Lot 9(a): reload the configuration as it changes, and show a fault in the icon

[geeooff]

The watcher reads config.toml again whenever it changes, and a file it cannot use no longer makes it exit: the icon turns red, a notification says why, and nothing runs until it is fixed. Lot 9's configuration item, built 2026-09-19 and verified in the field on 2026-09-20.

What changed for the person running it

• Live reload. Save the file and the watcher reads it within a second — Configuration reloaded in the log. A game in progress is not disturbed: the engine hands the session to its successor the way an update does, and the commands that run when the game ends are the ones just saved. log_level follows live; log_dir waits for the next start and says so.
• Faults. An unusable file — a typo, a value the program refuses, a missing file — is a red, slashed icon; a silent notification with the error glyph carrying the whole summary (line 3: unknown field 'log_levl', expected one of …); a menu line with the short of it; an ERROR line in the log. Nothing runs until it is fixed, not even the stop half — frozen, deliberately, never a fallback to the last good file. Saving a good one brings the icon back and a notification says the watcher is watching again, also after a restart on a file fixed while it was stopped.
• Fixed: log_level = "debg" used to be accepted and to leave a log with nothing but errors in it, silently. Now a fault like any other.

How it is built

• Supervisor, not RwLock. The plan named an Arc<RwLock<Config>> read at each use; that would have covered a valid change and left the invalid case — frozen idle, frozen mid-game, a recovery afterwards — to new engine states. Lot 13's handover already was those three, so a change to the file is a handover from one engine to the next in the same process, and the engine changed by one match arm. docs/design/09-robustness.md records the plan and what was built, and why.
• StopSignal gains a Reload reason and a child signal: the engine runs on a child of the process-wide stop; the child's own event carries the reload and is reset between engines, the parent is never reset, so a Quit during a reload cannot be lost.
• config::watch: FindFirstChangeNotificationW on the folder, a 250 ms settle after the last notification, bytes compared before signalling. LoadError with summary() and headline() replaces the two marker structs; exit codes 3 and 4 are now the other commands'.
• The tray reads the session and the fault together and draws both; the supervisor reports which transition each read is (Report::Faulty | Restored | Usable) so the tray can word the two notices without knowing the history. A configuration-fault file beside the session marker carries a fault across processes; status reports it, purge removes it.
• Eight new tests (181 with the client ones): the summaries and the level validation, the folder watch on a real folder, the reload scenario in the engine, the fault on every tray surface, the fault marker.

Measured

• 2026-09-19, scratch configuration, no game: six changes, six reloads, the error line and the icon at T+250 ms each time.
• 2026-09-20, the maintainer on the installed copy: a reload during a Starfield session (no command run, the session resumed, the renamed stop action ran at the end); a fault during a session (the game quit into a frozen watcher, the fix ran the recovery and the idle configuration came back); the notifications for a fault, a fix, a fault at start, and a fix after a restart.

For the reviewer

• AGENTS.md's Discreet principle now names the two things the program says unasked; the tray convention names the supervisor's verdict.
• The user pages no longer tell anyone to restart the watcher after an edit; the recipes keep install-task for the zip's first install.
• CI runs the same checklist; the three registry tests stay ignored on the runner.

🤖 Generated with Claude Code