An NGINX reverse proxy keeps one upstream marked healthy

Ordinary checks look fine, yet user traffic breaks because reused upstream sockets hide a backend identity change that only fresh connections expose.