[Shaan-Shoukath]

Summary

Release 0.11.0: the third Yuyu sync at full parity, the Space Works hackathon suite (judging rounds, Mentor Desk, volunteer shifts, multi-stage admission, per-stage reimbursements), the mobile API for a future Space Works app, and the in-app guide at /help.

This PR also carries the 35 commits that were already on local dev before this work started: paid teams, event finance and the ticket designer, with their review fixes.

Every branch was built from dev, independently reviewed, fixed, and merged locally. A final seven-track audit followed, and its findings were fixed. Planning and decisions are in docs/plans/yuyu-sync-3.md.

Features

Yuyu parity (sync 3). All 44 Yuyu commits since sync 2 are ported or reviewed. The weekly check reports 0 pending, and a structural re-diff of the schema, routes, actions, mobile API, help, outbox, webhooks and environment found nothing missing.

• Outbox drain and priority fixes.
• Real 404s on dashboard pages.
• no-store and no-referrer on signed-in and token pages.
• A Redis command deadline.
• DST-safe times.
• Faster queries for large hackathons.
• Streamed CSV exports.
• Hackathon email switches.
• Event crew.
• Attendance confirmation.

Event crew.

• Crew tickets are free and stay outside capacity, payment holds and teams.
• Crew have a join link, a public section, check-in details, ID badges, designed tickets and crew expense claims.

Attendance confirmation.

• Guests get an "Are you still coming?" email and the /attend page, plus reminders and share links.
• A "No" on a paid place follows the refund policy, opens a refund request once the policy window has closed, or is held for the organiser.

Judging rounds (Space Works design).

• Several rounds, each with its own rubric and judge panel.
• Judges are assigned balanced or with seeded random assignment (preview, apply, re-roll), with optional fresh eyes.
• A round can be finalised with an exception reason, which freezes its counted reviews.
• Finalists advance and are published; awards come only from final-round finalists.
• Judges can recuse themselves.
• Single-round events behave as before: the planner output is byte-identical.

Mentor Desk (Space Works design).

• MENTOR role with the staff authenticator check.
• A help queue with leases and expiry.
• Assignments per mentoring round: manual, round-robin, skill match or seeded random.
• Conflicts carry over into judging.
• Office hours, mentoring rounds and private nominations.

Volunteer shifts (Space Works design).

• Shifts with a waitlist and approval.
• Shift attendance kept separate from event check-in.
• Hours verified by a second person.
• Contributor certificates.

Multi-stage admission (any event, free or paid).

• Stages, each with its own reviewer panel and seeded assignment.
• Decision batches, then offers with a respond-by date.
• "Accept & pay": a place is never confirmed unpaid, and on teams the leader pays.
• FIFO waitlist promotion; applications are retained and private.

Per-stage reimbursements.

• Policies for judging rounds, mentoring rounds, admission stages (accepted applicants only), crew (by kind) and confirmed participants.
• Per-person caps, budgets and claim windows.
• Terms are frozen at submission and eligibility is re-checked at approval.

Mobile API (/api/mobile/v1; the app itself is not built yet).

• A Yuyu-compatible base with sign-in protections and staff MFA.
• Paid tickets, orders, claims, entry fees, prizes, check-in lists, crew, attendance, rounds, the Mentor Desk, volunteers, admission and reimbursements.
• Idempotent writes with path-bound keys, and bounded request bodies.
• An OpenAPI contract with drift tests.

In-app guide /help.

• About 130 articles, rewritten for Space Works.
• Search, role-gated sections and screenshots.

Decisions (owner)

• Port everything from Yuyu, plus the Space Works extras, following the Space Works design for mentors, judging and volunteers.
• Admission works on any event, free or paid; paid teams are leader-pays only.
• Reimbursements are per stage across all stage types; admission-stage policies pay accepted applicants only.
• Every stage has organiser-chosen people, with reproducible random assignment.
• docs/manual is kept unchanged.
• The authenticator check is required for every staff grant.

Deferred (in docs/FUTURE_PHASES.md): per-member team payment, the award/reservation reimbursement flow, the native apps, and a Google mobile nonce.

Split-hosting fix found by CI (please review). In split hosting, a page render reads a dozen or more views from the API, and each read counted against the visitor's 300/min global API limit. A few quick dashboard changes then broke the page. The website's authenticated view reads (gateway key checked) now skip that bucket, as a single-server render does. Peer actions and every other API request keep their limits (proxy.ts, docs/DEPLOYMENT_SPLIT.md, unit-tested). The remaining CI fixes were test-only:

• the trusted client-IP header and Origin on direct API posts in the new e2e specs;
• stale headings and button names;
• integration tests kept off CI's S3/SMTP;
• Playwright traces uploaded on failure.

Before merging (action required)

1. Reserved organisation slugs. Run this on production:

   SELECT slug FROM "Organisation" WHERE lower(slug) IN ('attend','crew','help','order','submit','team','verify-mfa');

   Rename any matches first. See docs/production-operations.md, "Reserved organisation addresses".
2. Judging rounds migration. Close judging, or use the Recreate strategy, while upgrading an instance that is already judging.
3. Hackathon emails default to off for existing events.
4. MFA_ENCRYPTION_KEY must be identical on every replica. It now also keys mobile idempotency and payment return links.
5. Merging bumps VERSION to 0.11.0, which publishes release images.

Checks

Run locally on dev at the head of this PR (Windows 11, Node 24):

Check	Result
npm run lint, npx next typegen && npx tsc --noEmit	0 errors
npm run test:unit	2804 passed. The only failures are the known Windows-only vps-installer and docker-entrypoint tests (they pass on Linux CI), plus a load timeout in check-production-env that passes when run alone
npm run test:integration, on a database migrated from scratch	807 / 807 (142 files)
prisma migrate deploy → db:verify → reserved-slug check	pass. Schema drift against the migrations: none
npm run build and npm run build:frontend (split frontend, no database/mail/Redis/storage code)	pass
Frontend catalog and help index --check	verified (120 views, 380 actions)
e2e (dev server): public smoke, dashboard 404s, help, help gating, series going count, crew, attendance	28/29 on a cold dev server. The one miss was a help article's first compile exceeding a 5 s expectation; it passed 4/4 on a warm re-run
Yuyu weekly-check logic	0 pending

The full e2e suite (including the payment specs and test:e2e:production) was not run locally because of memory limits on this machine. CI runs it.

Every branch was independently reviewed before merging. The final audit covered decisions, Yuyu parity, the end-to-end hackathon flow, Mentor Desk, judging, money, security/privacy/tenancy and deploy safety; all of its findings were fixed in fix/audit-* and chore/deploy-hardening.

🤖 Generated with Claude Code