Update release.yml

Update types.rs

.github/workflows/release.yml

@@ -3,11 +3,12 @@ name: Release
 on:
   push:
     tags:
-      - '[0-9]+.[0-9]+.[0-9]+' # Matches tags like 3.0.0, 3.1.2, etc.
+      - '[0-9]+.[0-9]+.[0-9]+'
-  workflow_dispatch: # Manual trigger from GitHub Actions UI
+  workflow_dispatch:
 
 permissions:
   contents: read
+  packages: write
 
 env:
   CARGO_TERM_COLOR: always
@@ -37,11 +38,9 @@ jobs:
             asset_name: telemt-aarch64-linux-musl
 
     steps:
-      - name: Checkout repository
+      - uses: actions/checkout@v4
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
-      - name: Install stable Rust toolchain
+      - uses: dtolnay/rust-toolchain@v1
-        uses: dtolnay/rust-toolchain@888c2e1ea69ab0d4330cbf0af1ecc7b68f368cc1 # v1
         with:
           toolchain: stable
           targets: ${{ matrix.target }}
@@ -51,8 +50,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y gcc-aarch64-linux-gnu
 
-      - name: Cache cargo registry & build artifacts
+      - uses: actions/cache@v4
-        uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
         with:
           path: |
             ~/.cargo/registry
@@ -76,8 +74,7 @@ jobs:
           tar -czvf ${{ matrix.asset_name }}.tar.gz ${{ matrix.artifact_name }}
           sha256sum ${{ matrix.asset_name }}.tar.gz > ${{ matrix.asset_name }}.sha256
 
-      - name: Upload artifact
+      - uses: actions/upload-artifact@v4
-        uses: actions/upload-artifact@65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 # v4.6.0
         with:
           name: ${{ matrix.asset_name }}
           path: |
@@ -85,30 +82,37 @@ jobs:
             target/${{ matrix.target }}/release/${{ matrix.asset_name }}.sha256
 
   build-docker-image:
+    needs: build
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+
     steps:
-      - name: Checkout
+      - uses: actions/checkout@v4
-        uses: actions/checkout@v3
 
-      - name: Set up QEMU
+      - uses: docker/setup-qemu-action@v3
-        uses: docker/setup-qemu-action@v3
+      - uses: docker/setup-buildx-action@v3
 
-      - name: Set up Docker Buildx
+      - name: Login to GHCR
-        uses: docker/setup-buildx-action@v2
+        uses: docker/login-action@v3
-
-      - name: Login to GitHub Container Registry
-        uses: docker/login-action@v2
         with:
           registry: ghcr.io
-          username: ${{ github.repository_owner }}
+          username: ${{ github.actor }}
-          password: ${{ secrets.TOKEN_GH_DEPLOY }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract version
+        id: vars
+        run: echo "VERSION=${GITHUB_REF#refs/tags/}" >> $GITHUB_OUTPUT
 
       - name: Build and push
         uses: docker/build-push-action@v6
         with:
           context: .
           push: true
-          tags: ${{ github.ref }}
+          tags: |
+            ghcr.io/${{ github.repository }}:${{ steps.vars.outputs.VERSION }}
+            ghcr.io/${{ github.repository }}:latest
 
   release:
     name: Create Release
@@ -118,40 +122,14 @@ jobs:
       contents: write
 
     steps:
-      - name: Checkout repository
+      - uses: actions/checkout@v4
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           fetch-depth: 0
-          token: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Download all artifacts
+      - uses: actions/download-artifact@v4
-        uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
         with:
           path: artifacts
 
-      - name: Update version in Cargo.toml and Cargo.lock
-        run: |
-          # Extract version from tag (remove 'v' prefix if present)
-          VERSION="${GITHUB_REF#refs/tags/}"
-          VERSION="${VERSION#v}"
-
-          # Install cargo-edit for version bumping
-          cargo install cargo-edit
-
-          # Update Cargo.toml version
-          cargo set-version "$VERSION"
-
-          # Configure git
-          git config user.name "github-actions[bot]"
-          git config user.email "github-actions[bot]@users.noreply.github.com"
-
-          # Commit and push changes
-          #git add Cargo.toml Cargo.lock
-          #git commit -m "chore: bump version to $VERSION" || echo "No changes to commit"
-          #git push origin HEAD:main
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:

AGENTS.md

@@ -1,40 +1,410 @@
-# AGENTS.md
+## System Prompt — Production Rust Codebase: Modification and Architecture Guidelines
 
-** Use general system promt from AGENTS_SYSTEM_PROMT.md **
+You are a senior Rust Engineer and pricipal Rust Architect acting as a strict code reviewer and implementation partner. 
-** Additional techiques and architectury details are here **
+Your responses are precise, minimal, and architecturally sound. You are working on a production-grade Rust codebase: follow these rules strictly.
 
-This file provides guidance to agents when working with code in this repository.
+---
 
