v25.10.4

changelog.md

@@ -1,5 +1,62 @@
 # Changelog
 
+## 2026-03-12 - 25.10.4 - fix(rustproxy-http)
+stabilize upstream HTTP/2 forwarding and fallback behavior
+
+- Remove hop-by-hop headers before forwarding requests to HTTP/2 backends to comply with RFC 9113.
+- Use ALPN-enabled TLS configuration whenever HTTP/2 is possible, including explicit H2 connections and retries.
+- Add HTTP/2 handshake timeouts, tuned connection settings, and fallback to HTTP/1 when H2 negotiation times out or fails.
+- Register pooled HTTP/2 senders only after a successful first request to avoid reusing broken connections.
+- Build absolute URIs for HTTP/2 upstream requests so pseudo-headers such as scheme and authority are derived correctly.
+
+## 2026-03-12 - 25.10.3 - fix(rustproxy-http)
+include request domain in backend proxy error and protocol detection logs
+
+- Adds domain context to backend TCP/TLS connect, handshake, request failure, retry, and fallback log entries in the Rust HTTP proxy service.
+- Propagates the resolved host/domain through H1, H2, pooled, and fallback forwarding paths so backend-level diagnostics can be correlated with the original request domain.
+
+## 2026-03-12 - 25.10.2 - fix(repo)
+no code changes to release
+
+
+## 2026-03-12 - 25.10.1 - fix(repo)
+no changes to commit
+
+
+## 2026-03-12 - 25.10.0 - feat(metrics)
+add per-backend connection, error, protocol, and pool metrics with stale backend pruning
+
+- tracks backend connection lifecycle, connect timing, protocol detection, pool hit/miss rates, handshake/request errors, and h2 fallback failures in Rust metrics
+- exposes backend metrics through the TypeScript metrics adapter with backend listings, protocol lookup, and top error summaries
+- prunes backend metrics for backends no longer referenced by active routes, including preserved-port targets expanded across listening ports
+
+## 2026-03-11 - 25.9.3 - fix(rustproxy-http)
+Evict stale HTTP/2 pooled senders and retry bodyless requests with fresh backend connections to avoid 502s
+
+- Introduce MAX_H2_AGE (120s) and evict HTTP/2 senders older than this or closed
+- Check MAX_H2_AGE on checkout and during background eviction to prevent reuse of stale h2 connections
+- Add connection_pool.remove_h2() to explicitly remove dead H2 senders from the pool
+- When a pooled H2 request returns a 502 and the original request had an empty body, retry using a fresh H2 connection (retry_h2_with_fresh_connection)
+- On H2 auto-detect failures, retry as HTTP/1.1 for bodyless requests via forward_h1_empty_body; return 502 for requests with bodies
+- Evict dead H2 senders on backend request failures in reconnect_backend so subsequent attempts create fresh connections
+
+## 2026-03-08 - 25.9.2 - fix(protocol-cache)
+Include requested_host in protocol detection cache key to avoid cache oscillation when multiple frontend domains share the same backend
+
+- Add ProtocolCacheKey.requested_host: Option<String> to distinguish cache entries by incoming request Host/:authority
+- Update protocol cache lookups/inserts in proxy_service to populate requested_host
+- Enhance debug logging to show requested_host on cache hits
+- Fixes repeated ALPN probing / cache oscillation when different frontend domains share a backend with differing HTTP/2 support
+
+## 2026-03-03 - 25.9.1 - fix(rustproxy)
+Cancel connections for routes removed/disabled by adding per-route cancellation tokens and make RouteManager swappable (ArcSwap) for runtime updates
+
+- Add per-route CancellationToken map (DashMap) to TcpListenerManager and call token.cancel() when routes are removed (invalidate_removed_routes)
+- Propagate Arc<ArcSwap<RouteManager>> into HttpProxyService and passthrough listener so the route manager can be hot-swapped without restarting listeners
+- Use per-route child cancellation tokens in accept/connection handling and forwarders to terminate existing connections when a route is removed
+- Prune HTTP proxy caches and retain/cleanup per-route tokens when routes are active/removed
+- Update test.test.sni-requirement.node.ts to allocate unique free ports via findFreePorts to avoid port conflicts during tests
+
 ## 2026-03-03 - 25.9.0 - feat(rustproxy-http)
 add HTTP/2 auto-detection via ALPN with TTL-backed protocol cache and h1-only/h2 ALPN client configs
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "@push.rocks/smartproxy",
-  "version": "25.9.0",
+  "version": "25.10.4",
   "private": false,
   "description": "A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.",
   "main": "dist_ts/index.js",

rust/crates/rustproxy-http/src/connection_pool.rs

@@ -18,6 +18,9 @@ const MAX_IDLE_PER_KEY: usize = 16;
 const IDLE_TIMEOUT: Duration = Duration::from_secs(90);
 /// Background eviction interval.
 const EVICTION_INTERVAL: Duration = Duration::from_secs(30);
+/// Maximum age for pooled HTTP/2 connections before proactive eviction.
+/// Prevents staleness from backends that close idle connections (e.g. nginx GOAWAY).
+const MAX_H2_AGE: Duration = Duration::from_secs(120);
 
 /// Identifies a unique backend endpoint.
 #[derive(Clone, Debug, Hash, Eq, PartialEq)]
@@ -37,7 +40,6 @@ struct IdleH1 {
 /// A pooled HTTP/2 sender (multiplexed, Clone-able).
 struct PooledH2 {
     sender: http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
-    #[allow(dead_code)] // Reserved for future age-based eviction
     created_at: Instant,
 }
 
@@ -116,8 +118,8 @@ impl ConnectionPool {
         let entry = self.h2_pool.get(key)?;
         let pooled = entry.value();
 
-        // Check if the h2 connection is still alive
+        // Check if the h2 connection is still alive and not too old
-        if pooled.sender.is_closed() {
+        if pooled.sender.is_closed() || pooled.created_at.elapsed() >= MAX_H2_AGE {
             drop(entry);
             self.h2_pool.remove(key);
             return None;
@@ -130,6 +132,12 @@ impl ConnectionPool {
         None
     }
 
+    /// Remove a dead HTTP/2 sender from the pool.
+    /// Called when `send_request` fails to prevent subsequent requests from reusing the stale sender.
+    pub fn remove_h2(&self, key: &PoolKey) {
+        self.h2_pool.remove(key);
+    }
+
     /// Register an HTTP/2 sender in the pool. Since h2 is multiplexed,
     /// only one sender per key is stored (it's Clone-able).
     pub fn register_h2(&self, key: PoolKey, sender: http2::SendRequest<BoxBody<Bytes, hyper::Error>>) {
@@ -165,10 +173,10 @@ impl ConnectionPool {
                 h1_pool.remove(&key);
             }
 
-            // Evict dead H2 connections
+            // Evict dead or aged-out H2 connections
             let mut dead_h2 = Vec::new();
             for entry in h2_pool.iter() {
-                if entry.value().sender.is_closed() {
+                if entry.value().sender.is_closed() || entry.value().created_at.elapsed() >= MAX_H2_AGE {
                     dead_h2.push(entry.key().clone());
                 }
             }

rust/crates/rustproxy-http/src/protocol_cache.rs

@@ -1,7 +1,8 @@
 //! Bounded, TTL-based protocol detection cache for HTTP/2 auto-detection.
 //!
-//! Caches the ALPN-negotiated protocol (H1 or H2) per backend endpoint (host:port).
+//! Caches the ALPN-negotiated protocol (H1 or H2) per backend endpoint and requested
-//! Prevents repeated ALPN probes for backends whose protocol is already known.
+//! domain (host:port + requested_host). This prevents cache oscillation when multiple
+//! frontend domains share the same backend but differ in HTTP/2 support.
 
 use std::sync::Arc;
 use std::time::{Duration, Instant};
@@ -27,11 +28,14 @@ pub enum DetectedProtocol {
     H2,
 }
 
-/// Key for the protocol cache: (host, port).
+/// Key for the protocol cache: (host, port, requested_host).
 #[derive(Clone, Debug, Hash, Eq, PartialEq)]
 pub struct ProtocolCacheKey {
     pub host: String,
     pub port: u16,
+    /// The incoming request's domain (Host header / :authority).
+    /// Distinguishes protocol detection when multiple domains share the same backend.
+    pub requested_host: Option<String>,
 }
 
 /// A cached protocol detection result with a timestamp.
@@ -73,7 +77,7 @@ impl ProtocolCache {
     pub fn get(&self, key: &ProtocolCacheKey) -> Option<DetectedProtocol> {
         let entry = self.cache.get(key)?;
         if entry.detected_at.elapsed() < PROTOCOL_CACHE_TTL {
-            debug!("Protocol cache hit: {:?} for {}:{}", entry.protocol, key.host, key.port);
+            debug!("Protocol cache hit: {:?} for {}:{} (requested: {:?})", entry.protocol, key.host, key.port, key.requested_host);
             Some(entry.protocol)
         } else {
             // Expired — remove and return None to trigger re-probe

rust/crates/rustproxy-http/src/proxy_service.rs

@@ -8,8 +8,10 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::sync::atomic::{AtomicU64, Ordering};
 
+use arc_swap::ArcSwap;
 use bytes::Bytes;
 use dashmap::DashMap;
+use http_body::Body as HttpBody;
 use http_body_util::{BodyExt, Full, combinators::BoxBody};
 use hyper::body::Incoming;
 use hyper::{Request, Response, StatusCode};
@@ -133,7 +135,7 @@ async fn connect_tls_backend(
 
 /// HTTP proxy service that processes HTTP traffic.
 pub struct HttpProxyService {
-    route_manager: Arc<RouteManager>,
+    route_manager: Arc<ArcSwap<RouteManager>>,
     metrics: Arc<MetricsCollector>,
     upstream_selector: UpstreamSelector,
     /// Timeout for connecting to upstream backends.
@@ -161,7 +163,7 @@ pub struct HttpProxyService {
 }
 
 impl HttpProxyService {
-    pub fn new(route_manager: Arc<RouteManager>, metrics: Arc<MetricsCollector>) -> Self {
+    pub fn new(route_manager: Arc<ArcSwap<RouteManager>>, metrics: Arc<MetricsCollector>) -> Self {
         Self {
             route_manager,
             metrics,
@@ -182,7 +184,7 @@ impl HttpProxyService {
 
