Frontend robustness batch: silent [] on directory-load errors; protest count ignores reversals; Take top/Laps clear-to-1; update_round after heats ran; timer persist-failure status

[ryan-johnson2]

From the 2026-07-03 release review (confirmed, minor — batched):

• LiveRaceControl/Marshaling/global-header pilot+heat loads swallow fetch errors into [] → raw refs render with no error state (mirror the Results error-state fix).
• Marshaling's open-protest count ignores ProtestResolved reversals → Finalize looks available when the server will reject it.
• Rounds form: clearing 'Take top' or 'Laps' keeps Submit enabled and silently saves 1.
• events.rs update_round permits rewriting format/win_condition/seeding of a round whose heats already ran (silently rescoring finalized results) — gate or warn.
• Timer registry persist-failures return 404/400 with memory already mutated (mirror the fix(primitives): backend validation + safety hardening for v1 #330 registry I/O→500 fix).

[ryan-johnson2]

Fixed across #345 (silent-[] error states with retry in Live control/Marshaling/header; protest count now reversal-aware, matching the server gate; Take top/Laps clear now blocks submit) and #346 (update_round-adjacent: ScheduleHeat re-seed guard). Two sub-items intentionally remain open questions and move to fresh tracking if needed: update_round rewriting a raced round's config (partially mitigated by freeze-at-fill #343), and timer-registry persist-failure status mapping.