ROLLBACK CONNECTION CHECK - PATCH PIPELINE
========================================

Problem confirmed in source
---------------------------
The legacy DirectSession preflight sends five unrelated traffic profiles for
six seconds and scores fixed RTT/loss thresholds out of ten. Its payload mix
includes large Replica/Checkpoint traffic, even though the selected backend
now uses Rollback controller histories. The restored spectator lobby instead
samples existing one-Hz heartbeat rings in the UI for seven seconds. Closing
that page interrupts its sample. Neither is a Rollback input-timing preflight.

The existing experimental_latency.hpp specifies a 30 Hz simulation and:
  usable_prediction_frames = max(prediction_window - 2, 0)
  delay = clamp(ceil((route_RTT + 8ms - usable_frames * 1000/30) * 30/1000),1,9)

The existing non-party Rollback Network services Realtime input every 33 ms
and Authoritative repair every 50 ms. The spectator PartyRuntime sends racer
inputs and their host relays over Control. Confirmed spectator output uses
Replica; checkpoints use Checkpoint. These runtime paths are NOT altered.

New isolated diagnostic
-----------------------
The final overlay composes after upstream-sync, which in turn retains the
approved restored lobby, vehicle Store, Rollback-only policy, invitation,
spectator, scene preparation and earlier accepted feature layers.

Only final DKRNetplayCore/direct_session.cpp and DKRPortGame/runtime_ui.cpp
are substituted. A separate small diagnostic sidecar is linked into netplay.
Three retained lobby includes are copied and changed only for diagnostics.
Checked-out runtime/dependency/generated game sources remain untouched.

DirectSession continues to own all credentials, route lookup and packet
authentication. New traffic reuses the preflight envelope, with a distinct
DKRC/version marker, message kind, test ID, nonce and exact per-probe timestamp.
No synthetic packet can enter a real input/Party Runtime/guest callback.
Receive interception is AFTER AEAD, provisional-privilege and replay-window
validation and additionally checks the exact admitted peer/source address.
Only an admitted host can initiate a client check. The client must explicitly
acknowledge Hello; an old client's generic echo is not accepted as support.

Host: 2-second support negotiation + 6-second measurement + 2-second drain.
Non-party racer: 30 Hz Realtime probes and 20 Hz Authoritative repair probes.
Party racer: 30 Hz Control probes.
Spectator: 20 Hz Replica probes; checkpoint channel readiness, not throughput.
Probe sizes stay below the conservative UDP datagram limit. These measure
application round-trip timing, not a replay of real controller traffic, a
maximum bandwidth benchmark, a save transfer or a checkpoint load test.

Backend-owned timing continues with other launcher panels selected. Only while
a check is active does the idle worker use the existing in-game 4 ms receive
poll instead of 12 ms. No clocks, priorities or scheduling change during a
real race. Context collection is skipped when no check/report is engaged.

Bounds and lifetime
-------------------
At most 11 remote participants; 512 pending/sampled records per participant;
bounded client duplicate tables; no synthetic outgoing backlog. Backpressure
defers/skips a probe rather than filling critical game queues. A 64 KiB queue
guard protects existing lobby work. No catch-up burst after a delayed worker.
Unsupported peers get no measurement flood. Host reports have bounded retries
with acknowledgement; older clients time out/inconclusive, never a fake pass.
Only the authenticated host can request echoes; reflected packets are no
larger than requests and client work is capped. Nonces, timestamps, test IDs,
lane and per-probe duplicate checks prevent stale/duplicate replies counting.

Room/local identity, roster/control generation, participant IDs/roles, sync
mode, manual delay, automatic/manual policy and prediction window are bound
to the check. A change, handover, stop or game launch cancels/invalidates it.
Automatic delay's ordinary heartbeat adjustments do not invalidate its sample;
the report records the effective delay at the start and makes a recommendation
without writing settings. Session reset/disconnect destroys the sidecar.

Reports
-------
Host sees every remote racer and spectator separately. Each updated client
receives the host's measurements for its own route with bounded retry/receipt.
Show sent/replied counts, median/p95 RTT, mean adjacent RTT variation, repair
timing, missing round-trip replies, queue peak/final, blocked sends and local
late probe schedules. At least 90 main replies are required for a racer timing
recommendation. Unsupported or insufficient samples are inconclusive.

Headroom uses (delay + max(window-2,0))*1000/30 - (p95_RTT+8ms).
This is the existing engine's conservative host-star arrival-budget model;
RTT is NOT divided by two or presented as measured one-way latency. Suggested
delay calls the original automatic_delay helper using the worst measured
racer p95. Spectators never affect racer recommendations or controller ports.
Missing probes are not called gameplay packet loss. There is no old ten-point
grade, no FPS estimate and no promised desync-free race. Live Rollback counters
are displayed only when the existing runtime_view says they are active.

UI keeps the accepted lobby design and action styles. The report has one
scrolling body and a pinned Close button within the existing modal height cap.
Every completed check has a distinct result ID so repeated reports reopen.

Verification / recovery
-----------------------
Source snapshot: D:/DiddykongWorkFolder/rollback-connection-20261023/baseline
Earlier Playtest 7 packages remain unchanged. The new audit re-composes each
staged source byte-for-byte, verifies final compiler bindings, runs the prior
source-contract audits, compares all retained contracts with Playtest 7, and
checks all 2,249 pre-existing authored files against their recovery inventory.
It inspects linked binaries and allowlisted archives without executing them.

No game, mod, test executable or AppImage is launched. Live network validation
and gameplay testing belong to the user. No publication, push or updater signing.