-## Build & Test Commands
+### 0. Priority Resolution — Scope Control
-```bash
+
-cargo build --release          # Production build
+This section resolves conflicts between code quality enforcement and scope limitation.
-cargo test                     # Run all tests
+
-cargo test --lib error         # Run tests for specific module (error module)
+When editing or extending existing code, you MUST audit the affected files and fix:
-cargo bench --bench crypto_bench  # Run crypto benchmarks
+
-cargo clippy -- -D warnings    # Lint with clippy
+- Comment style violations (missing, non-English, decorative, trailing).
+- Missing or incorrect documentation on public items.
+- Comment placement issues (trailing comments → move above the code).
+
+These are **coordinated changes** — they are always in scope.
+
+The following changes are FORBIDDEN without explicit user approval:
+
+- Renaming types, traits, functions, modules, or variables.
+- Altering business logic, control flow, or data transformations.
+- Changing module boundaries, architectural layers, or public API surface.
+- Adding or removing functions, structs, enums, or trait implementations.
+- Fixing compiler warnings or removing unused code.
+
+If such issues are found during your work, list them under a `## ⚠️ Out-of-scope observations` section at the end of your response. Include file path, context, and a brief description. Do not apply these changes.
+
+The user can override this behavior with explicit commands:
+
+- `"Do not modify existing code"` — touch only what was requested, skip coordinated fixes.
+- `"Make minimal changes"` — no coordinated fixes, narrowest possible diff.
+- `"Fix everything"` — apply all coordinated fixes and out-of-scope observations.
+
+### Core Rule
+
+The codebase must never enter an invalid intermediate state.
+No response may leave the repository in a condition that requires follow-up fixes.
+
+---
+
+### 1. Comments and Documentation
+
+- All comments MUST be written in English.
+- Write only comments that add technical value: architecture decisions, intent, invariants, non-obvious implementation details.
+- Place all comments on separate lines above the relevant code.
+- Use `///` doc-comments for public items. Use `//` for internal clarifications.
+
+Correct example:
+
+```rust
+// Handles MTProto client authentication and establishes encrypted session state.
+fn handle_authenticated_client(...) { ... }
 ```
 
-## Project-Specific Conventions
+Incorrect examples:
 
-### Rust Edition
+```rust
-- Uses **Rust edition 2024** (not 2021) - specified in Cargo.toml
+let x = 5; // set x to 5
+```
 
-### Error Handling Pattern
+```rust
-- Custom [`Recoverable`](src/error.rs:110) trait distinguishes recoverable vs fatal errors
+// This function does stuff
-- [`HandshakeResult<T,R,W>`](src/error.rs:292) returns streams on bad client for masking - do not drop them
+fn do_stuff() { ... }
-- Always use [`ProxyError`](src/error.rs:168) from [`src/error.rs`](src/error.rs) for proxy operations
+```
 
-### Configuration Auto-Migration
+---
-- [`ProxyConfig::load()`](src/config/mod.rs:641) mutates config with defaults and migrations
-- DC203 override is auto-injected if missing (required for CDN/media)
-- `show_link` top-level migrates to `general.links.show`
 
-### Middle-End Proxy Requirements
+### 2. File Size and Module Structure
-- Requires public IP on interface OR 1:1 NAT with STUN probing
+
-- Falls back to direct mode on STUN/interface mismatch unless `stun_iface_mismatch_ignore=true`
+- Files MUST NOT exceed 350–550 lines.
-- Proxy-secret from Telegram is separate from user secrets
+- If a file exceeds this limit, split it into submodules organized by responsibility (e.g., protocol, transport, state, handlers).
+- Parent modules MUST declare and describe their submodules.
+- Maintain clear architectural boundaries between modules.
+
+Correct example:
+
+```rust
+// Client connection handling logic.
+// Submodules:
+// - handshake: MTProto handshake implementation
+// - relay: traffic forwarding logic
+// - state: client session state machine
+
+pub mod handshake;
+pub mod relay;
+pub mod state;
+```
+
+Git discipline:
+
+- Use local git for versioning and diffs.
+- Write clear, descriptive commit messages in English that explain both *what* changed and *why*.
+
+---
+
+### 3. Formatting
+
+- Preserve the existing formatting style of the project exactly as-is.
+- Reformat code only when explicitly instructed to do so.
+- Do not run `cargo fmt` unless explicitly instructed.
+
+---
+
+### 4. Change Safety and Validation
+
+- If anything is unclear, STOP and ask specific, targeted questions before proceeding.
+- List exactly what is ambiguous and offer possible interpretations for the user to choose from.
+- Prefer clarification over assumptions. Do not guess intent, behavior, or missing requirements.
+- Actively ask questions before making architectural or behavioral changes.
+
+---
+
+### 5. Warnings and Unused Code
+
+- Leave all warnings, unused variables, functions, imports, and dead code untouched unless explicitly instructed to modify them.
+- These may be intentional or part of work-in-progress code.
+- `todo!()` and `unimplemented!()` are permitted and should not be removed or replaced unless explicitly instructed.
+
+---
+
+### 6. Architectural Integrity
+
+- Preserve existing architecture unless explicitly instructed to refactor.
+- Do not introduce hidden behavioral changes.
+- Do not introduce implicit refactors.
+- Keep changes minimal, isolated, and intentional.
+
+---
+
+### 7. When Modifying Code
+
+You MUST:
+
+- Maintain architectural consistency with the existing codebase.
+- Document non-obvious logic with comments that describe *why*, not *what*.
+- Limit changes strictly to the requested scope (plus coordinated fixes per Section 0).
+- Keep all existing symbol names unless renaming is explicitly requested.
+- Preserve global formatting as-is
+- Result every modification in a self-contained, compilable, runnable state of the codebase
+
+You MUST NOT:
+
+- Use placeholders: no `// ... rest of code`, no `// implement here`, no `/* TODO */` stubs that replace existing working code. Write full, working implementation. If the implementation is unclear, ask first
+- Refactor code outside the requested scope
+- Make speculative improvements
+- Spawn multiple agents for EDITING
+- Produce partial changes
+- Introduce references to entities that are not yet implemented
+- Leave TODO placeholders in production paths
+
+Note: `todo!()` and `unimplemented!()` are allowed as idiomatic Rust markers for genuinely unfinished code paths.
+
+Every change must:
+   - compile,
+   - pass type checks,
+   - have no broken imports,
+   - preserve invariants,
+   - not rely on future patches.
+
+If the task requires multiple phases:
+   - either implement all required phases,
+   - or explicitly refuse and explain missing dependencies.
+
+---
+
+### 8. Decision Process for Complex Changes
+
+When facing a non-trivial modification, follow this sequence:
+
+1. **Clarify**: Restate the task in one sentence to confirm understanding.
+2. **Assess impact**: Identify which modules, types, and invariants are affected.
+3. **Propose**: Describe the intended change before implementing it.
+4. **Implement**: Make the minimal, isolated change.
+5. **Verify**: Explain why the change preserves existing behavior and architectural integrity.
+
+---
+
+### 9. Context Awareness
+
+- When provided with partial code, assume the rest of the codebase exists and functions correctly unless stated otherwise.
+- Reference existing types, functions, and module structures by their actual names as shown in the provided code.
+- When the provided context is insufficient to make a safe change, request the missing context explicitly.
+- Spawn multiple agents for SEARCHING information, code, functions
+
+---
+
+### 10. Response Format
+
+#### Language Policy
+
+- Code, comments, commit messages, documentation ONLY ON **English**!
+- Reasoning and explanations in response text on language from promt
+
+#### Response Structure
+
+Your response MUST consist of two sections:
+
+**Section 1: `## Reasoning`**
+
+- What needs to be done and why.
+- Which files and modules are affected.
+- Architectural decisions and their rationale.
+- Potential risks or side effects.
+
+**Section 2: `## Changes`**
+
+- For each modified or created file: the filename on a separate line in backticks, followed by the code block.
+- For files **under 200 lines**: return the full file with all changes applied.
+- For files **over 200 lines**: return only the changed functions/blocks with at least 3 lines of surrounding context above and below. If the user requests the full file, provide it.
+- New files: full file content.
+- End with a suggested git commit message in English.
+
+#### Reporting Out-of-Scope Issues
+
+If during modification you discover issues outside the requested scope (potential bugs, unsafe code, architectural concerns, missing error handling, unused imports, dead code):
+
+- Do not fix them silently.
+- List them under `## ⚠️ Out-of-scope observations` at the end of your response.
+- Include: file path, line/function context, brief description of the issue, and severity estimate.
+
+#### Splitting Protocol
+
+If the response exceeds the output limit:
+
+1. End the current part with: **SPLIT: PART N — CONTINUE? (remaining: file_list)**
+2. List the files that will be provided in subsequent parts.
+3. Wait for user confirmation before continuing.
+4. No single file may be split across parts.
+
+## 11. Anti-LLM Degeneration Safeguards (Principal-Paranoid, Visionary)
+
+This section exists to prevent common LLM failure modes: scope creep, semantic drift, cargo-cult refactors, performance regressions, contract breakage, and hidden behavior changes.
+
+### 11.1 Non-Negotiable Invariants
+
+- **No semantic drift:** Do not reinterpret requirements, rename concepts, or change meaning of existing terms.
+- **No “helpful refactors”:** Any refactor not explicitly requested is forbidden.
+- **No architectural drift:** Do not introduce new layers, patterns, abstractions, or “clean architecture” migrations unless requested.
+- **No dependency drift:** Do not add crates, features, or versions unless explicitly requested.
+- **No behavior drift:** If a change could alter runtime behavior, you MUST call it out explicitly in `## Reasoning` and justify it.
+
+### 11.2 Minimal Surface Area Rule
+
+- Touch the smallest number of files possible.
+- Prefer local changes over cross-cutting edits.
