docs(adr): ADR-0094 D2 amendment — the recovery doors project too

[os-musk]

Part of #14415

Ruling (governing this amendment)

Ruled: A. ADR-0094's D2 enumeration is extended to the recovery doors: rollbackMetaItem (after its registry write-through) and both limbs of revertCommit project with state: 'active' and the restored body; revertCommit's soft-remove limb and deleteMetaItem's legacy raw-engine exit project with state: 'deleted', the same call deleteMetaItem's repository branch already makes. The projection is awaited BEFORE the fire-and-forget mutation listeners, in the order saveMetaItem's comment establishes. Boot reconciliation (D3) stays as the healing path; it is no longer the only one. Option B (document that recovery doors deliberately do not project) is not taken.

Director seat, summon #11, decision batch #17, item 2 (verbatim reply: 「同意」 — adopts the recommendation).

What this PR does

Adds a new "Amendment (2026-09-03)" section to docs/adr/0094-sys-permission-set-pure-projection.md, appended after the existing 2026-08-14 amendment. D2's own text is unchanged — this is an amendment, not a rewrite — and records:

• The gap: three recovery doors (rollbackMetaItem, both limbs of revertCommit, deleteMetaItem's legacy raw-engine exit) restore/remove the same metadata row D2's projector is meant to be the sole writer of, but were absent from D2's original enumeration (saveMetaItem / publishMetaItem / deleteMetaItem).
• The extension: the same already-registered, awaited, best-effort projector now also runs at those four call sites, in the order established by saveMetaItem (projector before the fire-and-forget listeners).
• D3 (boot reconciliation) is unchanged and stays the healing path — it is no longer the only path to a current projection for these doors.
• Option B (document that recovery doors deliberately don't project) was considered and not taken, per the ruling.
• No Clause-② change: the projector stays an internal, already-registered hook — no published schema or wire shape moves with this amendment.

Companion PR (code)

The code implementing this amendment is a separate PR, per the ruling's landing-path split (domain:engine lane, merge queue) — draft, not yet ready:

• Code PR: fix(metadata-protocol): recovery doors run the ADR-0094 mutation projector #14982

Per the ruling: the code PR must not land without this ADR PR in flight.

Governance

docs/adr/** is a governed surface (check-governed-merges.mjs): this PR is draft, requests review from os-zhuang and hotlong, and will not be marked ready, enqueued, approved, or merged by this seat or the PM seat — human merge only.

🤖 Generated with Claude Code

https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---

Generated by Claude Code

[os-musk]

Closed as void, on the maintainer's instruction

Provenance (three items, so this closure is not indistinguishable from a stray sweep):

• Whose instruction: the maintainer, directing this PM dispatch seat.
• Verbatim, untranslated: 「14980 作废关闭」
• Where: direct instruction in this seat's session, https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

No approval, review, or merge was performed by this seat on a governed surface. The PR is closed unmerged; the branch claude/issue-14415-adr-0094-recovery-doors is untouched and this PR can be reopened at any time — the closure is a record, not a deletion.

Consequence, recorded here rather than left in chat

Stating this because it is durable and someone reading docs/adr/0094-sys-permission-set-pure-projection.md later will hit it:

The code half already landed. Companion PR #14982 merged as 95464ed65, and the projector call sites it added are present on origin/main today (runMutationProjector, 7 call sites in packages/metadata-protocol/src/protocol.ts). This PR was the documentation half. With it voided, ADR-0094's D2 enumeration on the tree continues to list only saveMetaItem / publishMetaItem / deleteMetaItem, while the shipped code also projects from rollbackMetaItem, both limbs of revertCommit, and deleteMetaItem's legacy raw-engine exit.

So the ADR under-describes its own code as of 95464ed65 — the enumeration is now incomplete rather than wrong, and D3 boot reconciliation is documented as the only healing path when it is no longer the only one.

Also worth recording against the governing ruling quoted in the body above: that ruling's landing condition was "the code PR must not land without this ADR PR in flight." That condition held when #14982 landed — this PR was in flight at the time. Voiding the documentation half afterwards is a maintainer decision that supersedes the director-seat ruling; noting it only so the ruling's trail stays readable, not to contest it.

No card is filed and no work is dispatched from this closure. If the enumeration gap should be closed later, it needs a fresh decision about how — the release-notes and ADR text are written centrally, and this seat is not going to re-open the question on its own judgement.

---

Generated by Claude Code