     /// Create with a custom connect timeout.
     pub fn with_connect_timeout(
-        route_manager: Arc<RouteManager>,
+        route_manager: Arc<ArcSwap<RouteManager>>,
         metrics: Arc<MetricsCollector>,
         connect_timeout: std::time::Duration,
     ) -> Self {
@@ -405,7 +407,8 @@ impl HttpProxyService {
             protocol: Some("http"),
         };
 
-        let route_match = match self.route_manager.find_route(&ctx) {
+        let current_rm = self.route_manager.load();
+        let route_match = match current_rm.find_route(&ctx) {
             Some(rm) => rm,
             None => {
                 debug!("No route matched for HTTP request to {:?}{}", host, path);
@@ -476,6 +479,7 @@ impl HttpProxyService {
         }
 
         let upstream_key = format!("{}:{}", upstream.host, upstream.port);
+        let domain_str = host.as_deref().unwrap_or("-");
         self.upstream_selector.connection_started(&upstream_key);
 
         // Check for WebSocket upgrade
@@ -535,6 +539,15 @@ impl HttpProxyService {
             }
         }
 
+        // Remove hop-by-hop headers (RFC 9113 §8.2.2 forbids connection-specific headers in H2)
+        upstream_headers.remove("connection");
+        upstream_headers.remove("keep-alive");
+        upstream_headers.remove("proxy-connection");
+        upstream_headers.remove("transfer-encoding");
+        upstream_headers.remove("te");
+        upstream_headers.remove("trailer");
+        upstream_headers.remove("upgrade");
+
         // Add standard reverse-proxy headers (X-Forwarded-*)
         {
             let original_host = host.as_deref().unwrap_or("");
@@ -591,6 +604,7 @@ impl HttpProxyService {
                     let cache_key = crate::protocol_cache::ProtocolCacheKey {
                         host: upstream.host.clone(),
                         port: upstream.port,
+                        requested_host: host.clone(),
                     };
                     match self.protocol_cache.get(&cache_key) {
                         Some(crate::protocol_cache::DetectedProtocol::H2) => (true, false),
@@ -614,9 +628,11 @@ impl HttpProxyService {
             // H2 pool checkout (H2 senders are Clone and multiplexed)
             if use_h2 {
                 if let Some(sender) = self.connection_pool.checkout_h2(&pool_key) {
+                    self.metrics.backend_pool_hit(&upstream_key);
+                    self.metrics.set_backend_protocol(&upstream_key, "h2");
                     let result = self.forward_h2_pooled(
                         sender, parts, body, upstream_headers, &upstream_path,
-                        route_match.route, route_id, &ip_str, &pool_key,
+                        route_match.route, route_id, &ip_str, &pool_key, domain_str,
                     ).await;
                     self.upstream_selector.connection_ended(&upstream_key);
                     return result;
@@ -625,14 +641,17 @@ impl HttpProxyService {
         }
 
         // --- Fresh connection path ---
-        // Choose TLS config: use ALPN config for auto-detect probe, plain config otherwise
+        self.metrics.backend_pool_miss(&upstream_key);
-        let tls_config = if needs_alpn_probe {
+
+        // Choose TLS config: use ALPN config when H2 is possible (auto-detect probe OR explicit H2)
+        let tls_config = if needs_alpn_probe || use_h2 {
             &self.backend_tls_config_alpn
         } else {
             &self.backend_tls_config
         };
 
         // Establish backend connection
+        let connect_start = std::time::Instant::now();
         let (backend, detected_h2) = if upstream.use_tls {
             match tokio::time::timeout(
                 self.connect_timeout,
@@ -648,6 +667,7 @@ impl HttpProxyService {
                         let cache_key = crate::protocol_cache::ProtocolCacheKey {
                             host: upstream.host.clone(),
                             port: upstream.port,
+                            requested_host: host.clone(),
                         };
                         let detected = if is_h2 {
                             crate::protocol_cache::DetectedProtocol::H2
@@ -656,25 +676,42 @@ impl HttpProxyService {
                         };
                         self.protocol_cache.insert(cache_key, detected);
 
-                        debug!(
+                        info!(
-                            "Auto-detected {} for backend {}:{}",
+                            backend = %upstream_key,
-                            if is_h2 { "HTTP/2" } else { "HTTP/1.1" },
+                            domain = %domain_str,
-                            upstream.host, upstream.port
+                            protocol = if is_h2 { "h2" } else { "h1" },
+                            connect_time_ms = %connect_start.elapsed().as_millis(),
+                            "Backend protocol detected via ALPN"
                         );
 
                         is_h2
                     } else {
                         use_h2
                     };
+                    self.metrics.backend_connection_opened(&upstream_key, connect_start.elapsed());
+                    self.metrics.set_backend_protocol(&upstream_key, if final_h2 { "h2" } else { "h1" });
                     (BackendStream::Tls(tls), final_h2)
                 }
                 Ok(Err(e)) => {
-                    error!("Failed TLS connect to upstream {}:{}: {}", upstream.host, upstream.port, e);
+                    error!(
+                        backend = %upstream_key,
+                        domain = %domain_str,
+                        connect_time_ms = %connect_start.elapsed().as_millis(),
+                        error = %e,
+                        "Backend TLS connect failed"
+                    );
+                    self.metrics.backend_connect_error(&upstream_key);
                     self.upstream_selector.connection_ended(&upstream_key);
                     return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend TLS unavailable"));
                 }
                 Err(_) => {
-                    error!("Upstream TLS connect timeout for {}:{}", upstream.host, upstream.port);
+                    error!(
+                        backend = %upstream_key,
+                        domain = %domain_str,
+                        connect_time_ms = %connect_start.elapsed().as_millis(),
+                        "Backend TLS connect timeout"
+                    );
+                    self.metrics.backend_connect_error(&upstream_key);
                     self.upstream_selector.connection_ended(&upstream_key);
                     return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend TLS connect timeout"));
                 }
@@ -689,15 +726,30 @@ impl HttpProxyService {
                     let _ = socket2::SockRef::from(&s).set_tcp_keepalive(
                         &socket2::TcpKeepalive::new().with_time(std::time::Duration::from_secs(60))
                     );
+                    self.metrics.backend_connection_opened(&upstream_key, connect_start.elapsed());
+                    self.metrics.set_backend_protocol(&upstream_key, if use_h2 { "h2" } else { "h1" });
                     (BackendStream::Plain(s), use_h2)
                 }
                 Ok(Err(e)) => {
-                    error!("Failed to connect to upstream {}:{}: {}", upstream.host, upstream.port, e);
+                    error!(
+                        backend = %upstream_key,
+                        domain = %domain_str,
+                        connect_time_ms = %connect_start.elapsed().as_millis(),
+                        error = %e,
+                        "Backend TCP connect failed"
+                    );
+                    self.metrics.backend_connect_error(&upstream_key);
                     self.upstream_selector.connection_ended(&upstream_key);
                     return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend unavailable"));
                 }
                 Err(_) => {
-                    error!("Upstream connect timeout for {}:{}", upstream.host, upstream.port);
+                    error!(
+                        backend = %upstream_key,
+                        domain = %domain_str,
+                        connect_time_ms = %connect_start.elapsed().as_millis(),
+                        "Backend TCP connect timeout"
+                    );
+                    self.metrics.backend_connect_error(&upstream_key);
                     self.upstream_selector.connection_ended(&upstream_key);
                     return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend connect timeout"));
                 }
@@ -719,21 +771,23 @@ impl HttpProxyService {
                 self.forward_h2_with_fallback(
                     io, parts, body, upstream_headers, &upstream_path,
                     &upstream, route_match.route, route_id, &ip_str, &final_pool_key,
+                    host.clone(), domain_str,
                 ).await
             } else {
                 // Explicit H2 mode: hard-fail on handshake error (preserved behavior)
                 self.forward_h2(
                     io, parts, body, upstream_headers, &upstream_path,
-                    &upstream, route_match.route, route_id, &ip_str, &final_pool_key,
+                    &upstream, route_match.route, route_id, &ip_str, &final_pool_key, domain_str,
                 ).await
             }
         } else {
             self.forward_h1(
                 io, parts, body, upstream_headers, &upstream_path,
-                &upstream, route_match.route, route_id, &ip_str, &final_pool_key,
+                &upstream, route_match.route, route_id, &ip_str, &final_pool_key, domain_str,
             ).await
         };
         self.upstream_selector.connection_ended(&upstream_key);
+        self.metrics.backend_connection_closed(&upstream_key);
         result
     }
 
@@ -751,12 +805,16 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
+        let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
+
         // Try pooled H1 connection first — avoids TCP+TLS handshake
         if let Some(pooled_sender) = self.connection_pool.checkout_h1(pool_key) {
+            self.metrics.backend_pool_hit(&backend_key);
             return self.forward_h1_with_sender(
                 pooled_sender, parts, body, upstream_headers, upstream_path,
-                route, route_id, source_ip, pool_key,
+                route, route_id, source_ip, pool_key, domain,
             ).await;
         }
 
@@ -767,7 +825,8 @@ impl HttpProxyService {
         ) = match hyper::client::conn::http1::handshake(io).await {
             Ok(h) => h,
             Err(e) => {
-                error!("Upstream handshake failed: {}", e);
+                error!(backend = %backend_key, domain = %domain, error = %e, "Backend H1 handshake failed");
+                self.metrics.backend_handshake_error(&backend_key);
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend handshake failed"));
             }
         };
@@ -778,7 +837,7 @@ impl HttpProxyService {
             }
         });
 
-        self.forward_h1_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, pool_key).await
+        self.forward_h1_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, pool_key, domain).await
     }
 
