docs: record the circuit-open wait policy and the retry_after contract

README gains the key with the reason a single-source scope wants wait,
and the price of choosing it. .env.example carries the same warning
since README points at it as the full key list. ARCHITECTURE 7.4 records
why the missing cell is unrelated to source count -- and why keying on
len(sources) would be the worse debt -- plus the six-exit retry_after_s
contract and the admission convergence; 9 registers the key.

CHANGELOG stays unreleased per the release checklist: the version bump
belongs to the release run, not here. Its "read this first" section
covers the half-open retry_after_s change, which is visible even on the
default fail_fast setting.

.env.example

@@ -48,7 +48,12 @@ LLM_CIRCUIT_BREAKER_COOLDOWN=60          # 或 LLM__BREAKER__COOLDOWN_S
 # LLM__BREAKER__MAX_COOLDOWN_S=300       # 开路指数退避封顶(缺省 max(300, cooldown))
 # ── AIMD 自适应并发(M2.5,库常量非 env 键): 每源初始 8,429 ×0.5,成功 +1/limit,
 # ── ceiling = max(64, 源级 MAX_CONCURRENCY);禁用需构造函数注入自定义 pacer ──
-# LLM__QUOTA_FULL=wait                   # wait(默认) | fail_fast
+# LLM__QUOTA_FULL=wait                   # 配额满: wait(默认) | fail_fast
+# ── 熔断全拒时的处置(issue #14)。单源 scope 建议 wait: 只有一个源时
+# ── "停用这个源"等于"整个 scope 停服",fail_fast 会让开路期间的每次调用
+# ── 在几毫秒内死掉且 MAX_ATTEMPTS 一格用不上。wait 不削弱保护(等待期照样
+# ── 不发请求),只是把最坏墙钟拉长到 BACKPRESSURE__STALL_WINDOW_S ──
+# LLM__CIRCUIT_OPEN=fail_fast            # 熔断开路: fail_fast(默认) | wait
 
 # ══ 装配选择(PGW_*)══
 PGW_LIMITER_BACKEND=memory               # memory | redis(redis 需 REDIS_URL;多进程 worker 必须 redis)