diff --git a/certs/static-route/meta.json b/certs/static-route/meta.json
index 602a705..969e566 100644
--- a/certs/static-route/meta.json
+++ b/certs/static-route/meta.json
@@ -1,5 +1,5 @@
 {
-  "expiryDate": "2025-08-30T08:04:36.897Z",
-  "issueDate": "2025-06-01T08:04:36.897Z",
-  "savedAt": "2025-06-01T08:04:36.897Z"
+  "expiryDate": "2025-08-30T08:11:10.101Z",
+  "issueDate": "2025-06-01T08:11:10.101Z",
+  "savedAt": "2025-06-01T08:11:10.102Z"
 }
\ No newline at end of file
diff --git a/readme.plan.md b/readme.plan.md
index d79799f..7dc1d9f 100644
--- a/readme.plan.md
+++ b/readme.plan.md
@@ -1,1230 +1,337 @@
-# SmartProxy Performance Optimization Plan
+# SmartProxy Socket Cleanup Fix Plan
 
-## Executive Summary
+## Problem Summary
 
-This plan addresses critical performance issues in SmartProxy that impact scalability, responsiveness, and stability. The approach is phased, starting with critical event loop blockers and progressing to long-term architectural improvements.
+The current socket cleanup implementation is too aggressive and closes long-lived connections prematurely. This affects:
+- WebSocket connections in HTTPS passthrough
+- Long-lived HTTP connections (SSE, streaming)
+- Database connections
+- Any connection that should remain open for hours
 
-## Phase 1: Critical Issues (Week 1) ✅ COMPLETE
+## Root Causes
 
-### 1.1 Eliminate Busy Wait Loop ✅
-
-**Issue**: `ts/proxies/nftables-proxy/nftables-proxy.ts:235-238` blocks the entire event loop
-
-**Solution**:
+### 1. **Bilateral Socket Cleanup**
+When one socket closes, both sockets are immediately destroyed:
 ```typescript
-// Create utility function in ts/core/utils/async-utils.ts
-export async function delay(ms: number): Promise<void> {
-  return new Promise(resolve => setTimeout(resolve, ms));
-}
-
-// Replace busy wait in nftables-proxy.ts
-// OLD:
-const waitUntil = Date.now() + retryDelayMs;
-while (Date.now() < waitUntil) { }
-
-// NEW:
-await delay(retryDelayMs);
+// In createSocketCleanupHandler
+cleanupSocket(clientSocket, 'client');
+cleanupSocket(serverSocket, 'server');  // Both destroyed together!
 ```
 
-**Implementation**:
-1. Create `async-utils.ts` with common async utilities
-2. Replace all synchronous sleeps with async delay
-3. Ensure all calling functions are async
-
-### 1.2 Async Filesystem Operations ✅
-
-**Issue**: Multiple synchronous filesystem operations blocking the event loop
-
-**Solution Architecture**:
+### 2. **Aggressive Timeout Handling**
+Timeout events immediately trigger connection cleanup:
 ```typescript
-// Create ts/core/utils/fs-utils.ts
-import * as plugins from '../../plugins.js';
+socket.on('timeout', () => {
+  handleClose(`${prefix}_timeout`);  // Destroys both sockets!
+});
+```
 
-export class AsyncFileSystem {
-  static async exists(path: string): Promise<boolean> {
-    try {
-      await plugins.fs.promises.access(path);
-      return true;
-    } catch {
-      return false;
-    }
-  }
-
-  static async ensureDir(path: string): Promise<void> {
-    await plugins.fs.promises.mkdir(path, { recursive: true });
-  }
-
-  static async readFile(path: string): Promise<string> {
-    return plugins.fs.promises.readFile(path, 'utf8');
-  }
-
-  static async writeFile(path: string, data: string): Promise<void> {
-    // Ensure directory exists
-    const dir = plugins.path.dirname(path);
-    await this.ensureDir(dir);
-    await plugins.fs.promises.writeFile(path, data);
-  }
-
-  static async remove(path: string): Promise<void> {
-    try {
-      await plugins.fs.promises.unlink(path);
-    } catch (error: any) {
-      if (error.code !== 'ENOENT') throw error;
-    }
-  }
-
-  static async readJSON<T>(path: string): Promise<T> {
-    const content = await this.readFile(path);
-    return JSON.parse(content);
-  }
-
-  static async writeJSON(path: string, data: any): Promise<void> {
-    await this.writeFile(path, JSON.stringify(data, null, 2));
-  }
+### 3. **Parity Check Forces Closure**
+If one socket closes but the other remains open for >2 minutes, connection is forcefully terminated:
+```typescript
+if (record.outgoingClosedTime && 
+    !record.incoming.destroyed && 
+    now - record.outgoingClosedTime > 120000) {
+  this.cleanupConnection(record, 'parity_check');
 }
 ```
 
-**Migration Strategy**:
+### 4. **No Half-Open Connection Support**
+The proxy doesn't support TCP half-open connections where one side closes while the other continues sending.
 
-1. **Certificate Manager** (`ts/proxies/http-proxy/certificate-manager.ts`)
-   ```typescript
-   // OLD:
-   constructor(private options: IHttpProxyOptions) {
-     if (!fs.existsSync(this.certDir)) {
-       fs.mkdirSync(this.certDir, { recursive: true });
-     }
-   }
+## Fix Implementation Plan
 
-   // NEW:
-   private initialized = false;
-   
-   constructor(private options: IHttpProxyOptions) {}
-   
-   async initialize(): Promise<void> {
-     if (this.initialized) return;
-     await AsyncFileSystem.ensureDir(this.certDir);
-     this.initialized = true;
-   }
-   
-   async getCertificate(domain: string): Promise<{ cert: string; key: string } | null> {
-     await this.initialize();
-     const certPath = path.join(this.certDir, `${domain}.crt`);
-     const keyPath = path.join(this.certDir, `${domain}.key`);
-     
-     if (await AsyncFileSystem.exists(certPath) && await AsyncFileSystem.exists(keyPath)) {
-       const [cert, key] = await Promise.all([
-         AsyncFileSystem.readFile(certPath),
-         AsyncFileSystem.readFile(keyPath)
-       ]);
-       return { cert, key };
-     }
-     return null;
-   }
-   ```
+### Phase 1: Fix Socket Cleanup (Prevent Premature Closure)
 
