v0.19.0 use updated config and toml packages, dep update, minor fixes

doc/architecture.md

@@ -164,7 +164,9 @@ only for a peer that was already admitted. See the
 
 Reload (signal or file watch) rebuilds the entire service:
 
-1. Re-read the config through the config manager.
+1. Signals reread the selected file; watches consume a newly published snapshot.
+   The application owns its manager and detached snapshots; no global mutable
+   target is shared with the running service. Validate every candidate again.
 2. Build a **new** service from it. If construction fails, the old service keeps
    running untouched.
 3. Shut the old service down, start the new one, and restart the status
@@ -173,6 +175,10 @@ Reload (signal or file watch) rebuilds the entire service:
 Because this is a full rebuild, listening sockets close and reopen and all
 clients are disconnected. Application logging is configured once at startup and
 is **not** re-applied on reload.
+Watch errors do not rebuild services. Queued changes are combined, and an unchanged
+pipeline/status snapshot is skipped. Signals always rebuild for certificate rotation.
+Failed candidates release their session workers. Once the old service has stopped,
+a bind/start failure requires another corrected reload or process restart.
 
 ## Resource Management
 

doc/cli.md

@@ -26,20 +26,15 @@ Any scalar configuration key is settable as a flag using its TOML path:
 | Flag | Description | Default |
 |------|-------------|---------|
 | `-c <path>` | Configuration file | `./logwisp.toml` |
-| `--config=<path>` | Configuration file (equals form only) | `./logwisp.toml` |
+| `--config <path>` / `--config=<path>` | Configuration file | `./logwisp.toml` |
 | `--quiet` | Suppress all application output | `false` |
 | `--status_reporter=<bool>` | Periodic status logging | `true` |
 | `--auto_reload=<bool>` | Reload config when the file changes | `false` |
 | `--version` | Print version and exit | — |
 | `-h`, `--help`, `help` | Print usage and exit | — |
 
-> `--config <path>` with a space is not recognized. The path resolver
-> understands `-c <path>` and `--config=<path>` only; the space form is treated
-> as an unknown flag, warned about, and ignored, after which LogWisp silently
-> falls back to `./logwisp.toml`.
->
-> `-c` as the final argument, with no path after it, crashes with an index
-> panic rather than reporting a usage error.
+The last file-selection flag wins. `-c=<path>` also works. A missing or empty
+path returns an error, and `--` ends option parsing.
 
 ### Logging
 
@@ -74,22 +69,19 @@ that the current loader does not implement.
 
 ## Environment Variables
 
-Configuration paths map to environment variables by replacing `.` with `_` and
-uppercasing:
+Configuration paths map to environment variables by replacing `.` with `_`,
+uppercasing and adding `LOGWISP_`:
 
 ```bash
-export QUIET=true
-export LOGGING_LEVEL=debug
-export LOGGING_FILE_DIRECTORY=/var/log/logwisp
+export LOGWISP_QUIET=true
+export LOGWISP_LOGGING_LEVEL=debug
+export LOGWISP_LOGGING_FILE_DIRECTORY=/var/log/logwisp
 ```
 
-> The `LOGWISP_` prefix is **not** currently applied to these — see
-> [Configuration](configuration.md#environment-variables). Bare names like
-> `QUIET` are what LogWisp actually reads, which is worth knowing both to make
-> overrides work and to avoid accidental collisions.
+Bare names used by older versions are now ignored. Rename them to the prefixed
+forms when upgrading; see [Configuration](configuration.md#environment-variables).
 
-The two variables that do carry the prefix are read directly by the path
-resolver:
+The path resolver reads these variables directly:
 
 | Variable | Effect |
 |----------|--------|

doc/configuration.md

@@ -20,20 +20,19 @@ limit and formatter) disappears entirely.
 
 The path is resolved before any other configuration is read:
 
-1. `-c <path>` on the command line
-2. `--config=<path>` on the command line
-3. `$LOGWISP_CONFIG_FILE`, joined onto `$LOGWISP_CONFIG_DIR` when both are set
-4. `$LOGWISP_CONFIG_DIR/logwisp.toml`
-5. `~/.config/logwisp/logwisp.toml`, if it exists
-6. `./logwisp.toml`
+1. `-c <path>`, `--config <path>`, or their `=<path>` forms (last one wins)
+2. `$LOGWISP_CONFIG_FILE`, joined onto `$LOGWISP_CONFIG_DIR` when both are set
+3. `$LOGWISP_CONFIG_DIR/logwisp.toml`
+4. `~/.config/logwisp/logwisp.toml`, if it exists
+5. `./logwisp.toml`
 
 Missing file behaviour differs by how it was chosen. An explicitly requested
 file that does not exist is a fatal error (exit code 2); a missing discovered
 default is not an error, and LogWisp starts on built-in defaults.
 
-> `--config <path>` with a space is **not** recognized as a config path. It is
-> parsed as an unknown flag, warned about, and ignored — LogWisp then silently
-> falls back to `./logwisp.toml`. Use `-c <path>` or `--config=<path>`.
+File-selection flags are consumed before schema overrides are parsed. A missing
+or empty path is a usage error; `--` stops option parsing. The selected path is
+runtime metadata and cannot be redirected by a `config_file` key inside the file.
 
 ## Global Settings
 
@@ -186,28 +185,23 @@ suppress them, and they reach every sink in the pipeline.
 
