the sending side
The desktop entry runs helium-laptop-audio. That wrapper sets PULSE_SERVER=tcp:100.64.0.9, then replaces itself with Helium. Because Helium inherits the variable, its PulseAudio-compatible output goes to the laptop instead of the local speakers.
The launcher respects an existing PULSE_SERVER override. It looks for helium, then Helium, then the first installed Flatpak whose application ID contains “helium.”
the receiving side
On saxtonhale, a user service starts after pipewire-pulse.service. Its script asks pactl to load module-native-protocol-tcp, bound to the laptop's Tailscale address. The script stays alive so the module stays loaded, and unloads it when the service stops.
The boundary is Tailscale. The PulseAudio module uses anonymous protocol authentication, but it listens only on 100.64.0.9 and accepts the Tailscale address range 100.64.0.0/10. The audio protocol is therefore carried inside the encrypted tailnet.
what it is—and is not
This is a direct PulseAudio-protocol stream, not an SSH tunnel, Bluetooth connection, or system-wide output change. Only Helium inherits the remote server setting. The brittle part is the hard-coded address: if the laptop's Tailscale IP changes, the launcher and receiver must be updated together.