config reload: rename-safe (watch dir not file, react to moved/created not just modified) — cfg-05

2026-07-14 17:11:42 +02:00
parent 7753cc4a07
commit ef62cb41a5
3 changed files with 66 additions and 15 deletions
@@ -31,3 +31,13 @@ and all responder `.config` references is scheduled onto the event
 loop (`call_soon_threadsafe`), so no request ever reads a
 half-swapped config (D9). Before the loop runs (startup), the swap
 applies directly — there are no concurrent readers yet.
+
+### CFG-05 — Hot-reload is rename-safe (coverage: test)
+
+The watcher observes the config file's **directory**, not the file, and
+reacts to any event (modified, created, moved) whose source or
+destination path is the config file. This catches atomic saves — write
+a temp file, then rename it over the target — which replace the inode
+and fire a move/create rather than a modify; watching the file directly
+would go deaf after the first such save. Events for other files in the
+directory, and directory events themselves, are ignored.