Published: GitHub installer, runtime and pinned activation. Published, queued and installed are separate states; Live Lobbies shows current rooms.

Includes v7.2.10: reliable guarded reads for .stats <player>, Catch v2 statistics downloads, private-room playtime/visits/completed-map participation/recorded PP totals, and the Saycey greeting. Previously recorded authoritative private participation after the existing sharing boundary can be recovered with separate durable cursors. Public room links, passwords, rosters and chats stay unlisted; player hidden-stat preferences still apply. Statistics use the normal background refresh and do not require a command-thread hub lookup.

The first controller successor after v7.2.9 could refuse because root read a service-owned projection without switching identity. That read now uses the correct service identity without weakening permissions. Signed release selection now prefers a supported direct predecessor before optional intermediate versions; required hops and anti-rollback remain enforced.

Affected hosts need the one-time hash-verified poolrotater-activate-v7.2.12-v4.py asset from this release, with their existing instance name. See exact activation instructions. Use this version instead of the earlier v7.2.11 activator. This queues only: no forced room closure, OAuth change, reinstall, ownership clear or settings reset. Keep the normal updater running. It installs at the verified host-wide safe empty-room boundary; deliberately stopped slots stay stopped. Active or uncertain unrelated native updates are retained for review.

Retains 155 passing statistics/privacy/compatibility methods, 12 queue/bootstrap checks and 3 actual root/service-UID checks. Additional signed direct-predecessor, mandatory-hop, HTTPS delivery and bootstrap regressions passed. Exact published v7.2.6 through v7.2.11 compatibility contracts and reproducible artifacts checked. Actual protected donor upgrades retained full catalogs and 63 configuration/credential/catalog/ownership files; no bot was started there. Sensitive-data review found only expected public source/storage hash inventories. The unchanged full suite and actual osu! gameplay were not repeated for this patch. See the release VALIDATION.json for exact scope.

Use the revision 4 script and matching .sha256 companion from the same GitHub release. The runtime and installer are unchanged. It makes verified public SDK source readable during service-identity admission and arms the exact checked native safe-update timer after queueing. waiting_empty plus timer_armed: true confirms the job is scheduled. Earlier scripts remain immutable for audit history. No room stop/start, OAuth change or ownership clear is performed by activation.

The revision4 SDK is temporarily staged under protected root custody in /opt, keeping native path checks intact. Verified public source is read-only to the service identity; private download bytes and temporary staging are removed afterward. Exact activation logic passed running-owner admission and native timer arming.