pub fn read_checked_tee(path: &Path) -> Option<String>
One bounded, no-follow read shared by selectors, HTTP, CLI and in-band recovery. Policy is freshly resolved before I/O and rechecked at publication.