@@ -107,7 +107,7 @@ the call phase, so that column can still include their fixture work. Counts
 cover the current Python process; they are not aggregated across xdist workers.
 For a stable CI assertion, the pinned repository benchmark uses per-measurement
 ceilings in `test/performance/cli-budget.json`: the warm Gix journey launches
-one CLI process, opening launches five, and nested discovery launches seven.
+one CLI process, opening launches two, and nested discovery launches four.
 Reduce these ceilings as conversions land. The other operation rows have zero
 ceilings except the one-process patch diff.
 
@@ -121,16 +121,17 @@ accounting. The same run recorded 21,409 fallback decisions. These totals
 include explicit CLI tests and fixture commands, including non-Git commands
 passed directly to `Git.execute`; they are a local baseline, not a count of
 only fallback calls. The fixed warm benchmark instead isolates a user journey:
-23 CLI launches versus one Gix launch, opening 11 versus five, and nested
-discovery 13 versus seven after restoring the reference-format fallback.
+23 CLI launches versus one Gix launch, opening 11 versus two, and nested
+discovery 13 versus four after restoring the reference-format fallback.
 The historical full-suite counts above predate this correction. A constant
 `files` answer was not a Gix query; `GIX-1` records the missing binding.
 
 | GitPython entry point / managed command | Native implementation | Remaining CLI cases |
 | --- | --- | --- |
 | `Git.get_object_header`, ODB `info` | Object resolution and native header lookup | Custom storage, unsupported revision grammar |
 | `Git.stream_object_data`, ODB `stream` | Object bytes in an independent stream | Objects larger than 8 MiB; GIX-2 |
-| `Repo.rev_parse`, `rev_parse` metadata queries | Revision lookup, common directory, object format, bare flag, worktree root | Reference-storage format query; initial repository validation; message searches and describe forms; GIX-1/14/17 |
+| `Repo` opening/discovery | Native storage, worktree, object format and empty-tree metadata | Repository-format validation, unsupported layouts/environment and native validation gaps; GIX-1/14/19 |
+| `Repo.rev_parse`, `rev_parse` metadata queries | Revision lookup, common directory, object format, bare flag, worktree root | Repository-format validation, message searches and describe forms; GIX-1/14/17 |
 | Tree enumeration, `ls_tree` | Native tree entries with modes, names, and object IDs | Other command options |
 | Symbolic reference lookup, `symbolic_ref` | Nonrecursive target lookup | Mutation, missing-reference diagnostics |
 | Reference enumeration, `for_each_ref` | Sorted reference names and literal prefixes, preserving symbolic aliases | Dangling symbolic refs, root refs, glob patterns, other formats/options |
@@ -172,8 +173,9 @@ only an absent top-level `gix` selects CLI mode.
 operations and their complete journey on one already-open `git.Repo`, plus
 separate direct opening and discovery from `git/objects`. Fresh high-level
 wrappers preserve the cost of actual operations; imports, fixture preparation
-and parity preflight are outside timing. Native repository refresh remains inside operation timing, so these
-measurements include the cost of keeping retained state current.
+and parity preflight are outside timing. Native repository refresh remains
+inside operation timing, so these measurements include the cost of keeping
+retained state current.
 
