docs: record owned fanout checkpoint

docs/screenshare-audio-exclusion-impl-plan.md

@@ -9,9 +9,11 @@ sliced S1–S5: S1 and S2 are
 merged; **S3a is merged locally** in pixelpass (`15d1374`); and **S3b is built, validated, and
 committed locally** (`5d3da8b`). **S4, S5, 0d, round 11's bridge changes, and Phase 6's first
 pure channel-planning prerequisite are built, validated, and committed locally in pixelpass
-(`781defc`).** The Phase 6 mutation and phases 7–9 are not built — nothing released to date
-changes the feature's user-visible behaviour. **Phase 6 is now the current front**; its live
-fan-out remains the first audio-exclusion graph mutation.
+(`781defc`).** The first bounded Phase 6 mutation slice is now built, validated and committed
+locally in PixelPass (`98cde2c`): the hidden production path creates, retains, revokes and
+crash-cleans exact-channel non-lingering fan-out links. Phase 6's status events and
+sink-replacement recovery, plus phases 7–9, are not built — nothing released to date changes
+the feature's user-visible behaviour. **Phase 6 remains the current front.**
 **Date:** 2026-07-21 (v4); status line refreshed 2026-08-21
 **Design of record:** [`screenshare-audio-exclusion-plan.md`](screenshare-audio-exclusion-plan.md) v3.8, round 11.
 **Scope:** *ordering, gates and acceptance criteria only.*
@@ -669,15 +671,27 @@ retained for the life of the share, per-port link sets, "captured" only when **e
 link is `ACTIVE`, same-epoch revalidation immediately before each creation, proxy drop on
 ancestry becoming unsafe.
 
-> **Status 2026-08-21 — Phase 6 started, mutation not yet enabled.** The first bounded slice
-> found and closed a prerequisite the old model did not carry: Port snapshots now retain
-> `audio.channel`, and a pure planner produces exact link specs by channel rather than global-id
-> or enumeration order. Five matrix tests pin FL/FR mapping, MONO fan-out, unknown/surround
-> refusal, excluded-candidate refusal, and capture-sink replacement. Full non-GUI PixelPass:
-> 318 passed, 0 failed, 9 ignored; the serialized live observer boundary test and strict Clippy
-> pass. The next slice is the same-observer-callback mutation edge that creates and retains the
-> planned non-lingering proxies; no fan-out link is created by the current checkpoint, committed
-> locally in pixelpass `781defc`.
+> **Status 2026-08-21 — first Phase 6 mutation slice built, validated and committed locally.** The
+> hidden `DesktopExcluding` production path now launches a same-observer-callback link manager.
+> It revalidates every recyclable id against its `object.serial` immediately before mutation,
+> creates exact FL/FR (or MONO fan-out) links through `link-factory`, retains the proxies, marks a
+> stream captured only when every required link is `ACTIVE`, and drops owned links before the
+> capture sink on normal teardown. The links explicitly set `object.linger=false`.
+>
+> Twelve deterministic controller tests cover channel planning, recycled ids, idempotence,
+> partial activation, late arrivals, newly unsafe ancestry, AEC gating/revocation and mutation
+> failure. The full non-GUI suite passes with 326 passed, 0 failed and 10 ignored, and strict
+> all-target Clippy is clean. The real hidden host path was also tested with a late stereo
+> stream: exactly two native links became `ACTIVE`, no Pulse `module-loopback` fed the capture
+> sink, and both links were revoked when the stream ended. A separate subprocess gate sent
+> PixelPass `SIGKILL`; the connection-owned capture sink and both link object serials disappeared
+> without Rust destructors. The three serialized live observer tests and `pixelpass --doctor`
+> pass.
+>
+> This does **not** complete Phase 6. Versioned causal status events and actual capture-sink
+> replacement/relink recovery remain, along with the unclosed failure-matrix rows. The public
+> mode selector remains Phase 7 and PeerSpeak integration remains Phase 8. The last committed
+> PixelPass base is `781defc`; this mutation slice is local commit `98cde2c` and remains unpushed.
 
