Enable isolated Remote speech and protect reading exports

Attach incoming software speech to reader sessions with lease checks, local output priority and isolated cancellation. Preserve every document fragment source for privacy checks and export reviewed browse current-line reading, spelling and phonetic output.

Verified focused reading and Remote race tests, complete review and external Remote race suites, private relay integration, speech regressions, affected-package vet, reader build and Tentacles make check. Audible speech, physical input/Braille and live interoperability remain unverified.

docs/tentacle-remote-speech.md

@@ -2,9 +2,10 @@
 
 Typed speech IPC now includes an explicit reader-owned incoming mailbox and
 limited production observation of accessibility-event and document-reading speech. The
-external coordinator connects this IPC to relay speech. Incoming speech still
-has no production presentation owner and does not make Remote speak. Atomic
-assembly of split incoming utterances precedes owner admission.
+external coordinator connects this IPC to relay speech. Production software
+sessions now attach an isolated incoming owner with lease, focus and local-output
+policy. Atomic assembly of split incoming utterances precedes owner admission.
+Private tests establish protocol delivery; audible acceptance remains pending.
 Original base reader revision: `4f9b89e`
 on `testing`; matching Tentacles base: `0c74038` on `master`, plus the pending
 connection-command changes. No active or installed reader was replaced.
@@ -97,10 +98,31 @@ in an assembled line must have a known role and no password ancestry. Say All
 classifies all spoken lines before admission; a sensitive or unclassified line
 keeps the entire batch private, including sentence-mode continuations. Local
 navigation failures stay private. Derived phonetic hints retain their parent's
-origin and original observation ticket. Flat/object review, current-line commands,
+origin and original observation ticket. Flat/object review, native current-line commands,
 reading-context announcements, separate key-name echo and notification paths
 still need explicit source and sensitivity review.
 
+Visual-line assembly now retains each contributing object's complete captured
+ancestry in `DocumentLine.SourceContexts`, independently of the caret object's
+presentation context. Caret-line speech checks these sources, and Say All keeps
+them when flattening fragments into a single spoken string. A password source,
+password ancestor, unknown role or failed context lookup keeps the whole line
+private; a sensitive Say All line keeps its entire batch private. Missing source
+metadata does not prevent local reading. These checks do not opt flat/object
+review into export.
+
+Browse-mode current-line reporting, spelling and phonetic spelling now export
+only with the command's captured source ancestry. The review worker retains
+that ancestry from the tree producing the final movement, including after
+recapture. Every source role must be known; password sources/ancestors, missing
+or stale ancestry and sensitive neighboring fragments keep the report private.
+Classification does not add context announcements or change local reading,
+caret position, focus or Braille. Spelling retains repeated letters, character
+state and phonetic expansion through the existing speech owner, with its original
+lease/generation ticket and pronunciation policy. Errors remain private. Native
+focused-line reads lack complete ancestry and remain private even when a supplied
+snapshot appears ordinary.
+
 Say All exports each resolved chunk immediately before its completion-paced
 backend call. Sentence boundaries, pronunciation and the original request's
 lease/generation are retained. A lease replacement during reading cannot export
@@ -126,15 +148,16 @@ independently. This atomic IPC admission is not atomic relay or NVDA delivery.
 User/input interruption and mode/enable changes publish cancel through the same
 speech-owner mutex as observed utterances. An older delivery generation cannot
 publish behind that cancel. Remote publication never performs pipe, relay or
-backend I/O in the input loop. Incoming cancellation ownership remains pending.
+backend I/O in the input loop. Incoming cancellation uses the isolated owner
+described below.
 
 The source command now offers an explicit Return to desktop action after its
 reader lease opens. It closes status and releases local input capture while the
 original lease and heartbeat worker remain active. The Remote shortcut reopens
 status/Disconnect. Lock/handoff, expiry and process loss still revoke the lease.
 See [the terminal interaction contract](tentacle-sessions.md#reader-owned-consent-interactions).
-Incoming speech ownership and live acceptance remain pending; relay-testing
-warnings remain in place.
+Production incoming software ownership is described below; experimental-speech
+warnings remain in place pending live acceptance.
 
 ## Verification and remaining work
 
@@ -279,6 +302,53 @@ ownership and cancellation, without audible speech or real server scheduling.
 Production mailbox attachment, local output priority, physical input and live
 NVDA/Orca acceptance remain pending.
 
+### Production incoming owner and local priority
+
+Both local-launch and managed-session startup now attach one incoming owner when
+`remote-present`, the reader availability policy, focus gate and configured
+software speaker are present. Its lifecycle watcher joins cleanup on session
+revocation or reader shutdown. It creates no synthesis connection until accepted
+speech needs one. Hardware acquisition fails closed and retires the original
+lease; no hardware device is opened by the incoming owner.
+
+Every delivery and synthesis handoff rechecks the original process-owned lease
+with `remote-present`, its deadline/context, lock/handoff, internal-form capture,
+speech enable and speech mode. Denied work is discarded. Local pending/active
+requests and the interruption barrier also deny new speech admission. Incoming
+text bypasses local history and observation entirely; remote cancel/pause affects
+only its isolated speaking client. Backend failures retire only the failing
+lease epoch. Cleanup completes before the renderer starts speech under fresh
+consent; a stale failure cannot revoke a replacement approval.
+
+Local speech admission or interruption synchronously retires incoming admission
+tickets. Active remote rendering cancels; older queued work is discarded without
+replay. The first frame of an IPC assembly receives a reader-owned monotonic
+admission timestamp. Local output records a cutoff, so an assembly or mailbox
+item accepted before that output cannot acquire a fresh ticket when dequeued
+later. The local-generation check is synchronous even before its asynchronous
+cancellation callback runs. Mailbox budget remains retained through cleanup.
+Speech accepted after the cutoff may proceed once local queue policy permits.
+
+Ordinary software speech returns at queue acknowledgement, not audio completion.
+The isolated client therefore sets SSIP `TEXT` before speaking; local reader
+clients retain `MESSAGE`. Under the [SSIP priority contract](https://github.com/brailcom/speechd/blob/master/doc/ssip.texi),
+TEXT waits behind MESSAGE, and a new MESSAGE cancels older TEXT output. The
+relay's normal/NEXT/NOW values only order remote work and cannot raise its SSIP
+priority. A server cancellation discards the current assembly and its suffix;
+it does not itself revoke consent. Failed priority setup closes the candidate.
+This establishes the requested protocol policy, not real-server scheduling or
+audible priority acceptance. Other applications using TEXT priority can also
+cancel remote output. Pause and priority retain the limited discard semantics
+of the stream prerequisite; there is no replay or resume parity.
+
+Private source-command/TLS/SSIP checks exercise complete multilingual spelling
+and language output after Return to desktop, and cancel active synthesis on
+Disconnect, lock, handoff and disable. Focused tests cover local announcements,
+interruption, speech modes, disable/secure input, old mailbox/assembly cutoffs,
+rejected local results, backend priority rejection and server cancellation.
+Physical local approval, audible output, real Speech Dispatcher scheduling,
+Braille and NVDA/Orca interoperability remain separate acceptance gates.
+
 ### Automated evidence
 
 For the isolated synthesis prerequisite, focused application/backend race checks
@@ -345,9 +415,49 @@ host/wire/both-SDK race suites (host: about 127 seconds), focused application
 speech/Remote/Tentacle race checks, affected-package vet, a separate reader
 build, the existing speech regression harness and Tentacles `make check`.
 
-Next: attach the stream owner to production sessions with delivery-time
-policy and local output priority. Explicit status detachment is implemented; physical
-input capture/release and ordinary reading while connected still need acceptance.
+The production incoming-owner increment passed ten repetitions of its focused
+Remote speech/source-command race cases, the complete speech-backend and
+host/wire/both-SDK race suites (host: about 128 seconds), shared application
+speech/Tentacle race regressions, the existing speech regression harness,
+affected-package vet, a separate reader build and Tentacles `make check`.
+Backend failure coverage also verifies explicit status close and a fresh setup
+workflow without restarting the process. No full reader suite or live acceptance
+was performed.
+
+The subsequent fragment-privacy review adds a real accessibility-tree regression
+with an ordinary caret and a neighboring password descendant on the same visual
+row. Running that regression against the previous classifier with a Go source
+overlay reproduced export admission; the corrected classifier denies it.
+Presentation/SDK tests cover password sources, password ancestry, unknown roles,
+missing contexts and unchanged local reading. Review tests retain every source
+through Say All flattening and preserve local text after ancestry becomes stale.
+The source-command/private-relay fixture also checks private joined caret/Say All
+output never reaches relay speech frames.
+
+Verification for this review passed: the complete AT-SPI/review race suites,
+focused application Remote/speech/document/caret/current-line/flat/object-review
+race regressions, ten repetitions of the document privacy race cases,
+source-command/private-relay race checks, the speech regression harness, vet for
+the affected packages, a separate reader build in `/tmp`, and Tentacles
+`make check`. The repository check now includes document/Say All observation
+regressions. Native/hardware checks and the full reader suite were not run for
+this review. Physical input, audible speech, physical Braille and real
+NVDA/Orca interoperability remain unverified.
+
+The browse current-line increment passed focused application/input reading and
+Remote race regressions, the complete review and external Remote race suites,
+the existing speech regression harness, affected-package vet, a separate reader
+build and Tentacles `make check`. The new tests cover source/neighbor privacy,
+native and error exclusion, recaptured ancestry, unchanged local text after
+context invalidation, pronunciation, repeated-letter character spelling, phonetic
+spelling and blank lines. The source-command/private-relay fixture exports an
+ordinary report and rejects a private joined neighbor. No full reader suite,
+native desktop, hardware or audible acceptance was performed for this increment.
+See [the live test steps](../../cthulhu-tentacles/remote/command.md#physical-keyboard-acceptance-still-pending).
+
+Next: verify real Speech Dispatcher scheduling and audible local/remote
+arbitration. Physical input capture/release and ordinary reading while connected
+still need acceptance.
 Review the remaining output producers before assigning exportable origins.
 Atomic IPC assembly is implemented; it does not establish backend
 priority/cancel behavior or audible delivery.

