Ok nice, I think that with that, atomic symlink replacement should solve the problem for updating one server. For updating many servers behind a load balancer, client session persistence should result in consistency, though I'll need to look into the aspects of that (hopefully the persistence can expire after maybe 5 minutes). That's a load balancing matter, though.