Harden participant and map ownership and validate bounded physical flight

docs/player-lifecycle.md

@@ -8,7 +8,7 @@ Native reconnect reservation and handoff remain separate from new-character admi
 
 Prison placement searches a 4×4 lattice with axis coordinates -4.5, -1.5, 1.5 and 4.5m relative to the authored center. The four inner positions are checked first, then eight edge positions, then four corners. Neighboring centers are 3m apart and remain 1.5m inside walls positioned at ±6m. The inner and edge positions are within 5m of the prison center. Terrain height and slope, physical scene/character occupancy, and pending reservations can reject a slot. Connection IDs 1 and 13 receive no special or shared position. Disconnected physical bodies still obstruct the native query.
 
-If every candidate is occupied or pending, admission waits and retries. Lack of a clear slot does not consume the native spawn-failure budget. Later arrivals first search bounded clear ground near a conscious friendly survivor outside a vehicle, with terrain-height and line-of-sight checks, then try the same prison grid. Placement does not imply a navigable route or safe proximity to enemies.
+If every candidate is occupied or pending, admission waits and retries. Lack of a clear slot does not consume the native spawn-failure budget. Later arrivals first search bounded clear ground near a conscious friendly survivor outside a vehicle, with terrain-height and line-of-sight checks, then try the same prison grid. Placement does not imply a navigable route or safe proximity to enemies. Both late-join anchors and spectator follow targets now require the exact current round body through `ERR_PlayerRoster.CurrentActor`, in addition to the existing living/friendly checks. A controlled replacement, unfinished admission or recycled connection ID cannot supply a survivor target. Spawn anchors still require consciousness and the existing placement checks; living unconscious canonical prisoners remain eligible spectator targets. If no valid spawn anchor remains, the prison-grid fallback is unchanged.
 
 The previous 25-point grid passed reservation enumeration but exhausted at eight actual actors (archive `native-2026-09-19-062251`). Adding a ring to 49 candidates while keeping the central positions first still exhausted at nine (`native-2026-09-19-062847`). Diagnostics showed character world bounds about 4×4m; the old 1.5m lattice left adjacent candidates inside those conservative query bounds. The replacement 3m lattice changes packing rather than weakening the query or lowering the required population. All sixteen candidates still pass through the unchanged clearance predicate. The prisoner fixture must populate one real player plus eleven additional physical actors before capacity is accepted; this new packing awaits that native result. Manual crowding, movement, collision and spawn usability remain required.
 
@@ -27,3 +27,5 @@ The native handler interception applies only to successor game modes or an exist
 `ERR_NativeLifecycleProbe` is an opt-in WORKBENCH fixture integrated by the central runner as `-errBaseSmoke 1 -errSmokeOutcome lifecycle`. It checks native prison capacity, physical character occupancy, actual local-controller handler rejection, exact request ownership, deferred deletion, cancellation without another life, delayed observer metadata protection and a native displaced actor. Movement checks wait 750ms and deletion checks wait 1000ms rather than assuming immediate native updates. Synthetic ticket creation is confined to WORKBENCH and never changes the real prisoner's life record or possession.
 
 The native lifecycle fixture in [050403](evidence/native-2026-09-19-050403/report.json) completes 54 assertions, including an ordinary initial prisoner spawn. It finds 20 remaining clear positions around that prisoner. No script/VM exception occurs; seven inherited vanilla resource errors remain. Earlier reserved member-name and reflected-container failures are preserved in the validation archive. Normal Core/companion escape and restart regression remains a separate check. Remote 12-player concurrent join, slow client preload, disconnect during preload, recycled connection IDs, reconnect reservation handoff/expiry and spectator streaming cleanup remain separate multiplayer acceptance work.
+
+`tests/test_participant_selection.py` executes the actual `CurrentActor`, `SpawnPosition` and server observer-selection methods with engine enumeration, geometry and streaming represented by adapters. It covers unregistered and pending actors, missing identity, disconnect, mismatched connection/body, recycled IDs, dead/foreign bodies, accepted canonical targets, cycling, loss of a previously selected target, unconscious following and unchanged prison/geometry fallback. This closes a source-proven membership omission; it does not establish native possession or multiplayer streaming behavior for the revision.