====== v7.0.8 — distributed retirement and update-timing repair ======

^ Status | Technically qualified and prepared; not yet published to the live feed or confirmed installed at the October 15, 2026 Pacific review |
^ Required first step | The existing v7.0.6 operator runs the one-time catch-up and returns its ready receipt before publication |

===== Carry the repair into the operator runtime =====
This is the exact compatible successor to the published operator v7.0.6 baseline. It carries the bounded normal-room retirement and canceled-predecessor target checks from [[updates:v7_0_7|the owner repair]], while retaining the operator's complete updater, stable launcher, network agent and reporting. Only the package version, provider service and controller updater change; interpreter, dependencies, storage and gameplay remain intact.

===== Give the ordinary timer enough time =====
Installed testing showed that v7.0.6's 90-second private-admission deadline can expire before two normally scheduled observations complete. The repaired bound is 240 seconds inside the existing 300-second native gate lease. The 30-second continuously empty/idle window, minimum 15-second late-join drain, fresh roster/ownership checks and final recheck remain mandatory. A longer scheduling bound does not make stale observations valid.

The first hop needs a one-time local helper because the already installed v7.0.6 code cannot receive its own repair before upgrading. That helper delegates only to the existing protected updater, preserves saved consent and service definitions, refuses held or unsupported state, and exits after the exact successor is installed. It does not reinstall, request new OAuth credentials or force players out. The maintainer supplies the catch-up privately and waits for readiness before publishing.

After this repair, qualified routine compatible updates use the normal background timer without a GitHub ZIP or a per-release instruction relayed by the owner. Initial opt-in, unsupported migrations, trust changes and uncertain recovery can still need an operator. Shared-controller changes still wait for every configured room; worker-only changes use the individual-room path.

===== Qualification completed =====
Full prepared Standard, Mania 4K and Mania 7K catalogs were loaded into a two-room native installed donor test with invented players/provider traffic, a real signed HTTPS release origin and authenticated hub reporting. The exact v7.0.6-to-v7.0.8 transition passed using the unchanged catch-up. A separate private, explicitly unpublishable test successor then passed using only the ordinary unchanged timer.

An occupied sibling kept playing; a late join canceled admission; later all-empty handovers completed. Effective settings, identity, catalogs, enrollment, network operation, 12 pending votes and 20 history rows were retained. Three startup authorization/refresh witnesses passed. The ordinary-timer admission took approximately 117 seconds, reproducing why the old 90-second bound was insufficient. All donor resources were cleaned up.

Revised controller coverage passed 23 checks; unchanged provider and updater coverage had already passed 18 and 68 checks. These are separate coverage sets. A final test-observer permission error was corrected against retained stopped state without replaying the successful updates. Full unrelated gameplay/calculator suites and new real osu! gameplay were not repeated. No synthetic successor is a published release.

The owner remains on its independent v7.0.5-to-v7.0.7 queue. This prepared operator release does not replace that queue or change anyone's local update consent.

[[updates:v7_0_6|Operator updater bootstrap]] · [[updates:v7_0_7|Queued owner repair]] · [[updates:start|Release history]]