Third review round follow-through: enqueue_tx stamp source, sweep_expired handle form, with_tx signature, and B-block ambiguity pins

docs/architecture/decisions/019-mechanism-handle-surfaces.md

@@ -189,12 +189,23 @@ trait JobHandle {
     job(&self) -> &Job                  // the row, as a value
     ack(self: Box<Self>) -> bool
     retry(self: Box<Self>, err: Option<String>, delay: Option<i64>)
-                                        // None delay = queue curve
+          -> bool                       // None delay = queue curve
     fail(self: Box<Self>, err: Option<String>) -> bool
     heartbeat(self, extend: i64) -> bool    // absolute reset
 }
 ```
 
+*(Annotated 2026-10-07, third review round follow-through: the
+original sketch elided `retry`'s return type — pinned `-> bool`,
+the same validity predicate as its siblings. A refused retry —
+deadline lapsed, row reclaimed/cancelled/acked elsewhere — leaves
+the handle's op **not applied**: the handle was consumed by
+`retry(self: Box<Self>, …)` regardless (caller-side), but the row
+keeps its pre-call state (still `processing`, or gone if acked/cancelled)
+with its original stamps; no dead-letter, no schedule-side delay is
+recorded. `false` = the caller's window closed, at-least-once
+redelivery governs.)*
+
   — and **`get_job` returns `Option<Job>`** (pure data). The *same
   uniform validity predicate* ([ADR-010](010-queue-semantics-depth.md)
   §2 — `processing` + unexpired caller deadline) governs a
@@ -205,9 +216,18 @@ trait JobHandle {
   because renewal is inherently repeated within one claim (the same
   one-shot/repeatable split the receiver shapes carry; do not
   "fix" the asymmetry at implementation).
-  `err: Option<String>`: `None` = the engine's
-  documented-default string (taxonomy-consistent: these strings are
-  row content, `get_job` data — not matched error variants).
+   `err: Option<String>`: `None` = the engine's
+   documented-default string (taxonomy-consistent: these strings are
+   row content, `get_job` data — not matched error variants).
+   *(Annotated 2026-10-07, third review round follow-through: the
+   default string is pinned — **`fail(None)` records `"failed"`**;
+   `retry(None, …)` that exhausts the budget records
+   `"max attempts exceeded"`, per
+   [ADR-010](010-queue-semantics-depth.md) §4's path-based rule —
+   exhaustion is engine-observed state, so the path's pinned string
+   wins over the caller-None case; a successful `retry(None, …)`
+   records nothing (the row returns to pending, `last_error` exists
+   only on dead rows).)*
   *(Struct corrected 2026-10-07 by
   [ADR-021](021-tx-reads-and-value-shape-fixes.md) §2: `claimed_at`
   was missing from the original pinning —