ADR-021: third review round — tx-read methods, Job.claimed_at, schedule() queue validation, drop=rollback, receiver arms

docs/architecture/decisions/019-mechanism-handle-surfaces.md

@@ -114,10 +114,16 @@ trait Lock {
   carries; a `Queue` handle without `claim_*` would be a construction
   ceremony with no behavior. Honker's `Job`-ops-on-claimed-work shape
   and `Lock::release(self)` RAII shape are likewise inherited.
-- `get_job`, `save_offset`, `get_offset`, `read_*` remain available
+- `get_job`, `save_offset`, `get_offset`, `read_since`,
+  `read_from_consumer` remain available
   from *inside* a transaction through the `TxHandle`'s `*_tx` methods
-  — the handle forms are the auto-commit convenience counterparts
-  ([ADR-007](007-transactional-seam.md)).
+  (`get_job_tx`, `get_offset_tx`, `read_since_tx`,
+  `read_from_consumer_tx` —
+  [ADR-021](021-tx-reads-and-value-shape-fixes.md) §1) — the handle
+  forms are the auto-commit convenience counterparts
+  ([ADR-007](007-transactional-seam.md)); claim/maintenance ops are
+  deliberately not tx-shaped (no `claim_tx` — a claim's visibility
+  deadline must not be tied to a business transaction's lifetime).
 - The **reserved-prefix / name validation rules apply to the
   constructors** (`queue`/`stream`/`outbox`/`try_lock`) exactly as
   pinned by [ADR-008](008-contract-v1-pinning.md) §4 — nothing new;
@@ -160,6 +166,9 @@ struct Job {
     attempts: i64,                      // every claim counts
     max_attempts: i64,                  // the row's stamp
     worker_id: Option<String>,          // claimant, None pre-claim
+    claimed_at: Option<i64>,            // unix seconds at the most
+                                        // recent claim; None pre-claim
+                                        // (added by ADR-021 §2)
     claim_expires_at: Option<i64>,      // deadline, None pre-claim
     created_at: i64,                    // unix seconds
     expires_at: Option<i64>,            // job-level expiry, None =
@@ -191,10 +200,19 @@ trait JobHandle {
   §2 — `processing` + unexpired caller deadline) governs a
   `JobHandle`'s ops; a get_job row yields no handle, so no ghost ops
   exist on it. Ops take `self: Box<Self>` mirroring `TxHandle`'s
-  commit shape (consumed handle, one-shot discipline).
+  commit shape (consumed handle, one-shot discipline); `heartbeat` is
+  the deliberate counter-case — `self, extend: i64`, repeatable,
+  because renewal is inherently repeated within one claim (the same
+  one-shot/repeatable split the receiver shapes carry; do not
+  "fix" the asymmetry at implementation).
   `err: Option<String>`: `None` = the engine's
   documented-default string (taxonomy-consistent: these strings are
   row content, `get_job` data — not matched error variants).
+  *(Struct corrected 2026-10-07 by
+  [ADR-021](021-tx-reads-and-value-shape-fixes.md) §2: `claimed_at`
+  was missing from the original pinning —
+  [ADR-010](010-queue-semantics-depth.md) §1's `get_job` list carried
+  it and the fork schema adds the column — restored above.)*
 - `Schedule` (the `schedule()` read-back value):
   `Schedule { name: String, spec: String, queue: String, opts:
   ScheduleOpts }`.