v6.16.0

Auto-released from merge of PR #1730 (trigger: push).

• A long answer is no longer cut off at five minutes while it is still streaming. The upstream timeout ran over the whole request, so an agent turn that streamed for more than 300 s was aborted mid-stream: the mid-stream guard then sent the full prompt again to continue, or the answer was truncated when a tool_use block was open. The timeout now caps the wait until the response starts streaming, as before, and once a 2xx body is being read it is the longest gap allowed between two chunks; a stream that goes quiet still ends 300 s after its last chunk. This covers the Claude path, both ChatGPT seat paths, the OpenAI-compat backend, and the family-fallback and continuation loopback legs. The value is now settable with --upstream-timeout=MS (env DARIO_UPSTREAM_TIMEOUT_MS, default 300000). Nothing sent upstream changes.
• A request that fails over to another seat names that seat in its body. When a 429, 401 or 403 moved a Claude pool request from seat A to seat B, dario switched the bearer token and the x-claude-code-session-id header but sent the body it had built for A, so B received A's device_id and account_uuid in metadata.user_id and a session_id that disagreed with its own header. The failover now rebuilds metadata.user_id from B's identity and the session id B's header carries, and stamps cch again where a seed applies. A request that does not fail over is sent byte for byte as before; a passthrough body is the client's and is left alone.
• docker stop shuts dario down cleanly instead of waiting out the timeout. Under Node the CLI relaunches itself under Bun and waits; that wrapper never passed SIGTERM on. In the container it is PID 1, so the signal was dropped, Docker waited the full stop timeout and then SIGKILLed both processes, and the drain and the ledger and key flush never ran. The wrapper now forwards SIGTERM and SIGINT to the Bun child and exits with the child's code. An idle container stops in under a second (was the whole timeout, exit 137). Shutdown also runs once when a terminal Ctrl+C reaches the child twice.
• --pool-strategy=headroom-by-plan, opt-in: headroom routing that counts each seat by its plan size. A Max Nx seat's headroom counts N times (read from the profile's rate_limit_tier); Pro and any plan dario cannot read count once. In a pool of a Max 20x at 30% headroom and a Pro at 90%, new conversations go to the 20x instead of the Pro. headroom stays the default and is unchanged: utilization is an account-wide ratio, no absolute capacity reaches the wire, and the binding window matters more than the plan name, so plan weighting is a choice for pools whose seats are otherwise idle. Floors, parking, sticky bindings and failover order work as under headroom. Env DARIO_POOL_STRATEGY, config pool.strategy.

---

Built + tested + npm-published inline by cc-drift-auto-release.yml on this run — tokenless via OIDC trusted publishing, provenance-attested. See the workflow log for the publish output.