docs: phase 5 matrix PASSED (13/13) — design round 10, results run 2

The §5.1 dry-run audit gate passes. All 13 rows completed with a non-empty
eligible half in every one, and O5 is re-measured on the fixed graph: worst
recompute 67 µs across every run, 10 µs mean under deliberate churn, busy
fraction 0.0006, readiness 1-2 ms with 18 binds against a 2000 ms budget.

Round 10's finding, and it is the third of exactly the same shape: the
pipewire-pulse PID derivation required a SINGLE repeated pipewire.sec.pid.
WirePlumber repeats one too (two Clients, both sec_pid 1747), so the derivation
returned None permanently on a stock desktop, key 4's suppression never fired,
and every Pulse-emulated node fused into one owner. Row 1's CLEAN control
forwarder and Firefox were both excluded. Fixed in pixelpass 91c4ded by deleting
the heuristic: probe every distinct sec_pid and let /proc/<pid>/comm decide.

Three measured rounds now, all at the observation boundary, none in the
architecture -- and all three were fail-closed and silent, caught only because
§5.1 requires asserting what must remain ELIGIBLE. An exclusion-only checklist
would have passed every one of these builds.

Rows 4-6 are closed through peerspeak's REAL tagging sites (call, mpv, notify,
plus clip) with a hand-launched mpv staying eligible, so the cross-repo contract
is proven end to end on live nodes. Row 10 covers the full sticky lifecycle
including retirement; row 11 is provably non-vacuous (the recycled
node.link-group came back byte-identical and did not inherit taint).

Recorded and NOT claimed as passes: substitutions in rows 8, 9 and 13, and two
reporting-only findings (the audit's sticky flag is uninformative; a bridge's
named key is lost when a leg reappears under a new serial).

Phase 6 remains blocked by F11-1, phases 0b/0c/0d and the Stereo Mix design
call -- this file removes one gate, not all of them.

docs/screenshare-audio-exclusion-impl-plan.md

@@ -458,17 +458,31 @@ observable in Phase 5 before they gate anything real.
 
 ## 5. Phase 5 — dry-run audit mode 🚦 MAJOR GATE
 
-> **🚦 STATUS 2026-07-25: BUILT, RUN, AND THE GATE FAILED.** Results:
-> `docs/screenshare-audio-exclusion-phase5-results.md`. The machinery is correct and needs no
-> rework — **it found the defect on its first live run**, which is the phase working exactly as
-> designed. What failed is the observer beneath it (v3.5 §6.7). **Phase 6 does not start.** The
-> matrix re-runs after phase 3r and phase 1's second carrier land; no row was completable
-> under the defect, so none of it carries over. O5's numbers do not carry over either.
+> **🚦 STATUS 2026-07-26: GATE PASSED on run 2.** Results:
+> `docs/screenshare-audio-exclusion-phase5-results.md`. All 13 rows completed, the eligible
+> half of every row is non-empty, and O5 is re-measured on the fixed graph (worst recompute
+> 67 µs; readiness 1–2 ms with 18 binds). Three rows carry recorded substitutions (8, 9, 13)
+> and three findings are recorded as non-blocking.
 >
-> Read this before re-running: `PIXELPASS_AUDIO_AUDIT_FILE=… PIXELPASS_AUDIO_AUDIT_AEC=off
-> pixelpass --audit-audio`. **Every partition row must run with `AEC=off`** — a
+> **Run 2 found and fixed a third defect of the F2 class, F13-1:** pipewire-pulse's PID was
+> unresolvable on this host *permanently*, because stage 1 of the derivation required exactly
+> one repeated `sec_pid` and **WirePlumber repeats one too** (two Clients, one PID). Key 4's
+> suppression therefore never fired and every Pulse-emulated node fused into one owner. Fixed
+> in pixelpass `91c4ded`: probe every distinct `sec_pid` and let `/proc/<pid>/comm` decide.
+> **The eligible half of row 1 is the only thing that exposed it** — the verdict was
+> fail-closed and silent.
+>
+> ⚠️ **Phase 6 is NOT unblocked by this file alone.** F11-1 is a separate open gate (see §4's
+> owner-union note and `owner_is_bounded`'s doc), as are phases 0b/0c/0d and the "Stereo Mix"
+> design call.
+>
+> Two things to keep when re-running: **every partition row must run with `AEC=off`** (a
 > configured-but-unvalidated AEC shuts the fan-out gate and empties the eligible half of every
-> row, which reads as a failure that is really a harness error.
+> row, which reads as a failure that is really a harness error), and **start the audit BEFORE
+> building the fixture**. Fixture-first makes the whole graph arrive as one enumeration burst,
+> so every node is first tainted while `graph_ready` is false; that partial-graph taint enters
+> sticky state and the keyless sticky reason then wins over the evidence-derived one, so a row
+> cannot assert its own key. Read keys at *derivation* (first non-sticky appearance).
 
 **Adds no capability. Its entire purpose is to be wrong loudly and safely.**