-2. **Certificate Store** (`ts/proxies/smart-proxy/cert-store.ts`)
-   ```typescript
-   // Convert all methods to async
-   export class CertStore {
-     constructor(private storePath: string) {}
-     
-     async init(): Promise<void> {
-       await AsyncFileSystem.ensureDir(this.storePath);
-     }
-     
-     async hasCertificate(domain: string): Promise<boolean> {
-       const certPath = this.getCertificatePath(domain);
-       return AsyncFileSystem.exists(certPath);
-     }
-     
-     async getCertificate(domain: string): Promise<ICertificateInfo | null> {
-       if (!await this.hasCertificate(domain)) return null;
-       
-       const metaPath = path.join(this.getCertificatePath(domain), 'meta.json');
-       return AsyncFileSystem.readJSON<ICertificateInfo>(metaPath);
-     }
-   }
-   ```
-
-3. **NFTables Proxy** (`ts/proxies/nftables-proxy/nftables-proxy.ts`)
-   ```typescript
-   // Replace execSync with execAsync
-   private async execNftCommand(command: string): Promise<string> {
-     const maxRetries = 3;
-     let lastError: Error | null = null;
-     
-     for (let i = 0; i < maxRetries; i++) {
-       try {
-         const { stdout } = await this.execAsync(command);
-         return stdout;
-       } catch (err: any) {
-         lastError = err;
-         if (i < maxRetries - 1) {
-           await delay(this.retryDelayMs);
-         }
-       }
-     }
-     
-     throw new NftExecutionError(`Failed after ${maxRetries} attempts: ${lastError?.message}`);
-   }
-   ```
-
-## Dependencies Between Phases
-
-### Critical Path
-```
-Phase 1.1 (Busy Wait) ─┐
-                       ├─> Phase 2.1 (Timer Management) ─> Phase 3.2 (Worker Threads)
-Phase 1.2 (Async FS) ──┘                                │
-                                                       ├─> Phase 4.1 (Monitoring)
-Phase 2.2 (Connection Pool) ────────────────────────────┘
-```
-
-### Phase Dependencies
-- **Phase 1** must complete before Phase 2 (foundation for async operations)
-- **Phase 2.1** enables proper cleanup for Phase 3.2 worker threads
-- **Phase 3** optimizations depend on stable async foundation
-- **Phase 4** monitoring requires all components to be instrumented
-
-## Phase 2: Resource Management (Week 2) 🔨 IN PROGRESS
-
-### 2.1 Timer Lifecycle Management
-
-**Issue**: Timers created without cleanup references causing memory leaks
-
-**Solution Pattern**:
+#### 1.1 Modify `cleanupSocket()` to support graceful shutdown
 ```typescript
-// Create base class in ts/core/utils/lifecycle-component.ts
-export abstract class LifecycleComponent {
-  private timers: Set<NodeJS.Timeout> = new Set();
-  private listeners: Array<{ target: any, event: string, handler: Function }> = [];
-  protected isShuttingDown = false;
-
-  protected setInterval(handler: Function, timeout: number): NodeJS.Timeout {
-    const timer = setInterval(() => {
-      if (!this.isShuttingDown) {
-        handler();
-      }
-    }, timeout);
-    this.timers.add(timer);
-    return timer;
-  }
-
-  protected setTimeout(handler: Function, timeout: number): NodeJS.Timeout {
-    const timer = setTimeout(() => {
-      this.timers.delete(timer);
-      if (!this.isShuttingDown) {
-        handler();
-      }
-    }, timeout);
-    this.timers.add(timer);
-    return timer;
-  }
-
-  protected addEventListener(target: any, event: string, handler: Function): void {
-    target.on(event, handler);
-    this.listeners.push({ target, event, handler });
-  }
-
-  protected async cleanup(): Promise<void> {
-    this.isShuttingDown = true;
-    
-    // Clear all timers
-    for (const timer of this.timers) {
-      clearInterval(timer);
-      clearTimeout(timer);
-    }
-    this.timers.clear();
-
-    // Remove all listeners
-    for (const { target, event, handler } of this.listeners) {
-      target.removeListener(event, handler);
-    }
-    this.listeners = [];
-  }
+export interface CleanupOptions {
+  immediate?: boolean;      // Force immediate destruction
+  allowDrain?: boolean;     // Allow write buffer to drain
+  gracePeriod?: number;     // Ms to wait before force close
 }
-```
 
-**Implementation**:
-1. Extend LifecycleComponent in:
-   - `HttpProxy`
-   - `SmartProxy`
-   - `ConnectionManager`
-   - `RequestHandler`
-   - `SharedSecurityManager`
-   
-2. Replace direct timer/listener usage with lifecycle methods
-
-### 2.2 Connection Pool Enhancement
-
-**Issue**: No backpressure mechanism and synchronous operations
-
-**Solution**:
-```typescript
-// First, implement efficient BinaryHeap for O(log n) operations
-// Create ts/core/utils/binary-heap.ts
-export class BinaryHeap<T> {
-  private heap: T[] = [];
+export function cleanupSocket(
+  socket: Socket | TLSSocket | null, 
+  socketName?: string,
+  options: CleanupOptions = {}
+): Promise<void> {
+  if (!socket || socket.destroyed) return Promise.resolve();
   
-  constructor(
-    private compareFn: (a: T, b: T) => number,
-    private extractKey?: (item: T) => string
-  ) {}
-
-  insert(item: T): void {
-    this.heap.push(item);
-    this.bubbleUp(this.heap.length - 1);
-  }
-
-  extract(): T | undefined {
-    if (this.heap.length === 0) return undefined;
-    if (this.heap.length === 1) return this.heap.pop();
-    
-    const result = this.heap[0];
-    this.heap[0] = this.heap.pop()!;
-    this.bubbleDown(0);
-    return result;
-  }
-
-  extractIf(predicate: (item: T) => boolean): T | undefined {
-    const index = this.heap.findIndex(predicate);
-    if (index === -1) return undefined;
-    
-    if (index === this.heap.length - 1) return this.heap.pop();
-    
-    const result = this.heap[index];
-    this.heap[index] = this.heap.pop()!;
-    
-    // Restore heap property
-    this.bubbleUp(index);
-    this.bubbleDown(index);
-    return result;
-  }
-
-  sizeFor(key: string): number {
-    if (!this.extractKey) return this.heap.length;
-    return this.heap.filter(item => this.extractKey!(item) === key).length;
-  }
-
-  private bubbleUp(index: number): void {
-    while (index > 0) {
-      const parentIndex = Math.floor((index - 1) / 2);
-      if (this.compareFn(this.heap[index], this.heap[parentIndex]) >= 0) break;
-      
-      [this.heap[index], this.heap[parentIndex]] = 
-        [this.heap[parentIndex], this.heap[index]];
-      index = parentIndex;
-    }
-  }
-
-  private bubbleDown(index: number): void {
-    while (true) {
-      let minIndex = index;
-      const leftChild = 2 * index + 1;
-      const rightChild = 2 * index + 2;
-      
-      if (leftChild < this.heap.length && 
-          this.compareFn(this.heap[leftChild], this.heap[minIndex]) < 0) {
-        minIndex = leftChild;
+  return new Promise<void>((resolve) => {
+    const cleanup = () => {
+      socket.removeAllListeners();
+      if (!socket.destroyed) {
+        socket.destroy();
       }
-      
-      if (rightChild < this.heap.length && 
-          this.compareFn(this.heap[rightChild], this.heap[minIndex]) < 0) {
-        minIndex = rightChild;
-      }
-      
-      if (minIndex === index) break;
-      
-      [this.heap[index], this.heap[minIndex]] = 
-        [this.heap[minIndex], this.heap[index]];
-      index = minIndex;
-    }
-  }
-}
-
-// Enhanced connection pool with queue and heap
-export class EnhancedConnectionPool extends LifecycleComponent {
-  private connectionQueue: Array<{
-    resolve: (socket: net.Socket) => void;
-    reject: (error: Error) => void;
-    host: string;
-    port: number;
-    timestamp: number;
-  }> = [];
-  
-  private connectionHeap: BinaryHeap<IConnectionEntry>;
-  private metricsCollector: ConnectionMetrics;
-
-  constructor(options: IConnectionPoolOptions) {
-    super();
-    
-    // Priority: least recently used connections first
-    this.connectionHeap = new BinaryHeap(
-      (a, b) => a.lastUsed - b.lastUsed,
-      (item) => item.poolKey
-    );
-    
-    this.metricsCollector = new ConnectionMetrics();
-    this.startQueueProcessor();
-  }
-
-  private startQueueProcessor(): void {
-    // Process queue periodically to handle timeouts and retries
-    this.setInterval(() => {
-      const now = Date.now();
-      const timeout = this.options.connectionQueueTimeout || 30000;
-      
-      // Remove timed out requests
-      this.connectionQueue = this.connectionQueue.filter(item => {
-        if (now - item.timestamp > timeout) {
-          item.reject(new Error(`Connection pool timeout for ${item.host}:${item.port}`));
-          this.metricsCollector.recordTimeout();
-          return false;
-        }
-        return true;
-      });
-      
-      // Try to fulfill queued requests
-      this.processQueue();
-    }, 1000);
-  }
-
-  private processQueue(): void {
-    if (this.connectionQueue.length === 0) return;
-    
-    // Group by destination
-    const grouped = new Map<string, typeof this.connectionQueue>();
-    
-    for (const item of this.connectionQueue) {
-      const key = `${item.host}:${item.port}`;
-      if (!grouped.has(key)) grouped.set(key, []);
-      grouped.get(key)!.push(item);
-    }
-    
-    // Try to fulfill requests for each destination
-    for (const [poolKey, requests] of grouped) {
-      const available = this.connectionHeap.extractIf(
-        conn => conn.poolKey === poolKey && conn.isIdle && !conn.socket.destroyed
-      );
-      
-      if (available) {
-        const request = requests.shift()!;
-        this.connectionQueue = this.connectionQueue.filter(item => item !== request);
-        
-        available.isIdle = false;
-        available.lastUsed = Date.now();
-        request.resolve(available.socket);
-        
-        this.metricsCollector.recordReuse();
-      }
-    }
-  }
-
-  async getConnection(host: string, port: number): Promise<net.Socket> {
-    const poolKey = `${host}:${port}`;
-    
-    // Try to get existing connection
-    let connection = this.connectionHeap.extractIf(
-      conn => conn.poolKey === poolKey && conn.isIdle && !conn.socket.destroyed
-    );
-    
-    if (connection) {
-      connection.isIdle = false;
-      connection.lastUsed = Date.now();
-      this.metricsCollector.recordReuse();
-      
-      // Validate connection is still alive
-      if (await this.validateConnection(connection.socket)) {
-        return connection.socket;
-      }
-      
-      // Connection is dead, try another
-      connection.socket.destroy();
-      return this.getConnection(host, port);
-    }
-
-    // Check pool size
-    const poolSize = this.connectionHeap.sizeFor(poolKey);
-    if (poolSize < this.options.connectionPoolSize) {
-      return this.createConnection(host, port);
-    }
-
-    // Queue the request
-    return this.queueConnectionRequest(host, port);
-  }
-
-  private async validateConnection(socket: net.Socket): Promise<boolean> {
-    return new Promise((resolve) => {
-      if (socket.destroyed || !socket.readable || !socket.writable) {
-        resolve(false);
-        return;
-      }
-      
-      // Try to write a TCP keepalive probe
-      const originalWrite = socket.write;
-      let writeError = false;
-      
-      socket.write = function(data: any, encoding?: any, cb?: any) {
-        writeError = true;
-        return false;
-      };
-      
-      socket.setNoDelay(true);
-      socket.setNoDelay(false);
-      
-      socket.write = originalWrite;
-      
-      resolve(!writeError);
-    });
-  }
-
-  returnConnection(socket: net.Socket, host: string, port: number): void {
-    const poolKey = `${host}:${port}`;
-    
-    // Check for queued requests first
-    const queuedIndex = this.connectionQueue.findIndex(
-      item => item.host === host && item.port === port
-    );
-    
-    if (queuedIndex >= 0) {
-      const queued = this.connectionQueue.splice(queuedIndex, 1)[0];
-      queued.resolve(socket);
-      this.metricsCollector.recordDirectHandoff();
-      return;
-    }
-
-    // Return to pool
-    this.connectionHeap.insert({
-      socket,
-      poolKey,
-      lastUsed: Date.now(),
-      isIdle: true,
-      created: Date.now()
-    });
-  }
-
-  getMetrics(): IConnectionPoolMetrics {
-    return {
-      ...this.metricsCollector.getMetrics(),
-      poolSize: this.connectionHeap.size(),
-      queueLength: this.connectionQueue.length
+      resolve();
     };
-  }
-}
-```
-
-## Phase 3: Performance Optimizations (Week 3)
-
-### 3.1 JSON Operations Optimization
-
-**Issue**: Frequent JSON.stringify for cache keys
-
-**Solution**:
-```typescript
-// Create ts/core/utils/hash-utils.ts
-import * as crypto from 'crypto';
-
-export class HashUtils {
-  private static readonly objectCache = new WeakMap<object, string>();
-
-  static hashObject(obj: any): string {
-    // Check cache first
-    if (typeof obj === 'object' && obj !== null) {
-      const cached = this.objectCache.get(obj);
-      if (cached) return cached;
-    }
-
-    // Create stable string representation
-    const str = this.stableStringify(obj);
-    const hash = crypto.createHash('sha256').update(str).digest('hex').slice(0, 16);
     
-    // Cache if object
-    if (typeof obj === 'object' && obj !== null) {
-      this.objectCache.set(obj, hash);
+    if (options.immediate) {
+      cleanup();
+    } else if (options.allowDrain && socket.writable) {
+      // Allow pending writes to complete
+      socket.end(() => cleanup());
+      
+      // Force cleanup after grace period
+      if (options.gracePeriod) {
+        setTimeout(cleanup, options.gracePeriod);
+      }
+    } else {
+      cleanup();
     }
-    
-    return hash;
-  }
-
-  private static stableStringify(obj: any): string {
-    if (obj === null || typeof obj !== 'object') {
-      return JSON.stringify(obj);
-    }
-    
-    if (Array.isArray(obj)) {
-      return '[' + obj.map(item => this.stableStringify(item)).join(',') + ']';
-    }
-    
-    const keys = Object.keys(obj).sort();
-    const pairs = keys.map(key => `"${key}":${this.stableStringify(obj[key])}`);
-    return '{' + pairs.join(',') + '}';
-  }
-}
-
-// Update function-cache.ts
-private computeContextHash(context: IRouteContext): string {
-  return HashUtils.hashObject({
-    domain: context.domain,
-    path: context.path,
-    clientIp: context.clientIp
   });
 }
 ```
 
