Record Dataflow recovery adoption

docs/RECOVERY_LEDGER_ADOPTION.md

@@ -50,6 +50,13 @@ the immutable snapshot and terminal checkpoint commit atomically. The generic
 external-mutation contract is conformance-tested but remains `planned` until a
 production connector actually publishes, updates, or deletes provider state.
 
+Dataflow runs are adopted. Database-only execution uses one atomic terminal
+commit for the run projection and recovery checkpoint. Output publication uses
+forward recovery: source and output digests are checkpointed before dispatch,
+a conclusive provider result commits with the run projection, and an expired
+or failed attempt after dispatch becomes `outcome_unknown`. A stale attempt may
+be retried only when its durable boundary proves dispatch had not started.
+
 ## Operator Contract
 
 Ops lists non-terminal and manual-intervention operations. Operators must verify

docs/recovery-operation-inventory.json

@@ -125,7 +125,7 @@
       "resources": ["postgresql"],
       "mode": "atomic",
       "fenced": true,
-      "adoption": "planned",
+      "adoption": "adopted",
       "issue": "https://git.add-ideas.de/GovOPlaN/govoplan-dataflow/issues/19"
     },
     {
@@ -134,7 +134,7 @@
       "resources": ["postgresql", "queue", "object-storage", "external-sink"],
       "mode": "forward_recovery",
       "fenced": true,
-      "adoption": "planned",
+      "adoption": "adopted",
       "issue": "https://git.add-ideas.de/GovOPlaN/govoplan-dataflow/issues/19"
     },
     {