Memory stability repair: 1.0.10-memory-playtest.1

Scope
This layer includes the complete accepted spectator-admission-repair chain.
It composes two final DKRPortGame C++ units outside the checkout:
runtime_legacy_mods.cpp (primary heap admission) and runtime_hud_layout.cpp
(bounded diagnostics). A matching register-only fallback is added to each final
owned probe_native.c for vanilla/code-only sessions without an asset world.
Custom mod-service admission keeps precedence. All protected sources and earlier
layers remain read-only.
No launcher, allocator body, deferred free, model residency, GPU, save format,
wire format or checkpoint size is changed. Unknown/already expanded pools and
insufficient maps are passed through. The 1600 stock descriptors remain.

Evidence
The supplied v1.0.9/v1.0.10 logs show valid guest pools with fragmented free
space: required requests 6800 and 16800 cannot fit largest blocks 3088/15184.
The all-player detail layer clears the two original racer LOD skip flags in
spawn_object for ordinary and owned paths. Original non-custom sessions still
used a 4 MiB address ceiling. This is a confirmed resource-policy mismatch;
the logs do not contain an allocation owner census proving every missing HUD
asset came from that particular increase. Renderer water scratch fallback
warnings are a separate bounded budget and are not the logged fatal allocator.

The new known-pool ceiling is 0x807E0000, within mapped 8 MiB, with an upper
128 KiB guard. Existing admitted custom-session expansion remains unchanged.
Both original ROM revisions enter through the same resource callback, including
the existing owned mod-service dispatcher. All persistent allocation state is
still in guest RAM, covered by existing 16 MiB rollback snapshots. Peer IDs are
derived from retained IDs and the authored policy ledger to prevent mixed peers.

Checks
Configure with configure.py --build ... --capsule ... --log ..., using the
previous accepted source capsule. Build DKRPortGame and the two new
DKRMemoryStability{77,80}Checks targets plus the retained seven fixture targets.
run_checks.py runs only synthetic memory and existing ROM-free fixtures.
The allocator fixture extracts the exact final original bodies selected by the
compiler; code-mod dispatch is inactive and no game/ROM/RSP is executed.
The DKRMemoryOwned{77,80}Checks targets execute the exact native entry prefix
with synthetic dispatch stubs to cover absent/delegated mod services.
Negative controls leave >128 KiB free in 3 KiB holes and reject both reported
request sizes. The identical workload with guarded headroom must accept them.
Tests cover live resource patterns, coalescing, full-tail bounds, deferred frees,
canonical checkpoint restore, 5000 load/unload cycles and a guard canary outside
the synthetic call stack. Existing safe stops remain required under exhaustion.

audit.py verifies exact recomposition, actual compiler bindings, original source
baseline, the complete retained source audit chain, the final linked critical
guards and newly derived revision IDs. Retained intermediate IDs are checked
as source derivations; only new final IDs are required in the new binary.
package.py reuses the established allowlist for Windows ZIP and Linux AppImage.
No stable signing/deployment/publication is performed. Game/hardware/modded
multiplayer soak acceptance remains a real-user test, not a synthetic claim.
