host/taint: correct the constant's own doc, and record the ProcessId ambiguity

Verification round on the round-10 review fixes.

Finding 6 named the fixture, taint/tests.rs and snapshot.rs, but the same
stale claim was also on PEERSPEAK_OWNED_VALUE itself — the definition site
for the very literal the finding was about, still arguing that any truthy
value counts and that this is the fail-closed direction. Corrected with the
reason the argument fails.

Also records a known imprecision the union widened: OwnerKey::ProcessId now
covers both application.process.id and the Client's pipewire.sec.pid, so a
bridge reported under the former may have resolved on the latter.
Pre-existing since R10-3; not fixed here because these codes are a stable
contract for the audit output and the phase 6 status event, so splitting one
wants its own decision.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/host/taint/mod.rs

@@ -136,13 +136,19 @@ pub const ECHO_CANCEL_GROUP_PREFIX: &str = "echo-cancel-";
 /// change that invalidates the phase 5 matrix.
 pub const PEERSPEAK_OWNED_PROP: &str = "peerspeak.owned";
 
-/// The value peerspeak emits for [`PEERSPEAK_OWNED_PROP`].
+/// The value peerspeak emits for [`PEERSPEAK_OWNED_PROP`], and the **only**
+/// value this consumer reads as owned.
 ///
-/// The consumer deliberately accepts **any** truthy value, not just this one
-/// (see the observer's `truthy`) — treating an unexpected value as "owned" is
-/// the fail-closed direction. This constant exists so live tests can tag a
-/// node with exactly what the producer sends, rather than something merely
-/// truthy that would pass even if the real literal did not.
+/// ⚠️ This doc used to say the opposite — that any truthy value counted, on
+/// the theory that treating an unexpected value as "owned" is the fail-closed
+/// direction. R10-4 removed that leniency and the round-10 review caught the
+/// prose surviving it here and in the shared fixture. The theory is wrong:
+/// leniency buys false-positive *exclusion*, not safety, and it let any
+/// process suppress a rival application's audio from the share with a
+/// property it did not have to spell right. Fail-closed on this feature is
+/// about **ancestry** — an unresolvable graph is not eligible — not about
+/// parsing. The matching lives in the observer's `peerspeak_owned`, which is
+/// deliberately *not* the lenient `truthy` used for PipeWire's own booleans.
 pub const PEERSPEAK_OWNED_VALUE: &str = "1";
 
 /// Ownership carrier 2: a `node.name` prefix (v3.5 §5.1, round 8).