 At `244e418da6cc43de129cbe2908d11be4c5ad457a`, using official GixPython
 0.1.0 and the same existing CPython 3.12.14/macOS arm64 interpreter for both
@@ -343,7 +345,7 @@ below use the supplied `pygix` source and its pinned Gitoxide revision.
 | GIX-11 | Inexact and ambiguous rename pairing/scores have not been established as Git-compatible. This is a conservative guard, not a claimed native bug. | Verified pairing, scoring, tie-breaking and option parity. Exact unambiguous renames are native. |
 | GIX-12 | Config bindings lack standalone parsing, ordered section/key enumeration, multivars, unset/remove-section and source-scoped queries. | Those operations for `GitConfigParser` and remote/branch configuration. Native merged getters cannot replace repository-only config readers. |
 | GIX-13 | Native index writing normalizes v4 to v2, offers no version setter, and expands split indexes. | Version and split-index preservation. Tests now assert that a split index remains split after an update. |
-| GIX-14 | Gix correctly exposes linked worktree paths, including those of bare main repositories. Its documented `is_bare()` reflects configuration and can be true alongside a worktree; inventory now uses both pieces of native metadata. Actual gaps remain: discovery tolerates undecodable HEADs and ignores dangling `commondir` symlinks, while Python flattens native failure kinds into `gix.Error`. | Explicit native HEAD decoding and CLI fallback for remaining layout/diagnostic gaps. Strict trust checks do not replace layout validation. Canonical paths can be supplied when reopening through Gix, as already done for the inventory's main repository; no classification fix is required upstream. Initial `--resolve-git-dir` stays with Git at this stage. |
+| GIX-14 | Gix correctly exposes linked worktree paths, including those of bare main repositories. Its documented `is_bare()` reflects configuration and can be true alongside a worktree; opening and inventory now use both pieces of native metadata. Actual gaps remain: discovery tolerates undecodable HEADs and ignores dangling `commondir` symlinks, while Python flattens native failure kinds into `gix.Error`. | Opening forces native HEAD decoding and retains CLI validation for remaining layout/diagnostic gaps. Strict trust checks do not replace layout validation. Canonical inputs can be reopened through Gix, as already done for the inventory's main repository; no classification fix is required upstream. Do not fabricate rejection from Python `HEAD` existence checks or infer a missing worktree root. |
 | GIX-15 | Native blame disagrees with Git even with Myers and rewrite tracking selected. In the fixture's `README.md`, lines 150 and 158 are attributed to the opposite commits. Incremental order also differs. | Attribution and incremental-output parity before replacing `Repo.blame` / `blame_incremental`. |
 | GIX-16 | Native archive streaming takes a tree rather than a commit. Its TAR omits Git's global PAX commit comment, leaves `export-subst` placeholders literal, and writes ordinary modes as `0644` where Git uses `0664`. | Commit-aware export substitution, metadata and permission parity. Both engines respected `export-ignore` in the probe. |
 | GIX-17 | Revision parsing accepts abbreviated IDs with `-dirty`, prefers the OID suffix over an exact describe-shaped tag, and treats escaped braces in message searches differently. | Git-compatible revision grammar and regex semantics. Existing `test_rev_parse.py` cases reproduce all three. |
 
@@ -58,6 +58,47 @@ def _fallback(method: str, reason: str) -> Any:
     return NotImplemented
 
