[forhappy]

Metadata storage gained a new direct Tokio feature edge for cache read coalescing, which violates its approved feature budget. Use the existing futures mutex for the same four hashed read-ahead lanes, and remove the test debug print rejected by the metadata source-scope gate. Read-ahead ranges, cache capacity, page authentication and query admission bounds stay unchanged.

Stacked on #609. No dependency versions, lockfiles, inventories or test bounds change.

Validation:

• 602 metadata tests passed, one existing ignored stress test. The added regression cancels a queued cold read and verifies the cache lane remains usable.
• Minimal-feature strict Clippy, storage-only and remote-index checks passed. Full-feature all-target Clippy, formatting, metadata library build and the remote qualifier build passed.
• Real RustFS comparison against the fixed 128-publication fixture passed with both the frozen Integrate large-file push and indexed-read fixes #609 qualifier and this source: cold selected lookup uses 5 ranges / 3,764 bytes; warm lookup uses zero backend operations/bytes. Both results match the full catalog oracle. Source and binary fingerprints are unchanged through the proof.
• The architecture gate now reports only the unchanged rusqlite inventory mismatch (0.39 with fallible_uint versus the recorded 0.34). This draft does not claim a green architecture gate; that baseline remains untouched pending explicit approval.

Dependency contract: the locked futures-util 0.3.32 mutex removes queued waiters on cancellation and unlocks through its guard's drop. The cache uses its lock only for cold block coalescing; publication/ref ordering is owned elsewhere. Futures mutexes do not promise FIFO admission, and this private cache path does not use FIFO ordering for correctness.

Evidence map: PageCache lookup/scan -> fetch -> read_block serves both visibility proofs and selected catalog pages. Existing cache tests retain authentication, shared cache bounds and cold/warm admission checks; the catalog-opening regression retains its request assertions and diagnostic assertion message. The #609 baseline introduced the direct Tokio edge and print. Current main has no capsule-protocol layered checkpoint module.

Is this the best fix? Reuse the already approved async primitive at the existing cache owner, preserve the four-lane design and cancellation behavior, and remove the diagnostic rather than relaxing source/feature inventories.

The user's advisor-plan changes and both excluded benchmark audit files are absent.