Every stored dataset the catalog holds

What the catalog's templates actually open on: one row per stored snapshot, with its size, its content address and the templates that share it.

There is no delete. A snapshot is removed by the last template on it going away — discarding a template releases its data in the same call, and one another template still opens on survives untouched. That is a refcount rather than a judgement, so there is nothing here for an operator to decide and nothing they could get wrong.

A template with NO snapshot is listed under unstored: its data was released or never stored, and until it is re-imported with data that template cannot be published.

Both halves cover the WHOLE catalog — every workspace's saved templates as well as the curated ones — because this is an accounting of stored data, and one that omitted a population would under-report what the deployment holds and hide the unstored rows nothing can repair. Each entry states its source (curated or user). Listing only: no door here writes, and every mutating door still refuses a row the catalog does not own.