Wave-1 review gate: validation coverage fixes (unschedule, handle-level consumer-local entry points), ADR-008 §4 annotations (whitespace-exclusion, class scope), task check-line staleness fix (ADR-008/009/021, core-contract)

alkstore/src/outbox.rs

@@ -47,7 +47,8 @@ pub trait Outbox: Send + Sync {
     /// Pull op: claim one job, run `delivery`, ack on `Ok`,
     /// `retry(err, None)` (the queue curve) on `Err`. The consumer
     /// calls it in its own loop. `true` = claimed and processed;
-    /// `false` = no work (a value, not an error).
+    /// `false` = no work (a value, not an error). `worker_id` is
+    /// consumer-local, non-empty only (`InvalidName`; ADR-019 §2).
     fn run_once<'a>(
         &'a mut self,
         worker_id: &str,

alkstore/src/queue.rs

@@ -40,7 +40,8 @@ pub trait Queue: Send + Sync {
     ) -> BoxedFuture<'a, Result<Option<Box<dyn JobHandle>>>>;
 
     /// Claim up to `n` rows, same ordering and exclusivity as
-    /// [`Queue::claim_one`].
+    /// [`Queue::claim_one`]. `worker_id` is consumer-local, non-empty
+    /// only (`InvalidName`).
     fn claim_batch<'a>(
         &'a self,
         worker_id: &str,

alkstore/src/store.rs

@@ -96,7 +96,10 @@ pub trait Store: Send + Sync {
     ) -> BoxedFuture<'a, Result<Schedule>>;
 
     /// Remove a schedule registration. `true` = a row was removed;
-    /// `false` = no such schedule (a value, not an error).
+    /// `false` = no such schedule (a value, not an error). `name` is a
+    /// name-bearing entry point (ADR-009 §1) — validated like the
+    /// schedule name: non-empty (`InvalidName`), reserved-prefix
+    /// rejected (`ReservedName`).
     fn unschedule<'a>(&'a self, name: &str) -> BoxedFuture<'a, Result<bool>>;
 
     /// The opt-in scheduler runner: acquire the leadership lock (the

alkstore/src/stream_handle.rs

@@ -45,7 +45,8 @@ pub trait StreamHandle: Send + Sync {
     ) -> BoxedFuture<'a, Result<Vec<StreamEvent>>>;
 
     /// Cursor read from a consumer's stored checkpoint (absent
-    /// consumer = 0).
+    /// consumer = 0). `consumer` is a consumer-local identifier
+    /// (non-empty only — `InvalidName`).
     fn read_from_consumer<'a>(
         &'a self,
         consumer: &str,
@@ -55,11 +56,13 @@ pub trait StreamHandle: Send + Sync {
     /// Save a consumer's checkpoint — always explicit (no
     /// auto-checkpoint cadence). Monotone: a save below the stored
     /// checkpoint is a silent no-op (ADR-019 §6); the `Err` arm
-    /// carries `Database` only (ADR-021 §5).
+    /// carries `Database` only (ADR-021 §5). `consumer` is a
+    /// consumer-local identifier (non-empty only — `InvalidName`).
     fn save_offset<'a>(&'a self, consumer: &str, offset: i64) -> BoxedFuture<'a, Result<()>>;
 
     /// Inspect a consumer's stored checkpoint; absent consumer = 0
-    /// (the pre-save state, ADR-019 §1).
+    /// (the pre-save state, ADR-019 §1). `consumer` is a consumer-local
+    /// identifier (non-empty only — `InvalidName`).
     fn get_offset<'a>(&'a self, consumer: &str) -> BoxedFuture<'a, Result<i64>>;
 
     /// Bounded growth, consumer-invoked: delete events with

alkstore/src/tx.rs

@@ -97,7 +97,8 @@ pub trait TxHandle: Send {
 
     /// Read a consumer's stored checkpoint inside the caller's
     /// transaction; absent consumer = 0 (ADR-019 §1). Pure read.
-    /// Validates `stream`.
+    /// Validates `stream`; `consumer` is consumer-local (non-empty
+    /// only).
     fn get_offset_tx<'a>(
         &'a mut self,
         stream: &str,
@@ -115,7 +116,8 @@ pub trait TxHandle: Send {
     ) -> BoxedFuture<'a, Result<Vec<StreamEvent>>>;
 
     /// Read stream events from a consumer's stored checkpoint, inside
-    /// the caller's transaction. Pure read. Validates `stream`.
+    /// the caller's transaction. Pure read. Validates `stream`;
+    /// `consumer` is consumer-local (non-empty only).
     fn read_from_consumer_tx<'a>(
         &'a mut self,
         stream: &str,