Record authenticated local integrity check verification

docs/CURRENT_STATUS.md

@@ -213,10 +213,12 @@ The owner-only [operations page](ADMIN_PANEL.md) samples build revision,
 room/seat and lifecycle counts, invalid JSON, latest write and backup usage.
 It now also offers a separate **manual** SQLite quick/foreign-key check.
 Only owner requests can run it; the result contains pass/fail and time, never
-private rows or raw diagnostics. In-memory SQLite tests and disposable
+private rows or raw diagnostics. In-memory SQLite tests and an authenticated
-local D1 command probes passed; built-worker owner UI and live NAS checks
+owner request against an isolated built Wrangler worker passed. The same worker
-remain unverified. It is not a disk-capacity, restore-safety or game-rule
+reported a deliberately orphaned foreign key as failed without exposing its row;
-validation tool. No game or seat changes during a check.
+the phone-width owner UI showed both outcomes and the no-auto-repair warning.
+Live NAS checks remain unverified. This is not a disk-capacity, restore-safety
+or game-rule validation tool. No game or seat changes during a check.
 
 Current work adds [action history](ADMIN_ACTION_HISTORY.md): a searchable,
 paginated view of nine durable admin receipt sources with public before/after

docs/IMPLEMENTATION_STATUS.md

@@ -25,6 +25,16 @@ database scan or deployed revision was exercised. Disk capacity,
 backup restore safety, stalled-decision diagnosis and complete
 administration remain unfinished.
 
+Follow-up isolated built-worker verification used a disposable migrated D1
+database and provisioned owner: authenticated `GET /api/admin/operations?integrity=1`
+returned only time and two pass flags (both passed). After inserting one
+orphaned test seat while the worker was stopped, the same endpoint returned
+`sqlite: passed`, `foreignKeys: failed` and no row details. The actual owner
+Operations page displayed both outcomes at phone width, including the
+protected-snapshot/no-auto-repair warning. The earlier programmatic Miniflare
+batch timeout remains an initial test limitation; this later workerd run proves
+the HTTP path locally, not the live NAS database or deployed revision.
+
 ## 30 September 2026 — Semuta after BG Charity Karama
 
 In the explicit Richese preview, a clean printed Karama