Add role-scoped administrator action history

docs/ADMIN_ACTION_HISTORY.md

@@ -0,0 +1,77 @@
+# Administrative action history
+
+Open **Administration → Action history** to review recorded operations. The
+read-only page unifies the nine existing durable receipt sources: administrator
+access, pause/join controls, room creation, lobby configuration, removal,
+close/reopen, archive, participant AI and discussion moderation. It does not
+create another audit store or change saved games.
+
+Search room/seat/account identifiers or current acting/affected administrator
+names. Filter by action group and inclusive UTC calendar dates, then browse
+25 records per page. Events sort newest first with deterministic source/receipt
+ordering for matching timestamps. New operations can move records between pages;
+refresh to fetch current history. Filters and page number live in the URL and
+survive refresh and browser navigation. No credentials or reasons enter that URL.
+
+Each record identifies the action, time, room/seat/account where recorded, actor,
+operational reason when permitted, and bounded before/after settings. Expand
+**Recorded settings** for the public configuration, lifecycle flags, revisions,
+AI difficulty or changed player circle. Names come from current administrator
+accounts; deleted accounts retain their recorded identifiers. External account
+provisioning/revocation records have no human actor attribution, and the page
+explicitly says so. A **Recorded** outcome means the operation was applied; a
+room-control operation may successfully save identical settings, and later
+operations may supersede it. It does not assert the room's current state.
+
+## Access and privacy
+
+All administrator roles may read the safe event envelope and public operational
+settings. Only a live owner/operator receives reasons; viewers receive null.
+Reasons are excluded from search for every role, preventing a hidden-reason
+match/count oracle. Search uses the same validated identifiers and names that
+can be displayed, rather than raw historical JSON. Unknown actions and malformed
+metadata retain a generic record with unavailable details.
+
+Count and page reads repeat live session, enabled-account, generation, expiry and
+role checks inside one database transaction. Reason visibility derives from that
+live role, not the role captured during earlier authentication. The browser binds
+its read to the signed-in account, clears old results on refresh/error, and
+revalidates when focus/visibility or page restoration returns. Already disclosed
+information cannot be withdrawn from a browser or copied records.
+
+The query reads durable receipts directly and joins only current administrator
+names. It does not join saved games, messages or player credentials. Hashes,
+access/session/recovery secrets, session IDs, game state, cards and private
+messages are excluded. Raw metadata never reaches the response. Ordinary room
+hosts and unauthenticated callers receive no audit history. The route is GET-only
+and uses the existing no-store, cookie-varying administration boundary.
+
+## Evidence and remaining scope
+
+Implementation: [query/projection](../db/admin-audit.ts),
+[response contract](../lib/admin-audit.ts),
+[route](../app/api/admin/audit/route.ts), [page](../app/admin/audit/page.tsx).
+No schema migration is needed.
+
+```sh
+npm test -- admin-audit
+npm run test:integration -- admin-boundary
+```
+
+Focused checks cover nine sources, shared operation IDs, deleted targets,
+malformed/secret-shaped metadata, reason visibility and search exclusion,
+commit-time demotion/revocation/expiry, UTC dates, deterministic pagination and
+strict client allowlists. A real room-creation/configuration transaction verifies
+the one-based player-circle display. The dedicated operator HTTP verifier reads
+its own newly created moderation receipts and checks account binding.
+Independent review corrected malformed role coercion, rejected-field search
+(including embedded NULs), affected-account name lookup and position-only
+configuration evidence. An isolated workerd/D1 regression exercises all nine
+sources under its five-term compound-query limit, with live role demotion and
+filtered reads. Materialized groups keep the unified query within that limit.
+
+Existing records cover successful operations only. Failed/rejected attempts,
+additional account-management actions, full operational health/diagnostics,
+backup/import/restore and the remaining participant support are still required.
+Local/browser/source-bound evidence is separate from deployed acceptance, which
+must identify the actual running revision and use authorized QA access.

