Merge origin/wj into wilm

wilm was one commit behind wj. The only conflict was in the gunicorn command,
where both branches had already made the identical change (gthread, 4 workers,
8 threads, timeout 30) and only the explanatory comments differed. Kept the wj
wording, which records the production diagnosis behind the change.

docker-compose.yml

@@ -79,18 +79,25 @@ services:
       - gunicorn
       - --bind
       - 0.0.0.0:5001
-      # Threaded workers so one blocked request (e.g. an agent that fails the TLS
-      # handshake and retries in a loop) cannot pin a whole worker and starve the
-      # UI. With sync workers a handful of stuck clients exhausted all capacity.
-      - --worker-class
-      - gthread
-      - --workers
-      - "4"
-      - --threads
-      - "8"
-      # Shorter timeout so a hung connection frees its thread quickly instead of
-      # holding it for a full minute.
-      - --timeout
+# Threaded workers, not the blocking sync default. An agent that fails
+# the TLS handshake retries in a loop, and with 4 sync workers a handful
+# of those pinned every worker: real UI requests queued 20+ seconds while
+# the CPU sat idle. A stuck connection now holds one THREAD, and 32
+# (4 x 8) have to be exhausted before a person waits.
+#
+# Found in production at the other site (their commit db75ca7). Their
+# server, our agent - so the same client behaviour will reach any site
+# running the endpoint agent, and the fix belongs in the product rather
+# than on one branch.
+- --worker-class
+- gthread
+- --workers
+- "4"
+- --threads
+- "8"
+# 30, not 60: a hung connection frees its thread in half the time, which
+# is what decides whether a retry storm is absorbed or queues.
+- --timeout
       - "30"
       - --access-logfile
       - "-"