- Implemented.

Rebuilt embed-example.html with inline, full-screen, and popup examples.
Fixed host-page/frame scrolling and contained reply navigation.
New logins now transactionally replace prior sessions; displaced clients 
return to login.
Added per-user session/IP locking with automatic SQLite migration.
Added modular Spam Control dashboard for locks, honeypot, and CAPTCHA 
settings.
Moved CAPTCHA controls out of Plans & Platform.

README.md

@@ -49,7 +49,9 @@ CyberChat 2.2.0 is the current baseline release. It is a framework-free PHP, SQL
 - Registration with username and password; email is not required
 - Case-insensitive unique usernames using letters, numbers, underscores, and hyphens
 - Bcrypt password hashing with a configurable cost
-- Optional IP conflict restriction when an account already has an active session
+- Successful logins automatically terminate the same user's older session
+- Administrator session locks that pin an account to one session token and IP until unlocked
+- Optional IP binding for every active session
 - Configurable session lifetime with HTTP-only, strict SameSite cookies and the secure flag under HTTPS
 - Email verification by six-digit code or verification link
 - Verified email required only before premium checkout
@@ -322,7 +324,7 @@ Reply IDs, reply depth, parent previews, and voice bitrate metadata are retained
 
 CAPTCHA checks are scoped to registration and initial password login. Email 2FA code verification, chat messages, account updates, and dashboard actions do not invoke CAPTCHA.
 
-Dashboard controls under **Plans & Platform > Registration / Login CAPTCHA** configure:
+Dashboard controls under **Spam Control > Registration / Login CAPTCHA** configure:
 
 - Registration and login protection independently
 - Invisible honeypot protection
@@ -363,7 +365,8 @@ This design avoids overlapping poll requests, duplicate voice players, and tempo
 | Archives | Browse days, inspect file sizes, filter/edit/delete messages, delete days |
 | Users | Create users, edit credentials/colors, assign tiers, kick, delete |
 | Sessions | Inspect active/expired sessions and terminate one, expired, or all |
-| Plans & Platform | Plans, pricing, bitrate, replies, CAPTCHA, Stripe, Mailgun, FFmpeg, MySQL, statistics |
+| Spam Control | Search sessions, pin or unlock accounts, configure IP binding, honeypot, internal CAPTCHA, and Google reCAPTCHA |
+| Plans & Platform | Plans, pricing, bitrate, replies, Stripe, Mailgun, FFmpeg, MySQL, statistics |
 | Config | Edit and validate `config.json` directly |
 
 ## Configuration Families
@@ -424,18 +427,18 @@ The diagnostic endpoint exposes deployment details and should be restricted or r
 ## Embedding
 
 ```html
-<link rel="stylesheet" href="/chat/assets/css/cyberchat.css?v=20260609.4">
-<div id="my-chat" style="width:100%;height:600px"></div>
+<link rel="stylesheet" href="/chat/assets/css/cyberchat.css?v=20260609.5">
+<div id="my-chat" style="width:100%;height:600px;overflow:hidden"></div>
 <script>
   window.CYBERCHAT_BASE = '/chat';
 </script>
-<script src="/chat/assets/js/cyberchat-app.js?v=20260609.8"></script>
+<script src="/chat/assets/js/cyberchat-app.js?v=20260609.10"></script>
 <script>
   CyberChat.init('#my-chat');
 </script>
 ```
 
-See `embed-example.html` for a complete example.
+The chat scrolls inside its own container and does not change the host page's body overflow. See `embed-example.html` for inline, full-screen overlay, and popout window examples.
 
 ## Main Files
 
@@ -458,6 +461,7 @@ api/stripe-webhook.php       Stripe event synchronization
 assets/css/cyberchat.css     Cyberpunk and light interface themes
 assets/js/cyberchat-app.js   Browser chat, audio player, polling, and account UI
 lib/admin_platform.php       Plans and platform dashboard module
+lib/admin_spam.php           Session locking and anti-spam dashboard module
 lib/mailer.php               Reusable Mailgun sender
 lib/mysql_mirror.php         Optional SQLite-to-MySQL mirror
 lib/stripe.php               Stripe REST client and subscription sync