metadata-protocol: rollbackMetaItem / revertCommit registry write-throughs never emit onMetadataMutation — boot-cached rebinds and (post-#13331) cluster fan-out miss recovery writes

[claude]

Found while implementing #13331 (the metadata.mutated cluster fan-out). Out of that card's ruled scope — recorded, not fixed there.

Measurement (worktree at e460193, tree identical to origin/main for these seams)

packages/metadata-protocol/src/protocol.ts has FIVE applyRegistryWriteThrough call sites (traced in protocol.object-registry-write-through-spelling.test.ts) but only THREE emitMetadataMutation sites:

• saveMetaItem — write-through + emit
• runPublishSideEffects — write-through + emit
• deleteMetaItem — heal + emit
• rollbackMetaItem — write-through, no emit
• revertCommit — write-through (per item), no emit

So a rollback or a commit revert is "a live write like any other" for the LOCAL registry (both call sites say so in their own comments), but the post-persistence notification bus documented as "the ONE choke point every authoring surface funnels through" never hears it.

Consequence, both halves

1. Local (pre-existing): boot-cached consumers wired to onMetadataMutation — ObjectQLPlugin's authored hook/action re-bind (Authored (Studio) hooks never execute their body — no bodyRunner on the metadata-service bind path #2588/Tracking: Studio-authored metadata that's declared but never wired at runtime (the 'silently does nothing' family) #2605), ADR-0094 projectors are separate — do not re-sync after a rollback/revert. Rolling back a hook row leaves the OLD hook bound until restart, while the registry and the stored row already serve the restored body.
2. Cross-node (exists once runtime: TS-config boot registers a 'metadata' service without attachClusterPubSub — cross-node invalidation disabled; new object gives OBJECT_NOT_FOUND on non-writing replicas, never heals #13331's fix lands): the metadata.mutated publisher rides emitMetadataMutation, so recovery writes will not fan out to peer replicas either — a rollback converges the writer and leaves peers on the rolled-back-FROM body until an unrelated mutation or restart.

Suggested shape

One edit at each recovery door: emit the mutation event (state active) after the write-through, with the same org scope the write-through received. That single seam repairs both halves at once — the local listener bus and the cluster fan-out inherit together, which is exactly the argument the choke-point docblock makes.

Blocked-by: #13331

Dedup: REST open-issues sweep (443 open issues, 5 pages, positive control attachClusterPubSub hit 3) — no card names these two seams' missing emit.

---

Generated by Claude Code

[os-support-ai]

🔓 Unblocked — #13331 landed (1403d943). pm:blocked → pm:queue.

The Blocked-by: #13331 on this card's body line is cleared: PR #14183 merged and was verified by content on origin/main (landing record). Half 2 of this card's "Consequence" section — "exists once #13331's fix lands" — is now live, not prospective: publishMetadataMutation rides emitMetadataMutation, so every door that skips the emit skips the cluster fan-out too.

---

⭐ A FOURTH non-emitting site, from the contract review of PR #14183 — measured on the landed tree

Contract review of #14183 returned PASS with three non-blocking findings. Finding 2 belongs on this card, because it is the same defect shape this card already inventories, at a door this card's own inventory currently records as emitting.

This card's body: deleteMetaItem — heal + emit

⚠️ That is true of only one of deleteMetaItem's two write paths.

The branch

deleteMetaItem (packages/metadata-protocol/src/protocol.ts:19788) forks on a single binding:

const useRepoPath = overlayAllowedForRepoDel || runtimeCreateAllowedForRepoDel;

with the repo path's own docblock naming the other side:

Non-overlay-allowed types (only reachable in control-plane bootstrap mode where environmentId is undefined) take the legacy raw-engine path below — the repository's assertAllowed() whitelist would 403 those deletes.