internal/app/current_line.go

@@ -4,6 +4,7 @@
 package app
 
 import (
+	"git.stormux.org/storm/cthulhu/internal/atspi"
 	"git.stormux.org/storm/cthulhu/internal/input"
 	"git.stormux.org/storm/cthulhu/internal/presentation"
 	"git.stormux.org/storm/cthulhu/internal/review"
@@ -43,6 +44,18 @@ func (handler *eventReviewHandler) present_current_line(result review.Result) {
 	}
 	request := speechRequest{Text: "Could not read current line.", Role: "system", Cause: "current-line"}
 	if result.Err == nil {
+		// Native focused-line reads do not carry complete ancestry. Only
+		// browse reports with captured source metadata opt into observation.
+		if result.CurrentLineBrowse {
+			sources := atspi.DocumentLine{Contents: []atspi.DocumentContent{{Snapshot: result.DocumentPosition.Snapshot}},
+				SourceContexts: [][]atspi.Snapshot{result.DocumentCaretContext}}
+			request.origin = document_line_speech_origin(sources)
+			if result.DocumentCaretLine != nil {
+				if origin := document_line_speech_origin(*result.DocumentCaretLine); origin != speechOriginLocal {
+					request.origin = origin
+				}
+			}
+		}
 		text := result.DocumentCaretText
 		request.Text = presentation.FlatReviewText(text, false)
 		request.Role = result.DocumentPosition.Snapshot.Role

internal/app/document_review.go

@@ -221,6 +221,11 @@ func presentDocumentCaretResult(logger *slog.Logger, speech speechEnqueuer, resu
 		text = "blank"
 	}
 	request := speechRequest{origin: document_speech_origin(result.DocumentPosition.Snapshot, result.DocumentCaretContext), Text: text, Role: result.DocumentPosition.Snapshot.Role, Cause: "document-caret"}
+	if result.DocumentCaretLine != nil {
+		if origin := document_line_speech_origin(*result.DocumentCaretLine); origin != speechOriginLocal {
+			request.origin = origin
+		}
+	}
 	request.PhoneticHint = result.DocumentCaretCommand == review.CaretNextCharacter || result.DocumentCaretCommand == review.CaretPreviousCharacter
 	request.Context = result.DocumentCaretContext
 	if len(request.Context) > 0 && request.Context[0].ID() == result.DocumentPosition.Snapshot.ID() {

internal/app/remote_speech_stream.go

@@ -18,13 +18,32 @@ type remoteSpeechStreamItem struct {
 	delivery  tentacle.RemoteSpeechDelivery
 	utterance remoteSpeechUtterance
 	bytes     int
+	context   context.Context
+	cleanup   func()
+	current   func() bool
 }
 
+type remoteSpeechPermit struct {
+	context context.Context
+	current func() bool // Synchronous generation check, before cancellation callbacks run.
+	release func()
+}
+
+type remoteSpeechAdmission func(tentacle.RemoteSpeechDelivery) (remoteSpeechPermit, bool)
+
+type remoteSpeechStreamError struct {
+	lease tentaclewire.RemoteLease
+	cause error
+}
+
+func (err *remoteSpeechStreamError) Error() string { return err.cause.Error() }
+func (err *remoteSpeechStreamError) Unwrap() error { return err.cause }
+
 // run_remote_speech_playback supplies the isolated backend to the stream owner.
-// It is deliberately not registered with production sessions yet: the caller
-// still needs the reader's local-priority and delivery-time policy integration.
+// The caller supplies original-lease policy and optional local-output admission.
 func run_remote_speech_playback(ctx context.Context, speaker *configuredSpeaker,
-	incoming <-chan tentacle.RemoteSpeechDelivery, allow func(tentacle.RemoteSpeechDelivery) bool) error {
+	incoming <-chan tentacle.RemoteSpeechDelivery, allow func(tentacle.RemoteSpeechDelivery) bool,
+	admit remoteSpeechAdmission) error {
 	if speaker == nil || allow == nil {
 		return errors.New("Remote speech playback requires a backend and delivery policy")
 	}
@@ -42,7 +61,7 @@ func run_remote_speech_playback(ctx context.Context, speaker *configuredSpeaker,
 		}
 	}
 	defer closeVoice()
-	return run_remote_speech_stream(ctx, incoming, allow, func(request context.Context, delivery tentacle.RemoteSpeechDelivery, utterance remoteSpeechUtterance) error {
+	return run_remote_speech_stream(ctx, incoming, allow, admit, func(request context.Context, delivery tentacle.RemoteSpeechDelivery, utterance remoteSpeechUtterance) error {
 		if voice == nil || voice.ctx.Err() != nil || voiceLease != delivery.Lease {
 			closeVoice()
 			var err error
@@ -72,7 +91,7 @@ func run_remote_speech_playback(ctx context.Context, speaker *configuredSpeaker,
 	})
 }
 
-// run_remote_speech_stream is an unwired reader-owner prerequisite. allow must
+// run_remote_speech_stream retains complete deliveries until cleanup. allow must
 // recheck original lease, focus and output policy without backend I/O. render
 // must honor cancellation, recheck policy after acquisition, and complete scoped
 // backend cleanup before returning. Neither callback may observe this output.
@@ -80,6 +99,7 @@ func run_remote_speech_playback(ctx context.Context, speaker *configuredSpeaker,
 // until completion/discard, including while a cancelled renderer is closing.
 func run_remote_speech_stream(ctx context.Context, incoming <-chan tentacle.RemoteSpeechDelivery,
 	allow func(tentacle.RemoteSpeechDelivery) bool,
+	admit remoteSpeechAdmission,
 	render func(context.Context, tentacle.RemoteSpeechDelivery, remoteSpeechUtterance) error) error {
 	if allow == nil || render == nil {
 		return errors.New("Remote speech owner requires delivery policy and renderer")
@@ -97,6 +117,7 @@ func run_remote_speech_stream(ctx context.Context, incoming <-chan tentacle.Remo
 		return ctx.Err() == nil && delivery.Context != nil && delivery.Context.Err() == nil && allow(delivery)
 	}
 	release := func(item *remoteSpeechStreamItem) {
+		item.cleanup()
 		items -= len(item.delivery.Speeches)
 		bytes -= item.bytes
 		item.delivery.Release()
@@ -128,11 +149,11 @@ func run_remote_speech_stream(ctx context.Context, incoming <-chan tentacle.Remo
 			item := pending[0]
 			pending[0] = nil
 			pending = pending[1:]
-			if !valid(item.delivery) {
+			if !valid(item.delivery) || item.context.Err() != nil || !item.current() {
 				release(item)
 				continue
 			}
-			request, stop := context.WithCancel(item.delivery.Context)
+			request, stop := context.WithCancel(item.context)
 			cancel, active, activeContext, finished = stop, item, request, make(chan error, 1)
 			go func(result chan<- error) { result <- render(request, item.delivery, item.utterance) }(finished)
 		}
@@ -145,12 +166,13 @@ func run_remote_speech_stream(ctx context.Context, incoming <-chan tentacle.Remo
 		case err := <-finished:
 			// A deliberate stream interruption is not a backend failure. Never
 			// retry its suffix; the renderer may have spoken a prefix already.
-			interrupted := activeContext.Err() != nil
+			interrupted := activeContext.Err() != nil || !active.current()
+			failedLease := active.delivery.Lease
 			cancel()
 			release(active)
 			active, cancel, finished = nil, nil, nil
-			if err != nil && !interrupted {
-				return errors.New("Remote speech renderer failed")
+			if err != nil && !interrupted && !errors.Is(err, context.Canceled) {
+				return &remoteSpeechStreamError{lease: failedLease, cause: errors.New("Remote speech renderer failed")}
 			}
 		case delivery, ok := <-incoming:
 			if !ok {
@@ -183,20 +205,30 @@ func run_remote_speech_stream(ctx context.Context, incoming <-chan tentacle.Remo
 			utterance, err := prepare_remote_utterance(delivery.Speeches)
 			if err != nil {
 				delivery.Release()
-				return err
+				return &remoteSpeechStreamError{lease: delivery.Lease, cause: err}
 			}
 			if paused {
 				delivery.Release()
 				continue
 			}
-			item := &remoteSpeechStreamItem{delivery: delivery, utterance: utterance}
+			permit := remoteSpeechPermit{context: delivery.Context, release: func() {}, current: func() bool { return true }}
+			if admit != nil {
+				admitted, ok := admit(delivery)
+				if !ok {
+					delivery.Release()
+					continue
+				}
+				permit = admitted
+			}
+			item := &remoteSpeechStreamItem{delivery: delivery, utterance: utterance, context: permit.context, cleanup: permit.release, current: permit.current}
 			for _, frame := range delivery.Speeches {
 				encoded, _ := json.Marshal(frame)
 				item.bytes += len(encoded)
 			}
 			if items+len(delivery.Speeches) > tentaclewire.RemoteSpeechQueueSize || bytes+item.bytes > tentaclewire.RemoteSpeechQueueBytes {
+				permit.release()
 				delivery.Release()
-				return errors.New("Remote speech owner budget exceeded")
+				return &remoteSpeechStreamError{lease: delivery.Lease, cause: errors.New("Remote speech owner budget exceeded")}
 			}
 			items += len(delivery.Speeches)
 			bytes += item.bytes

