DKR-R lobby stability implementation
Patch Pipeline layer: patches/lobby-stability
Test version: 1.0.9-stability-playtest.1

Scope and retained behaviour
This layer composes after music-preview-repair -> online-directory -> the
existing repair chain. It replaces six build-local first-party source units
and two launcher includes, and adds an owned SDK task submission adapter.
Original source inputs, submodules, generated
RecompiledFuncs/RecompiledPatches, website/API and FTP hosting are untouched.
The existing launcher layout, online save/consent/compatibility gates, public
directory authorization, spectator/party lifecycle and scoreboard remain.
Both rollback ROM revisions receive new matching peer build IDs, derived
from the retained music IDs and this layer's authored code. A startup line
records the version and common stability contract to identify mixed builds.

Admission scheduling
The old uploader rejected a fourth provisional sender even though the
session has eight pending request records and spectator-capable rooms can
have more than four members. The uploader now accepts at most eight routes.
Three consented clients at a time own bulk payload slots, ordered by their
consent tickets. Review/manifest/control traffic stays available to queued
clients. Slots are released on preparing, admission, cancellation or leave.
Existing transport buffer/backpressure, eight-packet bursts and no bulk
transfer during gameplay remain. An encrypted display-only queue status is
sent every 500ms. It cannot grant consent, advance bytes or satisfy proof.
Host rejection reasons use the existing authenticated 160-byte HelloAck
field. Messages are bounded, printable and redact paths. The detailed local
host reason is also logged with the request and manifest identity. Pending
mod expiry sends an explicit reason before releasing just that route.

Phase and transfer recovery
The client separates download progress from queue/liveness reports. A gap
gets up to five successful repair requests with increasing waits capped at
30 seconds. Only contiguous received/written bytes reset that gap budget.
An active queue lease pauses gap repairs for two seconds; repeated leases
cannot reset the phase's absolute deadline. Metadata/initial offer: 120s;
consent: 10m; payload transfer: 20m; preparing: 15m; final admission proof:
45s. The session's existing 30s contact/20m total pending-admission caps and
the worker's per-item resource limits still apply. A heartbeat is not a
readiness signal. Existing idempotent consent/preparing/proof retries remain.
The client keeps completed verified payloads and durable partial files when
it leaves. Retry Join waits for the previous mod worker to retire, requests
fresh normal admission, preserves racer/spectator intent, and requires review
of the current host's exact executable code offer again. It never reuses a
retired directory capability or automatically grants code consent.

Cache and preparation work
An unchanged profile's named receipt is revalidated and reused, including
when offline library roots are configured. Previously that case always
created another index and rescanned candidates. A stale named index is
quarantined and rebuilt atomically under its original identity, allowing
later rejoins to reuse the repair. Per-payload prepared assets are still
checked; damaged native or reconstructed payload caches are quarantined
individually and regenerated from verified downloads. No offline item is
removed. Importer probing is deferred until a missing reconstructed payload
actually needs it; the client's early packaged-importer check is retained.
The installed-file scan and download path can quarantine only the affected
bad completed download. Incomplete prefixes remain, and full size/SHA-256
validation remains mandatory before publication. No cached content is
trusted just because of filename, timestamp or an old progress report.
Offline retention now runs on the existing worker after lobby admission.
It publishes immutable ready resources first. Copy failures become an
offline-retention notice and cannot revoke valid lobby admission. Frontend
library refreshes are deferred while loading/playing. Existing disabled
offline defaults, journals, selections and save protections are preserved.

Launcher and diagnostics
The existing Session mods modal gains stage/total elapsed time, raw package
progress when useful, transferred/reused bytes and sampled transfer rate.
Failures gain Retry Join and Copy Join Diagnostics. Cancellation stays in
the same dialog. Each local attempt has a unique ID; logs include its role,
manifest, payload, stage, timing, bytes/cache and repair counters. Host route
IDs, the common manifest and the bootstrap match correlate paired logs.
Preparation messages name the current package. No credentials or lobby
capabilities are included in the new diagnostic report.

Startup stall: owned audio submission repair and diagnostics
The provided reduced log reached local verification/admission with three
code mods and then stalled before the pre-INTRO bootstrap handoff. Its task
warning omitted task type. It does not show the full tracks/characters join
failure, and does not prove that rendering or any one code mod is at fault.
Static tracing of the actual compiled runtime found a concrete deadlock:
the muted-audio branch of submit_rsp_task calls blocking sp_complete on the
guest thread. That waits for an SP acknowledgement from the same scheduler
which cannot resume until the submission returns. The normal SP worker
already has the correct asynchronous task/acknowledgement lifecycle.
An owned task_submission.cpp adapter delegates the unchanged SDK sp.cpp
entrypoint. It includes that file unchanged under a private function alias;
the protected source is never patched or written. During bootstrap audio
submission only, a thread-local RAII scope lets the SDK enqueue the normal
audio worker. The bootstrap presentation callback remains false outside
that narrow audio scope; graphics and save-write suppression are unchanged.
Audio queue output remains muted. No completion or acknowledgement is faked.
The adapter validates bootstrap task bounds before inspecting the type.
MSVC explicitly uses /EHs /EHc- for this C ABI so a delegated C++ exception
cannot leak the scoped permission; the Windows host test caught this issue.
The unchanged delegated SDK source hash is part of the common peer contract.
This layer also logs bootstrap begin/end, match, local slot, resources identity,
elapsed time and task type/generation. Bounded SP/DP handler-consumption and
SP acknowledgement records are enabled for each bootstrap automatically.
The existing queue re-delivery, handler validity, real SP acknowledgement,
safe startup deadlines, rollback and custom-music proof rules are retained.
No startup deadline is extended to hide a hang. The same-thread audio
deadlock path is repaired, but the untyped historical warning cannot prove
every reported hang came from it. Paired logs from the new build and the
actual full mod selection are required if a wait remains. Isolate the
three-code combination and HD textures as test variables without assuming
either is the cause.

Verification and handoff
audit.py recomposes staged sources, verifies byte/hash receipts and final
compiler bindings, checks new policies, derives both peer IDs independently,
and runs every retained music/directory/scoreboard/repair source audit.
The recoverable baseline contains 2,385 authored files; each must remain
unchanged. Policy tests exercise the production queue, gap, deadline and
rejection helpers on both OSes. An additional host-only SDK boundary fixture
compiles the production owned task adapter and checks audio routing, muted
graphics, exception unwind, invalid task addresses and thread-local isolation.
It does not execute a ROM, RSP or real scheduler. Synthetic transfer/cache tests use the real
production transfer/cache code and add corruption, partial preservation,
cancellation, traversal and Linux symlink cases. No ROM is used by these tests.
Packages use the existing complete release allowlist and fresh notes. They
are test packages only; no release signature or updater manifest is changed.
Physical multiplayer and the 20-cycle acceptance gate remain owner tests.
See PLAYTEST.txt and the delivered VALIDATION.txt for the test handoff.
