I understand that readers fields supersedes Manager access. Please re-read my post:
... the WebQuerySave agent runs correctly and has access to the document via session.DocumentContext ...
The WQS agent IS ABLE to access the document via session.DocumentContext, even though the agent is signed by a user who is not in the Readers field on the document.
I'm curious why this would work... as you indicated, I would expect that the agent would NOT have access to the document.