     /// Common H1 forwarding logic used by both fresh and pooled paths.
@@ -793,6 +852,7 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         // Always use HTTP/1.1 for h1 backend connections (h2 incoming requests have version HTTP/2.0)
         let mut upstream_req = Request::builder()
@@ -819,7 +879,9 @@ impl HttpProxyService {
         let upstream_response = match sender.send_request(upstream_req).await {
             Ok(resp) => resp,
             Err(e) => {
-                error!("Upstream request failed: {}", e);
+                let bk = format!("{}:{}", pool_key.host, pool_key.port);
+                error!(backend = %bk, domain = %domain, error = %e, "Backend H1 request failed");
+                self.metrics.backend_request_error(&bk);
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend request failed"));
             }
         };
@@ -844,18 +906,31 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
+        let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
         let exec = hyper_util::rt::TokioExecutor::new();
-        // Explicitly type the handshake with BoxBody for uniform pool type
+        let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
+        h2_builder
+            .keep_alive_interval(std::time::Duration::from_secs(10))
+            .keep_alive_timeout(std::time::Duration::from_secs(5))
+            .adaptive_window(true)
+            .initial_stream_window_size(2 * 1024 * 1024);
         let (sender, conn): (
             hyper::client::conn::http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
             hyper::client::conn::http2::Connection<TokioIo<BackendStream>, BoxBody<Bytes, hyper::Error>, hyper_util::rt::TokioExecutor>,
-        ) = match hyper::client::conn::http2::handshake(exec, io).await {
+        ) = match tokio::time::timeout(self.connect_timeout, h2_builder.handshake(io)).await {
-            Ok(h) => h,
+            Ok(Ok(h)) => h,
-            Err(e) => {
+            Ok(Err(e)) => {
-                error!("HTTP/2 upstream handshake failed: {}", e);
+                error!(backend = %backend_key, domain = %domain, error = %e, "Backend H2 handshake failed");
+                self.metrics.backend_handshake_error(&backend_key);
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H2 handshake failed"));
             }
+            Err(_) => {
+                error!(backend = %backend_key, domain = %domain, "Backend H2 handshake timeout");
+                self.metrics.backend_handshake_error(&backend_key);
+                return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend H2 handshake timeout"));
+            }
         };
 
         tokio::spawn(async move {
@@ -864,13 +939,18 @@ impl HttpProxyService {
             }
         });
 
-        // Register for multiplexed reuse
+        // Clone sender for potential pool registration; register only after first request succeeds
-        self.connection_pool.register_h2(pool_key.clone(), sender.clone());
+        let sender_for_pool = sender.clone();
-
+        let result = self.forward_h2_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip, Some(pool_key), domain).await;
-        self.forward_h2_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip).await
+        if matches!(&result, Ok(ref resp) if resp.status() != StatusCode::BAD_GATEWAY) {
+            self.connection_pool.register_h2(pool_key.clone(), sender_for_pool);
+        }
+        result
     }
 
     /// Forward request using an existing (pooled) HTTP/2 sender.
+    /// If the pooled sender is stale (GOAWAY, connection closed), evicts it and retries
+    /// with a fresh connection for bodyless requests (GET/HEAD/DELETE).
     async fn forward_h2_pooled(
         &self,
         sender: hyper::client::conn::http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
@@ -881,9 +961,160 @@ impl HttpProxyService {
         route: &rustproxy_config::RouteConfig,
         route_id: Option<&str>,
         source_ip: &str,
-        _pool_key: &crate::connection_pool::PoolKey,
+        pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
-        self.forward_h2_with_sender(sender, parts, body, upstream_headers, upstream_path, route, route_id, source_ip).await
+        // Save retry state for bodyless requests (cheap: Method is an enum, HeaderMap clones Arc-backed Bytes)
+        let retry_state = if body.is_end_stream() {
+            Some((parts.method.clone(), upstream_headers.clone()))
+        } else {
+            None
+        };
+
+        let result = self.forward_h2_with_sender(
+            sender, parts, body, upstream_headers, upstream_path,
+            route, route_id, source_ip, Some(pool_key), domain,
+        ).await;
+
+        // If the request failed (502) and we can retry with an empty body, do so
+        let is_502 = matches!(&result, Ok(resp) if resp.status() == StatusCode::BAD_GATEWAY);
+        if is_502 {
+            if let Some((method, headers)) = retry_state {
+                warn!(backend = %format!("{}:{}", pool_key.host, pool_key.port), domain = %domain,
+                    "Stale pooled H2 sender, retrying with fresh connection");
+                return self.retry_h2_with_fresh_connection(
+                    method, headers, upstream_path,
+                    pool_key, route, route_id, source_ip, domain,
+                ).await;
+            }
+        }
+        result
+    }
+
+    /// Retry an H2 request with a fresh backend connection and empty body.
+    /// Used when a pooled sender was stale (GOAWAY/closed) and the original body was empty.
+    async fn retry_h2_with_fresh_connection(
+        &self,
+        method: hyper::Method,
+        upstream_headers: hyper::HeaderMap,
+        upstream_path: &str,
+        pool_key: &crate::connection_pool::PoolKey,
+        route: &rustproxy_config::RouteConfig,
+        route_id: Option<&str>,
+        source_ip: &str,
+        domain: &str,
+    ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
+        let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
+
+        // Establish fresh backend connection
+        let retry_connect_start = std::time::Instant::now();
+        let backend = if pool_key.use_tls {
+            match tokio::time::timeout(
+                self.connect_timeout,
+                connect_tls_backend(&self.backend_tls_config_alpn, &pool_key.host, pool_key.port),
+            ).await {
+                Ok(Ok(tls)) => BackendStream::Tls(tls),
+                Ok(Err(e)) => {
+                    error!(backend = %backend_key, domain = %domain, error = %e, "H2 retry: TLS connect failed");
+                    self.metrics.backend_connect_error(&backend_key);
+                    return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend unavailable on H2 retry"));
+                }
+                Err(_) => {
+                    error!(backend = %backend_key, domain = %domain, "H2 retry: TLS connect timeout");
+                    self.metrics.backend_connect_error(&backend_key);
+                    return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend timeout on H2 retry"));
+                }
+            }
+        } else {
+            match tokio::time::timeout(
+                self.connect_timeout,
+                TcpStream::connect(format!("{}:{}", pool_key.host, pool_key.port)),
+            ).await {
+                Ok(Ok(s)) => {
+                    s.set_nodelay(true).ok();
+                    BackendStream::Plain(s)
+                }
+                Ok(Err(e)) => {
+                    error!(backend = %backend_key, domain = %domain, error = %e, "H2 retry: TCP connect failed");
+                    self.metrics.backend_connect_error(&backend_key);
+                    return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend unavailable on H2 retry"));
+                }
+                Err(_) => {
+                    error!(backend = %backend_key, domain = %domain, "H2 retry: TCP connect timeout");
+                    self.metrics.backend_connect_error(&backend_key);
+                    return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend timeout on H2 retry"));
+                }
+            }
+        };
+        self.metrics.backend_connection_opened(&backend_key, retry_connect_start.elapsed());
+
+        let io = TokioIo::new(backend);
+        let exec = hyper_util::rt::TokioExecutor::new();
+        let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
+        h2_builder
+            .keep_alive_interval(std::time::Duration::from_secs(10))
+            .keep_alive_timeout(std::time::Duration::from_secs(5))
+            .adaptive_window(true)
+            .initial_stream_window_size(2 * 1024 * 1024);
+        let (mut sender, conn): (
+            hyper::client::conn::http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
+            hyper::client::conn::http2::Connection<TokioIo<BackendStream>, BoxBody<Bytes, hyper::Error>, hyper_util::rt::TokioExecutor>,
+        ) = match tokio::time::timeout(self.connect_timeout, h2_builder.handshake(io)).await {
+            Ok(Ok(h)) => h,
+            Ok(Err(e)) => {
+                error!(backend = %backend_key, domain = %domain, error = %e, "H2 retry: handshake failed");
+                self.metrics.backend_handshake_error(&backend_key);
+                self.metrics.backend_connection_closed(&backend_key);
+                return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H2 retry handshake failed"));
+            }
+            Err(_) => {
+                error!(backend = %backend_key, domain = %domain, "H2 retry: handshake timeout");
+                self.metrics.backend_handshake_error(&backend_key);
+                self.metrics.backend_connection_closed(&backend_key);
+                return Ok(error_response(StatusCode::GATEWAY_TIMEOUT, "Backend H2 retry handshake timeout"));
+            }
+        };
+
+        tokio::spawn(async move {
+            if let Err(e) = conn.await {
+                debug!("H2 retry: upstream connection error: {}", e);
+            }
+        });
+
+        // Build request with empty body using absolute URI for H2 pseudo-headers
+        let h2_uri = format!("{}://{}:{}{}",
+            if pool_key.use_tls { "https" } else { "http" },
+            pool_key.host, pool_key.port, upstream_path);
+        let mut upstream_req = Request::builder()
+            .method(method)
+            .uri(&h2_uri);
+
+        if let Some(headers) = upstream_req.headers_mut() {
+            *headers = upstream_headers;
+        }
+
+        let empty_body: BoxBody<Bytes, hyper::Error> = BoxBody::new(
+            http_body_util::Empty::new().map_err(|never| match never {})
+        );
+        let upstream_req = upstream_req.body(empty_body).unwrap();
+
+        match sender.send_request(upstream_req).await {
+            Ok(resp) => {
+                // Register in pool only after request succeeds
+                self.connection_pool.register_h2(pool_key.clone(), sender);
+                let result = self.build_streaming_response(resp, route, route_id, source_ip).await;
+                // Close the fresh backend connection (opened above)
+                self.metrics.backend_connection_closed(&backend_key);
+                result
+            }
+            Err(e) => {
+                error!(backend = %backend_key, domain = %domain, error = %e, "H2 retry: request failed");
+                self.metrics.backend_request_error(&backend_key);
+                // Close the fresh backend connection (opened above)
+                self.metrics.backend_connection_closed(&backend_key);
+                Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H2 request failed on retry"))
+            }
+        }
     }
 
