no artifact sweep, silently.

`tests/flow/test_round_trips.py` counts the state operations one message
costs — four, where it was about eleven — because none of the above would
fail a behavioural test if it were undone.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01M6hPWS6YEbT1P8LxhhFb2T

backend/tests/flow/test_queue.py

@@ -8,6 +8,7 @@ from fluksio.flow.executor import ExecutionService
 from fluksio.flow.messages import DType, MessageSpec
 from fluksio.flow.nodes import Node
 from fluksio.flow.pipeline import Pipeline
+from fluksio.flow import queue as queue_module
 from fluksio.flow.queue import MemoryWorkQueue, WorkItem
 from fluksio.flow.state import MemoryState
 
@@ -584,3 +585,44 @@ def test_a_throttled_emission_wakes_nothing():
     # The first is let through; the second is held by the interval, and a value
     # nothing published is nothing to wake on.
     assert seen == [1.0]
+
+
+def test_a_due_timer_is_claimable_while_the_backlog_is_not():
+    """What a saturated engine uses to get a motor's stop out.
+
+    Every cascade slot held by a long node used to mean the due lane was not
+    merely behind the backlog but unread, because the capacity gate sits in
+    front of the claim.
+    """
+    queue = MemoryWorkQueue()
+    queue.add(WorkItem(kind="cascade", node="f.backlog", flow="f"))
+    queue.add_delayed(
+        WorkItem(kind="cascade", node="f.timer", flow="f"), time.time() - 1
+    )
+    assert queue.move_due(time.time()) == 1
+
+    claimed = queue.claim(10, 10, due_only=True)
+    assert [item.node for item in claimed] == ["f.timer"]
+
+    # And the backlog is still there for whoever comes next.
+    assert [item.node for item in queue.claim(10, 10)] == ["f.backlog"]
+
+
+def test_a_due_only_claim_of_nothing_does_not_take_the_backlog():
+    queue = MemoryWorkQueue()
+    queue.add(WorkItem(kind="cascade", node="f.backlog", flow="f"))
+
+    assert queue.claim(10, 10, due_only=True) == []
+    assert len(queue.claim(10, 10)) == 1
+
+
+def test_done_markers_do_not_grow_without_bound():
+    """The Redis side expires them after an hour; this one is capped by count."""
+    queue = MemoryWorkQueue()
+    for i in range(queue_module.DONE_MARKERS + 500):
+        queue.mark_done(f"entry-{i}", "f.node")
+
+    assert len(queue._done) == queue_module.DONE_MARKERS
+    # The newest are what redelivery would ask about.
+    assert queue.was_done(f"entry-{queue_module.DONE_MARKERS + 499}", "f.node")
+    assert not queue.was_done("entry-0", "f.node")