docs: A worker whose pushed load records go silent is routed around after --worker-stale-secs (default 15 s) - #159

Reviewed SMG source: a29c64d4323dbf21950e2822cb099af04f6fd901.

All edits serve the stale-load-records-veto concern on the single allowlisted canonical page. Every claim verified against source a29c64d4: --worker-stale-secs default 15 / 0 disables (main.rs:681, liveness.rs:111, records_stopped liveness.rs:598, router_args.py:309); only gRPC KV-event-stream workers ever get note_load_record (sole caller apply_pushed_load monitor.rs:499 from subscription.rs:437; SubscribeKvEvents unimplemented over ZMQ, backend_client.rs:243), so the HTTP/ZMQ exemption is correct; contact sources (poll answers monitor.rs:1125, passed probes on_probe_passed, KV batches/records, tokens via note_token_progress updating last_contact_ms) all clear the Unreachable veto at once; the 250 ms sweep (monitor.rs:1315) runs unconditionally for all workers and the text correctly avoids an exact-instant promise. The prior review's counterexample is repaired exactly: the steering bullet now matches fallback_if_all_vetoed (overload.rs:115) — least-loaded healthy, breaker-closed candidate that shedding does not rule out, with shed_if_all_overloaded running first under --worker-overload-shed. The invalid release comparison was replaced by a short standalone Unreleased note with no version boundary; the rewritten section drops log strings and stream plumbing while keeping all required elements (~270 words vs the ~200 target, acceptable). Fail-open generalization qualified in place; no code/PR references in prose. Related pages (health-checks.md, configuration.md, zmq-workers.md, kv-events-cache-aware.md, reliability index) retain no contradictory claims; the configuration.md flag row is assigned to the deploy-config scan and the table claims no completeness. Limitation: the page's pre-existing overload-protection defaults/shedding prose is stale against current main (protection now on by default, shed opt-in), but that is untouched text constituting a separate concern; the new section stays accurate independently. No review threads exist in the feedback payload, so addressed_threads is empty; the state-level repair guidance is fully reflected in the final prose.