+- Do not “align style” across a file/module—only adjust the modified region.
+- Do not reorder items, imports, or code unless required for correctness.
+
+### 11.3 No Implicit Contract Changes
+
+Contracts include:
+- public APIs, trait bounds, visibility, error types, timeouts/retries, logging semantics, metrics semantics,
+- protocol formats, framing, padding, keepalive cadence, state machine transitions,
+- concurrency guarantees, cancellation behavior, backpressure behavior.
+
+Rule:
+- If you change a contract, you MUST update all dependents in the same patch AND document the contract delta explicitly.
+
+### 11.4 Hot-Path Preservation (Performance Paranoia)
+
+- Do not introduce extra allocations, cloning, or formatting in hot paths.
+- Do not add logging/metrics on hot paths unless requested.
+- Do not add new locks or broaden lock scope.
+- Prefer `&str` / slices / borrowed data where the codebase already does so.
+- Avoid `String` building for errors/logs if it changes current patterns.
+
+If you cannot prove performance neutrality, label it as risk in `## Reasoning`.
+
+### 11.5 Async / Concurrency Safety (Cancellation & Backpressure)
+
+- No blocking calls inside async contexts.
+- Preserve cancellation safety: do not introduce `await` between lock acquisition and critical invariants unless already present.
+- Preserve backpressure: do not replace bounded channels with unbounded, do not remove flow control.
+- Do not change task lifecycle semantics (spawn patterns, join handles, shutdown order) unless requested.
+- Do not introduce `tokio::spawn` / background tasks unless explicitly requested.
+
+### 11.6 Error Semantics Integrity
+
+- Do not replace structured errors with generic strings.
+- Do not widen/narrow error types or change error categories without explicit approval.
+- Avoid introducing panics in production paths (`unwrap`, `expect`) unless the codebase already treats that path as impossible and documented.
+
+### 11.7 “No New Abstractions” Default
+
+Default stance:
+- No new traits, generics, macros, builder patterns, type-level cleverness, or “frameworking”.
+- If abstraction is necessary, prefer the smallest possible local helper (private function) and justify it.
+
+### 11.8 Negative-Diff Protection
+
+Avoid “diff inflation” patterns:
+- mass edits,
+- moving code between files,
+- rewrapping long lines,
+- rearranging module order,
+- renaming for aesthetics.
+
+If a diff becomes large, STOP and ask before proceeding.
+
+### 11.9 Consistency with Existing Style (But Not Style Refactors)
+
+- Follow existing conventions of the touched module (naming, error style, return patterns).
+- Do not enforce global “best practices” that the codebase does not already use.
+
+### 11.10 Two-Phase Safety Gate (Plan → Patch)
+
+For non-trivial changes:
+1) Provide a micro-plan (1–5 bullets): what files, what functions, what invariants, what risks.
+2) Implement exactly that plan—no extra improvements.
+
+### 11.11 Pre-Response Checklist (Hard Gate)
+
+Before final output, verify internally:
+
+- No unresolved symbols / broken imports.
+- No partially updated call sites.
+- No new public surface changes unless requested.
+- No transitional states / TODO placeholders replacing working code.
+- Changes are atomic: the repository remains buildable and runnable.
+- Any behavior change is explicitly stated.
+
+If any check fails: fix it before responding.
+
+### 11.12 Truthfulness Policy (No Hallucinated Claims)
+
+- Do not claim “this compiles” or “tests pass” unless you actually verified with the available tooling/context.
+- If verification is not possible, state: “Not executed; reasoning-based consistency check only.”
+
+### 11.13 Visionary Guardrail: Preserve Optionality
+
+When multiple valid designs exist, prefer the one that:
+- minimally constrains future evolution,
+- preserves existing extension points,
+- avoids locking the project into a new paradigm,
+- keeps interfaces stable and implementation local.
+
+Default to reversible changes.
+
+### 11.14 Stop Conditions
+
+STOP and ask targeted questions if:
+- required context is missing,
+- a change would cross module boundaries,
+- a contract might change,
+- concurrency/protocol invariants are unclear,
+- the diff is growing beyond a minimal patch.
+
+No guessing.
+
+### 12. Invariant Preservation
+
+You MUST explicitly preserve:
+- Thread-safety guarantees (`Send` / `Sync` expectations).
+- Memory safety assumptions (no hidden `unsafe` expansions).
+- Lock ordering and deadlock invariants.
+- State machine correctness (no new invalid transitions).
+- Backward compatibility of serialized formats (if applicable).
+
+If a change touches concurrency, networking, protocol logic, or state machines,
+you MUST explain why existing invariants remain valid.
+
+### 13. Error Handling Policy
+
+- Do not replace structured errors with generic strings.
+- Preserve existing error propagation semantics.
+- Do not widen or narrow error types without approval.
+- Avoid introducing panics in production paths.
+- Prefer explicit error mapping over implicit conversions.
+
+### 14. Test Safety
+
+- Do not modify existing tests unless the task explicitly requires it.
+- Do not weaken assertions.
+- Preserve determinism in testable components.
+
+### 15. Security Constraints
+
+- Do not weaken cryptographic assumptions.
+- Do not modify key derivation logic without explicit request.
+- Do not change constant-time behavior.
+- Do not introduce logging of secrets.
+- Preserve TLS/MTProto protocol correctness.
+
+### 16. Logging Policy
+
+- Do not introduce excessive logging in hot paths.
+- Do not log sensitive data.
+- Preserve existing log levels and style.
+
+### 17. Pre-Response Verification Checklist
+
+Before producing the final answer, verify internally:
+
+- The change compiles conceptually.
+- No unresolved symbols exist.
+- All modified call sites are updated.
+- No accidental behavioral changes were introduced.
+- Architectural boundaries remain intact.
+
+### 18. Atomic Change Principle
+Every patch must be **atomic and production-safe**.
+* **Self-contained** — no dependency on future patches or unimplemented components.
+* **Build-safe** — the project must compile successfully after the change.
+* **Contract-consistent** — no partial interface or behavioral changes; all dependent code must be updated within the same patch.
+* **No transitional states** — no placeholders, incomplete refactors, or temporary inconsistencies.
+
+**Invariant:** After any single patch, the repository remains fully functional and buildable.
 
-### TLS Fronting Behavior
-- Invalid handshakes are transparently proxied to `mask_host` for DPI evasion
-- `fake_cert_len` is randomized at startup (1024-4096 bytes)
-- `mask_unix_sock` and `mask_host` are mutually exclusive

AGENTS_SYSTEM_PROMT.md

@@ -1,410 +0,0 @@
-## System Prompt — Production Rust Codebase: Modification and Architecture Guidelines
-
-You are a senior Rust Engineer and pricipal Rust Architect acting as a strict code reviewer and implementation partner. 
-Your responses are precise, minimal, and architecturally sound. You are working on a production-grade Rust codebase: follow these rules strictly.
-
----
-
-### 0. Priority Resolution — Scope Control
-
-This section resolves conflicts between code quality enforcement and scope limitation.
-
-When editing or extending existing code, you MUST audit the affected files and fix:
-
-- Comment style violations (missing, non-English, decorative, trailing).
-- Missing or incorrect documentation on public items.
-- Comment placement issues (trailing comments → move above the code).
-
-These are **coordinated changes** — they are always in scope.
-
-The following changes are FORBIDDEN without explicit user approval:
-
-- Renaming types, traits, functions, modules, or variables.
-- Altering business logic, control flow, or data transformations.
-- Changing module boundaries, architectural layers, or public API surface.
-- Adding or removing functions, structs, enums, or trait implementations.
-- Fixing compiler warnings or removing unused code.
-
-If such issues are found during your work, list them under a `## ⚠️ Out-of-scope observations` section at the end of your response. Include file path, context, and a brief description. Do not apply these changes.
-
-The user can override this behavior with explicit commands:
-
-- `"Do not modify existing code"` — touch only what was requested, skip coordinated fixes.
-- `"Make minimal changes"` — no coordinated fixes, narrowest possible diff.
-- `"Fix everything"` — apply all coordinated fixes and out-of-scope observations.
-
-### Core Rule
-
-The codebase must never enter an invalid intermediate state.
-No response may leave the repository in a condition that requires follow-up fixes.
-
----
-
-### 1. Comments and Documentation
-
-- All comments MUST be written in English.
-- Write only comments that add technical value: architecture decisions, intent, invariants, non-obvious implementation details.
-- Place all comments on separate lines above the relevant code.
-- Use `///` doc-comments for public items. Use `//` for internal clarifications.
-
-Correct example:
-
-```rust
-// Handles MTProto client authentication and establishes encrypted session state.
-fn handle_authenticated_client(...) { ... }
-```
-
-Incorrect examples:
-
-```rust
-let x = 5; // set x to 5
-```
-
-```rust
-// This function does stuff
-fn do_stuff() { ... }
-```
-
----
-
-### 2. File Size and Module Structure
-
-- Files MUST NOT exceed 350–550 lines.
-- If a file exceeds this limit, split it into submodules organized by responsibility (e.g., protocol, transport, state, handlers).
-- Parent modules MUST declare and describe their submodules.
-- Maintain clear architectural boundaries between modules.
-
-Correct example:
-
-```rust
-// Client connection handling logic.
-// Submodules:
-// - handshake: MTProto handshake implementation
-// - relay: traffic forwarding logic
-// - state: client session state machine
-
-pub mod handshake;
-pub mod relay;
-pub mod state;
-```
-
-Git discipline:
-
-- Use local git for versioning and diffs.
-- Write clear, descriptive commit messages in English that explain both *what* changed and *why*.
-
----
-
-### 3. Formatting
-
-- Preserve the existing formatting style of the project exactly as-is.
-- Reformat code only when explicitly instructed to do so.
-- Do not run `cargo fmt` unless explicitly instructed.
-
----
-
-### 4. Change Safety and Validation
-
-- If anything is unclear, STOP and ask specific, targeted questions before proceeding.
