Add neutral administrator lobby configuration

Configure supported rules/modules and AI seats or assign an existing human as host without granting private-seat access. Use genuine unused-lobby checks, existing engine actions, live authorization/version/pause/seat fences and atomic audit receipts. Preserve exact account-bound retries across refresh and confirm completed operations after game start without resetting play.

Verified types, lint, 5260 offline tests, 52 HTTP tests and build. Eleven authenticated HTTP groups and independent privacy/persistence review passed. Browser QA confirmed one AI and audit after a lost response and refresh/retry, persisted rules and AI configuration, and readable 1280/390px layouts. All existing rooms and seats preserved. Actual authenticated production administrator acceptance remains pending authorized QA operator access.

docs/ADMIN_LOBBY_CONFIGURATION.md

@@ -0,0 +1,84 @@
+# Configuring lobbies from Administration
+
+Choose **Configure lobby** in the administrator room directory. All administrator
+roles can inspect the current public roster, rules, AI difficulties, circles and
+readiness. Owners and operators can change Basic/Advanced preview, Tech Tokens,
+Stronghold Cards, add/remove/configure AI players and assign the host to an
+existing human participant with active saved-seat access.
+
+These controls grant no player seat. The previous host keeps their credentials
+and pieces after reassignment; every human must ready again. Host assignment
+changes lobby permissions, not private ownership. Reserved human seats, support
+for started-game host changes and full participant administration remain pending.
+
+Configuration supports genuine unused lobbies of the six classic factions and
+the existing optional Tech Tokens/Stronghold Cards. A paused room must be resumed
+first. A joining lock does not prevent configuration. Advanced remains explicitly
+unfinished and requires the ordinary preview-start acknowledgement. Tech Tokens
+require three players at start; Stronghold Cards require Advanced rules. Changing
+to Basic clears unused Stronghold Cards. Normal readiness, player-count and
+expansion gates still apply; this is not a general saved-state editor.
+
+## Confirmation and recovery
+
+Every change shows its scope and requires an operational reason and confirmation.
+Messages remain visible while the user reads them. The exact operation, version,
+action and reason are saved in this tab before sending, scoped to the signed-in
+administrator and room. Unknown responses keep **Retry saved lobby request**;
+refresh and reopen that room's configuration to confirm the same request.
+No new request overwrites an unresolved one.
+
+An exact retry returns the original applied version and current public settings.
+It does not reapply an older setting, reset readiness or undo later play. This
+also works after a completed request's room starts, pauses or becomes unavailable.
+A stale first request fails and requires a refreshed explicit choice. An expired
+or switched administrator session retains the original account's retry record.
+Corrupt local records require deliberate discard after inspecting current settings;
+discarding local data does not undo any change saved on the server.
+
+## Authority, preservation and privacy
+
+The [endpoint](../app/api/admin/rooms/[code]/lobby/route.ts) requires a live
+administrator session. Writes additionally require owner/operator authority,
+the configured origin, bounded strict input and the displayed administrator ID.
+The [database transaction](../db/admin-lobby-configuration.ts) repeats live
+authorization, the saved game version, lobby status and pause checks at commit.
+Host reassignment also fences the target's current seat access. Concurrent player
+actions, starts, joins or support operations cannot be overwritten.
+
+The [focused game adapter](../game/admin-lobby-configuration.ts) checks the entire
+unused runtime and physical player pieces against genuine setup. Malformed,
+unsupported or mismatched room saves are read-only with generic diagnostics.
+Saved-state version metadata may legitimately lag its authoritative database
+version after seat or lifecycle operations; the latter controls concurrency.
+Existing engine actions calculate rules/modules/AI changes. New public history
+uses generic administrator attribution; actual actor and reason stay in audit.
+
+The additive [migration](../drizzle/0011_admin_lobby_configuration.sql) records
+the operation, actor, room, request hash, versions, reason and public before/after
+configuration atomically with the game update. Exact requests are bound to their
+original actor and intent. Game and seat records are never deleted or reset.
+Responses use an explicit public projection, independent of GameView, with no
+private cards, choices, credentials or cookies. Read/replay remains available
+independently of permission to make a new lobby change.
+
+## Verification
+
+Focused regressions cover all supported actions, genuine starts, readiness and
+piece preservation, malformed saves, private projection, exact concurrent retries,
+transaction rollback, live authority and races with starts, pause, joins and seat
+revocation. Client regressions cover strict matching confirmation, account/room
+isolation, corrupt storage and replay after play has begun.
+
+`tools/verify-admin.mjs` uses a dedicated QA operator and creates one additional
+two-human lobby for neutral configuration. It exercises all seven action families,
+both unchanged seat cookies, new-host readiness/start and exact saved retry after
+start. Every QA room remains saved. All eleven authenticated HTTP groups passed.
+Local browser acceptance confirmed one AI seat and one audit record after losing
+a successful response, refreshing and retrying. Rules and AI faction/difficulty/
+circle changes survived another refresh. Desktop (1280px) and mobile (390px)
+controls had 16px form text, 44px action buttons and no horizontal overflow.
+No browser console errors were recorded. Source-bound checks and independent
+review accompany the checkpoint. Container and actual deployed checks
+are separate; positive production administrator acceptance requires explicitly
+authorized QA operator access and remains open until recorded.