internal/app/remote_speech_stream_test.go

@@ -35,15 +35,19 @@ type remoteStreamFixture struct {
 	allowed  atomic.Bool
 }
 
-func remote_stream_fixture(t *testing.T, hold bool) *remoteStreamFixture {
+func remote_stream_fixture(t *testing.T, hold bool, admission ...remoteSpeechAdmission) *remoteStreamFixture {
 	t.Helper()
 	ctx, cancel := context.WithCancel(t.Context())
 	f := &remoteStreamFixture{ctx: ctx, cancel: cancel, hold: hold,
 		incoming: make(chan tentacle.RemoteSpeechDelivery, 128), started: make(chan remoteStreamCall, 128), done: make(chan error, 1),
 		lease: tentaclewire.RemoteLease{Lease: strings.Repeat("a", 32), Epoch: 1}}
 	f.allowed.Store(true)
+	var admit remoteSpeechAdmission
+	if len(admission) != 0 {
+		admit = admission[0]
+	}
 	go func() {
-		f.done <- run_remote_speech_stream(ctx, f.incoming, func(tentacle.RemoteSpeechDelivery) bool { return f.allowed.Load() },
+		f.done <- run_remote_speech_stream(ctx, f.incoming, func(tentacle.RemoteSpeechDelivery) bool { return f.allowed.Load() }, admit,
 			func(ctx context.Context, _ tentacle.RemoteSpeechDelivery, utterance remoteSpeechUtterance) error {
 				call := remoteStreamCall{ctx: ctx, utterance: utterance, finish: make(chan error, 1), stopped: make(chan struct{}), cleanup: make(chan struct{})}
 				f.started <- call
@@ -81,7 +85,7 @@ func (f *remoteStreamFixture) send_delivery(t *testing.T, ctx context.Context, l
 	t.Helper()
 	released := make(chan struct{})
 	var calls atomic.Int32
-	f.incoming <- tentacle.RemoteSpeechDelivery{Context: ctx, Lease: lease, Speeches: frames, Release: func() {
+	f.incoming <- tentacle.RemoteSpeechDelivery{Context: ctx, Lease: lease, Received: time.Now(), Speeches: frames, Release: func() {
 		if calls.Add(1) != 1 {
 			t.Error("Remote stream released mailbox budget twice")
 			return
@@ -301,7 +305,7 @@ func TestRemoteSpeechStreamIsolatedBackendCancellation(t *testing.T) {
 	incoming := make(chan tentacle.RemoteSpeechDelivery, 8)
 	done := make(chan error, 1)
 	go func() {
-		done <- run_remote_speech_playback(ctx, speaker, incoming, func(tentacle.RemoteSpeechDelivery) bool { return true })
+		done <- run_remote_speech_playback(ctx, speaker, incoming, func(tentacle.RemoteSpeechDelivery) bool { return true }, nil)
 	}()
 	lease := tentaclewire.RemoteLease{Lease: strings.Repeat("b", 32), Epoch: 1}
 	send := func(effect tentaclewire.RemoteSpeech) <-chan struct{} {
@@ -314,6 +318,9 @@ func TestRemoteSpeechStreamIsolatedBackendCancellation(t *testing.T) {
 	local := server.next_utterance(t)
 	remoteRelease := send(remote_render_frame(0, tentaclewire.RemoteSpeechPart{Text: "remote first"}))
 	remote := server.next_utterance(t)
+	if remote.priority != "TEXT" || local.priority != "MESSAGE" {
+		t.Fatal("incoming speech can compete with local output priority")
+	}
 	if local.id == remote.id {
 		t.Fatal("stream acquired the local speaking client")
 	}
@@ -366,7 +373,7 @@ func TestRemoteSpeechStreamPolicyLossDuringAcquisition(t *testing.T) {
 		Release:  func() { close(released) }}
 	done := make(chan error, 1)
 	go func() {
-		done <- run_remote_speech_playback(t.Context(), speaker, incoming, func(tentacle.RemoteSpeechDelivery) bool { return allowed.Load() })
+		done <- run_remote_speech_playback(t.Context(), speaker, incoming, func(tentacle.RemoteSpeechDelivery) bool { return allowed.Load() }, nil)
 	}()
 	remote_stream_wait(t, held)
 	allowed.Store(false)
@@ -401,7 +408,7 @@ func test_remote_stream_lease_voice(t *testing.T, active bool) {
 	incoming := make(chan tentacle.RemoteSpeechDelivery, 4)
 	done := make(chan error, 1)
 	go func() {
-		done <- run_remote_speech_playback(ctx, speaker, incoming, func(delivery tentacle.RemoteSpeechDelivery) bool { return delivery.Context.Err() == nil })
+		done <- run_remote_speech_playback(ctx, speaker, incoming, func(delivery tentacle.RemoteSpeechDelivery) bool { return delivery.Context.Err() == nil }, nil)
 	}()
 	send := func(lifetime context.Context, epoch uint64, text string) <-chan struct{} {
 		released := make(chan struct{})

internal/app/remote_speech_voice.go

@@ -60,6 +60,10 @@ func (speaker *configuredSpeaker) open_remote_voice(ctx context.Context) (*remot
 	if err := client.Connect(ctx); err != nil {
 		return nil, err
 	}
+	if err := client.SetBackgroundPriority(ctx); err != nil {
+		_ = client.Close(context.Background())
+		return nil, err
+	}
 	if err := ctx.Err(); err != nil {
 		_ = client.Close(context.Background())
 		return nil, err

internal/app/remote_speech_voice_test.go

@@ -25,6 +25,7 @@ type isolatedVoiceConnection struct {
 	write sync.Mutex
 	// The following fields belong to isolatedVoiceServer.mutex.
 	module, pending          string
+	priority                 string
 	notifications            bool
 	language, spelling, ssml string
 	voiceType, synthesis     string
@@ -34,6 +35,7 @@ type isolatedVoiceUtterance struct {
 	id                             int
 	text, language, spelling, ssml string
 	module, voiceType, synthesis   string
+	priority                       string
 }
 
 func (connection *isolatedVoiceConnection) send(message string) {
@@ -100,6 +102,8 @@ func isolated_voice_fixture(t *testing.T) (*configuredSpeaker, *isolatedVoiceSer
 						response = "251-" + connection.module + "\r\n251 OK\r\n"
 					case command == "GET VOICE_TYPE":
 						response = "251-" + connection.voiceType + "\r\n251 OK\r\n"
+					case strings.HasPrefix(command, "SET SELF PRIORITY "):
+						connection.priority = strings.TrimPrefix(command, "SET SELF PRIORITY ")
 					case strings.HasPrefix(command, "SET SELF LANGUAGE "):
 						connection.language = strings.TrimPrefix(command, "SET SELF LANGUAGE ")
 						// Server LanguageDefaultModule mappings must not silently
@@ -161,7 +165,7 @@ func isolated_voice_fixture(t *testing.T) (*configuredSpeaker, *isolatedVoiceSer
 						}
 						server.mutex.Lock()
 						connection.pending = strings.Join(lines, "\n")
-						queued = &isolatedVoiceUtterance{id: id, text: connection.pending, language: connection.language, spelling: connection.spelling, ssml: connection.ssml, module: connection.module, voiceType: connection.voiceType, synthesis: connection.synthesis}
+						queued = &isolatedVoiceUtterance{id: id, text: connection.pending, language: connection.language, spelling: connection.spelling, ssml: connection.ssml, module: connection.module, voiceType: connection.voiceType, synthesis: connection.synthesis, priority: connection.priority}
 						response = "230 OK\r\n225 QUEUED\r\n"
 						if connection.notifications {
 							response += fmt.Sprintf("701-1\r\n701-%d\r\n701 BEGIN\r\n", id)

internal/app/speech_current_line_observation_test.go

@@ -0,0 +1,134 @@
+// Copyright (c) 2026 Storm Dragon
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app
+
+import (
+	"errors"
+	"fmt"
+	"strings"
+	"testing"
+	"time"
+
+	"git.stormux.org/storm/cthulhu/internal/atspi"
+	"git.stormux.org/storm/cthulhu/internal/review"
+)
+
+func current_line_observation_request(t *testing.T, result review.Result) speechRequest {
+	t.Helper()
+	focus := atspi.NewObjectID(":1.42", "/focus")
+	worker, err := review.NewWorker(&fakeAdapter{}, time.Second)
+	if err != nil {
+		t.Fatal(err)
+	}
+	worker.SyncFocus(focus)
+	queue := &fakeSpeechQueue{requests: make(chan speechRequest, 1), spoken: make(chan string, 1)}
+	handler := eventReviewHandler{objectReview: worker, speech: queue, focusGate: &focusGate{},
+		browser: &browserModeController{ready: true, mode: review.BrowseMode, focus: focus,
+			document: result.DocumentPosition.Document.ID()}}
+	result.DocumentFocus = focus
+	handler.present_current_line(result)
+	select {
+	case request := <-queue.requests:
+		return request
+	default:
+		t.Fatal("current-line producer did not enqueue speech")
+		return speechRequest{}
+	}
+}
+
+func TestRemoteCurrentLineSourcePrivacy(t *testing.T) {
+	for _, style := range []review.FlatSpeech{review.FlatSpeak, review.FlatSpell, review.FlatPhonetic} {
+		for _, source := range []string{"ordinary", "password", "ancestor", "snapshot-ancestor", "unknown", "unknown-ancestor", "missing-context", "ordinary-neighbor", "neighbor", "missing-neighbor", "native", "failure"} {
+			t.Run(fmt.Sprintf("%s/%d", source, style), func(t *testing.T) {
+				snapshot := atspi.Snapshot{Role: "static"}
+				ancestors := []atspi.Snapshot{snapshot, {Role: "paragraph"}, {Role: "document web"}}
+				result := review.Result{CurrentLineBrowse: true, FlatSpeech: style, DocumentCaretText: "book",
+					DocumentPosition: review.DocumentPosition{Snapshot: snapshot}, DocumentCaretContext: ancestors}
+				switch source {
+				case "password":
+					result.DocumentPosition.Snapshot.Role = "password text"
+				case "ancestor":
+					ancestors[1].Role = "password text"
+				case "snapshot-ancestor":
+					result.DocumentPosition.Snapshot.SpeechContext = []atspi.Snapshot{{Role: "password text"}}
+				case "unknown":
+					result.DocumentPosition.Snapshot.Role = ""
+				case "unknown-ancestor":
+					ancestors[1].Role = ""
+				case "missing-context":
+					result.DocumentCaretContext = nil
+				case "ordinary-neighbor", "neighbor", "missing-neighbor":
+					neighbor := []atspi.Snapshot{{Role: "static"}, {Role: "password text"}}
+					if source == "ordinary-neighbor" {
+						neighbor[1].Role = "paragraph"
+					} else if source == "missing-neighbor" {
+						neighbor = nil
+					}
+					result.DocumentCaretLine = &atspi.DocumentLine{Contents: []atspi.DocumentContent{{Snapshot: snapshot, Text: "book"}},
+						SourceContexts: [][]atspi.Snapshot{ancestors, neighbor}}
+				case "native":
+					result.CurrentLineBrowse = false
+				case "failure":
+					result.Err = errors.New("fixture unavailable")
+				}
+				request := current_line_observation_request(t, result)
+				if exportable_speech(request) != (source == "ordinary" || source == "ordinary-neighbor") {
+					t.Fatalf("source %s produced exportable=%v", source, exportable_speech(request))
+				}
+				if source != "failure" && request.Text != "book" {
+					t.Fatal("privacy classification changed local text")
+				}
+			})
+		}
+	}
+}
+
+func TestRemoteCurrentLineResolvedOutput(t *testing.T) {
+	worker, session, _, _ := observation_fixture(t)
+	worker.textTransform = func(text string) string { return strings.ReplaceAll(text, "colour", "color") }
+	for _, probe := range []struct {
+		text       string
+		style      review.FlatSpeech
+		want       []string
+		characters bool
+	}{
+		{"Current colour.", review.FlatSpeak, []string{"Current color."}, false},
+		{"book", review.FlatSpell, []string{"b", "o", "o", "k"}, true},
+		{"book", review.FlatPhonetic, []string{"bravo", "oscar", "oscar", "kilo"}, false},
+		{"\n", review.FlatSpeak, []string{"blank"}, false},
+	} {
+		source := atspi.Snapshot{Role: "static"}
+		result := review.Result{CurrentLineBrowse: true, FlatSpeech: probe.style, DocumentCaretText: probe.text,
+			DocumentPosition:     review.DocumentPosition{Snapshot: source},
+			DocumentCaretContext: []atspi.Snapshot{source, {Role: "paragraph"}, {Role: "document web"}}}
+		if err := worker.EnqueueAndWait(t.Context(), current_line_observation_request(t, result)); err != nil {
+			t.Fatal(err)
+		}
+		for _, want := range probe.want {
+			value := observed_speech(t, session)
+			if value.Kind != "speak" || len(value.Parts) != 2 || value.Parts[0].Text != want ||
+				value.Parts[0].Characters != probe.characters || !value.Parts[1].End {
+				t.Fatal("current-line delivery lost resolved text, repetition or character state", value)
+			}
+			if got := <-worker.speaker.(*observationSpeaker).spoken; got != want {
+				t.Fatalf("local reading %q, want %q", got, want)
+			}
+		}
+		// A sensitive ancestor must suppress every spelling/phonetic part,
+		// while the complete local reading remains available.
+		result.DocumentCaretContext[1].Role = "password text"
+		if err := worker.EnqueueAndWait(t.Context(), current_line_observation_request(t, result)); err != nil {
+			t.Fatal(err)
+		}
+		worker.InterruptForUser()
+		if value := observed_speech(t, session); value.Kind != "cancel" {
+			t.Fatal("sensitive current-line output reached the child", value)
+		}
+		for _, want := range probe.want {
+			if got := <-worker.speaker.(*observationSpeaker).spoken; got != want {
+				t.Fatalf("private local reading %q, want %q", got, want)
+			}
+		}
+	}
+}

