Add recoverable administrator room removal and restoration

Preserve room JSON, seats, credentials and messages while removed rooms deny ordinary reads and writes. Add deliberate room-scoped controls, removed-directory filters, persistent player notices and live-authorized atomic version/revision audit receipts. Retain uncertain room/seat requests and hidden recovery drafts through removal; restore the prior pause/join settings without reviving revoked credentials.

Fix AI readiness after a joining human or human faction change so real lobby starts remain legal.

Verified types, lint, 5314 offline tests, 52 HTTP tests and build. Fourteen authenticated HTTP groups and independent privacy/persistence review passed. Desktop/mobile browser QA confirmed a saved removal after a lost response and refresh, one audit on exact retry, persistent notices and recovery draft continuity. All 1,945 baseline rooms, 4,121 seats and related records preserved. Positive authenticated production admin acceptance remains pending authorized QA operator access; full admin and rules gates remain open.

docs/ADMIN_PANEL.md

@@ -12,7 +12,7 @@ recovery and persistence systems where suitable.
 | Administrator access | Personal access keys, server-enforced owner/operator/viewer roles, persistent eight-hour sessions, individual/all-session sign-out and operator provisioning/revocation. A room host is not a site administrator. Account-management UI and further operational permissions remain. | Prototyped |
 | Room directory | Search room codes/public player names, filter status/rules/availability, sort and paginate; show host, roster, modules, game change time, pause/join flags and bounded decision ownership. Detailed setup/shared-window ownership remains. | Prototyped |
 | Create and configure | [Create a lobby](ADMIN_ROOM_CREATION.md) with an explicitly owned new host seat, Basic/Advanced preview and initial AI configuration; invite humans and use ordinary lobby controls/voluntary host-seat handover. [Neutral lobby configuration](ADMIN_LOBBY_CONFIGURATION.md) adds rules/modules, AI seats and host assignment to an existing human without private access. Reserved human seats remain. | Prototyped, partial |
-| Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md) have controls, durable audit, exact retries and player/AI enforcement. Close/end, archive, restore and recoverable/permanent removal remain missing. | Prototyped, partial |
+| Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), plus [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md), have controls, durable audit, exact retries and player/AI enforcement. Close/end, archive, permanent deletion and bulk actions remain missing. | Prototyped, partial |
 | Participant support | Remove disruptive participants or revoke access, manage appropriate restrictions, assist saved-seat recovery and host reassignment, and use supported AI takeover/replacement without losing forces, cards or decisions. | Missing |
 | Saved-game operations | Create/list/download backups, validate imports, restore a selected checkpoint safely, and diagnose or resume interrupted automatic work through authoritative game actions. | Missing |
 | Operations and audit | Show server/build/storage health, room/player counts and actionable errors; provide maintenance controls and a searchable record of administrator actions. | Missing |
@@ -40,6 +40,9 @@ Owners/operators can also [create a configured lobby](ADMIN_ROOM_CREATION.md),
 with explicit new-host ownership and saved exact retries.
 [Configure lobby](ADMIN_LOBBY_CONFIGURATION.md) changes supported rules, AI seats
 and the host without granting private seat access.
+[Remove or restore](ADMIN_ROOM_REMOVAL.md) blocks ordinary room access while
+preserving the game, seats and access revocations. Use the Directory filter to
+find removed rooms; restoration retains prior pause and joining settings.
 Disabling an account invalidates its sessions; later re-enabling it cannot restore
 them. The database refuses to disable, demote or delete the final enabled owner.
 No default key, public account creation or host-to-administrator promotion exists.
@@ -109,7 +112,9 @@ authentication, cookie properties, ordinary-host denial, directory privacy,
 session revocation and unchanged game/seat continuation. Operator/owner QA keys
 also create dedicated rooms for joining locks, pause/takeback/resume,
 administrator creation, invitations, voluntary host handover and neutral lobby
-configuration with existing-human host assignment and a real game start. Private reports retain
+configuration with existing-human host assignment and a real game start. They
+also remove/restore a separate QA game, preserving its paused state, discussion,
+saved seats and revoked credentials. Private reports retain
 room IDs and safe outcomes, never keys/cookies. The container verifier provisions
 its own disposable QA account and checks admin-session continuity across restart
 and replacement, followed by the HTTP flow and HTTPS-proxy cookie behavior.

