Add reversible administrator room archiving

Organize closed rooms with archive filters, live-authorized atomic receipts and exact saved retries. Preserve saved games, timestamps, credentials, discussion and AI deadlines. Unarchive leaves play closed; reopen requires unarchive, and removal/restoration preserves both flags.

Verified types, lint, 5379 offline tests, 52 HTTP tests and build. Twenty dedicated administrator HTTP groups and independent privacy/persistence review passed. Desktop/mobile browser QA confirmed a single archive after a lost response and refresh, readable recovery text, mobile unarchive and separate reopening, and saved-seat restoration. All 2,049 baseline rooms, 4,348 seats and related records preserved. Authenticated production admin acceptance awaits authorized QA access; full admin and rules gates remain open.

docs/ADMIN_PANEL.md

@@ -12,7 +12,7 @@ recovery and persistence systems where suitable.
 | Administrator access | Personal access keys, server-enforced owner/operator/viewer roles, persistent eight-hour sessions, individual/all-session sign-out and operator provisioning/revocation. A room host is not a site administrator. Account-management UI and further operational permissions remain. | Prototyped |
 | Room directory | Search room codes/public player names, filter status/rules/availability, sort and paginate; show host, roster, modules, game change time, pause/join flags and bounded decision ownership. Detailed setup/shared-window ownership remains. | Prototyped |
 | Create and configure | [Create a lobby](ADMIN_ROOM_CREATION.md) with an explicitly owned new host seat, Basic/Advanced preview and initial AI configuration; invite humans and use ordinary lobby controls/voluntary host-seat handover. [Neutral lobby configuration](ADMIN_LOBBY_CONFIGURATION.md) adds rules/modules, AI seats and host assignment to an existing human without private access. Reserved human seats remain. | Prototyped, partial |
-| Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), [administrative close/reopen](ADMIN_ROOM_CLOSURE.md) and [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md) have controls, durable audit, exact retries and player/AI enforcement. Archive, permanent deletion and bulk actions remain missing. | Prototyped, partial |
+| Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), [administrative close/reopen](ADMIN_ROOM_CLOSURE.md) and [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md) have controls, durable audit, exact retries and player/AI enforcement. [Archive/unarchive](ADMIN_ROOM_ARCHIVE.md) has separate directory filters and exact retries. Permanent deletion and bulk actions remain missing. | Prototyped, partial |
 | Participant support | Remove disruptive participants or revoke access, manage appropriate restrictions, assist saved-seat recovery and host reassignment, and use supported AI takeover/replacement without losing forces, cards or decisions. | Missing |
 | Saved-game operations | Create/list/download backups, validate imports, restore a selected checkpoint safely, and diagnose or resume interrupted automatic work through authoritative game actions. | Missing |
 | Operations and audit | Show server/build/storage health, room/player counts and actionable errors; provide maintenance controls and a searchable record of administrator actions. | Missing |
@@ -46,6 +46,9 @@ find removed rooms; restoration retains prior pause and joining settings.
 [Close or reopen](ADMIN_ROOM_CLOSURE.md) ends further play without awarding a
 winner and preserves readable private tables and discussion. Reopening retains
 the saved game, pause/join settings and current credentials.
+[Archive or unarchive](ADMIN_ROOM_ARCHIVE.md) organizes closed rooms with separate
+directory filters and exact retries. Unarchiving leaves play closed; restoring
+a removed archive preserves both flags.
 Disabling an account invalidates its sessions; later re-enabling it cannot restore
 them. The database refuses to disable, demote or delete the final enabled owner.
 No default key, public account creation or host-to-administrator promotion exists.
@@ -116,7 +119,7 @@ session revocation and unchanged game/seat continuation. Operator/owner QA keys
 also create dedicated rooms for joining locks, pause/takeback/resume,
 administrator creation, invitations, voluntary host handover and neutral lobby
 configuration with existing-human host assignment and a real game start. They
-also remove/restore a separate QA game, preserving its paused state, discussion,
+also close/reopen, archive/unarchive and remove/restore separate QA games, preserving their paused state, discussion,
 saved seats and revoked credentials. Private reports retain
 room IDs and safe outcomes, never keys/cookies. The container verifier provisions
 its own disposable QA account and checks admin-session continuity across restart