internal/app/speech_document_observation_test.go

@@ -31,6 +31,9 @@ func document_observation_request(t *testing.T, kind string, result review.Resul
 		presentDocumentResult(logger, queue, result, options)
 	case "read-all":
 		presentReadAllResult(logger, queue, result, options)
+	case "current-line":
+		result.CurrentLineBrowse = true
+		return current_line_observation_request(t, result)
 	}
 	select {
 	case request := <-queue.requests:
@@ -84,6 +87,101 @@ func TestRemoteDocumentSpeechSourcePrivacy(t *testing.T) {
 	}
 }
 
+func TestRemoteDocumentSpeechFragmentPrivacy(t *testing.T) {
+	worker, session, _, _ := observation_fixture(t)
+	for _, kind := range []string{"caret", "read-all"} {
+		for _, source := range []string{"ordinary", "password", "ancestor", "snapshot-ancestor", "unknown", "missing"} {
+			t.Run(kind+"/"+source, func(t *testing.T) {
+				caret := atspi.Snapshot{Path: "/caret", Role: "static"}
+				neighbor := atspi.Snapshot{Path: "/neighbor", Role: "static"}
+				context := []atspi.Snapshot{neighbor, {Role: "section"}, {Role: "document web"}}
+				switch source {
+				case "password":
+					context[0].Role = "password text"
+				case "ancestor":
+					context[1].Role = "password text"
+				case "snapshot-ancestor":
+					context[0].SpeechContext = []atspi.Snapshot{{Role: "password text"}}
+				case "unknown":
+					context[0].Role = ""
+				case "missing":
+					context = nil
+				}
+				// The presentation has already flattened two fragments to one
+				// string. The caret and its ancestors are ordinary in every case.
+				line := atspi.DocumentLine{Contents: []atspi.DocumentContent{{Snapshot: caret, Text: "Joined colour."}},
+					SourceContexts: [][]atspi.Snapshot{{caret, {Role: "document web"}}, context}}
+				result := review.Result{Moved: true, DocumentCaretCommand: review.CaretNextLine,
+					DocumentPosition: review.DocumentPosition{Snapshot: caret}, DocumentCaretText: "Joined colour.",
+					DocumentCaretContext: []atspi.Snapshot{caret, {Role: "document web"}}, DocumentCaretLine: &line,
+					ReadAllContext: t.Context(), ReadAllLines: []atspi.DocumentLine{line}}
+				request := document_observation_request(t, kind, result)
+				if exportable_speech(request) != (source == "ordinary") {
+					t.Fatalf("fragment %s produced exportable=%v", source, exportable_speech(request))
+				}
+				if err := worker.EnqueueAndWait(t.Context(), request); err != nil {
+					t.Fatal(err)
+				}
+				if source == "ordinary" {
+					if value := observed_speech(t, session); value.Kind != "speak" || value.Parts[0].Text != "Joined colour." {
+						t.Fatal("ordinary fragmented reading was not exported", value)
+					}
+				}
+				worker.InterruptForUser()
+				if value := observed_speech(t, session); value.Kind != "cancel" {
+					t.Fatal("fragment privacy failed before cancellation", value)
+				}
+				select {
+				case text := <-worker.speaker.(*observationSpeaker).spoken:
+					if text != "Joined colour." {
+						t.Fatal("source classification changed local reading", text)
+					}
+				default:
+					t.Fatal("private fragmented reading did not reach local speech")
+				}
+			})
+		}
+	}
+}
+
+func TestRemoteDocumentSpeechCapturedNeighborPrivacy(t *testing.T) {
+	id := func(path string) atspi.ObjectID { return atspi.NewObjectID(":1.42", path) }
+	node := func(path, role string, children ...atspi.ObjectID) atspi.TreeNode {
+		return atspi.TreeNode{Snapshot: atspi.Snapshot{BusName: ":1.42", Path: path, Role: role}, Children: children}
+	}
+	public := node("/public", "static")
+	private := node("/private", "static")
+	for index, leaf := range []*atspi.TreeNode{&public, &private} {
+		text := []string{"Public text.", "Private text."}[index]
+		bounds := atspi.Rectangle{X: int32(index * 100), Y: 10, Width: 100, Height: 20}
+		leaf.Geometry = atspi.Geometry{Bounds: bounds, BoundsKnown: true, VisibilityKnown: true, Visible: true, Showing: true}
+		leaf.Text = atspi.VisibleText{Known: true, Ranges: []atspi.TextRange{{Start: 0, End: len(text), Text: text, Bounds: bounds}}}
+	}
+	tree, err := atspi.NewAccessibleTree(id("/doc"), []atspi.TreeNode{
+		node("/doc", "document web", id("/public"), id("/password")), public,
+		node("/password", "password text", id("/private")), private,
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+	reference, _ := tree.Reference(id("/public"))
+	line, err := tree.DocumentLineAtOffset(t.Context(), reference, 0)
+	if err != nil || len(line.Contents) != 2 {
+		t.Fatal("fixture did not assemble both visible sources", err)
+	}
+	// Only the neighbor has a password ancestor; the caret's line context
+	// cannot classify it. Exercise the real tree-to-presentation handoff.
+	for _, ancestor := range line.Context {
+		if ancestor.Role == "password text" {
+			t.Fatal("fixture caret has a password ancestor")
+		}
+	}
+	request := document_observation_request(t, "read-all", review.Result{ReadAllContext: t.Context(), ReadAllLines: []atspi.DocumentLine{line}})
+	if len(request.ReadAll) == 0 || exportable_speech(request) {
+		t.Fatal("captured neighbor ancestry was lost before speech admission")
+	}
+}
+
 func (speaker *observationSpeaker) SpeakAndWait(ctx context.Context, text string, began func()) error {
 	if began != nil {
 		began()

internal/app/speech_interrupt.go

@@ -49,6 +49,7 @@ func (worker *speechWorker) SetEnabled(enabled bool) {
 }
 
 func (worker *speechWorker) interruptLocked() {
+	worker.retire_remote_speech_locked()
 	if worker.hintCancel != nil {
 		worker.hintCancel()
 	}

internal/app/speech_observation.go

@@ -58,6 +58,16 @@ func document_line_speech_origin(line atspi.DocumentLine) speechOrigin {
 	if len(line.Contents) == 0 {
 		return speechOriginUnknown
 	}
+	for _, sources := range line.SourceContexts {
+		if len(sources) == 0 {
+			return speechOriginUnknown
+		}
+		for _, source := range sources {
+			if origin := document_speech_origin(source, nil); origin != speechOriginLocal {
+				return origin
+			}
+		}
+	}
 	for _, content := range line.Contents {
 		if origin := document_speech_origin(content.Snapshot, line.Context); origin != speechOriginLocal {
 			return origin

