Confirmed inline Track Select preview music

Reported on 24 October 2026: Online stops while selecting a custom track,
with owned-mod-service-failure / Custom music was not prepared at a confirmed
loading boundary. The owner confirmed this happens in Track Select before
starting the race. The active runtime log was exclusively locked; no running
game was stopped or modified to read it.

The accepted private native helper has two background-loading paths. Deferred
background loading resumes at confirmed scene site 7. Its existing driver
PreparationScope is explicitly silent. Inline Track Select previews instead
run load_level_for_menu at the beginning of an agreed menu tick. Their native
helper requires inline preview mode, menu ID 15, confirmed input, a clean scene
transaction and the actual completed retail constructor. The driver correctly
does not grant a decoder scope to an ordinary/replayed tick.

Both paths eventually call dkr_probe_scene_load_reset and the owned course
prepare service. The inline path had no silent scope, so State::load attempted
to acquire the selected recording and correctly hit the decoder boundary guard.
The private level-load reset is injected before the level loader's first guest
instruction. The reviewed menu wrapper retains the mode/menu identity through
that point; no guest register is guessed as a music policy.

This additive layer replaces four final first-party source copies and one
private header, outside the checkout. It does not rewrite the accepted source
capsule, dependencies, RecompiledFuncs or RecompiledPatches.

- The native reset sends a boolean derived from inline_track_preview(rdram)
  AND confirmed_menu_tick to the private course-prepare service.
- Both ROM revisions use the same new one-argument ABI. The receiver checks
  arity and the 0/1 range before entering the existing course hook.
- PreviewScope increments only silent_preparation_depth, not decoder permission.
  It is nested and unwinds inside ModWorld::dispatch before a failed native
  service can trigger its existing guest stop. No scope spans a guest longjmp.
- The existing silent empty-library MusicState path is reused. Preview capture
  and rollback therefore contain no selected recording or resident PCM need.
- Actual race construction still has the existing confirmed PreparationScope,
  and verifies the frozen recording's decoded shape and PCM proof. Checkpoint
  staging and audio callbacks keep their existing no-decode behaviour.
- A path-independent layer ledger extends both private peer identities, so
  old zero-argument and new one-argument clients cannot share a session.

Configure with configure.py over the verified frozen capsule and prepared
platform caches. It composes after online-directory and keeps the current
Scoreboard, party startup/checkpoint/departure, spectators, cars, achievements
and texture layers. This repair playtest is Windows/Linux; Android release
adapters and a new stable automatic-update publication are separate work.

audit.py recomposes the exact inputs, verifies both native endpoints, scope
balance, decoder/checkpoint/proof guards, real compiler source bindings and
the unchanged accepted directory and Scoreboard contracts. It runs the retained
static layer audits and checks every pre-repair authored file against its
recoverable snapshot. package.py uses the existing runtime allowlists and
creates a complete Windows ZIP and Linux AppImage with fresh ownership receipts.

Validation is compilation/linking and static source/binary/package inspection.
No game, mod, native test executable or AppImage is launched. The owner's
matching-peer Track Select/race/return checks are listed in PLAYTEST.txt.