docs/ADMIN_ROOM_ARCHIVE.md

@@ -0,0 +1,65 @@
+# Administrative archive and unarchive
+
+Owners and operators can choose **Archive or unarchive** beside a room in
+Administration. First close the room through [Close or reopen](ADMIN_ROOM_CLOSURE.md).
+Archiving requires an operational reason, the exact room code and confirmation.
+Unarchiving requires a reason and acknowledgment that play stays closed. Viewers
+can inspect archive status. Instructions and outcome notices remain readable
+until another deliberate action changes the panel.
+
+Archive organizes closed rooms in the administrator directory. It preserves the
+entire saved game, game-change timestamp, winner, pending decisions, physical
+pieces, seats, revoked access, discussion and AI deadlines. Existing players can
+still read their own closed table and history. It does not independently pause,
+end or resume the rules engine. **Unarchive leaves the room closed**; an
+administrator must separately reopen it when play should resume.
+
+## Directory and other controls
+
+The **Archive** filter defaults to **Unarchived rooms**; choose **Archived rooms**
+or **All rooms** to find an archived game. This filter is independent of
+**Directory → Active / Removed / All rooms** and the availability filter.
+To find a room that is both removed and archived, choose **All rooms** in both
+Directory and Archive. Searches still inspect only codes and public player names.
+
+Archived rooms cannot be reopened until unarchived. Recoverable removal can hide
+an archived room; restoration preserves its archive and closure and does not wake
+its AI. Restore a removed room before changing its archive status. An exact
+previous receipt can still be confirmed while a room is removed or after another
+administrator has changed its availability.
+
+## Saved retries and preservation
+
+Before sending, the browser saves the exact account/room operation, requested
+state, reason and two version counters in tab-scoped storage. A lost response or
+refresh offers **Retry saved request** when the controls reopen. The server
+confirms the original operation without repeating it, and reports the room's
+current status. Keep the tab open until resolved. Discarding an unreadable local
+record cannot undo a server change.
+
+Live owner/operator authority, room version, archive revision, closed status and
+removal status are fenced inside the write transaction. Audit receipt, room
+version increment and archive metadata commit together. Rejected or competing
+requests cannot partially change the room; identical concurrent requests commit
+once. Admin responses and audit metadata contain operational flags and timestamps,
+without hands, messages, seat credentials or raw saved state. These operations
+never parse or repair the saved game, including an unreadable save.
+
+Apply additive migration `0014_admin_room_archive.sql` before using this revision.
+`room_archives` holds current directory status; `admin_room_archives` holds durable
+audit receipts. Existing records are not rewritten or deleted. Permanent deletion,
+bulk operations, participant support and backup/restore tools remain unfinished.
+
+## Verification
+
+Focused tests cover live authorization changes, exact receipts, concurrent
+reopening/removal, transaction rollback, database reopen, AI deadline and credential
+preservation, strict client projections and combined directory pagination/search.
+The administrator HTTP verifier creates dedicated rooms for archive/unarchive,
+closure/removal composition and unchanged saved player views/history. Browser
+acceptance exercises actual confirmations, a lost successful response followed by
+refresh and exact retry, persistent notices, mobile controls and saved-seat reads.
+
+Keep source-bound checks, saved-record comparisons and deployed acceptance separate.
+Local checks do not establish authenticated production acceptance; that remains
+pending authorized QA operator access. See [verification workflow](VERIFICATION_WORKFLOW.md).

docs/ADMIN_ROOM_CLOSURE.md

@@ -44,7 +44,7 @@ available while the table's mutation controls are disabled.
 
 ## Other administrator controls
 
-Closed rooms remain in the default directory and can be filtered with
+Unarchived closed rooms remain in the default directory and can be filtered with
 **Availability → Closed**. **Running** excludes closed rooms. New pause/join and
 lobby configuration changes require reopening; prior exact receipts still work.
 
@@ -56,7 +56,8 @@ available to authorized administrators while it is removed.
 Apply additive migration `0013_admin_room_closure.sql` before this revision.
 `room_closures` stores current availability independently of pause and removal;
 `admin_room_closures` stores durable audit receipts. No existing game or credential
-rows are migrated or deleted. Archive, permanent deletion, bulk actions,
+rows are migrated or deleted. [Archiving](ADMIN_ROOM_ARCHIVE.md) organizes closed
+rooms separately; unarchive before reopening. Permanent deletion, bulk actions,
 participant support and backup/restore tools remain unfinished.
 
