v7.3.5 — Mode preferences and safer updates

Published October 27 UTC on GitHub and the signed pilot feed. Publication and download do not mean every host has installed it; check Live Lobbies for current room versions.

• Preferred difficulty is kept separately by ruleset. Catch no longer shares Standard's preference; Standard, Taiko, Mania 4K and Mania 7K retain their separate scopes. Older mixed Standard/Catch records remain intact and are not guessed or copied into Catch.

• Scheduled empty-room recreation waits while a maintenance drain is pending. A shared admission fence prevents an automatic refresh from replacing a room while an update is establishing its drain.
• A proven controller failure after the affected rooms have closed can be retried by the staged update timer. Unknown ownership, partial transactions and unproven failures remain held for review.
• Existing configurations, room intent, OAuth authorization, enrollment, catalogs, ratings and statistics are preserved. The preference database schema remains compatible with supported hosts on different versions.

First-transition limitation: The scheduled-refresh fence takes effect after v7.3.5 is running. An outgoing v7.3.3 or v7.3.4 worker does not yet have it, so a scheduled room refresh during this upgrade can still make the drain stop for review. A hold is not an installed update; retain state and use supported recovery. Occupied rooms are not force-closed.

The signed feed offers this controller update to supported v7.3.3 and v7.3.4 installations. Rooms drain independently at safe empty boundaries; the controller update waits for all required rooms and bookings to clear. Deliberately stopped slots remain stopped. A host with an uncertain operation retains its state for review.

The exact runtime was tested with full catalogs on a separate donor using synthetic providers and credentials. The tests covered active booking and occupied-room protection, a configuration edit while waiting, helper interruption and retry, an empty sibling draining, an injected controller failure followed by guarded automatic recovery, preserved settings and data, and recovery-helper pin refresh. Focused and broader regression suites passed.

One donor test observer rejected its own receipt because it used the wrong field name; an independent supplemental check verified the recorded worker identity, empty/idle pre-close state, completed native proof and post-upgrade preservation. The observer did not retain its original in-memory leave-dispatch timestamp. No actual osu! room was used for donor testing. Runtime SHA-256: 644f2cba96e720c06343b54fd7feb82ad2924e63d02c69260d8cfca5b32925f2.