ADR-014: transactional outbox enqueue — outbox_enqueue_tx on TxHandle (OQ-13 resolved)

docs/architecture/queues.md

@@ -24,7 +24,10 @@ made under; the ADRs carry the WHY.
   [ADR-009](decisions/009-scheduler-collapse.md)).
 - **Transactional enqueue**: commit-atomic with the caller's business
   write on both engines ([ADR-007](decisions/007-transactional-seam.md));
-  rollback drops the job row with no ghosts.
+  rollback drops the job row with no ghosts. For the outbox's backing
+  queue the tx path is `outbox_enqueue_tx` (the derived reserved names
+  are unreachable by `enqueue_tx` —
+  [ADR-014](decisions/014-outbox-tx-enqueue.md)).
 - **Exactly-once claim**: `FOR UPDATE SKIP LOCKED` (pg, POC-pinned
   under 4×4 concurrency) / the forked substrate's single-statement
   claim (SQLite, re-derived on [ADR-010](decisions/010-queue-semantics-depth.md)
@@ -260,6 +263,7 @@ Collapsed into queues: no `Scheduler` handle, no schedule objects.
 | [010](decisions/010-queue-semantics-depth.md) | Queue depth | visibility/heartbeat rules, backoff curve, dead-letter, no-stranded-rows sweep, schema layout |
 | [011](decisions/011-sqlite-substrate-fork.md) | Substrate fork | SQLite-side queue ops re-derived in owned code; `__alkstore_*` naming |
 | [012](decisions/012-forked-substrate-design.md) | Fork design | contract-blind substrate boundary; fidelity posture; port deltas |
+| [014](decisions/014-outbox-tx-enqueue.md) | Outbox tx enqueue | `outbox_enqueue_tx` on `TxHandle`; derived backing queue reached only through the outbox surface |
 
 ## Open Questions