Quintine
07c20ae806
Add an owner-only, read-only sample of at most ten live rooms whose public pending interaction — decision, response, Truthtrance or phase opening — has been idle longest, with the room code, idle duration, interaction kind, turn and phase. GET /api/admin/operations?stalled=1 repeats live owner authority, answers no-store, rejects any other query combination and repairs nothing; paused, closed, removed and archived rooms are excluded and no private game content is selected. The aggregate sample adds stalledRooms and oldestStalledChange for the same predicate. Owner-only unit coverage asserts the counters, the oldest stalled write, the bounded oldest-first order, every exclusion boundary, idle arithmetic, the absence of private content and the owner recheck after demotion. The anonymous HTTP boundary denies the new read, and the full HTTP integration suite passes 55/55 against a local build of this revision. The panel was verified in the real browser against six hours of genuine idle rooms, which caught and fixed a missing threshold field in the response. No game, seat, saved state, deployment, public start or played-save conversion changes.
2.3 KiB
Stalled-decision diagnosis
Added 7 October 2026 as owner-only, read-only administration scope. It samples rooms that are waiting on a public interaction and have not been written for a while, so an operator can find a table that stopped moving without opening anyone's private state. It changes nothing and repairs nothing.
Contract
GET /api/admin/operations?stalled=1 requires a live owner session, checks the
X-Dune-Admin-Id header against the session, and answers no-store. Any other
query combination is rejected with 400; an anonymous or non-owner request is
rejected with 401/403 before any room is read. The same request without a
query returns the aggregate sample, and ?integrity=1 keeps its manual SQLite
check.
A room is included only when all of these hold:
- its saved state is readable JSON (
json_valid(state)=1); statusisplaying;- it has a pending public interaction:
decision,response,truthtranceorphaseOpening; - it is not paused, closed, removed or archived;
- its last room write is older than
ADMIN_STALL_MS(six hours).
The sample returns at most ADMIN_STALL_LIMIT (ten) rooms, oldest first, with
the room code, the idle duration, the pending interaction kind and the saved
turn and phase. The aggregate operations sample adds stalledRooms and
oldestStalledChange for the same predicate.
Privacy and safety
Only public coordination facts leave the database: a room code is an invitation, and a pending interaction kind, turn and phase are already visible to the players at that table. Hands, spice, orders, private decisions, seat credentials and recovery material are never selected, so the sample cannot leak them. The route is read-only: it runs no repair, no automatic close, no retry and no migration. Pausing, resuming, closing, removing or archiving a room still happens only through its own audited control.
Limits
A stall is inferred from the room write time, so a genuinely slow human turn, a long offline pause that was never flagged, or an idle-but-live table all count. The sample does not diagnose why a decision is stuck, does not check disk capacity or backup recoverability, and does not verify rule-level save validity. It complements, and does not replace, the manual integrity check and the action history.