Configure existing AI seats in the lobby

Let the host change an existing permanent AI seat's difficulty, faction and player circle without removing and readding it. Shared strict validation limits configuration to the authenticated host in the lobby, existing profiles, enabled available factions and unoccupied circles. Preserve seat identity and initialize changed faction rosters consistently. Changes reset human readiness, keep bots ready and explain the changed fields in public history.

Use existing AI strategies without calibration or strength changes. Full AI development waits for all non-AI game features; the goal retains the three adjacent 75% targets, mandatory Git checkpoints and selective subagents without a usage cutoff. No mode or publication gate opens.

Independent implementation and review cover the quote, engine, controls and persistence tests. Types, lint, 4916 offline tests, production build and 46 HTTP checks pass on stable final source. Ten new offline cases cover all factions/profiles, strict guards, roster/identity, immutable rejection, restart/privacy and both configuration-versus-start race outcomes. HTTP verifies authentication, host authority, CSRF, stale/future requests, private views and saved settings. Identical direct actions preserve players/readiness/history but retain the generic action store's version increment; controls suppress them.

Browser QA changed difficulty, faction and circle, verified readiness reset and history, restored settings after refresh and used keyboard selection. Expanded mobile cards were widened after discovering cramped controls; measured selects/buttons are 272 by 44 pixels at a 390-pixel viewport without document overflow. Desktop controls measure 169 by 44 pixels. Screenshot capture timed out, so screenshot-based visual acceptance remains unverified. Configuration controls disappear after starting and saved AI settings persist in setup. The final source rerun follows a preliminary run invalidated by the mobile/readability edits.

All 1262 original rooms, 2644 seats and every prior recovery/entry/handover/delegation/migration row remain unchanged. SQLite integrity and foreign keys pass. No database reset, migration, server restart, usage check or automation was performed. Broader rules, components, durable unattended continuation and final AI acceptance remain unfinished.

Verified source tree: 8c1baf4602d000ee37f081b2a03f8a87e89a63ef14a7121f24268c575a1ac281

docs/CURRENT_STATUS.md

@@ -6,21 +6,22 @@ gated.** Prototypes do not open completion or publication gates.
 
 ## Current checkpoint and work
 
-Latest delivered checkpoint: `e13ad45`, [movement and Traitor practice](INTERACTIVE_INTRODUCTION.md).
-Types, lint, **4,899 offline tests** and production build passed. Seven lessons
-and five exercises connect shared rules and migrated browser-local saves. All
-1,174 baseline rooms and 2,456 seats stayed unchanged; no restart was needed.
-The preceding `54c8030` connects [Sandmaster worm rides](SANDMASTER_WORM.md).
+Latest delivered checkpoint: `b21b2bc`, [one-use AI permission](SEAT_AI_PERMISSION.md).
+Types, lint, **4,906 offline tests**, production build and **45 HTTP tests** passed.
+All 1,174 baseline rooms and 2,456 seats stayed unchanged; the new preservation
+baseline contains 1,262 rooms and 2,644 seats. No restart was needed.
+The preceding `e13ad45` connects [movement and Traitor practice](INTERACTIVE_INTRODUCTION.md).
 The `8f7a62c` policy checkpoint removed the
 usage cutoff and deferred AI refinement until feature completion, with three
 adjacent 75% win-rate targets. Earlier evidence remains in the
 [implementation history](IMPLEMENTATION_STATUS.md).
 
-Current work: [one-use AI permission](SEAT_AI_PERMISSION.md) connects optional
-named-player activation at the owner's chosen difficulty, retained ownership,
-both session fences and saved exact retries. Final independent review,
-verification and delivery belong to the source-bound private report and Git
-message. Broader disconnected-seat acceptance remains unfinished.
+Current work: [lobby AI configuration](LOBBY_AI_CONFIGURATION.md) connects
+host controls for an existing AI seat's difficulty, faction and player circle,
+preserving identity and resetting human readiness. It uses the existing profiles
+without strategic refinement. Final independent review, verification and delivery
+belong to the source-bound private report and Git message. Broader disconnected-seat
+acceptance remains unfinished.
 
 A bounded remaining-effect audit found that the reviewed faction/Nexus candidates
 still cross recorded pending rulings. Continue independent features rather than

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,16 @@
 # Dune implementation status
 
+## 20 September 2026 — Configure existing lobby AI seats
+
+[Lobby AI configuration](LOBBY_AI_CONFIGURATION.md) connects host-only difficulty,
+faction and player-circle controls to a shared strict quote and authoritative
+lobby action. Seat identity persists, faction rosters follow existing setup,
+actual changes clear human readiness, and public history explains each change.
+Focused engine, SQLite/restart/concurrent-start and HTTP tests cover the bounded
+contract. Final independent review, browser, source-bound check/build/HTTP and
+saved-game preservation evidence belong to the private checkpoint and Git message.
+Existing AI strategies and mode/publication gates remain unchanged.
+
 ## 20 September 2026 — One-use named-player AI permission
 
 The [AI permission prototype](SEAT_AI_PERMISSION.md) connects optional owner

docs/LOBBY_AI_CONFIGURATION.md

@@ -0,0 +1,35 @@
+# Lobby AI configuration
+
+The host can add, remove and configure permanent AI seats before starting. Each
+seat's Configure panel offers its existing difficulty, an available enabled
+faction and an unoccupied player circle. Changes save immediately; human players
+must confirm readiness again, while AI seats stay ready. Changing faction also
+updates the public AI name. The same seat ID survives every change and refresh.
+
+The shared `quoteLobbyBotConfiguration` validates the complete action for both
+the controls and server: exact fields, authenticated host, lobby status,
+permanent AI target, one of four existing profiles, enabled unoccupied faction,
+and integer circle 1–6. Human seats, including those using autopilot, cannot be
+configured through this action. Faction changes initialize leaders and Ixian
+elite reserves consistently with existing lobby selection. Difficulty and circle
+changes preserve those rosters. Public history names the changed fields and
+explains the readiness reset.
+
+Controls do not send unchanged settings. An identical direct server action
+preserves players, readiness and history, but advances the room version through
+the existing action store. Concurrent and stale requests retain that store's
+version/session fences. Configuration cannot overwrite a simultaneous successful
+start, and starting cannot overwrite a successful configuration. If configuration
+wins, cleared human readiness blocks starting until reconfirmed.
+
+This is an integrated lobby capability, not AI strategy refinement or complete
+multiplayer acceptance. It preserves the existing profiles, mode/expansion start
+gates and the [post-feature AI development plan](AI_DEVELOPMENT_PLAN.md).
+
+Evidence includes the focused engine/quote tests in
+`tests/lobby-bot-configuration.test.ts`, real SQLite/restart/concurrency checks in
+`tests/lobby-bot-configuration-recovery.test.ts`, and authenticated HTTP checks in
+`tests/lobby-bot-configuration-http.test.ts`. Browser, independent review and
+final source-bound checks/preservation belong to the private checkpoint report
+and Git message. Full rules completion, final accessibility review and AI
+calibration remain separate gates.