Files
Dune/docs/ADMIN_ROOM_ARCHIVE.md
Quintine e918e2e0c0 Add reversible administrator room archiving
Organize closed rooms with archive filters, live-authorized atomic receipts and exact saved retries. Preserve saved games, timestamps, credentials, discussion and AI deadlines. Unarchive leaves play closed; reopen requires unarchive, and removal/restoration preserves both flags.

Verified types, lint, 5379 offline tests, 52 HTTP tests and build. Twenty dedicated administrator HTTP groups and independent privacy/persistence review passed. Desktop/mobile browser QA confirmed a single archive after a lost response and refresh, readable recovery text, mobile unarchive and separate reopening, and saved-seat restoration. All 2,049 baseline rooms, 4,348 seats and related records preserved. Authenticated production admin acceptance awaits authorized QA access; full admin and rules gates remain open.
2026-09-22 12:55:44 +10:00

66 lines
3.8 KiB
Markdown

# Administrative archive and unarchive
Owners and operators can choose **Archive or unarchive** beside a room in
Administration. First close the room through [Close or reopen](ADMIN_ROOM_CLOSURE.md).
Archiving requires an operational reason, the exact room code and confirmation.
Unarchiving requires a reason and acknowledgment that play stays closed. Viewers
can inspect archive status. Instructions and outcome notices remain readable
until another deliberate action changes the panel.
Archive organizes closed rooms in the administrator directory. It preserves the
entire saved game, game-change timestamp, winner, pending decisions, physical
pieces, seats, revoked access, discussion and AI deadlines. Existing players can
still read their own closed table and history. It does not independently pause,
end or resume the rules engine. **Unarchive leaves the room closed**; an
administrator must separately reopen it when play should resume.
## Directory and other controls
The **Archive** filter defaults to **Unarchived rooms**; choose **Archived rooms**
or **All rooms** to find an archived game. This filter is independent of
**Directory → Active / Removed / All rooms** and the availability filter.
To find a room that is both removed and archived, choose **All rooms** in both
Directory and Archive. Searches still inspect only codes and public player names.
Archived rooms cannot be reopened until unarchived. Recoverable removal can hide
an archived room; restoration preserves its archive and closure and does not wake
its AI. Restore a removed room before changing its archive status. An exact
previous receipt can still be confirmed while a room is removed or after another
administrator has changed its availability.
## Saved retries and preservation
Before sending, the browser saves the exact account/room operation, requested
state, reason and two version counters in tab-scoped storage. A lost response or
refresh offers **Retry saved request** when the controls reopen. The server
confirms the original operation without repeating it, and reports the room's
current status. Keep the tab open until resolved. Discarding an unreadable local
record cannot undo a server change.
Live owner/operator authority, room version, archive revision, closed status and
removal status are fenced inside the write transaction. Audit receipt, room
version increment and archive metadata commit together. Rejected or competing
requests cannot partially change the room; identical concurrent requests commit
once. Admin responses and audit metadata contain operational flags and timestamps,
without hands, messages, seat credentials or raw saved state. These operations
never parse or repair the saved game, including an unreadable save.
Apply additive migration `0014_admin_room_archive.sql` before using this revision.
`room_archives` holds current directory status; `admin_room_archives` holds durable
audit receipts. Existing records are not rewritten or deleted. Permanent deletion,
bulk operations, participant support and backup/restore tools remain unfinished.
## Verification
Focused tests cover live authorization changes, exact receipts, concurrent
reopening/removal, transaction rollback, database reopen, AI deadline and credential
preservation, strict client projections and combined directory pagination/search.
The administrator HTTP verifier creates dedicated rooms for archive/unarchive,
closure/removal composition and unchanged saved player views/history. Browser
acceptance exercises actual confirmations, a lost successful response followed by
refresh and exact retry, persistent notices, mobile controls and saved-seat reads.
Keep source-bound checks, saved-record comparisons and deployed acceptance separate.
Local checks do not establish authenticated production acceptance; that remains
pending authorized QA operator access. See [verification workflow](VERIFICATION_WORKFLOW.md).