This question of opening up “/music” is specific to the purl.org policies rather than the PURLZ software in general. The answer might be of general interest to other PURLZ installations, though, so I’ll give it a shot. If anyone wants to follow up, though, you should consider removing persist...@googlegroups.com before hitting send.
The notion of public=true/false is a bit problematic. People who initiate requests to a PURL server must choose one-or-the-other. As the administrator, though, I can’t override that preference from the UI. In the past, we approved domains pretty liberally and didn’t pay much attention to whether they were marked as public or private. In hindsight, I wish we had taken more care. I am less willing to approve broadly named like “/music” now than has been the case in the past. It’s too late in this case, but I’d rather see /music shut down completely rather than opened up for chaos.
My suggestion is to request your own reasonably-narrow domain name and mark it as private.