**The second sanitizer is gone.** `sanitizeInput` stripped markup, truncated
every string at 10,000 characters and rejected any prose containing SQL
keywords — "select a track from the list" among them. Nothing called it: the
request path runs `scrubMarkup`, which refuses executable markup and passes
everything else through byte for byte. Only the tests called it, so the suite
was describing behaviour the product did not have. They now target the real one.

**`publicProcedure` requires a database.** Without it a public query with no
connection fell through to its own `if (!db)` branch, which returns null — and
the funnel page renders that as "nothing announced yet". A misconfigured deploy
looked like an empty product instead of a broken one.

**Cache invalidation actually evicts.** `deletePattern` anchors with `$`, so
the wildcard-free entries matched no real key — and because the map HAS an
entry, the namespace fallback was skipped, so nothing at all was evicted. Also
adds the caller's own keys to events.checkIn, so a member who just scanned sees
the change.

**Security logging goes to stderr**, not to a file under the source tree that
does not exist in the container, where the ENOENT was swallowed by an empty
callback — the one message saying security logging had stopped was itself
silently dropped. Dead exports removed with it.

Decisions, all recorded in PLAN.md §5:

- **D2** — registration is an application. `approved` to form a team,
  `checked_in` to submit: acceptance is a decision made weeks earlier and says
  nothing about whether somebody turned up, and judging is in person against a
  table number. Every participant is created `pending` and `pending` used to
  pass, so teams formed and projects were submitted with no review at all.
- **D4** — points removed. Every club check-in carried the schema default and
  the attendee CSV exported that constant as a "Points" column: a fabricated
  number presented as data.
- **D5** — a `not_accepted` audience, excluded from every other one so it can
  only be sent on purpose, with a drafted message prefilled into an untouched
  form.
- **D7** — the security headers ship report-only until CSP_ENFORCE=true, with
  /api/csp-report collecting violations; the 238-line module nothing imported
  is deleted. `camera` is deliberately absent from Permissions-Policy: /scan
  reads QR codes through getUserMedia.
- **D9** — /docs is linked from the admin nav.
- **W22** — initiative decisions are emailed. People applied and heard nothing.

Database: packages/db/ddl/2026-08-08-drop-points.sql (D4).

Verified: typecheck, 420 tests, lint --max-warnings 0, build.

Both points from Greptile on #325.

**`checked_in` was reachable from any status.** D2 makes it an authorisation
state — submitting a project requires it — so setting it on somebody still
pending hands them the whole event with no review having happened. The
attendees screen offers "Select all N matching", so one wrong click could do
that to every applicant at once.

The single-participant path now refuses and names the remedy: accept them
first, then check them in. The batch path filters in the WHERE instead of
refusing whole, because a 2000-row selection with a few unreviewed applicants
in it should still admit everybody else — and it now reports how many rows it
skipped, so a check-in run that quietly did less than it looked like cannot
pass for a complete one.

**The CSP report cap was documentation, not a limit.** `await request.text()`
buffers the entire request before the length check runs, so the endpoint had
already accepted whatever was sent. Content-Length is checked first, and an
absent or unparseable one is refused: this endpoint is unauthenticated and a
browser sending a violation report always declares a length. The post-read
check stays, because Content-Length is the sender's claim rather than the truth.

The transition guard is mutation-tested.

Verified: typecheck, 423 tests, lint --max-warnings 0, build.