Hi Jed.
1. Yes, a user can change buckets if you change weights. We do deterministic hashing based on the weights and the user id (or whatever the hashAttribute you're using). Since we don't store user states in any cookies, we have no way to knowing what variation the user got before. You can read about it here:
https://docs.growthbook.io/faq - We have a few ways to handle this within GrowthBook: one, you can adjust the over all experiment exposure safely (ie, run a 50/50 A/B test against 10% of your traffic, then change that 10% to a different percentage). With GrowthBook, users who are exposed to both variations (for whatever reason) can be excluded from the results (and will be by default).
2. Yes, it's called every time.