Enable isolated Remote speech and protect reading exports

Attach incoming software speech to reader sessions with lease checks, local output priority and isolated cancellation. Preserve every document fragment source for privacy checks and export reviewed browse current-line reading, spelling and phonetic output.

Verified focused reading and Remote race tests, complete review and external Remote race suites, private relay integration, speech regressions, affected-package vet, reader build and Tentacles make check. Audible speech, physical input/Braille and live interoperability remain unverified.

internal/app/remote_speech_stream_test.go

@@ -35,15 +35,19 @@ type remoteStreamFixture struct {
 	allowed  atomic.Bool
 }
 
-func remote_stream_fixture(t *testing.T, hold bool) *remoteStreamFixture {
+func remote_stream_fixture(t *testing.T, hold bool, admission ...remoteSpeechAdmission) *remoteStreamFixture {
 	t.Helper()
 	ctx, cancel := context.WithCancel(t.Context())
 	f := &remoteStreamFixture{ctx: ctx, cancel: cancel, hold: hold,
 		incoming: make(chan tentacle.RemoteSpeechDelivery, 128), started: make(chan remoteStreamCall, 128), done: make(chan error, 1),
 		lease: tentaclewire.RemoteLease{Lease: strings.Repeat("a", 32), Epoch: 1}}
 	f.allowed.Store(true)
+	var admit remoteSpeechAdmission
+	if len(admission) != 0 {
+		admit = admission[0]
+	}
 	go func() {
-		f.done <- run_remote_speech_stream(ctx, f.incoming, func(tentacle.RemoteSpeechDelivery) bool { return f.allowed.Load() },
+		f.done <- run_remote_speech_stream(ctx, f.incoming, func(tentacle.RemoteSpeechDelivery) bool { return f.allowed.Load() }, admit,
 			func(ctx context.Context, _ tentacle.RemoteSpeechDelivery, utterance remoteSpeechUtterance) error {
 				call := remoteStreamCall{ctx: ctx, utterance: utterance, finish: make(chan error, 1), stopped: make(chan struct{}), cleanup: make(chan struct{})}
 				f.started <- call
@@ -81,7 +85,7 @@ func (f *remoteStreamFixture) send_delivery(t *testing.T, ctx context.Context, l
 	t.Helper()
 	released := make(chan struct{})
 	var calls atomic.Int32
-	f.incoming <- tentacle.RemoteSpeechDelivery{Context: ctx, Lease: lease, Speeches: frames, Release: func() {
+	f.incoming <- tentacle.RemoteSpeechDelivery{Context: ctx, Lease: lease, Received: time.Now(), Speeches: frames, Release: func() {
 		if calls.Add(1) != 1 {
 			t.Error("Remote stream released mailbox budget twice")
 			return
@@ -301,7 +305,7 @@ func TestRemoteSpeechStreamIsolatedBackendCancellation(t *testing.T) {
 	incoming := make(chan tentacle.RemoteSpeechDelivery, 8)
 	done := make(chan error, 1)
 	go func() {
-		done <- run_remote_speech_playback(ctx, speaker, incoming, func(tentacle.RemoteSpeechDelivery) bool { return true })
+		done <- run_remote_speech_playback(ctx, speaker, incoming, func(tentacle.RemoteSpeechDelivery) bool { return true }, nil)
 	}()
 	lease := tentaclewire.RemoteLease{Lease: strings.Repeat("b", 32), Epoch: 1}
 	send := func(effect tentaclewire.RemoteSpeech) <-chan struct{} {
@@ -314,6 +318,9 @@ func TestRemoteSpeechStreamIsolatedBackendCancellation(t *testing.T) {
 	local := server.next_utterance(t)
 	remoteRelease := send(remote_render_frame(0, tentaclewire.RemoteSpeechPart{Text: "remote first"}))
 	remote := server.next_utterance(t)
+	if remote.priority != "TEXT" || local.priority != "MESSAGE" {
+		t.Fatal("incoming speech can compete with local output priority")
+	}
 	if local.id == remote.id {
 		t.Fatal("stream acquired the local speaking client")
 	}
@@ -366,7 +373,7 @@ func TestRemoteSpeechStreamPolicyLossDuringAcquisition(t *testing.T) {
 		Release:  func() { close(released) }}
 	done := make(chan error, 1)
 	go func() {
-		done <- run_remote_speech_playback(t.Context(), speaker, incoming, func(tentacle.RemoteSpeechDelivery) bool { return allowed.Load() })
+		done <- run_remote_speech_playback(t.Context(), speaker, incoming, func(tentacle.RemoteSpeechDelivery) bool { return allowed.Load() }, nil)
 	}()
 	remote_stream_wait(t, held)
 	allowed.Store(false)
@@ -401,7 +408,7 @@ func test_remote_stream_lease_voice(t *testing.T, active bool) {
 	incoming := make(chan tentacle.RemoteSpeechDelivery, 4)
 	done := make(chan error, 1)
 	go func() {
-		done <- run_remote_speech_playback(ctx, speaker, incoming, func(delivery tentacle.RemoteSpeechDelivery) bool { return delivery.Context.Err() == nil })
+		done <- run_remote_speech_playback(ctx, speaker, incoming, func(delivery tentacle.RemoteSpeechDelivery) bool { return delivery.Context.Err() == nil }, nil)
 	}()
 	send := func(lifetime context.Context, epoch uint64, text string) <-chan struct{} {
 		released := make(chan struct{})