 ## Verification

docs/ADMIN_ROOM_REMOVAL.md

@@ -64,7 +64,11 @@ These checks also exposed a lobby readiness bug: a joining human or human
 faction change could clear AI readiness and block start. Those changes now clear
 only human readiness; focused JSON continuation tests and the HTTP start cover it.
 
-Close/end, archive, permanent deletion, bulk operations, participant support and
+[Close/reopen](ADMIN_ROOM_CLOSURE.md) and [archive/unarchive](ADMIN_ROOM_ARCHIVE.md)
+are separate reversible controls. Permanent deletion, bulk operations, participant support and
 backup/import workflows remain unfinished. Recoverable removal does not satisfy
 those separate [administration requirements](ADMIN_PANEL.md). No existing human
 room is used for removal tests, and no database reset is authorized.
+
+Restoring an archived room preserves both archive and closure. Use All rooms in
+both Directory and Archive filters to find a room with both flags.

docs/CURRENT_STATUS.md

@@ -6,12 +6,20 @@ Expansion starts and full rules/publication acceptance remain gated.**
 
 ## Current checkpoint and work
 
-Current work adds [administrative close/reopen](ADMIN_ROOM_CLOSURE.md):
-closed rooms preserve readable private tables and discussion while stopping new
-play, joins, AI and seat mutations. Exact prior receipts remain confirmable;
-reopening preserves pending decisions, credentials and pause/join flags.
-Archive, permanent deletion, bulk actions and full participant/backup support
-remain unfinished.
+Current work adds [administrative archive/unarchive](ADMIN_ROOM_ARCHIVE.md):
+closed rooms can leave the default directory without changing saved games,
+credentials, discussion or AI deadlines. Unarchiving leaves play closed;
+reopening requires unarchiving first. Exact saved retries and combined archive /
+removal filters preserve recovery. Permanent deletion, bulk actions and full
+participant/backup support remain unfinished.
+
+Checkpoint `98b1b32` added [close/reopen](ADMIN_ROOM_CLOSURE.md) and passed types/lint,
+5,356 offline tests, 52 HTTP tests and build, with seventeen administrator HTTP
+groups and lost-response desktop/mobile browser QA. It is deployed on the NAS:
+container verification passed, migration 0013 applied, all eight prior rooms and
+ten seats were preserved, and public HTTPS/browser saved-seat restoration passed.
+Anonymous admin routes remain denied. Positive production administrator acceptance
+still awaits authorized QA access; archive/unarchive is not deployed yet.
 
 Checkpoint `238de38` added [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md)
 and passed types/lint, 5,314 offline tests, 52 HTTP tests and build, with fourteen
@@ -20,7 +28,7 @@ deployed on the NAS: container verification passed, migration 0012 applied,
 all eight prior rooms and ten seats were preserved, and public HTTPS/browser
 saved-seat restoration passed. Anonymous removal and other admin routes remain
 denied. Positive production administrator acceptance remains pending authorized
-QA operator access; the current close/reopen work is not deployed yet.
+QA operator access.
 
 Checkpoint `c0cc4de` added [neutral administrator lobby configuration](ADMIN_LOBBY_CONFIGURATION.md)
 and passed types/lint, 5,260 offline tests, 52 HTTP tests and build, with eleven

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,21 @@
 # Dune implementation status
 
+## 22 September 2026 — Administrative archive/unarchive prototype
+
+[Archive or unarchive](ADMIN_ROOM_ARCHIVE.md) organizes closed rooms without
+changing their saved state, timestamps, credentials, discussion or AI pacing.
+Separate directory filters compose with removal; unarchive leaves play closed,
+reopen rejects archives, and removal/restoration retains both flags. Live
+operator authority and room/archive version fences commit with durable audit
+receipts. Tab-scoped exact retries remain confirmable across refresh and later
+availability changes.
+
+Independent read-only review found no material issues. Focused database/client
+checks and twenty dedicated administrator HTTP groups passed. Browser acceptance,
+source-bound broad checks and preservation evidence accompany the checkpoint.
+Authenticated production acceptance awaits authorized QA access. Full admin and
+rules gates remain unfinished.
+
 ## 22 September 2026 — Administrative close/reopen prototype
 
 [Close or reopen](ADMIN_ROOM_CLOSURE.md) now separates administrative availability