internal/app/speech_worker.go

@@ -91,6 +91,9 @@ type readAllPart struct {
 // barrier so cancellation cannot overtake newly accepted output.
 type speechWorker struct {
 	remoteOutput   func() *tentacle.RemoteSpeechOutput // Owned under mutex; no runtime/output locks in callback.
+	remoteLifetime context.Context                     // Local output/interruptions retire admitted incoming work.
+	remoteCancel   context.CancelFunc
+	remoteAfter    time.Time // Discard mailbox/assembly work admitted before local output.
 	logger         *slog.Logger
 	speaker        Speaker
 	history        *speechHistory
@@ -203,6 +206,7 @@ func (worker *speechWorker) Enqueue(request speechRequest) {
 		return
 	}
 	request.observation = nil
+	worker.retire_remote_speech_locked()
 	if worker.remoteOutput != nil && exportable_speech(request) && !worker.secure {
 		request.observation = worker.remoteOutput()
 	}
@@ -296,6 +300,7 @@ func (worker *speechWorker) Stop(ctx context.Context) error {
 		return nil
 	}
 	worker.running = false
+	worker.retire_remote_speech_locked()
 	worker.confirmationID = 0
 	if worker.uninterruptibleCancel != nil {
 		worker.uninterruptibleCancel()

internal/app/tentacle_remote_connection_test.go

@@ -32,7 +32,7 @@ import (
 
 // This uses the source-built external executable and real host/SDK IPC. Only
 // OpenLocal submissions are synthetic; it cannot prove physical-source input.
-func remote_command_fixture(t *testing.T) (*tentacleRuntime, *consentTestForms, input.Command) {
+func remote_command_fixture(t *testing.T, setup ...func(*tentacleRuntime)) (*tentacleRuntime, *consentTestForms, input.Command) {
 	t.Helper()
 	program := os.Getenv("CTHULHU_REMOTE_BINARY")
 	if program == "" {
@@ -53,6 +53,9 @@ func remote_command_fixture(t *testing.T) (*tentacleRuntime, *consentTestForms,
 	runtime.newManager = func() (*tentacle.Manager, error) { return tentacle.NewManager(tentacle.DefaultLimits(), nil) }
 	forms := &consentTestForms{requests: make(chan consentFormRequest, 1)}
 	runtime.forms = forms
+	for _, configure := range setup {
+		configure(runtime)
+	}
 	ctx, cancel := context.WithCancel(t.Context())
 	t.Cleanup(func() {
 		cancel()
@@ -224,15 +227,25 @@ func TestRemoteConnectionCommandCancelsInspectionOnHandoff(t *testing.T) {
 }
 
 func TestRemoteConnectionCommandPrivateRelay(t *testing.T) {
-	for _, test := range []struct{ role, ending string }{
-		{"controller", "disconnect"}, {"controlled", "disconnect"},
-		{"controller", "lock"}, {"controlled", "lock"},
-		{"controller", "handoff"}, {"controlled", "handoff"},
-		{"controller", "disable"}, {"controlled", "disable"},
+	for _, test := range []struct {
+		role, ending string
+		playback     bool
+	}{
+		{"controller", "disconnect", false}, {"controlled", "disconnect", false},
+		{"controller", "lock", false}, {"controlled", "lock", false},
+		{"controller", "handoff", false}, {"controlled", "handoff", false},
+		{"controller", "disable", false}, {"controlled", "disable", false},
+		{"controller", "disconnect", true}, {"controller", "lock", true},
+		{"controller", "handoff", true}, {"controller", "disable", true},
+		{"controller", "backend-failure", true},
 	} {
 		role, ending := test.role, test.ending
-		t.Run(role+"/"+ending, func(t *testing.T) {
-			remoteText := "  " + strings.Repeat("é\x00世界 ", 1500) + "  "
+		name := role + "/" + ending
+		if test.playback {
+			name += "/production-speech"
+		}
+		t.Run(name, func(t *testing.T) {
+			remoteText := "  " + strings.Repeat("é\t世界 ", 1500) + "  "
 			key, err := ecdsa.GenerateKey(elliptic.P256(), rand.Reader)
 			if err != nil {
 				t.Fatal(err)
@@ -248,6 +261,7 @@ func TestRemoteConnectionCommandPrivateRelay(t *testing.T) {
 			}
 			defer listener.Close()
 			probed, joined, closed := make(chan struct{}), make(chan struct{}), make(chan struct{})
+			speechReady := make(chan struct{})
 			relayOutput := make(chan []byte, 64)
 			go func() {
 				probe, err := listener.Accept()
@@ -290,14 +304,19 @@ func TestRemoteConnectionCommandPrivateRelay(t *testing.T) {
 					peerRole = "slave"
 				}
 				io.WriteString(connection, `{"type":"channel_joined","channel":"synthetic-fixture","clients":[{"id":7,"connection_type":"`+peerRole+`"}]}`+"\n")
+				close(joined)
 				if role == "controller" {
+					select {
+					case <-speechReady:
+					case <-t.Context().Done():
+						return
+					}
 					json.NewEncoder(connection).Encode(map[string]any{"type": "speak", "origin": 7, "priority": 2, "sequence": []any{
 						[]any{"CharacterModeCommand", map[string]any{"state": true}},
 						[]any{"LangChangeCommand", map[string]any{"lang": "fr"}}, remoteText,
 						[]any{"EndUtteranceCommand", map[string]any{}},
 					}})
 				}
-				close(joined)
 				for {
 					frame, err := reader.ReadBytes('\n')
 					if err != nil {
@@ -307,7 +326,29 @@ func TestRemoteConnectionCommandPrivateRelay(t *testing.T) {
 				}
 				close(closed)
 			}()
-			runtime, forms, shortcut := remote_command_fixture(t)
+			var server *isolatedVoiceServer
+			var voice *remoteSpeechVoice
+			var rendered isolatedVoiceUtterance
+			var configure []func(*tentacleRuntime)
+			if test.playback {
+				speaker, fixture := isolated_voice_fixture(t)
+				server = fixture
+				configure = append(configure, func(runtime *tentacleRuntime) {
+					worker := runtime.output.speech
+					worker.speaker = speaker
+					if err := worker.Start(t.Context()); err != nil {
+						t.Fatal(err)
+					}
+					t.Cleanup(func() {
+						ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+						defer cancel()
+						if err := worker.Stop(ctx); err != nil {
+							t.Error(err)
+						}
+					})
+				})
+			}
+			runtime, forms, shortcut := remote_command_fixture(t, configure...)
 			if role == "controlled" {
 				worker := runtime.output.speech
 				worker.speaker = &observationSpeaker{fakeSpeaker{spoken: make(chan string, 16)}}
@@ -323,10 +364,10 @@ func TestRemoteConnectionCommandPrivateRelay(t *testing.T) {
 					}
 				})
 			}
-			// Incoming speech still needs a test owner; production observation
-			// is attached through makeManager on the controlled side.
+			// Keep the explicit mailbox assembly fixture alongside production
+			// playback, which is attached by the actual runtime startup path.
 			var deliveries <-chan tentacle.RemoteSpeechDelivery
-			if role == "controller" {
+			if role == "controller" && !test.playback {
 				runtime.mutex.Lock()
 				for _, command := range runtime.commands {
 					if command.id == "remote" {
@@ -371,13 +412,74 @@ func TestRemoteConnectionCommandPrivateRelay(t *testing.T) {
 			if status.ctx.Err() == nil {
 				t.Fatal("background connection retained its form context")
 			}
+			if test.playback {
+				waitTentacle(t, func() bool {
+					worker := runtime.output.speech
+					worker.mutex.Lock()
+					defer worker.mutex.Unlock()
+					return worker.activeDone == nil && len(worker.pending) == 0
+				})
+				if ending == "backend-failure" {
+					server.mutex.Lock()
+					server.queryReplies = map[string]string{"GET LANGUAGE": "400 Rejected\r\n"}
+					server.mutex.Unlock()
+				}
+			}
+			close(speechReady)
+			if ending == "backend-failure" {
+				remote_stream_wait(t, closed)
+				// Backend failure retires the lease, while the process and
+				// mailbox owner remain usable for an explicit new connection.
+				runtime.Invoke(t.Context(), shortcut)
+				selection := next_remote_form(t, forms)
+				if selection.form.Title == "Remote relay status" {
+					// An ended attempt remains inspectable until explicitly
+					// closed, as with ordinary transport failure.
+					selection.reply <- internalUIResult{Activated: "cancel"}
+					waitTentacle(t, func() bool { return len(runtime.resultSlots) == 0 })
+					runtime.Invoke(t.Context(), shortcut)
+					selection = next_remote_form(t, forms)
+				}
+				if !strings.Contains(selection.form.Title, "Remote relay and role") {
+					t.Fatal("backend failure retained a connected workflow")
+				}
+				selection.reply <- internalUIResult{Cancelled: true}
+				waitTentacle(t, func() bool { return len(runtime.resultSlots) == 0 })
+				server.mutex.Lock()
+				for _, connection := range server.connections {
+					if connection.priority == "TEXT" && connection.pending != "" {
+						t.Error("failed rendering exposed a speech prefix")
+					}
+				}
+				server.mutex.Unlock()
+				return
+			}
 			select {
 			case <-closed:
 				t.Fatal("return to desktop disconnected the relay")
 			default:
 			}
 			var delivery tentacle.RemoteSpeechDelivery
-			if role == "controller" {
+			if test.playback {
+				utterance := server.next_utterance(t)
+				for utterance.priority == "MESSAGE" {
+					// Returning to desktop produces local status on its ordinary
+					// client. The production Remote voice must stay separate.
+					utterance = server.next_utterance(t)
+				}
+				rendered = utterance
+				if utterance.text != remoteText || utterance.language != "fr" || utterance.spelling != "on" ||
+					utterance.ssml != "off" || utterance.priority != "TEXT" {
+					t.Fatal("production owner lost literal speech, metadata or local priority")
+				}
+				speaker := runtime.output.speech.speaker.(*configuredSpeaker)
+				speaker.mu.RLock()
+				voice = speaker.remote
+				speaker.mu.RUnlock()
+				if voice == nil {
+					t.Fatal("production owner did not acquire isolated synthesis")
+				}
+			} else if role == "controller" {
 				select {
 				case delivery = <-deliveries:
 				case <-time.After(5 * time.Second):
@@ -448,6 +550,28 @@ func TestRemoteConnectionCommandPrivateRelay(t *testing.T) {
 				if err := worker.EnqueueAndWait(t.Context(), request); err != nil {
 					t.Fatal(err)
 				}
+				request = current_line_observation_request(t, review.Result{CurrentLineBrowse: true,
+					DocumentCaretText: "Current colour.", DocumentPosition: review.DocumentPosition{Snapshot: atspi.Snapshot{Role: "static"}},
+					DocumentCaretContext: []atspi.Snapshot{{Role: "static"}, {Role: "paragraph"}, {Role: "document web"}}})
+				if err := worker.EnqueueAndWait(t.Context(), request); err != nil {
+					t.Fatal(err)
+				}
+				// A joined line can contain a private neighboring fragment even
+				// when its caret source and the line's presentation are ordinary.
+				caret := atspi.Snapshot{Role: "static"}
+				privateLine := atspi.DocumentLine{Contents: []atspi.DocumentContent{{Snapshot: caret, Text: "private joined text"}},
+					SourceContexts: [][]atspi.Snapshot{{caret}, {{Role: "static"}, {Role: "password text"}}}}
+				for _, kind := range []string{"caret", "read-all", "current-line"} {
+					request := document_observation_request(t, kind, review.Result{
+						Moved: true, DocumentCaretCommand: review.CaretNextLine,
+						DocumentPosition: review.DocumentPosition{Snapshot: caret}, DocumentCaretText: "private joined text",
+						DocumentCaretContext: []atspi.Snapshot{caret, {Role: "document web"}},
+						DocumentCaretLine:    &privateLine, ReadAllContext: t.Context(), ReadAllLines: []atspi.DocumentLine{privateLine},
+					})
+					if err := worker.EnqueueAndWait(t.Context(), request); err != nil {
+						t.Fatal(err)
+					}
+				}
 				worker.InterruptForUser()
 				var received strings.Builder
 				ends, frames := 0, 0
@@ -483,7 +607,7 @@ func TestRemoteConnectionCommandPrivateRelay(t *testing.T) {
 						t.Fatal("reader output did not reach the relay in order")
 					}
 				}
-				if received.String() != "color "+remoteText+"First color.Second color." || frames < 4 || ends != 3 {
+				if received.String() != "color "+remoteText+"First color.Second color.Current color." || frames < 5 || ends != 4 {
 					t.Fatal("observation leaked private text or lost resolved output/boundaries")
 				}
 			}
@@ -512,7 +636,15 @@ func TestRemoteConnectionCommandPrivateRelay(t *testing.T) {
 				t.Fatal("background connection retained the relay after " + ending)
 			}
 			waitTentacle(t, func() bool { return len(runtime.resultSlots) == 0 })
-			if role == "controller" {
+			if test.playback {
+				remote_stream_wait(t, voice.closed)
+				server.mutex.Lock()
+				pending := server.connections[rendered.id].pending
+				server.mutex.Unlock()
+				if pending != "" {
+					t.Fatal("revoked production speech survived backend cleanup")
+				}
+			} else if role == "controller" {
 				// Socket cancellation precedes the final sequenced lease close.
 				// A reopened status interaction did not issue the original consent,
 				// so its result-slot completion is not the lease-close barrier.