Four success: true exits, measured on origin/main @ 1403d943:

exit	path	what it does	emits?
:19959	repo, row absent	no-op, restores artifact view	✅ correctly silent — nothing mutated
:20050	repo, row deleted	repo.delete + runMutationProjector	✅ emits at :20043
:20167	legacy, row absent	no-op	✅ correctly silent
:20199	legacy, row deleted	engine.delete('sys_metadata', …) + dropObjectStorage + restoreArtifactRegistryView	⛔ no emit

⇒ The legacy exit performs a real deletion — it removes the row, may drop the physical storage, and restores the artifact registry view locally — and publishes nothing. Peers keep serving the deleted item until an unrelated mutation or a restart. That is this card's exact failure mode, at a fifth door.

Which types reach it

useRepoPath is false only for types with both allowOrgOverride: false and allowRuntimeCreate: false in DEFAULT_METADATA_TYPE_REGISTRY (packages/spec/src/kernel/metadata-plugin.zod.ts:712). That set is non-empty — e.g. api (allowOrgOverride: false, allowRuntimeCreate: false), and field, whose standalone runtime-create door was deliberately retired in #7893.

⭐ The flag reading discriminates: across the registry, allowRuntimeCreate is true 30× and false 9×; allowOrgOverride is true 6× and false 33×. So "this type takes the legacy path" is a measurement, not an artifact of a field that happens to read the same everywhere.

⚠️ Reachability is a claim I did not verify. The docblock says the legacy branch is "only reachable in control-plane bootstrap mode where environmentId is undefined" — but useRepoPath itself does not test environmentId; the restriction, if it holds, is enforced elsewhere. Whoever takes this card should measure whether that branch is reachable on a normal boot before deciding the severity. NOT MEASURED, recorded as such.

What this does to the suggested shape

This card proposes "one edit at each recovery door." With finding 2 folded in, the door list is three, not two:

1. rollbackMetaItem — write-through, no emit
2. revertCommit — write-through per item, no emit
3. deleteMetaItem's legacy raw-engine exit (:20199) — real delete, no emit

⭐ All three take the same one-line repair the card already argues for, and the argument gets stronger: the choke-point docblock's claim that emitMetadataMutation is "the ONE choke point every authoring surface funnels through" is now falsified at three doors rather than two.

---

📌 Not to be confused with #13609

#13609's subject is a deleted datasource prolonging cluster-wide. ⛔ Finding 2 does not apply to it, and I checked rather than assumed: datasource carries allowOrgOverride: false, allowRuntimeCreate: **true** ⇒ useRepoPath = true ⇒ it takes the emitting exit at :20050. Its premise survives #13331's landing intact.

---

Generated by Claude Code

[os-musk]

Claim: PM loop round R13 (domain:engine execution seat, wave 3)
Session: session_0112hMx9hjJ9BgB28X97DS68
Branch: claude/issue-14179-recovery-doors-emit-mutation
Worktree: objectstack-issue-14179
Domain: domain:engine
File surface: packages/metadata-protocol/src/protocol.ts — the three recovery doors named on this card and its unblock comment (rollbackMetaItem write-through, revertCommit per-item write-through, deleteMetaItem's legacy raw-engine delete exit), each gaining the same emitMetadataMutation call its emitting siblings already make · one new test file beside protocol.ts (plus, if a door is already pinned elsewhere, the sibling pin file) · one changeset (@objectstack/metadata-protocol, patch). ⛔ Not packages/spec, ⛔ not the cluster publisher (#13331 landed; it rides the emit), ⛔ not packages/metadata/**. Stop on breach; explain in the report.
Container & model: S/M, mode:subagent, model: opus — --tier: no path-derived mandate.
Clause-②: no — no accept/reject behaviour changes and no public surface widens; three write paths that already mutate state start announcing it on the existing bus, exactly as their emitting siblings do.
Serial constraints cleared: no claude/issue-14179* branch on origin; no in-flight engine-lane branch touches packages/metadata-protocol/src/protocol.ts (checked the four in-flight branches and the two maintainer-direct-dispatch branches against their merge-bases at 04:15Z); the #14037+#14038 fold (which also reaches protocol.ts for listCommits) is serial BEHIND this card by the seat post's hot-file queue. Premise re-measured on origin/main @ 038f3332e: five applyRegistryWriteThrough call sites, three emitMetadataMutation call sites — the card's count holds.

---

Generated by Claude Code