docs: record capture sink recovery checkpoint

docs/screenshare-audio-exclusion-impl-plan.md

@@ -12,9 +12,11 @@ pure channel-planning prerequisite are built, validated, and committed locally i
 (`781defc`).** The first bounded Phase 6 mutation slice is now built, validated and committed
 locally in PixelPass (`98cde2c`): the hidden production path creates, retains, revokes and
 crash-cleans exact-channel non-lingering fan-out links. The four versioned Phase 6 status events
-are built, validated and committed locally in PixelPass (`5a65f50`). Sink-replacement recovery,
+are built, validated and committed locally in PixelPass (`5a65f50`). Capture-sink replacement
-plus phases 7–9, are not built — nothing released to date changes the feature's user-visible
+and successful exact-channel relinking are built, validated and committed locally in PixelPass
-behaviour. **Phase 6 remains the current front.**
+(`d09ee9b`). The remaining Phase 6 matrix rows, plus phases 7–9, are not built — nothing
+released to date changes the feature's user-visible behaviour. **Phase 6 remains the current
+front.**
 **Date:** 2026-07-21 (v4); status line refreshed 2026-08-21
 **Design of record:** [`screenshare-audio-exclusion-plan.md`](screenshare-audio-exclusion-plan.md) v3.8, round 11.
 **Scope:** *ordering, gates and acceptance criteria only.*
@@ -698,10 +700,25 @@ ancestry becoming unsafe.
 > is queued only after owned links are dropped. Full PixelPass: 330 passed, 0 failed, 10 ignored;
 > strict all-target Clippy, both serialized Phase 6 live gates and `pixelpass --doctor` pass.
 >
-> This does **not** complete Phase 6. Actual capture-sink replacement/relink recovery and the
+> **Capture-sink replacement slice, committed locally as `d09ee9b`.** The
-> remaining failure-matrix rows are still open. The public mode selector remains Phase 7 and
+> connection owner now recreates an unexpectedly removed non-lingering sink under the stable
-> PeerSpeak parsing/UI integration remains Phase 8. The last committed PixelPass checkpoint is
+> Pulse name but with a fresh exact serial. A narrow identity channel hands that serial to the
-> `5a65f50`.
+> fan-out observer, whose own main-loop command immediately reconciles its coherent snapshot:
+> stale proxies are dropped before new links are created, and the stream returns to `Captured`
+> only after every replacement channel is `ACTIVE`. The observer treats only PipeWire's
+> asynchronous `-ENOENT` for a resource lost during ordinary graph churn as recoverable; every
+> other Core error remains fatal.
+>
+> The pure recovery gate proves both stale links are dropped and two replacement links activate.
+> A live owner-only gate destroys the sink and observes a fresh serial. The real hidden host gate
+> destroys an actively linked sink, observes a new sink serial and two fresh `ACTIVE` links,
+> proves both old link serials are absent, and leaves no residue. All three serialized Phase 6
+> live gates pass together. Full PixelPass: 332 passed, 0 failed, 12 ignored; strict all-target
+> Clippy, formatting, `git diff --check`, and `pixelpass --doctor` pass.
+>
+> This does **not** complete Phase 6. The remaining failure-matrix rows are still open. The public
+> mode selector remains Phase 7 and PeerSpeak parsing/UI integration remains Phase 8. The last
+> committed PixelPass checkpoint is `d09ee9b`.
 
 Failure ⇒ report the stream unsupported. **Never** fall back to the default monitor — and after
 0d that fallback is unconstructible in this mode, by either path.

docs/screenshare-audio-exclusion-plan.md

@@ -7,7 +7,8 @@ and live-churn calibration. The targeted live dry-run partition passed. The firs
 channel-planning prerequisite is committed locally in PixelPass `781defc`; the first bounded
 live fan-out mutation slice is built, validated and committed locally in PixelPass `98cde2c`.
 The four versioned causal status events are built, validated and committed locally in PixelPass
-`5a65f50`.
+`5a65f50`. Capture-sink replacement and successful all-channel relinking are built, validated
+and committed locally in PixelPass `d09ee9b`.
 **Date:** 2026-08-21 (v1: 07-19 · v2: 07-20 · Option C 07-20 · v3.1 r4 · v3.2 r5 · v3.3 r6 ·
 v3.4 r7 · v3.5 r8 · v3.6 r9 · v3.7 r10 · v3.8 r11 2026-08-21)
 **Origin:** Joe's suggestion — "whitelist all audio except audio coming from peerspeak."
@@ -1384,10 +1385,16 @@ non-lingering links through the hidden production path, requires all planned lin
 `ACTIVE`, revokes them when eligibility changes, and passed both normal-teardown and `SIGKILL`
 cleanup gates. Local commit `5a65f50` adds exact version-1 status records for stream link failure,
 AEC validation failure, AEC revocation and foreign AEC detection; PipeWire callbacks enqueue them
-for Tokio-side JSON emission.
+for Tokio-side JSON emission. Local commit `d09ee9b` recreates an unexpectedly removed
+connection-owned sink with a fresh serial, hands that exact identity to the fan-out observer,
+drops stale link proxies, and returns every replacement channel to `ACTIVE`. The pure recovery
+gate, an owner-only live sink-destruction gate, and the full hidden
+host-path sink-destruction/relink gate pass; the full suite reports 332 passed and 12 ignored, all
+three serialized Phase 6 live gates pass together, and strict Clippy plus `pixelpass --doctor`
+remain clean.
 
-1. **Continue Phase 6:** implement actual capture-sink replacement/relink recovery through the
+1. **Continue Phase 6:** complete the remaining failure-matrix rows; sink replacement/relink
-   real host path and complete the remaining failure-matrix rows.
+   recovery now passes through the real host path and is committed locally in `d09ee9b`.
 2. Carry the revised row-9 partition forward: music-only and a different-device microphone
    stay eligible; same-device capture and a tainted-monitor capture are excluded.
 3. Preserve the new live mutation slice's ownership, serial-revalidation, fail-closed,