host/taint: match peerspeak's second ownership carrier

The consumer half of phase 1 (plan §5.1, impl plan §3). The engine's
tag root becomes a union: `peerspeak.owned` truthy OR `node.name`
starting with `peerspeak_owned_`. Round 8 added the second carrier
because a node property is invisible to the registry `global` event
and recoverable only by binding the node — which is exactly how the
phase-5 gate failed — while `node.name` is announced directly.

The union lives in `local_root_reason`, not in the adapter. Folding
both into the one `peerspeak_owned` bool at the observation boundary
would make each carrier untestable alone, which is the phase-3r
lesson: a gate asserting a value two sources can satisfy gates
neither. The existing `peerspeak_tagged_nodes_…` fixture now carries
both carriers, so it would keep passing if either were deleted; two
new tests pin them individually, and a third pins that the prefix
matches only at the start of a name.

Both literals are now named constants — they are a cross-repo wire
contract with peerspeak, not local naming — and asserted against
tests/fixtures/ownership-tag-contract.txt, committed byte-identical
in both repos. That test also runs the fixture's own worked example
name through the engine, so the shared file cannot document a value
this side does not actually exclude.

Five mutations verified: drop either carrier, loosen `starts_with` to
`contains`, or rename either constant, and exactly the intended test
fails.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/host/taint/fixture.rs

@@ -152,11 +152,33 @@ impl Graph {
         self.node(name, role, app(client, pid))
     }
 
+    /// A peerspeak-owned node carrying **both** ownership carriers, as a
+    /// live one does. `name` gets the real `node.name` prefix so the fixture
+    /// cannot pass on the property alone.
     pub fn peerspeak_node(&mut self, name: &str, pid: u32) -> NodeRef {
+        let client = self.client_of_app(pid);
+        let name = format!("{}{name}_{pid}", super::PEERSPEAK_OWNED_NODE_PREFIX);
+        self.node(&name, MediaRole::StreamOutput, peerspeak_owned(client, pid))
+    }
+
+    /// Carrier 1 alone: the `peerspeak.owned` property present, the
+    /// `node.name` prefix absent. What the engine sees for a node it had to
+    /// bind to observe (v3.5 §6.7).
+    pub fn peerspeak_node_prop_only(&mut self, name: &str, pid: u32) -> NodeRef {
         let client = self.client_of_app(pid);
         self.node(name, MediaRole::StreamOutput, peerspeak_owned(client, pid))
     }
 
+    /// Carrier 2 alone: the `node.name` prefix present, the property absent
+    /// — indistinguishable from an ordinary app in every other respect.
+    /// This is the case that survives the F1 observation defect, and the
+    /// reason round 8 added a second carrier at all.
+    pub fn peerspeak_node_name_only(&mut self, role: &str, pid: u32) -> NodeRef {
+        let client = self.client_of_app(pid);
+        let name = format!("{}{role}_{pid}", super::PEERSPEAK_OWNED_NODE_PREFIX);
+        self.node(&name, MediaRole::StreamOutput, app(client, pid))
+    }
+
     pub fn node(&mut self, name: &str, role: MediaRole, props: NodeProps) -> NodeRef {
         let id = self.id();
         self.node_with_id(name, role, id, props)

src/host/taint/mod.rs

@@ -123,6 +123,29 @@ pub const CAPTURE_SINK_PREFIX: &str = "pixelpass_capture_";
 /// what `pulse.module.id` is for (v3.4 §5.2 correction 4).
 pub const ECHO_CANCEL_GROUP_PREFIX: &str = "echo-cancel-";
 