 Failure ⇒ report the stream unsupported. **Never** fall back to the default monitor — and after
 0d that fallback is unconstructible in this mode, by either path.

docs/screenshare-audio-exclusion-plan.md

@@ -4,8 +4,8 @@
 models an unobservable playback-to-capture route as a conservative same-`device.id` hardware
 edge (§6.9), and the 2 s readiness budget is retained after repeated baseline, inflated-graph,
 and live-churn calibration. The targeted live dry-run partition passed. The first pure Phase 6
-channel-planning prerequisite is committed locally in PixelPass `781defc`; the live fan-out
-remains the first graph mutation.
+channel-planning prerequisite is committed locally in PixelPass `781defc`; the first bounded
+live fan-out mutation slice is built, validated and committed locally in PixelPass `98cde2c`.
 **Date:** 2026-08-21 (v1: 07-19 · v2: 07-20 · Option C 07-20 · v3.1 r4 · v3.2 r5 · v3.3 r6 ·
 v3.4 r7 · v3.5 r8 · v3.6 r9 · v3.7 r10 · v3.8 r11 2026-08-21)
 **Origin:** Joe's suggestion — "whitelist all audio except audio coming from peerspeak."
@@ -1283,7 +1283,8 @@ paths, 13 a real `Audio/Duplex` device) and the third-party samples stay owed.
 **Round-11 supersession (2026-08-21):** the row above is the round-10 snapshot, not current
 status. F11-1 and phases 0b/0c/0d are satisfied, and §6.9 closes the hardware-path decision
 plus readiness calibration. S4/S5/0d, round 11, and Phase 6's first pure channel planner are
-committed locally in PixelPass `781defc`; the first live fan-out mutation remains pending.
+committed locally in PixelPass `781defc`; the first live fan-out mutation is committed locally
+in `98cde2c`.
 
 **Round 9 (2026-07-25).** Phase 3r shipped §6.7 and the audit was re-run
 immediately; it found a *second* measured defect within minutes — a permanent sticky taint
@@ -1375,15 +1376,19 @@ no-coalescing contract.
 Phases 0a–5 and 3r are built; the full phase-5 matrix passed; 0b is merged; and 0c/0d plus
 the S4/S5 ownership work are built, validated, and committed locally. Round 11 closes the last
 two pre-Phase-6 design decisions with pure, observer, live PipeWire and targeted dry-run
-evidence. Phase 6's channel-aware pure planner is also committed in PixelPass `781defc`.
+evidence. Phase 6's channel-aware pure planner is also committed in PixelPass `781defc`. On top
+of that checkpoint, local commit `98cde2c` creates and retains serial-guarded
+non-lingering links through the hidden production path, requires all planned links to be
+`ACTIVE`, revokes them when eligibility changes, and passed both normal-teardown and `SIGKILL`
+cleanup gates.
 
-1. **Continue Phase 6:** implement the owned, non-lingering fan-out link manager and causal
-   status events through the real host path. This is still the first exclusion-related graph
-   mutation.
+1. **Continue Phase 6:** add the four versioned causal status events, complete the remaining
+   failure-matrix rows, and implement actual capture-sink replacement/relink recovery through
+   the real host path.
 2. Carry the revised row-9 partition forward: music-only and a different-device microphone
    stay eligible; same-device capture and a tainted-monitor capture are excluded.
-3. Build the next bounded mutation slice from PixelPass checkpoint `781defc`, preserving its
-   ownership, fail-closed, and exact-channel planning gates.
+3. Preserve the new live mutation slice's ownership, serial-revalidation, fail-closed,
+   exact-channel, all-links-active and crash-cleanup gates while finishing the phase.
 
 Still owed beyond that, unchanged: the §9.2 rig upgrade before any exclusion claim is
 published, and **field-test §12** — nothing in this design has been tested over the real