Code optimization and bug fixes.

tests/README.md

@@ -104,6 +104,8 @@ invalid reader values, and startup refusal when only the unselected service
 exists. Both service names are owned while the selected reader handles requests.
 It also rejects invalid endpoint overrides, missing objects/interfaces,
 missing required methods and incorrect input/output signatures.
+UIA speech and cancellation methods are checked even with the RPC controller
+disabled; missing methods and incompatible input/output signatures must fail startup.
 The menu/editor and review tests also accept `--reader cthulhu`; omit the option
 to check existing default behavior. Review checks reject callers even when they
 own the unselected service, then replace the selected service owner and verify
@@ -308,6 +310,9 @@ input rejected at the text limit. Command-history checks consume queued Up/Down
 before dispatch, then replace the text and move the caret as MUSHclient does.
 They require ordered, single announcements for equal-length and rapid recalls
 and empty input, with no password, background or unrelated programmatic output.
+An unchanged history boundary is followed by a worker-thread text replacement
+before another queued message is removed. That replacement must stay silent,
+and subsequent navigation must read from the updated text snapshot.
 Both 32-bit and 64-bit fixtures use the same assertions. Lifecycle variants
 attach after the control has focus or restart the helper without closing it.
 Every text action must have an established