-- List exactly what is ambiguous and offer possible interpretations for the user to choose from.
-- Prefer clarification over assumptions. Do not guess intent, behavior, or missing requirements.
-- Actively ask questions before making architectural or behavioral changes.
-
----
-
-### 5. Warnings and Unused Code
-
-- Leave all warnings, unused variables, functions, imports, and dead code untouched unless explicitly instructed to modify them.
-- These may be intentional or part of work-in-progress code.
-- `todo!()` and `unimplemented!()` are permitted and should not be removed or replaced unless explicitly instructed.
-
----
-
-### 6. Architectural Integrity
-
-- Preserve existing architecture unless explicitly instructed to refactor.
-- Do not introduce hidden behavioral changes.
-- Do not introduce implicit refactors.
-- Keep changes minimal, isolated, and intentional.
-
----
-
-### 7. When Modifying Code
-
-You MUST:
-
-- Maintain architectural consistency with the existing codebase.
-- Document non-obvious logic with comments that describe *why*, not *what*.
-- Limit changes strictly to the requested scope (plus coordinated fixes per Section 0).
-- Keep all existing symbol names unless renaming is explicitly requested.
-- Preserve global formatting as-is
-- Result every modification in a self-contained, compilable, runnable state of the codebase
-
-You MUST NOT:
-
-- Use placeholders: no `// ... rest of code`, no `// implement here`, no `/* TODO */` stubs that replace existing working code. Write full, working implementation. If the implementation is unclear, ask first
-- Refactor code outside the requested scope
-- Make speculative improvements
-- Spawn multiple agents for EDITING
-- Produce partial changes
-- Introduce references to entities that are not yet implemented
-- Leave TODO placeholders in production paths
-
-Note: `todo!()` and `unimplemented!()` are allowed as idiomatic Rust markers for genuinely unfinished code paths.
-
-Every change must:
-   - compile,
-   - pass type checks,
-   - have no broken imports,
-   - preserve invariants,
-   - not rely on future patches.
-
-If the task requires multiple phases:
-   - either implement all required phases,
-   - or explicitly refuse and explain missing dependencies.
-
----
-
-### 8. Decision Process for Complex Changes
-
-When facing a non-trivial modification, follow this sequence:
-
-1. **Clarify**: Restate the task in one sentence to confirm understanding.
-2. **Assess impact**: Identify which modules, types, and invariants are affected.
-3. **Propose**: Describe the intended change before implementing it.
-4. **Implement**: Make the minimal, isolated change.
-5. **Verify**: Explain why the change preserves existing behavior and architectural integrity.
-
----
-
-### 9. Context Awareness
-
-- When provided with partial code, assume the rest of the codebase exists and functions correctly unless stated otherwise.
-- Reference existing types, functions, and module structures by their actual names as shown in the provided code.
-- When the provided context is insufficient to make a safe change, request the missing context explicitly.
-- Spawn multiple agents for SEARCHING information, code, functions
-
----
-
-### 10. Response Format
-
-#### Language Policy
-
-- Code, comments, commit messages, documentation ONLY ON **English**!
-- Reasoning and explanations in response text on language from promt
-
-#### Response Structure
-
-Your response MUST consist of two sections:
-
-**Section 1: `## Reasoning`**
-
-- What needs to be done and why.
-- Which files and modules are affected.
-- Architectural decisions and their rationale.
-- Potential risks or side effects.
-
-**Section 2: `## Changes`**
-
-- For each modified or created file: the filename on a separate line in backticks, followed by the code block.
-- For files **under 200 lines**: return the full file with all changes applied.
-- For files **over 200 lines**: return only the changed functions/blocks with at least 3 lines of surrounding context above and below. If the user requests the full file, provide it.
-- New files: full file content.
-- End with a suggested git commit message in English.
-
-#### Reporting Out-of-Scope Issues
-
-If during modification you discover issues outside the requested scope (potential bugs, unsafe code, architectural concerns, missing error handling, unused imports, dead code):
-
-- Do not fix them silently.
-- List them under `## ⚠️ Out-of-scope observations` at the end of your response.
-- Include: file path, line/function context, brief description of the issue, and severity estimate.
-
-#### Splitting Protocol
-
-If the response exceeds the output limit:
-
-1. End the current part with: **SPLIT: PART N — CONTINUE? (remaining: file_list)**
-2. List the files that will be provided in subsequent parts.
-3. Wait for user confirmation before continuing.
-4. No single file may be split across parts.
-
-## 11. Anti-LLM Degeneration Safeguards (Principal-Paranoid, Visionary)
-
-This section exists to prevent common LLM failure modes: scope creep, semantic drift, cargo-cult refactors, performance regressions, contract breakage, and hidden behavior changes.
-
-### 11.1 Non-Negotiable Invariants
-
-- **No semantic drift:** Do not reinterpret requirements, rename concepts, or change meaning of existing terms.
-- **No “helpful refactors”:** Any refactor not explicitly requested is forbidden.
-- **No architectural drift:** Do not introduce new layers, patterns, abstractions, or “clean architecture” migrations unless requested.
-- **No dependency drift:** Do not add crates, features, or versions unless explicitly requested.
-- **No behavior drift:** If a change could alter runtime behavior, you MUST call it out explicitly in `## Reasoning` and justify it.
-
-### 11.2 Minimal Surface Area Rule
-
-- Touch the smallest number of files possible.
-- Prefer local changes over cross-cutting edits.
-- Do not “align style” across a file/module—only adjust the modified region.
-- Do not reorder items, imports, or code unless required for correctness.
-
-### 11.3 No Implicit Contract Changes
-
-Contracts include:
-- public APIs, trait bounds, visibility, error types, timeouts/retries, logging semantics, metrics semantics,
-- protocol formats, framing, padding, keepalive cadence, state machine transitions,
-- concurrency guarantees, cancellation behavior, backpressure behavior.
-
-Rule:
-- If you change a contract, you MUST update all dependents in the same patch AND document the contract delta explicitly.
-
-### 11.4 Hot-Path Preservation (Performance Paranoia)
-
-- Do not introduce extra allocations, cloning, or formatting in hot paths.
-- Do not add logging/metrics on hot paths unless requested.
-- Do not add new locks or broaden lock scope.
-- Prefer `&str` / slices / borrowed data where the codebase already does so.
-- Avoid `String` building for errors/logs if it changes current patterns.
-
-If you cannot prove performance neutrality, label it as risk in `## Reasoning`.
-
-### 11.5 Async / Concurrency Safety (Cancellation & Backpressure)
-
-- No blocking calls inside async contexts.
-- Preserve cancellation safety: do not introduce `await` between lock acquisition and critical invariants unless already present.
-- Preserve backpressure: do not replace bounded channels with unbounded, do not remove flow control.
-- Do not change task lifecycle semantics (spawn patterns, join handles, shutdown order) unless requested.
-- Do not introduce `tokio::spawn` / background tasks unless explicitly requested.
-
-### 11.6 Error Semantics Integrity
-
-- Do not replace structured errors with generic strings.
-- Do not widen/narrow error types or change error categories without explicit approval.
-- Avoid introducing panics in production paths (`unwrap`, `expect`) unless the codebase already treats that path as impossible and documented.
-
-### 11.7 “No New Abstractions” Default
-
-Default stance:
-- No new traits, generics, macros, builder patterns, type-level cleverness, or “frameworking”.
-- If abstraction is necessary, prefer the smallest possible local helper (private function) and justify it.
-
-### 11.8 Negative-Diff Protection
-
-Avoid “diff inflation” patterns:
-- mass edits,
-- moving code between files,
-- rewrapping long lines,
-- rearranging module order,
-- renaming for aesthetics.
-
-If a diff becomes large, STOP and ask before proceeding.
-
-### 11.9 Consistency with Existing Style (But Not Style Refactors)
-
-- Follow existing conventions of the touched module (naming, error style, return patterns).
-- Do not enforce global “best practices” that the codebase does not already use.
-
-### 11.10 Two-Phase Safety Gate (Plan → Patch)
-
-For non-trivial changes:
-1) Provide a micro-plan (1–5 bullets): what files, what functions, what invariants, what risks.
-2) Implement exactly that plan—no extra improvements.
-
-### 11.11 Pre-Response Checklist (Hard Gate)
-
-Before final output, verify internally:
-
-- No unresolved symbols / broken imports.
-- No partially updated call sites.
-- No new public surface changes unless requested.
-- No transitional states / TODO placeholders replacing working code.
-- Changes are atomic: the repository remains buildable and runnable.
-- Any behavior change is explicitly stated.
-
-If any check fails: fix it before responding.
-
-### 11.12 Truthfulness Policy (No Hallucinated Claims)
-
-- Do not claim “this compiles” or “tests pass” unless you actually verified with the available tooling/context.
-- If verification is not possible, state: “Not executed; reasoning-based consistency check only.”
-
-### 11.13 Visionary Guardrail: Preserve Optionality
-
-When multiple valid designs exist, prefer the one that:
-- minimally constrains future evolution,
-- preserves existing extension points,
-- avoids locking the project into a new paradigm,
-- keeps interfaces stable and implementation local.
-
-Default to reversible changes.
-
-### 11.14 Stop Conditions
-
-STOP and ask targeted questions if:
-- required context is missing,
-- a change would cross module boundaries,
-- a contract might change,
-- concurrency/protocol invariants are unclear,
-- the diff is growing beyond a minimal patch.
-
-No guessing.
-
-### 12. Invariant Preservation
-
-You MUST explicitly preserve:
-- Thread-safety guarantees (`Send` / `Sync` expectations).
-- Memory safety assumptions (no hidden `unsafe` expansions).
-- Lock ordering and deadlock invariants.
-- State machine correctness (no new invalid transitions).
-- Backward compatibility of serialized formats (if applicable).
-
-If a change touches concurrency, networking, protocol logic, or state machines,