     /// Forward via HTTP/2 with fallback to HTTP/1.1 (auto-detect mode).
@@ -891,8 +1122,8 @@ impl HttpProxyService {
     /// Handles two failure scenarios:
     /// 1. H2 handshake fails → reconnects and falls back to H1 (body not consumed yet).
     /// 2. H2 handshake "succeeds" but request fails (backend advertises h2 via ALPN but
-    ///    doesn't actually speak h2) → updates cache to H1. The request body is consumed
+    ///    doesn't actually speak h2) → updates cache to H1, retries as H1 for bodyless
-    ///    so this request fails, but all subsequent requests will correctly use H1.
+    ///    requests, or returns 502 for requests with bodies.
     async fn forward_h2_with_fallback(
         &self,
         io: TokioIo<BackendStream>,
@@ -905,27 +1136,84 @@ impl HttpProxyService {
         route_id: Option<&str>,
         source_ip: &str,
         pool_key: &crate::connection_pool::PoolKey,
+        requested_host: Option<String>,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
         let exec = hyper_util::rt::TokioExecutor::new();
-        let handshake_result: Result<(
+        let mut h2_builder = hyper::client::conn::http2::Builder::new(exec);
-            hyper::client::conn::http2::SendRequest<BoxBody<Bytes, hyper::Error>>,
+        h2_builder
-            hyper::client::conn::http2::Connection<TokioIo<BackendStream>, BoxBody<Bytes, hyper::Error>, hyper_util::rt::TokioExecutor>,
+            .keep_alive_interval(std::time::Duration::from_secs(10))
-        ), hyper::Error> = hyper::client::conn::http2::handshake(exec, io).await;
+            .keep_alive_timeout(std::time::Duration::from_secs(5))
+            .adaptive_window(true)
+            .initial_stream_window_size(2 * 1024 * 1024);
+        let handshake_result = tokio::time::timeout(
+            self.connect_timeout,
+            h2_builder.handshake(io),
+        ).await;
 
         match handshake_result {
-            Ok((mut sender, conn)) => {
+            Err(_) => {
+                // H2 handshake timed out — fall back to H1
+                let bk = format!("{}:{}", upstream.host, upstream.port);
+                warn!(
+                    backend = %bk,
+                    domain = %domain,
+                    "H2 handshake timeout, falling back to H1"
+                );
+                self.metrics.backend_h2_failure(&bk);
+                self.metrics.backend_handshake_error(&bk);
+
+                let cache_key = crate::protocol_cache::ProtocolCacheKey {
+                    host: upstream.host.clone(),
+                    port: upstream.port,
+                    requested_host: requested_host.clone(),
+                };
+                self.protocol_cache.insert(cache_key, crate::protocol_cache::DetectedProtocol::H1);
+
+                match self.reconnect_backend(upstream, domain).await {
+                    Some(fallback_backend) => {
+                        let h1_pool_key = crate::connection_pool::PoolKey {
+                            host: upstream.host.clone(),
+                            port: upstream.port,
+                            use_tls: upstream.use_tls,
+                            h2: false,
+                        };
+                        let fallback_io = TokioIo::new(fallback_backend);
+                        let result = self.forward_h1(
+                            fallback_io, parts, body, upstream_headers, upstream_path,
+                            upstream, route, route_id, source_ip, &h1_pool_key, domain,
+                        ).await;
+                        self.metrics.backend_connection_closed(&bk);
+                        result
+                    }
+                    None => {
+                        Ok(error_response(StatusCode::BAD_GATEWAY, "Backend unavailable after H2 timeout fallback"))
+                    }
+                }
+            }
+            Ok(Ok((mut sender, conn))) => {
                 tokio::spawn(async move {
                     if let Err(e) = conn.await {
                         debug!("HTTP/2 upstream connection error: {}", e);
                     }
                 });
 
+                // Save retry state before consuming parts/body (for bodyless requests like GET)
+                let retry_state = if body.is_end_stream() {
+                    Some((parts.method.clone(), upstream_headers.clone()))
+                } else {
+                    None
+                };
+
                 // Build and send the h2 request inline (don't register in pool yet —
                 // we need to verify the request actually succeeds first, because some
                 // backends advertise h2 via ALPN but don't speak the h2 binary protocol).
+                let h2_uri = format!("{}://{}:{}{}",
+                    if upstream.use_tls { "https" } else { "http" },
+                    upstream.host, upstream.port, upstream_path);
                 let mut upstream_req = Request::builder()
                     .method(parts.method)
-                    .uri(upstream_path);
+                    .uri(&h2_uri);
 
                 if let Some(headers) = upstream_req.headers_mut() {
                     *headers = upstream_headers;
@@ -950,38 +1238,73 @@ impl HttpProxyService {
                     Err(e) => {
                         // H2 request failed — backend advertises h2 via ALPN but doesn't
                         // actually speak it. Update cache so future requests use H1.
-                        // The request body is consumed so this request can't be retried,
+                        let bk = format!("{}:{}", upstream.host, upstream.port);
-                        // but all subsequent requests will correctly use H1.
                         warn!(
-                            "Auto-detect: H2 request failed for {}:{}, updating cache to H1: {}",
+                            backend = %bk,
-                            upstream.host, upstream.port, e
+                            domain = %domain,
+                            error = %e,
+                            "Auto-detect: H2 request failed, falling back to H1"
                         );
+                        self.metrics.backend_h2_failure(&bk);
                         let cache_key = crate::protocol_cache::ProtocolCacheKey {
                             host: upstream.host.clone(),
                             port: upstream.port,
+                            requested_host: requested_host.clone(),
                         };
                         self.protocol_cache.insert(cache_key, crate::protocol_cache::DetectedProtocol::H1);
-                        Ok(error_response(StatusCode::BAD_GATEWAY, "Backend protocol mismatch, retrying with H1"))
+
+                        // Retry as H1 for bodyless requests; return 502 for requests with bodies
+                        if let Some((method, headers)) = retry_state {
+                            match self.reconnect_backend(upstream, domain).await {
+                                Some(fallback_backend) => {
+                                    let h1_pool_key = crate::connection_pool::PoolKey {
+                                        host: upstream.host.clone(),
+                                        port: upstream.port,
+                                        use_tls: upstream.use_tls,
+                                        h2: false,
+                                    };
+                                    let fallback_io = TokioIo::new(fallback_backend);
+                                    let result = self.forward_h1_empty_body(
+                                        fallback_io, method, headers, upstream_path,
+                                        route, route_id, source_ip, &h1_pool_key, domain,
+                                    ).await;
+                                    // Close the reconnected backend connection (opened in reconnect_backend)
+                                    self.metrics.backend_connection_closed(&bk);
+                                    result
+                                }
+                                None => {
+                                    Ok(error_response(StatusCode::BAD_GATEWAY, "Backend unavailable after H2 fallback"))
+                                }
+                            }
+                        } else {
+                            Ok(error_response(StatusCode::BAD_GATEWAY, "Backend protocol mismatch"))
+                        }
                     }
                 }
             }
-            Err(e) => {
+            Ok(Err(e)) => {
                 // H2 handshake truly failed — fall back to H1
                 // Body is NOT consumed yet, so we can retry the full request.
+                let bk = format!("{}:{}", upstream.host, upstream.port);
                 warn!(
-                    "H2 handshake failed for {}:{}, falling back to H1: {}",
+                    backend = %bk,
-                    upstream.host, upstream.port, e
+                    domain = %domain,
+                    error = %e,
+                    "H2 handshake failed, falling back to H1"
                 );
+                self.metrics.backend_h2_failure(&bk);
+                self.metrics.backend_handshake_error(&bk);
 
                 // Update cache to H1 so subsequent requests skip H2
                 let cache_key = crate::protocol_cache::ProtocolCacheKey {
                     host: upstream.host.clone(),
                     port: upstream.port,
+                    requested_host: requested_host.clone(),
                 };
                 self.protocol_cache.insert(cache_key, crate::protocol_cache::DetectedProtocol::H1);
 
                 // Reconnect for H1 (the original io was consumed by the failed h2 handshake)
-                match self.reconnect_backend(upstream).await {
+                match self.reconnect_backend(upstream, domain).await {
                     Some(fallback_backend) => {
                         let h1_pool_key = crate::connection_pool::PoolKey {
                             host: upstream.host.clone(),
@@ -990,10 +1313,13 @@ impl HttpProxyService {
                             h2: false,
                         };
                         let fallback_io = TokioIo::new(fallback_backend);
-                        self.forward_h1(
+                        let result = self.forward_h1(
                             fallback_io, parts, body, upstream_headers, upstream_path,
-                            upstream, route, route_id, source_ip, &h1_pool_key,
+                            upstream, route, route_id, source_ip, &h1_pool_key, domain,
-                        ).await
+                        ).await;
+                        // Close the reconnected backend connection (opened in reconnect_backend)
+                        self.metrics.backend_connection_closed(&bk);
+                        result
                     }
                     None => {
                         Ok(error_response(StatusCode::BAD_GATEWAY, "Backend unavailable after H2 fallback"))
@@ -1003,23 +1329,93 @@ impl HttpProxyService {
         }
     }
 