-### 3.2 Worker Thread Integration
-
-**Issue**: CPU-intensive operations blocking event loop
-
-**Solution Architecture**:
+#### 1.2 Implement Independent Socket Tracking
 ```typescript
-// Create ts/core/workers/worker-pool.ts
-import { Worker } from 'worker_threads';
-
-export class WorkerPool {
-  private workers: Worker[] = [];
-  private queue: Array<{
-    task: any;
-    resolve: Function;
-    reject: Function;
-  }> = [];
-  private busyWorkers = new Set<Worker>();
-
-  constructor(
-    private workerScript: string,
-    private poolSize: number = 4
-  ) {
-    this.initializeWorkers();
-  }
-
-  async execute<T>(task: any): Promise<T> {
-    const worker = await this.getAvailableWorker();
-    
-    return new Promise((resolve, reject) => {
-      const messageHandler = (result: any) => {
-        worker.off('message', messageHandler);
-        worker.off('error', errorHandler);
-        this.releaseWorker(worker);
-        resolve(result);
-      };
-      
-      const errorHandler = (error: Error) => {
-        worker.off('message', messageHandler);
-        worker.off('error', errorHandler);
-        this.releaseWorker(worker);
-        reject(error);
-      };
-      
-      worker.on('message', messageHandler);
-      worker.on('error', errorHandler);
-      worker.postMessage(task);
-    });
-  }
-}
-
-// Create ts/core/workers/nftables-worker.ts
-import { parentPort } from 'worker_threads';
-import { exec } from 'child_process';
-import { promisify } from 'util';
-
-const execAsync = promisify(exec);
-
-parentPort?.on('message', async (task) => {
-  try {
-    const result = await execAsync(task.command);
-    parentPort?.postMessage({ success: true, result });
-  } catch (error) {
-    parentPort?.postMessage({ success: false, error: error.message });
-  }
-});
-```
-
-## Phase 4: Monitoring & Metrics (Week 4)
-
-### 4.1 Event Loop Monitoring
-
-```typescript
-// Create ts/core/monitoring/performance-monitor.ts
-export class PerformanceMonitor extends LifecycleComponent {
-  private metrics = {
-    eventLoopLag: [] as number[],
-    activeConnections: 0,
-    memoryUsage: {} as NodeJS.MemoryUsage,
-    cpuUsage: {} as NodeJS.CpuUsage
+export function createIndependentSocketHandlers(
+  clientSocket: Socket,
+  serverSocket: Socket,
+  onBothClosed: (reason: string) => void
+): { cleanupClient: () => void, cleanupServer: () => void } {
+  let clientClosed = false;
+  let serverClosed = false;
+  let clientReason = '';
+  let serverReason = '';
+  
+  const checkBothClosed = () => {
+    if (clientClosed && serverClosed) {
+      onBothClosed(`client: ${clientReason}, server: ${serverReason}`);
+    }
   };
-
-  start() {
-    // Monitor event loop lag
-    let lastCheck = process.hrtime.bigint();
-    
-    this.setInterval(() => {
-      const now = process.hrtime.bigint();
-      const expectedInterval = 100n * 1000000n; // 100ms in nanoseconds
-      const actualInterval = now - lastCheck;
-      const lag = Number(actualInterval - expectedInterval) / 1000000; // Convert to ms
-      
-      this.metrics.eventLoopLag.push(lag);
-      if (this.metrics.eventLoopLag.length > 100) {
-        this.metrics.eventLoopLag.shift();
-      }
-      
-      lastCheck = now;
-    }, 100);
-
-    // Monitor system resources
-    this.setInterval(() => {
-      this.metrics.memoryUsage = process.memoryUsage();
-      this.metrics.cpuUsage = process.cpuUsage();
-    }, 5000);
-  }
-
-  getMetrics() {
-    const avgLag = this.metrics.eventLoopLag.reduce((a, b) => a + b, 0) 
-                   / this.metrics.eventLoopLag.length;
-    
-    return {
-      eventLoopLag: {
-        current: this.metrics.eventLoopLag[this.metrics.eventLoopLag.length - 1],
-        average: avgLag,
-        max: Math.max(...this.metrics.eventLoopLag)
-      },
-      memory: this.metrics.memoryUsage,
-      cpu: this.metrics.cpuUsage,
-      activeConnections: this.metrics.activeConnections
-    };
-  }
-}
-```
-
-## Testing Strategy
-
-### Unit Tests
-1. Create tests for each new utility class
-2. Mock filesystem and network operations
-3. Test error scenarios and edge cases
-
-### Integration Tests
-1. Test async migration with real filesystem
-2. Verify timer cleanup on shutdown
-3. Test connection pool under load
-
-### Performance Tests
-```typescript
-// Create test/performance/event-loop-test.ts
-import { tap, expect } from '@git.zone/tstest/tapbundle';
-
-tap.test('should not block event loop', async () => {
-  const intervals: number[] = [];
-  let lastTime = Date.now();
   
-  const timer = setInterval(() => {
-    const now = Date.now();
-    intervals.push(now - lastTime);
-    lastTime = now;
-  }, 10);
-
-  // Run operations that might block
-  await runPotentiallyBlockingOperation();
-
-  clearInterval(timer);
-  
-  // Check that no interval exceeded 50ms (allowing some tolerance)
-  const maxInterval = Math.max(...intervals);
-  expect(maxInterval).toBeLessThan(50);
-});
-```
-
-## Migration Timeline
-
-### Week 1: Critical Fixes
-- Day 1-2: Fix busy wait loop
-- Day 3-4: Convert critical sync operations
-- Day 5: Testing and validation
-
-### Week 2: Resource Management
-- Day 1-2: Implement LifecycleComponent
-- Day 3-4: Migrate components
-- Day 5: Connection pool enhancement
-
-### Week 3: Optimizations
-- Day 1-2: JSON operation optimization
-- Day 3-4: Worker thread integration
-- Day 5: Performance testing
-
-### Week 4: Monitoring & Polish
-- Day 1-2: Performance monitoring
-- Day 3-4: Load testing
-- Day 5: Documentation and release
-
-## Error Handling Strategy
-
-### Graceful Degradation
-```typescript
-// Create ts/core/utils/error-handler.ts
-export class ErrorHandler {
-  private static errorCounts = new Map<string, number>();
-  private static circuitBreakers = new Map<string, CircuitBreaker>();
-
-  static async withFallback<T>(
-    operation: () => Promise<T>,
-    fallback: () => Promise<T>,
-    context: string
-  ): Promise<T> {
-    const breaker = this.getCircuitBreaker(context);
+  const cleanupClient = async (reason: string) => {
+    if (clientClosed) return;
+    clientClosed = true;
+    clientReason = reason;
     
-    if (breaker.isOpen()) {
-      return fallback();
-    }
-    
-    try {
-      const result = await operation();
-      breaker.recordSuccess();
-      return result;
-    } catch (error) {
-      breaker.recordFailure();
-      this.recordError(context, error);
-      
-      if (breaker.isOpen()) {
-        logger.warn(`Circuit breaker opened for ${context}`);
-      }
-      
-      return fallback();
-    }
-  }
-
-  private static getCircuitBreaker(context: string): CircuitBreaker {
-    if (!this.circuitBreakers.has(context)) {
-      this.circuitBreakers.set(context, new CircuitBreaker({
-        failureThreshold: 5,
-        resetTimeout: 60000
-      }));
-    }
-    return this.circuitBreakers.get(context)!;
-  }
-}
-
-// Usage example in Certificate Manager
-async getCertificate(domain: string): Promise<CertificateInfo | null> {
-  return ErrorHandler.withFallback(
-    // Try async operation
-    async () => {
-      await this.initialize();
-      return this.loadCertificateAsync(domain);
-    },
-    // Fallback to sync if needed
-    async () => {
-      logger.warn(`Falling back to sync certificate load for ${domain}`);
-      return this.loadCertificateSync(domain);
-    },
-    'certificate-load'
-  );
-}
-```
-
-## Backward Compatibility
-
-### API Preservation
-1. **Maintain existing interfaces** - All public APIs remain unchanged
-2. **Progressive enhancement** - New features are opt-in via configuration
-3. **Sync method wrappers** - Provide sync-looking APIs that use async internally
-
-```typescript
-// Example: Maintaining backward compatibility
-export class CertStore {
-  // Old sync API (deprecated but maintained)
-  getCertificateSync(domain: string): ICertificateInfo | null {
-    console.warn('getCertificateSync is deprecated, use getCertificate');
-    return this.syncFallbackGetCertificate(domain);
-  }
-  
-  // New async API
-  async getCertificate(domain: string): Promise<ICertificateInfo | null> {
-    return this.asyncGetCertificate(domain);
-  }
-  
-  // Smart detection for gradual migration
-  getCertificateAuto(domain: string, callback?: (err: Error | null, cert: ICertificateInfo | null) => void) {
-    if (callback) {
-      // Callback style for compatibility
-      this.getCertificate(domain)
-        .then(cert => callback(null, cert))
-        .catch(err => callback(err, null));
+    // Allow server to continue if still active
+    if (!serverClosed && serverSocket.writable) {
+      // Half-close: stop reading from client, let server finish
+      clientSocket.pause();
+      clientSocket.unpipe(serverSocket);
+      await cleanupSocket(clientSocket, 'client', { allowDrain: true });
     } else {
-      // Return promise for modern usage
-      return this.getCertificate(domain);
+      await cleanupSocket(clientSocket, 'client');
     }
-  }
-}
-```
-
-### Configuration Compatibility
-```typescript
-// Support both old and new configuration formats
-interface SmartProxyOptions {
-  // Old options (maintained)
-  preserveSourceIP?: boolean;
-  defaultAllowedIPs?: string[];
-  
-  // New performance options (added)
-  performance?: {
-    asyncFilesystem?: boolean;
-    enhancedConnectionPool?: boolean;
-    workerThreads?: boolean;
+    
+    checkBothClosed();
   };
+  
+  const cleanupServer = async (reason: string) => {
+    if (serverClosed) return;
+    serverClosed = true;
+    serverReason = reason;
+    
+    // Allow client to continue if still active
+    if (!clientClosed && clientSocket.writable) {
+      // Half-close: stop reading from server, let client finish
+      serverSocket.pause();
+      serverSocket.unpipe(clientSocket);
+      await cleanupSocket(serverSocket, 'server', { allowDrain: true });
+    } else {
+      await cleanupSocket(serverSocket, 'server');
+    }
+    
+    checkBothClosed();
+  };
+  
+  return { cleanupClient, cleanupServer };
 }
 ```
 
