Add administrative room close and reopen controls

Preserve readable private tables, discussion and pending games while closure blocks new play, joins, messages, AI and seat mutations. Add live-authorized atomic closure audits, room-version/revision fences, dedicated controls and exact saved retries. Reopen with the saved pause/join settings and current credentials; restoring a removed but closed room keeps its AI stopped.

Verified types, lint, 5356 offline tests, 52 HTTP tests and build. Seventeen dedicated authenticated HTTP groups and independent privacy/persistence review passed. Desktop/mobile browser QA confirmed one close after a lost response and refresh, persistent readable notices, retained private draft, mobile reopening and saved-seat refresh. All 2,001 baseline rooms, 4,243 seats and related records preserved. Positive production admin acceptance awaits authorized QA access; full admin and rules gates remain open.

docs/ADMIN_PANEL.md

@@ -12,7 +12,7 @@ recovery and persistence systems where suitable.
 | Administrator access | Personal access keys, server-enforced owner/operator/viewer roles, persistent eight-hour sessions, individual/all-session sign-out and operator provisioning/revocation. A room host is not a site administrator. Account-management UI and further operational permissions remain. | Prototyped |
 | Room directory | Search room codes/public player names, filter status/rules/availability, sort and paginate; show host, roster, modules, game change time, pause/join flags and bounded decision ownership. Detailed setup/shared-window ownership remains. | Prototyped |
 | Create and configure | [Create a lobby](ADMIN_ROOM_CREATION.md) with an explicitly owned new host seat, Basic/Advanced preview and initial AI configuration; invite humans and use ordinary lobby controls/voluntary host-seat handover. [Neutral lobby configuration](ADMIN_LOBBY_CONFIGURATION.md) adds rules/modules, AI seats and host assignment to an existing human without private access. Reserved human seats remain. | Prototyped, partial |
-| Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), plus [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md), have controls, durable audit, exact retries and player/AI enforcement. Close/end, archive, permanent deletion and bulk actions remain missing. | Prototyped, partial |
+| Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), [administrative close/reopen](ADMIN_ROOM_CLOSURE.md) and [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md) have controls, durable audit, exact retries and player/AI enforcement. Archive, permanent deletion and bulk actions remain missing. | Prototyped, partial |
 | Participant support | Remove disruptive participants or revoke access, manage appropriate restrictions, assist saved-seat recovery and host reassignment, and use supported AI takeover/replacement without losing forces, cards or decisions. | Missing |
 | Saved-game operations | Create/list/download backups, validate imports, restore a selected checkpoint safely, and diagnose or resume interrupted automatic work through authoritative game actions. | Missing |
 | Operations and audit | Show server/build/storage health, room/player counts and actionable errors; provide maintenance controls and a searchable record of administrator actions. | Missing |
@@ -43,6 +43,9 @@ and the host without granting private seat access.
 [Remove or restore](ADMIN_ROOM_REMOVAL.md) blocks ordinary room access while
 preserving the game, seats and access revocations. Use the Directory filter to
 find removed rooms; restoration retains prior pause and joining settings.
+[Close or reopen](ADMIN_ROOM_CLOSURE.md) ends further play without awarding a
+winner and preserves readable private tables and discussion. Reopening retains
+the saved game, pause/join settings and current credentials.
 Disabling an account invalidates its sessions; later re-enabling it cannot restore
 them. The database refuses to disable, demote or delete the final enabled owner.
 No default key, public account creation or host-to-administrator promotion exists.