docs/ADMIN_PANEL.md

@@ -11,7 +11,7 @@ recovery and persistence systems where suitable.
 | --- | --- | --- |
 | Administrator access | Personal access keys, server-enforced owner/operator/viewer roles, persistent eight-hour sessions, individual/all-session sign-out and operator provisioning/revocation. A room host is not a site administrator. Account-management UI and further operational permissions remain. | Prototyped |
 | Room directory | Search room codes/public player names, filter status/rules/availability, sort and paginate; show host, roster, modules, game change time, pause/join flags and bounded decision ownership. Detailed setup/shared-window ownership remains. | Prototyped |
-| Create and configure | [Create a lobby](ADMIN_ROOM_CREATION.md) with an explicitly owned new host seat, Basic/Advanced preview and initial AI configuration; invite humans and use ordinary lobby controls/voluntary host-seat handover. Neutral administration of lobby configuration, reserved human seats and reassignment to another existing player remain. | Prototyped, partial |
+| Create and configure | [Create a lobby](ADMIN_ROOM_CREATION.md) with an explicitly owned new host seat, Basic/Advanced preview and initial AI configuration; invite humans and use ordinary lobby controls/voluntary host-seat handover. [Neutral lobby configuration](ADMIN_LOBBY_CONFIGURATION.md) adds rules/modules, AI seats and host assignment to an existing human without private access. Reserved human seats remain. | Prototyped, partial |
 | Lifecycle and removal | [Pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md) have controls, durable audit, exact retries and player/AI enforcement. Close/end, archive, restore and recoverable/permanent removal remain missing. | Prototyped, partial |
 | Participant support | Remove disruptive participants or revoke access, manage appropriate restrictions, assist saved-seat recovery and host reassignment, and use supported AI takeover/replacement without losing forces, cards or decisions. | Missing |
 | Saved-game operations | Create/list/download backups, validate imports, restore a selected checkpoint safely, and diagnose or resume interrupted automatic work through authoritative game actions. | Missing |
@@ -38,6 +38,8 @@ Owners/operators may pause/resume rooms and lock/unlock new joins through
 account, never accepted from a client.
 Owners/operators can also [create a configured lobby](ADMIN_ROOM_CREATION.md),
 with explicit new-host ownership and saved exact retries.
+[Configure lobby](ADMIN_LOBBY_CONFIGURATION.md) changes supported rules, AI seats
+and the host without granting private seat access.
 Disabling an account invalidates its sessions; later re-enabling it cannot restore
 them. The database refuses to disable, demote or delete the final enabled owner.
 No default key, public account creation or host-to-administrator promotion exists.
@@ -106,7 +108,8 @@ sessions of that QA account. Never supply a human operator's normal key. It chec
 authentication, cookie properties, ordinary-host denial, directory privacy,
 session revocation and unchanged game/seat continuation. Operator/owner QA keys
 also create dedicated rooms for joining locks, pause/takeback/resume,
-administrator creation, invitations and voluntary host handover. Private reports retain
+administrator creation, invitations, voluntary host handover and neutral lobby
+configuration with existing-human host assignment and a real game start. Private reports retain
 room IDs and safe outcomes, never keys/cookies. The container verifier provisions
 its own disposable QA account and checks admin-session continuity across restart
 and replacement, followed by the HTTP flow and HTTPS-proxy cookie behavior.

docs/ADMIN_ROOM_CREATION.md

@@ -14,9 +14,9 @@ set up for another person, use the existing **Pass your seat to another player**
 flow in that lobby; the host player identity and room progress survive transfer.
 This workflow grants no access to any existing participant's seat.
 
-This is a connected room-creation prototype, not complete neutral administrator
-lobby management. Creating reserved human seats, assigning a different existing
-participant as host and managing lobbies without a playing seat remain part of
+Use [Configure lobby](ADMIN_LOBBY_CONFIGURATION.md) to manage rules and AI seats
+or assign another existing human as host without a playing seat. Reserved human
+seats and remaining administration still belong to
 [the full panel requirements](ADMIN_PANEL.md).
 
 ## Saved confirmation

docs/CURRENT_STATUS.md

@@ -6,11 +6,19 @@ Expansion starts and full rules/publication acceptance remain gated.**
 
 ## Current checkpoint and work
 
-Current work adds [administrator room creation](ADMIN_ROOM_CREATION.md): a new
-explicitly owned human host seat, supported rules/modules, initial AI seats,
-invitation joining and exact saved retries. Creation uses ordinary engine setup
-and preserves normal readiness/start gates. Neutral administrator configuration,
-reserved human seats and reassignment to existing participants remain unfinished.
+Current work adds [neutral administrator lobby configuration](ADMIN_LOBBY_CONFIGURATION.md):
+supported rules/modules, AI seat management and host assignment to an existing
+human without private seat access. Exact saved requests, live authority and
+version fences preserve concurrent play and saved continuation. Reserved human
+seats, full participant support, archive/removal and backups remain unfinished.
+
+Checkpoint `e7d4efc` added [administrator room creation](ADMIN_ROOM_CREATION.md)
+and passed types/lint, 5,240 offline tests, 52 HTTP tests and build, with independent
+review and eight dedicated administrator HTTP groups. It is deployed on the NAS:
+container verification passed, migration 0010 applied, all eight prior rooms and
+ten seats were preserved, and a saved seat restored through public HTTPS and the
+browser. Anonymous administrator creation remains denied. Positive production
+administrator acceptance still requires explicitly authorized QA operator access.
 
 Checkpoint `8c922b4` added [pause/resume and joining locks](ADMIN_ROOM_CONTROLS.md)
 and passed types/lint, 5,223 offline tests, 52 HTTP tests and build, with independent

docs/IMPLEMENTATION_STATUS.md

@@ -1,5 +1,16 @@
 # Dune implementation status
 
+## 22 September 2026 — Neutral administrator lobby configuration
+
+Added [rules/modules, AI configuration and existing-human host assignment](ADMIN_LOBBY_CONFIGURATION.md)
+through public administrator controls. Genuine unused-lobby admission, existing
+engine calculations, atomic live authorization/version fences and durable audit
+preserve normal start gates, physical pieces and private seats. Exact tab-scoped
+requests confirm without reapplying after a lost response, refresh or later game
+start. Independent malformed-save review, focused regressions, actual HTTP/browser
+checks and required source-bound checks accompany the checkpoint. Full admin
+scope and authenticated production acceptance remain unfinished.
+
 ## 22 September 2026 — Administrator room creation
 
 Added [configured lobby creation](ADMIN_ROOM_CREATION.md) with explicit new-host