Worker
- Per-owner max_active_attempts (default 1, <= concurrent) replaces the
one-active-attempt-per-owner claim rule; claims fill free slots each tick
in deterministic created_at/profile_name/id order and record claimed_at.
- Disk, memory and artifact reservations are admitted and inserted in one
owner-locked transaction; clones reserve measured source disk bytes and
source RAM plus overhead; pending clone storage and aggregate artifact
headroom are accounted.
- nextid lock is released right after the allocation reservation; source
lock waits follow the caller context (20 min ceiling) with specific text.
- Shared settleJobSQL for worker and watchdog; cancellation is reported as
cancelled instead of failed/error.
- Safety deadline is refreshed when collection starts so the watchdog
cannot take over a live collection.
- Evidence release continues past failures, keeps the original error and
stops retrying until an admin re-requests.
- Job ISO media is reconciled after all attempts finish (fixes leaks and the
parallel-finish race); readiness errors carry the last guest/transport
cause and distinguish cancellation/lease loss.
- Watchdog prunes expired sessions, login limits and old orphan events;
worker health events are throttled.
PVE client
- Bounded retries for idempotent GETs on transport errors/5xx only; task
polling starts at 250 ms; task exitstatus is logged for operators;
QGA file reads use 1 MiB chunks.
API/store
- Indexes for hot job/claim/quota queries; claimed_at column.
- Native UUID path comparisons with early 404; deterministic run ordering;
queue_ahead; admin held-attempts listing; stale revision publish guard;
retry refused while any attempt is unfinished.
- Uploads stream outside the DB transaction with a short locked quota
recheck; explicit pool sizes; `otche healthcheck` CLI mode.
Recorder
- Network reads and FFmpeg writes happen outside the framebuffer lock;
wall-clock frame pacing with bounded catch-up and explicit gaps; fsync at
most once per second after the first durable fragment.
Windows runner
- UTC-safe timestamp parsing everywhere; readiness checks desktop first and
computes the baseline once; per-nonce probe results; collector publishes
initial telemetry immediately and reads event logs incrementally.
- Baseline records UAC, Smart App Control, Secure Boot and Device Guard
registry state; installer stores the LSA secret last and gains read-only
-Verify and signed -UpdateRunner maintenance modes.
omar