v0.16.2

Fixed

• A task removed by reload and then re-added by a later reload now resumes as a normal running service, instead of coming back with all instances stopped.
• Log rotation no longer deletes the previous rotated segment (.log.prev) when the rename that replaces it fails, and a failed write to the active log file no longer advances its line/byte counters as though it had succeeded.
• A notifier’s retry_budget now applies to SMTP and sendmail notifiers too, not just Slack, Discord, Telegram, and webhook.
• The unread-notification badge no longer overcounts after a failed “mark read” action, even if a newer update for that notification had arrived while the request was in flight.
• Local CLI/TUI streaming connections (log tail, event stream) are no longer subject to the same per-IP cap as remote clients — only the overall connection limit still applies to them.
• reload no longer silently restarts a service the operator had stopped (or that had exhausted its retry budget) when only its config changed. A changed service now recycles its running instances in place, leaving a stopped or fatally-failed service exactly as it was.
• Killing a task’s Docker/Podman container during shutdown or a graceful_stop no longer hangs indefinitely if the container engine itself stops responding.
• Fetching a run’s log or searching logs now returns a proper error instead of a misleading “not found” when the underlying storage lookup itself fails.
• A rejected config write (failed validation on reload) now rolls back through the same crash-safe atomic write every config write uses, instead of a plain in-place write that could leave the file corrupted if interrupted mid-rollback.
• A notifier’s retry_budget is now honoured even when a single delivery attempt hangs, by capping the HTTP client’s own timeout to the configured budget.
• Redefining a plain task as a service on reload now starts the new service like any newly-added one and lets the in-flight run finish under its old definition, instead of cancelling that still-draining run.
• A coalesced notification now states how many repeats it stands in for (×N), so a folded burst of failures no longer reads as a single occurrence.
• A hung (not merely down) Docker/Podman engine no longer blocks container-task startup indefinitely — the first-connect probe is now time-bounded, so one wedged engine can’t stall every other container task’s start.
• import supervisord now merges a [program] that appears in more than one included file (last value wins, as supervisord itself assembles it), instead of importing it twice as web and web-2.