fix(metadata-protocol): the three recovery doors announce their writes on the mutation choke point (#14411)

* fix(metadata-protocol): emit onMetadataMutation from the three recovery doors (#14179)

rollbackMetaItem, revertCommit (both limbs) and deleteMetaItem's legacy
raw-engine exit mutate live state and never reached emitMetadataMutation —
the documented choke point and, since #13331, the cluster publish point. Each
now announces after its write, with the same org scope and singular type key
the write used. Row-absent exits stay silent; the cluster receive path is
untouched.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

* test(metadata-protocol): name the boot topology instead of passing an id that a default parameter swallows (#14179)

A default parameter fires on an explicitly passed `undefined`, so the harness's
bootstrap-mode cases were built on an environment boot and measured the
two-tier gate's 403 rather than the legacy exit. The factory now takes a named
mode and asserts the topology it constructed.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

* test(metadata-protocol): declare the ablation direction per case before running it (#14179)

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

* chore: record the new pin file's three engine doubles in the RETAINED ledger (#14179)

`check:engine-double-contract` reds until the ledger learns about a file that
pins engine doubles, or the pin never protects it. Regenerated with
`--write`: 3 rows added, all naming the new test file, 0 lost.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0112hMx9hjJ9BgB28X97DS68

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: os-musk

.changeset/recovery-doors-emit-metadata-mutation.md

@@ -0,0 +1,41 @@
+---
+"@objectstack/metadata-protocol": patch
+---
+
+fix(metadata-protocol): the three recovery doors announce their writes on the mutation choke point (#14179)
+
+`emitMetadataMutation` documents itself as "the ONE choke point every authoring
+surface funnels through", and since #13331 it is also the `metadata.mutated`
+cluster publish point. Three live write paths never reached it:
+
+- **`rollbackMetaItem`** — ran the registry write-through ("a rollback is a live
+  write like any other") and announced nothing. A rolled-back `hook` row left the
+  OLD hook bound in every boot-cached consumer until restart, while the registry
+  and the stored row already served the restored body.
+- **`revertCommit`** — same miss on both limbs: the per-item restore
+  (write-through) and the per-item soft-remove (`repo.delete` + registry heal).
+- **`deleteMetaItem`'s legacy raw-engine exit** — the `else` side of
+  `useRepoPath`, which really deletes the row, may drop the physical storage and
+  heals the registry view locally. Its repository-path twin has emitted since
+  #2588.
+
+Each door now emits after its write, with the same org scope the write received
+and the same singular type key the registry was written under: `state: 'active'`
+for a restore, `state: 'deleted'` for a removal — mirroring the emitting siblings
+rather than inventing an event shape. That single seam repairs both halves at
+once: local `onMetadataMutation` consumers (the authored hook/action re-bind)
+re-sync after a recovery write, and the #13331 publisher fans the same signal out
+so peer replicas converge instead of serving the rolled-back-FROM body until an
+unrelated mutation or a restart.
+
+Deliberately unchanged, and pinned: the row-absent exits stay silent (nothing
+mutated, so no peer is woken to converge on a no-op), and the cluster RECEIVE
+path (`applyRemoteMetadataMutation`) still replays locally only — emitting there
+would re-broadcast every received event and ping-pong across replicas.
+
+Reachability of the legacy delete exit, recorded as NOT MEASURED when the door
+was found, is now measured: on a normal boot (`environmentId` defined) the
+two-tier delete authorization refuses every type that would reach it
+(`NOT_OVERRIDABLE` or `NOT_CREATABLE`, both 403), so that door's exposure is
+control-plane bootstrap mode — narrower than feared, and exactly the topology
+whose registry every organization shares.