ADR-021: third review round — tx-read methods, Job.claimed_at, schedule() queue validation, drop=rollback, receiver arms

docs/architecture/decisions/010-queue-semantics-depth.md

@@ -51,11 +51,16 @@ Contract job states: **`pending` → `processing` → `dead`** (+ absence:
 - **`get_job` sees dead jobs.** The returned job carries state,
   payload, attempts, priority, and the timestamps `created_at`,
   `run_at`, `claimed_at`, `expires_at` — plus, dead-only, `last_error`
-  and `died_at` (no job = `None`). This deliberately *narrows* honker's
-  surface (honker's `get_job` reads only live rows — post-mortem
-  diagnosis was SQL-only); diagnosis-by-API is the honest fix, and it
-  is what makes move-to-dead (vs flag-in-place) inspectable without
-  raw SQL.
+  and `died_at` (no job = `None`). *(Struct disposition 2026-10-07
+  per [ADR-021](021-tx-reads-and-value-shape-fixes.md) §2:
+  `claimed_at: Option<i64>` — None pre-claim, set on every claim —
+  now stands in [ADR-019](019-mechanism-handle-surfaces.md) §3's
+  pinned struct, which is the field list of record; ADR-019's
+  original omission is corrected there.)* This deliberately *narrows*
+  honker's surface (honker's `get_job` reads only live rows —
+  post-mortem diagnosis was SQL-only); diagnosis-by-API is the honest
+  fix, and it is what makes move-to-dead (vs flag-in-place)
+  inspectable without raw SQL.
 - **`cancel` is unconditional** (honker parity): it deletes the row in
   either `pending` or `processing`, regardless of which worker holds
   it. Not an interrupt — the holder's next ack/heartbeat returns