fix(windows-deploy): enforce awHostname override and safe single-instance collector restart

ansible/deploy_aw_windows.yml

@@ -160,6 +160,9 @@
           {% if (aw_windows_package_zip_path | default('') | string | length) > 0 %}
           $params.PackageZipPath = "{{ aw_windows_package_zip_path }}"
           {% endif %}
+          {% if (aw_windows_hostname_override | default('') | string | length) > 0 %}
+          $params.AwHostname = "{{ aw_windows_hostname_override }}"
+          {% endif %}
           {% if aw_windows_skip_hardening | bool %}
           $params.SkipHardening = $true
           {% endif %}
@@ -183,6 +186,44 @@
       ansible.windows.win_powershell:
         script: |
           $ErrorActionPreference = 'Stop'
+
+          function Get-CollectorKey {
+            param([string]$CommandLine)
+            if (-not $CommandLine) { return $null }
+            $cl = $CommandLine.ToLowerInvariant()
+            if ($cl -like '*browser-domains-native-collector.ps1*') { return 'browser' }
+            if ($cl -like '*file-operations-collector.ps1*') { return 'fileops' }
+            if ($cl -like '*dlp-endpoint-signals-collector.ps1*') { return 'endpoint' }
+            if ($cl -like '*email-outbound-collector.ps1*') { return 'email' }
+            if ($cl -like '*worktime-session-collector.ps1*') { return 'worktime' }
+            return $null
+          }
+
+          $collectorProcs = Get-CimInstance Win32_Process |
+            Where-Object { $_.Name -eq 'powershell.exe' -and $_.CommandLine } |
+            ForEach-Object {
+              $key = Get-CollectorKey -CommandLine $_.CommandLine
+              if ($key) {
+                [pscustomobject]@{
+                  ProcessId    = [int]$_.ProcessId
+                  SessionId    = [int]$_.SessionId
+                  CreationDate = $_.CreationDate
+                  CollectorKey = $key
+                }
+              }
+            } |
+            Where-Object { $_ -ne $null }
+
+          # Keep only one process per (collector, session): newest survives, older duplicates are stopped.
+          foreach ($group in ($collectorProcs | Group-Object CollectorKey, SessionId)) {
+            $ordered = @($group.Group | Sort-Object CreationDate -Descending)
+            if ($ordered.Count -le 1) { continue }
+            foreach ($dup in $ordered | Select-Object -Skip 1) {
+              Stop-Process -Id $dup.ProcessId -Force -ErrorAction SilentlyContinue
+            }
+          }
+
+          Start-Sleep -Seconds 2
           Start-ScheduledTask -TaskName "{{ aw_windows_recovery_task_name }}"
           Get-ScheduledTask |
             Where-Object TaskName -like "{{ aw_windows_launch_task_pattern }}" |

ansible/group_vars/aw_windows.yml

@@ -24,6 +24,7 @@ aw_windows_extra_users: []
 
 aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
 aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
+aw_windows_hostname_override: ""
 
 aw_windows_afk_enabled: true
 aw_windows_window_enabled: true

ansible/group_vars/windows.example.yml

@@ -21,6 +21,7 @@ aw_windows_extra_users: []
 # Единые Windows/RDP пути: те же, что использует InnoSetup.
 aw_windows_install_root: "C:\\Program Files\\AWatch-rus\\bin"
 aw_windows_state_root: "C:\\ProgramData\\AWatch-rus"
+aw_windows_hostname_override: ""  # Например: SHARKON2025
 aw_windows_afk_enabled: true
 aw_windows_window_enabled: true
 aw_windows_file_ops_enabled: true