docs/ADMIN_ROOM_REMOVAL.md

@@ -0,0 +1,70 @@
+# Recoverable room removal
+
+In **Administration**, owners and operators can choose **Remove or restore**
+for a room. Removal requires an operational reason, the exact room code and
+confirmation that active players have been warned. It immediately blocks
+ordinary private access, invitations, player actions, AI continuation, seat
+security operations and discussion. The saved game, seats, messages, pending
+choices and existing credential revocations remain stored.
+
+The directory defaults to active rooms. Choose **Removed rooms** or **All rooms**
+to find a removed room and restore it. Restoration retains the previous pause
+and joining-lock settings. Running AI resumes at the existing pace; a paused
+room stays paused. Removed rooms remain readable through the administrator's
+strict public metadata view, without granting private-seat access.
+
+## Uncertain responses and player notices
+
+Each removal/restoration saves an account- and room-bound request in this tab
+before submission. If its response is lost, **Retry saved request** confirms the
+same operation. After refresh, find the room using **All rooms** and reopen its
+controls. A replay never applies an old removal again after later restoration.
+Success and recovery text remain visible until the operator takes another action.
+
+Players see a persistent removal notice with **Check for restoration** and
+**Return home**. Polling and automatic requests stop after removal is observed;
+the table and discussion are hidden. Keep the tab open for any unconfirmed room,
+recovery, handover or permission request. Its exact proof is retained. Existing
+seat controllers remain mounted but hidden/disabled so an in-memory recovery
+draft is not discarded. This is not a claim to erase data already delivered to
+a browser. A successful explicit restoration check restores the same saved seat.
+An invitation without a saved seat returns to joining once restoration is confirmed.
+
+An administrator's unconfirmed creation receipt also preserves its private retry
+proof while the room is removed. Temporary inaccessibility must not discard the
+only proof needed to reclaim the newly created host seat after restoration.
+
+## Authority and storage
+
+Migration [0012](../drizzle/0012_admin_room_removal.sql) adds room availability
+metadata and durable administrator removal receipts; it does not delete or
+replace existing saved records. Live authorization, expected room version and
+removal revision guard an atomic transition and its audit. Both removal and
+restoration advance the room version, rejecting stale in-flight actions.
+Ordinary state reads/writes and AI work check availability, including after
+asynchronous work. Player endpoints return `ROOM_REMOVED`/410 without a cookie
+or private state. Restoring never revives a revoked credential.
+
+See [backend](../db/admin-removal.ts), [controls](../components/admin-room-removal.tsx),
+[client proof validation](../lib/admin-removal-client.ts) and
+[HTTP boundary](../app/api/admin/rooms/[code]/removal/route.ts).
+
+## Evidence and remaining scope
+
+Focused tests cover live permission changes, stale/concurrent transitions,
+exact receipts, physical-state and related-record preservation, player/AI/seat
+and message fences, strict public projections, and temporary-removal proof
+retention. The dedicated administrator HTTP verifier exercises a real paused
+game with two human seats, an AI and a revoked old host cookie, then restores it
+and compares the full private game view and discussion. It creates its own room
+and restores its flags afterward. Independent review and source-bound checks
+accompany the checkpoint; browser and deployed results are recorded separately.
+
+These checks also exposed a lobby readiness bug: a joining human or human
+faction change could clear AI readiness and block start. Those changes now clear
+only human readiness; focused JSON continuation tests and the HTTP start cover it.
+
+Close/end, archive, permanent deletion, bulk operations, participant support and
+backup/import workflows remain unfinished. Recoverable removal does not satisfy
+those separate [administration requirements](ADMIN_PANEL.md). No existing human
+room is used for removal tests, and no database reset is authorized.

docs/CURRENT_STATUS.md

@@ -6,11 +6,21 @@ Expansion starts and full rules/publication acceptance remain gated.**
 
 ## Current checkpoint and work
 
-Current work adds [neutral administrator lobby configuration](ADMIN_LOBBY_CONFIGURATION.md):
-supported rules/modules, AI seat management and host assignment to an existing
-human without private seat access. Exact saved requests, live authority and
-version fences preserve concurrent play and saved continuation. Reserved human
-seats, full participant support, archive/removal and backups remain unfinished.
+Current work adds [recoverable administrator removal/restoration](ADMIN_ROOM_REMOVAL.md):
+live authority and atomic version/revision fences block ordinary room access,
+player/AI work, seat operations and discussion while preserving saved records.
+Persistent notices and exact saved retries retain proof through temporary removal.
+Restoration retains prior pause/join settings and credential revocations.
+Close/end, archive, permanent deletion, bulk actions and full support remain open.
+
+Checkpoint `c0cc4de` added [neutral administrator lobby configuration](ADMIN_LOBBY_CONFIGURATION.md)
+and passed types/lint, 5,260 offline tests, 52 HTTP tests and build, with eleven
+dedicated administrator HTTP groups and lost-response desktop/mobile browser QA.
+It is deployed on the NAS: container verification passed, migration 0011 applied,
+all eight prior rooms and ten seats were preserved, and public HTTPS/browser
+saved-seat restoration passed. Anonymous creation, control and configuration
+requests remain denied. Positive production administrator acceptance remains
+pending authorized QA operator access.
 
 Checkpoint `e7d4efc` added [administrator room creation](ADMIN_ROOM_CREATION.md)
 and passed types/lint, 5,240 offline tests, 52 HTTP tests and build, with independent

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,19 @@
 # Dune implementation status
 
+## 22 September 2026 — Recoverable room removal and restoration
+
+Added [administrator removal/restoration](ADMIN_ROOM_REMOVAL.md) with a typed-room
+confirmation, persistent operator/player notices, removed-room directory filters,
+live authorization and atomic version/revision audit receipts. Removed rooms deny
+private reads, joins, actions, AI, seat changes and discussion; restoration keeps
+saved state, previous pause/join flags and credential revocations. Exact retries
+retain proof across refresh, lost responses and temporary removal. Independent
+review repaired stale client removal markers without discarding recovery drafts.
+The dedicated HTTP flow also exposed and fixed AI lobby readiness after a human
+joins or changes faction. Focused, browser and required source-bound evidence
+accompany this checkpoint. Full administration and authenticated deployed
+acceptance remain unfinished.
+
 ## 22 September 2026 — Neutral administrator lobby configuration
 
 Added [rules/modules, AI configuration and existing-human host assignment](ADMIN_LOBBY_CONFIGURATION.md)