I have been implementing a simple HA port script recently and it occurs 
to me that the design of the HA port feature is backwards because it 
sets up a very serious single point of failure ... if my HA port program 
falls over, then pound will either deny all traffic (because all back 
ends have been marked as down by my software failure) or spew traffic to 
batches of machines that shouldn't get the traffic (because I have spare 
back ends configured but not live).  Either option is really bad.

The HA port feature should really be fail-safe.  If the control program 
goes down, things should stay stable.  What I would much rather have is 
that we have a re-weighting server that pound occasionally checks that 
would allow load-balancing weights to be set for all back ends.  Giving 
a weight of 0 would mark a backed as down.  If the balancing connection 
fails, then nothing would change.  In complementary fashion, there 
should be a status port which can be accessed to get the current status 
of the  pound instance.
[...]