Export document reading with Remote lease safeguards

internal/tentacle/remote.go

@@ -296,7 +296,14 @@ func (session *Session) remote_call_locked(method string, params json.RawMessage
 		if method == "remote.close" && request.Epoch <= session.remoteEpoch && (access == nil || access.epoch != request.Epoch) {
 			return struct{}{}, nil
 		}
-		if access == nil || access.lease == "" || access.lease != request.Lease || access.epoch != request.Epoch || request.Sequence <= access.sequence || !time.Now().Before(access.deadline) || access.ctx.Err() != nil {
+		if access == nil || access.lease == "" || access.lease != request.Lease || access.epoch != request.Epoch || request.Sequence <= access.sequence {
+			return nil, denied
+		}
+		// Closing only removes authority. Allow authenticated cleanup even
+		// before the expiry/policy callback acquires this lock; rejecting it
+		// would make the child permanently distrust an otherwise healthy IPC
+		// session. Heartbeats must never renew that cancelled authority.
+		if method == "remote.heartbeat" && (!time.Now().Before(access.deadline) || access.ctx.Err() != nil) {
 			return nil, denied
 		}
 		access.sequence = request.Sequence