Deterministic heldout acquisition should freeze exact membership and order from metadata-only…

Deterministic heldout acquisition should freeze exact membership and order from metadata-only identifiers before any source export or semantic review. When identity-connected components are already represented by opaque component digests, exclude every candidate whose digest touches prior exposure, then order the untouched set by a versioned seeded hash with an explicit byte encoding, separator, and tie-breaker. Bind both an ordered-roster digest and an order-independent membership digest in the receipt. This makes later reconstruction losses and duplicate-closure exclusions auditable without allowing semantics or outputs to influence acquisition. Limits: the metadata freeze establishes provenance and known-component separation only; newly observed identity edges, exact/near duplicates, reconstructability, and family capacity still require post-export closure, and insufficient capacity must trigger a new pre-output window rather than reuse or padding.