+    /// Forward a request with an empty body via HTTP/1.1.
+    /// Used when retrying after a failed H2 attempt where the original body was consumed.
+    async fn forward_h1_empty_body(
+        &self,
+        io: TokioIo<BackendStream>,
+        method: hyper::Method,
+        upstream_headers: hyper::HeaderMap,
+        upstream_path: &str,
+        route: &rustproxy_config::RouteConfig,
+        route_id: Option<&str>,
+        source_ip: &str,
+        pool_key: &crate::connection_pool::PoolKey,
+        domain: &str,
+    ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
+        let backend_key = format!("{}:{}", pool_key.host, pool_key.port);
+        let (mut sender, conn): (
+            hyper::client::conn::http1::SendRequest<BoxBody<Bytes, hyper::Error>>,
+            hyper::client::conn::http1::Connection<TokioIo<BackendStream>, BoxBody<Bytes, hyper::Error>>,
+        ) = match hyper::client::conn::http1::handshake(io).await {
+            Ok(h) => h,
+            Err(e) => {
+                error!(backend = %backend_key, domain = %domain, error = %e, "H1 fallback: handshake failed");
+                self.metrics.backend_handshake_error(&backend_key);
+                return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H1 fallback handshake failed"));
+            }
+        };
+
+        tokio::spawn(async move {
+            if let Err(e) = conn.await {
+                debug!("H1 fallback: upstream connection error: {}", e);
+            }
+        });
+
+        let mut upstream_req = Request::builder()
+            .method(method)
+            .uri(upstream_path)
+            .version(hyper::Version::HTTP_11);
+
+        if let Some(headers) = upstream_req.headers_mut() {
+            *headers = upstream_headers;
+        }
+
+        let empty_body: BoxBody<Bytes, hyper::Error> = BoxBody::new(
+            http_body_util::Empty::new().map_err(|never| match never {})
+        );
+        let upstream_req = upstream_req.body(empty_body).unwrap();
+
+        let upstream_response = match sender.send_request(upstream_req).await {
+            Ok(resp) => resp,
+            Err(e) => {
+                error!(backend = %backend_key, domain = %domain, error = %e, "H1 fallback: request failed");
+                self.metrics.backend_request_error(&backend_key);
+                return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H1 fallback request failed"));
+            }
+        };
+
+        // Return sender to pool for keep-alive reuse
+        self.connection_pool.checkin_h1(pool_key.clone(), sender);
+
+        self.build_streaming_response(upstream_response, route, route_id, source_ip).await
+    }
+
     /// Reconnect to a backend (used for H2→H1 fallback).
     async fn reconnect_backend(
         &self,
         upstream: &crate::upstream_selector::UpstreamSelection,
+        domain: &str,
     ) -> Option<BackendStream> {
+        let backend_key = format!("{}:{}", upstream.host, upstream.port);
+        let reconnect_start = std::time::Instant::now();
         if upstream.use_tls {
             match tokio::time::timeout(
                 self.connect_timeout,
                 connect_tls_backend(&self.backend_tls_config, &upstream.host, upstream.port),
             ).await {
-                Ok(Ok(tls)) => Some(BackendStream::Tls(tls)),
+                Ok(Ok(tls)) => {
+                    self.metrics.backend_connection_opened(&backend_key, reconnect_start.elapsed());
+                    Some(BackendStream::Tls(tls))
+                }
                 Ok(Err(e)) => {
-                    error!("H1 fallback: TLS reconnect failed for {}:{}: {}", upstream.host, upstream.port, e);
+                    error!(backend = %backend_key, domain = %domain, error = %e, "H1 fallback: TLS reconnect failed");
+                    self.metrics.backend_connect_error(&backend_key);
                     None
                 }
                 Err(_) => {
-                    error!("H1 fallback: TLS reconnect timeout for {}:{}", upstream.host, upstream.port);
+                    error!(backend = %backend_key, domain = %domain, "H1 fallback: TLS reconnect timeout");
+                    self.metrics.backend_connect_error(&backend_key);
                     None
                 }
             }
@@ -1033,14 +1429,17 @@ impl HttpProxyService {
                     let _ = socket2::SockRef::from(&s).set_tcp_keepalive(
                         &socket2::TcpKeepalive::new().with_time(std::time::Duration::from_secs(60))
                     );
+                    self.metrics.backend_connection_opened(&backend_key, reconnect_start.elapsed());
                     Some(BackendStream::Plain(s))
                 }
                 Ok(Err(e)) => {
-                    error!("H1 fallback: reconnect failed for {}:{}: {}", upstream.host, upstream.port, e);
+                    error!(backend = %backend_key, domain = %domain, error = %e, "H1 fallback: TCP reconnect failed");
+                    self.metrics.backend_connect_error(&backend_key);
                     None
                 }
                 Err(_) => {
-                    error!("H1 fallback: reconnect timeout for {}:{}", upstream.host, upstream.port);
+                    error!(backend = %backend_key, domain = %domain, "H1 fallback: TCP reconnect timeout");
+                    self.metrics.backend_connect_error(&backend_key);
                     None
                 }
             }
@@ -1058,10 +1457,20 @@ impl HttpProxyService {
         route: &rustproxy_config::RouteConfig,
         route_id: Option<&str>,
         source_ip: &str,
+        pool_key: Option<&crate::connection_pool::PoolKey>,
+        domain: &str,
     ) -> Result<Response<BoxBody<Bytes, hyper::Error>>, hyper::Error> {
+        // Build absolute URI for H2 pseudo-headers (:scheme, :authority)
+        let h2_uri = if let Some(pk) = pool_key {
+            format!("{}://{}:{}{}",
+                if pk.use_tls { "https" } else { "http" },
+                pk.host, pk.port, upstream_path)
+        } else {
+            upstream_path.to_string()
+        };
         let mut upstream_req = Request::builder()
             .method(parts.method)
-            .uri(upstream_path);
+            .uri(&h2_uri);
 
         if let Some(headers) = upstream_req.headers_mut() {
             *headers = upstream_headers;
@@ -1082,7 +1491,15 @@ impl HttpProxyService {
         let upstream_response = match sender.send_request(upstream_req).await {
             Ok(resp) => resp,
             Err(e) => {
-                error!("HTTP/2 upstream request failed: {}", e);
+                // Evict the dead sender so subsequent requests get fresh connections
+                if let Some(key) = pool_key {
+                    let bk = format!("{}:{}", key.host, key.port);
+                    error!(backend = %bk, domain = %domain, error = %e, "Backend H2 request failed");
+                    self.metrics.backend_request_error(&bk);
+                    self.connection_pool.remove_h2(key);
+                } else {
+                    error!(domain = %domain, error = %e, "Backend H2 request failed");
+                }
                 return Ok(error_response(StatusCode::BAD_GATEWAY, "Backend H2 request failed"));
             }
         };
@@ -1759,7 +2176,7 @@ impl rustls::client::danger::ServerCertVerifier for InsecureBackendVerifier {
 impl Default for HttpProxyService {
     fn default() -> Self {
         Self {
-            route_manager: Arc::new(RouteManager::new(vec![])),
+            route_manager: Arc::new(ArcSwap::from(Arc::new(RouteManager::new(vec![])))),
             metrics: Arc::new(MetricsCollector::new()),
             upstream_selector: UpstreamSelector::new(),
             connect_timeout: DEFAULT_CONNECT_TIMEOUT,

rust/crates/rustproxy-metrics/src/collector.rs

@@ -3,6 +3,7 @@ use serde::{Deserialize, Serialize};
 use std::collections::HashSet;
 use std::sync::atomic::{AtomicU64, Ordering};
 use std::sync::Mutex;
+use std::time::Duration;
 
 use crate::throughput::{ThroughputSample, ThroughputTracker};
 
@@ -20,6 +21,7 @@ pub struct Metrics {
     pub throughput_recent_out_bytes_per_sec: u64,
     pub routes: std::collections::HashMap<String, RouteMetrics>,
     pub ips: std::collections::HashMap<String, IpMetrics>,
+    pub backends: std::collections::HashMap<String, BackendMetrics>,
     pub throughput_history: Vec<ThroughputSample>,
     pub total_http_requests: u64,
     pub http_requests_per_sec: u64,
@@ -52,6 +54,23 @@ pub struct IpMetrics {
     pub throughput_out_bytes_per_sec: u64,
 }
 
+/// Per-backend metrics (keyed by "host:port").
+#[derive(Debug, Clone, Serialize, Deserialize)]
+#[serde(rename_all = "camelCase")]
+pub struct BackendMetrics {
+    pub active_connections: u64,
+    pub total_connections: u64,
+    pub protocol: String,
+    pub connect_errors: u64,
+    pub handshake_errors: u64,
+    pub request_errors: u64,
+    pub total_connect_time_us: u64,
+    pub connect_count: u64,
+    pub pool_hits: u64,
+    pub pool_misses: u64,
+    pub h2_failures: u64,
+}
+
 /// Statistics snapshot.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -69,6 +88,9 @@ const DEFAULT_RETENTION_SECONDS: usize = 3600;
 /// Maximum number of IPs to include in a snapshot (top by active connections).
 const MAX_IPS_IN_SNAPSHOT: usize = 100;
 
+/// Maximum number of backends to include in a snapshot (top by total connections).
+const MAX_BACKENDS_IN_SNAPSHOT: usize = 100;
+
 /// Metrics collector tracking connections and throughput.
 ///
 /// Design: The hot path (`record_bytes`) is entirely lock-free — it only touches
@@ -96,6 +118,19 @@ pub struct MetricsCollector {
     ip_pending_tp: DashMap<String, (AtomicU64, AtomicU64)>,
     ip_throughput: DashMap<String, Mutex<ThroughputTracker>>,
 
+    // ── Per-backend tracking (keyed by "host:port") ──
+    backend_active: DashMap<String, AtomicU64>,
+    backend_total: DashMap<String, AtomicU64>,
+    backend_protocol: DashMap<String, String>,
+    backend_connect_errors: DashMap<String, AtomicU64>,
+    backend_handshake_errors: DashMap<String, AtomicU64>,
+    backend_request_errors: DashMap<String, AtomicU64>,
+    backend_connect_time_us: DashMap<String, AtomicU64>,
+    backend_connect_count: DashMap<String, AtomicU64>,
+    backend_pool_hits: DashMap<String, AtomicU64>,
+    backend_pool_misses: DashMap<String, AtomicU64>,
+    backend_h2_failures: DashMap<String, AtomicU64>,
+
     // ── HTTP request tracking ──
     total_http_requests: AtomicU64,
     pending_http_requests: AtomicU64,
@@ -134,6 +169,17 @@ impl MetricsCollector {
             ip_bytes_out: DashMap::new(),
             ip_pending_tp: DashMap::new(),
             ip_throughput: DashMap::new(),
+            backend_active: DashMap::new(),
+            backend_total: DashMap::new(),
+            backend_protocol: DashMap::new(),
+            backend_connect_errors: DashMap::new(),
+            backend_handshake_errors: DashMap::new(),
+            backend_request_errors: DashMap::new(),
+            backend_connect_time_us: DashMap::new(),
+            backend_connect_count: DashMap::new(),
+            backend_pool_hits: DashMap::new(),
+            backend_pool_misses: DashMap::new(),
+            backend_h2_failures: DashMap::new(),
             total_http_requests: AtomicU64::new(0),
             pending_http_requests: AtomicU64::new(0),
             http_request_throughput: Mutex::new(ThroughputTracker::new(retention_seconds)),
@@ -268,6 +314,113 @@ impl MetricsCollector {
         self.pending_http_requests.fetch_add(1, Ordering::Relaxed);
     }
 
