Export document reading with Remote lease safeguards

docs/tentacle-remote-speech.md

@@ -1,7 +1,7 @@
 # Remote speech transport prerequisite
 
 Typed speech IPC now includes an explicit reader-owned incoming mailbox and
-limited production observation of ordinary accessibility-event speech. The
+limited production observation of accessibility-event and document-reading speech. The
 external coordinator connects this IPC to relay speech. Incoming speech still
 has no production presentation owner and does not make Remote speak. Atomic
 assembly of split incoming utterances precedes owner admission.
@@ -84,17 +84,28 @@ core availability policy lock, so lock/handoff cannot admit new output after
 policy cancellation, including across unlock/return. Already accepted IPC or
 relay writes cannot be recalled.
 
-The zero speech origin is private. Only the main accessibility event presenter
-currently marks requests local. Forms, preferences, connection/status messages,
+The zero speech origin is private. The main accessibility event presenter and
+reviewed document-reading producers mark requests local. Forms, preferences, connection/status messages,
 incoming remote text, command-result Tentacle messages and other unclassified
 sources stay private. The presenter classifies the original source and ancestors
 before context filtering/reset, so a discarded password ancestor still excludes
 its descendant's output. Password roles/ancestors, history exclusion, forced mode
 announcements, confirmations and protected messages are independently denied.
-This does not export every reading path: document/review commands, Say All,
+Document caret movement, document navigation and assembled caret lines inspect
+their original source snapshots and unfiltered ancestors. Every content object
+in an assembled line must have a known role and no password ancestry. Say All
+classifies all spoken lines before admission; a sensitive or unclassified line
+keeps the entire batch private, including sentence-mode continuations. Local
+navigation failures stay private. Derived phonetic hints retain their parent's
+origin and original observation ticket. Flat/object review, current-line commands,
 reading-context announcements, separate key-name echo and notification paths
-still need explicit source and sensitivity review. Derived phonetic hints retain
-their parent's origin and original observation ticket.
+still need explicit source and sensitivity review.
+
+Say All exports each resolved chunk immediately before its completion-paced
+backend call. Sentence boundaries, pronunciation and the original request's
+lease/generation are retained. A lease replacement during reading cannot export
+later chunks to the new helper; local reading continues. Context announcements
+remain private, including labels remembered from an earlier reading context.
 
 Observation runs after speech-mode suppression, line/indentation processing,
 pronunciation, spelling expansion and backend character-path selection. It
@@ -164,7 +175,7 @@ build, the existing speech regression harness and Tentacles `make check`.
 Next: add incoming speech ownership, delivery-time policy, local priority and
 remote-only cancellation. Explicit status detachment is implemented; physical
 input capture/release and ordinary reading while connected still need acceptance.
-Review remaining output producers before assigning exportable origins.
+Review the remaining output producers before assigning exportable origins.
 Atomic IPC assembly is implemented; it does not establish backend
 priority/cancel behavior or audible delivery.
 Pause support or cancel-on-pause behavior and NVDA priority fidelity must be

docs/tentacle-sessions.md

@@ -166,8 +166,9 @@ The process supervisor still enforces cleanup for a child ignoring cancellation.
 
 Typed speech IPC now extends this transport; see
 [the speech contract](tentacle-remote-speech.md). It uses the same ordered event
-queue for exported speech and a separate 64-item incoming mailbox. No production
-output owner is connected. Keyboard/Braille/clipboard effects remain unsupported.
+queue for exported speech and a separate 64-item incoming mailbox. Limited
+production speech observation is connected; incoming presentation ownership is
+still pending. Keyboard/Braille/clipboard effects remain unsupported.
 
 ## Implemented lifecycle operations
 
@@ -203,7 +204,10 @@ positive sequence numbers. Heartbeat should be sent each second and expires afte
 three seconds without refresh. Expiry revokes the lease independently of command
 workers and pipe writes. A late heartbeat cannot revive it. A new local action
 revokes old access and advances the core epoch. Closing an already retired epoch
-is idempotent and cannot revoke a newer one.
+is idempotent and cannot revoke a newer one. An authenticated close also succeeds
+when expiry or policy cancellation has invalidated the current lease but its
+retirement callback has not yet acquired the session lock. It still checks the
+lease token, epoch and operation sequence; it never renews authority.
 
 Core `RemoteContext(lease, grant)` returns a cancellation context only for a live
 matching lease with that grant. Close, expiry, process failure, disable and parent