Record workflow recovery ledger adoption

docs/RECOVERY_LEDGER_ADOPTION.md

@@ -57,6 +57,16 @@ a conclusive provider result commits with the run projection, and an expired
 or failed attempt after dispatch becomes `outcome_unknown`. A stale attempt may
 be retried only when its durable boundary proves dispatch had not started.
 
+Workflow Engine is adopted at both declared boundaries. Instance workers,
+trigger deliveries, and timer resumptions use process-bound distributed fences.
+Every module-action invocation records the pinned definition, input, preview,
+authority, provider-idempotency, and action-contract hashes before dispatch.
+Conclusive results commit with the Workflow projection. A lost acknowledgement,
+invalid result, or unannounced non-atomic effect becomes `outcome_unknown` and
+cannot be retried until evidence confirms either that the effect occurred or is
+absent. Linked Dataflow uncertainty blocks the Workflow without duplicating
+Dataflow's recovery authority.
+
 ## Operator Contract
 
 Ops lists non-terminal and manual-intervention operations. Operators must verify

docs/recovery-operation-inventory.json

@@ -143,7 +143,7 @@
       "resources": ["postgresql"],
       "mode": "atomic",
       "fenced": true,
-      "adoption": "planned",
+      "adoption": "adopted",
       "issue": "https://git.add-ideas.de/GovOPlaN/govoplan-workflow-engine/issues/1"
     },
     {
@@ -152,7 +152,7 @@
       "resources": ["postgresql", "queue", "module-capability", "external-provider"],
       "mode": "forward_recovery",
       "fenced": true,
-      "adoption": "planned",
+      "adoption": "adopted",
       "issue": "https://git.add-ideas.de/GovOPlaN/govoplan-workflow-engine/issues/1"
     },
     {