ADR-021: third review round — tx-read methods, Job.claimed_at, schedule() queue validation, drop=rollback, receiver arms

docs/architecture/decisions/009-scheduler-collapse.md

@@ -74,7 +74,13 @@ store.run_schedules(stop) -> Result<()>        // runs until `stop`
   [ADR-008](008-contract-v1-pinning.md) §4 sense (their consumers-side
   obligation extends the entry-point list: a reserved-prefix schedule
   name could collide with the machinery's derived names). No charset
-  rule beyond that in v1.
+  rule beyond that in v1. *(The **queue argument** of `schedule()`
+  gets the same directly-supplied-queue-name validation, added
+  2026-10-07 by [ADR-021](021-tx-reads-and-value-shape-fixes.md) §3 —
+  without it, a schedule row could store a reserved name as its fire
+  target and every boundary fire would enqueue into it, a third write
+  path into the outbox's backing queue contradicting
+  [ADR-014](014-outbox-tx-enqueue.md)'s stated guarantee.)*
 - `run_schedules` is the tick: acquire the leadership lock, loop
   {renew lock — on loss, *return before ticking*; fire every due
   boundary; sleep until the next due boundary or `stop`}. Losing