fix: silence-timeout-ms now applies live, as the config promises

The generated config header says edits apply live except the hotkey.
Verified on hardware that this was false for silence-timeout-ms: editing
it and latching capture left the old timeout in force until restart,
because the pipeline read the value from a Config copied at startup and
the reload had nowhere to land.

That is the safety net which force-closes the microphone when a
tap-to-latch capture is never ended. The setting that bounds how long we
may be listening is the last one that should require restarting the
listener -- noticing a hot mic and shortening the timeout did nothing.

Fixed the same way sensitivity was, whose comments describe this exact
bug: an atomic on RuntimeShared, published by the menu host on every
reload, read through a live closure the pipeline consults per tick. The
documentation workaround from the previous commit is reverted, since the
promise is now true.

Regression test mirrors live_sensitivity_overrides_the_startup_snapshot:
proves the pipeline READS the live value, which is the half that was
broken before.

Author: blarer

crates/config/src/paths.rs

@@ -289,9 +289,8 @@ const PREAMBLE: &str = concat!(
     "# OutLoud configuration. Every setting below is shown at its built-in\n",
     "# default and commented out; uncomment a line to change it.\n",
     "#\n",
-    "# Most edits apply live (no restart). Two do not: the hotkey, which\n",
-    "# binds at launch, and silence-timeout-ms, which the pipeline reads\n",
-    "# once when capture starts. Full reference: docs/configuration.md\n\n",
+    "# Edits apply live (no restart) except the hotkey, which binds at\n",
+    "# launch. Full reference: docs/configuration.md\n\n",
 );
 
 /// Every key and its current default, commented out.

crates/config/src/schema.rs

@@ -284,8 +284,7 @@ pub fn schema() -> &'static [KeySpec] {
                 doc: "Safety net: force-commit and close the microphone after \
                       capture has run this long. Push-to-talk ends on key \
                       release; tap-to-latch waits for a second tap that may \
-                      never come. Read once at launch: unlike most settings, \
-                      an edit here needs a restart to take effect.",
+                      never come.",
                 wired: true,
             },
             KeySpec {

crates/outloud/src/main.rs

@@ -915,6 +915,15 @@ fn main() -> anyhow::Result<()> {
             .as_ref()
             .map(|h| h.silence_timeout_ms())
             .unwrap_or_else(outloud::menuhost::MenuHost::silence_timeout_from_config),
+        // A live view of the same setting, for the same reason as
+        // sensitivity above and with more at stake: this is the net that
+        // force-closes a latched microphone, and until it was published
+        // here, shortening it after noticing a hot mic did nothing until
+        // restart. `--once` has no menu host and keeps the startup value.
+        live_hot_mic_timeout_ms: menu_host.as_ref().map(|_| {
+            let runtime = runtime.clone();
+            std::sync::Arc::new(move || runtime.hot_mic_timeout_ms()) as _
+        }),
         warm_hold_ms: menu_host.as_ref().map_or(0, |h| h.warm_hold_ms()),
         // Per-app profiles need a live config; `--once` has no menu host
         // and therefore no profiles, which keeps its numbers comparable

crates/outloud/src/menuhost.rs

@@ -314,6 +314,11 @@ impl MenuHost {
         // key-down. It only LOOKED restart-only because the pipeline read it
         // from a Config copied at startup, so the reload had nowhere to land.
         self.runtime.set_sensitivity(self.settings.sensitivity);
+        // The hot-mic safety net, for the same reason: the pipeline used to
+        // read it from the startup Config copy, so shortening the timeout
+        // after noticing a latched microphone did nothing until restart.
+        self.runtime
+            .set_hot_mic_timeout_ms(self.settings.silence_timeout_ms.max(1_000) as u64);
         // Force a rebuild on the next publish.
         self.model = None;
     }

crates/outloud/src/pipeline.rs

@@ -103,6 +103,17 @@ pub struct Config {
     /// `None` for hosts with no live config (the `--once` measurement path),
     /// which then use the flat `sensitivity` field unchanged.
     pub live_sensitivity: Option<std::sync::Arc<dyn Fn() -> u8 + Send + Sync>>,
+    /// Live `silence-timeout-ms`, when the host has one to offer.
+    ///
+    /// Same freeze as `live_sensitivity`, and a worse consequence:
+    /// `hot_mic_timeout_ms` below is a snapshot, so shortening the safety
+    /// net after noticing a latched microphone did nothing until restart --
+    /// verified on hardware. The setting that bounds how long we may listen
+    /// must not require restarting the listener.
+    ///
+    /// `None` for hosts with no live config (the `--once` measurement path),
+    /// which then use the flat `hot_mic_timeout_ms` field unchanged.
+    pub live_hot_mic_timeout_ms: Option<std::sync::Arc<dyn Fn() -> u64 + Send + Sync>>,
     /// The merged vocabulary for `vocabulary.sets`, when any are active.
     ///
     /// `None` skips the correction pass entirely, which is the common path:
@@ -144,6 +155,7 @@ impl Default for Config {
             // The schema default, kept in one place.
             sensitivity: 50,
             hot_mic_timeout_ms: 60_000,
+            live_hot_mic_timeout_ms: None,
             // Off unless the user asks: the default must be the honest
             // indicator, not the faster one.
             warm_hold_ms: 0,
@@ -295,12 +307,12 @@ pub async fn run(
             // here regardless of how capture was started.
             _ = tokio::time::sleep_until(tokio::time::Instant::from_std(
                 capture_opened_at
-                    .map(|t| t + std::time::Duration::from_millis(cfg.hot_mic_timeout_ms))
+                    .map(|t| t + std::time::Duration::from_millis(current_hot_mic_timeout_ms(&cfg)))
                     .unwrap_or_else(Instant::now),
             )), if capture_opened_at.is_some() => {
                 eprintln!(
                     "outloud: capture ran for {}s without ending; closing the microphone",
-                    cfg.hot_mic_timeout_ms / 1000
+                    current_hot_mic_timeout_ms(&cfg) / 1000
                 );
                 // Commit rather than discard: the user spoke, and throwing
                 // their words away to fix a stuck mic trades one silent
@@ -1209,6 +1221,15 @@ type Segmenter = audio::segment::SpeechSegmenter<audio::vad::EnergyVad>;
 /// Prefers the host's live value so a config reload takes effect at the next
 /// key-down rather than the next launch, and falls back to the startup
 /// snapshot for hosts that have no live config.
+/// The hot-mic timeout in force right now: the live view when the host has
+/// one, else the value copied at startup.
+fn current_hot_mic_timeout_ms(cfg: &Config) -> u64 {
+    cfg.live_hot_mic_timeout_ms
+        .as_ref()
+        .map(|f| f())
+        .unwrap_or(cfg.hot_mic_timeout_ms)
+}
+
 fn current_sensitivity(cfg: &Config) -> u8 {
     let v = cfg
         .live_sensitivity
@@ -1595,6 +1616,39 @@ mod tests {
         );
     }
 
