ADR-021: third review round — tx-read methods, Job.claimed_at, schedule() queue validation, drop=rollback, receiver arms

docs/architecture/queues.md

@@ -1,6 +1,6 @@
 ---
 status: draft
-last_updated: 2026-10-06 (ADR-019/020 — handle surfaces, enqueue semantics)
+last_updated: 2026-10-07 (ADR-021 — third review round: tx reads, claimed_at, schedule queue validation)
 ---
 
 # Queues, scheduler, outbox — semantics depth
@@ -43,7 +43,10 @@ made under; the ADRs carry the WHY.
   relative-`expires` pinned by
   [ADR-020](decisions/020-enqueue-opt-semantics-and-bridges.md) §1/§2);
   `ack / retry / fail / heartbeat` on the boxed `JobHandle` a claim
-  returns ([ADR-019](decisions/019-mechanism-handle-surfaces.md)).
+  returns ([ADR-019](decisions/019-mechanism-handle-surfaces.md));
+  reads (`get_job`, and tx-side `get_job_tx` —
+  [ADR-021](decisions/021-tx-reads-and-value-shape-fixes.md) §1) are
+  name-taking pure reads, tx-shaped on the handle.
 - **Cut-flag context**: result storage is
   [ADR-002](decisions/002-feature-scope.md)'s cut-flag row;
   [ADR-010](decisions/010-queue-semantics-depth.md) §7 reconsidered it
@@ -184,7 +187,11 @@ Collapsed into queues: no `Scheduler` handle, no schedule objects.
 
 - Surface: `schedule(name, spec, queue, payload, opts)` (upsert by
   name), `unschedule(name) -> bool`, `run_schedules(stop) -> Result<()>`.
-  Update = re-register; pause = unregister + re-register.
+  Update = re-register; pause = unregister + re-register. Both
+  name-bearing arguments validate at the entry point — the schedule
+  name and (since
+  [ADR-021](decisions/021-tx-reads-and-value-shape-fixes.md) §3) the
+  queue argument, identically (non-empty, reserved-prefix rejected).
 - **Spec grammar v1: `@every <n><unit>` only** (`s|m|h|d`). Cron
   strings rejected with `InvalidSpec { spec }` (grammar rationale in
   the ADR; extension path: a consumer-inventory row first).
@@ -284,6 +291,7 @@ Collapsed into queues: no `Scheduler` handle, no schedule objects.
 | [014](decisions/014-outbox-tx-enqueue.md) | Outbox tx enqueue | `outbox_enqueue_tx` on `TxHandle`; derived backing queue reached only through the outbox surface |
 | [019](decisions/019-mechanism-handle-surfaces.md) | Handle surfaces | queue ops on the `Queue` handle, `JobHandle` from claims, `worker_id` identity, `Job`/`Schedule` shapes, core `StopToken` |
 | [020](decisions/020-enqueue-opt-semantics-and-bridges.md) | Enqueue options | delay-over-run_at; relative `expires`; scheduler fires stamp from derived queue defaults |
+| [021](decisions/021-tx-reads-and-value-shape-fixes.md) | Third review round | tx-read methods on `TxHandle` (`get_job_tx` etc.); `Job.claimed_at` restored; `schedule()` queue argument rejects the reserved prefix (backing queue reachable only through the outbox surface) |
 
 ## Open Questions