+    // ── Per-backend recording methods ──
+
+    /// Record a successful backend connection with its connect duration.
+    pub fn backend_connection_opened(&self, key: &str, connect_time: Duration) {
+        self.backend_active
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(1, Ordering::Relaxed);
+        self.backend_total
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(1, Ordering::Relaxed);
+        self.backend_connect_time_us
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(connect_time.as_micros() as u64, Ordering::Relaxed);
+        self.backend_connect_count
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Record a backend connection closing.
+    pub fn backend_connection_closed(&self, key: &str) {
+        if let Some(counter) = self.backend_active.get(key) {
+            let val = counter.load(Ordering::Relaxed);
+            if val > 0 {
+                counter.fetch_sub(1, Ordering::Relaxed);
+            }
+        }
+    }
+
+    /// Record a backend connect error (TCP or TLS connect failure/timeout).
+    pub fn backend_connect_error(&self, key: &str) {
+        self.backend_connect_errors
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Record a backend handshake error (H1 or H2 handshake failure).
+    pub fn backend_handshake_error(&self, key: &str) {
+        self.backend_handshake_errors
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Record a backend request error (send_request failure).
+    pub fn backend_request_error(&self, key: &str) {
+        self.backend_request_errors
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Record a connection pool hit for a backend.
+    pub fn backend_pool_hit(&self, key: &str) {
+        self.backend_pool_hits
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Record a connection pool miss for a backend.
+    pub fn backend_pool_miss(&self, key: &str) {
+        self.backend_pool_misses
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Record an H2 failure (h2 attempted but fell back to h1).
+    pub fn backend_h2_failure(&self, key: &str) {
+        self.backend_h2_failures
+            .entry(key.to_string())
+            .or_insert_with(|| AtomicU64::new(0))
+            .fetch_add(1, Ordering::Relaxed);
+    }
+
+    /// Set the protocol in use for a backend ("h1" or "h2").
+    pub fn set_backend_protocol(&self, key: &str, protocol: &str) {
+        self.backend_protocol
+            .entry(key.to_string())
+            .and_modify(|v| {
+                if v != protocol {
+                    *v = protocol.to_string();
+                }
+            })
+            .or_insert_with(|| protocol.to_string());
+    }
+
+    /// Remove per-backend metrics for backends no longer in any route target.
+    pub fn retain_backends(&self, active_backends: &HashSet<String>) {
+        self.backend_active.retain(|k, _| active_backends.contains(k));
+        self.backend_total.retain(|k, _| active_backends.contains(k));
+        self.backend_protocol.retain(|k, _| active_backends.contains(k));
+        self.backend_connect_errors.retain(|k, _| active_backends.contains(k));
+        self.backend_handshake_errors.retain(|k, _| active_backends.contains(k));
+        self.backend_request_errors.retain(|k, _| active_backends.contains(k));
+        self.backend_connect_time_us.retain(|k, _| active_backends.contains(k));
+        self.backend_connect_count.retain(|k, _| active_backends.contains(k));
+        self.backend_pool_hits.retain(|k, _| active_backends.contains(k));
+        self.backend_pool_misses.retain(|k, _| active_backends.contains(k));
+        self.backend_h2_failures.retain(|k, _| active_backends.contains(k));
+    }
+
     /// Take a throughput sample on all trackers (cold path, call at 1Hz or configured interval).
     ///
     /// Drains the lock-free pending counters and feeds the accumulated bytes
@@ -488,6 +641,72 @@ impl MetricsCollector {
             });
         }
 
+        // Collect per-backend metrics, capped at top MAX_BACKENDS_IN_SNAPSHOT by total connections
+        let mut backend_entries: Vec<(String, BackendMetrics)> = Vec::new();
+        for entry in self.backend_total.iter() {
+            let key = entry.key().clone();
+            let total = entry.value().load(Ordering::Relaxed);
+            let active = self.backend_active
+                .get(&key)
+                .map(|c| c.load(Ordering::Relaxed))
+                .unwrap_or(0);
+            let protocol = self.backend_protocol
+                .get(&key)
+                .map(|v| v.value().clone())
+                .unwrap_or_else(|| "unknown".to_string());
+            let connect_errors = self.backend_connect_errors
+                .get(&key)
+                .map(|c| c.load(Ordering::Relaxed))
+                .unwrap_or(0);
+            let handshake_errors = self.backend_handshake_errors
+                .get(&key)
+                .map(|c| c.load(Ordering::Relaxed))
+                .unwrap_or(0);
+            let request_errors = self.backend_request_errors
+                .get(&key)
+                .map(|c| c.load(Ordering::Relaxed))
+                .unwrap_or(0);
+            let total_connect_time_us = self.backend_connect_time_us
+                .get(&key)
+                .map(|c| c.load(Ordering::Relaxed))
+                .unwrap_or(0);
+            let connect_count = self.backend_connect_count
+                .get(&key)
+                .map(|c| c.load(Ordering::Relaxed))
+                .unwrap_or(0);
+            let pool_hits = self.backend_pool_hits
+                .get(&key)
+                .map(|c| c.load(Ordering::Relaxed))
+                .unwrap_or(0);
+            let pool_misses = self.backend_pool_misses
+                .get(&key)
+                .map(|c| c.load(Ordering::Relaxed))
+                .unwrap_or(0);
+            let h2_failures = self.backend_h2_failures
+                .get(&key)
+                .map(|c| c.load(Ordering::Relaxed))
+                .unwrap_or(0);
+
+            backend_entries.push((key, BackendMetrics {
+                active_connections: active,
+                total_connections: total,
+                protocol,
+                connect_errors,
+                handshake_errors,
+                request_errors,
+                total_connect_time_us,
+                connect_count,
+                pool_hits,
+                pool_misses,
+                h2_failures,
+            }));
+        }
+        // Sort by total connections descending, then cap
+        backend_entries.sort_by(|a, b| b.1.total_connections.cmp(&a.1.total_connections));
+        backend_entries.truncate(MAX_BACKENDS_IN_SNAPSHOT);
+
+        let backends: std::collections::HashMap<String, BackendMetrics> = backend_entries.into_iter().collect();
+
         // HTTP request rates
         let (http_rps, http_rps_recent) = self.http_request_throughput
             .lock()
@@ -509,6 +728,7 @@ impl MetricsCollector {
             throughput_recent_out_bytes_per_sec: global_recent_out,
             routes,
             ips,
+            backends,
             throughput_history,
             total_http_requests: self.total_http_requests.load(Ordering::Relaxed),
             http_requests_per_sec: http_rps,
@@ -805,4 +1025,120 @@ mod tests {
         assert_eq!(snapshot.throughput_history[0].bytes_in, 100);
         assert_eq!(snapshot.throughput_history[4].bytes_in, 500);
     }
+
+    #[test]
+    fn test_backend_metrics_basic() {
+        let collector = MetricsCollector::new();
+        let key = "backend1:8080";
+
+        // Open connections with timing
+        collector.backend_connection_opened(key, Duration::from_millis(15));
+        collector.backend_connection_opened(key, Duration::from_millis(25));
+
+        assert_eq!(collector.backend_active.get(key).unwrap().load(Ordering::Relaxed), 2);
+        assert_eq!(collector.backend_total.get(key).unwrap().load(Ordering::Relaxed), 2);
+        assert_eq!(collector.backend_connect_count.get(key).unwrap().load(Ordering::Relaxed), 2);
+        // 15ms + 25ms = 40ms = 40_000us
+        assert_eq!(collector.backend_connect_time_us.get(key).unwrap().load(Ordering::Relaxed), 40_000);
+
+        // Close one
+        collector.backend_connection_closed(key);
+        assert_eq!(collector.backend_active.get(key).unwrap().load(Ordering::Relaxed), 1);
+        // total stays
+        assert_eq!(collector.backend_total.get(key).unwrap().load(Ordering::Relaxed), 2);
+
+        // Record errors
+        collector.backend_connect_error(key);
+        collector.backend_handshake_error(key);
+        collector.backend_request_error(key);
+        collector.backend_h2_failure(key);
+        collector.backend_pool_hit(key);
+        collector.backend_pool_hit(key);
+        collector.backend_pool_miss(key);
+
+        assert_eq!(collector.backend_connect_errors.get(key).unwrap().load(Ordering::Relaxed), 1);
+        assert_eq!(collector.backend_handshake_errors.get(key).unwrap().load(Ordering::Relaxed), 1);
+        assert_eq!(collector.backend_request_errors.get(key).unwrap().load(Ordering::Relaxed), 1);
+        assert_eq!(collector.backend_h2_failures.get(key).unwrap().load(Ordering::Relaxed), 1);
+        assert_eq!(collector.backend_pool_hits.get(key).unwrap().load(Ordering::Relaxed), 2);
+        assert_eq!(collector.backend_pool_misses.get(key).unwrap().load(Ordering::Relaxed), 1);
+
+        // Protocol
+        collector.set_backend_protocol(key, "h1");
+        assert_eq!(collector.backend_protocol.get(key).unwrap().value(), "h1");
+        collector.set_backend_protocol(key, "h2");
+        assert_eq!(collector.backend_protocol.get(key).unwrap().value(), "h2");
+    }
+
+    #[test]
+    fn test_backend_metrics_in_snapshot() {
+        let collector = MetricsCollector::new();
+
+        collector.backend_connection_opened("b1:443", Duration::from_millis(10));
+        collector.backend_connection_opened("b2:8080", Duration::from_millis(20));
+        collector.set_backend_protocol("b1:443", "h2");
+        collector.set_backend_protocol("b2:8080", "h1");
+        collector.backend_connect_error("b1:443");
+
+        let snapshot = collector.snapshot();
+        assert_eq!(snapshot.backends.len(), 2);
+
+        let b1 = snapshot.backends.get("b1:443").unwrap();
+        assert_eq!(b1.active_connections, 1);
+        assert_eq!(b1.total_connections, 1);
+        assert_eq!(b1.protocol, "h2");
+        assert_eq!(b1.connect_errors, 1);
+        assert_eq!(b1.total_connect_time_us, 10_000);
+        assert_eq!(b1.connect_count, 1);
+
+        let b2 = snapshot.backends.get("b2:8080").unwrap();
+        assert_eq!(b2.protocol, "h1");
+        assert_eq!(b2.connect_errors, 0);
+    }
+
+    #[test]
+    fn test_retain_backends_prunes_stale() {
+        let collector = MetricsCollector::new();
+
+        collector.backend_connection_opened("active:443", Duration::from_millis(5));
+        collector.backend_connection_opened("stale:8080", Duration::from_millis(10));
+        collector.set_backend_protocol("active:443", "h1");
+        collector.set_backend_protocol("stale:8080", "h2");
+        collector.backend_connect_error("stale:8080");
+
+        let active = HashSet::from(["active:443".to_string()]);
+        collector.retain_backends(&active);
+
+        // active:443 should still exist
+        assert!(collector.backend_total.get("active:443").is_some());
+        assert!(collector.backend_protocol.get("active:443").is_some());
+
+        // stale:8080 should be fully removed
+        assert!(collector.backend_active.get("stale:8080").is_none());
+        assert!(collector.backend_total.get("stale:8080").is_none());
+        assert!(collector.backend_protocol.get("stale:8080").is_none());
+        assert!(collector.backend_connect_errors.get("stale:8080").is_none());
+        assert!(collector.backend_connect_time_us.get("stale:8080").is_none());
+        assert!(collector.backend_connect_count.get("stale:8080").is_none());
+        assert!(collector.backend_pool_hits.get("stale:8080").is_none());
+        assert!(collector.backend_pool_misses.get("stale:8080").is_none());
+        assert!(collector.backend_h2_failures.get("stale:8080").is_none());
+    }
+
+    #[test]
+    fn test_backend_connection_closed_saturates() {
+        let collector = MetricsCollector::new();
+        let key = "b:80";
+
+        // Close without opening — should not underflow
+        collector.backend_connection_closed(key);
+        // No entry created
+        assert!(collector.backend_active.get(key).is_none());
+
+        // Open one, close two — should saturate at 0
+        collector.backend_connection_opened(key, Duration::from_millis(1));
+        collector.backend_connection_closed(key);
+        collector.backend_connection_closed(key);
+        assert_eq!(collector.backend_active.get(key).unwrap().load(Ordering::Relaxed), 0);
+    }
 }