internal/app/tentacle_remote_speech.go

@@ -0,0 +1,105 @@
+// Copyright (c) 2026 Storm Dragon
+// Authors: Storm Dragon, Angus Kola
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app
+
+import (
+	"context"
+	"errors"
+	"slices"
+	"time"
+
+	"git.stormux.org/storm/cthulhu/internal/tentacle"
+)
+
+// Called under the speech mutex. Cancellation performs no backend I/O. A local
+// announcement or interruption discards all older incoming work, including work
+// waiting behind an active renderer. Later Remote output needs fresh admission.
+func (worker *speechWorker) retire_remote_speech_locked() {
+	worker.remoteAfter = time.Now()
+	if worker.remoteCancel != nil {
+		worker.remoteCancel()
+	}
+	worker.remoteLifetime, worker.remoteCancel = nil, nil
+}
+
+func (worker *speechWorker) admit_remote_speech(delivery tentacle.RemoteSpeechDelivery) (remoteSpeechPermit, bool) {
+	worker.mutex.Lock()
+	defer worker.mutex.Unlock()
+	if !worker.running || !worker.enabled || worker.secure || worker.mode != speechModeSpeech ||
+		worker.interrupting || worker.activeDone != nil || len(worker.pending) != 0 ||
+		!delivery.Received.After(worker.remoteAfter) {
+		return remoteSpeechPermit{}, false
+	}
+	if worker.remoteLifetime == nil {
+		worker.remoteLifetime, worker.remoteCancel = context.WithCancel(worker.workerContext)
+	}
+	ctx, cancel := context.WithCancel(delivery.Context)
+	local := worker.remoteLifetime
+	stop := context.AfterFunc(local, cancel)
+	return remoteSpeechPermit{context: ctx, current: func() bool { return local.Err() == nil },
+		release: func() { stop(); cancel() }}, true
+}
+
+func (worker *speechWorker) remote_speech_available(delivery tentacle.RemoteSpeechDelivery) bool {
+	worker.mutex.Lock()
+	defer worker.mutex.Unlock()
+	return worker.running && worker.enabled && !worker.secure && worker.mode == speechModeSpeech &&
+		delivery.Received.After(worker.remoteAfter)
+}
+
+// start_remote_speech installs the mailbox before the child becomes active.
+// One session worker owns it until output revocation or reader shutdown. The
+// lifecycle watcher joins cleanup; input/focus callers only cancel contexts.
+func (runtime *tentacleRuntime) start_remote_speech(ctx context.Context, session *tentacle.Session) <-chan struct{} {
+	done := make(chan struct{})
+	owner := runtime.output
+	if owner == nil || owner.speech == nil || owner.gate == nil || runtime.remotePolicy == nil ||
+		!slices.Contains(session.RemoteGrants(), "remote-present") {
+		close(done)
+		return done
+	}
+	speaker, ok := owner.speech.speaker.(*configuredSpeaker)
+	if !ok {
+		close(done)
+		return done
+	}
+	incoming := session.EnableRemoteSpeech()
+	ctx, cancel := context.WithCancel(ctx)
+	stop := context.AfterFunc(session.OutputContext(), cancel)
+	allow := func(delivery tentacle.RemoteSpeechDelivery) bool {
+		if delivery.Context == nil || delivery.Context.Err() != nil {
+			return false
+		}
+		owner.gate.mutex.Lock()
+		defer owner.gate.mutex.Unlock()
+		if owner.gate.Locked() || owner.gate.Suspended() || owner.gate.InternalUIActive() ||
+			!owner.speech.remote_speech_available(delivery) {
+			return false
+		}
+		lifetime, err := session.RemoteContext(delivery.Lease, "remote-present")
+		return err == nil && lifetime.Err() == nil
+	}
+	go func() {
+		defer close(done)
+		defer cancel()
+		defer stop()
+		for ctx.Err() == nil {
+			err := run_remote_speech_playback(ctx, speaker, incoming, allow, owner.speech.admit_remote_speech)
+			if ctx.Err() != nil || err == nil {
+				return
+			}
+			var failure *remoteSpeechStreamError
+			if !errors.As(err, &failure) {
+				// Internal ownership failure: leave no accepting mailbox without
+				// a consumer. Normal backend failures retire only their lease.
+				session.Disable()
+				return
+			}
+			session.RevokeRemoteEpoch(failure.lease.Epoch)
+			runtime.report("Remote speech stopped. Connect again to retry.")
+		}
+	}()
+	return done
+}

internal/app/tentacle_remote_speech_test.go

@@ -0,0 +1,131 @@
+// Copyright (c) 2026 Storm Dragon
+// Authors: Storm Dragon, Angus Kola
+// SPDX-License-Identifier: GPL-3.0-or-later
+
+package app
+
+import (
+	"context"
+	"log/slog"
+	"testing"
+	"time"
+
+	"git.stormux.org/storm/cthulhu/internal/tentacle"
+)
+
+func TestRemoteSpeechLocalPriorityDiscardsActiveAndQueuedWork(t *testing.T) {
+	for _, change := range []string{"announcement", "interrupt", "mode", "disable", "secure"} {
+		t.Run(change, func(t *testing.T) {
+			worker := newSpeechWorker(slog.New(slog.DiscardHandler), nil)
+			worker.running, worker.workerContext = true, t.Context()
+			f := remote_stream_fixture(t, false, worker.admit_remote_speech)
+			activeRelease := f.speak(t, "old active", 2)
+			active := f.next(t, "old active")
+			pendingRelease := f.speak(t, "old pending", 2)
+			// Equal priority keeps the queued item behind this active NOW.
+			// Use the barrier to establish admission before local output.
+			f.barrier(t)
+			switch change {
+			case "announcement":
+				worker.Enqueue(speechRequest{Text: "local status"})
+			case "interrupt":
+				worker.InterruptForUser()
+			case "mode":
+				worker.cycle_speech_mode()
+			case "disable":
+				worker.SetEnabled(false)
+			case "secure":
+				worker.SetSecureInputActive(true)
+			}
+			remote_stream_wait(t, active.stopped)
+			remote_stream_wait(t, activeRelease)
+			remote_stream_wait(t, pendingRelease)
+			remote_stream_wait(t, f.speak(t, "blocked by local policy", 2))
+			select {
+			case <-f.started:
+				t.Fatal("old or blocked incoming speech reached rendering")
+			default:
+			}
+			worker.mutex.Lock()
+			worker.pending, worker.interrupting = nil, false
+			worker.enabled, worker.secure, worker.mode = true, false, speechModeSpeech
+			worker.mutex.Unlock()
+			freshRelease := f.speak(t, "fresh output", 0)
+			fresh := f.next(t, "fresh output")
+			fresh.finish <- nil
+			remote_stream_wait(t, freshRelease)
+			f.stop(t)
+		})
+	}
+}
+
+func TestRemoteSpeechLocalPriorityRejectsOldMailboxAndIncompleteAssembly(t *testing.T) {
+	worker := newSpeechWorker(slog.New(slog.DiscardHandler), nil)
+	worker.running, worker.workerContext = true, t.Context()
+	// The first fragment's timestamp survives finalization: work retained in
+	// the IPC assembly or mailbox must not acquire fresh local authority later.
+	old := tentacle.RemoteSpeechDelivery{Context: t.Context(), Received: time.Now()}
+	worker.Enqueue(speechRequest{Text: "local status"})
+	worker.mutex.Lock()
+	worker.pending = nil // Local queue drained before the old mailbox is read.
+	worker.mutex.Unlock()
+	if _, ok := worker.admit_remote_speech(old); ok {
+		t.Fatal("old mailbox/assembly work followed local output")
+	}
+	fresh := tentacle.RemoteSpeechDelivery{Context: t.Context(), Received: time.Now()}
+	permit, ok := worker.admit_remote_speech(fresh)
+	if !ok || permit.context.Err() != nil || !permit.current() {
+		t.Fatal("fresh incoming output was rejected after local reading")
+	}
+	permit.release()
+}
+
+func TestRemoteSpeechRejectedLocalRequestPreservesRemoteAndServerCancelContinues(t *testing.T) {
+	worker := newSpeechWorker(slog.New(slog.DiscardHandler), nil)
+	worker.running, worker.workerContext = true, t.Context()
+	f := remote_stream_fixture(t, false, worker.admit_remote_speech)
+	released := f.speak(t, "active", 0)
+	active := f.next(t, "active")
+	oldGeneration := worker.generation + 1
+	worker.Enqueue(speechRequest{Text: "stale result", presentationGeneration: &oldGeneration})
+	select {
+	case <-active.ctx.Done():
+		t.Fatal("rejected local request cancelled Remote output")
+	default:
+	}
+	// A server priority cancellation discards this assembly. It must not
+	// disable the owner or retire consent, and no suffix is retried.
+	active.finish <- context.Canceled
+	remote_stream_wait(t, released)
+	nextRelease := f.speak(t, "after cancellation", 0)
+	next := f.next(t, "after cancellation")
+	next.finish <- nil
+	remote_stream_wait(t, nextRelease)
+	f.stop(t)
+}
+
+func TestRemoteSpeechBackgroundPriorityRejectionClosesCandidate(t *testing.T) {
+	speaker, server := isolated_voice_fixture(t)
+	server.mutex.Lock()
+	server.queryReplies = map[string]string{"SET SELF PRIORITY TEXT": "400 Rejected\r\n"}
+	server.mutex.Unlock()
+	if _, err := speaker.open_remote_voice(t.Context()); err == nil {
+		t.Fatal("isolated client acquired without lower backend priority")
+	}
+	speaker.mu.RLock()
+	remote := speaker.remote
+	speaker.mu.RUnlock()
+	if remote != nil {
+		t.Fatal("failed candidate became the owned voice")
+	}
+	server.mutex.Lock()
+	server.queryReplies = nil
+	server.mutex.Unlock()
+	voice, err := speaker.open_remote_voice(t.Context())
+	if err != nil {
+		t.Fatal("failed priority setup prevented a fresh acquisition", err)
+	}
+	if err := voice.Close(t.Context()); err != nil {
+		t.Fatal(err)
+	}
+}

