Rollback-only public online policy - 23 October 2026

This Patch Pipeline layer composes after invite-handoff. All changes are in
isolated first-party C++/UI include copies. Checked-out dependencies, original
runtime sources, RecompiledFuncs and RecompiledPatches are not edited.

rollback_policy.hpp is the common public host preset and supported-mode gate.
Public Rollback retains SynchronizationMode::ExperimentalRollback and wire
value 2. The historical enum named Rollback remains value 0; it is not renamed
or reinterpreted. Obsolete engines are not surgically deleted from the private
implementation; public hosting, rules validation and start admission reject
their mode values before they can be used.

CurrentOnlineSynchronization is constant engine 2. OnlineHostRequest starts
from default_rules. Missing settings use the same preset; valid existing
timing/player/development preferences are retained. Old backend settings are
read for compatibility, then canonicalized after the settings reader closes.
Canonical settings explicitly opt in to engine 2 and disable Auto. No saves,
mod configuration, input bindings or graphics preferences are reset.

The Host settings UI uses a fixed Rollback label rather than a one-item combo.
The rollback prediction-window and input-delay controls remain adjustable.
Development is opt-in, preserving consent, temporary progress and achievement
protection. Spectator capacity remains host-controlled.

Incoming lobby and start descriptor parsing checks the supported engine.
Generic rules/start validation applies the same gate. DirectSession host/start
adapter checks fail closed with a clear message, not a legacy fallback.
Wire schema, enum numbers, replay algorithms, rollback checkpoints, scene
budgets, renderer policy and save routing are unchanged.

The pipeline updates current user-facing labels and UI help, including status
and mod-preparation messages, without renaming internal macros or historical
build records. The preceding invitation/spectator layers remain untouched.

audit.py checks scoped replacements, shared defaults, source receipts, removed
UI choices, concrete-mode admission and retained previous layers. package.py
uses the accepted runtime allowlist for Windows ZIP and Linux AppImage.
Validation is compilation/linking and static archive/source inspection only;
no game, mod, test executable or AppImage is launched.
