Reload versus restart, and the workers that linger

A reload starts new workers with the new configuration and lets the old ones finish their current requests, so an nginx process list after a reload legitimately contains both.

$ nginx -t && systemctl reload nginx
$ ps aux | grep 'nginx: worker'
nginx  4102  worker process
nginx  4103  worker process
nginx  3881  worker process is shutting down    ← old, draining

# they linger for as long as their longest connection.
# a websocket or a long download can hold one open for hours.

A worker shutting down for hours is normal and looks alarming the first time. worker_shutdown_timeout bounds it, which matters if the old workers are holding an upstream that is being decommissioned. Anything that changes the number of workers or the listening sockets still needs a restart rather than a reload — and a restart drops connections, so it belongs in a maintenance window rather than in a deploy script.