-## Monitoring Dashboard
+### Phase 2: Fix Timeout Handling
 
-### Real-time Metrics Visualization
+#### 2.1 Separate timeout handling from connection closure
 ```typescript
-// Create ts/core/monitoring/dashboard-server.ts
-export class MonitoringDashboard {
-  private httpServer: http.Server;
-  private wsServer: WebSocket.Server;
-  private metricsHistory: MetricsHistory;
+export function setupSocketHandlers(
+  socket: Socket | TLSSocket,
+  handleClose: (reason: string) => void,
+  handleTimeout?: (socket: Socket) => void,  // New optional handler
+  errorPrefix?: string
+): void {
+  socket.on('error', (error) => {
+    const prefix = errorPrefix || 'Socket';
+    handleClose(`${prefix}_error: ${error.message}`);
+  });
+  
+  socket.on('close', () => {
+    const prefix = errorPrefix || 'socket';
+    handleClose(`${prefix}_closed`);
+  });
+  
+  socket.on('timeout', () => {
+    if (handleTimeout) {
+      handleTimeout(socket);  // Custom timeout handling
+    } else {
+      // Default: just log, don't close
+      console.warn(`Socket timeout: ${errorPrefix || 'socket'}`);
+    }
+  });
+}
+```
 
-  async start(port: number = 9090): Promise<void> {
-    this.httpServer = http.createServer(this.handleRequest.bind(this));
-    this.wsServer = new WebSocket.Server({ server: this.httpServer });
-    
-    this.wsServer.on('connection', (ws) => {
-      // Send current metrics
-      ws.send(JSON.stringify({
-        type: 'initial',
-        data: this.metricsHistory.getLast(100)
-      }));
-      
-      // Subscribe to updates
-      const interval = setInterval(() => {
-        if (ws.readyState === WebSocket.OPEN) {
-          ws.send(JSON.stringify({
-            type: 'update',
-            data: this.performanceMonitor.getMetrics()
-          }));
-        }
-      }, 1000);
-      
-      ws.on('close', () => clearInterval(interval));
+#### 2.2 Update HTTPS passthrough handler
+```typescript
+// In https-passthrough-handler.ts
+const { cleanupClient, cleanupServer } = createIndependentSocketHandlers(
+  clientSocket,
+  serverSocket,
+  (reason) => {
+    this.emit(ForwardingHandlerEvents.DISCONNECTED, {
+      remoteAddress,
+      bytesSent,
+      bytesReceived,
+      reason
     });
-    
-    this.httpServer.listen(port);
-    logger.info(`Monitoring dashboard available at http://localhost:${port}`);
   }
+);
 
-  private handleRequest(req: http.IncomingMessage, res: http.ServerResponse) {
-    if (req.url === '/') {
-      res.writeHead(200, { 'Content-Type': 'text/html' });
-      res.end(this.getDashboardHTML());
-    } else if (req.url === '/metrics') {
-      res.writeHead(200, { 'Content-Type': 'application/json' });
-      res.end(JSON.stringify(this.performanceMonitor.getMetrics()));
-    }
-  }
+// Setup handlers with custom timeout handling
+setupSocketHandlers(clientSocket, cleanupClient, (socket) => {
+  // Just reset timeout, don't close
+  socket.setTimeout(timeout);
+}, 'client');
 
-  private getDashboardHTML(): string {
-    return `
-<!DOCTYPE html>
-<html>
-<head>
-  <title>SmartProxy Performance Monitor</title>
-  <script src="https://cdn.jsdelivr.net/npm/chart.js"></script>
-  <style>
-    body { font-family: Arial, sans-serif; padding: 20px; }
-    .metric { display: inline-block; margin: 10px; padding: 15px; background: #f0f0f0; }
-    .chart-container { width: 45%; display: inline-block; margin: 2%; }
-  </style>
-</head>
-<body>
-  <h1>SmartProxy Performance Monitor</h1>
-  
-  <div id="metrics">
-    <div class="metric">
-      <h3>Event Loop Lag</h3>
-      <div id="eventLoopLag">--</div>
-    </div>
-    <div class="metric">
-      <h3>Active Connections</h3>
-      <div id="activeConnections">--</div>
-    </div>
-    <div class="metric">
-      <h3>Memory Usage</h3>
-      <div id="memoryUsage">--</div>
-    </div>
-    <div class="metric">
-      <h3>Connection Pool</h3>
-      <div id="connectionPool">--</div>
-    </div>
-  </div>
-  
-  <div class="chart-container">
-    <canvas id="eventLoopChart"></canvas>
-  </div>
-  <div class="chart-container">
-    <canvas id="connectionChart"></canvas>
-  </div>
-  
-  <script>
-    const ws = new WebSocket('ws://localhost:9090');
-    const eventLoopData = [];
-    const connectionData = [];
-    
-    // Initialize charts
-    const eventLoopChart = new Chart(document.getElementById('eventLoopChart'), {
-      type: 'line',
-      data: {
-        labels: [],
-        datasets: [{
-          label: 'Event Loop Lag (ms)',
-          data: eventLoopData,
-          borderColor: 'rgb(255, 99, 132)',
-          tension: 0.1
-        }]
-      },
-      options: {
-        responsive: true,
-        scales: { y: { beginAtZero: true } }
-      }
-    });
-    
-    ws.onmessage = (event) => {
-      const message = JSON.parse(event.data);
-      updateMetrics(message.data);
-    };
-    
-    function updateMetrics(metrics) {
-      document.getElementById('eventLoopLag').textContent = 
-        metrics.eventLoopLag.current.toFixed(2) + ' ms';
-      document.getElementById('activeConnections').textContent = 
-        metrics.activeConnections;
-      document.getElementById('memoryUsage').textContent = 
-        (metrics.memory.heapUsed / 1024 / 1024).toFixed(2) + ' MB';
-      
-      // Update charts
-      const now = new Date().toLocaleTimeString();
-      eventLoopData.push(metrics.eventLoopLag.current);
-      eventLoopChart.data.labels.push(now);
-      
-      if (eventLoopData.length > 60) {
-        eventLoopData.shift();
-        eventLoopChart.data.labels.shift();
-      }
-      
-      eventLoopChart.update();
-    }
-  </script>
-</body>
-</html>
-    `;
+setupSocketHandlers(serverSocket, cleanupServer, (socket) => {
+  // Just reset timeout, don't close
+  socket.setTimeout(timeout);
+}, 'server');
+```
+
+### Phase 3: Fix Connection Manager
+
+#### 3.1 Remove aggressive parity check
+```typescript
+// Remove or significantly increase the parity check timeout
+// From 2 minutes to 30 minutes for long-lived connections
+if (record.outgoingClosedTime &&
+    !record.incoming.destroyed &&
+    !record.connectionClosed &&
+    now - record.outgoingClosedTime > 1800000) {  // 30 minutes
+  // Only close if no data activity
+  if (now - record.lastActivity > 600000) {  // 10 minutes of inactivity
+    this.cleanupConnection(record, 'parity_check');
   }
 }
 ```
 
-## Performance Benchmarking
-
-### Benchmark Suite
+#### 3.2 Update cleanupConnection to check socket states
 ```typescript
-// Create test/performance/benchmark.ts
-import { SmartProxy } from '../../ts/index.js';
-
-export class PerformanceBenchmark {
-  async runConnectionStresTest(): Promise<BenchmarkResult> {
-    const proxy = new SmartProxy({ /* config */ });
-    await proxy.start();
+public cleanupConnection(record: IConnectionRecord, reason: string = 'normal'): void {
+  if (!record.connectionClosed) {
+    record.connectionClosed = true;
     
-    const results = {
-      connectionRate: 0,
-      avgLatency: 0,
-      maxConnections: 0,
-      eventLoopLag: []
-    };
-    
-    // Monitor event loop during test
-    const lagSamples: number[] = [];
-    let lastCheck = process.hrtime.bigint();
-    const monitor = setInterval(() => {
-      const now = process.hrtime.bigint();
-      const lag = Number(now - lastCheck - 100_000_000n) / 1_000_000;
-      lagSamples.push(lag);
-      lastCheck = now;
-    }, 100);
-    
-    // Create connections with increasing rate
-    const startTime = Date.now();
-    let connectionCount = 0;
-    
-    for (let rate = 100; rate <= 10000; rate += 100) {
-      const connections = await this.createConnections(rate);
-      connectionCount += connections.length;
-      
-      // Check if performance degrades
-      const avgLag = lagSamples.slice(-10).reduce((a, b) => a + b) / 10;
-      if (avgLag > 50) {
-        results.maxConnections = connectionCount;
-        break;
-      }
-      
-      await this.delay(1000);
+    // Only cleanup sockets that are actually closed or inactive
+    if (record.incoming && (!record.incoming.writable || record.incoming.destroyed)) {
+      cleanupSocket(record.incoming, `${record.id}-incoming`, { immediate: true });
     }
     
-    clearInterval(monitor);
-    await proxy.stop();
+    if (record.outgoing && (!record.outgoing.writable || record.outgoing.destroyed)) {
+      cleanupSocket(record.outgoing, `${record.id}-outgoing`, { immediate: true });
+    }
     
-    results.connectionRate = connectionCount / ((Date.now() - startTime) / 1000);
-    results.avgLatency = this.calculateAvgLatency();
-    results.eventLoopLag = lagSamples;
+    // If either socket is still active, don't remove the record yet
+    if ((record.incoming && record.incoming.writable) || 
+        (record.outgoing && record.outgoing.writable)) {
+      record.connectionClosed = false;  // Reset flag
+      return;  // Don't finish cleanup
+    }
     
-    return results;
+    // Continue with full cleanup...
   }
 }
 ```
 