internal/app/tentacle_startup.go

@@ -135,8 +135,10 @@ func (owner *tentacleLifecycle) startPending() {
 			}
 		})
 		owner.watchers = append(owner.watchers, done)
+		speechDone := owner.runtime.start_remote_speech(owner.ctx, session)
 		go func() {
 			defer close(done)
+			defer func() { <-speechDone }()
 			select {
 			case <-session.Revoked():
 			case <-owner.ctx.Done():

internal/app/tentacles.go

@@ -184,9 +184,11 @@ func (runtime *tentacleRuntime) run(ctx context.Context) error {
 			}
 			runtime.mutex.Unlock()
 			current, ready = session, session.Ready()
+			speechDone := runtime.start_remote_speech(ctx, session)
 			watchers.Add(1)
 			go func() {
 				defer watchers.Done()
+				defer func() { <-speechDone }()
 				select {
 				case <-session.Revoked():
 				case <-ctx.Done():

internal/atspi/document_line.go

@@ -24,6 +24,10 @@ type DocumentLine struct {
 	Context  []Snapshot
 	Document ObjectReference
 	Contents []DocumentContent
+	// SourceContexts retains each contributing object's unfiltered ancestry,
+	// including that object. It survives presentation flattening for speech
+	// privacy checks. A nil entry means that source could not be classified.
+	SourceContexts [][]Snapshot
 }
 
 func (tree *AccessibleTree) DocumentLineAtOffset(ctx context.Context, reference ObjectReference, offset int) (DocumentLine, error) {
@@ -75,6 +79,7 @@ func (tree *AccessibleTree) DocumentLineAtOffset(ctx context.Context, reference
 		if node.Hidden {
 			continue
 		}
+		contributed := false
 		for _, textRange := range node.Text.Ranges {
 			if !boundsAreOnSameLine(caretRange.Bounds, textRange.Bounds) {
 				continue
@@ -82,6 +87,11 @@ func (tree *AccessibleTree) DocumentLineAtOffset(ctx context.Context, reference
 			if textRange.Text == "" {
 				continue
 			}
+			if !contributed {
+				owner, _ := tree.DocumentContext(node.Reference)
+				line.SourceContexts = append(line.SourceContexts, owner.Ancestors)
+				contributed = true
+			}
 			line.Contents = append(line.Contents, DocumentContent{
 				Reference: node.Reference,
 				Snapshot:  node.Snapshot,

internal/atspi/document_test.go

@@ -209,6 +209,19 @@ func TestDocumentLineAssemblesSameVisualRow(t *testing.T) {
 	if line.Document.ID() != testID("/doc") {
 		t.Fatalf("line document = %#v", line.Document)
 	}
+	if len(line.SourceContexts) != len(line.Contents) {
+		t.Fatal("assembled line lost contributing sources")
+	}
+	for index, sources := range line.SourceContexts {
+		if len(sources) == 0 || sources[0].ID() != line.Contents[index].Snapshot.ID() {
+			t.Fatal("line source context belongs to another fragment")
+		}
+	}
+	// The first fragment is outside the caret object's ancestry. Keep its
+	// original ancestry even though line.Context belongs to the caret.
+	if line.SourceContexts[0][1].ID() != testID("/doc") || line.SourceContexts[1][1].ID() != testID("/inner") {
+		t.Fatal("neighbor ancestry was replaced by caret ancestry")
+	}
 }
 
 func TestDocumentLineExcludesHiddenAndOtherRows(t *testing.T) {

internal/review/current_line.go

@@ -69,10 +69,18 @@ func (worker *Worker) read_current_line(ctx context.Context, cursor *DocumentCur
 	if result.Err != nil {
 		return result
 	}
-	movement, _, err := worker.readAllMove(deadline, cursor, reader, CaretReadLine, result.DocumentFocus)
+	movement, cursor, err := worker.readAllMove(deadline, cursor, reader, CaretReadLine, result.DocumentFocus)
 	result.Err = err
 	result.DocumentPosition, result.DocumentCaretText = movement.Position, movement.Text
 	result.DocumentCaretRawText, result.DocumentCaretLine = movement.RawText, movement.Line
+	if err == nil {
+		// Retain the unfiltered ancestry from the tree that produced this
+		// movement, including after recapture. Missing metadata keeps export
+		// private without preventing the local current-line announcement.
+		if owner, contextErr := cursor.tree.DocumentContext(movement.Position.Object); contextErr == nil {
+			result.DocumentCaretContext = owner.Ancestors
+		}
+	}
 	if result.DocumentCaretText == "" && wholeCaretNode(movement.Position.Snapshot) {
 		result.DocumentCaretText = movement.Position.Snapshot.Name
 	}

internal/review/current_line_test.go

@@ -56,6 +56,10 @@ func TestCurrentLineReadsWholeBrowseLineWithoutMoving(t *testing.T) {
 	if result.Err != nil || strings.TrimSpace(result.DocumentCaretText) != "Second café 猫" {
 		t.Fatalf("whole browse line from middle: %+v", result)
 	}
+	owner, err := cursor.tree.DocumentContext(result.DocumentPosition.Object)
+	if err != nil || len(result.DocumentCaretContext) == 0 || !reflect.DeepEqual(result.DocumentCaretContext, owner.Ancestors) {
+		t.Fatal("current-line report lost its captured source ancestry", err)
+	}
 	if !reflect.DeepEqual(cursor.places, before) || capturer.nativePlacements != 0 {
 		t.Fatal("report changed browse or native caret")
 	}
@@ -76,6 +80,9 @@ func TestCurrentLineJoinsBrowseFragmentsWithoutMoving(t *testing.T) {
 	if result.Err != nil || result.DocumentCaretText != "One two." || !reflect.DeepEqual(cursor.places, before) {
 		t.Fatalf("fragmented current line: %+v", result)
 	}
+	if result.DocumentCaretLine == nil || len(result.DocumentCaretLine.SourceContexts) != 2 || len(result.DocumentCaretContext) == 0 {
+		t.Fatal("fragmented report lost source ancestry")
+	}
 }
 
 func TestCurrentLineReadsBrowseControlLabel(t *testing.T) {
@@ -99,6 +106,46 @@ func TestCurrentLineReadsBrowseControlLabel(t *testing.T) {
 	}
 }
 
