[forhappy]

Current-state opening must preserve the canonical replay order shared by Git visibility and catalog bindings. A ref borrowing an old tip waits until a visible ref supplies it; another eligible producer can change earlier controls’ relative replay order. An immutable per-run rank cannot replace this reconciliation.

Add two metadata regressions sharing one serialized capsule/run fixture:

• Complete and paged reconciliation agree before and after another producer becomes selected. Its physical bytes already exist in the first capture, so storage presence does not authorize visibility.
• Full catalog materialization and paged point lookup agree for each explicitly pinned root across a layered checkpoint. The checkpoint freezes its replay base and therefore binds catalog precedence. This characterizes metadata snapshot inputs; it does not establish whether a concurrent product writer may publish against an older base.

Validation on committed head aea42a27837: both storage-only release tests pass, including the original four reconciliation combinations; strict release all-target metadata Clippy, workspace formatting and whitespace checks pass. All 2,637 guarded inputs match their committed Git blobs. The shared fixture replaces duplicated setup; all added code is test-only. No production code, dependencies, formats, configuration or expected-policy records change. The advisor plan and both excluded benchmark reports are absent.

Stacked on #594. This guards semantics for the opening optimization; it does not fix the measured 9-to-1,079-operation opening growth across 532 publications. Final combined 10 GiB matrix and representative S3 latency gates remain open.

Evidence map: current file-index opening calls catalog_capture::capture, then ref_view::order_ref_controls and VisibilityReconciliation::{ready,apply}. Git control views share that owner; full and paged catalog readers share the same capture. The tests use real metadata codecs, typed root CAS, ref heads and checkpoint/history records. Their pack bodies are metadata fixtures, not native Git or reconstruction proof. Current main lacks the complete capsule stack.

Is this the best fix? The production optimization remains pending. These focused tests preserve the observed ordering and checkpoint authority boundaries without another policy, API or fallback. Concurrent writer admission must be audited separately before drawing a publication-race conclusion.