Spent some time looking at this on elph130, which does not have the PT_EraseAllFile eventproc or anything obviously related.
I started by logging the messages received by MetaCtg task in various situations. The message seems to be a structure and the code is fairly complicated, but I only ever saw a message sent when the camera was switch to play mode either by powering on, or after being in rec and in both cases it seemed to be identical. Shooting and deleting in the canon menu did not seem to send a message.
I decided to try making MetaCtg just consume the messages and ignore them. Unfortunately, different branches of the code may call GiveSemaphore on two semaphores associated with the task, depending on conditions I don't understand. In my hack, I just give both of them.
This code by itself would cause the camera to sit with the activity LED blinking after MetaCtg received a message. The camera isn't exactly hung, but if you try to switch to rec or shut down it really hangs, and you can't access the play UI. If you do click'menu' it shows "busy" for a second and doesn't show the play menu.
Looking at my camera logs from normal behavior, I tried posting the levents that appeared immediately after a MetaCtg message. Sure enough, posting 0x3220,0,0 makes the activity LED stop, and the camera seem to operate normally again. A hint for this was the fact the first two members of the message structure seem to be call backs that use PostLEvent (sub_FF0CE9C8 and FF0CD020). It's not clear to me where they would be called in the normal flow.
In the attached patch, calling set_skip_metactg(1) allows switching back to play after shooting with rs. I see "unknown image" for each of the shots taken with rs
This isn't a good solution, since it requires another task hook, and seems very likely to have adverse side effect. I haven't tested it exhaustively.
The message structure seems to look like
0x00 ff0ce9c8
0x04 ff0cd020
0x08 0000020d
0x0C 00000000
0x10 00000000
0x14 00000000
0x18 00000000
0x1c e1cd702c
but I'm not sure how big it is. Offset 0x14 is checked in the code, but it was always zero in my logs.
edit:
The original patch (-work-3) accidentally defaulted set_skip_metactg on. Updated.