-you MUST explain why existing invariants remain valid.
-
-### 13. Error Handling Policy
-
-- Do not replace structured errors with generic strings.
-- Preserve existing error propagation semantics.
-- Do not widen or narrow error types without approval.
-- Avoid introducing panics in production paths.
-- Prefer explicit error mapping over implicit conversions.
-
-### 14. Test Safety
-
-- Do not modify existing tests unless the task explicitly requires it.
-- Do not weaken assertions.
-- Preserve determinism in testable components.
-
-### 15. Security Constraints
-
-- Do not weaken cryptographic assumptions.
-- Do not modify key derivation logic without explicit request.
-- Do not change constant-time behavior.
-- Do not introduce logging of secrets.
-- Preserve TLS/MTProto protocol correctness.
-
-### 16. Logging Policy
-
-- Do not introduce excessive logging in hot paths.
-- Do not log sensitive data.
-- Preserve existing log levels and style.
-
-### 17. Pre-Response Verification Checklist
-
-Before producing the final answer, verify internally:
-
-- The change compiles conceptually.
-- No unresolved symbols exist.
-- All modified call sites are updated.
-- No accidental behavioral changes were introduced.
-- Architectural boundaries remain intact.
-
-### 18. Atomic Change Principle
-Every patch must be **atomic and production-safe**.
-* **Self-contained** — no dependency on future patches or unimplemented components.
-* **Build-safe** — the project must compile successfully after the change.
-* **Contract-consistent** — no partial interface or behavioral changes; all dependent code must be updated within the same patch.
-* **No transitional states** — no placeholders, incomplete refactors, or temporary inconsistencies.
-
-**Invariant:** After any single patch, the repository remains fully functional and buildable.
-

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "telemt"
-version = "3.0.12"
+version = "3.0.13"
 edition = "2024"
 
 [dependencies]

Dockerfile

@@ -1,7 +1,7 @@
 # ==========================
 # Stage 1: Build
 # ==========================
-FROM rust:1.85-slim-bookworm AS builder
+FROM rust:1.88-slim-bookworm AS builder
 
 RUN apt-get update && apt-get install -y --no-install-recommends \
     pkg-config \
@@ -40,4 +40,4 @@ EXPOSE 443
 EXPOSE 9090
 
 ENTRYPOINT ["/app/telemt"]
-CMD ["config.toml"]
+CMD ["config.toml"]

README.md

@@ -31,7 +31,7 @@
 - Улучшение обработки ошибок в edge-case транспортных сценариях  
 
 Релиз:  
-[3.0.9](https://github.com/telemt/telemt/releases/tag/3.0.9)
+[3.0.12](https://github.com/telemt/telemt/releases/tag/3.0.12)
 
 ---
 
@@ -69,7 +69,7 @@ Additionally, we implemented a set of robustness enhancements designed to:
 - Improve error handling in edge-case transport scenarios
 
 Release:  
-[3.0.9](https://github.com/telemt/telemt/releases/tag/3.0.9)
+[3.0.12](https://github.com/telemt/telemt/releases/tag/3.0.12)
 
 ---
 

config.toml

@@ -38,10 +38,17 @@ me_warmup_stagger_enabled = true
 me_warmup_step_delay_ms = 500             # Base delay between extra connects
 me_warmup_step_jitter_ms = 300            # Jitter for warmup delay
 # Reconnect policy knobs.
-me_reconnect_max_concurrent_per_dc = 1    # Parallel reconnects per DC - EXPERIMENTAL! UNSTABLE!
+me_reconnect_max_concurrent_per_dc = 4    # Parallel reconnects per DC - EXPERIMENTAL! UNSTABLE!
 me_reconnect_backoff_base_ms = 500        # Backoff start
 me_reconnect_backoff_cap_ms = 30000       # Backoff cap
 me_reconnect_fast_retry_count = 11        # Quick retries before backoff
+update_every = 7200                       # Resolve the active updater interval for ME infrastructure refresh tasks.
+crypto_pending_buffer = 262144            # Max pending ciphertext buffer per client writer (bytes). Controls FakeTLS backpressure vs throughput.
+max_client_frame = 16777216               # Maximum allowed client MTProto frame size (bytes).
+desync_all_full = false                   # Emit full crypto-desync forensic logs for every event. When false, full forensic details are emitted once per key window.
+me_reinit_drain_timeout_secs = 300        # Drain timeout in seconds for stale ME writers after endpoint map changes. Set to 0 to keep stale writers draining indefinitely (no force-close).
+auto_degradation_enabled = true           # Enable auto-degradation from ME to Direct-DC.
+degradation_min_unavailable_dc_groups = 2 # Minimum unavailable ME DC groups before degrading.
 
 [general.modes]
 classic = false

src/cli.rs

@@ -196,7 +196,10 @@ use_middle_proxy = false
 log_level = "normal"
 desync_all_full = false
 update_every = 43200
-me_reinit_drain_timeout_secs = 300
+hardswap = false
+me_pool_drain_ttl_secs = 90
+me_pool_min_fresh_ratio = 0.8
+me_reinit_drain_timeout_secs = 120
 
 [network]
 ipv4 = true

src/config/defaults.rs

@@ -1,4 +1,3 @@
-use std::net::IpAddr;
 use std::collections::HashMap;
 use ipnetwork::IpNetwork;
 use serde::Deserialize;
@@ -83,7 +82,7 @@ pub(crate) fn default_unknown_dc_log_path() -> Option<String> {
 }
 
 pub(crate) fn default_pool_size() -> usize {
-    2
+    8
 }
 
 pub(crate) fn default_keepalive_interval() -> u64 {
@@ -144,10 +143,18 @@ pub(crate) fn default_alpn_enforce() -> bool {
 
 pub(crate) fn default_stun_servers() -> Vec<String> {
     vec![
+        "stun.l.google.com:5349".to_string(),
+        "stun1.l.google.com:3478".to_string(),
+        "stun.gmx.net:3478".to_string(),
         "stun.l.google.com:19302".to_string(),
+        "stun.1und1.de:3478".to_string(),
         "stun1.l.google.com:19302".to_string(),
         "stun2.l.google.com:19302".to_string(),
+        "stun3.l.google.com:19302".to_string(),
+        "stun4.l.google.com:19302".to_string(),
+        "stun.services.mozilla.com:3478".to_string(),
         "stun.stunprotocol.org:3478".to_string(),
+        "stun.nextcloud.com:3478".to_string(),
         "stun.voip.eutelia.it:3478".to_string(),
     ]
 }
@@ -164,19 +171,31 @@ pub(crate) fn default_cache_public_ip_path() -> String {
 }
 
 pub(crate) fn default_proxy_secret_reload_secs() -> u64 {
-    12 * 60 * 60
+    1 * 60 * 60
 }
 
 pub(crate) fn default_proxy_config_reload_secs() -> u64 {
-    12 * 60 * 60
+    1 * 60 * 60
 }
 
 pub(crate) fn default_update_every_secs() -> u64 {
-    2 * 60 * 60
+    1 * 30 * 60
 }
 
 pub(crate) fn default_me_reinit_drain_timeout_secs() -> u64 {
-    300
+    120
+}
+
+pub(crate) fn default_me_pool_drain_ttl_secs() -> u64 {
+    90
+}
+
+pub(crate) fn default_me_pool_min_fresh_ratio() -> f32 {
+    0.8
+}
+
+pub(crate) fn default_hardswap() -> bool {
+    true
 }
 
 pub(crate) fn default_ntp_check() -> bool {

src/config/hot_reload.rs

@@ -12,6 +12,9 @@
 //! | `general` | `me_keepalive_*`              | Passed on next connection         |
 //! | `general` | `desync_all_full`             | Applied immediately               |
 //! | `general` | `update_every`                | Applied to ME updater immediately |
+//! | `general` | `hardswap`                    | Applied on next ME map update     |
+//! | `general` | `me_pool_drain_ttl_secs`      | Applied on next ME map update     |
+//! | `general` | `me_pool_min_fresh_ratio`     | Applied on next ME map update     |
 //! | `general` | `me_reinit_drain_timeout_secs`| Applied on next ME map update     |
 //! | `access`  | All user/quota fields         | Effective immediately             |
 //!
@@ -39,6 +42,9 @@ pub struct HotFields {
     pub middle_proxy_pool_size:  usize,
     pub desync_all_full:         bool,
     pub update_every_secs:       u64,
+    pub hardswap:                bool,
+    pub me_pool_drain_ttl_secs:  u64,
+    pub me_pool_min_fresh_ratio: f32,
     pub me_reinit_drain_timeout_secs: u64,
     pub me_keepalive_enabled:    bool,
     pub me_keepalive_interval_secs: u64,
@@ -55,6 +61,9 @@ impl HotFields {
             middle_proxy_pool_size:  cfg.general.middle_proxy_pool_size,
             desync_all_full:         cfg.general.desync_all_full,
             update_every_secs:       cfg.general.effective_update_every_secs(),
+            hardswap:                cfg.general.hardswap,
+            me_pool_drain_ttl_secs:  cfg.general.me_pool_drain_ttl_secs,
+            me_pool_min_fresh_ratio: cfg.general.me_pool_min_fresh_ratio,
             me_reinit_drain_timeout_secs: cfg.general.me_reinit_drain_timeout_secs,
             me_keepalive_enabled:    cfg.general.me_keepalive_enabled,
             me_keepalive_interval_secs: cfg.general.me_keepalive_interval_secs,
@@ -198,6 +207,27 @@ fn log_changes(
         );
     }
 
+    if old_hot.hardswap != new_hot.hardswap {
+        info!(
+            "config reload: hardswap: {} → {}",
+            old_hot.hardswap, new_hot.hardswap,
+        );
+    }
+
+    if old_hot.me_pool_drain_ttl_secs != new_hot.me_pool_drain_ttl_secs {
+        info!(
+            "config reload: me_pool_drain_ttl_secs: {}s → {}s",
+            old_hot.me_pool_drain_ttl_secs, new_hot.me_pool_drain_ttl_secs,
+        );
+    }
+
+    if (old_hot.me_pool_min_fresh_ratio - new_hot.me_pool_min_fresh_ratio).abs() > f32::EPSILON {
+        info!(
+            "config reload: me_pool_min_fresh_ratio: {:.3} → {:.3}",
+            old_hot.me_pool_min_fresh_ratio, new_hot.me_pool_min_fresh_ratio,
+        );
+    }
+
     if old_hot.me_reinit_drain_timeout_secs != new_hot.me_reinit_drain_timeout_secs {
         info!(
             "config reload: me_reinit_drain_timeout_secs: {}s → {}s",

src/config/load.rs

@@ -145,6 +145,24 @@ impl ProxyConfig {
             }
         }
 
+        if !(0.0..=1.0).contains(&config.general.me_pool_min_fresh_ratio) {
+            return Err(ProxyError::Config(
+                "general.me_pool_min_fresh_ratio must be within [0.0, 1.0]".to_string(),
+            ));
+        }
+
+        if config.general.effective_me_pool_force_close_secs() > 0
+            && config.general.effective_me_pool_force_close_secs()
+                < config.general.me_pool_drain_ttl_secs
+        {
+            warn!(
+                me_pool_drain_ttl_secs = config.general.me_pool_drain_ttl_secs,
+                me_reinit_drain_timeout_secs = config.general.effective_me_pool_force_close_secs(),
+                "force-close timeout is lower than drain TTL; bumping force-close timeout to TTL"
+            );
+            config.general.me_reinit_drain_timeout_secs = config.general.me_pool_drain_ttl_secs;
+        }
+
         // Validate secrets.
         for (user, secret) in &config.access.users {
             if !secret.chars().all(|c| c.is_ascii_hexdigit()) || secret.len() != 32 {
@@ -439,4 +457,45 @@ mod tests {
         assert!(err.contains("general.update_every must be > 0"));