-## Documentation Updates
+### Phase 4: Testing and Validation
 
-### API Documentation
-1. **Update JSDoc comments** for all modified methods
-2. **Add migration guide** for async transitions
-3. **Performance tuning guide** with recommended settings
+#### 4.1 Test Cases to Implement
+1. WebSocket connection should stay open for >1 hour
+2. HTTP streaming response should continue after request closes
+3. Half-open connections should work correctly
+4. Verify no socket leaks with long-running connections
+5. Test graceful shutdown with pending data
 
-### Example Updates
+#### 4.2 Socket Leak Prevention
+- Ensure all event listeners are tracked and removed
+- Use WeakMap for socket metadata to prevent memory leaks
+- Implement connection count monitoring
+- Add periodic health checks for orphaned sockets
+
+## Implementation Order
+
+1. **Day 1**: Implement graceful `cleanupSocket()` and independent socket handlers
+2. **Day 2**: Update all handlers to use new cleanup mechanism
+3. **Day 3**: Fix timeout handling to not close connections
+4. **Day 4**: Update connection manager parity check and cleanup logic
+5. **Day 5**: Comprehensive testing and leak detection
+
+## Configuration Changes
+
+Add new options to SmartProxyOptions:
 ```typescript
-/**
- * Gets a certificate for the specified domain
- * @param domain - The domain to get certificate for
- * @returns Promise resolving to certificate info or null
- * @since v20.0.0 - Now returns Promise (breaking change)
- * @example
- * // Old way (deprecated)
- * const cert = certStore.getCertificateSync('example.com');
- * 
- * // New way
- * const cert = await certStore.getCertificate('example.com');
- * 
- * // Compatibility mode
- * certStore.getCertificateAuto('example.com', (err, cert) => {
- *   if (err) console.error(err);
- *   else console.log(cert);
- * });
- */
-async getCertificate(domain: string): Promise<ICertificateInfo | null> {
-  // Implementation
+interface ISmartProxyOptions {
+  // Existing options...
+  
+  // New options for long-lived connections
+  socketCleanupGracePeriod?: number;        // Default: 5000ms
+  allowHalfOpenConnections?: boolean;       // Default: true
+  parityCheckTimeout?: number;              // Default: 1800000ms (30 min)
+  timeoutBehavior?: 'close' | 'reset' | 'ignore';  // Default: 'reset'
 }
 ```
 
-## Rollback Strategy
-
-Each phase is designed to be independently deployable with feature flags:
-
-```typescript
-export const PerformanceFlags = {
-  useAsyncFilesystem: process.env.SMARTPROXY_ASYNC_FS !== 'false',
-  useEnhancedPool: process.env.SMARTPROXY_ENHANCED_POOL === 'true',
-  useWorkerThreads: process.env.SMARTPROXY_WORKERS === 'true',
-  enableMonitoring: process.env.SMARTPROXY_MONITORING === 'true'
-};
-```
-
-### Gradual Rollout Plan
-1. **Development**: All flags enabled
-2. **Staging**: Monitor metrics for 1 week
-3. **Production**: 
-   - 10% traffic → 25% → 50% → 100%
-   - Monitor key metrics at each stage
-   - Rollback if metrics degrade
-
 ## Success Metrics
 
-1. **Event Loop Lag**: < 10ms average, < 50ms max
-2. **Connection Handling**: Support 10k+ concurrent connections
-3. **Memory Usage**: Stable under sustained load
-4. **CPU Usage**: Efficient utilization across cores
-5. **Response Time**: < 5ms overhead for proxy operations
+1. WebSocket connections remain stable for 24+ hours
+2. No premature connection closures reported
+3. Memory usage remains stable (no socket leaks)
+4. Half-open connections work correctly
+5. Graceful shutdown completes within grace period
 
-## Risk Mitigation
+## Implementation Status: COMPLETED ✅
 
-1. **Backward Compatibility**: Maintain existing APIs
-2. **Gradual Rollout**: Use feature flags
-3. **Monitoring**: Track metrics before/after changes
-4. **Testing**: Comprehensive test coverage
-5. **Documentation**: Update all API docs
+### Implemented Changes
 
-## Summary of Key Optimizations
+1. **Modified `cleanupSocket()` in `socket-utils.ts`**
+   - Added `CleanupOptions` interface with `immediate`, `allowDrain`, and `gracePeriod` options
+   - Implemented graceful shutdown support with write buffer draining
 
-### Immediate Impact (Phase 1)
-1. **Eliminate busy wait loop** - Unblocks event loop immediately
-2. **Async filesystem operations** - Prevents I/O blocking
-3. **Proper error handling** - Graceful degradation with fallbacks
+2. **Created `createIndependentSocketHandlers()` in `socket-utils.ts`**
+   - Tracks socket states independently
+   - Supports half-open connections where one side can close while the other remains open
+   - Only triggers full cleanup when both sockets are closed
 
-### Performance Enhancements (Phase 2-3)
-1. **Enhanced connection pooling** - O(log n) operations with BinaryHeap
-2. **Resource lifecycle management** - Prevents memory leaks
-3. **Worker threads** - Offloads CPU-intensive operations
-4. **Optimized JSON operations** - Reduces parsing overhead
+3. **Updated `setupSocketHandlers()` in `socket-utils.ts`**
+   - Added optional `handleTimeout` parameter to customize timeout behavior
+   - Prevents automatic connection closure on timeout events
 
-### Monitoring & Validation (Phase 4)
-1. **Real-time dashboard** - Visual performance monitoring
-2. **Event loop lag tracking** - Early warning system
-3. **Automated benchmarking** - Regression prevention
+4. **Updated HTTPS Passthrough Handler**
+   - Now uses `createIndependentSocketHandlers` for half-open support
+   - Custom timeout handling that resets timer instead of closing connection
+   - Manual data forwarding with backpressure handling
 
-## Implementation Checklist
+5. **Updated Connection Manager**
+   - Extended parity check from 2 minutes to 30 minutes
+   - Added activity check before closing (10 minutes of inactivity required)
+   - Modified cleanup to check socket states before destroying
 
-### Phase 1: Critical Fixes (Priority: URGENT)
-- [ ] Create `ts/core/utils/async-utils.ts` with delay function
-- [ ] Fix busy wait loop in `nftables-proxy.ts`
-- [ ] Create `ts/core/utils/fs-utils.ts` with AsyncFileSystem class
-- [ ] Migrate `certificate-manager.ts` to async operations
-- [ ] Migrate `cert-store.ts` to async operations
-- [ ] Replace `execSync` with `execAsync` in `nftables-proxy.ts`
-- [ ] Add comprehensive unit tests for async operations
-- [ ] Performance test to verify event loop improvements
+6. **Updated Basic Forwarding in Route Connection Handler**
+   - Replaced simple `pipe()` with independent socket handlers
+   - Added manual data forwarding with backpressure support
+   - Removed bilateral close handlers to prevent premature cleanup
 
-### Phase 2: Resource Management
-- [x] Implement LifecycleComponent base class
-- [ ] Migrate components to extend LifecycleComponent
-- [x] Implement BinaryHeap data structure
-- [x] Create EnhancedConnectionPool with queue support
-- [x] Add connection validation and health checks  
-- [ ] Implement proper timer cleanup in all components
-- [ ] Add integration tests for resource management
-- [x] Clean up legacy code (removed ts/common/, event-utils.ts, event-system.ts)
+### Test Results
 
-### Phase 3: Performance Optimizations
-- [ ] Implement HashUtils for efficient object hashing
-- [ ] Create WorkerPool for CPU-intensive operations
-- [ ] Migrate NFTables operations to worker threads
-- [ ] Optimize JSON operations with caching
-- [ ] Add performance benchmarks
+All tests passing:
+- ✅ Long-lived connection test: Connection stayed open for 61+ seconds with periodic keep-alive
+- ✅ Half-open connection test: One side closed while the other continued to send data
+- ✅ No socket leaks or premature closures
 
-### Phase 4: Monitoring & Polish
-- [ ] Implement PerformanceMonitor class
-- [ ] Create monitoring dashboard with WebSocket updates
-- [ ] Add comprehensive metrics collection
-- [ ] Document all API changes
-- [ ] Create migration guide
-- [ ] Update examples and tutorials
+### Notes
 
