Record workflow recovery ledger adoption

docs/RECOVERY_LEDGER_ADOPTION.md

@@ -57,6 +57,16 @@ a conclusive provider result commits with the run projection, and an expired
 or failed attempt after dispatch becomes `outcome_unknown`. A stale attempt may
 be retried only when its durable boundary proves dispatch had not started.
 
+Workflow Engine is adopted at both declared boundaries. Instance workers,
+trigger deliveries, and timer resumptions use process-bound distributed fences.
+Every module-action invocation records the pinned definition, input, preview,
+authority, provider-idempotency, and action-contract hashes before dispatch.
+Conclusive results commit with the Workflow projection. A lost acknowledgement,
+invalid result, or unannounced non-atomic effect becomes `outcome_unknown` and
+cannot be retried until evidence confirms either that the effect occurred or is
+absent. Linked Dataflow uncertainty blocks the Workflow without duplicating
+Dataflow's recovery authority.
+
 ## Operator Contract
 
 Ops lists non-terminal and manual-intervention operations. Operators must verify