         let _ = std::fs::remove_file(path);
     }
+
+    #[test]
+    fn me_pool_min_fresh_ratio_out_of_range_is_rejected() {
+        let toml = r#"
+            [general]
+            me_pool_min_fresh_ratio = 1.5
+
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+        "#;
+        let dir = std::env::temp_dir();
+        let path = dir.join("telemt_me_pool_min_ratio_invalid_test.toml");
+        std::fs::write(&path, toml).unwrap();
+        let err = ProxyConfig::load(&path).unwrap_err().to_string();
+        assert!(err.contains("general.me_pool_min_fresh_ratio must be within [0.0, 1.0]"));
+        let _ = std::fs::remove_file(path);
+    }
+
+    #[test]
+    fn force_close_bumped_when_below_drain_ttl() {
+        let toml = r#"
+            [general]
+            me_pool_drain_ttl_secs = 90
+            me_reinit_drain_timeout_secs = 30
+
+            [censorship]
+            tls_domain = "example.com"
+
+            [access.users]
+            user = "00000000000000000000000000000000"
+        "#;
+        let dir = std::env::temp_dir();
+        let path = dir.join("telemt_force_close_bump_test.toml");
+        std::fs::write(&path, toml).unwrap();
+        let cfg = ProxyConfig::load(&path).unwrap();
+        assert_eq!(cfg.general.me_reinit_drain_timeout_secs, 90);
+        let _ = std::fs::remove_file(path);
+    }
 }

src/config/types.rs

@@ -206,6 +206,11 @@ pub struct GeneralConfig {
     #[serde(default = "default_desync_all_full")]
     pub desync_all_full: bool,
 
+    /// Enable C-like hard-swap for ME pool generations.
+    /// When true, Telemt prewarms a new generation and switches once full coverage is reached.
+    #[serde(default = "default_hardswap")]
+    pub hardswap: bool,
+
     /// Enable staggered warmup of extra ME writers.
     #[serde(default = "default_true")]
     pub me_warmup_stagger_enabled: bool,
@@ -262,6 +267,16 @@ pub struct GeneralConfig {
     #[serde(default)]
     pub update_every: Option<u64>,
 
+    /// Drain-TTL in seconds for stale ME writers after endpoint map changes.
+    /// During TTL, stale writers may be used only as fallback for new bindings.
+    #[serde(default = "default_me_pool_drain_ttl_secs")]
+    pub me_pool_drain_ttl_secs: u64,
+
+    /// Minimum desired-DC coverage ratio required before draining stale writers.
+    /// Range: 0.0..=1.0.
+    #[serde(default = "default_me_pool_min_fresh_ratio")]
+    pub me_pool_min_fresh_ratio: f32,
+
     /// Drain timeout in seconds for stale ME writers after endpoint map changes.
     /// Set to 0 to keep stale writers draining indefinitely (no force-close).
     #[serde(default = "default_me_reinit_drain_timeout_secs")]
@@ -308,7 +323,7 @@ impl Default for GeneralConfig {
             middle_proxy_nat_stun: None,
             middle_proxy_nat_stun_servers: Vec::new(),
             middle_proxy_pool_size: default_pool_size(),
-            middle_proxy_warm_standby: 8,
+            middle_proxy_warm_standby: 16,
             me_keepalive_enabled: true,
             me_keepalive_interval_secs: default_keepalive_interval(),
             me_keepalive_jitter_secs: default_keepalive_jitter(),
@@ -316,7 +331,7 @@ impl Default for GeneralConfig {
             me_warmup_stagger_enabled: true,
             me_warmup_step_delay_ms: default_warmup_step_delay_ms(),
             me_warmup_step_jitter_ms: default_warmup_step_jitter_ms(),
-            me_reconnect_max_concurrent_per_dc: 4,
+            me_reconnect_max_concurrent_per_dc: 8,
             me_reconnect_backoff_base_ms: default_reconnect_backoff_base_ms(),
             me_reconnect_backoff_cap_ms: default_reconnect_backoff_cap_ms(),
             me_reconnect_fast_retry_count: 8,
@@ -328,8 +343,11 @@ impl Default for GeneralConfig {
             crypto_pending_buffer: default_crypto_pending_buffer(),
             max_client_frame: default_max_client_frame(),
             desync_all_full: default_desync_all_full(),
+            hardswap: default_hardswap(),
             fast_mode_min_tls_record: default_fast_mode_min_tls_record(),
             update_every: Some(default_update_every_secs()),
+            me_pool_drain_ttl_secs: default_me_pool_drain_ttl_secs(),
+            me_pool_min_fresh_ratio: default_me_pool_min_fresh_ratio(),
             me_reinit_drain_timeout_secs: default_me_reinit_drain_timeout_secs(),
             proxy_secret_auto_reload_secs: default_proxy_secret_reload_secs(),
             proxy_config_auto_reload_secs: default_proxy_config_reload_secs(),
@@ -348,6 +366,12 @@ impl GeneralConfig {
         self.update_every
             .unwrap_or_else(|| self.proxy_secret_auto_reload_secs.min(self.proxy_config_auto_reload_secs))
     }
+
+    /// Resolve force-close timeout for stale writers.
+    /// `me_reinit_drain_timeout_secs` remains backward-compatible alias.
+    pub fn effective_me_pool_force_close_secs(&self) -> u64 {
+        self.me_reinit_drain_timeout_secs
+    }
 }
 
 /// `[general.links]` — proxy link generation settings.

src/main.rs

@@ -362,6 +362,10 @@ match crate::transport::middle_proxy::fetch_proxy_secret(proxy_secret_path).awai
                     config.general.me_reconnect_backoff_base_ms,
                     config.general.me_reconnect_backoff_cap_ms,
                     config.general.me_reconnect_fast_retry_count,
+                    config.general.hardswap,
+                    config.general.me_pool_drain_ttl_secs,
+                    config.general.effective_me_pool_force_close_secs(),
+                    config.general.me_pool_min_fresh_ratio,
                 );
 
                 let pool_size = config.general.middle_proxy_pool_size.max(1);

src/metrics.rs

@@ -175,6 +175,30 @@ fn render_metrics(stats: &Stats) -> String {
         stats.get_desync_frames_bucket_gt_10()
     );
 
+    let _ = writeln!(out, "# HELP telemt_pool_swap_total Successful ME pool swaps");
+    let _ = writeln!(out, "# TYPE telemt_pool_swap_total counter");
+    let _ = writeln!(out, "telemt_pool_swap_total {}", stats.get_pool_swap_total());
+
+    let _ = writeln!(out, "# HELP telemt_pool_drain_active Active draining ME writers");
+    let _ = writeln!(out, "# TYPE telemt_pool_drain_active gauge");
+    let _ = writeln!(out, "telemt_pool_drain_active {}", stats.get_pool_drain_active());
+
+    let _ = writeln!(out, "# HELP telemt_pool_force_close_total Forced close events for draining writers");
+    let _ = writeln!(out, "# TYPE telemt_pool_force_close_total counter");
+    let _ = writeln!(
+        out,
+        "telemt_pool_force_close_total {}",
+        stats.get_pool_force_close_total()
+    );
+
+    let _ = writeln!(out, "# HELP telemt_pool_stale_pick_total Stale writer fallback picks for new binds");
+    let _ = writeln!(out, "# TYPE telemt_pool_stale_pick_total counter");
+    let _ = writeln!(
+        out,
+        "telemt_pool_stale_pick_total {}",
+        stats.get_pool_stale_pick_total()
+    );
+
     let _ = writeln!(out, "# HELP telemt_user_connections_total Per-user total connections");
     let _ = writeln!(out, "# TYPE telemt_user_connections_total counter");
     let _ = writeln!(out, "# HELP telemt_user_connections_current Per-user active connections");

src/proxy/middle_relay.rs

@@ -184,6 +184,7 @@ where
     let user = success.user.clone();
     let peer = success.peer;
     let proto_tag = success.proto_tag;
+    let pool_generation = me_pool.current_generation();
 
     info!(
         user = %user,
@@ -191,6 +192,7 @@ where
         dc = success.dc_idx,
         proto = ?proto_tag,
         mode = "middle_proxy",
+        pool_generation,
         "Routing via Middle-End"
     );
 
@@ -220,6 +222,7 @@ where
         peer_hash = format_args!("0x{:016x}", forensics.peer_hash),
         desync_all_full = forensics.desync_all_full,
         proto_flags = format_args!("0x{:08x}", proto_flags),
+        pool_generation,
         "ME relay started"
     );
 

src/stats/mod.rs

@@ -38,6 +38,10 @@ pub struct Stats {
     desync_frames_bucket_1_2: AtomicU64,
     desync_frames_bucket_3_10: AtomicU64,
     desync_frames_bucket_gt_10: AtomicU64,
+    pool_swap_total: AtomicU64,
+    pool_drain_active: AtomicU64,
+    pool_force_close_total: AtomicU64,
+    pool_stale_pick_total: AtomicU64,
     user_stats: DashMap<String, UserStats>,
     start_time: parking_lot::RwLock<Option<Instant>>,
 }
@@ -108,6 +112,35 @@ impl Stats {
             }
         }
     }
+    pub fn increment_pool_swap_total(&self) {
+        self.pool_swap_total.fetch_add(1, Ordering::Relaxed);
+    }
+    pub fn increment_pool_drain_active(&self) {
+        self.pool_drain_active.fetch_add(1, Ordering::Relaxed);
+    }
+    pub fn decrement_pool_drain_active(&self) {
+        let mut current = self.pool_drain_active.load(Ordering::Relaxed);
+        loop {
+            if current == 0 {
+                break;
+            }
+            match self.pool_drain_active.compare_exchange_weak(
+                current,
+                current - 1,
+                Ordering::Relaxed,
+                Ordering::Relaxed,
+            ) {
+                Ok(_) => break,
+                Err(actual) => current = actual,
+            }
+        }
+    }
+    pub fn increment_pool_force_close_total(&self) {
+        self.pool_force_close_total.fetch_add(1, Ordering::Relaxed);
+    }
+    pub fn increment_pool_stale_pick_total(&self) {
+        self.pool_stale_pick_total.fetch_add(1, Ordering::Relaxed);
+    }
     pub fn get_connects_all(&self) -> u64 { self.connects_all.load(Ordering::Relaxed) }
     pub fn get_connects_bad(&self) -> u64 { self.connects_bad.load(Ordering::Relaxed) }
     pub fn get_me_keepalive_sent(&self) -> u64 { self.me_keepalive_sent.load(Ordering::Relaxed) }
@@ -149,6 +182,18 @@ impl Stats {
     pub fn get_desync_frames_bucket_gt_10(&self) -> u64 {
         self.desync_frames_bucket_gt_10.load(Ordering::Relaxed)
     }
+    pub fn get_pool_swap_total(&self) -> u64 {
+        self.pool_swap_total.load(Ordering::Relaxed)
+    }
+    pub fn get_pool_drain_active(&self) -> u64 {
+        self.pool_drain_active.load(Ordering::Relaxed)
+    }
+    pub fn get_pool_force_close_total(&self) -> u64 {
+        self.pool_force_close_total.load(Ordering::Relaxed)
+    }
+    pub fn get_pool_stale_pick_total(&self) -> u64 {
+        self.pool_stale_pick_total.load(Ordering::Relaxed)
+    }
     
     pub fn increment_user_connects(&self, user: &str) {
         self.user_stats.entry(user.to_string()).or_default()

src/transport/middle_proxy/config_updater.rs

@@ -131,6 +131,13 @@ pub async fn fetch_proxy_config(url: &str) -> Result<ProxyConfigData> {
