More work on tentacles.

docs/testing/remote-input-feasibility.md

@@ -83,7 +83,11 @@ bounded IPC and X-server failure handling, stale-work invalidation, explicit
 error reporting, restart policy and lifecycle tests. Simultaneous helper death
 or a blocked X server is not recovered by this experiment.
 
-Trusted input origin remains a release blocker. The existing reader event
+Trusted input origin remains a release blocker. A subsequent
+[authorization increment](../tentacle-remote-authorization.md) now adds separate
+XI2 capture for sensitive forms, XTEST/device-node filtering and private rejection
+tests. Positive physical-keyboard acceptance and production command integration
+remain pending. The ordinary reader event
 schema contains keycode, transition and timestamp but no source device or
 core-owned injection identity. Do not grant local consent based on an XRecord
 event, `send_event`, or a timing-only match. Investigate device-aware events and