 
+def discover_repository(path: str, environment: Dict[str, Any]) -> Any:
+    """Open one discovery candidate; the caller controls parent traversal."""
+    if gix is None:
+        return NotImplemented
+    effective = {**os.environ, **environment}
+    if any(
+        effective.get(key)
+        for key in ("GIT_COMMON_DIR", "GIT_OBJECT_DIRECTORY", "GIT_ALTERNATE_OBJECT_DIRECTORIES", "GIT_NAMESPACE")
+    ) or any(value != os.environ.get(key) for key, value in environment.items() if key != "GIT_WORK_TREE"):
+        return _fallback("Repo.open", "storage or command environment")
+    options = gix.OpenOptions().open_path_as_is(True).bail_if_untrusted(True).strict_config(True)
+    options = options.config_overrides(
+        ["core.fsmonitor=false", "gc.auto=0", "maintenance.auto=false", "core.hooksPath=" + os.devnull]
+    )
+    try:
+        repo = gix.open_opts(path, options)
+        snapshot = repo.config_snapshot()
+        if snapshot.string("extensions.refStorage") == b"reftable":
+            return _fallback("Repo.open", "reftable (GIX-1)")
+        if snapshot.string("extensions.compatObjectFormat") is not None:
+            return _fallback("Repo.open", "compatibility object format (GIX-19)")
+        # Discovery accepts undecodable HEADs; force the native reference decoder.
+        repo.head()
+        if not repo.is_bare() and repo.workdir() is None and not effective.get("GIT_WORK_TREE"):
+            return _fallback("Repo.open", "missing native worktree metadata (GIX-14)")
+        commondir = os.path.join(repo.git_dir(), "commondir")
+        if os.path.lexists(commondir):
+            # Gix ignores invalid commondir files on common repositories. A common
+            # directory must have been resolved and contain actual shared storage.
+            if os.path.realpath(repo.common_dir()) == os.path.realpath(repo.git_dir()) or not all(
+                os.path.isdir(os.path.join(repo.common_dir(), entry)) for entry in ("objects", "refs")
+            ):
+                return _fallback("Repo.open", "common-directory validation (GIX-14)")
+        record("Repo.open", "native")
+        return repo
+    except gix.Error as exc:
+        # Retain Git's rejection/diagnostics for layouts Gix cannot open yet.
+        _logger.debug("native discovery: %s", exc)
+        return _fallback("Repo.open", "native discovery diagnostics")
+
+
 def _repository(command: Any, env: Dict[str, Any], *, query_config: bool = False) -> Any:
     owner = command._repo() if command._repo is not None else None
     if owner is not None:
@@ -118,7 +159,7 @@ def _open_repository(command: Any, env: Dict[str, Any], *, query_config: bool =
                 stamps.append(None)
         state = (path, tuple(sorted(effective.items())), tuple(stamps))
         repo = owner._gix_repository
-        if repo is not None and os.path.abspath(repo.git_dir()) != os.path.abspath(path):
+        if repo is not None and os.path.realpath(repo.git_dir()) != os.path.realpath(path):
             repo = None
         if repo is not None and state != owner._gix_state:
             repo.reload()
@@ -166,7 +207,6 @@ def object_data(command: Any, ref: bytes, *, stream: bool = False) -> Any:
     if gix is None:
         return NotImplemented
     method = "stream_object_data" if stream else "get_object_header"
-    command._require_version()
     try:
         repo = _repository(command, {})
         oid = _oid(repo, ref)
@@ -192,7 +232,7 @@ def _rev_parse(repo: Any, args: List[str], kwargs: Dict[str, Any]) -> bytes:
     if args == ["--path-format=absolute", "--git-common-dir"]:
         return os.fsencode(os.path.abspath(repo.common_dir())) + b"\n"
     if args == ["--is-bare-repository"]:
-        return b"true\n" if repo.is_bare() else b"false\n"
+        return b"true\n" if repo.is_bare() and repo.workdir() is None else b"false\n"
     if args == ["--show-object-format"]:
         return str(repo.object_hash()).encode("ascii") + b"\n"
     if args == ["--show-ref-format"]:
@@ -319,7 +359,6 @@ def is_dirty(command: Any, index: bool, working_tree: bool, untracked: bool, sub
     if gix is None:
         return NotImplemented
     method = "Repo.is_dirty"
-    command._require_version()
     try:
         repo = _repository(command, {})
         _worktree_root(command, repo)
@@ -365,7 +404,6 @@ def untracked_files(command: Any, args: Tuple[Any, ...], options: Dict[str, Any]
     if gix is None:
         return NotImplemented
     method = "Repo.untracked_files"
-    command._require_version()
     try:
         if options.keys() - {"ignore_submodules"}:
             raise _Unsupported("status options")
@@ -401,7 +439,6 @@ def ignored(command: Any, paths: Sequence[Any]) -> Any:
     if gix is None:
         return NotImplemented
     method = "Repo.ignored"
-    command._require_version()
     try:
         repo = _repository(command, {})
         root = _worktree_root(command, repo)
@@ -495,7 +532,6 @@ def history(command: Any, rev: str, paths: Any, options: Dict[str, Any], *, coun
     if gix is None:
         return NotImplemented
     method = "Commit.count" if count else "Commit.iter_items"
-    command._require_version()
     try:
         if paths:
             raise _Unsupported("history path filtering")
@@ -624,7 +660,6 @@ def materialize_index(command: Any, source: Any, destination: str, desired: Dict
     if gix is None:
         return NotImplemented
     method = "IndexFile.write"
-    command._require_version()
     try:
         if any(stage for _path, stage in desired):
             raise _Unsupported("unmerged index editing")
@@ -761,7 +796,6 @@ def _write_tree(repo: Any, entries: Sequence[Tuple[bytes, int, str]]) -> str:
 def write_tree(command: Any, entries: Sequence[Tuple[bytes, int, str]]) -> Any:
     if gix is None:
         return NotImplemented
-    command._require_version()
     try:
         result = _write_tree(_repository(command, {}), entries)
     except _Unsupported as exc:
@@ -780,7 +814,6 @@ def tree_diff(repository: Any, left: Any, right: Any, paths: Any, patch: bool, o
     from git.diff import Diff, DiffIndex, Lit_change_type
 
     method = "Diffable.diff"
-    repository.git._require_version()
     try:
         if not hasattr(left, "hexsha") or not (hasattr(right, "hexsha") or isinstance(right, str)):
             raise _Unsupported("index/worktree/root diff")
@@ -867,7 +900,6 @@ def commit_stats(commit: Any) -> Any:
     from git.util import Stats
 
     method = "Commit.stats"
-    commit.repo.git._require_version()
     try:
         repo = _repository(commit.repo.git, {})
         if not hasattr(repo, "diff_tree_to_tree") or not hasattr(repo, "attributes_only"):
 
@@ -1185,7 +1185,6 @@ def _call_process_safe(
         ):
             if "\0" in arg:
                 raise UnsafeOptionError("Git arguments cannot contain NUL bytes")
-        self._require_version()
         options = ["--no-pager", "--no-optional-locks"]
         # These settings would become visible as user configuration in `config`.
         if method != "config":
@@ -1199,6 +1198,7 @@ def _call_process_safe(
         native = _backend.dispatch(self, method, args, kwargs, _config)
         if native is not NotImplemented:
             return native
+        self._require_version()
         env = dict(kwargs.pop("env", {}) or {})
         env.update(LC_ALL="C", LANGUAGE="C")
         if not _allow_network: