repair: say "once per (pid, attribution)", because that is what it is now

Codex's non-blocking round-7 nit. The comment and test name still claimed liveness
is asked once per pid, which stopped being true when one pid became two questions.
No behaviour change; the wording was the last thing pointing at the old model.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Cargo.lock

@@ -2958,6 +2958,33 @@ version = "0.2.16"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b6d2cec3eae94f9f509c767b45932f1ada8350c4bdb85af2fcab4a3c14807981"
 
+[[package]]
+name = "libpulse-binding"
+version = "2.30.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "909eb3049e16e373680fe65afe6e2a722ace06b671250cc4849557bc57d6a397"
+dependencies = [
+ "bitflags 2.13.0",
+ "libc",
+ "libpulse-sys",
+ "num-derive",
+ "num-traits",
+ "winapi",
+]
+
+[[package]]
+name = "libpulse-sys"
+version = "1.23.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d74371848b22e989f829cc1621d2ebd74960711557d8b45cfe740f60d0a05e61"
+dependencies = [
+ "libc",
+ "num-derive",
+ "num-traits",
+ "pkg-config",
+ "winapi",
+]
+
 [[package]]
 name = "libredox"
 version = "0.1.18"
@@ -3539,6 +3566,17 @@ version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
+[[package]]
+name = "num-derive"
+version = "0.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ed3955f1a9c7c0c15e092f9c887db08b1fc683305fdf6eb6684f22555355e202"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "num-traits"
 version = "0.2.19"
@@ -4163,6 +4201,7 @@ dependencies = [
  "iroh",
  "iroh-tickets",
  "ksni",
+ "libpulse-binding",
  "nix 0.30.1",
  "notify-rust",
  "pipewire",

Cargo.toml

@@ -46,6 +46,16 @@ serde_json = "1"
 directories = "5"
 ashpd = { version = "0.9", default-features = false, features = ["tokio"] }
 pipewire = "0.9"
+# `--repair` reads and unloads Pulse modules through libpulse introspection rather
+# than by parsing `pactl` output. `pa_module_info` carries index, name and the exact
+# argument in one record, and `pa_context_is_local()` answers whether the server we
+# actually reached is local — neither of which the text listings can do (an argument
+# may contain tabs and newlines that the short format cannot escape, the JSON
+# listing carries no module index at all, and `PULSE_SERVER` is a fallback list, so
+# it never proved locality). Vetted at 2.30.1: MIT/Apache-2.0, no build script
+# beyond a pkg-config probe, no network or subprocess use, and all three historical
+# RustSec advisories (2018-0020, 2018-0021, 2019-0038) fixed by 2.6.0.
+libpulse-binding = "2.30"
 x11rb = { version = "0.13", default-features = false, features = ["allow-unsafe-code"] }
 uuid = { version = "1", features = ["v4"] }
 iroh-tickets = "1.0.0"

src/cli.rs

@@ -105,6 +105,18 @@ pub struct Cli {
     #[arg(long)]
     pub repair: bool,
 
+    /// With `--repair`: also clean up modules that carry no ownership token,
+    /// judging them by process id alone.
+    ///
+    /// Modules loaded by pixelpass versions before ownership tokens existed cannot
+    /// be attributed to a machine, boot or pid namespace, so `--repair` refuses them
+    /// by default: a process id means different processes in different namespaces,
+    /// and acting on the wrong one unloads a *running* host's audio. Use this only
+    /// on the machine that ran the crashed host, and only when the reported
+    /// candidates look right.
+    #[arg(long, requires = "repair")]
+    pub repair_legacy_untagged: bool,
+
     /// Print an environment diagnostic report (display server, capture/encode
     /// dependencies, VA-API H.264 support, viewer player, relay reachability),
     /// then exit. Use this to check a machine can host or view before a real

src/host/audio.rs

@@ -39,6 +39,7 @@ use std::sync::{Arc, Mutex};
 use std::thread::JoinHandle;
 
 use crate::cli::HostOpts;
+use crate::repair::plan::{self as repair_plan, Shape};
 
 /// Owns the pactl-loaded modules plus, when filtering is active, the
 /// libpipewire stream-router thread. Drop unloads modules as a backstop;
@@ -64,9 +65,14 @@ impl Routing {
     /// also spawn the libpipewire thread that reroutes matching streams.
     pub async fn start(opts: &HostOpts) -> Result<Self> {
         let pid = std::process::id();
-        let sink_name = format!("pixelpass_capture_{pid}");
+        let sink_name = repair_plan::sink_name_for(pid);
 
-        let sink_module = load_module(&["module-null-sink", &format!("sink_name={sink_name}")])
+        // Every module this host loads carries an ownership token, minted per
+        // load, so `--repair` can tell whose pid the name refers to instead of
+        // assuming the number means the same thing everywhere. Without it a repair
+        // run in another pid namespace can unload a live host's audio; see
+        // `repair::plan::OwnerToken`.
+        let sink_module = load_module(Shape::LegacyCaptureSink, pid)
             .context("failed to load module-null-sink")?;
 
         // In strict per-app mode we never mirror the default sink: the viewer
@@ -82,13 +88,8 @@ impl Routing {
             None
         } else {
             Some(
-                load_module(&[
+                load_module(Shape::LoopbackIntoCapture, pid)
-                    "module-loopback",
+                    .context("failed to load module-loopback (null-sink cleaned up on Drop)")?,
-                    "source=@DEFAULT_SINK@.monitor",
-                    &format!("sink={sink_name}"),
-                    "latency_msec=20",
-                ])
-                .context("failed to load module-loopback (null-sink cleaned up on Drop)")?,
             )
         };
 
@@ -115,7 +116,6 @@ impl Routing {
             let (router, mut event_rx) = StreamRouter::spawn(app.clone(), sink_name.clone())?;
             let loopback_for_task = Arc::clone(&loopback_arc);
             let local_monitor_for_task = Arc::clone(&local_monitor_arc);
-            let sink_name_for_task = sink_name.clone();
             let strict = opts.strict_audio;
             let event_task = tokio::spawn(async move {
                 use crate::common::output::{self, AppAudioState};
@@ -137,12 +137,7 @@ impl Routing {
                             // only, never the desktop/call — so it can't echo into
                             // the capture.
                             if local_monitor_for_task.lock().unwrap().is_none() {
-                                match load_module(&[
+                                match load_module(Shape::LoopbackOutOfCapture, pid) {
-                                    "module-loopback",
-                                    &format!("source={sink_name_for_task}.monitor"),
-                                    "sink=@DEFAULT_SINK@",
-                                    "latency_msec=20",
-                                ]) {
                                     Ok(id) => {
                                         tracing::info!(
                                             module = id,
@@ -195,12 +190,7 @@ impl Routing {
                             tracing::info!(
                                 "audio routing: last routed stream gone → restoring default-sink loopback"
                             );
-                            match load_module(&[
+                            match load_module(Shape::LoopbackIntoCapture, pid) {
-                                "module-loopback",
-                                "source=@DEFAULT_SINK@.monitor",
-                                &format!("sink={sink_name_for_task}"),
-                                "latency_msec=20",
-                            ]) {
                                 Ok(id) => {
                                     *loopback_for_task.lock().unwrap() = Some(id);
                                 }
@@ -349,10 +339,47 @@ struct SinkInputProperties {
 // pactl module helpers
 // ──────────────────────────────────────────────────────────────────────
 
-fn load_module(args: &[&str]) -> Result<u32> {
+/// Mint an ownership token for one module load.
+///
+/// **Per load, not per session.** The nonce is what makes two loads by the same pid
+/// render different arguments, which is what lets a fingerprint tell a module from
+/// its replacement at the same index. A token minted once and reused for every
+/// reload would be a host-session nonce and would not do that, so the counter is
+/// bumped on every call and mixed with the clock.
+fn owner_token(pid: u32) -> Result<repair_plan::OwnerToken> {
+    use std::sync::atomic::{AtomicU64, Ordering};
+    static LOADS: AtomicU64 = AtomicU64::new(0);
+
+    let local = crate::repair::local_identity()?;
+    // A nonce only has to be unlikely to repeat, not unguessable. The counter makes
+    // two loads within the same clock tick distinct; the clock keeps two runs of the
+    // same process distinct.
+    let counter = LOADS.fetch_add(1, Ordering::Relaxed);
+    let nanos = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map(|d| d.as_nanos() as u64)
+        .unwrap_or(0);
+    Ok(repair_plan::OwnerToken {
+        machine: local.machine,
+        boot: local.boot,
+        pid_ns: local.pid_ns,
+        nonce: nanos ^ (counter << 48) ^ (u64::from(pid) << 32),
+    })
+}
+
+/// Load the Pulse module for one [`Shape`] and return its index.
+///
+/// Both the module name and its arguments come from the shape itself
+/// ([`crate::repair::plan::Shape`]) rather than being written out here, so that
+/// `--repair`'s exact-form matcher and this loader are one source of truth. A
+/// latency or argument change that moved only one of them would leave repair
+/// silently unable to recognise the modules this build loads.
+fn load_module(shape: Shape, pid: u32) -> Result<u32> {
+    let owner = owner_token(pid).context("could not build an audio ownership token")?;
     let output = Command::new("pactl")
         .arg("load-module")
-        .args(args)
+        .arg(shape.module_name())
+        .args(shape.render_args(pid, Some(&owner)))
         .output()
         .context("failed to run pactl load-module")?;
     if !output.status.success() {

src/host/audit/mod.rs

@@ -74,8 +74,9 @@ use serde::Serialize;
 
 use crate::host::aec::{AecConfig, AecState, AecValidator};
 use crate::host::observer::{EventKind, Millis, Projection, Readiness};
+use crate::host::taint::owner::OwnerKey;
 use crate::host::taint::snapshot::Serial;
-use crate::host::taint::{Decisions, Eligibility, ExclusionCtx, StickyState, evaluate};
+use crate::host::taint::{Decisions, Eligibility, ExclusionCtx, Reason, StickyState, evaluate};
 
 /// How long the AEC validator may sit in `Validating` after the graph first
 /// reports ready before failing closed. Generous relative to the observer's own
@@ -181,6 +182,16 @@ pub struct AuditRow {
     pub eligible: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub reason: Option<&'static str>,
+    /// The owner key that carried the taint across, when the reason is
+    /// `tainted-owner-bridge` *and* the tainted member shared a key directly.
+    ///
+    /// §5.1 row 1 asserts "reason = owner bridge, **naming the key**" — the
+    /// point being that the exclusion is provably the owner bridge on a
+    /// specific key rather than an incidental link walk that happens to reach
+    /// the same verdict. [`Reason::code`] collapses the payload, so without
+    /// this field that row cannot be asserted from the record at all.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub owner_key: Option<&'static str>,
     /// The exclusion was carried over from a previous snapshot rather than
     /// derived from the current topology (phase-2 stickiness).
     pub sticky: bool,
@@ -195,9 +206,36 @@ pub struct TaintRow {
     pub serial: u64,
     pub name: Option<String>,
     pub reason: &'static str,
+    /// As [`AuditRow::owner_key`]. Present here too because the bridge that
+    /// matters for a row's diagnosis is often on a non-candidate node.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub owner_key: Option<&'static str>,
     pub sticky: bool,
 }
 
+/// The owner key a `tainted-owner-bridge` reason resolved on, if it named one.
+///
+/// `None` for every other reason, and also for a bridge whose tainted member
+/// shared no key *directly* — the taint reached it transitively, so there is no
+/// single key to name and inventing one would be a false diagnosis.
+fn owner_key_of(reason: Reason) -> Option<&'static str> {
+    match reason {
+        Reason::TaintedOwnerBridge { key } => key.map(OwnerKey::code),
+        _ => None,
+    }
+}
+
+/// A node carrying a peerspeak ownership carrier on a role the engine does not
+/// honour it on (round 10, R10-1). `role` is the point of the row: it says
+/// which non-producer role the tag turned up on, which is what distinguishes a
+/// producer-side bug from an impersonation attempt.
+#[derive(Clone, Debug, PartialEq, Eq, Serialize)]
+pub struct IgnoredTagRow {
+    pub serial: u64,
+    pub name: Option<String>,
+    pub role: &'static str,
+}
+
 /// The decision content of one recompute — everything except which recompute it
 /// was. Split out from [`AuditRecord`] so "did anything actually change?" is a
 /// derived `==` rather than a hand-maintained field comparison that a later
@@ -227,6 +265,16 @@ pub struct AuditBody {
     pub excluded_count: usize,
     /// Taint across all node roles, ascending by serial.
     pub taint: Vec<TaintRow>,
+    /// Nodes carrying a peerspeak ownership carrier that the engine
+    /// **ignored** because they are not `Stream/Output/Audio` (round 10,
+    /// R10-1). Normally empty; a non-empty list means either peerspeak is
+    /// tagging something it should not, or a process is impersonating the
+    /// tag. Neither is an exclusion, and neither should be silent.
+    ///
+    /// Omitted from the JSONL when empty, so it costs nothing on the common
+    /// path and is impossible to miss when it is not.
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    pub ignored_ownership_tags: Vec<IgnoredTagRow>,
 }
 
 impl AuditBody {
@@ -403,11 +451,13 @@ fn build_body(
             // engine would have passed — otherwise a shut gate would erase every
             // reason code in the record and the matrix would stop constraining
             // the engine at all.
-            let (eligible, reason, sticky) = match decision.eligibility {
+            let (eligible, reason, owner_key, sticky) = match decision.eligibility {
-                Eligibility::NotEligible { reason, sticky } => (false, Some(reason.code()), sticky),
+                Eligibility::NotEligible { reason, sticky } => {
+                    (false, Some(reason.code()), owner_key_of(reason), sticky)
+                }
                 Eligibility::Eligible => match gate_reason {
-                    Some(gate) => (false, Some(gate.code()), false),
+                    Some(gate) => (false, Some(gate.code()), None, false),
-                    None => (true, None, false),
+                    None => (true, None, None, false),
                 },
             };
             AuditRow {
@@ -415,6 +465,7 @@ fn build_body(
                 name: decision.name.clone(),
                 eligible,
                 reason,
+                owner_key,
                 sticky,
             }
         })
@@ -429,10 +480,21 @@ fn build_body(
             serial: serial.0,
             name: node_name(projection, serial),
             reason: entry.reason.code(),
+            owner_key: owner_key_of(entry.reason),
             sticky: entry.sticky,
         })
         .collect();
 
+    let ignored_ownership_tags: Vec<IgnoredTagRow> =
+        crate::host::taint::misplaced_ownership_tags(&projection.snapshot)
+            .into_iter()
+            .map(|node| IgnoredTagRow {
+                serial: node.serial.0,
+                name: node.name.clone(),
+                role: node.role.code(),
+            })
+            .collect();
+
     AuditBody {
         graph_ready: projection.graph_ready,
         epoch: readiness_code(projection.readiness),
@@ -444,6 +506,7 @@ fn build_body(
         eligible_count,
         candidates,
         taint,
+        ignored_ownership_tags,
     }
 }
 

src/host/audit/tests.rs

@@ -22,9 +22,17 @@ use super::metrics::{BUCKET_LABELS, Metrics, QUEUE_THRESHOLD_US, Sample};
 use super::*;
 use crate::host::aec::AecConfig;
 use crate::host::observer::{EventKind, Readiness};
+use crate::host::taint::PEERSPEAK_OWNED_NODE_PREFIX;
 use crate::host::taint::fixture::{self, Graph, NodeRef};
 use crate::host::taint::snapshot::{GraphSnapshot, MediaRole};
 
+/// The `node.name` a [`Graph::peerspeak_node`] fixture produces. Built from
+/// the same constant the engine matches on, so these audit rows report the
+/// name shape a live peerspeak node actually has (v3.5 §5.1, carrier 2).
+fn owned_name(role: &str, pid: u32) -> String {
+    format!("{PEERSPEAK_OWNED_NODE_PREFIX}{role}_{pid}")
+}
+
 const AEC_MODULE: u64 = 7;
 const TIMEOUT: Millis = 5_000;
 
@@ -117,6 +125,58 @@ fn the_record_carries_the_complete_candidate_universe() {
     assert_eq!(outcome.record.body.excluded_count, 0);
 }
 
+/// **R10-1's diagnostic reaches the record.** The engine deliberately ignores
+/// an ownership carrier on a non-producer, which means the fix removes an
+/// exclusion — so the only way an operator learns a tag was seen and dropped is
+/// this field. A matrix row that silently grew an impostor would otherwise read
+/// as a clean pass.
+#[test]
+fn an_ignored_ownership_tag_is_reported_without_excluding_anything() {
+    let mut graph = Graph::new();
+    graph.app_node("music", MediaRole::StreamOutput, 100);
+    let impostor = graph.peerspeak_tagged_node("rogue", MediaRole::StreamInput, 4_242);
+    let projection = ready(graph.build());
+
+    let body = observe(&mut auditor_off(), &projection, 0).record.body;
+
+    // The bystander is untouched — the point of the fix.
+    let (eligible, excluded) = partition(&body);
+    assert_eq!(eligible, vec!["music"]);
+    assert!(excluded.is_empty(), "unexpected exclusions: {excluded:?}");
+    assert!(body.taint.is_empty(), "unexpected taint: {:?}", body.taint);
+
+    // ...but the tag is not silent, and the row names the role it appeared on.
+    assert_eq!(body.ignored_ownership_tags.len(), 1);
+    let row = &body.ignored_ownership_tags[0];
+    assert_eq!(row.serial, impostor.serial.0);
+    assert_eq!(row.role, "stream-input");
+    assert_eq!(
+        row.name.as_deref(),
+        Some(owned_name("rogue", 4_242).as_str())
+    );
+}
+
+/// The common path stays quiet: a correctly tagged peerspeak producer is
+/// honoured as a taint root and is *not* reported as a misplaced tag. Without
+/// this, a diagnostic that fired on every normal run would be worthless.
+#[test]
+fn a_correctly_tagged_producer_is_not_reported_as_misplaced() {
+    let mut graph = Graph::new();
+    let sink = graph.device_node("speakers", MediaRole::Sink);
+    let call = graph.peerspeak_node("call", 200);
+    graph.link(call, sink);
+    let projection = ready(graph.build());
+
+    let body = observe(&mut auditor_off(), &projection, 0).record.body;
+
+    assert_eq!(body.excluded_count, 1);
+    assert!(
+        body.ignored_ownership_tags.is_empty(),
+        "honoured tag reported as misplaced: {:?}",
+        body.ignored_ownership_tags
+    );
+}
+
 /// The fail-closed default asserted at the boundary (impl plan §4, phase 2's
 /// "one addition"): nothing in, nothing eligible — and, just as importantly, no
 /// panic and no invented row.
@@ -284,13 +344,14 @@ fn a_shut_gate_preserves_the_engines_own_reasons() {
         .body;
     let (_, excluded) = partition(&body);
 
+    let playback = owned_name("peerspeak-playback", 200);
     assert!(!body.fan_out_permitted);
     assert_eq!(
         excluded,
         vec![
             ("music", "aec-validating"),
             // Tagged, so it keeps the reason that actually applies to it.
-            ("peerspeak-playback", "peerspeak-owned"),
+            (playback.as_str(), "peerspeak-owned"),
         ]
     );
 }
@@ -457,16 +518,64 @@ fn row_1_owner_bridge_forwarder_with_an_untainted_control() {
         .body;
     let (eligible, excluded) = partition(&body);
 
+    let call_name = owned_name("peerspeak-call", 200);
     assert_eq!(eligible, vec!["clean-loopback-playback"]);
     assert_eq!(
         excluded,
         vec![
-            ("peerspeak-call", "peerspeak-owned"),
+            (call_name.as_str(), "peerspeak-owned"),
             ("tainted-loopback-playback", "tainted-owner-bridge"),
         ]
     );
 }
 
+/// §5.1 row 1's other half: the record must **name the key** the bridge
+/// resolved on, not merely say "owner bridge".
+///
+/// Without this the row is unassertable from the record: `Reason::code`
+/// collapses `TaintedOwnerBridge { key }` to one string, so an exclusion that
+/// arrived by an incidental link walk and one that arrived across a named owner
+/// key are indistinguishable — and the row exists precisely to tell them apart.
+/// The fixture's forwarder legs are joined by `pulse.module.id`, so that is the
+/// key that must be reported.
+#[test]
+fn row_1_names_the_owner_key_the_bridge_resolved_on() {
+    let mut graph = Graph::new();
+    let call = graph.peerspeak_node("peerspeak-call", 200);
+    let sink = graph.module_node("tainted-null-sink", MediaRole::Sink, 30);
+    graph.link(call, sink);
+    let capture = graph.module_node("tainted-loopback-capture", MediaRole::StreamInput, 30);
+    let _playback = graph.module_node("tainted-loopback-playback", MediaRole::StreamOutput, 30);
+    graph.link(sink, capture);
+
+    let body = observe(&mut auditor_off(), &ready(graph.build()), 0)
+        .record
+        .body;
+
+    let playback = body
+        .candidates
+        .iter()
+        .find(|row| row.name.as_deref() == Some("tainted-loopback-playback"))
+        .expect("the forwarder's playback leg is a candidate");
+    assert_eq!(playback.reason, Some("tainted-owner-bridge"));
+    assert_eq!(
+        playback.owner_key,
+        Some("pulse.module.id"),
+        "the bridge key must be named in the record, not collapsed into the reason code"
+    );
+
+    // And it stays absent everywhere it would be a false diagnosis: the tag
+    // exclusion is not a bridge at all.
+    let call_name = owned_name("peerspeak-call", 200);
+    let tagged = body
+        .candidates
+        .iter()
+        .find(|row| row.name.as_deref() == Some(call_name.as_str()))
+        .expect("the tagged call playback is a candidate");
+    assert_eq!(tagged.reason, Some("peerspeak-owned"));
+    assert_eq!(tagged.owner_key, None);
+}
+
 /// §5.1 row 3: two Pulse modules, one tainted input. **The other module's output
 /// must be eligible** — this is the row that makes a wrong pipewire-pulse-PID
 /// fusion observable, because fusing all Pulse-created nodes into one owner
@@ -494,11 +603,12 @@ fn row_3_one_tainted_module_does_not_taint_the_other() {
         .body;
     let (eligible, excluded) = partition(&body);
 
+    let call_name = owned_name("peerspeak-call", 200);
     assert_eq!(eligible, vec!["module-b-playback"]);
     assert_eq!(
         excluded,
         vec![
-            ("peerspeak-call", "peerspeak-owned"),
+            (call_name.as_str(), "peerspeak-owned"),
             ("module-a-playback", "tainted-owner-bridge"),
         ]
     );
@@ -701,7 +811,8 @@ fn the_taint_view_covers_non_candidate_roles() {
         tainted.contains(&("null-sink", "tainted-upstream")),
         "the sink is not a candidate but its taint is what explains the row: {tainted:?}"
     );
-    assert!(tainted.contains(&("peerspeak-call", "peerspeak-owned")));
+    let call_name = owned_name("peerspeak-call", 200);
+    assert!(tainted.contains(&(call_name.as_str(), "peerspeak-owned")));
 }
 
 /// A record must serialise to a single line. Newlines inside a JSON Lines

src/host/observer/adapter.rs

@@ -12,10 +12,11 @@ use crate::host::audio::parse_object_serial;
 use crate::host::taint::snapshot::{
     ClientSnapshot, GlobalId, MediaRole, NodeProps, PortDirection, PortSnapshot, Serial,
 };
+use crate::host::taint::{PEERSPEAK_OWNED_PROP, PEERSPEAK_OWNED_VALUE};
 use anyhow::{Context, Result};
 use pipewire::{self as pw, types::ObjectType};
 use std::cell::{Cell, RefCell};
-use std::collections::{BTreeMap, VecDeque};
+use std::collections::{BTreeMap, BTreeSet, VecDeque};
 use std::rc::Rc;
 use std::sync::{Arc, Mutex};
 use std::thread::JoinHandle;
@@ -129,7 +130,9 @@ struct LiveGlobal {
 struct ObserverState {
     model: RegistryModel,
     latest: Arc<Mutex<Option<Projection>>>,
-    last_candidate: Option<u32>,
+    /// The pulse-PID candidate set as of the last probe, so only PIDs entering
+    /// it are read from `/proc`.
+    last_candidates: BTreeSet<u32>,
     live_globals: BTreeMap<GlobalId, VecDeque<LiveGlobal>>,
     sink: Option<Box<dyn ProjectionSink>>,
     started_at: Instant,
@@ -147,7 +150,7 @@ impl ObserverState {
         Self {
             model: RegistryModel::new(0, READINESS_TIMEOUT_MILLIS),
             latest,
-            last_candidate: None,
+            last_candidates: BTreeSet::new(),
             live_globals: BTreeMap::new(),
             sink,
             started_at,
@@ -162,10 +165,17 @@ impl ObserverState {
         let event_outcome = self.model.apply(event);
         let mut outcome = event_outcome;
 
-        let candidate = self.model.pulse_pid_candidate();
+        // Round 10: a *set* of candidates, because repetition across Clients
-        if candidate != self.last_candidate {
+        // turned out not to identify pipewire-pulse (see `pulse_pid`'s module
-            self.last_candidate = candidate;
+        // docs — WirePlumber repeats a PID too, which made the old single
-            if let Some(pid) = candidate {
+        // candidate permanently ambiguous on this host).
+        let candidates = self.model.pulse_pid_candidates();
+        if candidates != self.last_candidates {
+            // Only PIDs *entering* the set are probed. A PID that left and came
+            // back is "entering" again and so is re-probed, which is what keeps
+            // the PID-reuse guard honest rather than answering from a cached
+            // `comm` for a number that now belongs to someone else.
+            for &pid in candidates.difference(&self.last_candidates) {
                 let comm = std::fs::read_to_string(format!("/proc/{pid}/comm"))
                     .ok()
                     .map(|comm| comm.trim_end_matches(['\r', '\n']).to_string());
@@ -177,6 +187,8 @@ impl ObserverState {
                     outcome = Outcome::Applied;
                 }
             }
+            self.model.retain_probed_comms(&candidates);
+            self.last_candidates = candidates;
         }
 
         // v3.5 §6.7 decision 2: a projection the model proved identical is not
@@ -648,16 +660,44 @@ fn parse_serial(id: u32, kind: &str, raw: Option<&str>) -> Option<Serial> {
     }
 }
 
+/// Lenient boolean for PipeWire's own `bool`-ish properties
+/// (`port.exclusive`, `port.monitor`, `node.passthrough`), whose spelling
+/// varies by producer. Leniency is the fail-closed direction *for these*:
+/// each one, when true, causes exclusion.
 fn truthy(value: Option<&str>) -> bool {
     value.is_some_and(|value| value != "false" && value != "0")
 }
 
+/// The ownership carrier is matched **exactly**, not leniently (round 10,
+/// R10-4).
+///
+/// It is tempting to reuse [`truthy`] here on the grounds that treating an
+/// unexpected value as "owned" over-excludes and is therefore safe. That
+/// argument does not hold: leniency buys false-positive *exclusion*, not
+/// safety. Under `truthy`, `peerspeak.owned=""` and `peerspeak.owned=false `
+/// (trailing space) both mean owned, so any process can suppress a rival's
+/// audio from the share with a property it does not even have to spell right.
+///
+/// Fail-closed on this feature is about **ancestry** — an unresolvable graph
+/// is not eligible — not about parsing. The producer emits exactly
+/// [`PEERSPEAK_OWNED_VALUE`] at all three of its sites and is pinned to it by
+/// the shared cross-repo fixture, so there is no real value to be lenient
+/// about. And a missed tag is not silent: carrier 2 is a union with this one,
+/// so a garbled property still leaves the `node.name` prefix.
+fn peerspeak_owned(value: Option<&str>) -> bool {
+    value == Some(PEERSPEAK_OWNED_VALUE)
+}
+
 fn node_observation_from_props(props: &pw::spa::utils::dict::DictRef) -> NodeObservation {
     NodeObservation {
         name: props.get("node.name").map(str::to_string),
         role: MediaRole::parse(props.get("media.class")),
         props: NodeProps {
-            peerspeak_owned: truthy(props.get("peerspeak.owned")),
+            // Carrier 1 only. Carrier 2 (the `node.name` prefix) is matched
+            // in the engine off `NodeObservation::name` above, so each
+            // carrier stays independently testable — see
+            // [`crate::host::taint::PEERSPEAK_OWNED_NODE_PREFIX`].
+            peerspeak_owned: peerspeak_owned(props.get(PEERSPEAK_OWNED_PROP)),
             pulse_module_id: props
                 .get("pulse.module.id")
                 .and_then(|value| value.parse::<u64>().ok()),
@@ -717,6 +757,165 @@ mod tests {
     use super::*;
     use std::process::Command;
 
+    /// **R10-4.** The ownership carrier is matched exactly; the lenient
+    /// [`truthy`] spelling is wrong for it.
+    ///
+    /// Under `truthy`, every value in `denied` below meant "peerspeak owns
+    /// this" — including the empty string and a `false` with a trailing space
+    /// — so any process could suppress a rival application's audio from the
+    /// share with a property it did not have to spell correctly. Leniency here
+    /// buys false-positive exclusion, not safety.
+    #[test]
+    fn the_ownership_carrier_is_matched_exactly_not_leniently() {
+        assert!(peerspeak_owned(Some(PEERSPEAK_OWNED_VALUE)));
+
+        let denied = [
+            None,
+            Some(""),
+            Some("false"),
+            Some("0"),
+            Some("false "),
+            Some("true"),
+            Some("yes"),
+            Some("1 "),
+            Some(" 1"),
+            Some("01"),
+            Some("2"),
+        ];
+        for value in denied {
+            assert!(
+                !peerspeak_owned(value),
+                "{value:?} must not read as peerspeak-owned"
+            );
+        }
+    }
+
+    /// The same property, asserted through the **production wiring** rather
+    /// than the helper.
+    ///
+    /// ⚠️ **This is the gate; the one above is a unit test of a private
+    /// function** (round 10 review, finding 4). Mutating
+    /// [`node_observation_from_props`] back to `truthy(props.get(…))` left the
+    /// helper test green, because it calls [`peerspeak_owned`] directly and
+    /// the only live case it shares with production — exact `"1"` — passes
+    /// under both implementations. That is precisely the "a gate satisfiable
+    /// by two sources gates neither" failure that bit the `main.rs` wiring
+    /// guard and phase 3r row 1.
+    ///
+    /// So: build a real `pw_properties` dictionary, push it through the same
+    /// function the registry callback calls, and assert the resulting
+    /// [`NodeProps::peerspeak_owned`] for every spelling.
+    #[test]
+    fn the_production_wiring_reads_the_ownership_carrier_exactly() {
+        pw::init();
+
+        // (property value, must be read as peerspeak-owned)
+        let spellings = [
+            (Some(PEERSPEAK_OWNED_VALUE), true),
+            (None, false),
+            (Some(""), false),
+            (Some("false"), false),
+            (Some("0"), false),
+            (Some("false "), false),
+            (Some("true"), false),
+            (Some("yes"), false),
+            (Some("1 "), false),
+            (Some(" 1"), false),
+            (Some("01"), false),
+            (Some("2"), false),
+        ];
+
+        for (value, expected) in spellings {
+            let mut props = pw::properties::PropertiesBox::new();
+            // A realistic node, so the rest of the parse runs too: this is the
+            // shape peerspeak's own tagged playback arrives in.
+            props.insert("media.class", "Stream/Output/Audio");
+            props.insert("node.name", "probe");
+            props.insert("client.id", "42");
+            if let Some(value) = value {
+                props.insert(PEERSPEAK_OWNED_PROP, value);
+            }
+
+            let observation = node_observation_from_props(props.dict());
+            assert_eq!(
+                observation.props.peerspeak_owned, expected,
+                "{PEERSPEAK_OWNED_PROP}={value:?} through the real adapter"
+            );
+            // The surrounding parse must still work, or a green result above
+            // could just mean the whole dictionary was dropped.
+            assert_eq!(observation.role, MediaRole::StreamOutput);
+            assert_eq!(observation.name.as_deref(), Some("probe"));
+            assert_eq!(observation.props.client_id, Some(GlobalId(42)));
+        }
+    }
+
+    /// The cross-repo fixture's `prop_value` is the only spelling this
+    /// consumer treats as owned — asserted through the production wiring.
+    ///
+    /// The taint module's `ownership_carriers_match_the_cross_repo_fixture`
+    /// proves the two repos agree on the *literal*. That is not the same as
+    /// proving the shipping observer reads it, which is the half the round-10
+    /// review's finding 6 was about: a future producer following the fixture
+    /// needs the file to describe what the code does, and only a test that
+    /// runs the code can keep those two honest.
+    #[test]
+    fn the_fixture_value_is_the_only_owned_spelling() {
+        const FIXTURE: &str = include_str!("../../../tests/fixtures/ownership-tag-contract.txt");
+        pw::init();
+
+        let pinned = FIXTURE
+            .lines()
+            .map(str::trim)
+            .filter(|line| !line.is_empty() && !line.starts_with('#'))
+            .map(|line| line.split_once('=').expect("fixture line is key=value"));
+        let mut prop_key = None;
+        let mut prop_value = None;
+        for (key, value) in pinned {
+            match key {
+                "prop_key" => prop_key = Some(value),
+                "prop_value" => prop_value = Some(value),
+                _ => {}
+            }
+        }
+        let prop_key = prop_key.expect("fixture defines prop_key");
+        let prop_value = prop_value.expect("fixture defines prop_value");
+
+        let observe = |value: &str| {
+            let mut props = pw::properties::PropertiesBox::new();
+            props.insert("media.class", "Stream/Output/Audio");
+            props.insert(prop_key, value);
+            node_observation_from_props(props.dict())
+                .props
+                .peerspeak_owned
+        };
+
+        assert!(
+            observe(prop_value),
+            "the fixture's own {prop_key}={prop_value} must read as owned"
+        );
+        // The spellings the fixture explicitly says are NOT owned.
+        for denied in ["true", "yes", ""] {
+            assert!(
+                !observe(denied),
+                "{prop_key}={denied:?} must not read as owned; the fixture says so"
+            );
+        }
+    }
+
+    /// The other three boolean properties keep the lenient spelling, and that
+    /// is deliberate rather than an oversight: each is PipeWire's own, each
+    /// varies by producer, and each causes *exclusion* when true — so reading
+    /// an unrecognised value as true is genuinely the safe direction for them.
+    #[test]
+    fn pipewires_own_boolean_props_stay_lenient() {
+        assert!(truthy(Some("true")));
+        assert!(truthy(Some("1")));
+        assert!(truthy(Some("")));
+        assert!(!truthy(Some("false")));
+        assert!(!truthy(Some("0")));
+        assert!(!truthy(None));
+    }
+
     struct PactlModule {
         id: Option<u32>,
     }
@@ -893,7 +1092,15 @@ mod tests {
             "module-null-sink",
             &[
                 format!("sink_name={unique}"),
-                "sink_properties=peerspeak.owned=true node.passthrough=true".to_string(),
+                // The value peerspeak actually emits, not merely a truthy one:
+                // this row is the live proof that carrier 1 survives the bind,
+                // and the sink's name deliberately does *not* carry the
+                // `peerspeak_owned_` prefix, so carrier 2 cannot stand in for
+                // it here.
+                format!(
+                    "sink_properties={PEERSPEAK_OWNED_PROP}={} node.passthrough=true",
+                    crate::host::taint::PEERSPEAK_OWNED_VALUE
+                ),
             ],
         );
         let null_sink_id = null_sink.id.expect("null-sink module must have an id");

src/host/observer/mod.rs

@@ -91,7 +91,7 @@ use crate::host::taint::snapshot::{
     PortSnapshot, Serial,
 };
 use classify::{Classification, DeviceClaim, DeviceProps};
-use std::collections::{BTreeMap, VecDeque};
+use std::collections::{BTreeMap, BTreeSet, VecDeque};
 
 /// A monotonic millisecond clock value, supplied by the adapter via
 /// [`RegEvent::Tick`]. Kept as a bare integer rather than
@@ -399,12 +399,25 @@ impl RegistryModel {
         matches!(self.readiness, Readiness::Complete) && !self.obligations_outstanding()
     }
 
-    /// The pulse-PID candidate the adapter should be probing (`None` = no
+    /// The pulse-PID candidates the adapter should be probing — every distinct
-    /// repeated `sec_pid`, nothing to probe). Exposed so the adapter re-probes
+    /// `sec_pid` on the current Clients. Exposed so the adapter re-probes only
-    /// only when the candidate changes.
+    /// the PIDs *entering* the set rather than all of them on every event.
-    pub fn pulse_pid_candidate(&self) -> Option<u32> {
+    pub fn pulse_pid_candidates(&self) -> BTreeSet<u32> {
         let clients: Vec<ClientSnapshot> = self.clients.values().cloned().collect();
-        pulse_pid::candidate(&clients)
+        pulse_pid::candidates(&clients)
+    }
+
+    /// Forget probed `comm`s for PIDs no Client presents any more.
+    ///
+    /// Cannot change the projection — [`Self::pulse_pid`] only ever reads
+    /// `comm`s for PIDs in the current candidate set — so it is deliberately
+    /// not an [`Outcome`]-returning `apply` arm: it must not publish, and it
+    /// must not count as a graph event for O5. Its purpose is to bound the map
+    /// (one entry per live Client PID) in a host process that runs for hours,
+    /// and to guarantee a PID that leaves and returns is re-probed rather than
+    /// answered from a stale `comm`.
+    pub fn retain_probed_comms(&mut self, live: &BTreeSet<u32>) {
+        self.probed_comm.retain(|pid, _| live.contains(pid));
     }
 
     /// Fold one observation into the model. The returned [`Outcome`] tells the
@@ -701,9 +714,9 @@ impl RegistryModel {
     /// probed `comm`. `None` whenever anything is ambiguous or unconfirmed —
     /// the safe answer (key 4 unusable).
     fn pulse_pid(&self) -> Option<u32> {
-        let candidate = self.pulse_pid_candidate()?;
+        pulse_pid::resolve(&self.pulse_pid_candidates(), |pid| {
-        let comm = self.probed_comm.get(&candidate).and_then(|c| c.as_deref());
+            self.probed_comm.get(&pid).cloned().flatten()
-        pulse_pid::validate(candidate, comm)
+        })
     }
 
     /// Project the current state into the taint engine's inputs.

src/host/observer/pulse_pid.rs

@@ -11,20 +11,49 @@
 //! The derivation is split into two pure stages so the I/O — reading
 //! `/proc/<pid>/comm` — stays in the adapter:
 //!
-//! 1. [`candidate`] finds the PID that *looks* like pulse from the graph
+//! 1. [`candidates`] lists the PIDs worth probing from the graph alone: every
-//!    alone: the `pipewire.sec.pid` value shared across multiple Clients.
+//!    distinct `pipewire.sec.pid` any Client presents.
-//!    Native PipeWire clients carry their own distinct PID; only the
+//! 2. [`resolve`] picks the one whose `comm`, as read from `/proc` by the
-//!    Pulse shim repeats one value, so a repeated value is the signal.
+//!    adapter, is exactly pipewire-pulse's. This is also what closes **PID
-//! 2. [`validate`] confirms that candidate against the `comm` the adapter
+//!    reuse**: a recycled PID is rejected because `/proc/<pid>/comm` now names
-//!    read from `/proc`. This is what closes **PID reuse**: a recycled PID
+//!    a different process.
-//!    that coincidentally repeats in the graph is rejected because
-//!    `/proc/<pid>/comm` now names a different process.
 //!
-//! Any failure at either stage — no repeated value, two repeated values,
+//! Any failure — no Client carries the property, no `comm` matches, `/proc`
-//! the property missing, `/proc` gone, a `comm` mismatch — yields `None`.
+//! gone, or *several* PIDs claim to be pipewire-pulse — yields `None`.
+//!
+//! ## ⚠️ Round 10 (MEASURED): repetition is not the signal
+//!
+//! Stage 1 used to return a single candidate: the one `sec_pid` value shared by
+//! two or more Clients, reasoning that "native PipeWire clients carry their own
+//! distinct PID; only the Pulse shim repeats one value". **That is false on a
+//! stock desktop, and the phase-5 §5.1 matrix caught it on row 1.** Measured on
+//! this host (PipeWire 1.6.8 / WirePlumber 0.5.15): WirePlumber holds *two*
+//! Clients — `WirePlumber` and `WirePlumber [export]` — both carrying
+//! `sec_pid` 1747. So two values repeated (1747 and pipewire-pulse's 2528), the
+//! old rule called that ambiguous and returned `None`, and the consequence was
+//! not a missing optimisation but a machine-wide over-exclusion cascade: with
+//! the daemon PID unknown, key 4's suppression never fires, every
+//! Pulse-emulated node fuses into one owner, and the eligible half of every row
+//! empties out (see `owner::keys_of`'s fail-closed asymmetry note).
+//!
+//! The rule failed in *both* directions, which is why the prefilter is gone
+//! rather than patched:
+//!
+//! - **False ambiguity** — any second process holding two Clients defeats it.
+//!   WirePlumber always does, so this was permanent, not a corner case.
+//! - **False absence** — a session where pipewire-pulse happens to hold exactly
+//!   one Client (one Pulse app running) never repeats a value at all, so the
+//!   candidate is missed and the same cascade follows.
+//!
+//! `comm` was always the authoritative check; repetition was a heuristic
+//! standing in front of it, and it was wrong. Probing every distinct `sec_pid`
+//! costs one `/proc` read per *distinct* PID (single digits — bounded by the
+//! Client count, cached, and re-read only when the candidate set changes),
+//! which is a cheap price for a signal that does not encode an assumption about
+//! how many Clients anyone else opens.
 
 use crate::host::taint::snapshot::ClientSnapshot;
-use std::collections::BTreeMap;
+use std::collections::BTreeSet;
 
 /// The kernel `comm` of the pipewire-pulse process. `comm` is truncated to
 /// 15 bytes by the kernel; `pipewire-pulse` is 14 bytes, so it is exact —
@@ -32,40 +61,19 @@ use std::collections::BTreeMap;
 /// recycled PID belonging to e.g. `pipewire-pulseX`.
 const PULSE_COMM: &str = "pipewire-pulse";
 
-/// Stage 1: the PID that looks like pipewire-pulse from the client graph.
+/// Stage 1: every PID worth probing — the distinct `pipewire.sec.pid` values
+/// the Clients present.
 ///
-/// Returns `Some(pid)` only when **exactly one** `pipewire.sec.pid` value is
+/// No filtering, and deliberately so (see the module docs): any rule applied
-/// shared by two or more clients. Rationale, matched to the failure matrix:
+/// here is a guess about other processes' Client counts, while stage 2 has the
-///
+/// kernel's own answer. A `BTreeSet` because the adapter diffs successive
-/// - **consistent** — one value repeats, the rest (native clients) are
+/// candidate sets to decide what to re-probe, and that diff must not depend on
-///   distinct ⇒ that value.
+/// Client iteration order.
-/// - **inconsistent** — two or more values each repeat ⇒ we cannot tell which
+pub fn candidates(clients: &[ClientSnapshot]) -> BTreeSet<u32> {
-///   is pulse ⇒ `None`.
+    clients.iter().filter_map(|client| client.sec_pid).collect()
-/// - **missing property** — the Pulse clients carry no `sec_pid` ⇒ nothing
-///   repeats ⇒ `None`.
-///
-/// A count threshold of two is deliberate: a single client carrying a PID is
-/// indistinguishable from a lone native app, and pulse always mints many.
-pub fn candidate(clients: &[ClientSnapshot]) -> Option<u32> {
-    let mut counts: BTreeMap<u32, usize> = BTreeMap::new();
-    for client in clients {
-        if let Some(pid) = client.sec_pid {
-            *counts.entry(pid).or_insert(0) += 1;
-        }
-    }
-
-    // Every PID seen on 2+ clients is a pulse candidate. If there is exactly
-    // one such PID we trust it; zero or several ⇒ fail closed.
-    let mut repeated = counts.iter().filter(|&(_, &n)| n >= 2).map(|(&pid, _)| pid);
-    let first = repeated.next()?;
-    if repeated.next().is_some() {
-        // Ambiguous: more than one value repeats.
-        return None;
-    }
-    Some(first)
 }
 
-/// Stage 2: confirm the candidate against the `comm` read from
+/// Stage 2: confirm one candidate against the `comm` read from
 /// `/proc/<candidate>/comm`.
 ///
 /// `comm` is `None` when the adapter's read failed — the `/proc` entry is
@@ -79,11 +87,36 @@ pub fn validate(candidate: u32, comm: Option<&str>) -> Option<u32> {
     }
 }
 
-/// The two stages composed, for callers that already hold the probed `comm`.
+/// Stage 2 across the whole candidate set: the *unique* PID whose `comm` is
-/// The model keeps them separate (it recomputes the candidate as clients
+/// pipewire-pulse's.
-/// churn, and only re-probes when the candidate *changes*), so this is a
+///
-/// convenience for tests and for the fully-resolved path.
+/// `None` when none matches (nothing to suppress that we can prove) and also
-pub fn derive(clients: &[ClientSnapshot], comm_of: impl Fn(u32) -> Option<String>) -> Option<u32> {
+/// when **several** do. Several means either two pipewire-pulse daemons are
-    let candidate = candidate(clients)?;
+/// live — a nested or sandboxed session — or a `comm` collision, and a single
-    validate(candidate, comm_of(candidate).as_deref())
+/// `Option<u32>` cannot suppress two owners. Failing closed here lands on the
+/// over-exclusion side, matching the asymmetry `owner::keys_of` already
+/// documents: broad over-exclusion is annoying, a missed suppression is an
+/// echo. Suppressing a *set* of daemon PIDs is the real answer if a
+/// multi-daemon host ever turns up; it is not v1, and it is recorded rather
+/// than silently approximated.
+pub fn resolve(candidates: &BTreeSet<u32>, comm_of: impl Fn(u32) -> Option<String>) -> Option<u32> {
+    let mut found = None;
+    for &pid in candidates {
+        if validate(pid, comm_of(pid).as_deref()).is_some() {
+            if found.is_some() {
+                return None;
+            }
+            found = Some(pid);
+        }
+    }
+    found
+}
+
+/// Both stages composed, for callers that can probe on demand.
+///
+/// The model keeps them separate — it recomputes the candidate set as Clients
+/// churn and only re-probes PIDs entering it — so this is a convenience for
+/// tests and for the fully-resolved path.
+pub fn derive(clients: &[ClientSnapshot], comm_of: impl Fn(u32) -> Option<String>) -> Option<u32> {
+    resolve(&candidates(clients), comm_of)
 }

src/host/observer/tests.rs

@@ -418,29 +418,107 @@ fn clients_with(pids: &[Option<u32>]) -> Vec<ClientSnapshot> {
         .collect()
 }
 
+/// A `comm` probe of `pipewire-pulse` identifies the daemon regardless of how
+/// many Clients it holds.
 #[test]
-fn pid_candidate_consistent_repeated_value() {
+fn pid_resolves_on_comm_not_on_repetition() {
     let clients = clients_with(&[Some(4137), Some(4137), Some(9001)]);
-    assert_eq!(pulse_pid::candidate(&clients), Some(4137));
+    let pulse = pulse_pid::derive(&clients, |pid| {
+        Some(
+            if pid == 4137 {
+                "pipewire-pulse"
+            } else {
+                "firefox"
+            }
+            .to_string(),
+        )
+    });
+    assert_eq!(pulse, Some(4137));
+}
+
+/// 🔴 **The round-10 regression, measured on this host and caught by the §5.1
+/// row-1 matrix run.** WirePlumber holds two Clients (`WirePlumber` and
+/// `WirePlumber [export]`) sharing one `sec_pid`, so two values repeat. The old
+/// stage 1 called that ambiguous and returned `None`, which switched key 4's
+/// suppression off and fused every Pulse-emulated node into a single owner —
+/// a machine-wide over-exclusion cascade, on a stock desktop, permanently.
+#[test]
+fn a_second_process_holding_two_clients_does_not_defeat_the_derivation() {
+    // 1747 = WirePlumber x2, 2528 = pipewire-pulse x2, plus a native app.
+    let clients = clients_with(&[Some(1747), Some(1747), Some(2528), Some(2528), Some(9001)]);
+    let pulse = pulse_pid::derive(&clients, |pid| {
+        Some(
+            match pid {
+                1747 => "wireplumber",
+                2528 => "pipewire-pulse",
+                _ => "firefox",
+            }
+            .to_string(),
+        )
+    });
+    assert_eq!(
+        pulse,
+        Some(2528),
+        "the WirePlumber pair must not make this ambiguous"
+    );
+}
+
+/// The other direction the old rule failed in: pipewire-pulse holding exactly
+/// one Client (a session with one Pulse app) repeated nothing, so it was never
+/// even a candidate — same cascade, opposite cause.
+#[test]
+fn a_daemon_holding_a_single_client_is_still_found() {
+    let clients = clients_with(&[Some(2528), Some(9001)]);
+    let pulse = pulse_pid::derive(&clients, |pid| {
+        Some(
+            if pid == 2528 {
+                "pipewire-pulse"
+            } else {
+                "kwin_wayland"
+            }
+            .to_string(),
+        )
+    });
+    assert_eq!(pulse, Some(2528));
 }
 
 #[test]
-fn pid_candidate_inconsistent_two_repeats_is_none() {
+fn pid_candidates_are_every_distinct_sec_pid() {
-    let clients = clients_with(&[Some(4137), Some(4137), Some(9001), Some(9001)]);
+    let clients = clients_with(&[Some(4137), Some(4137), Some(9001), None]);
-    assert_eq!(pulse_pid::candidate(&clients), None);
+    assert_eq!(
+        pulse_pid::candidates(&clients),
+        [4137, 9001].into_iter().collect()
+    );
 }
 
 #[test]
-fn pid_candidate_missing_property_is_none() {
+fn pid_missing_property_leaves_nothing_to_probe() {
     let clients = clients_with(&[None, None, None]);
-    assert_eq!(pulse_pid::candidate(&clients), None);
+    assert!(pulse_pid::candidates(&clients).is_empty());
+    assert_eq!(pulse_pid::derive(&clients, |_| None), None);
 }
 
+/// No Client's `comm` is pipewire-pulse's: nothing to suppress that we can
+/// prove, so `None` — and key 4 stays coarse rather than wrong.
 #[test]
-fn pid_candidate_single_occurrence_is_none() {
+fn pid_resolve_no_match_is_none() {
-    // One client per pid: nothing repeats, so nothing is pipewire-pulse.
     let clients = clients_with(&[Some(4137), Some(9001)]);
-    assert_eq!(pulse_pid::candidate(&clients), None);
+    assert_eq!(
+        pulse_pid::derive(&clients, |_| Some("firefox".to_string())),
+        None
+    );
+}
+
+/// Two live pipewire-pulse daemons: a single `Option<u32>` cannot suppress
+/// both, so fail closed to over-exclusion rather than pick one and leak the
+/// other's fusion.
+#[test]
+fn pid_resolve_two_daemons_is_none() {
+    let clients = clients_with(&[Some(4137), Some(9001)]);
+    assert_eq!(
+        pulse_pid::derive(&clients, |_| Some("pipewire-pulse".to_string())),
+        None
+    );
 }
 
 #[test]
@@ -473,9 +551,8 @@ fn pid_validate_reuse_named_other_process_is_none() {
 #[test]
 fn pid_derive_end_to_end_valid() {
     let clients = clients_with(&[Some(4137), Some(4137)]);
-    let candidate = pulse_pid::candidate(&clients).expect("candidate");
     assert_eq!(
-        pulse_pid::validate(candidate, Some("pipewire-pulse")),
+        pulse_pid::derive(&clients, |_| Some("pipewire-pulse".to_string())),
         Some(4137)
     );
 }
@@ -490,7 +567,7 @@ fn model_pulse_pid_valid_through_projection() {
     m.apply(client(1, 200, Some(4137)));
     m.apply(client(2, 201, Some(4137)));
     m.apply(client(3, 202, Some(9001)));
-    assert_eq!(m.pulse_pid_candidate(), Some(4137));
+    assert_eq!(m.pulse_pid_candidates(), [4137, 9001].into_iter().collect());
     m.apply(RegEvent::ProcCommProbed {
         pid: 4137,
         comm: Some("pipewire-pulse".to_string()),
@@ -507,6 +584,40 @@ fn model_pulse_pid_none_until_probed() {
     assert_eq!(m.project().pipewire_pulse_pid, None);
 }
 
+/// Probed `comm`s are dropped once no Client presents the PID any more.
+///
+/// Two reasons, and the second is the load-bearing one: the map is bounded by
+/// the live Client count in a process that runs for hours, **and** a PID that
+/// leaves and returns is re-probed rather than answered from the `comm` of
+/// whoever held that number before. Pruning cannot change the projection —
+/// `pulse_pid` only reads PIDs in the current candidate set — which is why it
+/// is not an `apply` arm and must not publish.
+#[test]
+fn a_departed_pid_does_not_keep_its_probed_comm() {
+    let mut m = model();
+    m.apply(client(1, 200, Some(4137)));
+    m.apply(RegEvent::ProcCommProbed {
+        pid: 4137,
+        comm: Some("pipewire-pulse".to_string()),
+    });
+    assert_eq!(m.project().pipewire_pulse_pid, Some(4137));
+
+    // The daemon's Client goes away; the adapter prunes to the live set.
+    let live = m.pulse_pid_candidates();
+    assert!(live.contains(&4137));
+    m.retain_probed_comms(&std::collections::BTreeSet::new());
+
+    // A *different* process now holds 4137 and opens a Client. Without the
+    // prune this would answer from the stale `comm` and suppress a real app's
+    // owner key.
+    m.apply(client(2, 201, Some(4137)));
+    assert_eq!(
+        m.project().pipewire_pulse_pid,
+        None,
+        "the stale comm must not survive its PID leaving the graph"
+    );
+}
+
 #[test]
 fn model_pulse_pid_none_on_comm_mismatch() {
     let mut m = model();

src/host/taint/fixture.rs

@@ -36,6 +36,10 @@ pub struct Graph {
     /// (GStreamer opens one per stream) pass clients explicitly instead.
     client_by_app: BTreeMap<u32, GlobalId>,
     client_by_module: BTreeMap<u64, GlobalId>,
+    /// Native (non-Pulse-emulated) clients, whose `pipewire.sec.pid` is the
+    /// app's **own** pid rather than pipewire-pulse's. See
+    /// [`Graph::native_client_node`].
+    native_client_by_app: BTreeMap<u32, GlobalId>,
     session_client: Option<GlobalId>,
 }
 
@@ -84,6 +88,35 @@ impl Graph {
         id
     }
 
+    /// A **native PipeWire** client's stream: `client.id` on the node, **no
+    /// `application.process.id`**, and the app's real pid only on the Client
+    /// as `pipewire.sec.pid`.
+    ///
+    /// ⚠️ This is what an ordinary app actually looks like when it does not go
+    /// through pipewire-pulse — measured for mpv on its default ao and for
+    /// peerspeak's own playback stream. [`Graph::app_node`] models the
+    /// Pulse-emulated shape, where the pid is on the node and the Client's
+    /// `sec_pid` is the *daemon's*; both shapes are live on this host, and
+    /// only this one exercises key 4's Client fallback (round 10, R10-3).
+    pub fn native_client_node(&mut self, name: &str, role: MediaRole, pid: u32) -> NodeRef {
+        let client = match self.native_client_by_app.get(&pid) {
+            Some(id) => *id,
+            None => {
+                let id = self.client(Some(pid));
+                self.native_client_by_app.insert(pid, id);
+                id
+            }
+        };
+        self.node(
+            name,
+            role,
+            NodeProps {
+                client_id: Some(client),
+                ..NodeProps::default()
+            },
+        )
+    }
+
     /// An ordinary application stream: its own client, its own PID.
     pub fn app_node(&mut self, name: &str, role: MediaRole, pid: u32) -> NodeRef {
         let client = self.client_of_app(pid);
@@ -152,11 +185,43 @@ impl Graph {
         self.node(name, role, app(client, pid))
     }
 
+    /// A peerspeak-owned node carrying **both** ownership carriers, as a
+    /// live one does. `name` gets the real `node.name` prefix so the fixture
+    /// cannot pass on the property alone.
     pub fn peerspeak_node(&mut self, name: &str, pid: u32) -> NodeRef {
+        let client = self.client_of_app(pid);
+        let name = format!("{}{name}_{pid}", super::PEERSPEAK_OWNED_NODE_PREFIX);
+        self.node(&name, MediaRole::StreamOutput, peerspeak_owned(client, pid))
+    }
+
+    /// Both ownership carriers on a node of **any** role — an impostor, or a
+    /// producer-side tagging bug. Only [`MediaRole::StreamOutput`] makes it a
+    /// taint root (round 10, R10-1); every other role must be ignored, and
+    /// these are the fixtures that prove it.
+    pub fn peerspeak_tagged_node(&mut self, name: &str, role: MediaRole, pid: u32) -> NodeRef {
+        let client = self.client_of_app(pid);
+        let name = format!("{}{name}_{pid}", super::PEERSPEAK_OWNED_NODE_PREFIX);
+        self.node(&name, role, peerspeak_owned(client, pid))
+    }
+
+    /// Carrier 1 alone: the `peerspeak.owned` property present, the
+    /// `node.name` prefix absent. What the engine sees for a node it had to
+    /// bind to observe (v3.5 §6.7).
+    pub fn peerspeak_node_prop_only(&mut self, name: &str, pid: u32) -> NodeRef {
         let client = self.client_of_app(pid);
         self.node(name, MediaRole::StreamOutput, peerspeak_owned(client, pid))
     }
 
+    /// Carrier 2 alone: the `node.name` prefix present, the property absent
+    /// — indistinguishable from an ordinary app in every other respect.
+    /// This is the case that survives the F1 observation defect, and the
+    /// reason round 8 added a second carrier at all.
+    pub fn peerspeak_node_name_only(&mut self, role: &str, pid: u32) -> NodeRef {
+        let client = self.client_of_app(pid);
+        let name = format!("{}{role}_{pid}", super::PEERSPEAK_OWNED_NODE_PREFIX);
+        self.node(&name, MediaRole::StreamOutput, app(client, pid))
+    }
+
     pub fn node(&mut self, name: &str, role: MediaRole, props: NodeProps) -> NodeRef {
         let id = self.id();
         self.node_with_id(name, role, id, props)

src/host/taint/mod.rs

@@ -123,6 +123,44 @@ pub const CAPTURE_SINK_PREFIX: &str = "pixelpass_capture_";
 /// what `pulse.module.id` is for (v3.4 §5.2 correction 4).
 pub const ECHO_CANCEL_GROUP_PREFIX: &str = "echo-cancel-";
 
+/// Ownership carrier 1: the node property peerspeak sets on everything it
+/// plays (v3.5 §5.1). Read at the observer boundary, which is the only place
+/// that touches raw property names — see [`super::observer`].
+///
+/// ⚠️ **Cross-repo wire contract.** peerspeak emits this; it does not depend
+/// on this crate, nor this crate on it. The values are pinned in
+/// `tests/fixtures/ownership-tag-contract.txt`, committed byte-identical in
+/// both repos, and asserted by [`tests::ownership_carriers_match_the_cross_repo_fixture`].
+/// The producer's matching constants live in peerspeak
+/// `src/audio/ownership.rs`. Changing either is a both-repos-same-session
+/// change that invalidates the phase 5 matrix.
+pub const PEERSPEAK_OWNED_PROP: &str = "peerspeak.owned";
+
+/// The value peerspeak emits for [`PEERSPEAK_OWNED_PROP`], and the **only**
+/// value this consumer reads as owned.
+///
+/// ⚠️ This doc used to say the opposite — that any truthy value counted, on
+/// the theory that treating an unexpected value as "owned" is the fail-closed
+/// direction. R10-4 removed that leniency and the round-10 review caught the
+/// prose surviving it here and in the shared fixture. The theory is wrong:
+/// leniency buys false-positive *exclusion*, not safety, and it let any
+/// process suppress a rival application's audio from the share with a
+/// property it did not have to spell right. Fail-closed on this feature is
+/// about **ancestry** — an unresolvable graph is not eligible — not about
+/// parsing. The matching lives in the observer's `peerspeak_owned`, which is
+/// deliberately *not* the lenient `truthy` used for PipeWire's own booleans.
+pub const PEERSPEAK_OWNED_VALUE: &str = "1";
+
+/// Ownership carrier 2: a `node.name` prefix (v3.5 §5.1, round 8).
+///
+/// Matched as a **union** with [`PEERSPEAK_OWNED_PROP`] — either one makes a
+/// node peerspeak-owned. Two carriers because a property is invisible to the
+/// registry `global` event and recoverable only by binding the node (v3.5
+/// §6.7), which is precisely how the phase-5 gate failed; this one is
+/// announced directly. A union is also the fail-closed direction: a missed
+/// tag leaks call audio into the share, a spurious one only over-excludes.
+pub const PEERSPEAK_OWNED_NODE_PREFIX: &str = "peerspeak_owned_";
+
 /// Why a node is tainted or excluded. Stable machine-readable codes: this
 /// value is the phase 5 audit output, the phase 6 status event, and the
 /// eventual answer to "why isn't this app being shared?".
@@ -378,39 +416,36 @@ pub fn evaluate(
     ctx: &ExclusionCtx,
     prior: &StickyState,
 ) -> (Decisions, StickyState) {
-    let components = OwnerComponents::build(snapshot, ctx.pipewire_pulse_pid);
+    // Built once and shared: it carries the Client → `pipewire.sec.pid` index
-    let keys = owner::OwnerKeyIndex::build(snapshot, ctx.pipewire_pulse_pid);
+    // that key 4 falls back to (round 10, R10-3), so the components and the
+    // key index must be derived from the *same* one or they would disagree
+    // about which nodes are bounded.
+    let owner_ctx = owner::OwnerCtx::new(snapshot, ctx.pipewire_pulse_pid);
+    let components = OwnerComponents::build(snapshot, &owner_ctx);
+    let keys = owner::OwnerKeyIndex::build(snapshot, &owner_ctx);
 
-    let mut taint: BTreeMap<Serial, Reason> = BTreeMap::new();
+    // Pass 1 — the fail-closed view. Every decision is made from this one, so
-    let mut sticky_serials: BTreeSet<Serial> = BTreeSet::new();
+    // "we could not see" counts as taint.
-
+    let (taint, sticky_serials) = compute_taint(
-    seed_local_roots(snapshot, ctx, &mut taint);
-    seed_sticky(
         snapshot,
+        ctx,
         &keys,
-        prior,
         &components,
-        &mut taint,
+        prior,
-        &mut sticky_serials,
+        Uncertainty::FailsClosed,
     );
-
-    // Monotone fixpoint: every step only adds taint, or lowers a node's
-    // reason priority, both of which are bounded. Link propagation and the
-    // owner bridge feed each other — a bridged output leg has downstream
-    // links, and a downstream monitor reader bridges to its own siblings —
-    // so neither can be run once.
-    let edges = downstream_edges(snapshot, &mut taint);
-    loop {
-        let mut changed = false;
-        changed |= propagate_links(&edges.edges, &mut taint);
-        changed |= propagate_owner_bridge(&keys, &components, &edges, &mut taint);
-        changed |= propagate_unresolved_owner(snapshot, &keys, &edges, &mut taint);
-        if !changed {
-            break;
-        }
-    }
-
     let decisions = build_decisions(snapshot, ctx, &taint, &sticky_serials);
+
+    // Pass 2 — the evidence-only view, and the only thing sticky state is
+    // ever built from (see [`Uncertainty`]).
+    let (evidence, _) = compute_taint(
+        snapshot,
+        ctx,
+        &keys,
+        &components,
+        prior,
+        Uncertainty::Ignored,
+    );
     // ⚠️ Readiness gates **retirement only**, never addition (Codex rounds
     // 1 and 2, which caught the two halves of this in turn). An object
     // missing from an untrustworthy snapshot has not been observed to
@@ -419,10 +454,105 @@ pub fn evaluate(
     // *observed* during a not-ready epoch is real — a reader can consume
     // and buffer the call and then vanish before readiness — so discarding
     // additions was the same defect pointing the other way.
-    let next_sticky = build_sticky(snapshot, &keys, &components, &taint, prior, ctx.graph_ready);
+    let next_sticky = build_sticky(
+        snapshot,
+        &keys,
+        &components,
+        &evidence,
+        prior,
+        ctx.graph_ready,
+    );
     (decisions, next_sticky)
 }
 
+/// Whether a pass treats "we could not see" as taint.
+///
+/// **Both passes exist because stickiness is a claim about history, and
+/// uncertainty is not history.** A node tainted only because the graph was
+/// mid-enumeration has had nothing observed about it; remembering that as
+/// taint forever is over-exclusion with no evidence behind it, and phase 3r's
+/// bind-everything observer makes the window it happens in systematically
+/// wide (every node is withheld until its bind resolves, so any link observed
+/// across that gap raises [`Reason::UnresolvedAncestry`] on its input side).
+/// Measured on a live desktop: a hardware sink acquired a permanent sticky
+/// taint at every startup, from one link seen while its output node was still
+/// unbound.
+///
+/// Retiring by *reason code* is not enough, because uncertainty launders
+/// itself: an unresolved node propagates [`Reason::TaintedUpstream`] to its
+/// downstream, and that reason is indistinguishable from real contamination
+/// once recorded. So the split is by **provenance** — the sticky pass never
+/// raises an uncertainty root at all, and nothing derived from one can reach
+/// it. Decisions are unaffected: they are made from the fail-closed pass,
+/// which is unchanged.
+#[derive(Clone, Copy, PartialEq, Eq, Debug)]
+enum Uncertainty {
+    /// Unresolved ancestry and an unbounded tainted reader are taint
+    /// (v3.4 §6.1, §6.1.1, §6.1.4).
+    FailsClosed,
+    /// Only positively observed contamination counts.
+    Ignored,
+}
+
+/// One taint fixpoint over the snapshot. The `uncertainty` mode decides
+/// whether absence of evidence is treated as evidence of contamination.
+fn compute_taint(
+    snapshot: &GraphSnapshot,
+    ctx: &ExclusionCtx,
+    keys: &owner::OwnerKeyIndex,
+    components: &OwnerComponents,
+    prior: &StickyState,
+    uncertainty: Uncertainty,
+) -> (BTreeMap<Serial, Reason>, BTreeSet<Serial>) {
+    let fails_closed = uncertainty == Uncertainty::FailsClosed;
+    let mut taint: BTreeMap<Serial, Reason> = BTreeMap::new();
+    let mut sticky_serials: BTreeSet<Serial> = BTreeSet::new();
+
+    seed_local_roots(snapshot, ctx, &mut taint);
+    if fails_closed {
+        for serial in ambiguous_id_nodes(snapshot) {
+            raise(&mut taint, serial, Reason::UnresolvedAncestry);
+        }
+    }
+    seed_sticky(
+        snapshot,
+        keys,
+        prior,
+        components,
+        &mut taint,
+        &mut sticky_serials,
+    );
+
+    // Edges are built identically in both passes — receiver status is a
+    // topological fact and must not depend on the mode, or the owner bridge
+    // would see two different graphs.
+    let mut unresolved_input: BTreeSet<Serial> = BTreeSet::new();
+    let edges = downstream_edges(snapshot, &mut unresolved_input);
+    if fails_closed {
+        for serial in unresolved_input {
+            raise(&mut taint, serial, Reason::UnresolvedAncestry);
+        }
+    }
+
+    // Monotone fixpoint: every step only adds taint, or lowers a node's
+    // reason priority, both of which are bounded. Link propagation and the
+    // owner bridge feed each other — a bridged output leg has downstream
+    // links, and a downstream monitor reader bridges to its own siblings —
+    // so neither can be run once.
+    loop {
+        let mut changed = false;
+        changed |= propagate_links(&edges.edges, &mut taint);
+        changed |= propagate_owner_bridge(keys, components, &edges, &mut taint);
+        if fails_closed {
+            changed |= propagate_unresolved_owner(snapshot, keys, &edges, &mut taint);
+        }
+        if !changed {
+            break;
+        }
+    }
+    (taint, sticky_serials)
+}
+
 /// Roots that are visible on the node itself.
 fn seed_local_roots(
     snapshot: &GraphSnapshot,
@@ -433,16 +563,73 @@ fn seed_local_roots(
         if let Some(reason) = local_root_reason(node, ctx) {
             raise(taint, node.serial, reason);
         }
-        // A node whose own global id is ambiguous cannot be the reliable
-        // endpoint of any link, so its ancestry is unresolvable.
-        if snapshot.node_by_id(node.id) == Some(IdLookup::Ambiguous) {
-            raise(taint, node.serial, Reason::UnresolvedAncestry);
-        }
     }
 }
 
+/// Nodes whose own global id is ambiguous: they cannot be the reliable
+/// endpoint of any link, so their ancestry is unresolvable. Uncertainty, not
+/// evidence — see [`Uncertainty`].
+fn ambiguous_id_nodes(snapshot: &GraphSnapshot) -> BTreeSet<Serial> {
+    snapshot
+        .nodes()
+        .filter(|node| snapshot.node_by_id(node.id) == Some(IdLookup::Ambiguous))
+        .map(|node| node.serial)
+        .collect()
+}
+
+/// Does this node carry either ownership carrier? **Tag presence only** — it
+/// deliberately says nothing about whether the tag is honoured, which is
+/// `local_root_reason`'s business (round 10 restricts that to producers).
+/// Split out so the "is it tagged?" and "does the tag count?" questions can
+/// be tested, and reported, independently.
+pub fn is_peerspeak_tagged(node: &NodeSnapshot) -> bool {
+    node.props.peerspeak_owned
+        || node
+            .name
+            .as_deref()
+            .is_some_and(|name| name.starts_with(PEERSPEAK_OWNED_NODE_PREFIX))
+}
+
+/// Nodes carrying an ownership carrier that `local_root_reason` **ignored**
+/// because the node is not a producer (round 10, R10-1). Ascending by serial.
+///
+/// Purely diagnostic — nothing in the engine consumes it. It exists because
+/// R10-1 turns a formerly load-bearing tag into a no-op, and a silently
+/// ignored tag has exactly two causes, both of which someone wants to know
+/// about: peerspeak tagging a node it should not (a producer-side bug this
+/// would otherwise hide), or another process impersonating the tag (the F2
+/// attack, now defanged but still worth seeing).
+pub fn misplaced_ownership_tags(snapshot: &GraphSnapshot) -> Vec<&NodeSnapshot> {
+    let mut tagged: Vec<&NodeSnapshot> = snapshot
+        .nodes()
+        .filter(|node| node.role != MediaRole::StreamOutput && is_peerspeak_tagged(node))
+        .collect();
+    tagged.sort_by_key(|node| node.serial);
+    tagged
+}
+
 fn local_root_reason(node: &NodeSnapshot, ctx: &ExclusionCtx) -> Option<Reason> {
-    if node.props.peerspeak_owned {
+    // The two ownership carriers, as a union (v3.5 §5.1). Kept here rather
+    // than folded together at the observer boundary so that the union is a
+    // pure, directly-testable rule: an adapter that collapsed both into the
+    // one `peerspeak_owned` bool would make each carrier untestable alone,
+    // which is exactly how phase 3r's row 1 nearly gated nothing.
+    //
+    // ⚠️ **Producer roles only** (round 10, R10-1). Neither carrier is a
+    // security boundary — both are strings any unprivileged process can put
+    // on its own node — so an unrestricted root is a denial of the whole
+    // feature: an unlinked `Stream/Input/Audio` named `peerspeak_owned_x`
+    // is a tainted *reader* with no owner bound to it, which fails every
+    // candidate closed machine-wide (Codex phase-1 F2, reproduced live).
+    // Restricting the root to `Stream/Output/Audio` costs nothing real —
+    // peerspeak only ever tags playback streams — and the attack needs the
+    // impostor to be a plausible playback node instead, which taints only
+    // its own descendants. The AEC's virtual sink/source is unaffected: it
+    // roots on [`Reason::AecIdentity`] below, by module id, not by this tag.
+    // A tag on a non-producer falls through: ignored for taint, but not
+    // nothing — it is either a peerspeak bug or an impostor, and
+    // [`misplaced_ownership_tags`] surfaces it so neither is silent.
+    if is_peerspeak_tagged(node) && node.role == MediaRole::StreamOutput {
         return Some(Reason::PeerspeakOwned);
     }
     if let (Some(module), Some(aec)) = (node.props.pulse_module_id, ctx.aec_module_id)
@@ -563,7 +750,7 @@ fn nodes_of_client(
 /// `output node → input nodes`, resolving snapshot-local ids. An endpoint
 /// that does not resolve taints the *other* end as unresolved ancestry when
 /// that other end is the input side — we cannot know what is feeding it.
-fn downstream_edges(snapshot: &GraphSnapshot, taint: &mut BTreeMap<Serial, Reason>) -> Edges {
+fn downstream_edges(snapshot: &GraphSnapshot, unresolved_input: &mut BTreeSet<Serial>) -> Edges {
     let mut edges: BTreeMap<Serial, Vec<Serial>> = BTreeMap::new();
     let mut receivers: BTreeSet<Serial> = BTreeSet::new();
     for link in snapshot.links() {
@@ -575,8 +762,10 @@ fn downstream_edges(snapshot: &GraphSnapshot, taint: &mut BTreeMap<Serial, Reaso
                 receivers.insert(to);
             }
             (_, Some(IdLookup::Unique(to))) => {
-                // Something feeds this node and we cannot say what.
+                // Something feeds this node and we cannot say what. Reported
-                raise(taint, to, Reason::UnresolvedAncestry);
+                // rather than raised here, because whether "cannot say" is
+                // taint depends on which pass is running ([`Uncertainty`]).
+                unresolved_input.insert(to);
                 receivers.insert(to);
             }
             (_, Some(IdLookup::Ambiguous)) => {
@@ -715,7 +904,10 @@ fn propagate_owner_bridge(
 /// unknown than one we can** (Codex round 3 — the mirror image of the
 /// round-1 case):
 ///
-/// - A *bounded* tainted reader has a strong key or a usable PID, so its
+/// - A *bounded* tainted reader has a strong key, or a usable PID **backed by
+///   a resolved Client** (F11-1 — a node's self-claimed
+///   `application.process.id` no longer bounds anything on its own; see
+///   [`owner::owner_is_bounded`]), so its
 ///   siblings are exactly the output legs sharing that key. Any output leg
 ///   that is *itself* bounded by a **different** key is provably a different
 ///   owner and stays eligible; only unbounded output legs are its possible

src/host/taint/owner.rs

@@ -67,10 +67,87 @@
 //! Grouping is **transitive** (union-find). That is the fail-closed
 //! direction: bigger owner components mean more taint, never less.
 
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
 
 use super::snapshot::{GlobalId, GraphSnapshot, NodeSnapshot, Serial};
 
+/// Everything owner-key derivation needs from outside a single node.
+///
+/// Introduced by round 10 (R10-3). Before it, `keys_of` read only node
+/// properties, and key 4 was therefore available **only** to nodes carrying
+/// `application.process.id` — which native PipeWire clients do not. mpv on its
+/// default ao, and peerspeak's own playback stream, expose nothing but
+/// `client.id`, so both were *unbounded*, and the moment any tainted reader
+/// existed anywhere, `propagate_unresolved_owner` excluded every one of them.
+/// Measured: an untagged mpv went from eligible (alone) to `unresolved-owner`
+/// the instant peerspeak played audio. That is "native-PipeWire apps are never
+/// shareable", which is not a feature.
+///
+/// The missing pid is not missing at all — it is one hop away, on the node's
+/// **Client**, as `pipewire.sec.pid`, and already in the snapshot.
+pub struct OwnerCtx {
+    pub pipewire_pulse_pid: Option<u32>,
+    /// `client.id` → that Client's `pipewire.sec.pid`.
+    ///
+    /// Clients whose global id is **ambiguous** (two live objects claiming it,
+    /// i.e. the observer missed a removal) are deliberately absent: resolving
+    /// an ambiguous id to a pid would attribute a node to whichever Client won
+    /// a coin toss, and inventing an owner key is the one direction that can
+    /// *reduce* taint. Absent ⇒ unbounded ⇒ fails closed, as before.
+    client_pids: BTreeMap<GlobalId, u32>,
+}
+
+impl OwnerCtx {
+    pub fn new(snapshot: &GraphSnapshot, pipewire_pulse_pid: Option<u32>) -> Self {
+        let mut client_pids: BTreeMap<GlobalId, u32> = BTreeMap::new();
+        // ⚠️ Tracked separately from `client_pids`, and that is the point: a
+        // Client with no `sec_pid` still *claims* its id. Detecting duplicates
+        // by looking in the pid map would let a pid-less first claimant leave
+        // no trace, so the next Client claiming the same id would look unique
+        // and its pid would be used — resolving an ambiguous id, which is the
+        // one guess this guard exists to refuse. Pid-less Clients are ordinary
+        // (the session manager's is one).
+        let mut seen: BTreeSet<GlobalId> = BTreeSet::new();
+        for client in snapshot.clients() {
+            if !seen.insert(client.id) {
+                // Two Clients claiming one id: drop it entirely rather than
+                // pick. See the field docs.
+                client_pids.remove(&client.id);
+                continue;
+            }
+            if let Some(pid) = client.sec_pid {
+                client_pids.insert(client.id, pid);
+            }
+        }
+        Self {
+            pipewire_pulse_pid,
+            client_pids,
+        }
+    }
+
+    /// The `pipewire.sec.pid` of this node's Client, if it has one and that
+    /// Client's id is unambiguous.
+    fn client_pid(&self, node: &NodeSnapshot) -> Option<u32> {
+        self.client_pids.get(&node.props.client_id?).copied()
+    }
+
+    /// Does this node have **protected provenance** — an unambiguous Client
+    /// yielding `Some(pipewire.sec.pid)`?
+    ///
+    /// ⚠️ Read **before** the pipewire-pulse suppression in [`keys_of`], and
+    /// that ordering is the whole rule (F11-1, below). A Pulse-emulated app's
+    /// Client resolves to the daemon's PID; the value is then omitted from the
+    /// bridge keys as too coarse to *group* on, but it is still a protected
+    /// `pipewire.*` answer to "who is this", so the app keeps its provenance.
+    ///
+    /// ❌ Not "a unique Client object exists". A unique Client with
+    /// `sec_pid = None` satisfies that and carries no protected identity at
+    /// all, which is exactly the hole [`owner_is_bounded`] closes.
+    fn client_is_resolved(&self, node: &NodeSnapshot) -> bool {
+        self.client_pid(node).is_some()
+    }
+}
+
 /// Which key bridged two legs. Ordered strongest first; the `Ord` derive is
 /// load-bearing for "report the strongest shared key".
 #[derive(Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Debug, Hash)]
@@ -84,6 +161,16 @@ pub enum OwnerKey {
 impl OwnerKey {
     /// Stable, machine-readable — this ends up in the phase 5 audit output
     /// and the phase 6 status event.
+    ///
+    /// ⚠️ **Known imprecision, deliberately not fixed here.** `ProcessId` now
+    /// covers two sources — the node's `application.process.id` and its
+    /// Client's `pipewire.sec.pid` (see [`keys_of`]) — so a bridge reported as
+    /// `application.process.id` may in fact have resolved on the Client's
+    /// protected pid. Pre-existing since R10-3 made the Client a fallback, and
+    /// widened by the review's finding 1 making it a union. Splitting it would
+    /// add a code to a set that is explicitly a stable contract for the audit
+    /// output and the "why isn't this app being shared?" answer, so it wants
+    /// its own decision rather than a drive-by.
     pub fn code(self) -> &'static str {
         match self {
             Self::LinkGroup => "node.link-group",
@@ -106,7 +193,7 @@ enum KeyValue {
 /// A key that is present but unusable (the pipewire-pulse PID; a coarse key
 /// on a device node) is **absent** here — that is the whole mechanism of the
 /// two exceptions.
-fn keys_of(node: &NodeSnapshot, pipewire_pulse_pid: Option<u32>) -> Vec<(OwnerKey, KeyValue)> {
+fn keys_of(node: &NodeSnapshot, ctx: &OwnerCtx) -> Vec<(OwnerKey, KeyValue)> {
     let mut out = Vec::new();
     if let Some(group) = &node.props.link_group {
         out.push((OwnerKey::LinkGroup, KeyValue::Text(group.clone())));
@@ -122,14 +209,48 @@ fn keys_of(node: &NodeSnapshot, pipewire_pulse_pid: Option<u32>) -> Vec<(OwnerKe
     if let Some(client) = node.props.client_id {
         out.push((OwnerKey::ClientId, KeyValue::Num(u64::from(client.0))));
     }
-    if let Some(pid) = node.props.process_id {
+    // Key 4, from the node **and** from its Client (round 10, R10-3; made a
-        // Exception 1. Note the fail-closed asymmetry when the daemon PID is
+    // union rather than a fallback by the round-10 review, finding 1).
-        // unknown (`None`): the exception does *not* fire, key 4 applies to
+    //
-        // everything, and Pulse modules fuse into one owner. That is broad
+    // ⚠️ **A union, not `node.or_else(client)`, and the difference is a leak.**
-        // over-exclusion — annoying and safe — which is the direction v3.4
+    // The node's `application.process.id` is client-controlled and optional;
-        // §6.1.2's failure-mode paragraph asks for.
+    // the Client's `pipewire.sec.pid` is `pipewire.*`, protected, and the only
-        if Some(pid) != pipewire_pulse_pid {
+    // one that can carry a soundness argument (the same reason
-            out.push((OwnerKey::ProcessId, KeyValue::Num(u64::from(pid))));
+    // `propagate_unresolved_owner` sweeps everything for an unbounded reader).
+    // Letting the node's value *replace* the Client's meant one process using
+    // two Clients could escape the bridge entirely: its tainted reader reports
+    // a bogus node pid, its output leg omits the node pid and falls back to
+    // the Client's real one, the two legs are bounded by different values, so
+    // they neither bridge nor trip the unbounded sweep — and the output stays
+    // eligible while re-emitting the call. Carrying both values costs nothing
+    // and closes it: a leg that presents *either* value bridges.
+    //
+    // ⚠️ **Exception 1 applies to each value independently, and that is the
+    // whole risk here.** Measured on this host: 15 unrelated Clients share
+    // `sec_pid` 2528, which is pipewire-pulse's own — every Pulse-emulated app
+    // has one. Suppressing it per value is what keeps the union from fusing
+    // all fifteen into a single owner while still keeping each app's real
+    // per-app pid. For the common Pulse shape (node pid = the app's, Client
+    // `sec_pid` = the daemon's) the union therefore reduces to exactly the
+    // node's pid, as before.
+    //
+    // Note the fail-closed asymmetry when the daemon PID is unknown (`None`):
+    // the exception does *not* fire, key 4 applies to everything, and Pulse
+    // modules fuse into one owner. That is broad over-exclusion — annoying and
+    // safe — which is the direction v3.4 §6.1.2's failure-mode paragraph asks
+    // for.
+    for pid in [node.props.process_id, ctx.client_pid(node)]
+        .into_iter()
+        .flatten()
+    {
+        if Some(pid) == ctx.pipewire_pulse_pid {
+            continue;
+        }
+        let key = (OwnerKey::ProcessId, KeyValue::Num(u64::from(pid)));
+        // The two agree far more often than not; a duplicate entry would be
+        // harmless but would make the audit's key list read oddly.
+        if !out.contains(&key) {
+            out.push(key);
         }
     }
     out
@@ -151,10 +272,120 @@ fn keys_of(node: &NodeSnapshot, pipewire_pulse_pid: Option<u32>) -> Vec<(OwnerKe
 /// nothing else relates them. Its sibling output leg cannot be found, so
 /// the engine must fail closed rather than declare it clean
 /// (v3.4 §6.1.1, final paragraph).
-pub fn owner_is_bounded(node: &NodeSnapshot, pipewire_pulse_pid: Option<u32>) -> bool {
+///
-    keys_of(node, pipewire_pulse_pid)
+/// # F11-1 — CLOSED. A self-claimed PID is not provenance
-        .iter()
+///
-        .any(|(key, _)| *key != OwnerKey::ClientId)
+/// **The rule, implemented below:** a strong key (`node.link-group`,
+/// `pulse.module.id`) bounds an owner on its own; **key 4 bounds an owner only
+/// when the node's Client resolves** — see [`OwnerCtx::client_is_resolved`].
+/// A node whose Client cannot be resolved at all is *unbounded*, whatever
+/// `application.process.id` it puts on itself.
+///
+/// The five Client cases, which is the matrix this needed (two of them are
+/// indistinguishable under the wrong reading of "resolves"):
+///
+/// | Client | node's own pid | bounded? | why |
+/// | --- | --- | --- | --- |
+/// | **absent** | claimed | **no** | nothing corroborates the claim |
+/// | **ambiguous** (two Clients, one id) | claimed | **no** | "we do not know who owns this" must not be papered over |
+/// | **unique but pid-less** | claimed | **no** | a Client object is not an identity; `sec_pid` is |
+/// | **resolved-native** (`sec_pid` = the app's) | absent | **yes** | protected pid, and it *is* key 4 |
+/// | **resolved-to-pipewire-pulse** | claimed | **yes** | protected provenance; the daemon pid is suppressed as a *grouping* key only |
+///
+/// The last row is what keeps this from being the blunt fix. Applying
+/// "self-claims are not sound" without the provenance test unbounds every
+/// Pulse-emulated app — their Client's `sec_pid` is the daemon's and
+/// suppressed, so the node's own claim is their only per-app identity — which
+/// re-triggers the §6.1.1 mass over-exclusion the whole design exists to avoid
+/// and empties the eligible half of the §5.1 matrix.
+///
+/// **Cost, measured on the live graph** (2026-07-26): **zero**. The
+/// before- and after-binaries audited the *same* graph simultaneously — both
+/// are read-only observers, which is the only way to A/B a partition without
+/// churn between runs — with a tagged producer feeding the default sink,
+/// `parec` on its monitor as a real tainted reader (so the sweep was armed,
+/// not merely present in the code), and Firefox, `aplay` and `pacat` as
+/// bystanders. **181 records each, the same 14 distinct decision states, none
+/// exclusive to either side, no `unresolved-owner` on either.** The eligible
+/// half stayed non-empty throughout: native (`aplay`), Pulse-emulated
+/// (`pacat`) and Firefox all eligible. O5 is unmoved: identical p50 (15 µs)
+/// and busy fraction (0.0012), and the after-binary's worst per-record
+/// recompute was *lower* (217 µs vs 243 µs — noise, same debug build, same
+/// concurrent load).
+///
+/// Why it costs nothing here: every real app on this box is either native
+/// (Client `sec_pid` = its own pid) or Pulse-emulated (Client `sec_pid` = the
+/// daemon's), and **both resolve**. Sweeping all 18 live nodes for the
+/// predicate's inputs directly, the only unresolved-Client nodes were
+/// `Dummy-Driver` and `Freewheel-Driver`, which carry no pid key to lose;
+/// session-manager device nodes are unresolved too (their Client is pid-less)
+/// but exception 2 already strips key 4 from them. That is the answer the
+/// deferral was waiting for: the rule bites exactly the anomalous shapes, and
+/// this host has none.
+///
+/// ## The leak it closes (round 11 review, finding 1)
+///
+/// Round 10 made key 4 a union of the node's
+/// `application.process.id` and its Client's `pipewire.sec.pid`, and the claim
+/// that this was "strictly additive" was too strong: the same key list also
+/// feeds *this* predicate, so adding a value can move a node from unbounded to
+/// bounded, and `propagate_unresolved_owner`'s global sweep is triggered by an
+/// **un**bounded tainted reader. Concretely:
+///
+/// 1. A tainted reader's node claims the pipewire-pulse PID while its Client
+///    holds a real protected PID `A`. Under `or_else` the node's value won and
+///    exception 1 suppressed it, leaving the reader unbounded; under the union
+///    it is bounded by `A`.
+/// 2. Its process's output leg uses a second Client whose id is **ambiguous**
+///    (the observer missed a removal), so no protected PID is available — but
+///    the leg claims a bogus `application.process.id` `B`, which bounds it.
+/// 3. Neither the bridge nor the sweep fires, and the output stays eligible
+///    while re-emitting the call.
+///
+/// Step 2 is now unbounded ⇒ the sweep fires ⇒ the leg is excluded. Note it
+/// could not leak *yet* when it was filed — `evaluate()` is reached only by the
+/// dry-run audit, which creates no links — and that is why the fix waited for
+/// the §5.1 measurement instead of guessing at its cost.
+///
+/// ## What this is deliberately NOT
+///
+/// It is not a claim that `application.process.id` is now unused: it still
+/// bridges (a self-claim is fine as *evidence that two legs are related* —
+/// the fail-closed direction), and a resolved-Client node is still bounded by
+/// whichever key-4 value survives suppression. Only *boundedness* — the
+/// permission to say "I can enumerate this owner's other legs, so a
+/// differently-keyed output is provably someone else" — now demands a
+/// `pipewire.*` answer to "who is this".
+///
+/// ⚠️ Bridging must keep using the **full** union, so boundedness is carried
+/// separately from the key set in [`OwnerKeyIndex`] rather than being
+/// re-derived from it.
+pub fn owner_is_bounded(node: &NodeSnapshot, ctx: &OwnerCtx) -> bool {
+    bounded_by(&keys_of(node, ctx), node, ctx)
+}
+
+/// [`owner_is_bounded`]'s rule, over an already-computed key list.
+///
+/// The single implementation: [`OwnerKeyIndex::build`] has the keys in hand and
+/// must not recompute them, and two copies of a predicate this load-bearing is
+/// how the two spellings drift apart.
+fn bounded_by(keys: &[(OwnerKey, KeyValue)], node: &NodeSnapshot, ctx: &OwnerCtx) -> bool {
+    let mut has_process_key = false;
+    for (key, _) in keys {
+        match key {
+            // Strong keys are per-instance and name the sibling set directly.
+            OwnerKey::LinkGroup | OwnerKey::PulseModuleId => return true,
+            OwnerKey::ProcessId => has_process_key = true,
+            // Never: one process can present two `client.id`s (the measured
+            // GStreamer refutation, above).
+            OwnerKey::ClientId => {}
+        }
+    }
+    // F11-1. The key may be the node's own claim, the Client's protected pid,
+    // or both — `keys_of` does not record which, and it does not need to: a
+    // resolved Client is provenance for the node *whatever* value key 4 ends
+    // up carrying, and without one there is no protected identity to stand on.
+    has_process_key && ctx.client_is_resolved(node)
 }
 
 /// Owner keys computed once per snapshot.
@@ -165,16 +396,27 @@ pub fn owner_is_bounded(node: &NodeSnapshot, pipewire_pulse_pid: Option<u32>) ->
 #[derive(Debug, Default)]
 pub struct OwnerKeyIndex {
     keys: BTreeMap<Serial, Vec<(OwnerKey, KeyValue)>>,
+    /// Nodes whose owner is positively bounded — see [`owner_is_bounded`].
+    ///
+    /// ⚠️ **Stored, not derived from `keys`.** Since F11-1 the predicate needs
+    /// the node's Client as well as its key list, and the two answers are
+    /// deliberately different: the full union still bridges, while a
+    /// self-claimed pid no longer bounds.
+    bounded: BTreeSet<Serial>,
 }
 
 impl OwnerKeyIndex {
-    pub fn build(snapshot: &GraphSnapshot, pipewire_pulse_pid: Option<u32>) -> Self {
+    pub fn build(snapshot: &GraphSnapshot, ctx: &OwnerCtx) -> Self {
-        Self {
+        let mut keys = BTreeMap::new();
-            keys: snapshot
+        let mut bounded = BTreeSet::new();
-                .nodes()
+        for node in snapshot.nodes() {
-                .map(|node| (node.serial, keys_of(node, pipewire_pulse_pid)))
+            let node_keys = keys_of(node, ctx);
-                .collect(),
+            if bounded_by(&node_keys, node, ctx) {
+                bounded.insert(node.serial);
+            }
+            keys.insert(node.serial, node_keys);
         }
+        Self { keys, bounded }
     }
 
     /// The strongest key these two nodes share directly, if any.
@@ -238,11 +480,10 @@ impl OwnerKeyIndex {
         })
     }
 
-    /// See [`owner_is_bounded`].
+    /// See [`owner_is_bounded`]. A node outside this snapshot is unbounded,
+    /// which is the fail-closed answer.
     pub fn is_bounded(&self, serial: Serial) -> bool {
-        self.keys
+        self.bounded.contains(&serial)
-            .get(&serial)
-            .is_some_and(|keys| keys.iter().any(|(key, _)| *key != OwnerKey::ClientId))
     }
 }
 
@@ -252,10 +493,10 @@ impl OwnerKeyIndex {
 pub fn strongest_shared_key(
     a: &NodeSnapshot,
     b: &NodeSnapshot,
-    pipewire_pulse_pid: Option<u32>,
+    ctx: &OwnerCtx,
 ) -> Option<OwnerKey> {
-    let a_keys = keys_of(a, pipewire_pulse_pid);
+    let a_keys = keys_of(a, ctx);
-    let b_keys = keys_of(b, pipewire_pulse_pid);
+    let b_keys = keys_of(b, ctx);
     // `keys_of` yields strongest-first, so the first match is the strongest.
     a_keys.iter().find_map(|(key, value)| {
         b_keys
@@ -279,7 +520,7 @@ pub struct OwnerComponents {
 }
 
 impl OwnerComponents {
-    pub fn build(snapshot: &GraphSnapshot, pipewire_pulse_pid: Option<u32>) -> Self {
+    pub fn build(snapshot: &GraphSnapshot, ctx: &OwnerCtx) -> Self {
         let serials: Vec<Serial> = snapshot.nodes().map(|n| n.serial).collect();
         let index: BTreeMap<Serial, usize> =
             serials.iter().enumerate().map(|(i, s)| (*s, i)).collect();
@@ -290,7 +531,7 @@ impl OwnerComponents {
         let mut buckets: BTreeMap<(OwnerKey, KeyValue), Vec<usize>> = BTreeMap::new();
         for node in snapshot.nodes() {
             let slot = index[&node.serial];
-            for (key, value) in keys_of(node, pipewire_pulse_pid) {
+            for (key, value) in keys_of(node, ctx) {
                 buckets.entry((key, value)).or_default().push(slot);
             }
         }

src/host/taint/snapshot.rs

@@ -87,6 +87,20 @@ impl MediaRole {
     pub fn is_candidate(self) -> bool {
         matches!(self, Self::StreamOutput)
     }
+
+    /// Stable machine-readable code for the audit output. Not the raw
+    /// `media.class`: `Other` has no single one, and the audit's codes are a
+    /// contract with the matrix, not with PipeWire.
+    pub fn code(self) -> &'static str {
+        match self {
+            Self::StreamOutput => "stream-output",
+            Self::StreamInput => "stream-input",
+            Self::Sink => "sink",
+            Self::Source => "source",
+            Self::Duplex => "duplex",
+            Self::Other => "other",
+        }
+    }
 }
 
 /// The subset of node properties the engine actually reasons about.
@@ -97,8 +111,17 @@ impl MediaRole {
 /// on this feature means "not tainted".
 #[derive(Clone, Debug, Default, PartialEq, Eq)]
 pub struct NodeProps {
-    /// `peerspeak.owned` is present and truthy (v3.4 §5.1). A correctness
+    /// `peerspeak.owned` is present and **exactly**
-    /// mechanism, explicitly *not* a security boundary.
+    /// [`super::PEERSPEAK_OWNED_VALUE`] (v3.4 §5.1, tightened by round 10's
+    /// R10-4 — it is not "present and truthy", and the round-10 review found
+    /// this doc still saying so). A correctness mechanism, explicitly *not* a
+    /// security boundary.
+    ///
+    /// ⚠️ **Ownership carrier 1 of 2, so this being `false` does not mean
+    /// "not peerspeak's".** Carrier 2 is the [`NodeSnapshot::name`] prefix
+    /// [`super::PEERSPEAK_OWNED_NODE_PREFIX`], matched as a union in
+    /// `local_root_reason`. Read that function, not this field, to answer
+    /// "is this node owned?".
     pub peerspeak_owned: bool,
     /// `pulse.module.id`, parsed as `u64` — never `u32`, per v3.4 §5.2's
     /// parse-defensively note and the phase 0a truncation bug.

src/host/taint/tests.rs

@@ -15,7 +15,7 @@
 use std::collections::BTreeSet;
 
 use super::fixture::{Graph, NodeRef, PULSE_PID, app};
-use super::owner::{OwnerKey, strongest_shared_key};
+use super::owner::{OwnerCtx, OwnerKey, strongest_shared_key};
 use super::snapshot::{MediaRole, NodeProps, PortDirection, Serial};
 use super::{Decisions, Eligibility, ExclusionCtx, ObjectRef, Reason, StickyState, evaluate};
 
@@ -176,6 +176,217 @@ fn peerspeak_tagged_nodes_are_excluded_and_plain_apps_are_not() {
     assert_tainted(&decisions, sink, "tainted-upstream");
 }
 
+/// Each ownership carrier must work **alone** (v3.5 §5.1).
+///
+/// ⚠️ The phase-3r lesson, applied deliberately: a gate that asserts a value
+/// two sources can satisfy gates neither. `peerspeak_tagged_nodes_…` above
+/// uses nodes carrying both carriers, so it would keep passing if either
+/// were deleted. These are the rows that actually pin them.
+#[test]
+fn either_ownership_carrier_alone_taints_the_node() {
+    let mut graph = Graph::new();
+    let sink = graph.device_node("hw-sink", MediaRole::Sink);
+    // Carrier 1: the property, on a node whose name says nothing.
+    let prop_only = graph.peerspeak_node_prop_only("some-playback-stream", 7);
+    // Carrier 2: the name prefix, property absent — the F1 case.
+    let name_only = graph.peerspeak_node_name_only("mpv", 31_284);
+    let firefox = graph.app_node("firefox", MediaRole::StreamOutput, 11_114);
+    for node in [prop_only, name_only, firefox] {
+        graph.link(node, sink);
+    }
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("firefox", firefox)],
+        &[
+            ("prop_only", prop_only, "peerspeak-owned"),
+            ("name_only", name_only, "peerspeak-owned"),
+        ],
+    );
+}
+
+/// **R10-1, the F2 fix.** Neither carrier is a security boundary — both are
+/// strings any unprivileged process can set on its own node — so the tag is
+/// honoured only on `Stream/Output/Audio`, the one role peerspeak ever tags.
+///
+/// Without the restriction, a tagged `Stream/Input/Audio` **with no links at
+/// all** is a tainted *reader* (`receivers` includes nodes by role, no link
+/// required), and an unbounded one, so `propagate_unresolved_owner` fails
+/// every candidate on the machine closed. That is a whole-feature denial from
+/// an unprivileged process, reproduced live during the phase-1 review.
+#[test]
+fn an_ownership_tag_on_a_non_producer_is_not_a_taint_root() {
+    for role in [
+        MediaRole::StreamInput,
+        MediaRole::Sink,
+        MediaRole::Source,
+        MediaRole::Duplex,
+        MediaRole::Other,
+    ] {
+        let mut graph = Graph::new();
+        let sink = graph.device_node("hw-sink", MediaRole::Sink);
+        let firefox = graph.app_node("firefox", MediaRole::StreamOutput, 11_114);
+        graph.link(firefox, sink);
+        // Deliberately unlinked: the F2 shape needs no edges whatsoever.
+        let impostor = graph.peerspeak_tagged_node("rogue", role, 4_242);
+
+        let decisions = run(&graph, &ctx());
+        assert_untainted(&decisions, impostor);
+        assert!(
+            decisions.taint.is_empty(),
+            "{role:?} impostor tainted something: {:?}",
+            decisions.taint.keys().collect::<Vec<_>>()
+        );
+        // The whole point: the eligible half stays non-empty.
+        assert_partition(&decisions, &[("firefox", firefox)], &[]);
+    }
+}
+
+/// **The live F2 reproduction, verbatim.** The measured impostor was an
+/// *unbounded* reader — `client.id` present, `application.process.id` absent
+/// — which is what turns "one bogus tainted node" into "nothing on this
+/// machine is shareable": `propagate_unresolved_owner` cannot prove any
+/// candidate independent of a reader it cannot attribute to an owner.
+///
+/// Measured before the fix: `BASELINE eligible=1 excluded=[]` →
+/// `WITH IMPOSTOR eligible=0 excluded=[firefox → unresolved-owner]`.
+///
+/// Distinct from the row above, which uses a *bounded* impostor and so would
+/// still pass if only the cheap half of the fix were present.
+#[test]
+fn an_unbounded_tagged_impostor_cannot_exclude_a_bystander_app() {
+    let mut graph = Graph::new();
+    let sink = graph.device_node("hw-sink", MediaRole::Sink);
+    let firefox = graph.app_node("firefox", MediaRole::StreamOutput, 11_114);
+    let mpv = graph.app_node("mpv", MediaRole::StreamOutput, 31_284);
+    for node in [firefox, mpv] {
+        graph.link(node, sink);
+    }
+
+    let baseline = run(&graph, &ctx());
+    assert_partition(&baseline, &[("firefox", firefox), ("mpv", mpv)], &[]);
+
+    // Both carriers, no pid, no links — everything an unprivileged process
+    // can arrange for itself in one `pw-cli` invocation.
+    let rogue_client = graph.client(Some(PULSE_PID));
+    let impostor = graph.node(
+        &format!("{}rogue_4242", super::PEERSPEAK_OWNED_NODE_PREFIX),
+        MediaRole::StreamInput,
+        NodeProps {
+            peerspeak_owned: true,
+            client_id: Some(rogue_client),
+            ..NodeProps::default()
+        },
+    );
+
+    let decisions = run(&graph, &ctx());
+    assert_untainted(&decisions, impostor);
+    assert_partition(&decisions, &[("firefox", firefox), ("mpv", mpv)], &[]);
+}
+
+/// A tag that R10-1 ignores is still reported, so that neither a peerspeak
+/// tagging bug nor an impersonation attempt is silent.
+#[test]
+fn ignored_ownership_tags_are_surfaced_for_diagnostics() {
+    let mut graph = Graph::new();
+    let sink = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("call", 7);
+    graph.link(call, sink);
+    let impostor = graph.peerspeak_tagged_node("rogue", MediaRole::StreamInput, 4_242);
+
+    let snapshot = graph.build();
+    let misplaced: Vec<Serial> = super::misplaced_ownership_tags(&snapshot)
+        .iter()
+        .map(|node| node.serial)
+        .collect();
+
+    // Exactly the ignored one: the honoured producer is not "misplaced".
+    assert_eq!(misplaced, vec![impostor.serial]);
+    assert_ne!(impostor.serial, call.serial);
+}
+
+/// The prefix is a **prefix**, not a substring: an unrelated app must not be
+/// excluded because the literal appears somewhere in its name. Over-exclusion
+/// is the safe direction, but it is still wrong, and the phase-5 gate now
+/// asserts exact partitions in both halves.
+#[test]
+fn the_owned_prefix_matches_only_at_the_start_of_node_name() {
+    let mut graph = Graph::new();
+    let sink = graph.device_node("hw-sink", MediaRole::Sink);
+    let impostor = graph.app_node(
+        &format!("recorder-of-{}stuff", super::PEERSPEAK_OWNED_NODE_PREFIX),
+        MediaRole::StreamOutput,
+        11_114,
+    );
+    graph.link(impostor, sink);
+
+    assert_partition(&run(&graph, &ctx()), &[("impostor", impostor)], &[]);
+}
+
+/// The consumer half of the cross-repo contract test (impl plan §3
+/// requirement 2). peerspeak runs the mirror of this against a byte-identical
+/// copy of the same file, and asserts the environment a real child `Command`
+/// would carry produces exactly these literals.
+///
+/// This proves the two repos agree on the *literals*. That pixelpass actually
+/// *listens* is proven by the two carrier tests above, and against the live
+/// graph by the phase 5 dry-run.
+#[test]
+fn ownership_carriers_match_the_cross_repo_fixture() {
+    const FIXTURE: &str = include_str!("../../../tests/fixtures/ownership-tag-contract.txt");
+
+    let pinned: Vec<(&str, &str)> = FIXTURE
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty() && !line.starts_with('#'))
+        .map(|line| line.split_once('=').expect("fixture line is key=value"))
+        .collect();
+
+    // ⚠️ Refuse a duplicated key rather than resolving it (Codex phase-1
+    // review, finding 3). This side takes the first match and peerspeak's
+    // took the last, so a duplicate in a byte-identical file could leave both
+    // repos green having selected *different* contracts.
+    for (index, (key, _)) in pinned.iter().enumerate() {
+        assert!(
+            !pinned[..index].iter().any(|(seen, _)| seen == key),
+            "fixture defines {key:?} twice; the two repos would disagree on which wins"
+        );
+    }
+    let get = |key: &str| -> &str {
+        pinned
+            .iter()
+            .find(|(k, _)| *k == key)
+            .unwrap_or_else(|| panic!("fixture has no key {key:?}"))
+            .1
+    };
+
+    assert_eq!(super::PEERSPEAK_OWNED_PROP, get("prop_key"));
+    assert_eq!(super::PEERSPEAK_OWNED_NODE_PREFIX, get("node_name_prefix"));
+    // ⚠️ **Equality, and that is now the whole rule**: carrier 1 is matched
+    // exactly, not as "anything but false/0" (round 10, R10-4). This assert
+    // used to be followed by a weaker `value != "false" && value != "0"`
+    // check, which described a leniency that no longer exists — the round-10
+    // review's finding 6, and a real trap: a future producer reading the old
+    // fixture prose could emit "true" and silently lose this carrier.
+    //
+    // That this consumer actually *listens* to the fixture's value, through
+    // the production observer wiring rather than a helper, is asserted by
+    // `observer::adapter::tests::the_fixture_value_is_the_only_owned_spelling`.
+    assert_eq!(super::PEERSPEAK_OWNED_VALUE, get("prop_value"));
+
+    // And the fixture's own worked example must be one this engine excludes,
+    // through carrier 2, exactly as written in the shared file.
+    let mut graph = Graph::new();
+    let sink = graph.device_node("hw-sink", MediaRole::Sink);
+    let example = graph.app_node(get("node_name_example"), MediaRole::StreamOutput, 31_284);
+    graph.link(example, sink);
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[],
+        &[("example", example, "peerspeak-owned")],
+    );
+}
+
 #[test]
 fn aec_identity_is_exact_equality_and_other_modules_stay_eligible() {
     let mut graph = Graph::new();
@@ -507,8 +718,9 @@ fn owner_key_union_falls_through_a_present_but_unequal_key() {
         snapshot.node(b.serial).unwrap(),
     );
     assert_ne!(a.props.client_id, b.props.client_id);
+    let owner_ctx = OwnerCtx::new(&snapshot, Some(PULSE_PID));
     assert_eq!(
-        strongest_shared_key(a, b, Some(PULSE_PID)),
+        strongest_shared_key(a, b, &owner_ctx),
         Some(OwnerKey::ProcessId)
     );
 }
@@ -519,11 +731,12 @@ fn the_strongest_shared_key_wins_when_several_match() {
     let a = graph.group_node("a", MediaRole::StreamInput, "g", 500);
     let b = graph.group_node("b", MediaRole::StreamOutput, "g", 500);
     let snapshot = graph.build();
+    let owner_ctx = OwnerCtx::new(&snapshot, Some(PULSE_PID));
     assert_eq!(
         strongest_shared_key(
             snapshot.node(a.serial).unwrap(),
             snapshot.node(b.serial).unwrap(),
-            Some(PULSE_PID)
+            &owner_ctx
         ),
         Some(OwnerKey::LinkGroup)
     );
@@ -560,6 +773,541 @@ fn the_pipewire_pulse_pid_does_not_fuse_unrelated_modules() {
     assert_untainted(&decisions, b_in);
 }
 
+/// **R10-3, the fix.** A native PipeWire client puts no
+/// `application.process.id` on its node — only `client.id` — so before the
+/// Client fallback it had no key 4, was therefore *unbounded*, and
+/// `propagate_unresolved_owner` excluded it the moment any tainted reader
+/// existed anywhere on the machine.
+///
+/// Measured live: an untagged mpv was eligible alone, and became
+/// `unresolved-owner` the instant peerspeak played audio. Since peerspeak
+/// playing audio is the only situation in which this feature runs at all, that
+/// amounted to "native-PipeWire apps are never shareable".
+#[test]
+fn a_native_client_is_bounded_by_its_clients_sec_pid() {
+    let mut graph = Graph::new();
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+
+    // The tainted reader that arms the unresolved-owner arm. Bounded itself
+    // (a real pid), exactly as the live `sunshine` was — so this is the
+    // bounded-reader arm, not the keyless-reader one.
+    let sunshine = graph.app_node("sunshine", MediaRole::StreamInput, 3_838);
+    graph.link(hw, sunshine);
+
+    // mpv on its default ao: client.id only, pid on the Client.
+    let mpv = graph.native_client_node("mpv", MediaRole::StreamOutput, 31_284);
+    graph.link(mpv, hw);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("mpv", mpv)],
+        &[("call", call, "peerspeak-owned")],
+    );
+}
+
+/// The fallback must bridge a native app's *own* legs, or it has bought
+/// boundedness without buying correctness: an app that reads the call and
+/// re-emits it on a second native node would be declared clean.
+#[test]
+fn the_sec_pid_fallback_still_bridges_a_native_apps_own_legs() {
+    let mut graph = Graph::new();
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+
+    // One native process, two nodes, no link between them — the forwarder
+    // shape, in the native flavour.
+    let leg_in = graph.native_client_node("forwarder-in", MediaRole::StreamInput, 50_000);
+    let leg_out = graph.native_client_node("forwarder-out", MediaRole::StreamOutput, 50_000);
+    graph.link(hw, leg_in);
+
+    let decisions = run(&graph, &ctx());
+    assert_tainted(&decisions, leg_out, "tainted-owner-bridge");
+    assert_partition(
+        &decisions,
+        &[],
+        &[
+            ("call", call, "peerspeak-owned"),
+            ("forwarder-out", leg_out, "tainted-owner-bridge"),
+        ],
+    );
+}
+
+/// **The risk the fallback creates, and the guard on it.** Every
+/// Pulse-emulated Client carries pipewire-pulse's own PID as `sec_pid` —
+/// measured, 15 unrelated Clients sharing 2528 on this host. An unguarded
+/// fallback would give all of them key 4 with the *same* value and fuse them
+/// into one owner, so a single tainted Pulse app would exclude every other
+/// Pulse app on the machine.
+///
+/// Exception 1 therefore applies to the fallback exactly as it does to the
+/// node's own property. Without that, this row goes red.
+#[test]
+fn the_sec_pid_fallback_does_not_fuse_every_pulse_client() {
+    let mut graph = Graph::new();
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+
+    // Three unrelated Pulse-emulated apps, each on its own Client, none
+    // exposing a node-level pid — so each can only reach key 4 through its
+    // Client, whose sec_pid is the daemon's.
+    let pulse_app = |graph: &mut Graph, name: &str, role| {
+        let client = graph.client(Some(PULSE_PID));
+        graph.node(
+            name,
+            role,
+            NodeProps {
+                client_id: Some(client),
+                ..NodeProps::default()
+            },
+        )
+    };
+    // One of them reads the tainted sink; the other two must not care.
+    let reader = pulse_app(&mut graph, "recorder", MediaRole::StreamInput);
+    graph.link(hw, reader);
+    let other_a = pulse_app(&mut graph, "player-a", MediaRole::StreamOutput);
+    let other_b = pulse_app(&mut graph, "player-b", MediaRole::StreamOutput);
+
+    let decisions = run(&graph, &ctx());
+    // They are unbounded (`client.id` alone never bounds an owner), so the
+    // fail-closed arm still excludes them — but as `unresolved-owner`, NOT as
+    // `tainted-owner-bridge`. That distinction is the whole assertion: a
+    // bridge reason here would mean the daemon pid had fused three unrelated
+    // applications into one owner, and unlike fail-closed exclusion, fusion
+    // does not go away when the apps are given real pids
+    // (`distinct_sec_pids_bound_each_native_app_separately` is that half).
+    assert_tainted(&decisions, other_a, "unresolved-owner");
+    assert_tainted(&decisions, other_b, "unresolved-owner");
+    for node in [other_a, other_b] {
+        assert_ne!(
+            decisions.taint.get(&node.serial).map(|e| e.reason.code()),
+            Some("tainted-owner-bridge"),
+            "the daemon pid must not bridge unrelated Pulse clients"
+        );
+    }
+}
+
+/// The same three apps, given **real per-app** `sec_pid`s: now the fallback
+/// fires, all three are bounded, and only the one actually reading the call is
+/// affected. This is the row that proves the guard above suppresses the daemon
+/// pid *specifically* rather than disabling the fallback outright.
+#[test]
+fn distinct_sec_pids_bound_each_native_app_separately() {
+    let mut graph = Graph::new();
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+
+    let reader = graph.native_client_node("recorder", MediaRole::StreamInput, 6_001);
+    graph.link(hw, reader);
+    let other_a = graph.native_client_node("player-a", MediaRole::StreamOutput, 6_002);
+    let other_b = graph.native_client_node("player-b", MediaRole::StreamOutput, 6_003);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("player-a", other_a), ("player-b", other_b)],
+        &[("call", call, "peerspeak-owned")],
+    );
+}
+
+/// An **ambiguous** `client.id` — two live Clients claiming it, meaning the
+/// observer missed a removal — must not yield a fallback pid. Inventing an
+/// owner key is the one direction that can *reduce* taint, so resolving the
+/// ambiguity by coin toss is the wrong kind of guess.
+#[test]
+fn an_ambiguous_client_id_yields_no_fallback_pid() {
+    let mut graph = Graph::new();
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+    let sunshine = graph.app_node("sunshine", MediaRole::StreamInput, 3_838);
+    graph.link(hw, sunshine);
+
+    // Two Clients, one id, distinct real pids.
+    let shared_id = graph.client(Some(6_010));
+    graph.client_with_id(shared_id, Some(6_011));
+    let app = graph.node(
+        "native-app",
+        MediaRole::StreamOutput,
+        NodeProps {
+            client_id: Some(shared_id),
+            ..NodeProps::default()
+        },
+    );
+    graph.link(app, hw);
+
+    // Unbounded ⇒ fails closed, exactly as before R10-3.
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[],
+        &[
+            ("call", call, "peerspeak-owned"),
+            ("native-app", app, "unresolved-owner"),
+        ],
+    );
+}
+
+/// The ambiguity guard must not depend on the *first* Client claiming an id
+/// having a `sec_pid`.
+///
+/// Found by auditing R10-3 rather than by a failing case: the first cut
+/// detected a duplicate id by looking it up in the pid map, which is only
+/// populated for Clients that carry a pid at all. A pid-less Client therefore
+/// left no trace, and the next Client claiming the same id was treated as
+/// unique — resolving an ambiguous id, which is exactly the guess the guard
+/// exists to refuse. Pid-less Clients are ordinary here (`device_node`'s
+/// session client is one), so this is reachable, not theoretical.
+#[test]
+fn a_pidless_first_client_still_makes_its_id_ambiguous() {
+    let mut graph = Graph::new();
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+    let sunshine = graph.app_node("sunshine", MediaRole::StreamInput, 3_838);
+    graph.link(hw, sunshine);
+
+    // First claimant has NO sec_pid; second has one.
+    let shared_id = graph.client(None);
+    graph.client_with_id(shared_id, Some(6_011));
+    let app = graph.node(
+        "native-app",
+        MediaRole::StreamOutput,
+        NodeProps {
+            client_id: Some(shared_id),
+            ..NodeProps::default()
+        },
+    );
+    graph.link(app, hw);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[],
+        &[
+            ("call", call, "peerspeak-owned"),
+            ("native-app", app, "unresolved-owner"),
+        ],
+    );
+}
+
+/// A process using **two** Clients cannot escape the bridge by presenting a
+/// bogus pid on one leg and none on the other.
+///
+/// ⚠️ **This is the round-10 review's finding 1, and it was a real leak while
+/// key 4 was `node.or_else(client)`.** The node's `application.process.id` is
+/// client-controlled; the Client's `pipewire.sec.pid` is protected. Letting
+/// the node's value *replace* the Client's meant the reader was bounded by
+/// `12_345` and the output leg by `50_000`, so they shared no key, did not
+/// bridge, and — both being bounded — neither tripped the unbounded sweep.
+/// The output stayed eligible while re-emitting the call.
+///
+/// Carrying both values fixes it: the two legs share the Client pid.
+///
+/// Reachability, stated honestly: `evaluate()` today is reached only by the
+/// dry-run audit, which creates no links, so this could not echo on this
+/// branch. It becomes live the moment phase 6 consumes these decisions.
+#[test]
+fn one_process_with_two_clients_cannot_split_its_pid_to_escape_the_bridge() {
+    let mut graph = Graph::new();
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+
+    // One native process, two Clients, one protected pid.
+    let reader_client = graph.client(Some(50_000));
+    let output_client = graph.client(Some(50_000));
+
+    // Its reading leg claims a pid that is not its own.
+    let reader = graph.node(
+        "two-client-reader",
+        MediaRole::StreamInput,
+        NodeProps {
+            client_id: Some(reader_client),
+            process_id: Some(12_345),
+            ..NodeProps::default()
+        },
+    );
+    graph.link(hw, reader);
+
+    // Its re-emitting leg claims no pid at all.
+    let output = graph.node(
+        "two-client-output",
+        MediaRole::StreamOutput,
+        NodeProps {
+            client_id: Some(output_client),
+            process_id: None,
+            ..NodeProps::default()
+        },
+    );
+    graph.link(output, hw);
+
+    // A genuinely unrelated app must survive, or "exclude everything" would
+    // pass this test — the §5.1 eligible-half rule.
+    let bystander = graph.app_node("mpv", MediaRole::StreamOutput, 9_001);
+    graph.link(bystander, hw);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("mpv", bystander)],
+        &[
+            ("call", call, "peerspeak-owned"),
+            ("two-client-output", output, "tainted-owner-bridge"),
+        ],
+    );
+}
+
+/// The node's own `application.process.id` is used even when its Client's
+/// `sec_pid` is the daemon's — the single most common shape here, since a
+/// Pulse-emulated node's pid is the app's while its Client's is
+/// pipewire-pulse's.
+///
+/// ⚠️ Both values are now carried (round-10 review, finding 1), so this is no
+/// longer "the node's wins" but "exception 1 is applied per value": the
+/// daemon's `sec_pid` is dropped and the node's real pid is kept, leaving the
+/// same single key as before.
+#[test]
+fn the_nodes_own_process_id_wins_over_its_clients() {
+    let mut graph = Graph::new();
+    // `app_node` is exactly that shape: node pid 11_114, Client sec_pid
+    // PULSE_PID. If the Client's won, exception 1 would suppress key 4 and
+    // this node would be unbounded.
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+    let sunshine = graph.app_node("sunshine", MediaRole::StreamInput, 3_838);
+    graph.link(hw, sunshine);
+    let firefox = graph.app_node("firefox", MediaRole::StreamOutput, 11_114);
+    graph.link(firefox, hw);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("firefox", firefox)],
+        &[("call", call, "peerspeak-owned")],
+    );
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// F11-1 — a self-claimed pid is not provenance: the five Client cases
+// ──────────────────────────────────────────────────────────────────────
+
+/// The scaffold every F11-1 row needs: peerspeak's call reaching the hardware
+/// sink, a **bounded** tainted reader, and an ordinary bystander.
+///
+/// ⚠️ The reader must be *bounded* (`sunshine` carries a real pid). An
+/// unbounded tainted reader trips `propagate_unresolved_owner`'s other tier,
+/// which sweeps **every** output candidate on the box regardless of its own
+/// keys — the three "unbounded" rows below would then pass without testing
+/// anything. The bystander is the other half of that guard: it is bounded via
+/// the ordinary Pulse shape, so an implementation that unbounded everything
+/// fails every row instead of passing three of them.
+///
+/// Returns the graph, the hardware sink to hang nodes off, and the two nodes
+/// every row must name in its partition.
+fn armed_with_a_bounded_reader() -> (Graph, NodeRef, NodeRef, NodeRef) {
+    let mut graph = Graph::new();
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+    let sunshine = graph.app_node("sunshine", MediaRole::StreamInput, 3_838);
+    graph.link(hw, sunshine);
+    let bystander = graph.app_node("mpv", MediaRole::StreamOutput, 9_001);
+    graph.link(bystander, hw);
+    (graph, hw, call, bystander)
+}
+
+/// Case 1 of 5 — **Client absent.** A node that names no Client at all has
+/// nothing but its own word for who owns it, so it cannot be bounded.
+#[test]
+fn an_absent_client_leaves_a_self_claimed_pid_unbounded() {
+    let (mut graph, hw, call, bystander) = armed_with_a_bounded_reader();
+    let orphan = graph.node(
+        "no-client",
+        MediaRole::StreamOutput,
+        NodeProps {
+            process_id: Some(70_001),
+            ..NodeProps::default()
+        },
+    );
+    graph.link(orphan, hw);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("mpv", bystander)],
+        &[
+            ("call", call, "peerspeak-owned"),
+            ("no-client", orphan, "unresolved-owner"),
+        ],
+    );
+}
+
+/// Case 2 of 5 — **Client ambiguous.** Two live Clients claim the id, so the
+/// observer missed a removal and we do not know who owns this node. A
+/// self-claimed pid must not paper over that: this is step 2 of the recorded
+/// leak path, and before F11-1 the claim bounded the node and spared it.
+#[test]
+fn an_ambiguous_client_leaves_a_self_claimed_pid_unbounded() {
+    let (mut graph, hw, call, bystander) = armed_with_a_bounded_reader();
+    let shared_id = graph.client(Some(70_010));
+    graph.client_with_id(shared_id, Some(70_011));
+    let app = graph.node(
+        "ambiguous-client",
+        MediaRole::StreamOutput,
+        NodeProps {
+            client_id: Some(shared_id),
+            process_id: Some(70_012),
+            ..NodeProps::default()
+        },
+    );
+    graph.link(app, hw);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("mpv", bystander)],
+        &[
+            ("call", call, "peerspeak-owned"),
+            ("ambiguous-client", app, "unresolved-owner"),
+        ],
+    );
+}
+
+/// Case 3 of 5 — **Client unique but pid-less**, and *the row that decides
+/// which rule is implemented*.
+///
+/// A unique Client object exists, so "resolved = a unique Client exists" would
+/// call this node bounded — leaving the self-claimed-pid hole wide open under a
+/// rule that looks like it closed it. `sec_pid` is what carries protected
+/// identity, so `None` means unresolved, and pid-less Clients are ordinary
+/// (the session manager's is one).
+///
+/// A two-case absent/resolved matrix skips this silently. That is why it is
+/// written out.
+#[test]
+fn a_unique_but_pidless_client_leaves_a_self_claimed_pid_unbounded() {
+    let (mut graph, hw, call, bystander) = armed_with_a_bounded_reader();
+    let pidless = graph.client(None);
+    let app = graph.node(
+        "pidless-client",
+        MediaRole::StreamOutput,
+        NodeProps {
+            client_id: Some(pidless),
+            process_id: Some(70_020),
+            ..NodeProps::default()
+        },
+    );
+    graph.link(app, hw);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("mpv", bystander)],
+        &[
+            ("call", call, "peerspeak-owned"),
+            ("pidless-client", app, "unresolved-owner"),
+        ],
+    );
+}
+
+/// Case 4 of 5 — **Client resolved, native.** `pipewire.sec.pid` is the app's
+/// own, so provenance and key 4 are the same value and the node is bounded
+/// without claiming anything itself.
+#[test]
+fn a_resolved_native_client_bounds_its_node() {
+    let (mut graph, hw, call, bystander) = armed_with_a_bounded_reader();
+    let mpv2 = graph.native_client_node("mpv-native", MediaRole::StreamOutput, 70_030);
+    graph.link(mpv2, hw);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("mpv", bystander), ("mpv-native", mpv2)],
+        &[("call", call, "peerspeak-owned")],
+    );
+}
+
+/// Case 5 of 5 — **Client resolved to pipewire-pulse.** The row that stops
+/// this rule from being the blunt fix.
+///
+/// Every Pulse-emulated app looks like this: the Client's `sec_pid` is the
+/// daemon's — suppressed as a *grouping* key, because it would fuse fifteen
+/// unrelated apps — while the node's own `application.process.id` is the app's.
+/// Provenance is read **before** that suppression, so the app keeps its bound
+/// and stays eligible. Reading it after would unbound every Pulse app on the
+/// box and empty the eligible half of the §5.1 matrix, which is the §6.1.1
+/// catastrophe arriving through the boundedness door.
+#[test]
+fn a_client_resolving_to_pipewire_pulse_still_bounds_its_node() {
+    let (mut graph, hw, call, bystander) = armed_with_a_bounded_reader();
+    let firefox = graph.app_node("firefox", MediaRole::StreamOutput, 70_040);
+    graph.link(firefox, hw);
+
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("mpv", bystander), ("firefox", firefox)],
+        &[("call", call, "peerspeak-owned")],
+    );
+}
+
+/// **The recorded leak path, end to end** (round 11 review, finding 1).
+///
+/// One process, two Clients. Its reading leg claims the daemon's pid — which
+/// exception 1 suppresses — while its Client holds a real protected pid `A`, so
+/// the union bounds the reader by `A` and the *unbounded-reader* tier never
+/// arms. Its re-emitting leg sits on a second Client whose id is **ambiguous**
+/// (one of the two claimants even holds `A`, so this is not "the guess would
+/// have been wrong" — it is "a guess is not evidence"), and claims a pid of its
+/// own. The two legs share no key, so the bridge does not fire either.
+///
+/// Before F11-1 the self-claim bounded the output leg, both tiers stayed quiet,
+/// and it re-emitted the call while eligible. Now the leg is unbounded, the
+/// bounded-reader tier sweeps it, and `mpv` shows the sweep is still targeted.
+#[test]
+fn a_self_claimed_pid_cannot_spare_an_output_leg_the_bridge_cannot_reach() {
+    let mut graph = Graph::new();
+    let hw = graph.device_node("hw-sink", MediaRole::Sink);
+    let call = graph.peerspeak_node("peerspeak", 7);
+    graph.link(call, hw);
+
+    let reader_client = graph.client(Some(80_000));
+    let reader = graph.node(
+        "forwarder-in",
+        MediaRole::StreamInput,
+        NodeProps {
+            client_id: Some(reader_client),
+            process_id: Some(PULSE_PID),
+            ..NodeProps::default()
+        },
+    );
+    graph.link(hw, reader);
+
+    let ambiguous = graph.client(Some(80_000));
+    graph.client_with_id(ambiguous, Some(80_001));
+    let output = graph.node(
+        "forwarder-out",
+        MediaRole::StreamOutput,
+        NodeProps {
+            client_id: Some(ambiguous),
+            process_id: Some(80_002),
+            ..NodeProps::default()
+        },
+    );
+    graph.link(output, hw);
+
+    let bystander = graph.app_node("mpv", MediaRole::StreamOutput, 9_001);
+    graph.link(bystander, hw);
+
+    // `mpv` staying eligible is what proves the reader is bounded: an
+    // unbounded tainted reader sweeps **every** output candidate, `mpv`
+    // included, and this row would then be testing the wrong tier.
+    assert_partition(
+        &run(&graph, &ctx()),
+        &[("mpv", bystander)],
+        &[
+            ("call", call, "peerspeak-owned"),
+            ("forwarder-out", output, "unresolved-owner"),
+        ],
+    );
+}
+
 #[test]
 fn an_unknown_pipewire_pulse_pid_over_excludes_rather_than_leaks() {
     // v3.4 §6.1.2's failure-mode paragraph: if pixelpass cannot identify
@@ -820,6 +1568,137 @@ fn an_ambiguous_recycled_global_id_fails_closed() {
     );
 }
 
+// ──────────────────────────────────────────────────────────────────────
+// Uncertainty is not history — it never enters sticky state
+// (round 9, from a live phase-5 audit run; see `Uncertainty` in mod.rs)
+// ──────────────────────────────────────────────────────────────────────
+
+#[test]
+fn unresolved_ancestry_does_not_survive_being_resolved() {
+    // Measured live on a desktop: a link is observed while its output node is
+    // still unbound, the input side fails closed — correctly — and then that
+    // fail-closed mark became *sticky*, so a hardware sink stayed excluded for
+    // the process lifetime even after the node resolved and turned out to be
+    // an ordinary game. Phase 3r's bind-everything observer widens that window
+    // to every node, so this must clear.
+    let mut graph = Graph::new();
+    let ghost = graph.dangling_id();
+    let client = graph.client_of_app(6000);
+    let victim = graph.node("victim-in", MediaRole::StreamInput, app(client, 6000));
+    let sibling = graph.node("victim-out", MediaRole::StreamOutput, app(client, 6000));
+    graph.link_ids(ghost, victim.id);
+    let firefox = graph.app_node("firefox", MediaRole::StreamOutput, 11114);
+    let c = ctx();
+
+    // While the ancestry is genuinely unresolved, the decision is unchanged:
+    // fail closed, both the victim and its sibling excluded.
+    let (first, sticky) = evaluate(&graph.build(), &c, &StickyState::default());
+    assert_partition(
+        &first,
+        &[("firefox", firefox)],
+        &[("victim-out", sibling, "tainted-owner-bridge")],
+    );
+    assert_tainted(&first, victim, "unresolved-ancestry");
+
+    // The node behind that id turns up — nothing tainted, it was simply not
+    // observed yet. The uncertainty is gone, so nothing may remain of it.
+    let late_client = graph.client_of_app(7100);
+    let resolved = graph.node_with_id(
+        "was-unbound",
+        MediaRole::StreamOutput,
+        ghost,
+        app(late_client, 7100),
+    );
+    let (second, _) = evaluate(&graph.build(), &c, &sticky);
+    assert_partition(
+        &second,
+        &[
+            ("firefox", firefox),
+            ("victim-out", sibling),
+            ("was-unbound", resolved),
+        ],
+        &[],
+    );
+}
+
+#[test]
+fn uncertainty_laundered_into_downstream_taint_is_not_sticky_either() {
+    // Retiring by reason *code* would not be enough: an unresolved node
+    // propagates `tainted-upstream`, which is indistinguishable from real
+    // contamination once recorded. The split has to be by provenance, so a
+    // node two hops from the uncertainty must clear too.
+    let mut graph = Graph::new();
+    let ghost = graph.dangling_id();
+    let forwarder_client = graph.client_of_app(6100);
+    let forwarder_in = graph.node(
+        "fwd-in",
+        MediaRole::StreamInput,
+        app(forwarder_client, 6100),
+    );
+    let forwarder_out = graph.node(
+        "fwd-out",
+        MediaRole::StreamOutput,
+        app(forwarder_client, 6100),
+    );
+    let downstream_client = graph.client_of_app(6200);
+    let downstream = graph.node("downstream", MediaRole::Sink, app(downstream_client, 6200));
+    let downstream_leg = graph.node(
+        "downstream-out",
+        MediaRole::StreamOutput,
+        app(downstream_client, 6200),
+    );
+    graph.link_ids(ghost, forwarder_in.id);
+    graph.link(forwarder_out, downstream);
+    let c = ctx();
+
+    let (first, sticky) = evaluate(&graph.build(), &c, &StickyState::default());
+    assert_tainted(&first, forwarder_in, "unresolved-ancestry");
+    assert_tainted(&first, downstream, "tainted-upstream");
+    assert!(
+        first.candidates[&downstream_leg.serial].reason().is_some(),
+        "while the ancestry is unresolved the downstream owner is excluded too"
+    );
+
+    let late_client = graph.client_of_app(7200);
+    graph.node_with_id(
+        "was-unbound",
+        MediaRole::StreamOutput,
+        ghost,
+        app(late_client, 7200),
+    );
+    let (second, _) = evaluate(&graph.build(), &c, &sticky);
+    assert_eq!(
+        second.candidates[&downstream_leg.serial].reason(),
+        None,
+        "nothing derived from the uncertainty may outlive it"
+    );
+    assert_eq!(
+        second.candidates[&forwarder_out.serial].reason(),
+        None,
+        "including the unresolved node's own owner siblings"
+    );
+}
+
+#[test]
+fn real_taint_is_still_sticky_when_its_topology_goes_away() {
+    // The other half of the same rule, stated positively: *evidence* is
+    // history and must survive. This is the guard on the change above — if
+    // provenance splitting ever leaks into the evidence path, peerspeak's own
+    // audio starts escaping.
+    let (graph, call, rec_in, rec_out, firefox) = sticky_scene();
+    let c = ctx();
+    let (_, sticky) = evaluate(&graph.build(), &c, &StickyState::default());
+    let (second, _) = evaluate(&graph.build_without(&[rec_in]), &c, &sticky);
+    assert_partition(
+        &second,
+        &[("firefox", firefox)],
+        &[
+            ("call", call, "peerspeak-owned"),
+            ("rec-out", rec_out, "tainted-owner-bridge"),
+        ],
+    );
+}
+
 // ──────────────────────────────────────────────────────────────────────
 // Stickiness and lifetime-awareness (v3.4 §6.1.3)
 // ──────────────────────────────────────────────────────────────────────
@@ -1804,5 +2683,12 @@ fn an_ambiguous_client_id_remembers_every_claimant_for_stickiness() {
         client_members >= 2,
         "both ambiguous-id clients should be remembered: {sticky:#?}"
     );
-    let _ = (ClientSnapshot { serial: Serial(0), id: GlobalId(0), sec_pid: None }, firefox);
+    let _ = (
+        ClientSnapshot {
+            serial: Serial(0),
+            id: GlobalId(0),
+            sec_pid: None,
+        },
+        firefox,
+    );
 }

src/main.rs

@@ -49,7 +49,7 @@ async fn main() -> Result<()> {
     pipewire::init();
 
     if cli.repair {
-        return repair::run().await;
+        return repair::run(cli.repair_legacy_untagged).await;
     }
 
     // Read-only diagnostic: observe the graph, report what the audio-exclusion

src/repair.rs

@@ -1,236 +0,0 @@
-//! `--repair`: clean up null-sinks and loopbacks left behind by a crashed
-//! pixelpass host. Identifies orphans by the `pixelpass_capture_<pid>`
-//! name pattern + dead-PID check, then unloads paired loopbacks first
-//! (mirrors `Routing::shutdown`'s order so PipeWire doesn't leave zombie
-//! links). Live PIDs — including this process and any other running
-//! pixelpass — are left alone.
-
-use anyhow::{Context, Result, bail};
-use std::collections::HashSet;
-use std::path::Path;
-use std::process::Command;
-
-const SINK_NAME_PREFIX: &str = "pixelpass_capture_";
-
-pub async fn run() -> Result<()> {
-    let modules = list_modules().context("failed to list pactl modules")?;
-
-    let mut dead_sinks: Vec<OrphanSink> = Vec::new();
-    let mut dead_pids: HashSet<u32> = HashSet::new();
-    let mut live_skipped: u32 = 0;
-
-    for m in &modules {
-        if m.name != "module-null-sink" {
-            continue;
-        }
-        let Some(sink_name) = extract_kv(&m.args, "sink_name") else {
-            continue;
-        };
-        let Some(pid_str) = sink_name.strip_prefix(SINK_NAME_PREFIX) else {
-            continue;
-        };
-        let Ok(pid) = pid_str.parse::<u32>() else {
-            continue;
-        };
-
-        if is_pid_alive(pid) {
-            live_skipped += 1;
-            continue;
-        }
-        dead_pids.insert(pid);
-        dead_sinks.push(OrphanSink {
-            id: m.id,
-            sink_name: sink_name.to_string(),
-            pid,
-        });
-    }
-
-    let mut dead_loopbacks: Vec<u32> = Vec::new();
-    for m in &modules {
-        if m.name != "module-loopback" {
-            continue;
-        }
-        // A pixelpass loopback references a capture sink either as its
-        // destination (`sink=pixelpass_capture_<pid>` — the default→null
-        // mirror) or as its source (`source=pixelpass_capture_<pid>.monitor`
-        // — the local monitor that lets the sharer hear the app). Match both.
-        let Some(pid) = loopback_capture_pid(&m.args) else {
-            continue;
-        };
-        if dead_pids.contains(&pid) {
-            dead_loopbacks.push(m.id);
-        }
-    }
-
-    if dead_sinks.is_empty() && dead_loopbacks.is_empty() {
-        if live_skipped > 0 {
-            println!(
-                "[pixelpass] --repair: nothing to clean up ({live_skipped} live pixelpass host(s) left alone)."
-            );
-        } else {
-            println!("[pixelpass] --repair: nothing to clean up.");
-        }
-        return Ok(());
-    }
-
-    let mut unloaded = 0u32;
-    let mut failed = 0u32;
-
-    for id in &dead_loopbacks {
-        match unload_module(*id) {
-            Ok(()) => {
-                println!("[pixelpass] --repair: unloaded loopback module #{id}");
-                unloaded += 1;
-            }
-            Err(e) => {
-                eprintln!("[pixelpass] --repair: failed to unload loopback #{id}: {e:#}");
-                failed += 1;
-            }
-        }
-    }
-    for orphan in &dead_sinks {
-        match unload_module(orphan.id) {
-            Ok(()) => {
-                println!(
-                    "[pixelpass] --repair: unloaded {} (orphaned from pid {})",
-                    orphan.sink_name, orphan.pid
-                );
-                unloaded += 1;
-            }
-            Err(e) => {
-                eprintln!(
-                    "[pixelpass] --repair: failed to unload {} (#{}): {e:#}",
-                    orphan.sink_name, orphan.id
-                );
-                failed += 1;
-            }
-        }
-    }
-
-    if live_skipped > 0 {
-        println!("[pixelpass] --repair: left {live_skipped} live pixelpass host(s) alone.");
-    }
-
-    if failed > 0 {
-        bail!("--repair: {failed} module(s) failed to unload (see errors above)");
-    }
-    println!("[pixelpass] --repair: cleaned up {unloaded} module(s).");
-    Ok(())
-}
-
-struct Module {
-    id: u32,
-    name: String,
-    args: String,
-}
-
-struct OrphanSink {
-    id: u32,
-    sink_name: String,
-    pid: u32,
-}
-
-fn list_modules() -> Result<Vec<Module>> {
-    let output = Command::new("pactl")
-        .args(["list", "short", "modules"])
-        .output()
-        .context("failed to run `pactl list short modules`")?;
-    if !output.status.success() {
-        bail!(
-            "pactl list short modules failed: {}",
-            String::from_utf8_lossy(&output.stderr).trim()
-        );
-    }
-    let text = String::from_utf8(output.stdout).context("pactl returned non-UTF-8")?;
-    let mut modules = Vec::new();
-    // `pactl list short modules` is tab-separated, but some modules have
-    // multi-line `{ ... }` argument blocks that wrap onto continuation
-    // lines starting with whitespace. The wrap lines never parse as a
-    // u32 ID, so the simple per-line + parse-id filter is robust.
-    for line in text.lines() {
-        let mut parts = line.splitn(4, '\t');
-        let Some(id_str) = parts.next() else { continue };
-        let Ok(id) = id_str.parse::<u32>() else {
-            continue;
-        };
-        let Some(name) = parts.next() else { continue };
-        let args = parts.next().unwrap_or("").to_string();
-        modules.push(Module {
-            id,
-            name: name.to_string(),
-            args,
-        });
-    }
-    Ok(modules)
-}
-
-/// The `pixelpass_capture_<pid>` PID a loopback references, whether the capture
-/// sink is its destination (`sink=pixelpass_capture_<pid>`) or its source
-/// (`source=pixelpass_capture_<pid>.monitor`). `None` for unrelated loopbacks.
-fn loopback_capture_pid(args: &str) -> Option<u32> {
-    let from_sink = extract_kv(args, "sink").and_then(|v| v.strip_prefix(SINK_NAME_PREFIX));
-    let from_source = extract_kv(args, "source")
-        .and_then(|v| v.strip_prefix(SINK_NAME_PREFIX))
-        .and_then(|rest| rest.strip_suffix(".monitor"));
-    from_sink
-        .or(from_source)
-        .and_then(|pid| pid.parse::<u32>().ok())
-}
-
-fn extract_kv<'a>(args: &'a str, key: &str) -> Option<&'a str> {
-    for token in args.split_whitespace() {
-        if let Some(rest) = token.strip_prefix(key)
-            && let Some(value) = rest.strip_prefix('=')
-        {
-            return Some(value);
-        }
-    }
-    None
-}
-
-fn is_pid_alive(pid: u32) -> bool {
-    Path::new(&format!("/proc/{pid}")).exists()
-}
-
-fn unload_module(id: u32) -> Result<()> {
-    let output = Command::new("pactl")
-        .arg("unload-module")
-        .arg(id.to_string())
-        .output()
-        .context("failed to run pactl unload-module")?;
-    if !output.status.success() {
-        bail!(
-            "pactl unload-module #{id}: {}",
-            String::from_utf8_lossy(&output.stderr).trim()
-        );
-    }
-    Ok(())
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-
-    #[test]
-    fn loopback_pid_matches_default_null_mirror_by_sink() {
-        // The default→null loopback: capture sink is the destination.
-        let args = "source=@DEFAULT_SINK@.monitor sink=pixelpass_capture_4242 latency_msec=20";
-        assert_eq!(loopback_capture_pid(args), Some(4242));
-    }
-
-    #[test]
-    fn loopback_pid_matches_local_monitor_by_source() {
-        // The local monitor: capture sink's monitor is the source, and the
-        // destination is the real default sink (not a pixelpass name).
-        let args = "source=pixelpass_capture_4242.monitor sink=@DEFAULT_SINK@ latency_msec=20";
-        assert_eq!(loopback_capture_pid(args), Some(4242));
-    }
-
-    #[test]
-    fn loopback_pid_ignores_unrelated_loopback() {
-        assert_eq!(
-            loopback_capture_pid("source=alsa_output.pci.monitor sink=some_other_sink"),
-            None
-        );
-    }
-}

src/repair/introspect.rs

@@ -0,0 +1,297 @@
+//! Structured Pulse introspection: the observation and destruction layer for
+//! `--repair`.
+//!
+//! # Why this replaced parsing `pactl`
+//!
+//! Three separate defects, all of them consequences of reading a human-oriented
+//! text format rather than the protocol:
+//!
+//! 1. **Record boundaries were unprovable.** `pactl list short modules` prints a
+//!    module's argument raw into a tab-and-newline-delimited format with no
+//!    escaping. A *genuine* module whose argument contains a newline — say
+//!    `…latency_msec=20\nremix=false`, and `remix` is a real loopback option —
+//!    renders a first line that reads byte-exactly like one of our canonical
+//!    forms, with the remainder dropped as an unparseable continuation. No index
+//!    is forged, so no duplicate-index check can see it: repair would classify and
+//!    unload a module it had never actually seen in full. A tab in the same
+//!    position instead hides a sink reference, which is worse, because the gate
+//!    that protects a still-referenced sink then cannot see the reference.
+//! 2. **Index and argument could be mis-paired.** The one listing that carries the
+//!    exact argument (`-f json`) carries **no index** at all on pactl 17, and the
+//!    one that carries the index cannot carry the argument faithfully. Combining
+//!    them by position is unsound whenever module names repeat: another client
+//!    loading one module and unloading another between the two calls leaves the
+//!    counts and names aligned while every argument has shifted by one.
+//! 3. **Locality was a guess.** `PULSE_SERVER` is a *fallback list*, so
+//!    `unix:/missing tcp:remote:4713` passes any "starts with unix:" test and then
+//!    connects to another machine — where our local pids mean nothing and a live
+//!    remote host's modules look dead.
+//!
+//! `pa_module_info` carries index, name and argument together in one structured
+//! record, so (1) and (2) cannot arise. `pa_context_is_local()` answers (3) about
+//! the connection that actually got established rather than about a string we
+//! hoped described it. And because unloading goes back through the *same*
+//! connection, there is no window in which listing and destruction could disagree
+//! about which server they are talking to.
+//!
+//! # What is deliberately not here
+//!
+//! No decisions. This module observes and destroys; every judgement about what may
+//! be destroyed lives in [`super::plan`], which is pure and needs no Pulse server
+//! to test. The one policy this layer owns is *refusing to talk to the wrong
+//! server at all*.
+
+use anyhow::{Context as _, Result, bail};
+use libpulse_binding::callbacks::ListResult;
+use libpulse_binding::context::{Context, FlagSet as ContextFlagSet, State as ContextState};
+use libpulse_binding::mainloop::standard::{IterateResult, Mainloop};
+use libpulse_binding::operation::{Operation, State as OperationState};
+use libpulse_binding::proplist::{Proplist, properties};
+use std::cell::RefCell;
+use std::rc::Rc;
+use std::time::{Duration, Instant};
+
+use super::plan::ModuleObservation;
+
+/// How long to wait for the connection to reach `Ready`. A one-shot CLI must not
+/// hang on an unresponsive server; failing closed here costs the user a re-run.
+const CONNECT_BUDGET: Duration = Duration::from_secs(3);
+
+/// How long any single introspection request may take.
+///
+/// ⚠️ On timeout the `Operation` wrapper is dropped while still running. In
+/// libpulse-binding 2.30.1 that only unrefs the C operation — the boxed callback
+/// and the `Rc`s it captured leak until the context cancels the operation at
+/// disconnect. That is bounded and harmless *here*, because `--repair` is a
+/// one-shot process that exits immediately afterwards, and it cannot become a
+/// use-after-free (the closure owns its clones, and the context clears callbacks
+/// before the mainloop is touched). **It would not be acceptable in the long-lived
+/// host**, so this module must not be reused for host-side loading until that
+/// binding bug is fixed or worked around; `op.cancel()` does not help.
+const REQUEST_BUDGET: Duration = Duration::from_secs(3);
+
+/// How long to sleep between mainloop iterations while waiting. Non-blocking
+/// iteration plus a short sleep keeps the deadline enforceable, which
+/// `iterate(true)` would not.
+const POLL_INTERVAL: Duration = Duration::from_millis(2);
+
+/// A live, verified-local connection to the Pulse server.
+///
+/// Both listing and unloading run through this one connection, so everything
+/// repair sees and everything it destroys provably belong to the same server.
+///
+/// ⚠️ **Field order is load-bearing, and this was not theoretical.** Rust drops
+/// fields in declaration order, and the context's teardown frees IO events that
+/// live *in* the mainloop. With `mainloop` declared first, `--repair` did its work
+/// correctly and then died on the way out:
+///
+/// ```text
+/// Assertion '!e->dead' failed at ../pulseaudio/src/pulse/mainloop.c:207,
+/// function mainloop_io_free(). Aborting.
+/// ```
+///
+/// SIGABRT, a core dump, and exit 134 — so a completely successful repair reported
+/// failure to its caller. This is the same invariant phase 0b's
+/// `ScreenshareTeardown` exists for, met again one layer down.
+///
+/// Rather than leave that resting on where the fields happen to be written, [`Drop`]
+/// **explicitly** takes and drops the context first, so the ordering survives a
+/// future reorder of this struct. The declaration order below is still correct, and
+/// now it is also not load-bearing.
+pub struct PulseSession {
+    /// `Option` only so that `Drop` can `take()` it and destroy it *before* the
+    /// mainloop. Always `Some` for the whole of the session's usable life.
+    context: Option<Context>,
+    mainloop: Mainloop,
+}
+
+impl Drop for PulseSession {
+    fn drop(&mut self) {
+        // Disconnect, then destroy the context while the mainloop it registered its
+        // IO events with is still alive. The mainloop then drops after us.
+        //
+        // Nothing is drained afterwards on purpose. An earlier version iterated the
+        // mainloop a few times here to "let teardown settle", which was a ritual
+        // rather than a barrier: a fixed number of non-blocking polls cannot
+        // guarantee that any particular event became ready. It is also unnecessary —
+        // PulseAudio's context unlink cancels outstanding operations and removes the
+        // context's socket machinery synchronously, so by the time `drop(context)`
+        // returns there is no obligation left for the mainloop to service.
+        if let Some(mut context) = self.context.take() {
+            context.disconnect();
+            drop(context);
+        }
+    }
+}
+
+impl PulseSession {
+    /// The live context. Infallible in practice: only `Drop` ever clears it, and
+    /// nothing can call this afterwards.
+    fn context(&mut self) -> &mut Context {
+        self.context
+            .as_mut()
+            .expect("the context is only taken during Drop")
+    }
+    /// Connect, wait for readiness, and refuse anything but a local server.
+    pub fn connect() -> Result<Self> {
+        let mut proplist = Proplist::new().context("could not allocate a Pulse proplist")?;
+        // `set_str` fails only on an invalid key, and these keys are constants.
+        let _ = proplist.set_str(properties::APPLICATION_NAME, "pixelpass --repair");
+        let _ = proplist.set_str(properties::APPLICATION_ID, "xyz.pixelpass.repair");
+
+        let mut mainloop = Mainloop::new().context("could not create a Pulse mainloop")?;
+        let mut context = Context::new_with_proplist(&mainloop, "pixelpass --repair", &proplist)
+            .context("could not create a Pulse context")?;
+        context
+            .connect(None, ContextFlagSet::NOFLAGS, None)
+            .context("could not connect to the Pulse server")?;
+
+        let deadline = Instant::now() + CONNECT_BUDGET;
+        loop {
+            iterate_once(&mut mainloop)?;
+            match context.get_state() {
+                ContextState::Ready => break,
+                ContextState::Failed => {
+                    bail!("the Pulse server refused the connection");
+                }
+                ContextState::Terminated => {
+                    bail!("the Pulse connection terminated before it was ready");
+                }
+                _ => {
+                    if Instant::now() >= deadline {
+                        bail!(
+                            "the Pulse server did not become ready within {:?}",
+                            CONNECT_BUDGET
+                        );
+                    }
+                    std::thread::sleep(POLL_INTERVAL);
+                }
+            }
+        }
+
+        // The connection is established, so this is about the server we actually
+        // reached — not about what a server string appeared to promise. A remote
+        // server's module table belongs to another machine's processes, where our
+        // pids mean nothing, so repair must not touch it.
+        match context.is_local() {
+            Some(true) => {}
+            Some(false) => bail!(
+                "connected to a REMOTE Pulse server; --repair only ever operates on the local \
+                 server, because it decides what to unload from local process liveness"
+            ),
+            None => bail!(
+                "could not determine whether the Pulse server is local; refusing to unload \
+                 anything"
+            ),
+        }
+
+        Ok(Self {
+            context: Some(context),
+            mainloop,
+        })
+    }
+
+    /// Every loaded module, with its exact argument.
+    pub fn list_modules(&mut self) -> Result<Vec<ModuleObservation>> {
+        // `Rc<RefCell<…>>` because the callback is owned by the C library and may
+        // be invoked many times before the operation completes.
+        let collected: Rc<RefCell<Vec<ModuleObservation>>> = Rc::new(RefCell::new(Vec::new()));
+        let failed: Rc<RefCell<bool>> = Rc::new(RefCell::new(false));
+
+        let sink = Rc::clone(&collected);
+        let error_flag = Rc::clone(&failed);
+        let op = self
+            .context()
+            .introspect()
+            .get_module_info_list(move |result| match result {
+                ListResult::Item(info) => {
+                    // A module with no name is not one we can identify, and an
+                    // argumentless module is simply one loaded without arguments.
+                    let name = info.name.as_deref().unwrap_or_default();
+                    let args = info.argument.as_deref().unwrap_or_default();
+                    sink.borrow_mut()
+                        .push(ModuleObservation::new(info.index, name, args));
+                }
+                ListResult::End => {}
+                ListResult::Error => *error_flag.borrow_mut() = true,
+            });
+
+        self.run_to_completion(op, "list modules")?;
+        if *failed.borrow() {
+            bail!("the Pulse server returned an error while listing modules");
+        }
+
+        let modules = collected.borrow().clone();
+        // Impossible per the protocol — an index identifies one module — so this is
+        // a sanity check on external input, not a safety boundary. It fails closed
+        // because an ambiguous index is one we could unload wrongly.
+        for (i, module) in modules.iter().enumerate() {
+            if modules[..i].iter().any(|earlier| earlier.id == module.id) {
+                bail!(
+                    "the Pulse server reported module index #{} twice; refusing to unload \
+                     anything",
+                    module.id
+                );
+            }
+        }
+        Ok(modules)
+    }
+
+    /// Unload one module, over the same connection it was observed on.
+    pub fn unload_module(&mut self, index: u32) -> Result<()> {
+        let succeeded: Rc<RefCell<Option<bool>>> = Rc::new(RefCell::new(None));
+        let outcome = Rc::clone(&succeeded);
+        let op = self
+            .context()
+            .introspect()
+            .unload_module(index, move |success| *outcome.borrow_mut() = Some(success));
+
+        self.run_to_completion(op, "unload module")?;
+        match *succeeded.borrow() {
+            Some(true) => Ok(()),
+            Some(false) => bail!("the Pulse server rejected unloading module #{index}"),
+            // The operation completed without the callback running, which we cannot
+            // read as success.
+            None => bail!("no result was reported for unloading module #{index}"),
+        }
+    }
+
+    /// Drive the mainloop until `op` finishes, or the budget expires.
+    fn run_to_completion<T: ?Sized>(&mut self, op: Operation<T>, what: &str) -> Result<()> {
+        let deadline = Instant::now() + REQUEST_BUDGET;
+        loop {
+            iterate_once(&mut self.mainloop)?;
+            match op.get_state() {
+                OperationState::Done => return Ok(()),
+                OperationState::Cancelled => {
+                    bail!("the Pulse server cancelled the request to {what}");
+                }
+                OperationState::Running => {
+                    // A connection that dies mid-request would otherwise be waited
+                    // out to the full budget.
+                    match self.context().get_state() {
+                        ContextState::Ready => {}
+                        state => {
+                            bail!("the Pulse connection became {state:?} while trying to {what}")
+                        }
+                    }
+                    if Instant::now() >= deadline {
+                        bail!("the Pulse server did not {what} within {REQUEST_BUDGET:?}");
+                    }
+                    std::thread::sleep(POLL_INTERVAL);
+                }
+            }
+        }
+    }
+}
+
+/// One non-blocking mainloop iteration, with quit and error surfaced as errors.
+fn iterate_once(mainloop: &mut Mainloop) -> Result<()> {
+    match mainloop.iterate(false) {
+        IterateResult::Success(_) => Ok(()),
+        IterateResult::Quit(code) => {
+            bail!("the Pulse mainloop quit unexpectedly (code {})", code.0)
+        }
+        IterateResult::Err(e) => Err(e).context("the Pulse mainloop failed"),
+    }
+}

