src/nc_server.c server_failure will call add_failed_server without calling server_pool_run(which updates the distribution) for a failed server. It will set server->fail to a different value, though, and if ketama_update does get called by something else then that will remove the server from the pool.
The whole point of the heartbeat patch seems to be to avoid sending requests to failed servers, so server_failure_limit may be unnecessary