docs/ADMIN_ROOM_CLOSURE.md

@@ -0,0 +1,78 @@
+# Administrative close and reopen
+
+Owners and operators can choose **Close or reopen** beside a room in
+Administration. Closing requires a reason, the exact room code and confirmation
+that active players have been warned. Reopening requires a reason and review of
+the retained pause setting. Viewer accounts can inspect availability only.
+Notices stay visible; the operation does not depend on a short timer.
+
+Closing ends further play administratively. It preserves the exact game state,
+pending decisions, official outcome and all seats. It does not invent a winner
+or replace the engine's game status. Existing authenticated players can still
+read their own table and discussion history. New joins, game decisions, AI,
+automatic continuation, messages and seat security changes stop. The closed
+notice is separate from the saved pause and joining settings, including for
+rooms that have never been paused.
+
+Reopening retains those pause/join settings and existing access revocations.
+An unpaused started game with AI resumes with a fresh 1.5-second pacing deadline;
+a paused room remains paused. No credential is restored, rotated or extended.
+Existing physical pieces, cards and sealed commitments remain in the saved game.
+
+## Retries and concurrency
+
+The tab saves the exact account/room operation before sending it. An uncertain
+response offers **Retry saved request**, including after refresh and reopening
+the controls. Its receipt confirms the original operation and reports current
+availability; replaying an old close after a later reopen cannot close it again.
+An unreadable local record requires deliberate local discard after inspecting
+the room. Discarding a retry cannot undo a server change.
+
+The server checks current owner/operator authority and both the room version and
+closure revision. The audit receipt, version fence and closure metadata commit
+atomically. Concurrent identical requests create one record. A stale or competing
+new request cannot change the room. Failed actions preserve their game, credential
+and receipt records. Privacy-safe audit metadata contains operational flags and
+timestamps, with no private hands, messages or keys.
+
+Already-completed entry, message, recovery, handover and AI-permission requests
+may still confirm their exact receipts while closed, provided their credentials
+remain valid. They cannot repeat a mutation, extend permission expiry or revive
+revoked access. Keep unconfirmed requests and private kits. A new key/transfer
+cannot be enabled until reopening. Local drafts and readable inspectors remain
+available while the table's mutation controls are disabled.
+
+## Other administrator controls
+
+Closed rooms remain in the default directory and can be filtered with
+**Availability → Closed**. **Running** excludes closed rooms. New pause/join and
+lobby configuration changes require reopening; prior exact receipts still work.
+
+[Recoverable removal](ADMIN_ROOM_REMOVAL.md) can also hide a closed room.
+Restoring it retains its closure and does not wake its AI. A removed room must be
+restored before a new close/reopen transition. Old closure receipts remain
+available to authorized administrators while it is removed.
+
+Apply additive migration `0013_admin_room_closure.sql` before this revision.
+`room_closures` stores current availability independently of pause and removal;
+`admin_room_closures` stores durable audit receipts. No existing game or credential
+rows are migrated or deleted. Archive, permanent deletion, bulk actions,
+participant support and backup/restore tools remain unfinished.
+
+## Verification
+
+Focused database/runtime tests exercise live roles and revocation, rollback,
+concurrent/stale writes, all player mutation commit fences, AI before/after sleep,
+automatic normalization, private views, exact receipts, database reopen and
+removed-plus-closed restoration. Route tests check that closed reads and exact
+AI-permission receipts do not schedule workers. Recovery rendering is checked
+without browser globals.
+
+The reusable administrator HTTP verifier creates its own QA room, checks closure
+access and disabled operations, and reopens it with its complete saved table,
+discussion and current seats intact. Browser checks cover lost successful
+responses, refresh/retry, persistent notices, retained local drafts and mobile
+controls. Source-bound checkpoint checks and saved-record comparisons are
+recorded outside the checkout. Deployed acceptance must match the pushed revision;
+local checks alone do not establish production behavior. See
+[verification workflow](VERIFICATION_WORKFLOW.md).

docs/CURRENT_STATUS.md

@@ -6,12 +6,21 @@ Expansion starts and full rules/publication acceptance remain gated.**
 
 ## Current checkpoint and work
 
-Current work adds [recoverable administrator removal/restoration](ADMIN_ROOM_REMOVAL.md):
-live authority and atomic version/revision fences block ordinary room access,
-player/AI work, seat operations and discussion while preserving saved records.
-Persistent notices and exact saved retries retain proof through temporary removal.
-Restoration retains prior pause/join settings and credential revocations.
-Close/end, archive, permanent deletion, bulk actions and full support remain open.
+Current work adds [administrative close/reopen](ADMIN_ROOM_CLOSURE.md):
+closed rooms preserve readable private tables and discussion while stopping new
+play, joins, AI and seat mutations. Exact prior receipts remain confirmable;
+reopening preserves pending decisions, credentials and pause/join flags.
+Archive, permanent deletion, bulk actions and full participant/backup support
+remain unfinished.
+
+Checkpoint `238de38` added [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md)
+and passed types/lint, 5,314 offline tests, 52 HTTP tests and build, with fourteen
+administrator HTTP groups and lost-response desktop/mobile browser QA. It is
+deployed on the NAS: container verification passed, migration 0012 applied,
+all eight prior rooms and ten seats were preserved, and public HTTPS/browser
+saved-seat restoration passed. Anonymous removal and other admin routes remain
+denied. Positive production administrator acceptance remains pending authorized
+QA operator access; the current close/reopen work is not deployed yet.
 
 Checkpoint `c0cc4de` added [neutral administrator lobby configuration](ADMIN_LOBBY_CONFIGURATION.md)
 and passed types/lint, 5,260 offline tests, 52 HTTP tests and build, with eleven

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,23 @@
 # Dune implementation status
 
+## 22 September 2026 — Administrative close/reopen prototype
+
+[Close or reopen](ADMIN_ROOM_CLOSURE.md) now separates administrative availability
+from the saved game's rules status and winner. It retains readable private tables
+and discussion, blocks new player/AI/seat/message mutations, and preserves exact
+prior receipts. Atomic audit/version/revision fences and independent closure
+metadata compose with pause, lobby configuration and recoverable removal.
+Reopening preserves credentials and pending choices, with existing AI pacing.
+
+Independent review corrected recovery-claim scope, unnecessary closed-room worker
+scheduling and typed closure errors after write races. Focused runtime checks,
+dedicated HTTP acceptance and lost-response/mobile browser QA accompany the
+checkpoint. Source-bound broad checks and preservation evidence remain private;
+production acceptance must match the deployed checkpoint. Archive, permanent
+removal, bulk operations and the rest of the full administration panel remain
+unfinished; this does not certify complete rules or open publication gates.
+
+
 ## 22 September 2026 — Recoverable room removal and restoration
 
 Added [administrator removal/restoration](ADMIN_ROOM_REMOVAL.md) with a typed-room