rust/crates/rustproxy-passthrough/src/tcp_listener.rs

@@ -1,6 +1,7 @@
 use std::collections::HashMap;
 use std::sync::Arc;
 use arc_swap::ArcSwap;
+use dashmap::DashMap;
 use tokio::net::TcpListener;
 use tokio_rustls::TlsAcceptor;
 use tokio_util::sync::CancellationToken;
@@ -162,14 +163,18 @@ pub struct TcpListenerManager {
     socket_handler_relay: Arc<std::sync::RwLock<Option<String>>>,
     /// Global connection semaphore — limits total simultaneous connections.
     conn_semaphore: Arc<tokio::sync::Semaphore>,
+    /// Per-route cancellation tokens (child of cancel_token).
+    /// When a route is removed, its token is cancelled, terminating all connections on that route.
+    route_cancels: Arc<DashMap<String, CancellationToken>>,
 }
 
 impl TcpListenerManager {
     pub fn new(route_manager: Arc<RouteManager>) -> Self {
         let metrics = Arc::new(MetricsCollector::new());
         let conn_config = ConnectionConfig::default();
+        let route_manager_swap = Arc::new(ArcSwap::from(route_manager));
         let mut http_proxy_svc = HttpProxyService::with_connect_timeout(
-            Arc::clone(&route_manager),
+            Arc::clone(&route_manager_swap),
             Arc::clone(&metrics),
             std::time::Duration::from_millis(conn_config.connection_timeout_ms),
         );
@@ -188,7 +193,7 @@ impl TcpListenerManager {
         let max_conns = conn_config.max_connections as usize;
         Self {
             listeners: HashMap::new(),
-            route_manager: Arc::new(ArcSwap::from(route_manager)),
+            route_manager: route_manager_swap,
             metrics,
             tls_configs: Arc::new(ArcSwap::from(Arc::new(HashMap::new()))),
             shared_tls_acceptor: Arc::new(ArcSwap::from(Arc::new(None))),
@@ -198,14 +203,16 @@ impl TcpListenerManager {
             cancel_token: CancellationToken::new(),
             socket_handler_relay: Arc::new(std::sync::RwLock::new(None)),
             conn_semaphore: Arc::new(tokio::sync::Semaphore::new(max_conns)),
+            route_cancels: Arc::new(DashMap::new()),
         }
     }
 
     /// Create with a metrics collector.
     pub fn with_metrics(route_manager: Arc<RouteManager>, metrics: Arc<MetricsCollector>) -> Self {
         let conn_config = ConnectionConfig::default();
+        let route_manager_swap = Arc::new(ArcSwap::from(route_manager));
         let mut http_proxy_svc = HttpProxyService::with_connect_timeout(
-            Arc::clone(&route_manager),
+            Arc::clone(&route_manager_swap),
             Arc::clone(&metrics),
             std::time::Duration::from_millis(conn_config.connection_timeout_ms),
         );
@@ -224,7 +231,7 @@ impl TcpListenerManager {
         let max_conns = conn_config.max_connections as usize;
         Self {
             listeners: HashMap::new(),
-            route_manager: Arc::new(ArcSwap::from(route_manager)),
+            route_manager: route_manager_swap,
             metrics,
             tls_configs: Arc::new(ArcSwap::from(Arc::new(HashMap::new()))),
             shared_tls_acceptor: Arc::new(ArcSwap::from(Arc::new(None))),
@@ -234,6 +241,7 @@ impl TcpListenerManager {
             cancel_token: CancellationToken::new(),
             socket_handler_relay: Arc::new(std::sync::RwLock::new(None)),
             conn_semaphore: Arc::new(tokio::sync::Semaphore::new(max_conns)),
+            route_cancels: Arc::new(DashMap::new()),
         }
     }
 
@@ -245,10 +253,9 @@ impl TcpListenerManager {
         ));
         self.conn_semaphore = Arc::new(tokio::sync::Semaphore::new(config.max_connections as usize));
 
-        // Rebuild http_proxy with updated timeouts
+        // Rebuild http_proxy with updated timeouts (shares the same ArcSwap<RouteManager>)
-        let rm = self.route_manager.load_full();
         let mut http_proxy_svc = HttpProxyService::with_connect_timeout(
-            rm,
+            Arc::clone(&self.route_manager),
             Arc::clone(&self.metrics),
             std::time::Duration::from_millis(config.connection_timeout_ms),
         );
@@ -317,12 +324,13 @@ impl TcpListenerManager {
         let cancel = self.cancel_token.clone();
         let relay = Arc::clone(&self.socket_handler_relay);
         let semaphore = Arc::clone(&self.conn_semaphore);
+        let route_cancels = Arc::clone(&self.route_cancels);
 
         let handle = tokio::spawn(async move {
             Self::accept_loop(
                 listener, port, route_manager_swap, metrics, tls_configs,
                 shared_tls_acceptor, http_proxy, conn_config, conn_tracker, cancel, relay,
-                semaphore,
+                semaphore, route_cancels,
             ).await;
         });
 
@@ -401,6 +409,20 @@ impl TcpListenerManager {
         self.route_manager.store(route_manager);
     }
 
+    /// Cancel connections on routes that no longer exist in the active set.
+    /// Existing connections on removed routes are terminated via their per-route CancellationToken.
+    pub fn invalidate_removed_routes(&self, active_route_ids: &std::collections::HashSet<String>) {
+        self.route_cancels.retain(|id, token| {
+            if active_route_ids.contains(id) {
+                true
+            } else {
+                info!("Cancelling connections for removed route '{}'", id);
+                token.cancel();
+                false // remove cancelled token from map
+            }
+        });
+    }
+
     /// Prune HTTP proxy caches for route IDs that are no longer active.
     pub fn prune_http_proxy_caches(&self, active_route_ids: &std::collections::HashSet<String>) {
         self.http_proxy.prune_stale_routes(active_route_ids);
@@ -430,6 +452,7 @@ impl TcpListenerManager {
         cancel: CancellationToken,
         socket_handler_relay: Arc<std::sync::RwLock<Option<String>>>,
         conn_semaphore: Arc<tokio::sync::Semaphore>,
+        route_cancels: Arc<DashMap<String, CancellationToken>>,
     ) {
         loop {
             tokio::select! {
@@ -484,6 +507,7 @@ impl TcpListenerManager {
                             let ct = Arc::clone(&conn_tracker);
                             let cn = cancel.clone();
                             let sr = Arc::clone(&socket_handler_relay);
+                            let rc = Arc::clone(&route_cancels);
                             debug!("Accepted connection from {} on port {}", peer_addr, port);
 
