Prototype paused admin participant AI support

Enable an existing AI difficulty for a human seat through admin controls without granting private access or advancing paused play. Preserve custody, credentials, takeback and separate paced resume. Bind atomic writes and outgoing-grant revocation to live authority, room/pause versions and active seat access with durable exact receipts.

Validation: types/lint, 5408 offline tests, build and 52 HTTP tests passed on source fingerprint 2157de0f4bb0b74d9760d52102601c52344cf674dee8ccd1d559f0a246a1d4ff; 22 authenticated admin HTTP groups, independent SQL/privacy/UI review, desktop/mobile and refresh checks. All 2098 baseline rooms and 4455 seats preserved. Migration 0015 is additive. Positive production admin QA awaits authorized access; full admin/rules scope remains unfinished.

docs/ADMIN_PANEL.md

@@ -13,7 +13,7 @@ recovery and persistence systems where suitable.
 | Room directory | Search room codes/public player names, filter status/rules/availability, sort and paginate; show host, roster, modules, game change time, pause/join flags and bounded decision ownership. Detailed setup/shared-window ownership remains. | Prototyped |
 | Create and configure | [Create a lobby](ADMIN_ROOM_CREATION.md) with an explicitly owned new host seat, Basic/Advanced preview and initial AI configuration; invite humans and use ordinary lobby controls/voluntary host-seat handover. [Neutral lobby configuration](ADMIN_LOBBY_CONFIGURATION.md) adds rules/modules, AI seats and host assignment to an existing human without private access. Reserved human seats remain. | Prototyped, partial |
 | Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md), [administrative close/reopen](ADMIN_ROOM_CLOSURE.md) and [recoverable removal/restoration](ADMIN_ROOM_REMOVAL.md) have controls, durable audit, exact retries and player/AI enforcement. [Archive/unarchive](ADMIN_ROOM_ARCHIVE.md) has separate directory filters and exact retries. Permanent deletion and bulk actions remain missing. | Prototyped, partial |
-| Participant support | Remove disruptive participants or revoke access, manage appropriate restrictions, assist saved-seat recovery and host reassignment, and use supported AI takeover/replacement without losing forces, cards or decisions. | Missing |
+| Participant support | [Participant AI](ADMIN_PARTICIPANT_AI.md) enables an existing difficulty on an eligible human seat in a paused game, retaining access/takeback and private custody. Participant restrictions/removal, access revocation, assisted recovery and further replacement remain. Existing lobby controls can reassign the host. | Prototyped, partial |
 | Saved-game operations | Create/list/download backups, validate imports, restore a selected checkpoint safely, and diagnose or resume interrupted automatic work through authoritative game actions. | Missing |
 | Operations and audit | Show server/build/storage health, room/player counts and actionable errors; provide maintenance controls and a searchable record of administrator actions. | Missing |
 
@@ -53,6 +53,10 @@ Disabling an account invalidates its sessions; later re-enabling it cannot resto
 them. The database refuses to disable, demote or delete the final enabled owner.
 No default key, public account creation or host-to-administrator promotion exists.
 
+[Participant AI](ADMIN_PARTICIPANT_AI.md) lets owners/operators support an absent
+human in a paused, started game. The player retains access and takeback controls;
+the administrator receives no private seat. Resume remains a separate action.
+
 The directory uses an explicit field allowlist, independent of any player view.
 It never returns hands, Traitors, predictions, plans, private messages, recovery
 records or raw saved state. Searches inspect only codes and public player names.
@@ -124,6 +128,8 @@ saved seats and revoked credentials. Private reports retain
 room IDs and safe outcomes, never keys/cookies. The container verifier provisions
 its own disposable QA account and checks admin-session continuity across restart
 and replacement, followed by the HTTP flow and HTTPS-proxy cookie behavior.
+Participant checks use another new QA room for paused AI enable, private-seat
+continuity, takeback and durable retries after resuming.
 
 Local browser checks cover sign-in, directory filters, refresh restoration and
 mobile layout. Final source-bound checks and separately recorded deployed