+/// Ownership carrier 1: the node property peerspeak sets on everything it
+/// plays (v3.5 §5.1). Read at the observer boundary, which is the only place
+/// that touches raw property names — see [`super::observer`].
+///
+/// ⚠️ **Cross-repo wire contract.** peerspeak emits this; it does not depend
+/// on this crate, nor this crate on it. The values are pinned in
+/// `tests/fixtures/ownership-tag-contract.txt`, committed byte-identical in
+/// both repos, and asserted by [`tests::ownership_carriers_match_the_cross_repo_fixture`].
+/// The producer's matching constants live in peerspeak
+/// `src/audio/ownership.rs`. Changing either is a both-repos-same-session
+/// change that invalidates the phase 5 matrix.
+pub const PEERSPEAK_OWNED_PROP: &str = "peerspeak.owned";
+
+/// Ownership carrier 2: a `node.name` prefix (v3.5 §5.1, round 8).
+///
+/// Matched as a **union** with [`PEERSPEAK_OWNED_PROP`] — either one makes a
+/// node peerspeak-owned. Two carriers because a property is invisible to the
+/// registry `global` event and recoverable only by binding the node (v3.5
+/// §6.7), which is precisely how the phase-5 gate failed; this one is
+/// announced directly. A union is also the fail-closed direction: a missed
+/// tag leaks call audio into the share, a spurious one only over-excludes.
+pub const PEERSPEAK_OWNED_NODE_PREFIX: &str = "peerspeak_owned_";
+
 /// Why a node is tainted or excluded. Stable machine-readable codes: this
 /// value is the phase 5 audit output, the phase 6 status event, and the
 /// eventual answer to "why isn't this app being shared?".
@@ -535,7 +558,17 @@ fn ambiguous_id_nodes(snapshot: &GraphSnapshot) -> BTreeSet<Serial> {
 }
 
 fn local_root_reason(node: &NodeSnapshot, ctx: &ExclusionCtx) -> Option<Reason> {
-    if node.props.peerspeak_owned {
+    // The two ownership carriers, as a union (v3.5 §5.1). Kept here rather
+    // than folded together at the observer boundary so that the union is a
+    // pure, directly-testable rule: an adapter that collapsed both into the
+    // one `peerspeak_owned` bool would make each carrier untestable alone,
+    // which is exactly how phase 3r's row 1 nearly gated nothing.
+    if node.props.peerspeak_owned
+        || node
+            .name
+            .as_deref()
+            .is_some_and(|name| name.starts_with(PEERSPEAK_OWNED_NODE_PREFIX))
+    {
         return Some(Reason::PeerspeakOwned);
     }
     if let (Some(module), Some(aec)) = (node.props.pulse_module_id, ctx.aec_module_id)

src/host/taint/snapshot.rs

@@ -99,6 +99,12 @@ impl MediaRole {
 pub struct NodeProps {
     /// `peerspeak.owned` is present and truthy (v3.4 §5.1). A correctness
     /// mechanism, explicitly *not* a security boundary.
+    ///
+    /// ⚠️ **Ownership carrier 1 of 2, so this being `false` does not mean
+    /// "not peerspeak's".** Carrier 2 is the [`NodeSnapshot::name`] prefix
+    /// [`super::PEERSPEAK_OWNED_NODE_PREFIX`], matched as a union in
+    /// `local_root_reason`. Read that function, not this field, to answer
+    /// "is this node owned?".
     pub peerspeak_owned: bool,
     /// `pulse.module.id`, parsed as `u64` — never `u32`, per v3.4 §5.2's
     /// parse-defensively note and the phase 0a truncation bug.

src/host/taint/tests.rs

@@ -176,6 +176,104 @@ fn peerspeak_tagged_nodes_are_excluded_and_plain_apps_are_not() {
     assert_tainted(&decisions, sink, "tainted-upstream");
 }
 
