feat: allow unrestricted independent job concurrency

docs/decisions.md

@@ -35,8 +35,11 @@ expand these rules but must not contradict them.
   manifests, and observed external state.
 - SQLite backups use the online backup API. Defaults are every six hours, 12
   recent, 14 daily, and eight weekly copies, plus pre/post-migration backups.
-- Default concurrency is one active data-moving job per client and per route.
-  Disjoint node pairs may run concurrently. Queueing is durable FIFO.
+- Default concurrency is unrestricted: every eligible queued job is admitted
+  in one scheduler pass and independent jobs execute concurrently on a client.
+  Physical qBittorrent, Syncthing, disk, and network capacity are therefore
+  the natural limit. `enforce_concurrency_limits=true` restores the optional
+  legacy per-client/per-route gates. Commands for one job remain serialized.
 - A queued job owns a per-resource reservation. Cancelling it removes only the
   queued record/reservation and never sends cleanup commands.
 - Connectivity or transfer stalls wait indefinitely. A configurable 30-minute

docs/deployment-and-usage.md

@@ -44,6 +44,9 @@ command_max_attempts = 3 # Total sends, including the initial attempt.
 stall_after = "30m" # Warning state only; jobs continue waiting.
 route_policy = "on_demand" # Alternative: eager_mesh.
 route_setup_timeout = "30m"
+# Default: allow all eligible jobs; disk/network/service capacity is the limit.
+enforce_concurrency_limits = false
+# Used only when enforce_concurrency_limits is true.
 max_active_per_client = 1
 max_active_per_route = 1
 max_envelope_bytes = 1048576

docs/system-design.md

@@ -133,10 +133,13 @@ a resource may be active or queued at a time. This prevents incompatible
 baselines even when jobs would use different nodes or observe different sides
 of a hybrid identity.
 
-Defaults allow one active data-moving job per client and one per route. A job
-must acquire its source client, target client, route, and resource reservation
-atomically. Disjoint node pairs may run concurrently. Route setup is a
-preflight activity and does not permit a data step to bypass these leases.
+By default every eligible queued job is claimed in the same scheduler pass and
+independent jobs run concurrently on each client; physical service and storage
+capacity are the limit. Set `enforce_concurrency_limits=true` on control to
+enable the optional one-per-client/one-per-route gates. A job always retains
+its resource reservation, and commands for the same job remain serialized.
+Route setup is a preflight activity and does not permit a data step to bypass
+the resource reservation.
 
 Offline nodes do not prevent unrelated jobs from being listed or run. A job
 requiring an offline node remains waiting indefinitely; it does not consume an
@@ -154,6 +157,12 @@ advances to the next step. On reconnect:
 4. Control observes relevant qBittorrent, Syncthing, staging, and manifest
    state before selecting retry, resume, compensation, cleanup, or manual
    intervention.
+
+If a connection disappears while a synchronous job operation is in progress,
+the client journals events locally, reconnects indefinitely, and serializes a
+replayed command behind the in-flight operation for that job. The replay reads
+the journal rather than repeating the data operation. This applies to every
+transfer step, including post-commit staging cleanup.
 5. A command is reissued with its original ID when the acceptance result is
    uncertain.
 

docs/telegram-ux.md

@@ -25,8 +25,10 @@ What do you want to do?
 [ Evict Cache ] [ Job Status ]
 ```
 
-All subsequent pages edit this message. `Cancel` closes the active selection
-flow. `Back` returns one level while retaining validated filters/selections.
+All subsequent pages edit this message. Leaving a resource/tree selection
+returns to the Archive Control operation menu without closing the shared
+conversation. Confirmation `Cancel` returns to its immediate prior selection;
+the main menu alone can close Archive Control.
 Callback payloads contain opaque session/action IDs, not resource names or
 paths, and are validated against persisted session revision and expiry.
 

docs/testing.md

@@ -225,7 +225,7 @@ Fixtures include small deterministic v1, v2, and hybrid torrents with:
 | Recovery | restart every step on source/target/control, lost DB with proof, ambiguous loss fails closed |
 | Messaging | duplicate command/event, lost ack, sequence gap, stale revision, duplicate client ID |
 | Safety | attempted download, corrupt same-size file, symlink/path escape, special file, partfile mismatch |
-| Operations | stall retains percent, offline wait, cancellation each phase, postcommit cleanup retry |
+| Operations | stall retains percent, offline wait, cancellation each phase, postcommit cleanup retry, disconnect/reconnect during every transfer step with exactly-once replay |
 | Database | online backup under load, pre/post migration, retention, corrupt backup rejection, offline restore |
 | UI | pagination/filter chain, stale/double callback, persisted session, clear vs evict separation |