[Maneek21]

Opening Reply repeated six serial Host authority round trips and downloaded an already rendered original message again. Live Runtime26 evidence showed 7.67 seconds in authority versus 0.38 seconds in the provider read for one completed hydration; other attempts exhausted the Host opening budget before reaching the provider.

Source-seeded metadata now uses the existing optimistic read path and the exact current reader presentation memo. Fresh entry/session/disclosure checks remain online; cold reads also keep the pre-provider check. Current custody generation, source digest and durable snapshot checks fence disclosure. The first persisted create still revalidates the original source and preserves user edits. No authority decision is cached, consent is unchanged, and opening creates no draft.

Prepares Email29 / App10 / Runtime27 with unchanged public Kit42 bytes and minimum Host136. Release/deployment remains held for the coordinated Host137 acceptance step; this PR makes no live acceptance claim.

Validation:

• Real Runtime/native MIME/encrypted-store regression with 350 ms authority delay: baseline warm Reply 2.27 s / 6 checks / 1 repeated MIME read fails; fixed warm 1.24 s / 3 checks / 0 repeated MIME reads, cold 1.57 s / 4 checks / 1 MIME read. No server drafts are created.
• Plain and HTML originals with attachments cover Reply, Reply all and Forward; exact quotes/digests and fresh authority are retained. Source/custody/session drift, revocation, cancellation and expiry deny disclosure. Existing first-save source/mode/digest pins remain covered.
• Actual packed Worker/Kit SDK opens the local Reply view immediately while every further network response is held, without a data/write/Send request.
• Build, App tests (8), UI tests (48), Kit/vendor provenance and focused Reply regressions pass.
• Additional local Runtime/cache/IMAP run: 44/45 pass. The existing cache concurrency expectation also fails on untouched main505a243; its independent baseline reproduction is retained. No test was suppressed or changed to hide that result.

No live edit, save, permission review, reconnect, Send, deployment or release was performed.

🤖 Generated with Claude Code