Fence and reconcile workflow runtime effects

README.md

@@ -20,6 +20,8 @@ for the ownership and compatibility policy.
 See [the module concept](docs/CONCEPT.md) and
 [BPMN interoperability contract](docs/BPMN_INTEROPERABILITY.md) for runtime
 semantics and adapter boundaries.
+See [durable runtime recovery](docs/DURABLE_RUNTIME_RECOVERY.md) for action,
+worker, timer, and unknown-provider-outcome handling.
 
 The optional `workflow_engine.service_launcher` capability lets Portal start an
 authorized active workflow from an exact published Service revision. It resolves
@@ -37,6 +39,14 @@ human handoffs; event filters and variable mappings are bounded JSON
 expressions and never executable code. Cron remains an optional governed
 scheduler-adapter concern.
 
+Consequential module actions are staged in Core's durable recovery ledger
+before provider dispatch. Conclusive effects commit with the Workflow
+projection. Lost acknowledgements block continuation and expose evidence-based
+**Effect confirmed** and **Effect absent** operator actions instead of a blind
+retry. Instance workers, trigger deliveries, and timers are fenced across
+hosts; linked Dataflow recovery states remain unresolved until Dataflow reports
+a conclusive outcome.
+
 ## Checks
 
 ```bash