Bug fix
- Fix CONNECT race condition that silently dropped early TLS data — The server previously returned the CONNECT ACK before the outbound TCP connection was established and the data writer was registered. If the client's TLS ClientHello arrived during that window, it was silently discarded, causing the TLS handshake to hang until the remote host timed out the idle connection. This manifested as certain sites (with higher-latency servers) failing while nearby ones worked fine. The ACK is now sent only after the target connection is ready and the writer channel is in place.
Upgrade
Drop-in replacement — no config changes needed. Just rebuild the server binary.