Add owner-only operational counts dashboard

docs/ADMIN_PANEL.md

@@ -15,7 +15,7 @@ recovery and persistence systems where suitable.
 | Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), [administrative close/reopen](ADMIN_ROOM_CLOSURE.md) and [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md) have controls, durable audit, exact retries and player/AI enforcement. [Archive/unarchive](ADMIN_ROOM_ARCHIVE.md) has separate directory filters and exact retries. Permanent deletion and bulk actions remain missing. | Prototyped, partial |
 | Participant support | [Participant AI](ADMIN_PARTICIPANT_AI.md) enables an existing difficulty on an eligible human seat in a paused game, retaining access/takeback and private custody. [Discussion controls](ADMIN_DISCUSSION.md) mute/unmute new sends while retaining history and gameplay. Participant removal, access revocation, assisted recovery and further replacement remain. Existing lobby controls can reassign the host. | Prototyped, partial |
 | Saved-game operations | [Owner-only room backups](ADMIN_BACKUPS.md) capture/list/download a size-limited, version-fenced room snapshot without changing play or access; import validation, safe checkpoint restore and interrupted-work diagnosis/resume remain missing. | Prototyped, partial |
-| Operations and audit | Show server/build/storage health, room/player counts and actionable errors; provide maintenance controls and a searchable record of administrator actions. | Missing |
+| Operations and audit | The owner-only [operations page](../app/admin/operations/page.tsx) samples build revision, room/seat flags, JSON syntax failures and backup/export counts without exposing game contents. Searchable action history, failed-attempt records, integrity/disk checks, stalled-decision diagnosis and maintenance controls remain. | Prototyped, partial |
 
 Track each area through Missing, Prototyped, Integrated, Verified and Polished.
 As implementation begins, link its controls, server actions, persistence,
@@ -64,6 +64,12 @@ state and related room-owned records without pausing or editing the room. The
 metadata directory omits private contents; downloaded JSON contains secret
 game state and hashed seat/recovery credentials. Import/restore are not available.
 
+The owner-only [operations page](../app/admin/operations/page.tsx) provides
+manual read-only samples of room lifecycle counts, active seat credentials,
+invalid JSON saves, latest room write, backup payload usage and export receipts.
+The database query repeats current owner authority. This is not an integrity
+check, disk-capacity monitor, restore validation or automated repair.
+
 The directory uses an explicit field allowlist, independent of any player view.
 It never returns hands, Traitors, predictions, plans, private messages, recovery
 records or raw saved state. Searches inspect only codes and public player names.

docs/CURRENT_STATUS.md

@@ -39,6 +39,13 @@ limits, missing import/restore and absent unified action-history entries keep
 the saved-game operations gate open. Local isolated capture/export and a
 signed-out browser denial passed; this is not deployed evidence.
 
+The owner-only [read-only operations sample](ADMIN_PANEL.md) now exposes the
+build revision, saved-room and active-seat counts, lifecycle flags, invalid
+JSON room counts, latest room write and backup/export usage. Live SQL owner
+authorization and desktop/mobile local UI checks passed. It does not inspect
+SQLite integrity, disk space, stalled turns or restore safety; no live NAS
+deployment or production administrator acceptance is claimed.
+
 The bounded [Fremen Nexus Cunning](NEXUS_FREMEN_RULES.md#connected-native-cunning-path)
 prototype connects an initially empty worm's public offer, one spent private
 card, a Karama response, a typed remote ride after the Nexus, human controls

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,21 @@
 # Dune implementation status
 
+## 28 September 2026 — owner-only operational counts
+
+`/admin/operations` now samples the build revision and live database aggregates:
+saved/removed/archived/paused/closed rooms, active seat credentials, syntactically
+invalid JSON saves, last room write, backup snapshot bytes/count and committed
+private exports. Its read query repeats owner authority in SQL and returns no
+saved state, seat token, message, backup payload or audit reason. The page is
+read-only and refreshes only on request; it makes no integrity, disk-capacity,
+repair or stalled-decision claim. Two isolated D1 tests pass for counts, live
+demotion/revocation and unchanged saved games. The production HTTP suite
+passed 54/54 with anonymous/forged-session denial, and the build includes the
+new route/page. A real local signed-out browser denied access; desktop and
+390-pixel samples rendered correctly using **mocked owner API responses** only,
+not an authenticated production owner. Full administrator operations and
+deployed acceptance remain gated; no production data was changed.
+
 ## 28 September 2026 — owner-only room backup capture
 
 The new `/admin/backups` page lets an authenticated owner capture, list and