maxpool 1.24.18 → 1.24.20

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "maxpool",
-  "version": "1.24.18",
+  "version": "1.24.20",
   "description": "Multi-account Claude Code proxy with adaptive, rate-aware load balancing across Claude accounts",
   "type": "module",
   "main": "src/index.js",

package/src/restart-controller.js

@@ -87,17 +87,20 @@ export class RestartController {
     // Without the `pending` guard a second call (e.g. auto-apply firing while a manual
     // restart is draining) would orphan the first _drainTimer and re-log.
     if (this.restarting || this.pending) return;
-    this.pauseAdmission();
-    if (this.upstreamRequests.size === 0) {
+    // Seamless handoff → do not pre-drain AND do not pause admission. The old worker
+    // keeps serving everything it already holds after the baton passes — including
+    // requests WAITING in its queue. Pausing admission made the routing oracle report
+    // "no route will ever recover", so every queued waiter gave up at once: the
+    // v1.24.18 auto-update dropped 24 sessions that had waited 3-13 min (2026-10-11).
+    if (this.isSeamless()) {
+      if (this.upstreamRequests.size > 0) {
+        this.log(`[Maxpool] Restarting now — ${this.upstreamRequests.size} in-flight request(s) finish on the current version; new requests go to the updated one.`);
+      }
       this._restart();
       return;
     }
-
-    // Seamless handoff → do not pre-drain (see isSeamless above). The in-flight
-    // requests finish on the OLD worker after the baton passes; holding admission
-    // here would only 503 the rest of the fleet for nothing.
-    if (this.isSeamless()) {
-      this.log(`[Maxpool] Restarting now — ${this.upstreamRequests.size} in-flight request(s) finish on the current version; new requests go to the updated one.`);
+    this.pauseAdmission();
+    if (this.upstreamRequests.size === 0) {
       this._restart();
       return;
     }

package/src/server.js

@@ -507,7 +507,19 @@ async function forwardRequest(
     ctx.account = '(none available)';
     const retryPlan = accountManager.nextRetryForRequest?.(requestInfo, new Set()) || {};
     const willRecoverSoon = Number.isFinite(retryPlan.retryAfterMs);
-    const retryAfter = willRecoverSoon ? Math.max(1, Math.ceil(retryPlan.retryAfterMs / 1000)) : 60;
+    // CLI-RETRIABLE CAP (2026-10-11 "bricked sessions"). The real soonest reset can
+    // be hours out; sending `retry-after: 10800` makes Claude Code's SDK treat the
+    // 429 as terminal (binary-verified 2.1.296: a plain rate_limit 429 whose
+    // retry-after exceeds 60s + 25% headroom aborts with tengu_api_retry_after_too_long
+    // — it neither sleeps nor retries; the turn dies and the session looks dead).
+    // The pool has ALREADY decided not to hold this request, so the honest and
+    // useful header is "retry soon": every SDK retries ≤60s values with backoff,
+    // and the pool answers again immediately with a fresh estimate. The body text
+    // still carries the real wait.
+    const RETRY_AFTER_RETRIABLE_S = 60;
+    const retryAfter = willRecoverSoon
+      ? Math.min(Math.max(1, Math.ceil(retryPlan.retryAfterMs / 1000)), RETRY_AFTER_RETRIABLE_S)
+      : 60;
     // Surface the routing decision (logs go to the TUI; this is the only record
     // of WHY a request was rejected rather than queued).
     console.log(`[Maxpool] No route for request — returning 429 (cause: ${retryPlan.cause || 'unavailable'}, recovers-soon: ${willRecoverSoon})`);