Additive Patch Pipeline: patches/online-performance
Version: 1.0.11-online-playtest.2

Composes after vehicle-original-textures, retaining the completed v1.0.11
memory/render repairs and playtest 4 online/spectator chain. Authored changes
stay in this directory. Build outputs and source copies stay outside checkout.
Submodules, RecompiledFuncs and RecompiledPatches are read-only inputs.

1. Take a recoverable source snapshot before authoring this layer.
2. Run configure.py with --build, --capsule, --log and --cmake for each host.
3. Build DKRPortGame, all release-prep/v1.0.11/run_checks.py targets, the two
   vehicle fixtures and DKROnlineMenu77Checks, DKROnlineMenu80Checks,
   DKROnlineSetupChecks, DKROnlinePartyChecks and DKRDirectoryLifecycleChecks. Build the Linux vehicle
   sanitizer fixture too. Never run a game, user ROM, RSP or GPU workload.
4. Run the retained checks and this layer's run_checks.py. audit.py checks
   exact source composition, actual compiler bindings and compatibility IDs.
5. package.py uses the established payload allowlist. Verify ZIP read-back,
   AppImage squashfs contents and Linux dependency closure before handoff.

Setup-only SDK queue: 256 KiB, plus 32 KiB reserved for control/authority.
The permission is local to the authenticated send call and thread. During a
race the existing checkpoint/replica bulk limits and pacing still apply.
The application transfer window, active download slots, consent, SHA-256,
atomic publication, five repair attempts and all scene/Ready proofs remain.

Durable partial-file batches increase from 64 KiB to 1 MiB. Cancellation
still performs a best-effort flush; publication requires a successful final
flush, complete size and full SHA-256. No unverified partial becomes a mod.

One immutable desktop collection can be retained up to 768 MiB, bounded by
physical RAM / 16 and available RAM / 4. Pressure is checked again on reuse.
An unrelated collection is released before preparing another. No collection
cache limit, texture budget, guest heap, GPU fence or gameplay clock is removed.

The owned menu guard admits only known no-owner notifications through event
23 and vehicle lifecycle 100..105. Owner dispatch still runs first. Unknown
calls and invalid full-scene/owner modes continue to fail safely.

New peer IDs prevent old builds joining this owner contract. Updater signatures,
stable release files, website deployment and main are outside this playtest.

Disconnect and terminal failure clear the directory hosting state, admission
proofs and bridge queues while the DirectSession mutex is held. This
does not rely on another transport pump and does not disconnect the account.
The existing directory worker sends Close and the existing service removes the
listing/code and pending joins. No website/API deployment is required.
The next authenticated join's pending key survives room cleanup; only the
destructor forgets the whole directory session. The lifecycle fixture exercises
the production bootstrap transfer, disconnect and one-time key consumption.
