Add recoverable administrator room removal and restoration

Preserve room JSON, seats, credentials and messages while removed rooms deny ordinary reads and writes. Add deliberate room-scoped controls, removed-directory filters, persistent player notices and live-authorized atomic version/revision audit receipts. Retain uncertain room/seat requests and hidden recovery drafts through removal; restore the prior pause/join settings without reviving revoked credentials.

Fix AI readiness after a joining human or human faction change so real lobby starts remain legal.

Verified types, lint, 5314 offline tests, 52 HTTP tests and build. Fourteen authenticated HTTP groups and independent privacy/persistence review passed. Desktop/mobile browser QA confirmed a saved removal after a lost response and refresh, one audit on exact retry, persistent notices and recovery draft continuity. All 1,945 baseline rooms, 4,121 seats and related records preserved. Positive authenticated production admin acceptance remains pending authorized QA operator access; full admin and rules gates remain open.

app/api/admin/rooms/[code]/removal/route.ts

@@ -0,0 +1,35 @@
+import { env, waitUntil } from 'cloudflare:workers';
+import { AdminError, requireAdmin } from '@/db/admin-access';
+import { applyAdminRemoval, readAdminRemoval } from '@/db/admin-removal';
+import { resumeRoom } from '@/db/room-continuation';
+import { validAdminRemovalInput } from '@/lib/admin-removal';
+import { adminBody, adminFailure, adminResponse, adminToken } from '@/lib/admin-http';
+
+function code(request: Request) {
+  const code = new URL(request.url).pathname.split('/').at(-2)?.toUpperCase() ?? '';
+  if (code.length !== 8 || !/^[A-Z2-9]{8}$/.test(code)) throw new AdminError('Enter the eight-character room code.', 400);
+  return code;
+}
+
+export async function GET(request: Request) {
+  try {
+    const identity = await requireAdmin(env.DB, adminToken(request));
+    if (request.headers.has('X-Dune-Admin-Id') && request.headers.get('X-Dune-Admin-Id') !== identity.id)
+      throw new AdminError('The signed-in administrator changed. Reload administration before continuing.', 401);
+    return adminResponse(await readAdminRemoval(env.DB, identity, code(request)));
+  } catch (error) { return adminFailure(error); }
+}
+
+export async function POST(request: Request) {
+  try {
+    const input = await adminBody(request, env.DUNE_PUBLIC_ORIGIN);
+    const identity = await requireAdmin(env.DB, adminToken(request), ['owner', 'operator']);
+    if (request.headers.get('X-Dune-Admin-Id') !== identity.id)
+      throw new AdminError('The signed-in administrator changed. Reload administration before continuing.', 401);
+    if (!validAdminRemovalInput(input)) throw new AdminError('Choose removal or restoration, current versions and an operational reason.', 400);
+    const room = code(request);
+    const result = await applyAdminRemoval(env.DB, identity, room, input);
+    if (!result.replayed && !result.room.removed && !result.room.paused) waitUntil(resumeRoom(room));
+    return adminResponse(result);
+  } catch (error) { return adminFailure(error); }
+}

app/api/rooms/[code]/control/route.ts

@@ -6,6 +6,7 @@ import {
   claimSeatHandover,
   recoverSeat,
   SeatControlError,
+  RoomEntryError,
   setRecoveryKey,
   setSeatAiDelegate,
   revokeSeatAiDelegate,
@@ -124,7 +125,7 @@ export async function POST(req: Request) {
       try {
         existing = await authenticate(code, token);
       } catch (error) {
-        if (!(error instanceof RuleError)) throw error;
+        if (error instanceof RoomEntryError && error.code === 'ROOM_REMOVED' || !(error instanceof RuleError)) throw error;
       }
       if (existing && existing.playerId !== input.playerId)
         throw new SeatControlError(
@@ -173,7 +174,7 @@ export async function POST(req: Request) {
               ? 'Invalid JSON.'
               : 'The server could not complete this seat request.',
         code:
-          error instanceof SeatControlError
+          (error instanceof SeatControlError || error instanceof RoomEntryError)
             ? error.code
             : error instanceof RuleError
               ? 'INVALID_SESSION'
@@ -183,7 +184,7 @@ export async function POST(req: Request) {
       },
       {
         status:
-          error instanceof SeatControlError
+          (error instanceof SeatControlError || error instanceof RoomEntryError)
             ? error.status
             : error instanceof RuleError
               ? 409

app/api/rooms/[code]/messages/route.ts

@@ -1,6 +1,6 @@
 import { env } from 'cloudflare:workers';
 import { requestOrigin } from '@/lib/request-origin';
-import { authenticate } from '@/db/rooms';
+import { authenticate, RoomEntryError } from '@/db/rooms';
 import { readTableTalk, sendTableTalk, TableTalkError } from '@/db/table-talk';
 import { RuleError } from '@/game/engine';
 const noStore = { 'Cache-Control': 'no-store' };
@@ -50,6 +50,7 @@ async function handle(req: Request, write: boolean) {
   } catch (error) {
     return Response.json(
       {
+        ...((error instanceof TableTalkError || error instanceof RoomEntryError) && error.code ? { code: error.code } : {}),
         error:
           error instanceof TableTalkError || error instanceof RuleError
             ? error.message
@@ -59,7 +60,7 @@ async function handle(req: Request, write: boolean) {
       },
       {
         status:
-          error instanceof TableTalkError
+          (error instanceof TableTalkError || error instanceof RoomEntryError)
             ? error.status
             : error instanceof RuleError
               ? 409

app/api/rooms/[code]/route.ts

@@ -89,7 +89,7 @@ export async function POST(req: Request) {
         try {
           auth = await authenticate(code, existing);
         } catch (error) {
-          if (!(error instanceof RuleError)) throw error;
+          if (error instanceof RoomEntryError && error.code === 'ROOM_REMOVED' || !(error instanceof RuleError)) throw error;
         }
       }
       if (body.entry === undefined && auth) {