+func TestCurrentLineUsesRecapturedSourceContext(t *testing.T) {
+	text := caretTextReader{webID("/text"): "First\nSecond", webID("/next"): "Last"}
+	cursor := newCaretTextCursor(t, text)
+	fresh := newCaretTextCursor(t, text).tree
+	capturer := &sequenceReadAllCapturer{caretTextReader: text, trees: []*atspi.AccessibleTree{fresh},
+		invalidateTree: cursor.tree, staleAt: 2}
+	worker, _ := NewWorker(capturer, time.Second)
+	worker.SyncFocus(webID("/text"))
+	result := worker.read_current_line(t.Context(), cursor, true)
+	if result.Err != nil || strings.TrimSpace(result.DocumentCaretText) != "First" || capturer.index != 1 {
+		t.Fatalf("current line did not recover capture: %+v", result)
+	}
+	owner, err := fresh.DocumentContext(result.DocumentPosition.Object)
+	if err != nil || len(result.DocumentCaretContext) == 0 || !reflect.DeepEqual(result.DocumentCaretContext, owner.Ancestors) {
+		t.Fatal("report did not retain the replacement tree's source context", err)
+	}
+}
+
+type currentLineStaleContextCapturer struct{ *readAllCapturer }
+
+func (capturer *currentLineStaleContextCapturer) ReadDocumentCaret(ctx context.Context, reference atspi.ObjectReference, offset int, unit atspi.DocumentCaretUnit) (atspi.DocumentCaretText, error) {
+	text, err := capturer.caretTextReader.ReadDocumentCaret(ctx, reference, offset, unit)
+	if unit == atspi.DocumentCaretLineRemainder {
+		capturer.tree.InvalidateSnapshot(webID("/doc"))
+	}
+	return text, err
+}
+
+func TestCurrentLinePreservesLocalTextWithStaleContext(t *testing.T) {
+	text := caretTextReader{webID("/text"): "Local line", webID("/next"): "Last"}
+	cursor := newCaretTextCursor(t, text)
+	capturer := &currentLineStaleContextCapturer{&readAllCapturer{caretTextReader: text, tree: cursor.tree}}
+	worker, _ := NewWorker(capturer, time.Second)
+	worker.SyncFocus(webID("/text"))
+	result := worker.read_current_line(t.Context(), cursor, true)
+	if result.Err != nil || result.DocumentCaretText != "Local line" || len(result.DocumentCaretContext) != 0 {
+		t.Fatalf("stale ancestry must leave local reading available without export metadata: %+v", result)
+	}
+}
+
 type currentLineFragmentCapturer struct {
 	*readAllCapturer
 	fragmentTextReader

internal/review/document_visual_line.go

@@ -272,9 +272,9 @@ func assemble_visual_line(tree *atspi.AccessibleTree, doc atspi.DocumentSnapshot
 		raw.WriteString(separator)
 		raw.WriteString(value)
 		snapshot := doc.Nodes[part.index].Snapshot
-		if context, err := tree.DocumentContext(doc.Nodes[part.index].Reference); err == nil {
-			snapshot.BrailleContext = context.Ancestors
-		}
+		owner, _ := tree.DocumentContext(doc.Nodes[part.index].Reference)
+		snapshot.BrailleContext = owner.Ancestors
+		line.SourceContexts = append(line.SourceContexts, owner.Ancestors)
 		snapshot.Misspelled = part.text.Misspelled
 		misspelled = misspelled || part.text.Misspelled
 		line.Contents = append(line.Contents, atspi.DocumentContent{Reference: doc.Nodes[part.index].Reference, Snapshot: snapshot,

internal/review/document_visual_line_test.go

@@ -167,6 +167,13 @@ func TestReadAllFragmentLinesAndRemainder(t *testing.T) {
 			t.Fatalf("line %d: %q, want %q", index, got, want)
 		}
 	}
+	// Say All flattens the fragments into one text value, but must retain
+	// every original source and ancestry for Remote's privacy decision.
+	contexts := result.ReadAllLines[0].SourceContexts
+	if len(contexts) != 2 || len(contexts[0]) < 2 || len(contexts[1]) < 2 ||
+		contexts[0][0].ID() != webID("/one") || contexts[1][0].ID() != webID("/two") || contexts[1][1].ID() != webID("/span") {
+		t.Fatal("flattened Say All line lost fragment ancestry")
+	}
 	if cursor.places[0].offset != 1 {
 		t.Fatal("assembly moved the user's cursor")
 	}
@@ -182,6 +189,31 @@ func TestReadAllFragmentLinesAndRemainder(t *testing.T) {
 	}
 }
 
+func TestDocumentFragmentSourceLookupFailureKeepsLocalText(t *testing.T) {
+	cursor, reader := fragment_cursor(t, "paragraph")
+	doc, err := cursor.tree.Document(t.Context(), cursor.places[0].object)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var parts []visualLinePart
+	for index, node := range doc.Nodes {
+		if node.Reference.ID() == webID("/one") || node.Reference.ID() == webID("/two") {
+			text, err := reader.ReadDocumentCaret(t.Context(), node.Reference, 0, atspi.DocumentCaretLineRemainder)
+			if err != nil {
+				t.Fatal(err)
+			}
+			parts = append(parts, visualLinePart{index: index, text: text})
+		}
+	}
+	// Metadata can become stale after the successful text read. The local
+	// text stays usable; missing source evidence must remain explicit.
+	cursor.tree.InvalidateSnapshot(webID("/span"))
+	line, raw, _ := assemble_visual_line(cursor.tree, doc, parts)
+	if raw != "One two." || len(line.SourceContexts) != 2 || len(line.SourceContexts[0]) == 0 || line.SourceContexts[1] != nil {
+		t.Fatal("stale source context changed local text or looked classified")
+	}
+}
+
 func TestDocumentFragmentBoundaries(t *testing.T) {
 	for _, boundary := range []string{"heading", "link", "table cell", "pre", "code", "entry"} {
 		t.Run(boundary, func(t *testing.T) {

internal/review/read_all.go

@@ -114,6 +114,12 @@ func (worker *Worker) readAll(ctx context.Context, cursor *DocumentCursor) Resul
 		previous = movement.Position
 		movement.Position.Snapshot.Misspelled = movement.Misspelled
 		line := atspi.DocumentLine{Document: movement.Position.Document, Contents: []atspi.DocumentContent{{Snapshot: movement.Position.Snapshot, Text: movement.Text, RawText: movement.RawText}}}
+		if movement.Line != nil {
+			// Presentation deliberately flattens a visual line into one spoken
+			// string. Keep every contributing source for independent privacy
+			// checks, including sources outside the caret object's ancestry.
+			line.SourceContexts = movement.Line.SourceContexts
+		}
 		owner, err := cursor.tree.DocumentContext(movement.Position.Object)
 		if err != nil {
 			if !documentNeedsCapture(err) {

internal/speech/speech.go

@@ -273,6 +273,19 @@ func (client *Client) Speak(ctx context.Context, text string) (result error) {
 	return client.speak(ctx, text)
 }
 
+// SetBackgroundPriority makes this isolated client yield to ordinary MESSAGE
+// output. Call before speaking; relay priorities must never select SSIP priority.
+// TEXT waits behind MESSAGE and is cancelled when new MESSAGE output arrives.
+// Protocol: https://github.com/brailcom/speechd/blob/master/doc/ssip.texi
+func (client *Client) SetBackgroundPriority(ctx context.Context) error {
+	client.mutex.Lock()
+	defer client.mutex.Unlock()
+	if client.conn == nil {
+		return errors.New("speech client is not connected")
+	}
+	return client.sendCommand(ctx, []string{"SET", "SELF", "PRIORITY", "TEXT"})
+}
+
 // SpeakCharacter gives the synthesizer a single character as a character,
 // preserving repeated adjacent letters during caret and flat review. Spoken
 // names such as "space" still use normal speech.

internal/tentacle/remote_speech.go

@@ -20,6 +20,9 @@ import (
 type RemoteSpeechDelivery struct {
 	Context context.Context
 	Lease   tentaclewire.RemoteLease
+	// Received is the reader's monotonic admission time of the first frame.
+	// Local output can discard old mailbox/assembly work before it is dequeued.
+	Received time.Time
 	// Speeches is one complete effect/utterance, including all IPC fragments.
 	// The owner applies priority once and must not deliver a partial assembly.
 	Speeches []tentaclewire.RemoteSpeech
@@ -30,13 +33,14 @@ type RemoteSpeechDelivery struct {
 
 type remoteSpeechBatch struct {
 	id       uint64
+	received time.Time
 	speeches []tentaclewire.RemoteSpeech
 	bytes    int
 }
 
 // EnableRemoteSpeech installs one bounded mailbox, explicitly from reader code.
-// Without an owner, remote.present is unavailable. No production speech worker
-// is bound yet. The owner selects Session.Done as well as this channel.
+// Without an owner, remote.present is unavailable. The owner selects session
+// shutdown as well as this channel and joins its backend cleanup.
 func (session *Session) EnableRemoteSpeech() <-chan RemoteSpeechDelivery {
 	session.mutex.Lock()
 	defer session.mutex.Unlock()
@@ -103,7 +107,7 @@ func (session *Session) remote_present_locked(params json.RawMessage) (any, *RPC
 		if request.Utterance != 0 && request.Utterance != request.Sequence {
 			return nil, &RPCError{Code: -32602, Message: "Invalid utterance assembly"}
 		}
-		batch = &remoteSpeechBatch{id: request.Utterance}
+		batch = &remoteSpeechBatch{id: request.Utterance, received: time.Now()}
 	} else if request.Utterance != batch.id || request.Speech.Priority != batch.speeches[0].Priority {
 		// No interleaved speech, cancel, pause, or changed priority may expose
 		// an incomplete utterance. Heartbeats may still advance the sequence.
@@ -125,7 +129,7 @@ func (session *Session) remote_present_locked(params json.RawMessage) (any, *RPC
 	}
 	access.speechBatch = nil
 	var released sync.Once
-	delivery := RemoteSpeechDelivery{Context: access.ctx, Lease: lease, Speeches: batch.speeches, Release: func() {
+	delivery := RemoteSpeechDelivery{Context: access.ctx, Lease: lease, Received: batch.received, Speeches: batch.speeches, Release: func() {
 		released.Do(func() {
 			session.mutex.Lock()
 			defer session.mutex.Unlock()

internal/tentacle/remote_speech_test.go

@@ -178,6 +178,7 @@ func TestRemoteSpeechSDKAtomicUtterance(t *testing.T) {
 			if _, code := remoteCall(t, session, "remote.present", request); code != 0 {
 				t.Fatal(code)
 			}
+			firstAdmitted := time.Now()
 			request.Sequence++
 			if _, code := remoteCall(t, session, "remote.heartbeat", request.RemoteOperation); code != 0 {
 				t.Fatal("heartbeat could not run during assembly", code)
@@ -210,6 +211,9 @@ func TestRemoteSpeechSDKAtomicUtterance(t *testing.T) {
 				t.Fatal(code)
 			}
 			delivery := <-deliveries
+			if delivery.Received.IsZero() || delivery.Received.After(firstAdmitted) {
+				t.Fatal("finalization refreshed the original assembly admission time")
+			}
 			if !reflect.DeepEqual(delivery.Speeches, frames) || delivery.Lease != lease || delivery.Context.Err() != nil {
 				t.Fatal("assembly changed semantics or ownership")
 			}