Spectator checkpoint admission repair - playtest.4

The additive overlay includes offline-retention-repair/ReleaseOverlay.cmake
unchanged. It composes the final first-party resident_music.cpp, party runtime
and v77/v80 owned probe drivers into an external build stage. It does not edit
submodules, RecompiledFuncs or RecompiledPatches. Existing authored sources
remain byte-identical to the recoverable baseline snapshot.

The only production preparation scope is in restore_state's non-null
ConfirmedAdmission branch while staging native mod state. That object is
constructed by the existing observer admission gate after validating the
authenticated baseline's layout, cursor and irreversible save/Pak/magic
participants. Existing mod identity and padding validation happens before
the new scope. The scope ends before state_.restore mutates guest RAM.

observer_music.hpp delegates the retained PreparationScope and carries a
balanced thread-local permission. Resident music validates the entire music
checkpoint against admitted metadata before decoding. Its activate path may
then acquire the one selected recording under this explicit observer scope.
The original !allow_decode || !preparation_depth guard, 64 MiB per-recording
bound, decoded shape and PCM proof checks remain. The active library held in
staged_mods pins decoded samples through restore/commit and later playback.
Shared source libraries still contain metadata rather than all decoded songs.

Ordinary restores take the unchanged stage_checkpoint arm and cannot grant
the new permission. Silent preview scope never grants decoding permission.
No public class definition, canonical music/checkpoint layout, native sample
format, game simulation or network schema is changed. Playtest.3 peer IDs are
retained. These are matching test packages, not a signed automatic update.

Only the non-simulating observer branch counts consecutive failed admissions
or playback steps. Five failures stop that observer; actual committed
playback clears the streak. Fresh downloads/admission alone do not. The
runtime runner's existing watcher failure path disconnects only that viewer.
The log retains the concrete failure (bounded to 512 bytes), successful
admission and the first confirmed frame in each epoch. Racing proof/voting,
read-only spectator saves and authority checks are unchanged.

Tests link the actual production resident code and decoder. In-memory mono
WAVs, synthetic guest fields and both revision address tables cover a cold
cache, ordinary restore denial, authorized staging, PCM parity with a host,
warm rollback, lease release, repeated admission, two recordings, sequence and
stock/results states, malformed checkpoints, thread-local/unwind behavior,
decode shape/budget errors and cancellation. The same test linked with the
previous resident implementation reproduces the original failure.

A separate fixture includes the final party handler and retained synthetic
owner fixture. It checks real failed admission/retry flow, reason retention,
no lobby closure or racing simulation from the watcher, recovery and failure
streak reset only after committed playback. Existing 96 race-start assertions
use the final handler, and the playtest.3 retention checks remain unchanged.
Native build/source/binary/package audits are distinct from these synthetic
executions and from the owner's remaining real multiplayer acceptance test.