docs/ADMIN_PARTICIPANT_AI.md

@@ -0,0 +1,82 @@
+# Administrative participant AI
+
+The **Participant AI** action in the administration directory enables an existing
+AI difficulty for an absent human in a paused, started game. This is a bounded
+participant-support prototype. It does not revoke access, remove a faction,
+replace a permanent AI player, or give an administrator a private seat.
+
+## Use
+
+1. Find the room and use **Room controls** to pause it at an appropriate point.
+2. Open **Participant AI**. Select an eligible human, choose Easy, Medium, Hard or
+   Brutal, and enter a short operational reason without private information.
+3. Type the room code, acknowledge that the player keeps their seat and can take
+   back control, then choose **Enable participant AI**.
+4. The room stays paused. Resume it separately through **Room controls** when
+   everyone is ready. The existing 1.5-second AI continuation delay starts then.
+
+Owners and operators may apply the action; viewers may inspect public participant
+availability. The room must be in setup or play, paused, open, unarchived and not
+removed. The target needs a current human seat credential and no existing AI
+controller. Use existing lobby configuration for permanent AI seats before play.
+
+The human can use **Take back control** even while paused. Their forces, cards,
+resources, sealed choices, host assignment, credentials, recovery kits, handovers
+and discussion remain saved. Unused permissions that this participant gave
+others to start AI are revoked atomically; permissions merely delegated to them
+are unchanged. The public chronicle truthfully identifies an administrator's
+controller change without exposing the administrator's identity or audit reason.
+
+## Saved requests and authority
+
+The exact operation identifier, room and pause versions, participant, difficulty
+and reason are saved in account/room-scoped session storage before sending.
+First submission shows concise progress. Uncertain responses retain explicit
+retry controls, including after refresh. A different unresolved request cannot
+overwrite the saved proof. Success text persists until another deliberate action.
+
+**Retry saved request** confirms the original result even after the player takes
+back control, the room resumes, or an administrator removes it. It never enables
+AI again. After signing in again, use All rooms in both directory filters to
+find later removed/archived rooms and reopen these controls. An unreadable local
+record requires explicit acknowledgment before discarding it; that does not undo
+any server operation.
+
+The server repeats live session/role, room version, pause revision, lifecycle and
+target-seat checks inside the transaction. Game write, audit receipt and unused
+outgoing permission revocation commit together. A rejected/racing request cannot
+partially change the game. Replayed operations remain bound to their original
+administrator, room and payload. Administrative reads return an explicit public
+roster; they do not use a private player view or return credentials.
+
+Saved games pass a bounded core/continuation shape check before this controller
+change. The ordinary authoritative engine still applies module integrity checks;
+the operation also verifies that only the chosen controller and one chronicle
+event changed. This is not a general import validator or complete rules
+certification. Unreadable saves are preserved for inspection rather than repaired
+by the administration action. No worker or bot action is scheduled while paused.
+
+## Implementation and verification
+
+Controls: [panel](../components/admin-seat-ai.tsx), [client retry](../lib/admin-seat-ai-client.ts).
+Authority and persistence: [route](../app/api/admin/rooms/[code]/seat-ai/route.ts),
+[transaction](../db/admin-seat-ai.ts), [engine adapter](../game/admin-seat-ai.ts),
+[additive migration](../drizzle/0015_admin_seat_ai.sql).
+
+```sh
+npm test -- admin-seat-ai
+npm run test:integration -- admin-boundary
+```
+
+The dedicated administrator verifier also exercises enable, frozen polling,
+private-seat continuity, takeback and replay after resume in a new QA room.
+Unit/recovery checks cover JSON-restored Basic/Advanced setup, malformed core,
+precise mutation scope, concurrent duplicate/conflicting requests, commit-time
+authority and seat revocation, rollback and the existing resume deadline.
+Independent review, browser acceptance, preservation and full checkpoint checks
+are recorded separately. Positive deployed administrator acceptance still needs
+explicitly authorized production QA access; local passes do not establish it.
+
+Participant restrictions/removal, administrator-assisted recovery, further
+replacement workflows and the rest of the complete admin panel remain unfinished.
+This work does not refine AI strategy or open expansion/publication gates.

docs/CURRENT_STATUS.md

@@ -6,6 +6,18 @@ Expansion starts and full rules/publication acceptance remain gated.**
 
 ## Current checkpoint and work
 
+Current work adds [participant AI support](ADMIN_PARTICIPANT_AI.md): a live
+owner/operator can enable an existing AI difficulty for an eligible human in a
+paused, started game. Saved custody and seat access remain; the human can take
+back control, and resume is separate. Atomic audit, exact saved retries and
+commit-time room/seat/authority checks are connected. Participant restrictions,
+access revocation, assisted recovery, permanent deletion, bulk actions and
+backup/operations tools remain unfinished. This adds no strategic AI refinement.
+
+Readable-notice checkpoint `137f922` is pushed. Types/lint, 5,381 offline tests,
+52 HTTP tests, build and delayed-response desktop/mobile browser QA passed.
+Its new-revision deployment handoff is pending confirmation.
+
 The [readable-notice follow-up](READABLE_NOTICES.md) extends first-request progress
 to admin operations, AI permissions and seat handovers, preventing recovery
 instructions from flashing before a successful response. Seat recovery/handover
@@ -13,8 +25,8 @@ confirmations remain above the table until Continue. Existing retry proofs and
 rules/AI pacing are unchanged. New-revision deployed acceptance remains separate
 from local checks; positive production admin testing still needs authorized access.
 
-Current work adds [administrative archive/unarchive](ADMIN_ROOM_ARCHIVE.md):
-closed rooms can leave the default directory without changing saved games,
+The connected [administrative archive/unarchive](ADMIN_ROOM_ARCHIVE.md) prototype lets
+closed rooms leave the default directory without changing saved games,
 credentials, discussion or AI deadlines. Unarchiving leaves play closed;
 reopening requires unarchiving first. Exact saved retries and combined archive /
 removal filters preserve recovery. Permanent deletion, bulk actions and full

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,21 @@
 # Dune implementation status
 
+## 26 September 2026 — Administrative participant AI prototype
+
+[Participant AI](ADMIN_PARTICIPANT_AI.md) connects paused human-seat support to
+the existing authoritative controller action. It retains player access, private
+custody and AI deadlines; explicit resume starts normal paced continuation.
+Atomic authority/room/pause/seat fences, durable receipts and target-owned unused
+permission revocation preserve concurrent and uncertain requests. Local retry
+controls survive refresh and confirm old operations without reversing takeback.
+
+Independent review corrected sector-18 and worm-ride compatibility, core
+continuation shape guards and changed-access handling after reconciliation.
+Focused regressions and twenty-two administrator HTTP groups passed; source-bound
+checks, browser acceptance and preservation accompany the checkpoint separately.
+Positive production admin testing remains pending authorized access. The complete
+administration panel, rules/expansion coverage and AI refinement remain unfinished.
+
 ## 26 September 2026 — Readable admin and saved-seat notices
 
 First administrator and seat-control submissions show progress while the request