-## Next Steps
-
-1. **Immediate Action**: Fix the busy wait loop (blocks entire event loop)
-2. **Code Review**: Review this plan with the team
-3. **Feature Branch**: Create `feature/performance-optimization`
-4. **Phase 1 Implementation**: Complete within 1 week
-5. **Staging Deployment**: Test with real traffic patterns
-6. **Gradual Rollout**: Use feature flags for production
-7. **Monitor & Iterate**: Track metrics and adjust as needed
-
-## Expected Outcomes
-
-After implementing all phases:
-- **10x improvement** in concurrent connection handling
-- **90% reduction** in event loop blocking
-- **50% reduction** in memory usage under load
-- **Zero memory leaks** with proper resource cleanup
-- **Real-time visibility** into performance metrics
-- **Graceful degradation** under extreme load
-
-## Version Plan
-
-- **v19.6.0**: Phase 1 (Critical fixes) - Backward compatible
-- **v19.7.0**: Phase 2 (Resource management) - Backward compatible
-- **v19.8.0**: Phase 3 (Optimizations) - Backward compatible
-- **v20.0.0**: Phase 4 (Full async) - Breaking changes with migration path
\ No newline at end of file
+- The fix maintains backward compatibility
+- No configuration changes required for existing deployments
+- Long-lived connections now work correctly in both HTTPS passthrough and basic forwarding modes
\ No newline at end of file
diff --git a/test/test.long-lived-connections.ts b/test/test.long-lived-connections.ts
new file mode 100644
index 0000000..6ae1489
--- /dev/null
+++ b/test/test.long-lived-connections.ts
@@ -0,0 +1,192 @@
+import { tap, expect } from '@git.zone/tstest/tapbundle';
+import * as net from 'net';
+import * as tls from 'tls';
+import { SmartProxy } from '../ts/index.js';
+
+let testProxy: SmartProxy;
+let targetServer: net.Server;
+
+// Create a simple echo server as target
+tap.test('setup test environment', async () => {
+  // Create target server that echoes data back
+  targetServer = net.createServer((socket) => {
+    console.log('Target server: client connected');
+    
+    // Echo data back
+    socket.on('data', (data) => {
+      console.log(`Target server received: ${data.toString().trim()}`);
+      socket.write(data);
+    });
+    
+    socket.on('close', () => {
+      console.log('Target server: client disconnected');
+    });
+  });
+  
+  await new Promise<void>((resolve) => {
+    targetServer.listen(9876, () => {
+      console.log('Target server listening on port 9876');
+      resolve();
+    });
+  });
+  
+  // Create proxy with simple TCP forwarding (no TLS)
+  testProxy = new SmartProxy({
+    routes: [{
+      name: 'tcp-forward-test',
+      match: {
+        ports: 8888  // Plain TCP port
+      },
+      action: {
+        type: 'forward',
+        target: {
+          host: 'localhost',
+          port: 9876
+        }
+        // No TLS configuration - just plain TCP forwarding
+      }
+    }],
+    defaults: {
+      target: {
+        host: 'localhost',
+        port: 9876
+      }
+    },
+    enableDetailedLogging: true,
+    keepAliveTreatment: 'extended',  // Allow long-lived connections
+    inactivityTimeout: 3600000,      // 1 hour
+    socketTimeout: 3600000,          // 1 hour
+    keepAlive: true,
+    keepAliveInitialDelay: 1000
+  });
+  
+  await testProxy.start();
+});
+
+tap.test('should keep WebSocket-like connection open for extended period', async (tools) => {
+  tools.timeout(65000); // 65 second test timeout
+  
+  const client = new net.Socket();
+  let messagesReceived = 0;
+  let connectionClosed = false;
+  
+  // Connect to proxy
+  await new Promise<void>((resolve, reject) => {
+    client.connect(8888, 'localhost', () => {
+      console.log('Client connected to proxy');
+      resolve();
+    });
+    
+    client.on('error', reject);
+  });
+  
+  // Set up data handler
+  client.on('data', (data) => {
+    console.log(`Client received: ${data.toString().trim()}`);
+    messagesReceived++;
+  });
+  
+  client.on('close', () => {
+    console.log('Client connection closed');
+    connectionClosed = true;
+  });
+  
+  // Send initial handshake-like data
+  client.write('HELLO\n');
+  
+  // Wait for response
+  await new Promise(resolve => setTimeout(resolve, 100));
+  expect(messagesReceived).toEqual(1);
+  
+  // Simulate WebSocket-like keep-alive pattern
+  // Send periodic messages over 60 seconds
+  const startTime = Date.now();
+  const pingInterval = setInterval(() => {
+    if (!connectionClosed && Date.now() - startTime < 60000) {
+      console.log('Sending ping...');
+      client.write('PING\n');
+    } else {
+      clearInterval(pingInterval);
+    }
+  }, 10000); // Every 10 seconds
+  
+  // Wait for 61 seconds
+  await new Promise(resolve => setTimeout(resolve, 61000));
+  
+  // Clean up interval
+  clearInterval(pingInterval);
+  
+  // Connection should still be open
+  expect(connectionClosed).toEqual(false);
+  
+  // Should have received responses (1 hello + 6 pings)
+  expect(messagesReceived).toBeGreaterThan(5);
+  
+  // Close connection gracefully
+  client.end();
+  
+  // Wait for close
+  await new Promise(resolve => setTimeout(resolve, 100));
+  expect(connectionClosed).toEqual(true);
+});
+
+tap.test('should support half-open connections', async () => {
+  const client = new net.Socket();
+  const serverSocket = await new Promise<net.Socket>((resolve) => {
+    targetServer.once('connection', resolve);
+    client.connect(8888, 'localhost');
+  });
+  
+  let clientClosed = false;
+  let serverClosed = false;
+  let serverReceivedData = false;
+  
+  client.on('close', () => {
+    clientClosed = true;
+  });
+  
+  serverSocket.on('close', () => {
+    serverClosed = true;
+  });
+  
+  serverSocket.on('data', () => {
+    serverReceivedData = true;
+  });
+  
+  // Client sends data then closes write side
+  client.write('HALF-OPEN TEST\n');
+  client.end(); // Close write side only
+  
+  // Wait a bit
+  await new Promise(resolve => setTimeout(resolve, 500));
+  
+  // Server should still be able to send data
+  expect(serverClosed).toEqual(false);
+  serverSocket.write('RESPONSE\n');
+  
+  // Wait for data
+  await new Promise(resolve => setTimeout(resolve, 100));
+  
+  // Now close server side
+  serverSocket.end();
+  
+  // Wait for full close
+  await new Promise(resolve => setTimeout(resolve, 500));
+  
+  expect(clientClosed).toEqual(true);
+  expect(serverClosed).toEqual(true);
+  expect(serverReceivedData).toEqual(true);
+});
+
+tap.test('cleanup', async () => {
+  await testProxy.stop();
+  
+  await new Promise<void>((resolve) => {
+    targetServer.close(() => {
+      console.log('Target server closed');
+      resolve();
+    });
+  });
+});
+
+export default tap.start();
\ No newline at end of file
diff --git a/ts/core/utils/socket-utils.ts b/ts/core/utils/socket-utils.ts
index fc41b8a..da38006 100644
--- a/ts/core/utils/socket-utils.ts
+++ b/ts/core/utils/socket-utils.ts
@@ -1,27 +1,62 @@
 import * as plugins from '../../plugins.js';
 
+export interface CleanupOptions {
+  immediate?: boolean;      // Force immediate destruction
+  allowDrain?: boolean;     // Allow write buffer to drain
+  gracePeriod?: number;     // Ms to wait before force close
+}
+
 /**
  * Safely cleanup a socket by removing all listeners and destroying it
  * @param socket The socket to cleanup
  * @param socketName Optional name for logging
+ * @param options Cleanup options
  */
-export function cleanupSocket(socket: plugins.net.Socket | plugins.tls.TLSSocket | null, socketName?: string): void {
-  if (!socket) return;
+export function cleanupSocket(
+  socket: plugins.net.Socket | plugins.tls.TLSSocket | null, 
+  socketName?: string,
+  options: CleanupOptions = {}
+): Promise<void> {
+  if (!socket || socket.destroyed) return Promise.resolve();
   
-  try {
-    // Remove all event listeners
-    socket.removeAllListeners();
+  return new Promise<void>((resolve) => {
+    const cleanup = () => {
+      try {
+        // Remove all event listeners
+        socket.removeAllListeners();
+        
+        // Destroy if not already destroyed
+        if (!socket.destroyed) {
+          socket.destroy();
+        }
+      } catch (err) {
+        console.error(`Error cleaning up socket${socketName ? ` (${socketName})` : ''}: ${err}`);
+      }
+      resolve();
+    };
     
-    // Unpipe any streams
-    socket.unpipe();
-    
-    // Destroy if not already destroyed
-    if (!socket.destroyed) {
-      socket.destroy();
+    if (options.immediate) {
+      // Immediate cleanup (old behavior)
+      socket.unpipe();
+      cleanup();
+    } else if (options.allowDrain && socket.writable) {
+      // Allow pending writes to complete
+      socket.end(() => cleanup());
+      
+      // Force cleanup after grace period
+      if (options.gracePeriod) {
+        setTimeout(() => {
+          if (!socket.destroyed) {
+            cleanup();
+          }
+        }, options.gracePeriod);
+      }
+    } else {
+      // Default: immediate cleanup
+      socket.unpipe();
+      cleanup();
     }
-  } catch (err) {
-    console.error(`Error cleaning up socket${socketName ? ` (${socketName})` : ''}: ${err}`);
-  }
+  });
 }
 
 /**
@@ -30,6 +65,7 @@ export function cleanupSocket(socket: plugins.net.Socket | plugins.tls.TLSSocket
  * @param serverSocket The server socket (optional)
  * @param onCleanup Optional callback when cleanup is done
  * @returns A cleanup function that can be called multiple times safely
+ * @deprecated Use createIndependentSocketHandlers for better half-open support
  */
 export function createSocketCleanupHandler(
   clientSocket: plugins.net.Socket | plugins.tls.TLSSocket,
@@ -42,10 +78,10 @@ export function createSocketCleanupHandler(
     if (cleanedUp) return;
     cleanedUp = true;
     
-    // Cleanup both sockets
-    cleanupSocket(clientSocket, 'client');
+    // Cleanup both sockets (old behavior - too aggressive)
+    cleanupSocket(clientSocket, 'client', { immediate: true });
     if (serverSocket) {
-      cleanupSocket(serverSocket, 'server');
+      cleanupSocket(serverSocket, 'server', { immediate: true });
     }
     
     // Call cleanup callback if provided
@@ -55,15 +91,79 @@ export function createSocketCleanupHandler(
   };
 }
 
