Make sure we iterate over a list of models that's not concurrently modified
Introduce connection recovery interval; improve recovery robustness