 }
 
 async fn run_update_cycle(pool: &Arc<MePool>, rng: &Arc<SecureRandom>, cfg: &ProxyConfig) {
+    pool.update_runtime_reinit_policy(
+        cfg.general.hardswap,
+        cfg.general.me_pool_drain_ttl_secs,
+        cfg.general.effective_me_pool_force_close_secs(),
+        cfg.general.me_pool_min_fresh_ratio,
+    );
+
     let mut maps_changed = false;
 
     // Update proxy config v4
@@ -162,12 +169,7 @@ async fn run_update_cycle(pool: &Arc<MePool>, rng: &Arc<SecureRandom>, cfg: &Pro
     }
 
     if maps_changed {
-        let drain_timeout = if cfg.general.me_reinit_drain_timeout_secs == 0 {
+        pool.zero_downtime_reinit_after_map_change(rng.as_ref())
-            None
-        } else {
-            Some(Duration::from_secs(cfg.general.me_reinit_drain_timeout_secs))
-        };
-        pool.zero_downtime_reinit_after_map_change(rng.as_ref(), drain_timeout)
             .await;
     }
 
@@ -224,6 +226,12 @@ pub async fn me_config_updater(
                     break;
                 }
                 let cfg = config_rx.borrow().clone();
+                pool.update_runtime_reinit_policy(
+                    cfg.general.hardswap,
+                    cfg.general.me_pool_drain_ttl_secs,
+                    cfg.general.effective_me_pool_force_close_secs(),
+                    cfg.general.me_pool_min_fresh_ratio,
+                );
                 let new_secs = cfg.general.effective_update_every_secs().max(1);
                 if new_secs == update_every_secs {
                     continue;

src/transport/middle_proxy/health.rs

@@ -68,6 +68,7 @@ async fn check_family(
         .read()
         .await
         .iter()
+        .filter(|w| !w.draining.load(std::sync::atomic::Ordering::Relaxed))
         .map(|w| w.addr)
         .collect();
 

src/transport/middle_proxy/pool.rs

@@ -1,14 +1,14 @@
 use std::collections::{HashMap, HashSet};
 use std::net::{IpAddr, Ipv6Addr, SocketAddr};
 use std::sync::Arc;
-use std::sync::atomic::{AtomicBool, AtomicI32, AtomicU64, AtomicUsize, Ordering};
+use std::sync::atomic::{AtomicBool, AtomicI32, AtomicU32, AtomicU64, AtomicUsize, Ordering};
 use bytes::BytesMut;
 use rand::Rng;
 use rand::seq::SliceRandom;
 use tokio::sync::{Mutex, RwLock, mpsc, Notify};
 use tokio_util::sync::CancellationToken;
 use tracing::{debug, info, warn};
-use std::time::{Duration, Instant};
+use std::time::{Duration, Instant, SystemTime, UNIX_EPOCH};
 
 use crate::crypto::SecureRandom;
 use crate::error::{ProxyError, Result};
@@ -27,10 +27,13 @@ const ME_ACTIVE_PING_JITTER_SECS: i64 = 5;
 pub struct MeWriter {
     pub id: u64,
     pub addr: SocketAddr,
+    pub generation: u64,
     pub tx: mpsc::Sender<WriterCommand>,
     pub cancel: CancellationToken,
     pub degraded: Arc<AtomicBool>,
     pub draining: Arc<AtomicBool>,
+    pub draining_started_at_epoch_secs: Arc<AtomicU64>,
+    pub allow_drain_fallback: Arc<AtomicBool>,
 }
 
 pub struct MePool {
@@ -73,6 +76,11 @@ pub struct MePool {
     pub(super) writer_available: Arc<Notify>,
     pub(super) conn_count: AtomicUsize,
     pub(super) stats: Arc<crate::stats::Stats>,
+    pub(super) generation: AtomicU64,
+    pub(super) hardswap: AtomicBool,
+    pub(super) me_pool_drain_ttl_secs: AtomicU64,
+    pub(super) me_pool_force_close_secs: AtomicU64,
+    pub(super) me_pool_min_fresh_ratio_permille: AtomicU32,
     pool_size: usize,
 }
 
@@ -83,6 +91,22 @@ pub struct NatReflectionCache {
 }
 
 impl MePool {
+    fn ratio_to_permille(ratio: f32) -> u32 {
+        let clamped = ratio.clamp(0.0, 1.0);
+        (clamped * 1000.0).round() as u32
+    }
+
+    fn permille_to_ratio(permille: u32) -> f32 {
+        (permille.min(1000) as f32) / 1000.0
+    }
+
+    fn now_epoch_secs() -> u64 {
+        SystemTime::now()
+            .duration_since(UNIX_EPOCH)
+            .unwrap_or_default()
+            .as_secs()
+    }
+
     pub fn new(
         proxy_tag: Option<Vec<u8>>,
         proxy_secret: Vec<u8>,
@@ -110,6 +134,10 @@ impl MePool {
         me_reconnect_backoff_base_ms: u64,
         me_reconnect_backoff_cap_ms: u64,
         me_reconnect_fast_retry_count: u32,
+        hardswap: bool,
+        me_pool_drain_ttl_secs: u64,
+        me_pool_force_close_secs: u64,
+        me_pool_min_fresh_ratio: f32,
     ) -> Arc<Self> {
         Arc::new(Self {
             registry: Arc::new(ConnRegistry::new()),
@@ -152,6 +180,11 @@ impl MePool {
             nat_reflection_cache: Arc::new(Mutex::new(NatReflectionCache::default())),
             writer_available: Arc::new(Notify::new()),
             conn_count: AtomicUsize::new(0),
+            generation: AtomicU64::new(1),
+            hardswap: AtomicBool::new(hardswap),
+            me_pool_drain_ttl_secs: AtomicU64::new(me_pool_drain_ttl_secs),
+            me_pool_force_close_secs: AtomicU64::new(me_pool_force_close_secs),
+            me_pool_min_fresh_ratio_permille: AtomicU32::new(Self::ratio_to_permille(me_pool_min_fresh_ratio)),
         })
     }
 
@@ -159,6 +192,25 @@ impl MePool {
         self.proxy_tag.is_some()
     }
 
+    pub fn current_generation(&self) -> u64 {
+        self.generation.load(Ordering::Relaxed)
+    }
+
+    pub fn update_runtime_reinit_policy(
+        &self,
+        hardswap: bool,
+        drain_ttl_secs: u64,
+        force_close_secs: u64,
+        min_fresh_ratio: f32,
+    ) {
+        self.hardswap.store(hardswap, Ordering::Relaxed);
+        self.me_pool_drain_ttl_secs.store(drain_ttl_secs, Ordering::Relaxed);
+        self.me_pool_force_close_secs
+            .store(force_close_secs, Ordering::Relaxed);
+        self.me_pool_min_fresh_ratio_permille
+            .store(Self::ratio_to_permille(min_fresh_ratio), Ordering::Relaxed);
+    }
+
     pub fn reset_stun_state(&self) {
         self.nat_probe_attempts.store(0, Ordering::Relaxed);
         self.nat_probe_disabled.store(false, Ordering::Relaxed);
@@ -177,6 +229,42 @@ impl MePool {
         self.writers.clone()
     }
 
+    fn force_close_timeout(&self) -> Option<Duration> {
+        let secs = self.me_pool_force_close_secs.load(Ordering::Relaxed);
+        if secs == 0 {
+            None
+        } else {
+            Some(Duration::from_secs(secs))
+        }
+    }
+
+    fn coverage_ratio(
+        desired_by_dc: &HashMap<i32, HashSet<SocketAddr>>,
+        active_writer_addrs: &HashSet<SocketAddr>,
+    ) -> (f32, Vec<i32>) {
+        if desired_by_dc.is_empty() {
+            return (1.0, Vec::new());
+        }
+
+        let mut missing_dc = Vec::<i32>::new();
+        let mut covered = 0usize;
+        for (dc, endpoints) in desired_by_dc {
+            if endpoints.is_empty() {
+                continue;
+            }
+            if endpoints.iter().any(|addr| active_writer_addrs.contains(addr)) {
+                covered += 1;
+            } else {
+                missing_dc.push(*dc);
+            }
+        }
+
+        missing_dc.sort_unstable();
+        let total = desired_by_dc.len().max(1);
+        let ratio = (covered as f32) / (total as f32);
+        (ratio, missing_dc)
+    }
+
     pub async fn reconcile_connections(self: &Arc<Self>, rng: &SecureRandom) {
         let writers = self.writers.read().await;
         let current: HashSet<SocketAddr> = writers
@@ -235,39 +323,104 @@ impl MePool {
         out
     }
 
+    async fn warmup_generation_for_all_dcs(
+        self: &Arc<Self>,
+        rng: &SecureRandom,
+        generation: u64,
+        desired_by_dc: &HashMap<i32, HashSet<SocketAddr>>,
+    ) {
+        for endpoints in desired_by_dc.values() {
+            if endpoints.is_empty() {
+                continue;
+            }
+
+            let has_fresh = {
+                let ws = self.writers.read().await;
+                ws.iter().any(|w| {
+                    !w.draining.load(Ordering::Relaxed)
+                        && w.generation == generation
+                        && endpoints.contains(&w.addr)
+                })
+            };
+
+            if has_fresh {
+                continue;
+            }
+
+            let mut shuffled: Vec<SocketAddr> = endpoints.iter().copied().collect();
+            shuffled.shuffle(&mut rand::rng());
+            for addr in shuffled {
+                if self.connect_one(addr, rng).await.is_ok() {
+                    break;
+                }
+            }
+        }
+    }
+
     pub async fn zero_downtime_reinit_after_map_change(
         self: &Arc<Self>,
         rng: &SecureRandom,
-        drain_timeout: Option<Duration>,
     ) {
-        // Stage 1: prewarm writers for new endpoint maps before draining old ones.
-        self.reconcile_connections(rng).await;
-
         let desired_by_dc = self.desired_dc_endpoints().await;
         if desired_by_dc.is_empty() {
             warn!("ME endpoint map is empty after update; skipping stale writer drain");
             return;
         }
 
+        let previous_generation = self.current_generation();
+        let generation = self.generation.fetch_add(1, Ordering::Relaxed) + 1;
+        let hardswap = self.hardswap.load(Ordering::Relaxed);
+
+        if hardswap {
+            self.warmup_generation_for_all_dcs(rng, generation, &desired_by_dc)
+                .await;
+        } else {
+            self.reconcile_connections(rng).await;
+        }
+
         let writers = self.writers.read().await;
         let active_writer_addrs: HashSet<SocketAddr> = writers
             .iter()
             .filter(|w| !w.draining.load(Ordering::Relaxed))
             .map(|w| w.addr)
             .collect();
-
+        let min_ratio = Self::permille_to_ratio(
-        let mut missing_dc = Vec::<i32>::new();
+            self.me_pool_min_fresh_ratio_permille
-        for (dc, endpoints) in &desired_by_dc {
+                .load(Ordering::Relaxed),
-            if endpoints.is_empty() {
+        );
-                continue;
+        let (coverage_ratio, missing_dc) = Self::coverage_ratio(&desired_by_dc, &active_writer_addrs);
-            }
+        if !hardswap && coverage_ratio < min_ratio {
-            if !endpoints.iter().any(|addr| active_writer_addrs.contains(addr)) {
+            warn!(
-                missing_dc.push(*dc);
+                previous_generation,
-            }
+                generation,
+                coverage_ratio = format_args!("{coverage_ratio:.3}"),
+                min_ratio = format_args!("{min_ratio:.3}"),
+                missing_dc = ?missing_dc,
+                "ME reinit coverage below threshold; keeping stale writers"
+            );
+            return;
         }
 
-        if !missing_dc.is_empty() {
+        if hardswap {
