Capacity and waitlists are server-enforced. QR check-in is idempotent. Protected documents use the vault (no public URLs). Communications create notification intents — never browser-side provider calls.
COMMITTEES — membership / office terms / meetings
Membership uses relation documents. Office-bearer terms cannot overlap. Attendance scans are idempotent. Committee Admin sees masked member projections only — no religious/photo cells. Archival blocks new activity but preserves evidence.