ADR-015: streams depth — carried-metadata keys, global-FIFO ordering, StreamEvent, trim_to (OQ-12 resolved)

docs/architecture/decisions/008-contract-v1-pinning.md

@@ -53,7 +53,11 @@ implement identically):
   shape, the ordering guarantee row, and log retention are OQ-12's —
   the method *names* are pinned here, their depth was left
   un-pinned, mirrored in [core-contract.md](../core-contract.md)
-  streams.)*
+  streams. **Resolved 2026-10-05 by [ADR-015](015-streams-depth.md)** —
+  key = carried metadata, global-FIFO ordering row, event shape
+  pinned, `trim_to` added; `publish_with_key_tx` also joins the
+  tx seam (§2 there); the depth was completed in place,
+  pre-implementation.)*
 - queues v1 skeleton — `enqueue`, `claim_one`, `claim_batch`,
   `ack_batch`, `cancel`, `get_job`, `sweep_expired`; job handle
   `ack / retry / fail / heartbeat`; `EnqueueOpts { delay, run_at,
@@ -114,7 +118,8 @@ a **`TxHandle` trait carrying the `*_tx` methods directly**:
 ```text
 trait TxHandle {
     enqueue_tx(name, opts, payload) -> job_id
-    publish_tx(stream, payload) -> event_id
+    publish_tx(stream, payload) -> offset
+    publish_with_key_tx(stream, key, payload) -> offset   // ADR-015
     notify_tx(channel, payload)
     save_offset_tx(stream, consumer, offset)
     outbox_enqueue_tx(outbox, opts, payload) -> job_id   // ADR-014
@@ -277,7 +282,10 @@ v1 variants (guaranteed-matchable on every engine):
   `try_recv` / `recv_timeout` form of the wake close in §3).
 - `Codec` — payload serialization/deserialization failures
   (`payload_as` on stream events and job payloads; wakes carry no
-  payload per §3).
+  payload per §3). *(Annotated 2026-10-05: a present key on
+  `publish_with_key(_tx)` being non-empty is validated as
+  `InvalidName` ([ADR-015](015-streams-depth.md) §2 — the same
+  entry-point-validation variant, not a new one).)*
 - `Database` — everything else: driver/connection/SQL errors, opaque
   to the contract, engine detail preserved via the error source chain.
   No engine-specific variants are minted for its contents.
@@ -339,6 +347,7 @@ differs):
 | `Lock::heartbeat(ttl)` | `Lock::renew(ttl)` | renew describes the TTL discipline the guarantee row pins; heartbeat is the queue-side renewal term |
 | `Queue::claim_waker()` | (not surfaced) | engine-internal consumption wake (§1) |
 | `StreamSubscription` (`save_every`, auto-save on drop) | `subscribe(consumer) -> Box<dyn EventReceiver>`, explicit saves only | the explicit-offset obligation (core-contract.md streams; the auto-checkpoint ambiguity is not inherited, [ADR-006](006-wake-and-delivery-contract.md)) |
+| `StreamEvent.topic` (field) | `StreamEvent.stream` *(added 2026-10-05 by [ADR-015](015-streams-depth.md) §3)* | one term for the mechanism everywhere — the contract names it streams (the §4 kinds list); the substrate's column stays `topic` per the [ADR-012](012-forked-substrate-design.md) §3 fidelity posture |
 | `update_events()` | (not surfaced) | superseded by the wake subscription — the pinned `WakeReceiver` *is* the reactive-event surface; honker's separate raw update-event stream has no contract role |
 | `prune_notifications` / `prune_notifications_keep_latest` | (not surfaced) | notifications-table maintenance tooling on the SQLite engine; disposition rides OQ-05's sweep/maintenance design (consumer-visible only if that design surfaces it) |
 | `Scheduler` surface | (out of v1, OQ-09 decides) | §1 |