Motivation:

#2217 changed round-robin mode to hold the per-host connection permit for the lifetime of an HTTP/2 connection, ensuring maxConnectionsPerHost limits live connections. However, after a GOAWAY, the connection is immediately removed from the registry and marked as draining, while its permit is only released when the channel finally closes after all in-flight streams complete. During this drain window, the connection can no longer serve requests but still occupies both its per-host permit (and, with a combined limiter, a global connection permit). As a result, new requests cannot reuse the draining connection or acquire a new permit, eventually timing out with TooManyConnectionsPerHostException. With maxConnectionsPerHost=1, even same-host redirects fail, and under a combined limiter a draining connection can block new connections to unrelated hosts. DEFAULT mode does not have this issue because it releases the permit immediately after ALPN negotiation.

Modification:

Release the connection permit when draining begins instead of waiting for channel close. Http2ConnectionState now exposes a once-only permit release hook (setPermitRelease/releasePermitOnce) backed by an AtomicReference latch. In round-robin mode, NettyConnectListener installs this hook and also registers a closeFuture listener that invokes it. The GOAWAY handler in ChannelManager invokes the same hook after marking the connection as draining and removing it from the registry. Whichever path executes first releases the permit exactly once, preventing double releases from over-incrementing the semaphore. DEFAULT mode remains unchanged. The change also avoids repeatedly reading future.getPartitionKey() in registerHttp2AndManageSemaphore and documents the connection-lifetime permit semantics in LoadBalance.

Result:

A GOAWAY now immediately frees the draining connection's per-host and global connection permits, allowing a replacement connection to be established without waiting for existing streams to finish. This restores the expected behavior during server rolling restarts while preserving the connection cap. The change is covered by unit tests for drain-time permit release, double-release prevention, close-without-GOAWAY, combined-limiter behavior, concurrent once-only release, and an end-to-end HTTP/2 GOAWAY scenario that previously failed with TooManyConnectionsPerHostException.