**Goal (Matt, 2026-07-07):** make GUI **Save just apply** instead of prompting a container restart. The restart-required system is high-friction and Matt loathes it. This doc captures the why + the fix so it can be picked up later. Surfaced while building [[meshai-region-routing-plan]] (coverage/region edits require a restart to take effect).
## Why saves don't apply today
Split by **who reads the config, and when:**
- **Live sections (already hot):** notifications, rules, toggles, timezone, etc. Their consumer reads `config.<section>`**fresh on every use** (e.g. the dispatcher reads `config.notifications` per event), so the save endpoint's `setattr(app.state.config, section, new_value)` (`dashboard/api/config_routes.py:176`) is enough — instant.
- **Restart-required sections snapshot config at BOOT and never re-read it.** `RESTART_REQUIRED_SECTIONS` (`config_routes.py:29-40`) = `connection, llm, mesh_sources, meshmonitor, dashboard, environmental, coverage, generic_sources`. Examples:
-`CoverageFilter` is built ONCE at pipeline start from `areas_from_config(config.coverage)` (`notifications/pipeline/__init__.py:120-126`) — frozen copy of the areas.
- Adapters get their fetch bbox computed ONCE at boot via `enclosing_bbox(coverage.areas)` (`main.py:413`).
- The radio connector opens the link ONCE with `connection` settings.
A naive live mutate would leave these running objects on the OLD config while new data flows under new assumptions → a half-applied, inconsistent "transient AND-mode" (the exact thing the guard prevents). So the flag saves-to-disk-but-diverges-in-memory until restart. Crude but not arbitrary.
## The fix: per-section reload hooks + a hot-apply framework
"Save just works" = on save, **rebuild the component that snapshotted the config, atomically.** Proposed framework: each section registers an optional `apply_live(new_config)` handler; the save endpoint calls it and only falls back to "restart required" when a section has no safe handler.
Tiers:
| Tier | Sections | Effort |
|---|---|---|
| **Easy wins** | `coverage`, `llm`, `environmental` thresholds | Low — rebuild the filter / swap the LLM client / re-read next tick |
| **Moderate** | `generic_sources`, `mesh_sources`, `environmental` adapters | Medium — re-instantiate the adapter with new config |
| **Genuinely disruptive** | `connection`, `meshmonitor`, `dashboard` (port) | Replace full restart with an explicit **"Reconnect" / "Rebind" action** — a live half-swap of an open radio link is unsafe |
**Coverage is Tier-1:** on save, rebuild `CoverageFilter`'s area list + refresh the adapters' bbox → region edits apply fully live (both routing columns AND engine re-scoping). NOTE: the routing-column half is already solved in [[meshai-region-routing-plan]] (regions endpoint reads on-disk coverage, so columns are dynamic without restart); the remaining half is the engine re-scoping, which this work covers.
## Two ways to scope
1.**Narrow:** just make `coverage` hot-apply (rebuild filter + adapter bbox on save) — bounded, testable, closes the region-routing loop end-to-end.
2.**Broad:** design the hot-apply framework and convert the whole GUI so Save just saves everywhere; restart becomes a last-resort scoped reconnect only. (Candidate for a local ultraplan.)
**Payoff:** kills ~90% of restart prompts (everything edited day-to-day) while keeping a safe, scoped reconnect for the handful of things that genuinely disrupt a live connection.