+/// Each ownership carrier must work **alone** (v3.5 §5.1).
+///
+/// ⚠️ The phase-3r lesson, applied deliberately: a gate that asserts a value
+/// two sources can satisfy gates neither. `peerspeak_tagged_nodes_…` above
+/// uses nodes carrying both carriers, so it would keep passing if either
+/// were deleted. These are the rows that actually pin them.
+#[test]
+fn either_ownership_carrier_alone_taints_the_node() {
+    let mut graph = Graph::new();
+    let sink = graph.device_node("hw-sink", MediaRole::Sink);
+    // Carrier 1: the property, on a node whose name says nothing.
+    let prop_only = graph.peerspeak_node_prop_only("some-playback-stream", 7);
+    // Carrier 2: the name prefix, property absent — the F1 case.
+    let name_only = graph.peerspeak_node_name_only("mpv", 31_284);
+    let firefox = graph.app_node("firefox", MediaRole::StreamOutput, 11_114);
+    for node in [prop_only, name_only, firefox] {
+        graph.link(node, sink);
+    }
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("firefox", firefox)],
+        &[
+            ("prop_only", prop_only, "peerspeak-owned"),
+            ("name_only", name_only, "peerspeak-owned"),
+        ],
+    );
+}
+
+/// The prefix is a **prefix**, not a substring: an unrelated app must not be
+/// excluded because the literal appears somewhere in its name. Over-exclusion
+/// is the safe direction, but it is still wrong, and the phase-5 gate now
+/// asserts exact partitions in both halves.
+#[test]
+fn the_owned_prefix_matches_only_at_the_start_of_node_name() {
+    let mut graph = Graph::new();
+    let sink = graph.device_node("hw-sink", MediaRole::Sink);
+    let impostor = graph.app_node(
+        &format!("recorder-of-{}stuff", super::PEERSPEAK_OWNED_NODE_PREFIX),
+        MediaRole::StreamOutput,
+        11_114,
+    );
+    graph.link(impostor, sink);
+
+    assert_partition(&run(&graph, &ctx()), &[("impostor", impostor)], &[]);
+}
+
+/// The consumer half of the cross-repo contract test (impl plan §3
+/// requirement 2). peerspeak runs the mirror of this against a byte-identical
+/// copy of the same file, and asserts the environment a real child `Command`
+/// would carry produces exactly these literals.
+///
+/// This proves the two repos agree on the *literals*. That pixelpass actually
+/// *listens* is proven by the two carrier tests above, and against the live
+/// graph by the phase 5 dry-run.
+#[test]
+fn ownership_carriers_match_the_cross_repo_fixture() {
+    const FIXTURE: &str = include_str!("../../../tests/fixtures/ownership-tag-contract.txt");
+
+    let pinned: Vec<(&str, &str)> = FIXTURE
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty() && !line.starts_with('#'))
+        .map(|line| line.split_once('=').expect("fixture line is key=value"))
+        .collect();
+    let get = |key: &str| -> &str {
+        pinned
+            .iter()
+            .find(|(k, _)| *k == key)
+            .unwrap_or_else(|| panic!("fixture has no key {key:?}"))
+            .1
+    };
+
+    assert_eq!(super::PEERSPEAK_OWNED_PROP, get("prop_key"));
+    assert_eq!(super::PEERSPEAK_OWNED_NODE_PREFIX, get("node_name_prefix"));
+
+    // The value the producer pins must be one this consumer reads as truthy.
+    // `truthy` lives at the observer boundary; assert the property of it that
+    // matters here rather than reaching across modules for the function.
+    let value = get("prop_value");
+    assert!(
+        value != "false" && value != "0",
+        "pinned prop value {value:?} would read as untruthy"
+    );
+
+    // And the fixture's own worked example must be one this engine excludes,
+    // through carrier 2, exactly as written in the shared file.
+    let mut graph = Graph::new();
+    let sink = graph.device_node("hw-sink", MediaRole::Sink);
+    let example = graph.app_node(get("node_name_example"), MediaRole::StreamOutput, 31_284);
+    graph.link(example, sink);
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[],
+        &[("example", example, "peerspeak-owned")],
+    );
+}
+
 #[test]
 fn aec_identity_is_exact_equality_and_other_modules_stay_eligible() {
     let mut graph = Graph::new();