+/**
+ * Create independent cleanup handlers for paired sockets that support half-open connections
+ * @param clientSocket The client socket
+ * @param serverSocket The server socket
+ * @param onBothClosed Callback when both sockets are closed
+ * @returns Independent cleanup functions for each socket
+ */
+export function createIndependentSocketHandlers(
+  clientSocket: plugins.net.Socket | plugins.tls.TLSSocket,
+  serverSocket: plugins.net.Socket | plugins.tls.TLSSocket,
+  onBothClosed: (reason: string) => void
+): { cleanupClient: (reason: string) => Promise<void>, cleanupServer: (reason: string) => Promise<void> } {
+  let clientClosed = false;
+  let serverClosed = false;
+  let clientReason = '';
+  let serverReason = '';
+  
+  const checkBothClosed = () => {
+    if (clientClosed && serverClosed) {
+      onBothClosed(`client: ${clientReason}, server: ${serverReason}`);
+    }
+  };
+  
+  const cleanupClient = async (reason: string) => {
+    if (clientClosed) return;
+    clientClosed = true;
+    clientReason = reason;
+    
+    // Allow server to continue if still active
+    if (!serverClosed && serverSocket.writable) {
+      // Half-close: stop reading from client, let server finish
+      clientSocket.pause();
+      clientSocket.unpipe(serverSocket);
+      await cleanupSocket(clientSocket, 'client', { allowDrain: true, gracePeriod: 5000 });
+    } else {
+      await cleanupSocket(clientSocket, 'client', { immediate: true });
+    }
+    
+    checkBothClosed();
+  };
+  
+  const cleanupServer = async (reason: string) => {
+    if (serverClosed) return;
+    serverClosed = true;
+    serverReason = reason;
+    
+    // Allow client to continue if still active
+    if (!clientClosed && clientSocket.writable) {
+      // Half-close: stop reading from server, let client finish
+      serverSocket.pause();
+      serverSocket.unpipe(clientSocket);
+      await cleanupSocket(serverSocket, 'server', { allowDrain: true, gracePeriod: 5000 });
+    } else {
+      await cleanupSocket(serverSocket, 'server', { immediate: true });
+    }
+    
+    checkBothClosed();
+  };
+  
+  return { cleanupClient, cleanupServer };
+}
+
 /**
  * Setup socket error and close handlers with proper cleanup
  * @param socket The socket to setup handlers for
  * @param handleClose The cleanup function to call
+ * @param handleTimeout Optional custom timeout handler
  * @param errorPrefix Optional prefix for error messages
  */
 export function setupSocketHandlers(
   socket: plugins.net.Socket | plugins.tls.TLSSocket,
   handleClose: (reason: string) => void,
+  handleTimeout?: (socket: plugins.net.Socket | plugins.tls.TLSSocket) => void,
   errorPrefix?: string
 ): void {
   socket.on('error', (error) => {
@@ -77,8 +177,12 @@ export function setupSocketHandlers(
   });
   
   socket.on('timeout', () => {
-    const prefix = errorPrefix || 'socket';
-    handleClose(`${prefix}_timeout`);
+    if (handleTimeout) {
+      handleTimeout(socket);  // Custom timeout handling
+    } else {
+      // Default: just log, don't close
+      console.warn(`Socket timeout: ${errorPrefix || 'socket'}`);
+    }
   });
 }
 
diff --git a/ts/forwarding/handlers/http-handler.ts b/ts/forwarding/handlers/http-handler.ts
index c2cddf3..e8f533c 100644
--- a/ts/forwarding/handlers/http-handler.ts
+++ b/ts/forwarding/handlers/http-handler.ts
@@ -49,7 +49,12 @@ export class HttpForwardingHandler extends ForwardingHandler {
       });
     };
     
-    setupSocketHandlers(socket, handleClose, 'http');
+    // Use custom timeout handler that doesn't close the socket
+    setupSocketHandlers(socket, handleClose, () => {
+      // For HTTP, we can be more aggressive with timeouts since connections are shorter
+      // But still don't close immediately - let the connection finish naturally
+      console.warn(`HTTP socket timeout from ${remoteAddress}`);
+    }, 'http');
     
     socket.on('error', (error) => {
       this.emit(ForwardingHandlerEvents.ERROR, {
diff --git a/ts/forwarding/handlers/https-passthrough-handler.ts b/ts/forwarding/handlers/https-passthrough-handler.ts
index a804630..e596e01 100644
--- a/ts/forwarding/handlers/https-passthrough-handler.ts
+++ b/ts/forwarding/handlers/https-passthrough-handler.ts
@@ -2,7 +2,7 @@ import * as plugins from '../../plugins.js';
 import { ForwardingHandler } from './base-handler.js';
 import type { IForwardConfig } from '../config/forwarding-types.js';
 import { ForwardingHandlerEvents } from '../config/forwarding-types.js';
-import { createSocketCleanupHandler, setupSocketHandlers, pipeSockets } from '../../core/utils/socket-utils.js';
+import { createIndependentSocketHandlers, setupSocketHandlers } from '../../core/utils/socket-utils.js';
 
 /**
  * Handler for HTTPS passthrough (SNI forwarding without termination)
@@ -55,19 +55,32 @@ export class HttpsPassthroughHandler extends ForwardingHandler {
     let bytesSent = 0;
     let bytesReceived = 0;
     
-    // Create cleanup handler with our utility
-    const handleClose = createSocketCleanupHandler(clientSocket, serverSocket, (reason) => {
-      this.emit(ForwardingHandlerEvents.DISCONNECTED, {
-        remoteAddress,
-        bytesSent,
-        bytesReceived,
-        reason
-      });
-    });
+    // Create independent handlers for half-open connection support
+    const { cleanupClient, cleanupServer } = createIndependentSocketHandlers(
+      clientSocket,
+      serverSocket,
+      (reason) => {
+        this.emit(ForwardingHandlerEvents.DISCONNECTED, {
+          remoteAddress,
+          bytesSent,
+          bytesReceived,
+          reason
+        });
+      }
+    );
     
-    // Setup error and close handlers for both sockets
-    setupSocketHandlers(serverSocket, handleClose, 'server');
-    setupSocketHandlers(clientSocket, handleClose, 'client');
+    // Setup handlers with custom timeout handling that doesn't close connections
+    const timeout = this.getTimeout();
+    
+    setupSocketHandlers(clientSocket, cleanupClient, (socket) => {
+      // Just reset timeout, don't close
+      socket.setTimeout(timeout);
+    }, 'client');
+    
+    setupSocketHandlers(serverSocket, cleanupServer, (socket) => {
+      // Just reset timeout, don't close  
+      socket.setTimeout(timeout);
+    }, 'server');
     
     // Forward data from client to server
     clientSocket.on('data', (data) => {
@@ -117,8 +130,7 @@ export class HttpsPassthroughHandler extends ForwardingHandler {
       });
     });
     
-    // Set timeouts
-    const timeout = this.getTimeout();
+    // Set initial timeouts - they will be reset on each timeout event  
     clientSocket.setTimeout(timeout);
     serverSocket.setTimeout(timeout);
   }
@@ -128,7 +140,7 @@ export class HttpsPassthroughHandler extends ForwardingHandler {
    * @param req The HTTP request
    * @param res The HTTP response
    */
-  public handleHttpRequest(req: plugins.http.IncomingMessage, res: plugins.http.ServerResponse): void {
+  public handleHttpRequest(_req: plugins.http.IncomingMessage, res: plugins.http.ServerResponse): void {
     // HTTPS passthrough doesn't support HTTP requests
     res.writeHead(404, { 'Content-Type': 'text/plain' });
     res.end('HTTP not supported for this domain');
diff --git a/ts/forwarding/handlers/https-terminate-to-http-handler.ts b/ts/forwarding/handlers/https-terminate-to-http-handler.ts
index f8a93d8..1509ae7 100644
--- a/ts/forwarding/handlers/https-terminate-to-http-handler.ts
+++ b/ts/forwarding/handlers/https-terminate-to-http-handler.ts
@@ -112,7 +112,7 @@ export class HttpsTerminateToHttpHandler extends ForwardingHandler {
     });
     
     // Set up error handling with our cleanup utility
-    setupSocketHandlers(tlsSocket, handleClose, 'tls');
+    setupSocketHandlers(tlsSocket, handleClose, undefined, 'tls');
     
     // Set timeout
     const timeout = this.getTimeout();
@@ -167,7 +167,7 @@ export class HttpsTerminateToHttpHandler extends ForwardingHandler {
         });
         
         // Set up handlers for backend socket
-        setupSocketHandlers(backendSocket, newHandleClose, 'backend');
+        setupSocketHandlers(backendSocket, newHandleClose, undefined, 'backend');
         
         backendSocket.on('error', (error) => {
           this.emit(ForwardingHandlerEvents.ERROR, {
diff --git a/ts/forwarding/handlers/https-terminate-to-https-handler.ts b/ts/forwarding/handlers/https-terminate-to-https-handler.ts
index d2970fd..32f8c38 100644
--- a/ts/forwarding/handlers/https-terminate-to-https-handler.ts
+++ b/ts/forwarding/handlers/https-terminate-to-https-handler.ts
@@ -106,7 +106,7 @@ export class HttpsTerminateToHttpsHandler extends ForwardingHandler {
     });
     
     // Set up error handling with our cleanup utility
-    setupSocketHandlers(tlsSocket, handleClose, 'tls');
+    setupSocketHandlers(tlsSocket, handleClose, undefined, 'tls');
     
     // Set timeout
     const timeout = this.getTimeout();
@@ -151,7 +151,7 @@ export class HttpsTerminateToHttpsHandler extends ForwardingHandler {
       });
       
       // Set up handlers for backend socket
-      setupSocketHandlers(backendSocket, newHandleClose, 'backend');
+      setupSocketHandlers(backendSocket, newHandleClose, undefined, 'backend');
       
       backendSocket.on('error', (error) => {
         this.emit(ForwardingHandlerEvents.ERROR, {
diff --git a/ts/proxies/http-proxy/connection-pool.ts b/ts/proxies/http-proxy/connection-pool.ts
index a790fd3..9aa62c0 100644
--- a/ts/proxies/http-proxy/connection-pool.ts
+++ b/ts/proxies/http-proxy/connection-pool.ts
@@ -134,7 +134,7 @@ export class ConnectionPool {
         if ((connection.isIdle && now - connection.lastUsed > idleTimeout) ||
             connections.length > (this.options.connectionPoolSize || 50)) {
           
-          cleanupSocket(connection.socket, `pool-${host}-idle`);
+          cleanupSocket(connection.socket, `pool-${host}-idle`, { immediate: true }).catch(() => {});
           
           connections.shift(); // Remove from pool
           removed++;
@@ -164,7 +164,7 @@ export class ConnectionPool {
       this.logger.debug(`Closing ${connections.length} connections to ${host}`);
       
       for (const connection of connections) {
-        cleanupSocket(connection.socket, `pool-${host}-close`);
+        cleanupSocket(connection.socket, `pool-${host}-close`, { immediate: true }).catch(() => {});
       }
     }
     
diff --git a/ts/proxies/http-proxy/http-proxy.ts b/ts/proxies/http-proxy/http-proxy.ts
index 986a02b..916362a 100644
--- a/ts/proxies/http-proxy/http-proxy.ts
+++ b/ts/proxies/http-proxy/http-proxy.ts
@@ -520,9 +520,10 @@ export class HttpProxy implements IMetricsTracker {
     this.webSocketHandler.shutdown();
     
