[jacobcxdev]

Busy chats previously kept renewing work before the upgrade controller reached its drain command, so deployment could defer indefinitely. Upgrades now pause new admissions first and let each dispatched turn finish. Completed WebSocket chats receive 1012 and reconnect; new connections queue while remaining turns drain and the verified successor takes ownership.

• Removed the default drain deadline while keeping explicit bounded requests and preparation/recovery limits.
• Kept CLI reconciliation waiting for a known active transaction; prepared-only or unreadable receipts still report unverified selection. Authenticated bounded status probes detect a stopped controller behind a stale waiting receipt while paused-listener timeouts remain pending.
• Reconciled a verified unchanged runtime without another handoff, preserving truthful receipts and rollback artifacts.
• Added overlapping-turn, continuous-traffic, queued-request and failure-path regression coverage.

Validation: go build ./..., go vet ./..., and go test -race -count=1 ./... passed. Focused final CLI race tests passed. Native Homebrew acceptance at final head c9bf4fa passed: all 163 admitted turns completed, HTTP 200=148, WebSocket 101=14, zero 503, refused connections or continuity mismatches, one coordinator owner and the same listener/PID. Production state stayed unchanged.

The already-running v0.34.2 controller still needs its existing initial quiet boundary to load this fix. Subsequent handovers use the new drain ordering.