docs: Phase 1 review round — wake wording honesty, job-handle validity predicate, outbox/streams depth OQs

- C2: 'at-least-once wake delivery' collapsed to 'best-effort hints'
  (ADR-006 §1 + core-contract) — coalescing and the pg no-replay hole
  contradict per-commit wake promises; the guarantee table's row was
  already correct.
- W2: uniform job-handle validity predicate pinned (ADR-010 §2,
  core-contract, queues.md; verification-backlog row): processing
  state + unexpired deadline; D-12's missing-check not inherited.
- W1: outbox run_once worker semantics pinned in core-contract
  (pull op, ack/retry-on-curve, no heartbeat in delivery — honker
  parity, dual-execution window documented).
- W3: named-locks tx-seam posture stated (no lock_tx; acquisition is
  auto-commit; TTL discipline governs).
- C1 -> OQ-12: streams depth (key semantics w/ honker ground, event
  shape, ordering row, retention); method names pinned, depth open.
- New find -> OQ-13: the v1 TxHandle surface cannot express the
  transactional outbox enqueue (derived backing-queue name is
  reserved-prefix-rejected; honker's raw-Transaction seam unavailable);
  option set + decision rule sketched.
- README resolution order refreshed (OQ-06 resolved); ScheduleOpts +
  stream consumption-trigger lines added to core-contract.

docs/architecture/queues.md

@@ -65,8 +65,15 @@ made under; the ADRs carry the WHY.
       ┌────────┐   fail(err) / budget         │
       │  dead  │ ◄────── exhausted ───────────┘
       └────────┘
-           │        ack deletes the row
-           │        (from processing, claim still valid)
+            │        ack deletes the row
+            │        (from processing, deadline unexpired)
+
+      Handle-op validity (ADR-010 §2, uniform): ack/heartbeat/retry/
+      fail succeed only while the row is processing and the claim's
+      deadline is unexpired — lapse refuses all handle ops; a worker
+      whose deadline lapsed before reclaim may still complete its
+      work, but its ack does not land (the job reprocesses at
+      reclaim — at-least-once).
            │
            ▼
       (gone)
@@ -84,9 +91,13 @@ made under; the ADRs carry the WHY.
   [ADR-010](decisions/010-queue-semantics-depth.md) §3a).
   `heartbeat(extend)` is renewal — an absolute reset from now (the new
   full deadline, not additive); a **late heartbeat is refused** (never
-  steals the job back from a reclaimer). Between deadline lapse and
-  another worker's reclaim, the original worker may still complete —
-  the dual-execution window is the contract's honest at-least-once
+  steals the job back from a reclaimer). Deadline lapse refuses all
+  handle ops uniformly (the validity predicate,
+  [ADR-010](decisions/010-queue-semantics-depth.md) §2). Between
+  deadline lapse and another worker's reclaim, the original worker may
+  still complete its *work* — but its ack refuses and the row
+  reprocesses at reclaim — the dual-execution window is the
+  contract's honest at-least-once
   posture; downstream idempotence is the consumer's job.
 - **Reclaim consumes an attempt**: a handler that forgets to
   heartbeat looks like a repeatedly-failing job and dead-letters on