docs(mem): pin growth postures and outbox delivered-or-reclaimable semantic

Review 004 items 10+11: the two recorded mem growth postures
(subscribe backlog drain unbounded on the consumer side; O(live-rows)
claim scan with full-row clones) and the outbox's 'processed means
delivered-or-reclaimable' semantic, pinned in engine-mem.md. The
debug_assert arm was declined: the dropped ack/retry booleans also
refuse benignly on legitimate in-closure handle ops, so it cannot
separate a visibility lapse from a deliberate first-party outcome.

docs/architecture/engine-mem.md

@@ -1,13 +1,14 @@
 ---
 status: stable
-last_updated: "2026-10-10 (the wave-6 review gate passed: the
-conformance read clean — three edge-domain fixes landed inline (the
-stream cursor read's `i64::MAX` overflow, `trim_to`'s horizon
-endpoint, the scheduler register-time interval overflow now rejecting
-with `InvalidSpec` like the SQLite register) plus scaffold-residue
-cleanup; the third column's 25-row set green under the current-thread
-flavor; the wasm32 gate + feature subset verified; the rider's arms
-verified)"
+last_updated: "2026-10-11 (review-004 items 10+11 pinned: the growth
+postures section — subscribe backlog drain, O(live-rows) claim scan —
+and the outbox's delivered-or-reclaimable semantic; the wave-6
+review gate had passed earlier — conformance read clean, three
+edge-domain fixes landed inline (the stream cursor read's `i64::MAX`
+overflow, `trim_to`'s horizon endpoint, the scheduler register-time
+interval overflow now rejecting with `InvalidSpec`), the third
+column's 25-row set green under the current-thread flavor, the
+wasm32 gate + feature subset verified, the rider's arms verified)"
 ---
 
 # Mem engine
@@ -98,6 +99,23 @@ private to the caller's handle.
 | begin_tx | overlay allocation ([ADR-007](decisions/007-transactional-seam.md)) |
 | handle ops | direct `.await`s on guarded state; `encode_payload` via core (ADR-020 §4) |
 
+### Outbox semantics
+
+The outbox is a helper over queues ([ADR-014](decisions/014-outbox-tx-enqueue.md)):
+`run_once` claims one job through the ordinary claim machinery and
+applies the outcome when delivery returns — `Ok` ⇒ ack, `Err` ⇒
+retry on the queue's own curve. The ack/retry application's
+row-ref booleans are dropped: a delivery that outlived its
+visibility window (or a consumer side-effect that handled the row
+first, e.g. an in-closure `ack`/`retry` on the boxed handle) leaves
+the outer outcome unapplied, and `run_once` still reports `true`.
+Inherent to the no-heartbeat outbox design — at-least-once reclaim
+is the recovery, not a second report. **Processed means
+delivered-or-reclaimable**: `true` attests the claim was processed,
+not that the ack/exhaust landed; renewal inside the window is the
+consumer's obligation ([ADR-019](decisions/019-mechanism-handle-surfaces.md)
+§5) and reclaim closes a lapsed one.
+
 ## Asymmetry classification (ADR-024 §3)
 
 | Asymmetry | Mem posture |
@@ -107,6 +125,24 @@ private to the caller's handle.
 | Receiver close | one close path: engine drop closes open receivers (process exit/shutdown); contract close-arm shapes apply unchanged ([ADR-021](decisions/021-tx-reads-and-value-shape-fixes.md)) |
 | Wake coalescing | not applicable — direct at-commit delivery, per-subscriber FIFO; the engine spec line above pins it |
 
+## Growth postures (review 004 items 10–11)
+
+Two perf/posture notes recorded at the pre-release general review
+(the mem side of [deployment.md](deployment.md)'s accepted growth
+families), pinned here as the code-level economics:
+
+- **Subscribe backlog drain** — the subscribe path drains the full
+  event backlog into the receiver's pending deque *before the first
+  yield*, and pending keeps growing at publish rate while a consumer
+  is stalled (`alkstore-mem/src/stream.rs:314-331` — the documented
+  "drains to the tail then parks" shape, unbounded on the consumer
+  side). The feed ends at engine drop; `trim_to` bounds the stored
+  log, not a stalled consumer's pending deque.
+- **Claim scan** — the claim path is an O(total-live-rows) scan with
+  full-row clones per claim (`alkstore-mem/src/queue.rs:122-181`) —
+  blessed economics for the ephemeral tier ([ADR-024](decisions/024-mem-engine.md)
+  §2).
+
 ## Isolation and the suite factory
 
 Each `MemStore::new()` yields a distinct engine instance sharing