docs/ADMIN_PANEL.md

@@ -15,7 +15,7 @@ recovery and persistence systems where suitable.
 | Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), [administrative close/reopen](ADMIN_ROOM_CLOSURE.md) and [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md) have controls, durable audit, exact retries and player/AI enforcement. [Archive/unarchive](ADMIN_ROOM_ARCHIVE.md) has separate directory filters and exact retries. Permanent deletion and bulk actions remain missing. | Prototyped, partial |
 | Participant support | [Participant AI](ADMIN_PARTICIPANT_AI.md) enables an existing difficulty on an eligible human seat in a paused game, retaining access/takeback and private custody. [Discussion controls](ADMIN_DISCUSSION.md) mute/unmute new sends while retaining history and gameplay. Participant removal, access revocation, assisted recovery and further replacement remain. Existing lobby controls can reassign the host. | Prototyped, partial |
 | Saved-game operations | [Owner-only room backups](ADMIN_BACKUPS.md) capture/list/download a size-limited, version-fenced room snapshot without changing play or access; import validation, safe checkpoint restore and interrupted-work diagnosis/resume remain missing. | Prototyped, partial |
-| Operations and audit | The owner-only [operations page](../app/admin/operations/page.tsx) samples build revision, room/seat flags, JSON syntax failures and backup/export counts without exposing game contents. Searchable action history, failed-attempt records, integrity/disk checks, stalled-decision diagnosis and maintenance controls remain. | Prototyped, partial |
+| Operations and audit | [Action history](ADMIN_ACTION_HISTORY.md) searches existing durable operations with safe settings and role-limited reasons. The owner-only [operations page](../app/admin/operations/page.tsx) samples build revision, room/seat flags, JSON syntax failures and backup/export counts without exposing game contents. Failed-attempt records, integrity/disk checks, stalled-decision diagnosis and maintenance controls remain. | Prototyped, partial |
 
 Track each area through Missing, Prototyped, Integrated, Verified and Polished.
 As implementation begins, link its controls, server actions, persistence,
@@ -85,7 +85,8 @@ Implementation: [panel](../app/admin/page.tsx), [access](../db/admin-access.ts),
 [additive migration](../drizzle/0008_admin_access.sql), and
 [operator CLI](../tools/admin-access.mjs). The migration's explicit SQLite triggers
 enforce final-owner protection and account revocation/provisioning audit; retain
-them when generating future schema changes. Audit browsing is still pending.
+them when generating future schema changes. [Action history](ADMIN_ACTION_HISTORY.md)
+unifies the existing successful-operation records; broader audit coverage remains.
 
 ### Initial owner and access recovery
 

docs/CURRENT_STATUS.md

@@ -92,6 +92,19 @@ authorization and desktop/mobile local UI checks passed. It does not inspect
 SQLite integrity, disk space, stalled turns or restore safety; no live NAS
 deployment or production administrator acceptance is claimed.
 
+Current work adds [action history](ADMIN_ACTION_HISTORY.md): a searchable,
+paginated view of nine durable admin receipt sources with public before/after
+settings. Owners/operators receive operational reasons; viewers do not. Queries
+preserve live authority and reject private or malformed metadata from search.
+Failed-attempt coverage, operational health and the remaining full admin scope
+are still unfinished.
+
+Discussion checkpoint `160fdc1` is pushed. Types/lint, 5,431 offline tests,
+52 HTTP tests, build, twenty-four administrator HTTP groups and desktop/mobile
+browser checks passed; all 2,230 baseline games and 4,746 seats were preserved.
+Its container workflow `36218058095` succeeded; the later NAS Apps deployment
+and current live revision are recorded above.
+
 The bounded [Fremen Nexus Cunning](NEXUS_FREMEN_RULES.md#connected-native-cunning-path)
 prototype connects an initially empty worm's public offer, one spent private
 card, a Karama response, a typed remote ride after the Nexus, human controls

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,30 @@
 # Dune implementation status
 
+## 29 September 2026 — administrator action history prototype
+
+The existing [Action history](ADMIN_ACTION_HISTORY.md) draft now has a bounded
+source-bound checkpoint. Its read-only endpoint joins nine durable receipt
+families, projects only public operational settings and identifier/name fields,
+and returns reasons only to a live owner/operator role. Search excludes raw
+JSON, messages, saved games, secrets and reasons; pagination/count and role
+rechecks share the same database batch. Viewer and anonymous access stay
+restricted. No game row is read or changed by the history query.
+
+Ten focused offline audit/D1 cases pass, including a workerd compound-query
+regression, malformed metadata, deleted accounts, filtered pagination and
+commit-time demotion/revocation. The administrator HTTP boundary passes two
+focused cases (54/54 in the last full local HTTP suite). An isolated non-test
+in-memory query returned only the two account-event envelopes, without
+credential contents. Browser inspection showed signed-out denial and read-only
+operator/viewer fixtures at desktop/mobile widths; viewer reasons stayed
+hidden and mobile had no horizontal overflow. Independent read-only security
+review found no concrete authorization or privacy defect. Typecheck, lint,
+5,756/5,756 offline tests and the app build passed with this draft present.
+The dedicated signed-in QA operator HTTP verifier was not run: it revokes
+all sessions for its account and requires a separate authorized QA key.
+This is not deployed acceptance or complete administration; failed-attempt
+history, broader operations and backup/restore remain pending.
+
 ## 29 September 2026 — Fremen Nexus Betrayal pre-blow worm suppression
 
 The second printed Betrayal alternative now spends the physical Fremen Nexus