Add owner-only manual database integrity check

docs/ADMIN_PANEL.md

@@ -15,7 +15,7 @@ recovery and persistence systems where suitable.
 | Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), [administrative close/reopen](ADMIN_ROOM_CLOSURE.md) and [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md) have controls, durable audit, exact retries and player/AI enforcement. [Archive/unarchive](ADMIN_ROOM_ARCHIVE.md) has separate directory filters and exact retries. Permanent deletion and bulk actions remain missing. | Prototyped, partial |
 | Participant support | [Participant AI](ADMIN_PARTICIPANT_AI.md) enables an existing difficulty on an eligible human seat in a paused game, retaining access/takeback and private custody. [Discussion controls](ADMIN_DISCUSSION.md) mute/unmute new sends while retaining history and gameplay. Participant removal, access revocation, assisted recovery and further replacement remain. Existing lobby controls can reassign the host. | Prototyped, partial |
 | Saved-game operations | [Owner-only room backups](ADMIN_BACKUPS.md) capture/list/download a size-limited, version-fenced room snapshot without changing play or access; import validation, safe checkpoint restore and interrupted-work diagnosis/resume remain missing. | Prototyped, partial |
-| Operations and audit | [Action history](ADMIN_ACTION_HISTORY.md) searches existing durable operations with safe settings and role-limited reasons. The owner-only [operations page](../app/admin/operations/page.tsx) samples build revision, room/seat flags, JSON syntax failures and backup/export counts without exposing game contents. Failed-attempt records, integrity/disk checks, stalled-decision diagnosis and maintenance controls remain. | Prototyped, partial |
+| Operations and audit | [Action history](ADMIN_ACTION_HISTORY.md) searches existing durable operations with safe settings and role-limited reasons. The owner-only [operations page](../app/admin/operations/page.tsx) samples build revision, room/seat flags, JSON syntax failures and backup/export counts without exposing game contents. An explicit owner action runs read-only SQLite quick/foreign-key checks and returns only pass/fail, never corrupt row details. Failed-attempt records, disk capacity, stalled-decision diagnosis and maintenance controls remain. | Prototyped, partial |
 
 Track each area through Missing, Prototyped, Integrated, Verified and Polished.
 As implementation begins, link its controls, server actions, persistence,
@@ -76,8 +76,13 @@ game state and hashed seat/recovery credentials. Import/restore are not availabl
 The owner-only [operations page](../app/admin/operations/page.tsx) provides
 manual read-only samples of room lifecycle counts, active seat credentials,
 invalid JSON saves, latest room write, backup payload usage and export receipts.
-The database query repeats current owner authority. This is not an integrity
-check, disk-capacity monitor, restore validation or automated repair.
+The database query repeats current owner authority. **Run integrity check** is
+a separate, explicit read-only D1 quick check and foreign-key check. It repeats
+owner authority inside the query batch and returns only pass/fail and sample
+time, never a table name, row ID, private save or SQLite diagnostic text.
+The check can take time; a failed check calls for a protected snapshot and
+private diagnosis, not automatic repair. It does not prove disk capacity,
+backup recoverability, valid game rules or the absence of stalled decisions.
 
 The directory uses an explicit field allowlist, independent of any player view.
 It never returns hands, Traitors, predictions, plans, private messages, recovery

docs/CURRENT_STATUS.md

@@ -209,12 +209,14 @@ limits, missing import/restore and absent unified action-history entries keep
 the saved-game operations gate open. Local isolated capture/export and a
 signed-out browser denial passed; this is not deployed evidence.
 
-The owner-only [read-only operations sample](ADMIN_PANEL.md) now exposes the
-build revision, saved-room and active-seat counts, lifecycle flags, invalid
-JSON room counts, latest room write and backup/export usage. Live SQL owner
-authorization and desktop/mobile local UI checks passed. It does not inspect
-SQLite integrity, disk space, stalled turns or restore safety; no live NAS
-deployment or production administrator acceptance is claimed.
+The owner-only [operations page](ADMIN_PANEL.md) samples build revision,
+room/seat and lifecycle counts, invalid JSON, latest write and backup usage.
+It now also offers a separate **manual** SQLite quick/foreign-key check.
+Only owner requests can run it; the result contains pass/fail and time, never
+private rows or raw diagnostics. In-memory SQLite tests and disposable
+local D1 command probes passed; built-worker owner UI and live NAS checks
+remain unverified. It is not a disk-capacity, restore-safety or game-rule
+validation tool. No game or seat changes during a check.
 
 Current work adds [action history](ADMIN_ACTION_HISTORY.md): a searchable,
 paginated view of nine durable admin receipt sources with public before/after

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,30 @@
 # Dune implementation status
 
+## 30 September 2026 — Owner-only manual integrity check
+
+Administration → Operations now has a separate **Run integrity check**
+control. An owner-only request batches live owner authority with
+SQLite `quick_check(1)` and a bounded foreign-key existence query;
+the response contains only pass/fail and sample time. It exposes no
+database diagnostic, table, row, game state or credential and makes
+no repair. Refresh/owner changes clear stale browser results. A
+failed check advises a protected snapshot and private investigation,
+not automatic restore.
+
+Focused in-memory SQLite tests verified healthy structure, an actual
+orphaned foreign key, unchanged seats and live-role demotion. Both
+query forms succeeded separately in a disposable Wrangler D1 store;
+an isolated programmatic Miniflare batch timed out, so it did not
+prove the combined workerd path. Local HTTP tests covered anonymous
+denial; the owner UI was visually exercised on phone width with
+explicitly mocked owner responses, not a real authenticated network
+integrity request. Independent rules/security reviews found no scoped
+defect. `npm run check` passed typecheck, lint and 5,833 offline
+tests; `npm run build` and 55 local HTTP tests passed. No production
+database scan or deployed revision was exercised. Disk capacity,
+backup restore safety, stalled-decision diagnosis and complete
+administration remain unfinished.
+
 ## 30 September 2026 — Semuta after BG Charity Karama
 
 In the explicit Richese preview, a clean printed Karama