     // Close all tracked sockets
-    for (const socket of this.socketMap.getArray()) {
-      cleanupSocket(socket, 'http-proxy-stop');
-    }
+    const socketCleanupPromises = this.socketMap.getArray().map(socket => 
+      cleanupSocket(socket, 'http-proxy-stop', { immediate: true })
+    );
+    await Promise.all(socketCleanupPromises);
     
     // Close all connection pool connections
     this.connectionPool.closeAllConnections();
diff --git a/ts/proxies/smart-proxy/connection-manager.ts b/ts/proxies/smart-proxy/connection-manager.ts
index 6f911b7..d849d2c 100644
--- a/ts/proxies/smart-proxy/connection-manager.ts
+++ b/ts/proxies/smart-proxy/connection-manager.ts
@@ -278,12 +278,37 @@ export class ConnectionManager extends LifecycleComponent {
         }
       }
 
-      // Handle socket cleanup without delay
-      cleanupSocket(record.incoming, `${record.id}-incoming`);
+      // Handle socket cleanup - check if sockets are still active
+      const cleanupPromises: Promise<void>[] = [];
+      
+      if (record.incoming) {
+        if (!record.incoming.writable || record.incoming.destroyed) {
+          // Socket is not active, clean up immediately
+          cleanupPromises.push(cleanupSocket(record.incoming, `${record.id}-incoming`, { immediate: true }));
+        } else {
+          // Socket is still active, allow graceful cleanup
+          cleanupPromises.push(cleanupSocket(record.incoming, `${record.id}-incoming`, { allowDrain: true, gracePeriod: 5000 }));
+        }
+      }
       
       if (record.outgoing) {
-        cleanupSocket(record.outgoing, `${record.id}-outgoing`);
+        if (!record.outgoing.writable || record.outgoing.destroyed) {
+          // Socket is not active, clean up immediately
+          cleanupPromises.push(cleanupSocket(record.outgoing, `${record.id}-outgoing`, { immediate: true }));
+        } else {
+          // Socket is still active, allow graceful cleanup
+          cleanupPromises.push(cleanupSocket(record.outgoing, `${record.id}-outgoing`, { allowDrain: true, gracePeriod: 5000 }));
+        }
       }
+      
+      // Wait for cleanup to complete
+      Promise.all(cleanupPromises).catch(err => {
+        logger.log('error', `Error during socket cleanup: ${err}`, {
+          connectionId: record.id,
+          error: err,
+          component: 'connection-manager'
+        });
+      });
 
       // Clear pendingData to avoid memory leaks
       record.pendingData = [];
@@ -484,19 +509,24 @@ export class ConnectionManager extends LifecycleComponent {
       }
       
       // Parity check: if outgoing socket closed and incoming remains active
+      // Increased from 2 minutes to 30 minutes for long-lived connections
       if (
         record.outgoingClosedTime &&
         !record.incoming.destroyed &&
         !record.connectionClosed &&
-        now - record.outgoingClosedTime > 120000
+        now - record.outgoingClosedTime > 1800000  // 30 minutes
       ) {
-        logger.log('warn', `Parity check failed: ${record.remoteIP}`, {
-          connectionId,
-          remoteIP: record.remoteIP,
-          timeElapsed: plugins.prettyMs(now - record.outgoingClosedTime),
-          component: 'connection-manager'
-        });
-        this.cleanupConnection(record, 'parity_check');
+        // Only close if no data activity for 10 minutes
+        if (now - record.lastActivity > 600000) {
+          logger.log('warn', `Parity check failed after extended timeout: ${record.remoteIP}`, {
+            connectionId,
+            remoteIP: record.remoteIP,
+            timeElapsed: plugins.prettyMs(now - record.outgoingClosedTime),
+            inactiveFor: plugins.prettyMs(now - record.lastActivity),
+            component: 'connection-manager'
+          });
+          this.cleanupConnection(record, 'parity_check');
+        }
       }
     }
   }
@@ -537,13 +567,18 @@ export class ConnectionManager extends LifecycleComponent {
           }
 
           // Immediate destruction using socket-utils
+          const shutdownPromises: Promise<void>[] = [];
+          
           if (record.incoming) {
-            cleanupSocket(record.incoming, `${record.id}-incoming-shutdown`);
+            shutdownPromises.push(cleanupSocket(record.incoming, `${record.id}-incoming-shutdown`, { immediate: true }));
           }
 
           if (record.outgoing) {
-            cleanupSocket(record.outgoing, `${record.id}-outgoing-shutdown`);
+            shutdownPromises.push(cleanupSocket(record.outgoing, `${record.id}-outgoing-shutdown`, { immediate: true }));
           }
+          
+          // Don't wait for shutdown cleanup in this batch processing
+          Promise.all(shutdownPromises).catch(() => {});
         } catch (err) {
           logger.log('error', `Error during connection cleanup: ${err}`, { 
             connectionId: record.id, 
diff --git a/ts/proxies/smart-proxy/port-manager.ts b/ts/proxies/smart-proxy/port-manager.ts
index b1fb6a3..df68165 100644
--- a/ts/proxies/smart-proxy/port-manager.ts
+++ b/ts/proxies/smart-proxy/port-manager.ts
@@ -65,7 +65,7 @@ export class PortManager {
     const server = plugins.net.createServer((socket) => {
       // Check if shutting down
       if (this.isShuttingDown) {
-        cleanupSocket(socket, 'port-manager-shutdown');
+        cleanupSocket(socket, 'port-manager-shutdown', { immediate: true });
         return;
       }
       
diff --git a/ts/proxies/smart-proxy/route-connection-handler.ts b/ts/proxies/smart-proxy/route-connection-handler.ts
index 86a124a..3e90342 100644
--- a/ts/proxies/smart-proxy/route-connection-handler.ts
+++ b/ts/proxies/smart-proxy/route-connection-handler.ts
@@ -9,7 +9,7 @@ import { TlsManager } from './tls-manager.js';
 import { HttpProxyBridge } from './http-proxy-bridge.js';
 import { TimeoutManager } from './timeout-manager.js';
 import { RouteManager } from './route-manager.js';
-import { cleanupSocket } from '../../core/utils/socket-utils.js';
+import { cleanupSocket, createIndependentSocketHandlers, setupSocketHandlers } from '../../core/utils/socket-utils.js';
 
 /**
  * Handles new connection processing and setup logic with support for route-based configuration
@@ -84,7 +84,7 @@ export class RouteConnectionHandler {
     const ipValidation = this.securityManager.validateIP(remoteIP);
     if (!ipValidation.allowed) {
       logger.log('warn', `Connection rejected`, { remoteIP, reason: ipValidation.reason, component: 'route-handler' });
-      cleanupSocket(socket, `rejected-${ipValidation.reason}`);
+      cleanupSocket(socket, `rejected-${ipValidation.reason}`, { immediate: true });
       return;
     }
 
@@ -1110,9 +1110,8 @@ export class RouteConnectionHandler {
     // Setup improved error handling for outgoing connection
     this.setupOutgoingErrorHandler(connectionId, targetSocket, record, socket, finalTargetHost, finalTargetPort);
 
-    // Setup close handlers
-    targetSocket.on('close', this.connectionManager.handleClose('outgoing', record));
-    socket.on('close', this.connectionManager.handleClose('incoming', record));
+    // Note: Close handlers are managed by independent socket handlers above
+    // We don't register handleClose here to avoid bilateral cleanup
     
     // Setup error handlers for incoming socket
     socket.on('error', this.connectionManager.handleError('incoming', record));
@@ -1225,14 +1224,64 @@ export class RouteConnectionHandler {
         record.pendingDataSize = 0;
       }
 
-      // Immediately setup bidirectional piping - much simpler than manual data management
-      socket.pipe(targetSocket);
-      targetSocket.pipe(socket);
+      // Set up independent socket handlers for half-open connection support
+      const { cleanupClient, cleanupServer } = createIndependentSocketHandlers(
+        socket,
+        targetSocket,
+        (reason) => {
+          this.connectionManager.initiateCleanupOnce(record, reason);
+        }
+      );
 
-      // Track incoming data for bytes counting - do this after piping is set up
+      // Setup socket handlers with custom timeout handling
+      setupSocketHandlers(socket, cleanupClient, (sock) => {
+        // Don't close on timeout for keep-alive connections
+        if (record.hasKeepAlive) {
+          sock.setTimeout(this.settings.socketTimeout || 3600000);
+        }
+      }, 'client');
+
+      setupSocketHandlers(targetSocket, cleanupServer, (sock) => {
+        // Don't close on timeout for keep-alive connections  
+        if (record.hasKeepAlive) {
+          sock.setTimeout(this.settings.socketTimeout || 3600000);
+        }
+      }, 'server');
+
+      // Forward data from client to target with backpressure handling
       socket.on('data', (chunk: Buffer) => {
         record.bytesReceived += chunk.length;
         this.timeoutManager.updateActivity(record);
+        
+        if (targetSocket.writable) {
+          const flushed = targetSocket.write(chunk);
+          
+          // Handle backpressure
+          if (!flushed) {
+            socket.pause();
+            targetSocket.once('drain', () => {
+              socket.resume();
+            });
+          }
+        }
+      });
+
+      // Forward data from target to client with backpressure handling
+      targetSocket.on('data', (chunk: Buffer) => {
+        record.bytesSent += chunk.length;
+        this.timeoutManager.updateActivity(record);
+        
+        if (socket.writable) {
+          const flushed = socket.write(chunk);
+          
+          // Handle backpressure
+          if (!flushed) {
+            targetSocket.pause();
+            socket.once('drain', () => {
+              targetSocket.resume();
+            });
+          }
+        }
       });
 
       // Log successful connection