Third review round follow-through: enqueue_tx stamp source, sweep_expired handle form, with_tx signature, and B-block ambiguity pins

docs/architecture/decisions/007-transactional-seam.md

@@ -56,6 +56,24 @@ handle.commit() / handle.rollback()
   wrapper over* the handle shape, not instead of it (the POC verified
   the reverse composition doesn't work: a closure cannot outlive
   itself, so caching-subscriber state can't escape it).
+  *(Signature pinned 2026-10-07, third review round follow-through —
+  the last "shape at implementation" deferral this ADR carried:*
+  ```text
+  store.with_tx(f) -> Result<()>                  // on the Store trait
+      f: FnOnce(&mut dyn TxHandle) -> BoxedFuture<Result<()>>
+  ```
+  *The trait method is deliberately **non-generic** (a `Store` trait
+  object must stay object-safe, ADR-008 §2's posture) and returns
+  `Result<()>`: the closure signals commit/rollback by its own result
+  (`Ok` ⇒ commit, `Err` ⇒ rollback; drop/panic across the closure ⇒
+  rollback, ADR-021 §4's disposition) and returns values through the
+  caller's captured state (the handle never escapes the closure —
+  the same box-in/box-out composition the POC's closure-scoped arm
+  (b) verified works, with (a)'s preference unchanged: `with_tx` is
+  the convenience, `begin_tx` the seam). The closure's future boxes
+  for object safety. An engine may additionally offer a generic
+  value-returning `with_tx` convenience on its *concrete* store type;
+  that ergonomics layer is engine surface, not contract.)*
 - Both engines deliver the property **natively** — no emulation:
   in-tx notify/Notify delivers only at commit; rollback drops job rows,
   business rows, and notifications together (the POC property tests on