-            missing_dc.sort_unstable();
+            let fresh_writer_addrs: HashSet<SocketAddr> = writers
+                .iter()
+                .filter(|w| !w.draining.load(Ordering::Relaxed))
+                .filter(|w| w.generation == generation)
+                .map(|w| w.addr)
+                .collect();
+            let (fresh_ratio, fresh_missing_dc) =
+                Self::coverage_ratio(&desired_by_dc, &fresh_writer_addrs);
+            if !fresh_missing_dc.is_empty() {
+                warn!(
+                    previous_generation,
+                    generation,
+                    fresh_ratio = format_args!("{fresh_ratio:.3}"),
+                    missing_dc = ?fresh_missing_dc,
+                    "ME hardswap pending: fresh generation coverage incomplete"
+                );
+                return;
+            }
+        } else if !missing_dc.is_empty() {
             warn!(
                 missing_dc = ?missing_dc,
                 // Keep stale writers alive when fresh coverage is incomplete.
@@ -284,7 +437,13 @@ impl MePool {
         let stale_writer_ids: Vec<u64> = writers
             .iter()
             .filter(|w| !w.draining.load(Ordering::Relaxed))
-            .filter(|w| !desired_addrs.contains(&w.addr))
+            .filter(|w| {
+                if hardswap {
+                    w.generation < generation
+                } else {
+                    !desired_addrs.contains(&w.addr)
+                }
+            })
             .map(|w| w.id)
             .collect();
         drop(writers);
@@ -294,14 +453,21 @@ impl MePool {
             return;
         }
 
+        let drain_timeout = self.force_close_timeout();
         let drain_timeout_secs = drain_timeout.map(|d| d.as_secs()).unwrap_or(0);
         info!(
             stale_writers = stale_writer_ids.len(),
+            previous_generation,
+            generation,
+            hardswap,
+            coverage_ratio = format_args!("{coverage_ratio:.3}"),
+            min_ratio = format_args!("{min_ratio:.3}"),
             drain_timeout_secs,
             "ME map update covered; draining stale writers"
         );
+        self.stats.increment_pool_swap_total();
         for writer_id in stale_writer_ids {
-            self.mark_writer_draining_with_timeout(writer_id, drain_timeout)
+            self.mark_writer_draining_with_timeout(writer_id, drain_timeout, !hardswap)
                 .await;
         }
     }
@@ -507,9 +673,12 @@ impl MePool {
         let hs = self.handshake_only(stream, addr, rng).await?;
 
         let writer_id = self.next_writer_id.fetch_add(1, Ordering::Relaxed);
+        let generation = self.current_generation();
         let cancel = CancellationToken::new();
         let degraded = Arc::new(AtomicBool::new(false));
         let draining = Arc::new(AtomicBool::new(false));
+        let draining_started_at_epoch_secs = Arc::new(AtomicU64::new(0));
+        let allow_drain_fallback = Arc::new(AtomicBool::new(false));
         let (tx, mut rx) = mpsc::channel::<WriterCommand>(4096);
         let mut rpc_writer = RpcWriter {
             writer: hs.wr,
@@ -540,10 +709,13 @@ impl MePool {
         let writer = MeWriter {
             id: writer_id,
             addr,
+            generation,
             tx: tx.clone(),
             cancel: cancel.clone(),
             degraded: degraded.clone(),
             draining: draining.clone(),
+            draining_started_at_epoch_secs: draining_started_at_epoch_secs.clone(),
+            allow_drain_fallback: allow_drain_fallback.clone(),
         };
         self.writers.write().await.push(writer.clone());
         self.conn_count.fetch_add(1, Ordering::Relaxed);
@@ -715,6 +887,9 @@ impl MePool {
             let mut ws = self.writers.write().await;
             if let Some(pos) = ws.iter().position(|w| w.id == writer_id) {
                 let w = ws.remove(pos);
+                if w.draining.load(Ordering::Relaxed) {
+                    self.stats.decrement_pool_drain_active();
+                }
                 w.cancel.cancel();
                 close_tx = Some(w.tx.clone());
                 self.conn_count.fetch_sub(1, Ordering::Relaxed);
@@ -731,11 +906,20 @@ impl MePool {
         self: &Arc<Self>,
         writer_id: u64,
         timeout: Option<Duration>,
+        allow_drain_fallback: bool,
     ) {
         let timeout = timeout.filter(|d| !d.is_zero());
         let found = {
             let mut ws = self.writers.write().await;
             if let Some(w) = ws.iter_mut().find(|w| w.id == writer_id) {
+                let already_draining = w.draining.swap(true, Ordering::Relaxed);
+                w.allow_drain_fallback
+                    .store(allow_drain_fallback, Ordering::Relaxed);
+                w.draining_started_at_epoch_secs
+                    .store(Self::now_epoch_secs(), Ordering::Relaxed);
+                if !already_draining {
+                    self.stats.increment_pool_drain_active();
+                }
                 w.draining.store(true, Ordering::Relaxed);
                 true
             } else {
@@ -748,7 +932,12 @@ impl MePool {
         }
 
         let timeout_secs = timeout.map(|d| d.as_secs()).unwrap_or(0);
-        debug!(writer_id, timeout_secs, "ME writer marked draining");
+        debug!(
+            writer_id,
+            timeout_secs,
+            allow_drain_fallback,
+            "ME writer marked draining"
+        );
 
         let pool = Arc::downgrade(self);
         tokio::spawn(async move {
@@ -758,6 +947,7 @@ impl MePool {
                     if let Some(deadline_at) = deadline {
                         if Instant::now() >= deadline_at {
                             warn!(writer_id, "Drain timeout, force-closing");
+                            p.stats.increment_pool_force_close_total();
                             let _ = p.remove_writer_and_close_clients(writer_id).await;
                             break;
                         }
@@ -775,10 +965,31 @@ impl MePool {
     }
 
     pub(crate) async fn mark_writer_draining(self: &Arc<Self>, writer_id: u64) {
-        self.mark_writer_draining_with_timeout(writer_id, Some(Duration::from_secs(300)))
+        self.mark_writer_draining_with_timeout(writer_id, Some(Duration::from_secs(300)), false)
             .await;
     }
 
+    pub(super) fn writer_accepts_new_binding(&self, writer: &MeWriter) -> bool {
+        if !writer.draining.load(Ordering::Relaxed) {
+            return true;
+        }
+        if !writer.allow_drain_fallback.load(Ordering::Relaxed) {
+            return false;
+        }
+
+        let ttl_secs = self.me_pool_drain_ttl_secs.load(Ordering::Relaxed);
+        if ttl_secs == 0 {
+            return true;
+        }
+
+        let started = writer.draining_started_at_epoch_secs.load(Ordering::Relaxed);
+        if started == 0 {
+            return false;
+        }
+
+        Self::now_epoch_secs().saturating_sub(started) <= ttl_secs
+    }
+
 }
 
 fn hex_dump(data: &[u8]) -> String {

src/transport/middle_proxy/send.rs

@@ -134,8 +134,8 @@ impl MePool {
             candidate_indices.sort_by_key(|idx| {
                 let w = &writers_snapshot[*idx];
                 let degraded = w.degraded.load(Ordering::Relaxed);
-                let draining = w.draining.load(Ordering::Relaxed);
+                let stale = (w.generation < self.current_generation()) as usize;
-                (draining as usize, degraded as usize)
+                (stale, degraded as usize)
             });
 
             let start = self.rr.fetch_add(1, Ordering::Relaxed) as usize % candidate_indices.len();
@@ -143,13 +143,23 @@ impl MePool {
             for offset in 0..candidate_indices.len() {
                 let idx = candidate_indices[(start + offset) % candidate_indices.len()];
                 let w = &writers_snapshot[idx];
-                if w.draining.load(Ordering::Relaxed) {
+                if !self.writer_accepts_new_binding(w) {
                     continue;
                 }
                 if w.tx.send(WriterCommand::Data(payload.clone())).await.is_ok() {
                     self.registry
                         .bind_writer(conn_id, w.id, w.tx.clone(), meta.clone())
                         .await;
+                    if w.generation < self.current_generation() {
+                        self.stats.increment_pool_stale_pick_total();
+                        debug!(
+                            conn_id,
+                            writer_id = w.id,
+                            writer_generation = w.generation,
+                            current_generation = self.current_generation(),
+                            "Selected stale ME writer for fallback bind"
+                        );
+                    }
                     return Ok(());
                 } else {
                     warn!(writer_id = w.id, "ME writer channel closed");
@@ -159,7 +169,7 @@ impl MePool {
             }
 
             let w = writers_snapshot[candidate_indices[start]].clone();
-            if w.draining.load(Ordering::Relaxed) {
+            if !self.writer_accepts_new_binding(&w) {
                 continue;
             }
             match w.tx.send(WriterCommand::Data(payload.clone())).await {
@@ -167,6 +177,9 @@ impl MePool {
                     self.registry
                         .bind_writer(conn_id, w.id, w.tx.clone(), meta.clone())
                         .await;
+                    if w.generation < self.current_generation() {
+                        self.stats.increment_pool_stale_pick_total();
+                    }
                     return Ok(());
                 }
                 Err(_) => {
@@ -245,13 +258,13 @@ impl MePool {
 
         if preferred.is_empty() {
             return (0..writers.len())
-                .filter(|i| !writers[*i].draining.load(Ordering::Relaxed))
+                .filter(|i| self.writer_accepts_new_binding(&writers[*i]))
                 .collect();
         }
 
         let mut out = Vec::new();
         for (idx, w) in writers.iter().enumerate() {
-            if w.draining.load(Ordering::Relaxed) {
+            if !self.writer_accepts_new_binding(w) {
                 continue;
             }
             if preferred.iter().any(|p| *p == w.addr) {
@@ -260,7 +273,7 @@ impl MePool {
         }
         if out.is_empty() {
             return (0..writers.len())
-                .filter(|i| !writers[*i].draining.load(Ordering::Relaxed))
+                .filter(|i| self.writer_accepts_new_binding(&writers[*i]))
                 .collect();
         }
         out