Record Core lifecycle recovery adoption

docs/RECOVERY_LEDGER_ADOPTION.md

@@ -67,6 +67,16 @@ cannot be retried until evidence confirms either that the effect occurred or is
 absent. Linked Dataflow uncertainty blocks the Workflow without duplicating
 Dataflow's recovery authority.
 
+Core module lifecycle is adopted at four boundaries. Installer recovery is
+prepared before snapshots so a full database restore preserves the attempted
+operation. Pre-migration package changes use compensation, migrated changes use
+forward recovery, destructive retirement requires a hashed and restore-checked
+snapshot, and live graph changes restore the prior registry when no migration
+ran. A deployment-wide database fence serializes these effects; any unresolved
+predecessor blocks a differently keyed retry until explicit reconciliation.
+Supervised installs become successful only after restart and health evidence is
+recorded.
+
 ## Operator Contract
 
 Ops lists non-terminal and manual-intervention operations. Operators must verify

docs/recovery-operation-inventory.json

@@ -161,7 +161,7 @@
       "resources": ["postgresql", "package-environment", "webui-bundle", "filesystem"],
       "mode": "compensation",
       "fenced": true,
-      "adoption": "planned",
+      "adoption": "adopted",
       "issue": "https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/281"
     },
     {
@@ -170,7 +170,7 @@
       "resources": ["postgresql", "package-environment", "webui-bundle", "runtime-nodes"],
       "mode": "forward_recovery",
       "fenced": true,
-      "adoption": "planned",
+      "adoption": "adopted",
       "issue": "https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/281"
     },
     {
@@ -179,7 +179,16 @@
       "resources": ["postgresql", "object-storage", "package-environment"],
       "mode": "snapshot_restore",
       "fenced": true,
-      "adoption": "planned",
+      "adoption": "adopted",
+      "issue": "https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/281"
+    },
+    {
+      "id": "core.module-runtime.apply-graph",
+      "repository": "govoplan-core",
+      "resources": ["postgresql", "runtime-nodes", "module-registry"],
+      "mode": "compensation",
+      "fenced": true,
+      "adoption": "adopted",
       "issue": "https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/281"
     }
   ]

tests/test_recovery_operation_inventory.py

@@ -23,6 +23,11 @@ REQUIRED_PREFIXES = {
     "dataflow.",
     "workflow-engine.",
     "core.module-lifecycle.",
+    "core.module-runtime.",
+}
+ATOMIC_EXTERNAL_READS = {
+    "connectors.sync.read-snapshot",
+    "mail.mailbox.sync-cursor",
 }
 
 
@@ -50,6 +55,7 @@ def test_non_atomic_operations_do_not_claim_plain_database_rollback() -> None:
     operations = json.loads(INVENTORY.read_text(encoding="utf-8"))["operations"]
     for item in operations:
         if item["mode"] == "atomic":
-            assert item["resources"] == ["postgresql"] or item["id"] == (
-                "connectors.sync.read-snapshot"
+            assert (
+                item["resources"] == ["postgresql"]
+                or item["id"] in ATOMIC_EXTERNAL_READS
             )