                             tokio::spawn(async move {
@@ -492,7 +516,7 @@ impl TcpListenerManager {
                                 // RAII guard ensures connection_closed is called on all paths
                                 let _ct_guard = ConnectionTrackerGuard::new(ct, ip);
                                 let result = Self::handle_connection(
-                                    stream, port, peer_addr, rm, m, tc, sa, hp, cc, cn, sr,
+                                    stream, port, peer_addr, rm, m, tc, sa, hp, cc, cn, sr, rc,
                                 ).await;
                                 if let Err(e) = result {
                                     debug!("Connection error from {}: {}", peer_addr, e);
@@ -522,6 +546,7 @@ impl TcpListenerManager {
         conn_config: Arc<ConnectionConfig>,
         cancel: CancellationToken,
         socket_handler_relay: Arc<std::sync::RwLock<Option<String>>>,
+        route_cancels: Arc<DashMap<String, CancellationToken>>,
     ) -> Result<(), Box<dyn std::error::Error + Send + Sync>> {
         use tokio::io::AsyncReadExt;
 
@@ -626,6 +651,14 @@ impl TcpListenerManager {
                         let target_port = target.port.resolve(port);
                         let route_id = quick_match.route.id.as_deref();
 
+                        // Resolve per-route cancel token (child of global cancel)
+                        let conn_cancel = match route_id {
+                            Some(id) => route_cancels.entry(id.to_string())
+                                .or_insert_with(|| cancel.child_token())
+                                .clone(),
+                            None => cancel.clone(),
+                        };
+
                         // Check route-level IP security
                         if let Some(ref security) = quick_match.route.security {
                             if !rustproxy_http::request_filter::RequestFilter::check_ip_security(
@@ -680,7 +713,7 @@ impl TcpListenerManager {
 
                             let (_bytes_in, _bytes_out) = forwarder::forward_bidirectional_with_timeouts(
                                 stream, backend_w, None,
-                                inactivity_timeout, max_lifetime, cancel,
+                                inactivity_timeout, max_lifetime, conn_cancel,
                                 Some(forwarder::ForwardMetricsCtx {
                                     collector: Arc::clone(&metrics),
                                     route_id: route_id.map(|s| s.to_string()),
@@ -690,7 +723,7 @@ impl TcpListenerManager {
                         } else {
                             let (_bytes_in, _bytes_out) = forwarder::forward_bidirectional_with_timeouts(
                                 stream, backend, None,
-                                inactivity_timeout, max_lifetime, cancel,
+                                inactivity_timeout, max_lifetime, conn_cancel,
                                 Some(forwarder::ForwardMetricsCtx {
                                     collector: Arc::clone(&metrics),
                                     route_id: route_id.map(|s| s.to_string()),
@@ -795,6 +828,16 @@ impl TcpListenerManager {
 
         let route_id = route_match.route.id.as_deref();
 
+        // Resolve per-route cancel token (child of global cancel).
+        // When this route is removed via updateRoutes, the token is cancelled,
+        // terminating all connections on this route.
+        let cancel = match route_id {
+            Some(id) => route_cancels.entry(id.to_string())
+                .or_insert_with(|| cancel.child_token())
+                .clone(),
+            None => cancel,
+        };
+
         // Check route-level IP security for passthrough connections
         if let Some(ref security) = route_match.route.security {
             if !rustproxy_http::request_filter::RequestFilter::check_ip_security(

rust/crates/rustproxy/src/lib.rs

@@ -603,6 +603,31 @@ impl RustProxy {
             .collect();
         self.metrics.retain_routes(&active_route_ids);
 
+        // Prune per-backend metrics for backends no longer in any route target.
+        // For PortSpec::Preserve routes, expand across all listening ports since
+        // the actual runtime port depends on the incoming connection.
+        let listening_ports = self.get_listening_ports();
+        let active_backends: HashSet<String> = routes.iter()
+            .filter_map(|r| r.action.targets.as_ref())
+            .flat_map(|targets| targets.iter())
+            .flat_map(|target| {
+                let hosts: Vec<String> = target.host.to_vec().into_iter().map(|s| s.to_string()).collect();
+                match &target.port {
+                    rustproxy_config::PortSpec::Fixed(p) => {
+                        hosts.into_iter().map(|h| format!("{}:{}", h, p)).collect::<Vec<_>>()
+                    }
+                    _ => {
+                        // Preserve/special: expand across all listening ports
+                        let lp = &listening_ports;
+                        hosts.into_iter()
+                            .flat_map(|h| lp.iter().map(move |p| format!("{}:{}", h, *p)))
+                            .collect::<Vec<_>>()
+                    }
+                }
+            })
+            .collect();
+        self.metrics.retain_backends(&active_backends);
+
         // Atomically swap the route table
         let new_manager = Arc::new(new_manager);
         self.route_table.store(Arc::clone(&new_manager));
@@ -610,6 +635,8 @@ impl RustProxy {
         // Update listener manager
         if let Some(ref mut listener) = self.listener_manager {
             listener.update_route_manager(Arc::clone(&new_manager));
+            // Cancel connections on routes that were removed or disabled
+            listener.invalidate_removed_routes(&active_route_ids);
             // Prune HTTP proxy caches (rate limiters, regex cache, round-robin counters)
             listener.prune_http_proxy_caches(&active_route_ids);
 

test/test.sni-requirement.node.ts

@@ -7,10 +7,15 @@
 import { expect, tap } from '@git.zone/tstest/tapbundle';
 import { SmartProxy } from '../ts/proxies/smart-proxy/index.js';
 import type { IRouteConfig } from '../ts/proxies/smart-proxy/models/route-types.js';
+import { findFreePorts } from './helpers/port-allocator.js';
 
-// Use unique high ports for each test to avoid conflicts
+let testPorts: number[];
-let testPort = 20000;
+let portIndex = 0;
-const getNextPort = () => testPort++;
+const getNextPort = () => testPorts[portIndex++];
+
+tap.test('setup - allocate ports', async () => {
+  testPorts = await findFreePorts(16);
+});
 
 // --------------------------------- Single Route, No Domain Restriction ---------------------------------
 

ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@push.rocks/smartproxy',
-  version: '25.9.0',
+  version: '25.10.4',
   description: 'A powerful proxy package with unified route-based configuration for high traffic management. Features include SSL/TLS support, flexible routing patterns, WebSocket handling, advanced security options, and automatic ACME certificate management.'
 }

ts/proxies/smart-proxy/models/metrics-types.ts

@@ -67,6 +67,13 @@ export interface IMetrics {
     connections(): number;
   };
   
+  // Backend metrics
+  backends: {
+    byBackend(): Map<string, IBackendMetrics>;
+    protocols(): Map<string, string>;
+    topByErrors(limit?: number): Array<{ backend: string; errors: number }>;
+  };
+
   // Performance metrics
   percentiles: {
     connectionDuration(): { p50: number; p95: number; p99: number };
@@ -98,6 +105,21 @@ export interface IMetricsConfig {
   prometheusPrefix: string;        // Default: smartproxy_
 }
 
+/**
+ * Per-backend metrics
+ */
+export interface IBackendMetrics {
+  protocol: string;
+  activeConnections: number;
+  totalConnections: number;
+  connectErrors: number;
+  handshakeErrors: number;
+  requestErrors: number;
+  avgConnectTimeMs: number;
+  poolHitRate: number;
+  h2Failures: number;
+}
+
 /**
  * Internal interface for connection byte tracking
  */

ts/proxies/smart-proxy/rust-metrics-adapter.ts

@@ -1,4 +1,4 @@
-import type { IMetrics, IThroughputData, IThroughputHistoryPoint } from './models/metrics-types.js';
+import type { IMetrics, IBackendMetrics, IThroughputData, IThroughputHistoryPoint } from './models/metrics-types.js';
 import type { RustProxyBridge } from './rust-proxy-bridge.js';
 
 /**
@@ -169,6 +169,55 @@ export class RustMetricsAdapter implements IMetrics {
     },
   };
 
+  public backends = {
+    byBackend: (): Map<string, IBackendMetrics> => {
+      const result = new Map<string, IBackendMetrics>();
+      if (this.cache?.backends) {
+        for (const [key, bm] of Object.entries(this.cache.backends)) {
+          const m = bm as any;
+          const totalTimeUs = m.totalConnectTimeUs ?? 0;
+          const count = m.connectCount ?? 0;
+          const poolHits = m.poolHits ?? 0;
+          const poolMisses = m.poolMisses ?? 0;
+          const poolTotal = poolHits + poolMisses;
+          result.set(key, {
+            protocol: m.protocol ?? 'unknown',
+            activeConnections: m.activeConnections ?? 0,
+            totalConnections: m.totalConnections ?? 0,
+            connectErrors: m.connectErrors ?? 0,
+            handshakeErrors: m.handshakeErrors ?? 0,
+            requestErrors: m.requestErrors ?? 0,
+            avgConnectTimeMs: count > 0 ? (totalTimeUs / count) / 1000 : 0,
+            poolHitRate: poolTotal > 0 ? poolHits / poolTotal : 0,
+            h2Failures: m.h2Failures ?? 0,
+          });
+        }
+      }
+      return result;
+    },
+    protocols: (): Map<string, string> => {
+      const result = new Map<string, string>();
+      if (this.cache?.backends) {
+        for (const [key, bm] of Object.entries(this.cache.backends)) {
+          result.set(key, (bm as any).protocol ?? 'unknown');
+        }
+      }
+      return result;
+    },
+    topByErrors: (limit: number = 10): Array<{ backend: string; errors: number }> => {
+      const result: Array<{ backend: string; errors: number }> = [];
+      if (this.cache?.backends) {
+        for (const [key, bm] of Object.entries(this.cache.backends)) {
+          const m = bm as any;
+          const errors = (m.connectErrors ?? 0) + (m.handshakeErrors ?? 0) + (m.requestErrors ?? 0);
+          if (errors > 0) result.push({ backend: key, errors });
+        }
+      }
+      result.sort((a, b) => b.errors - a.errors);
+      return result.slice(0, limit);
+    },
+  };
+
   public percentiles = {
     connectionDuration: (): { p50: number; p95: number; p99: number } => {
       return { p50: 0, p95: 0, p99: 0 };