 ## Environment Variables
 
-Environment overrides are derived from the TOML path: `.` becomes `_` and the
-result is uppercased.
+Environment overrides are derived from the TOML path: `.` becomes `_`, the
+result is uppercased, and `LOGWISP_` is prepended.
 
 | TOML path | Environment variable |
 |-----------|---------------------|
-| `quiet` | `QUIET` |
-| `status_reporter` | `STATUS_REPORTER` |
-| `logging.level` | `LOGGING_LEVEL` |
-| `logging.file.directory` | `LOGGING_FILE_DIRECTORY` |
+| `quiet` | `LOGWISP_QUIET` |
+| `status_reporter` | `LOGWISP_STATUS_REPORTER` |
+| `logging.level` | `LOGWISP_LOGGING_LEVEL` |
+| `logging.file.directory` | `LOGWISP_LOGGING_FILE_DIRECTORY` |
 
-> **The `LOGWISP_` prefix is not currently applied.** The configuration loader
-> requests it, but supplying a custom path-to-variable transform replaces the
-> prefixing step rather than composing with it, so LogWisp reads bare
-> `QUIET`, `LOGGING_LEVEL`, and so on from the environment. Treat this as
-> current behaviour to be aware of — bare names like `QUIET` can collide with
-> unrelated variables — rather than as intended design.
->
-> The two exceptions are `LOGWISP_CONFIG_FILE` and `LOGWISP_CONFIG_DIR`, which
-> are read directly by the path resolver and **do** carry the prefix.
+Migration: the old custom transform accidentally read bare names such as `QUIET`
+and `LOGGING_LEVEL`. Rename those variables to their prefixed forms; bare names
+are now ignored. `LOGWISP_CONFIG_FILE` and `LOGWISP_CONFIG_DIR` still select the
+file directly.
 
 Only scalar paths that exist in the configuration schema can be set this way.
-Array elements cannot: `PIPELINES_0_NAME` has no effect.
+Array elements cannot: `LOGWISP_PIPELINES_0_NAME` has no effect.
 
 ## Command-Line Overrides
 
@@ -258,11 +252,21 @@ same port fail at listener bind time, when the pipeline starts.
 auto_reload = true
 ```
 
-or send `SIGHUP` / `SIGUSR1`.
+or send `SIGHUP` / `SIGUSR1`. Signals reread the selected file even when watching
+is disabled and always rebuild, allowing certificate rotation without TOML edits.
+CLI and environment overrides are captured at startup and keep their precedence.
 
 Reload rebuilds the whole service: a new service is constructed from the new
-configuration first, and only if that succeeds is the old one shut down. A
-configuration error therefore leaves the running service untouched.
+configuration first, and only if that succeeds is the old one shut down. Each
+candidate is a detached snapshot and runs top-level validation again. Parse,
+conversion, validation and construction errors leave the running service intact.
+Listener bind/start failures occur after shutdown of the old service and can leave
+the application without working pipelines; correct the file and signal again.
+
+Watch errors (including deletion, permission changes and timeout) are logged
+without rebuilding. Queued path changes are combined, and unchanged pipelines
+and status settings do not trigger another rebuild. Removed file keys fall back
+to the remaining sources on the next successful load.
 
 | Reloaded | Not reloaded |
 |----------|--------------|
@@ -283,3 +287,8 @@ client is disconnected. Chain sinks reconnect on their own backoff schedule.
 | Boolean | `bool` | `true` / `false`, or a bare flag for `true` |
 | Array | `[]T` | Not settable outside the file |
 | Table | struct | Nested path with `.` (flags) or `_` (environment) |
+
+Integer fields reject fractions, overflow and negative unsigned values. Non-finite
+floats and integer-to-float precision loss are rejected too. This applies to plugin
+maps when their constructors decode them. Only TOML configuration files are accepted;
+JSON log formatting and network payloads are unaffected.

doc/installation.md

@@ -64,7 +64,7 @@ sudo mkdir -p /etc/logwisp
 sudo cp config/logwisp.toml /etc/logwisp/logwisp.toml
 ```
 
-LogWisp searches, in order: `-c <path>`, `--config=<path>`,
+LogWisp searches, in order: `-c <path>` / `--config <path>` (also `=<path>`),
 `$LOGWISP_CONFIG_DIR`/`$LOGWISP_CONFIG_FILE`, `~/.config/logwisp/logwisp.toml`,
 `./logwisp.toml`. See [Configuration](configuration.md).
 

doc/operations.md

@@ -45,9 +45,10 @@ or send a signal:
 kill -HUP $(pidof logwisp)
 ```
 
-Reload constructs a new service from the new configuration **before** tearing
-the old one down, so a broken configuration leaves the running service intact
-and logs the failure:
+Signals reread the selected TOML file even when `auto_reload` is disabled.
+Reload validates a detached snapshot and constructs a new service **before**
+tearing the old one down, so invalid configuration leaves the running service
+intact and logs the failure:
 
 ```
 ERROR msg="Failed to bootstrap new service, keeping old service running" error=...
@@ -63,6 +64,9 @@ What reload does *not* do:
   construction, so rotation requires `SIGHUP`.
 
 Plan reloads on a busy relay the way you would plan a restart.
+Listener bind/start failures happen after the old service stops; these can leave
+the application without working pipelines until a corrected configuration reloads.
+File-watch errors do not restart services, and queued changes are combined.
 
 ### Checking a configuration
 
@@ -264,8 +268,8 @@ and remember `http_chain` waits up to `flush_interval_ms`. For TLS problems see
 
 **Environment variable override has no effect**
 
-LogWisp currently reads these **without** the `LOGWISP_` prefix — `QUIET`,
-`LOGGING_LEVEL`, and so on. Array-indexed paths cannot be set from the
+LogWisp reads `LOGWISP_QUIET`, `LOGWISP_LOGGING_LEVEL`, and other prefixed
+names. Bare names used by older versions must be renamed. Array-indexed paths cannot be set from the
 environment or the command line at all.
 
 ## Security Operations