fix: retain realtime work through draining

R-02: add an OPEN/DRAINING/CLOSED lifecycle orthogonal to freshness. Effect and
recovery authorities are now awaited under a deadline: on expiry the commit
capability is revoked and the work aborted, the caller gets a bounded
non-retryable IDLE_TIMEOUT, and the underlying task is retained rather than
dropped. A draining stream refuses new events and recovery, and close() returns
a Promise that succeeds only once every retained task actually settled,
reporting IDLE_TIMEOUT otherwise.

R-03: a handoff fail-close moves active, probe, quiescing and transition leases
into a retired-writer set before clearing their references, and close() waits on
current and retired writers together, so an abandoned non-cooperative writer can
no longer make teardown report a false success.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/architecture/realtime-events-web-push-and-bounded-polling.md

@@ -34,6 +34,16 @@ capability가 설치됐거나 production-ready라는 뜻이 아니다.
 [Frontend ports, adapters, and boundaries](./frontend-ports-adapters-and-boundaries.md)
 를 따른다.
 
+
+## Bounded task lease와 DRAINING (R-02, R-03)
+
+non-cooperative effect/recovery authority 하나가 stream tail 전체를 영구
+wedge하지 못하도록, common coordinator는 각 task를 deadline으로 감싼다. deadline
+초과 시 commit capability는 즉시 취소되지만 task 자체는 `retainedTasks`에 남아
+stream을 `DRAINING`으로 유지한다. `close()`는 이 retain 집합이 실제로 settle해야
+성공을 반환한다. handoff coordinator도 같은 원칙으로 fail-close된 writer를
+`retiredWriters`에 보존한다.
+
 ## 0. 현재 상태와 목표 delta
 
 이 문서에서 설계 승인, reference source 존재, production 조합과 target browser의