Third review round follow-through: enqueue_tx stamp source, sweep_expired handle form, with_tx signature, and B-block ambiguity pins

docs/architecture/decisions/008-contract-v1-pinning.md

@@ -212,7 +212,11 @@ struct Wake { channel: String }
   the receiver's forms: `recv() -> None` means closed (source death);
   `try_recv`/`recv_timeout` return `Err(Closed)` when the source is
   closed, versus `Ok(None)` when merely no wake is pending right now
-  — closed and idle are distinguishable states.
+  — closed and idle are distinguishable states. *(Timeout arm pinned
+  2026-10-07, third review round follow-through: `recv_timeout(d)`'s
+  expiry without a wake returns `Ok(None)` — idle is the documented
+  `Ok(None)` arm; `Err` on that method carries `Database` (storage
+  failure) or `Closed` (source death), never a timeout signal.)*
 
 ### 4. Reserved namespace — exact strings
 
@@ -238,7 +242,14 @@ struct Wake { channel: String }
   consumer arguments, `subscribe(consumer)`) are *not* a reserved-
   namespace kind — they are consumer-local identifiers, not shared
   engine namespaces; no prefix rule applies (an engine may still quote
-  them).
+  them). *(Annotated 2026-10-07, third review round follow-through:
+  the consumer-local identifier classes take the **non-empty rule
+  only** — an empty stream-consumer name or empty `try_lock` owner is
+  `InvalidName`, mirroring `worker_id`'s rule
+  ([ADR-019](019-mechanism-handle-surfaces.md) §2) — with no
+  reserved-prefix rejection (they are not a shared namespace, so a
+  leading `__alkstore_` is the caller's own local name, no engine
+  namespace to collide with).)*
 - Per-engine internal names:
   - SQLite: honker's machinery owns two categories of internal names,
     and the contract treats them differently. Its `_honker_*` *table*
@@ -283,7 +294,11 @@ v1 variants (guaranteed-matchable on every engine):
 - `PayloadTooLarge { limit }` — **universal variant**, produced by the
   Postgres engine's client-side check (8000 bytes, POC #2
   verified-before-round-trip) and by contract never on SQLite (no
-  limit — the documented engine asymmetry). The variant lives in the
+  limit — the documented engine asymmetry). The measured quantity
+  *(pinned 2026-10-07, third review round follow-through)* is the
+  **serde_json serialization of the payload `Value`** — the same
+  byte string ADR-020 §4 pins as the stored row bytes — the check and
+  the storage measure one quantity. The variant lives in the
   shared taxonomy so the limit asymmetry is visible to engine-agnostic
   code — a caller can match it without knowing which engine is behind
   the store, and the error itself documents the boundary. The
@@ -397,7 +412,14 @@ trait EventReceiver {
 No `save_every`, no save-on-drop — checkpointing is the consumer's
 explicit call (the §1 obligation). The consumer's *name* is fixed at
 `subscribe(consumer)`; it is a consumer-local identifier (no reserved
-prefix, §4).
+prefix, §4). *(Annotated 2026-10-07, third review round follow-through:
+`EventReceiver` deliberately carries **no `recv_timeout`** — unlike
+`WakeReceiver` (§3) — because a stream consumer's steady state is
+wake-driven re-read (the queues split applies: the durable row is the
+truth, the wake is the hint) and its polling-shaped needs are already
+served by `try_recv` and the offset-anchored `read_since`; a
+bounded-wait convenience has no row naming it. Stated so the absence
+is read as design, not oversight.)*
 
 ## Consequences