diff --git a/packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts b/packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts
index bc01e4aa3a..69c6b13330 100644
--- a/packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts
+++ b/packages/metadata-protocol/src/protocol.recovery-doors-mutation-projector.test.ts
@@ -17,7 +17,7 @@
  * three recovery doors restored the row and the in-memory registry but never
  * called it: a rollback (or a commit revert) left the derived record on the
  * ROLLED-BACK-FROM state until an unrelated save/publish/delete on the same
- * name, or a boot reconciliation (ADR-0094 D3), re-derived it.
+ * name, or a boot reconciliation (ADR-0094 D4), re-derived it.
  *
  * The companion file `protocol.recovery-doors-emit-mutation.test.ts` (a prior
  * card) pins the sibling half of the SAME four call sites — the
diff --git a/packages/metadata-protocol/src/protocol.ts b/packages/metadata-protocol/src/protocol.ts
index 89436302d0..426728d2ae 100644
--- a/packages/metadata-protocol/src/protocol.ts
+++ b/packages/metadata-protocol/src/protocol.ts
@@ -20021,7 +20021,7 @@ export class ObjectStackProtocolImplementation implements
             // registry to the target version; a derived read-model (e.g.
             // `permission` -> `sys_permission_set`) must be just as current
             // when this call returns, not only after the next unrelated
-            // write or boot reconciliation (ADR-0094 D3) eventually heals it.
+            // write or boot reconciliation (ADR-0094 D4) eventually heals it.
             // `body` is the restored version's own — the same value the
             // write-through above registered.
             await this.runMutationProjector({