docs: ADR-0030 — the read projection is sourced from the register (refs #153)

Records the re-source and the three decisions inside it: the ACL writing an INGEDIEND record
on submit (without which re-sourcing silently drops every submitted registration), the dedup
key being the projected row rather than the notification, and the notification log holding
the row rather than the event.

Closes out ADR-0028's stated direction and the caveat it left open — the register record was
written but not yet read, and the two had to agree; there is now one source.

docs/architecture/adr-0028-objecten-holds-the-register.md

@@ -130,8 +130,8 @@ every message was dropped on the floor — a delivery path that looks wired and
   independent of the case that produced it.
 - The disclosure boundary is enforced by Objecten's schema validation (ADR-0027), not by
   discipline in projection code.
-- The read projection can become a cache of Objecten rather than a re-derivation of ZGW
-  (S-19b, #150).
+- The read projection can become a cache of Objecten rather than a re-derivation of ZGW —
+  done in S-19b-2 (#153), ADR-0030.
 
 **Negative / costs**
 
@@ -142,8 +142,9 @@ every message was dropped on the floor — a delivery path that looks wired and
   (`Acl__Objecten__Token`) in compose.
 - Two new hand-kept constants: the pinned objecttype UUID (two files) and the objecttype
   name (compose + `register.py`).
-- Until S-19b lands, the public register is still read from the NRC-derived projection, so
-  the register record is written but not yet read — the two must agree.
+- ~~Until S-19b lands, the public register is still read from the NRC-derived projection, so
+  the register record is written but not yet read — the two must agree.~~ Closed by ADR-0030:
+  the projection is now derived from the register, so there is only one source to agree with.
 
 ## Coupling rules touched (CLAUDE.md §8)