src/repair/mod.rs

@@ -0,0 +1,553 @@
+//! `--repair`: clean up the Pulse modules left behind by a crashed pixelpass
+//! host.
+//!
+//! All of the judgement lives in [`plan`], which is pure. What remains here is
+//! I/O plus the two rules that cannot be expressed in a plan:
+//!
+//! - **Re-verify immediately before destroying anything.** Pulse module indices
+//!   are reused verbatim, and a host can die (or come back) between the snapshot
+//!   and the unload, so the plan is treated as evidence that expires — never as a
+//!   licence.
+//! - **Gate the sink on what is still attached to it**, not on the plan's ordering
+//!   having succeeded. An unload can fail or be skipped, and a loopback can appear
+//!   after the plan was made.
+//!
+//! Repair never touches native PipeWire nodes. Since phase 0c the capture sink is
+//! connection-owned and removes itself when its host dies, so there is nothing
+//! there for repair to do and no safe way for it to help.
+//!
+//! # Where the observations come from
+//!
+//! Structured Pulse introspection over one verified-local connection — see
+//! [`introspect`], which also documents the three defects that parsing `pactl`'s
+//! text output turned out to have. Listing *and* unloading both go through that
+//! same connection.
+
+pub mod introspect;
+pub mod plan;
+
+use anyhow::{Context, Result, bail};
+use std::path::Path;
+
+use introspect::PulseSession;
+use plan::{Fingerprint, Liveness, Shape};
+
+pub async fn run(clean_untagged: bool) -> Result<()> {
+    let liveness = LivenessProbe::new();
+    if let Some(reason) = liveness.degraded_reason() {
+        // Scoped deliberately: modules carrying a token that matches this machine,
+        // boot and pid namespace are still cleaned, because the token establishes
+        // what these signals can only guess at. Saying "refusing to unload
+        // anything" here would be false in exactly the container-recovery case the
+        // token was added for.
+        eprintln!(
+            "[pixelpass] --repair: cannot independently determine process liveness \
+             ({reason}); modules WITHOUT an ownership token will be left alone."
+        );
+    }
+
+    let local = local_identity().context("could not establish this process's own identity")?;
+    let policy = plan::Policy {
+        local,
+        untagged: if clean_untagged {
+            plan::UntaggedPolicy::CleanByPidAlone
+        } else {
+            plan::UntaggedPolicy::Refuse
+        },
+    };
+    if clean_untagged {
+        eprintln!(
+            "[pixelpass] --repair: --repair-legacy-untagged given; untagged modules will be \
+             judged by process id ALONE. That is only safe on the machine and in the pid \
+             namespace that ran the crashed host."
+        );
+    }
+
+    let mut pulse = PulseSession::connect().context("could not observe the Pulse module table")?;
+    let modules = pulse
+        .list_modules()
+        .context("could not list Pulse modules")?;
+
+    // Say so loudly when something names our sinks but matches no shape we know:
+    // that is either a third party using our names, or a newer pixelpass whose
+    // modules this build cannot recognise. The second is how repair would go
+    // silently blind, so it never gets inferred from a clean exit.
+    let unrecognised = plan::unrecognised_pixelpass_modules(&modules);
+    if !unrecognised.is_empty() {
+        eprintln!(
+            "[pixelpass] --repair: {} module(s) name a pixelpass capture sink but do not match \
+             any shape this build knows; they are being LEFT ALONE:",
+            unrecognised.len()
+        );
+        for obs in &unrecognised {
+            eprintln!(
+                "[pixelpass] --repair:   #{} {} {}",
+                obs.id, obs.name, obs.args
+            );
+        }
+    }
+
+    let planned = plan::plan(&modules, &policy, |pid, attribution| {
+        liveness_for(&liveness, attribution, pid)
+    });
+
+    // Ours by shape, but carrying no proof of whose pid they name. Never unloaded by
+    // default — listed, so an explicit legacy run has something to look at first.
+    if !planned.untagged.is_empty() {
+        eprintln!(
+            "[pixelpass] --repair: {} module(s) are pixelpass's but carry no ownership token, so \
+             the process id in their name cannot be attributed to this machine or pid namespace. \
+             LEFT ALONE. Re-run with --repair-legacy-untagged to clean them by pid alone:",
+            planned.untagged.len()
+        );
+        for fp in &planned.untagged {
+            eprintln!(
+                "[pixelpass] --repair:   #{} {} (claims pid {})",
+                fp.id,
+                fp.shape.label(),
+                fp.pid
+            );
+        }
+    }
+    // Tokened, but the token belongs to another machine, boot or namespace.
+    if !planned.foreign.is_empty() {
+        eprintln!(
+            "[pixelpass] --repair: {} module(s) belong to another machine, boot or pid namespace; \
+             their process ids mean nothing here. LEFT ALONE:",
+            planned.foreign.len()
+        );
+        for fp in &planned.foreign {
+            eprintln!(
+                "[pixelpass] --repair:   #{} {} (claims pid {})",
+                fp.id,
+                fp.shape.label(),
+                fp.pid
+            );
+        }
+    }
+
+    if planned.is_empty() {
+        let mut held = Vec::new();
+        if !planned.live_pids.is_empty() {
+            held.push(format!(
+                "{} live pixelpass host(s)",
+                planned.live_pids.len()
+            ));
+        }
+        if !planned.unknown_pids.is_empty() {
+            held.push(format!(
+                "{} pid(s) of undeterminable liveness",
+                planned.unknown_pids.len()
+            ));
+        }
+        if held.is_empty() {
+            println!("[pixelpass] --repair: nothing to clean up.");
+        } else {
+            println!(
+                "[pixelpass] --repair: nothing to clean up ({} left alone).",
+                held.join(", ")
+            );
+        }
+        return Ok(());
+    }
+
+    let mut unloaded = 0u32;
+    let mut skipped = 0u32;
+    let mut failed = 0u32;
+
+    for fp in &planned.unload {
+        // ORDER MATTERS, and it is the opposite of what reads naturally.
+        //
+        // Liveness is asked FIRST, and the fresh snapshot is taken AFTER it. The
+        // tempting order — verify the module, then check liveness, then unload —
+        // leaves the dangerous window wide open: between `kill` returning ESRCH and
+        // the unload, this process can be descheduled long enough for the planned
+        // module to vanish, a new host to inherit both the pid and the module index,
+        // and its differently-nonced arguments to occupy that index. Nothing would
+        // re-read those arguments, so the reused index gets unloaded.
+        //
+        // Asking liveness first and re-verifying the fingerprint after it means a
+        // replacement arriving in that window is caught by the argument comparison,
+        // and only the irreducible snapshot-to-unload interval remains.
+        match attributed_liveness(&liveness, fp) {
+            Liveness::Dead => {}
+            Liveness::Alive => {
+                println!(
+                    "[pixelpass] --repair: pid {} is alive again; leaving module #{} alone",
+                    fp.pid, fp.id
+                );
+                skipped += 1;
+                continue;
+            }
+            Liveness::Unknown => {
+                eprintln!(
+                    "[pixelpass] --repair: pid {}'s liveness became undeterminable; \
+                     leaving module #{} alone",
+                    fp.pid, fp.id
+                );
+                skipped += 1;
+                continue;
+            }
+        }
+
+        // Fresh snapshot per action, taken after the liveness answer. Deliberately
+        // not hoisted out of the loop: each unload changes the module table, and the
+        // point is to decide against the table as it is *now*.
+        let current = pulse
+            .list_modules()
+            .context("could not re-list Pulse modules")?;
+        let Some(obs) = current.iter().find(|m| m.id == fp.id) else {
+            println!(
+                "[pixelpass] --repair: module #{} is already gone; skipping",
+                fp.id
+            );
+            skipped += 1;
+            continue;
+        };
+        if !fp.still_matches(obs) {
+            // The index now names something else, or the same module's
+            // arguments changed. Either way we no longer know what we would be
+            // destroying, so we do not destroy it.
+            eprintln!(
+                "[pixelpass] --repair: module #{} no longer matches what was planned \
+                 (index reused?); refusing to unload it",
+                fp.id
+            );
+            skipped += 1;
+            continue;
+        }
+        // The sink goes last in the plan, but "last" is not the same as "nothing
+        // is attached any more": a loopback unload may have failed or been
+        // skipped, or a new one may have arrived since. Ask the fresh snapshot.
+        if fp.shape == Shape::LegacyCaptureSink
+            && let Some(holder) = plan::sink_still_referenced(&current, fp.pid, fp.id)
+        {
+            eprintln!(
+                "[pixelpass] --repair: module #{} (capture sink for pid {}) is still referenced \
+                 by module #{}; leaving the sink loaded",
+                fp.id, fp.pid, holder
+            );
+            skipped += 1;
+            continue;
+        }
+
+        match pulse.unload_module(fp.id) {
+            Ok(()) => {
+                println!("[pixelpass] --repair: {}", describe(fp));
+                unloaded += 1;
+            }
+            Err(e) => {
+                eprintln!("[pixelpass] --repair: failed to unload #{}: {e:#}", fp.id);
+                failed += 1;
+            }
+        }
+    }
+
+    if !planned.live_pids.is_empty() {
+        println!(
+            "[pixelpass] --repair: left {} live pixelpass host(s) alone.",
+            planned.live_pids.len()
+        );
+    }
+    if !planned.unknown_pids.is_empty() {
+        println!(
+            "[pixelpass] --repair: left {} pid(s) alone whose liveness could not be determined.",
+            planned.unknown_pids.len()
+        );
+    }
+    if skipped > 0 {
+        // Deliberately not "changed under us": a skip can also mean the module is
+        // still referenced, or its owner's liveness stopped being decidable. The
+        // per-module reason was printed above.
+        println!("[pixelpass] --repair: skipped {skipped} module(s) (reasons above).");
+    }
+    if failed > 0 {
+        bail!("--repair: {failed} module(s) failed to unload (see errors above)");
+    }
+    println!("[pixelpass] --repair: cleaned up {unloaded} module(s).");
+    Ok(())
+}
+
+fn describe(fp: &Fingerprint) -> String {
+    format!(
+        "unloaded {} #{} (orphaned from pid {})",
+        fp.shape.label(),
+        fp.id,
+        fp.pid
+    )
+}
+
+/// Ask liveness with the module's *attribution* in hand.
+///
+/// A module whose token matches this machine, boot and pid namespace has already
+/// proven that its pid is a number meaningful here — that is the token's entire
+/// job. Running such a module through the probe's degradation checks would defeat
+/// it in exactly the situation it exists for: a host crashing inside a container
+/// leaves a token that matches perfectly, while a container marker or a multi-entry
+/// `NSpid` makes the probe answer `Unknown` for everything, so token-qualified
+/// repair would do nothing precisely where it is now safe.
+///
+/// The degradation signals therefore guard only the *untagged* path, where a bare
+/// pid is all there is and those signals are the only protection left.
+fn liveness_for(probe: &LivenessProbe, attribution: plan::Attribution, pid: u32) -> Liveness {
+    match attribution {
+        plan::Attribution::Tokened => probe.of_attributed(pid),
+        plan::Attribution::Untagged => probe.of(pid),
+    }
+}
+
+/// The same rule, for a fingerprint at execution time.
+fn attributed_liveness(probe: &LivenessProbe, fp: &Fingerprint) -> Liveness {
+    let attribution = match fp.owner {
+        Some(_) => plan::Attribution::Tokened,
+        None => plan::Attribution::Untagged,
+    };
+    liveness_for(probe, attribution, fp.pid)
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// Identity
+// ──────────────────────────────────────────────────────────────────────
+
+/// This process's machine, boot and pid-namespace identity.
+///
+/// Read from the kernel and the system, never guessed: without all three, a token
+/// cannot be compared and no module can be attributed. Dashes are stripped so every
+/// component is safe inside a single unquoted Pulse property value.
+pub fn local_identity() -> Result<plan::LocalIdentity> {
+    let machine = read_identity_file("/etc/machine-id")
+        .or_else(|_| read_identity_file("/var/lib/dbus/machine-id"))
+        .context("could not read a machine id")?;
+    let boot = read_identity_file("/proc/sys/kernel/random/boot_id")
+        .context("could not read the boot id")?;
+    let pid_ns = pid_namespace_id().context("could not read this process's pid namespace")?;
+    Ok(plan::LocalIdentity {
+        machine,
+        boot,
+        pid_ns,
+    })
+}
+
+fn read_identity_file(path: &str) -> Result<String> {
+    let raw = std::fs::read_to_string(path).with_context(|| format!("could not read {path}"))?;
+    let cleaned: String = raw
+        .trim()
+        .chars()
+        .filter(|c| c.is_ascii_hexdigit())
+        .collect();
+    if cleaned.is_empty() {
+        bail!("{path} held no usable identity");
+    }
+    Ok(cleaned)
+}
+
+/// The inode of `/proc/self/ns/pid` — the kernel's identity for a pid namespace.
+///
+/// This is the value that makes a pid meaningful: two processes in different pid
+/// namespaces can hold the same number, and only this distinguishes them.
+fn pid_namespace_id() -> Result<u64> {
+    use std::os::unix::fs::MetadataExt;
+    let meta =
+        std::fs::metadata("/proc/self/ns/pid").context("could not stat /proc/self/ns/pid")?;
+    Ok(meta.ino())
+}
+
+// ──────────────────────────────────────────────────────────────────────
+// Liveness
+// ──────────────────────────────────────────────────────────────────────
+
+/// Answers "is this pid still around", and knows when it must refuse to answer.
+///
+/// **An error is not an absence.** `Path::exists()` folds permission errors and a
+/// missing `/proc` into `false`, which here would read as "dead, go ahead and
+/// unload". Liveness is asked with `kill(pid, 0)` instead, where `EPERM` *proves*
+/// existence.
+///
+/// # The limit of what this can prove, stated rather than papered over
+///
+/// A pid can be alive and invisible. Inside a pid namespace — a container, a
+/// distrobox — `/proc/self` is perfectly visible while every process in the
+/// *parent* namespace is not, and `hidepid` has the same self-visible,
+/// others-invisible shape. Repair in such a place can reach the host's Pulse
+/// socket, see a live host's modules, get `ESRCH` for its pid and unload a running
+/// host's audio.
+///
+/// The signals below are **negative** ones: they detect *some* cases where pid
+/// numbers cannot be trusted, and every one of them fails closed. What they cannot
+/// do is prove the converse. `NSpid` reports this process's pid in each namespace
+/// that its procfs can see, and its leftmost value is relative to the pid namespace
+/// that mounted that procfs — so a nested namespace with its own `/proc` reports a
+/// single entry quite legitimately. `NSpid > 1` therefore means "definitely
+/// nested", while `NSpid == 1` means only "not detectably nested".
+///
+/// Closing that properly needs the module itself to carry an owner token (machine
+/// and boot identity plus pid-namespace identity) written at load time, with
+/// token-less modules treated as `Unknown`. That changes what pixelpass writes into
+/// the graph and how far back `--repair` can clean up, so it is a design decision
+/// recorded in the impl plan rather than guessed at here.
+struct LivenessProbe {
+    /// `None` when no signal says pid numbers are untrustworthy; `Some(reason)`
+    /// when every answer must be [`Liveness::Unknown`].
+    degraded: Option<String>,
+}
+
+impl LivenessProbe {
+    fn new() -> Self {
+        Self {
+            degraded: Self::detect_degradation(),
+        }
+    }
+
+    fn detect_degradation() -> Option<String> {
+        // Locality is deliberately NOT checked here. `PULSE_SERVER` is a fallback
+        // *list*, so `unix:/missing tcp:remote:4713` starts with "unix:" and still
+        // connects to another machine, and a remote server can be selected by client
+        // configuration with the variable unset entirely. The authoritative answer
+        // comes from `pa_context_is_local()` on the connection that actually got
+        // established — see `introspect::PulseSession::connect`.
+        match std::fs::read_to_string("/proc/self/status") {
+            Ok(status) => {
+                let nspid = status
+                    .lines()
+                    .find_map(|line| line.strip_prefix("NSpid:"))
+                    .map(|rest| rest.split_whitespace().count());
+                match nspid {
+                    Some(n) if n > 1 => {
+                        return Some(format!(
+                            "this process is in a nested pid namespace (NSpid has {n} entries), \
+                             so pids in module names may belong to processes it cannot see"
+                        ));
+                    }
+                    // NB: a single entry is not proof of the initial namespace — see
+                    // the type's doc comment. It only means nothing detected it.
+                    // A kernel too old to report NSpid cannot rule nesting out.
+                    None => {
+                        return Some(
+                            "/proc/self/status does not report NSpid, so pid-namespace identity \
+                             cannot be established"
+                                .to_string(),
+                        );
+                    }
+                    Some(_) => {}
+                }
+            }
+            Err(e) => return Some(format!("/proc/self/status could not be read: {e}")),
+        }
+        // Belt and braces: container runtimes that leave a marker.
+        for marker in ["/run/.containerenv", "/.dockerenv"] {
+            if Path::new(marker).try_exists().unwrap_or(false) {
+                return Some(format!("{marker} exists, so this is a container"));
+            }
+        }
+        None
+    }
+
+    fn degraded_reason(&self) -> Option<&str> {
+        self.degraded.as_deref()
+    }
+
+    /// Liveness for a pid this process has **no** independent reason to trust —
+    /// an untagged module. Here the degradation signals are the only protection.
+    fn of(&self, pid: u32) -> Liveness {
+        if self.degraded.is_some() {
+            return Liveness::Unknown;
+        }
+        self.of_attributed(pid)
+    }
+
+    /// Liveness for a pid already proven to belong to this machine, boot and pid
+    /// namespace by an [`plan::OwnerToken`].
+    ///
+    /// The degradation checks are deliberately skipped: they exist to guess at
+    /// whether a bare pid is meaningful, and here that is not a guess any more.
+    fn of_attributed(&self, pid: u32) -> Liveness {
+        // `kill(0, …)` signals our whole process group and a negative pid signals
+        // another group, so neither may ever reach `kill`. Neither is a pid we
+        // could have written into a sink name anyway.
+        if pid == 0 || pid > i32::MAX as u32 {
+            return Liveness::Unknown;
+        }
+        match nix::sys::signal::kill(nix::unistd::Pid::from_raw(pid as i32), None) {
+            Ok(()) => Liveness::Alive,
+            // The process exists; we merely may not signal it.
+            Err(nix::errno::Errno::EPERM) => Liveness::Alive,
+            Err(nix::errno::Errno::ESRCH) => Liveness::Dead,
+            Err(_) => Liveness::Unknown,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    // The `pactl`-text parser that used to live here is gone, and so are its
+    // tests: `introspect` gets index, name and argument as structured fields, so
+    // there is no format left to mis-parse. What replaced those tests is the live
+    // field gate, since the remaining risk is in talking to the server, which no
+    // unit test can exercise. The decisions all live in `plan`, which is pure and
+    // tested there.
+
+    /// The probe must never say `Dead` when it cannot see the whole pid space, and
+    /// must never ask `kill` about a pid that would signal something other than one
+    /// process.
+    #[test]
+    fn a_degraded_probe_never_reports_dead() {
+        let degraded = LivenessProbe {
+            degraded: Some("test".to_string()),
+        };
+        assert_eq!(degraded.of(1), Liveness::Unknown);
+        assert_eq!(degraded.of(u32::MAX), Liveness::Unknown);
+
+        let probe = LivenessProbe::new();
+        // Our own pid is alive by construction — unless this test itself runs
+        // somewhere the probe must abstain, which is exactly the other branch.
+        let me = std::process::id();
+        match probe.degraded_reason() {
+            None => assert_eq!(probe.of(me), Liveness::Alive),
+            Some(_) => assert_eq!(probe.of(me), Liveness::Unknown),
+        }
+        // `kill(0, …)` would signal our whole process group, and a pid past
+        // `i32::MAX` cannot be expressed to `kill` at all.
+        assert_eq!(probe.of(0), Liveness::Unknown);
+        assert_eq!(probe.of(u32::MAX), Liveness::Unknown);
+    }
+
+    /// A token proves the pid is meaningful here, so the probe's namespace
+    /// guesswork must not veto it. Without this, a host crashing inside a
+    /// container leaves a perfectly matching token while a container marker makes
+    /// every answer `Unknown` — and token-qualified repair does nothing in exactly
+    /// the situation the token was built for.
+    ///
+    /// This runs against a *degraded* probe deliberately: on an ordinary desktop
+    /// the two paths agree, so a test using the real probe's state would pass
+    /// whether or not the distinction exists.
+    #[test]
+    fn a_token_beats_the_degradation_signals_but_a_bare_pid_does_not() {
+        let degraded = LivenessProbe {
+            degraded: Some("pretending to be in a container".to_string()),
+        };
+        let me = std::process::id();
+
+        assert_eq!(
+            degraded.of_attributed(me),
+            Liveness::Alive,
+            "an attributed pid must still be answered when the probe is degraded"
+        );
+        assert_eq!(
+            degraded.of(me),
+            Liveness::Unknown,
+            "a bare pid must not be, since the signals are all it has"
+        );
+
+        // And the routing between them, which is what the caller actually uses.
+        assert_eq!(
+            liveness_for(&degraded, plan::Attribution::Tokened, me),
+            Liveness::Alive
+        );
+        assert_eq!(
+            liveness_for(&degraded, plan::Attribution::Untagged, me),
+            Liveness::Unknown
+        );
+    }
+}

tests/fixtures/ownership-tag-contract.txt

@@ -0,0 +1,42 @@
+# Screenshare audio exclusion — ownership tagging wire contract.
+#
+# peerspeak PRODUCES these carriers on every audio node it owns; pixelpass
+# CONSUMES them as the primary taint root of the exclusion engine. Neither
+# repo depends on the other, so this file is the contract: it is committed
+# byte-identical in both, and each repo has a test that asserts its own named
+# constants (and, on the producer side, the environment a real child Command
+# would carry) match these values exactly.
+#
+#   peerspeak/tests/fixtures/ownership-tag-contract.txt
+#   pixelpass/tests/fixtures/ownership-tag-contract.txt
+#
+# Pinned by peerspeak docs/screenshare-audio-exclusion-impl-plan.md §3 and
+# docs/screenshare-audio-exclusion-plan.md §5.1 (v3.5). Changing a value here
+# is a cross-repo breaking change: both repos must land in the same session,
+# and the phase 5 matrix must be re-run.
+#
+# Two carriers, matched as a UNION — a node is peerspeak-owned if EITHER
+# matches. Round 8 added the second because a property is invisible to the
+# PipeWire registry `global` event and readable only via a node bind, so the
+# primary taint root must not rest on one observation mechanism alone.
+
+# Carrier 1 — a node property, matched EXACTLY: `prop_value` below is the
+# ONLY spelling the consumer reads as owned. A producer emitting "true", "yes"
+# or "" is NOT owned on this carrier, and only carrier 2 would still catch it.
+#
+# ⚠️ This wording is load-bearing and it CHANGED in round 10. The consumer
+# used to accept any value other than "false"/"0", on the theory that leniency
+# over-excludes and is therefore safe. It is not: leniency buys false-positive
+# exclusion, and it let any process suppress a rival application's audio from
+# the share with a property it did not even have to spell right. Fail-closed
+# on this feature is about ANCESTRY — an unresolvable graph is not eligible —
+# not about parsing.
+prop_key=peerspeak.owned
+prop_value=1
+
+# Carrier 2 — a `node.name` prefix, announced by the registry without a bind.
+# `node.description` is deliberately NOT touched, so mixers still show "mpv".
+# Only the prefix is matched; the rest of the name is for diagnostics.
+node_name_prefix=peerspeak_owned_
+node_name_format=peerspeak_owned_<role>_<pid>
+node_name_example=peerspeak_owned_mpv_31284