+    /// The pipeline must read the hot-mic timeout through the live view.
+    ///
+    /// Same shape as the sensitivity test above, and the same bug: the
+    /// value was published to a runtime the pipeline never consulted, so
+    /// the generated config's promise that edits apply live was false for
+    /// the one setting that bounds how long the microphone may stay open.
+    /// Verified on hardware before the fix: editing silence-timeout-ms and
+    /// latching capture left the old timeout in force until restart.
+    #[test]
+    fn live_hot_mic_timeout_overrides_the_startup_snapshot() {
+        let snapshot_only = Config {
+            hot_mic_timeout_ms: 60_000,
+            live_hot_mic_timeout_ms: None,
+            ..Default::default()
+        };
+        assert_eq!(
+            current_hot_mic_timeout_ms(&snapshot_only),
+            60_000,
+            "with no live view, the startup value stands"
+        );
+
+        let live = Config {
+            hot_mic_timeout_ms: 60_000,
+            live_hot_mic_timeout_ms: Some(std::sync::Arc::new(|| 5_000)),
+            ..Default::default()
+        };
+        assert_eq!(
+            current_hot_mic_timeout_ms(&live),
+            5_000,
+            "a reload must beat the value copied at startup"
+        );
+    }
+
     /// A silent utterance must still count toward `once_after`.
     ///
     /// `once_after` was first implemented by counting REPORTS. Silence

crates/outloud/src/runtime.rs

@@ -13,7 +13,7 @@
 //! [`crate::state::StatusShared`] already works: locks held for nanoseconds,
 //! and the reader never blocks the pipeline.
 
-use std::sync::atomic::{AtomicBool, AtomicU8, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicU64, AtomicU8, Ordering};
 use std::sync::{Arc, Mutex};
 
 /// What the daemon actually bound and opened.
@@ -72,6 +72,18 @@ pub struct RuntimeShared {
     /// same "settings the process can adopt without a restart" channel the
     /// Pause switch uses.
     sensitivity: Arc<AtomicU8>,
+    /// `silence-timeout-ms`, as an atomic for exactly the same reason as
+    /// `sensitivity` above: the pipeline gets `Config` by value at startup,
+    /// so a value read from that copy is frozen for the life of the process.
+    ///
+    /// This one is worth more than convenience. It is the safety net that
+    /// force-closes the microphone when a tap-to-latch capture is never
+    /// ended, and the generated config header promises edits apply live;
+    /// verified on hardware that they did not, so shortening the timeout
+    /// after noticing a hot microphone did nothing until a restart. The
+    /// setting that limits how long we can be listening is the last one that
+    /// should require restarting the thing that is listening.
+    hot_mic_timeout_ms: Arc<AtomicU64>,
 }
 
 impl Default for RuntimeShared {
@@ -92,6 +104,9 @@ impl RuntimeShared {
             // Matches `Config::default().sensitivity`. Overridden at load,
             // and again on every reload.
             sensitivity: Arc::new(AtomicU8::new(50)),
+            // Matches the schema default for `silence-timeout-ms`.
+            // Overridden at load, and again on every reload.
+            hot_mic_timeout_ms: Arc::new(AtomicU64::new(60_000)),
         }
     }
 
@@ -140,6 +155,22 @@ impl RuntimeShared {
         self.sensitivity.load(Ordering::Relaxed)
     }
 
+    /// Publish `silence-timeout-ms` so a reload reaches the running
+    /// pipeline. Clamped to the schema's documented range: a zero would
+    /// mean "close the microphone immediately", i.e. dictation that can
+    /// never record anything, and an unbounded value would defeat the
+    /// safety net entirely.
+    pub fn set_hot_mic_timeout_ms(&self, ms: u64) {
+        self.hot_mic_timeout_ms
+            .store(ms.clamp(1_000, 600_000), Ordering::Relaxed);
+    }
+
+    /// How long capture may run before the pipeline force-commits and
+    /// closes the microphone, as of right now.
+    pub fn hot_mic_timeout_ms(&self) -> u64 {
+        self.hot_mic_timeout_ms.load(Ordering::Relaxed)
+    }
+
     /// Record a working capture device. Also clears the blocked flag: a
     /// stream that came up is the definitive answer to "can we record", and
     /// leaving a stale warning row in the menu after recovery would train