[forhappy]

Metadata catalog loading and read orchestration implemented separate stable ref-head capture and activation validation. Make metadata the shared owner, and remove 141 duplicate read-side lines. This is groundwork for eliminating the eager current-state catalog opener; that opener remains unchanged in this PR.

The shared capture keeps the bounded list/read/re-list loop, ETag binding, epoch filtering before activation reads, canonical ref-head key checks and committed-activation validation. It also applies the read-side rule to metadata: a head with no transaction must match the compacted root. Retired epochs remain ignored. Selected-ref read/push paths retain their targeted probes and expected-old checks while sharing the activation validator.

Evidence map

• Changed owner: crates/crab-metadata/src/capsule_protocol/store.rs; two existing helpers become feature-gated shared APIs.
• Entry/callers: complete crab-read view opens and metadata catalog loading; selected read/push capture reuses activation validation.
• Callees/contracts: bounded Store ref-head listing, provider ETags, CapsuleRefHead epoch/identity and bounded CapsuleTransactionRecord decoding.
• Siblings: selected ref probes remain targeted; full capture retries retain the existing limit. Error sources flow through ReadError::Metadata and CLI metadata conversion. No fallback or new wire format.
• Regression: transactionless active-epoch mismatch rejects, while the same retired-epoch head is excluded. Existing capsule tests cover activation, visibility and cold page behavior.
• Main comparison: stacked on perf(read): page pinned hydration catalog lookups #581, based on the unmerged indexed/staging stack. No main-level or full initiative completion verdict.

Is this the best fix? One metadata-owned authority capture avoids a third copy when the current-state opener adopts authenticated pages. The remaining catalog/control ordering extraction and consumer qualification are explicit follow-ups.

Validation

• Passed: all seven metadata capsule-store tests, including the new active/retired epoch regression.
• Passed: all 39 read capsule-protocol tests (27.95s runtime), using the shared owner.
• Passed: touched Rust formatting and diff whitespace checks; net deletion of production code.
• Rebase onto the fixture type-annotation correction changes ancestry only; tested Rust contents are unchanged.
• Full protocol/provider CI and combined lifecycle/current-state lookup qualification remain required. Draft only; no merges or baseline/expected-failure edits.