Add event registration operations, attendance, exports, and change notifications

[alexeygrigorev]

Parent epic: #6

Normative spec: 05 — Event changes and Studio/API capabilities

Scope

Add PII-gated registration lookup/counts, reasoned correct/cancel/reactivate commands, formula-safe export, bounded attendance import/marking, asynchronous resumable/idempotent reschedule/cancellation/reminder/follow-up operations, ICS update/cancel sequence, preview/count/confirmation, progress/results, and full Studio/admin API parity/audit.

#111 adds a separate, dedicated named-sponsor opt-in export. It is scoped to one event/sponsor/statement version and contains only affirmative current email-share evidence plus the minimum audit columns; ordinary registration exports and answers never imply sponsor consent. #112 adds provider-neutral historical aggregate import, exact mapping/reconciliation, and public total operations without importing legacy attendee rows.

Public-attendee boundary

No management lookup or export becomes public. Public event pages unconditionally expose no attendee identity, card, name, initial, avatar, profile, directory, search, list, or export. #112 alone may expose the non-identifying exact aggregate N registered total after completeness/reconciliation succeeds. Imported source data, native identities, attendance state, marketing values, and ordinary answers remain private.

Non-goals

No marketing campaign, generic newsletter export/question, public attendee identity/directory/full list, unbounded synchronous send/export, or physical deletion of events/registrations with history.

Acceptance criteria

• Event change operation snapshots audience/revision, increments calendar sequence, and creates exactly one correct update/cancel delivery per active registration.
• Bulk work is resumable/idempotent/rate-aware, supports documented cancellation, and exposes per-row safe errors/counts.
• PII/export/attendance/change permissions are distinct; support role sees masked data by default.
• CSV prevents spreadsheet formula execution and export/PII access is audited.
• Add configurable event registration questions and sponsor consent #111 sponsor export returns only exact affirmative event/sponsor/version evidence and excludes every ordinary answer, negative/missing/revoked choice, newsletter state, and unrelated PII.
• Import historical registration totals safely and show aggregate event counts #112 public total consumes only its safe aggregate/native/replacement query, cannot double-count a coverage slot, and cannot expose registration lookup/export data or attendee identity.
• Studio/API parity covers all capabilities, stale edits, partial failure, and high-risk confirmation.

Test scenarios

1. Reschedule/cancel replay, worker crash mid-batch, audience changes, stale event revision, repeated ICS, and operation resume.
2. Authorized/denied/masked PII, malicious CSV values, bounded import duplicates/unknowns/partial errors.
3. Event with no/one/many registrations and already-cancelled/no-show states.
4. Sponsor export missing/negative/affirmative/revoked/stale evidence and public-total zero/one/many/incomplete/historical-native-replacement cases; prove no public identity or full-list path.

Playwright

In Studio inspect masked/full registration views by role, preview/export/attendance import, start/resume change operation, inspect progress/results, confirm/cancel, and capture desktop/mobile screenshots. #111 owns sponsor export; #112 owns aggregate mapping/import/reconciliation and count-only public output with the same parity/redaction boundary.

Dependencies

Depends on #28, #32, #33, #45, #46, and #49–#50. Sponsor-export integration depends on #111. #112 aggregate ingestion may proceed against #105's accepted checked event identity; native-count integration consumes this issue's protected registration operations when available without blocking the aggregate slice.

[alexeygrigorev]

PM Contract Addendum — #111/#112 reconciliation

#111 sponsor exports are exact event+sponsor+statement scoped and contain only affirmative current email-share evidence; ordinary answers and newsletter state never imply consent. #112 public proof cannot consume registration lookup/export data and exposes only a safe aggregate count plus at most three individually opted-in cards. There remains no public attendee directory/search/full list/export or generic newsletter export/question.

Existing PII masking, formula safety, confirmation, audit, resumability, and Studio/admin API parity remain unchanged.

[alexeygrigorev]

Grooming Addendum — count-only public boundary

Aligned operations with the owner-approved aggregate-only #112 contract.

No management lookup/export or attendee identity becomes public. #112 may expose only an exact reconciled N registered total, with provider/native/replacement coverage counted once. Historical aggregation can proceed against #105's checked event identity; later native integration consumes protected #46/#47 state without importing or exposing legacy attendee rows.