[Maneek21]

Reply opening still spent two full authority round trips serially before reading its quoted source. This overlaps the compound snapshot entry and admission calls while capturing only opaque local session/visibility metadata. Both checks remain fresh and independent, and both must succeed with the exact current session before identity, custody, source, saved-record, file or provider work. The final disclosure check stays independent; ordinary reads, form connections and mutations retain their existing path.

Each authority response is checked against its own dispatch ceiling; shared expiry can only shrink. Any opening failure cancels and drains both calls. No consent, timeout, package/version metadata, Kit interface or first-save behavior changes.

Validation:

• RED on aa4019: held entry starts only 1 callback; fresh independent checker is absent. GREEN after fix: both callbacks start before entry is released, with zero private reads/provider/CAS.
• 20 relevant data regressions, 4 full IMAP authority fences, 5 mutation/file/frame/diagnostic regressions pass. New negatives cover denial, malformed schema/pins, cancellation, local capture failure, session drift, shortened expiry and out-of-order deadlines.
• Actual Runtime at 350ms/authority callback: warm NULL-consent reader to NONNULL-consent compound quote 778–869ms, 3 fresh callbacks / 0 MIME/0 draft writes; true cold 1199–1231ms, 4 callbacks / 1 MIME/0 draft writes. Plain/HTML attachment, Reply/Reply all/Forward, existing record, final disclosure and first-save pins pass.
• Existing per-line endings preserved. No live data changes or release/deployment performed. Full actual Host+Runtime performance remains a release gate; earlier full pipeline was 2.417–3.842s and is not represented by the Runtime fixture timing.

🤖 Generated with Claude Code