Share verified native Where Am I speech with Remote

docs/tentacle-remote-speech.md

@@ -129,7 +129,8 @@ updates and Say All position updates without ancestry. Focus/epoch replacement,
 missing or mismatched ancestry, password/unknown/invalid roles and defunct
 sources keep the report local. Foreground synchronization runs before this
 check. Lock and terminal handoff suppress the command. Missing-location status
-stays private. Native focus reports and other unreviewed producers remain private.
+stays private. Native focus reports use the separate fresh-verification path below;
+other unreviewed producers remain private.
 Existing text, role chunks, formula reporting, pronunciation, focus, caret and
 Braille behavior are preserved; the speech worker captures the current lease
 and generation when the explicit command enters its queue.
@@ -156,7 +157,31 @@ application ancestry; the shared classifier rejects password, unknown/invalid
 and defunct sources or ancestors. Spelling, phonetics, pronunciation and blank
 line handling use the existing speech owner and original lease/generation.
 Lock/handoff are rechecked after foreground synchronization and before presenting
-a completed report. Native Where Am I and other unreviewed producers stay private.
+a completed report. Other unreviewed producers stay private.
+
+Native Where Am I now requests a fresh focused snapshot and complete ancestry on
+the review/GLib owners, only while enabled speech has a live output observer.
+Idle/disabled Remote retains the immediate cached local path. Capture does not
+move focus or caret. The existing 64-object/100-millisecond ancestry limits apply;
+individual synchronous provider calls retain their existing timeout. Unsupported
+providers or a full request queue fall back to the original private local report.
+
+The cached local report is preserved. Export additionally requires matching source
+identities and roles, complete known nonprivate ancestry, and exact equality of
+the freshly rendered and cached text, formula and speech chunks. Fresh ancestry
+alone cannot authorize cached text. Missing/truncated ancestry, provider failure,
+password/unknown/invalid/defunct sources and changed reports keep local output
+private. A snapshot replacement (even of the same object), focus/epoch change,
+lock or handoff retires a pending result. Verification stores no reusable native
+classification or lease. The speech worker captures its ordinary lease/generation
+ticket only when the verified report enters its queue. Pronunciation, role chunks,
+local speech, focus, caret and Braille retain their existing presentation paths.
+
+Private GTK checks exercise the new snapshot operation, fresh private ancestor
+roles, password text exclusion, unchanged caret and truncated ancestry. Worker,
+application and actual source-command/private-relay tests cover fresh capture,
+cached/fresh mismatch, stale-result exclusion and resolved output. Physical
+keyboard, audible speech and real NVDA/Orca acceptance remain pending.
 
 Say All exports each resolved chunk immediately before its completion-paced
 backend call. Sentence boundaries, pronunciation and the original request's