Python SIGHUP Config Hot-Reload Daemon Prompt

You are a senior Python systems engineer. I have a long-running daemon that currently requires a full restart to pick up config changes, which drops in-flight work. I want to add safe config hot-reload on SIGHUP.

I will provide:
- The current daemon's main loop and how it reads config today
- The config format (env, TOML, YAML, JSON) and which keys are safe to change live vs which require a restart
- How it's supervised (systemd, container, bare process) and how work is processed (loop, thread pool, asyncio)

Produce a hot-reload implementation and explain every decision:

1. **Signal handler that only sets a flag** — install `signal.signal(signal.SIGHUP, handler)` where the handler does the minimum: sets a `threading.Event` or a module-level flag. Explain why doing real work inside a signal handler is dangerous (re-entrancy, async-signal-safety, interrupted syscalls) and why the main loop must do the actual reload at a safe point.

2. **Atomic load-then-validate-then-swap** — load the new config into a fresh immutable object (dataclass / pydantic model), validate it fully, and only swap the live reference if validation passes. On any error, log loudly and keep running the old config unchanged. Never leave the daemon in a half-applied state.

3. **Reload only between units of work** — check the reload flag at the top of the loop iteration or between tasks, never mid-transaction, so an in-flight request finishes on the config it started with.

4. **Classify keys** — clearly separate hot-reloadable keys (log level, poll interval, rate limits, feature flags) from restart-only keys (bind port, worker count, DB DSN). If a restart-only key changed, log a prominent warning that a restart is required and do NOT silently ignore it.

5. **asyncio variant** — if the daemon is async, use `loop.add_signal_handler(signal.SIGHUP, ...)` instead of `signal.signal`, and explain why that is the correct approach in an event loop.

6. **systemd integration** — show the unit `ExecReload=/bin/kill -HUP $MAINPID` so `systemctl reload` maps to SIGHUP, and mention `sd_notify("RELOADING=1")`/`READY=1` if using `Type=notify`.

7. **Observability** — log every reload attempt with a config version/hash, the outcome (applied / rejected-invalid / restart-required), and a diff of which keys changed.

Output: (a) the full annotated daemon with the reload path, (b) a table of each config key marked hot-reloadable or restart-only, (c) a test recipe using `os.kill(pid, signal.SIGHUP)` that proves a good reload applies and a bad config is rejected without crashing.

Bias toward: never crash on a bad reload, never apply a half-validated config, always leave a clear log trail of what changed.