docs(metadata-protocol): boot reconciliation is ADR-0094 D4, not D3, at two comment sites (#16153)

Two comments in `packages/metadata-protocol` cite `ADR-0094 D3` for boot
reconciliation. In ADR-0094 that is D4 (`### D4 — Boot reconciliation and the
migration/backfill path`); D3 is a different decision — `### D3 — Data-door
writes are redirected into metadata (write-through)`.

Prime Directive #13's mechanism is that a code comment naming an ADR section
sends the next author to the decision they are standing on. A wrong section
sends them to the write-through redirect table when they were looking for the
`kernel:ready` convergence pass — a plausible-looking wrong answer, which is
worse than no citation at all.

Comment text only; no behaviour, no assertion, no test semantics. The edit is
byte-length neutral, so no line number moves.


Claude-Session: https://claude.ai/code/session_01ARYe3yQTQCUFm5qPYNgKaJ

Co-authored-by: Claude <noreply@anthropic.com>

Author: claude[bot]

packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts

@@ -17,7 +17,7 @@
  * three recovery doors restored the row and the in-memory registry but never
  * called it: a rollback (or a commit revert) left the derived record on the
  * ROLLED-BACK-FROM state until an unrelated save/publish/delete on the same
- * name, or a boot reconciliation (ADR-0094 D3), re-derived it.
+ * name, or a boot reconciliation (ADR-0094 D4), re-derived it.
  *
  * The companion file `protocol.recovery-doors-emit-mutation.test.ts` (a prior
  * card) pins the sibling half of the SAME four call sites — the

packages/metadata-protocol/src/protocol.ts

@@ -20056,7 +20056,7 @@ export class ObjectStackProtocolImplementation implements
             // registry to the target version; a derived read-model (e.g.
             // `permission` -> `sys_permission_set`) must be just as current
             // when this call returns, not only after the next unrelated
-            // write or boot reconciliation (ADR-0094 D3) eventually heals it.
+            // write or boot reconciliation (ADR-0094 D4) eventually heals it.
             // `body` is the restored version's own — the same value the
             // write-through above registered.
             await this.runMutationProjector({