updates from chat

MEMBER-NOTE-DELETION-2026-10-21.md

@@ -0,0 +1,14 @@
+# Administrative note deletion — October 21, 2026
+
+- Added a red Delete note action on each administrative note in the member summary. A confirmation modal shows the member and escaped note text, an irreversible-deletion warning, Confirm deletion, and Cancel.
+- Deletion is limited on the server to administrators of the selected club and Super Administrators. It requires CSRF, matching club/membership context, and a matching note version. Archived clubs remain read-only.
+- The service locks the club and selected private membership note, checks permissions again, and deletes only that note. A changed note requires reloading before deletion.
+- Deletion and its mandatory audit event share one database transaction. Audit failure rolls back deletion. The journal retains the actor, timestamp, IP, club, membership and deleted note identifiers, without retaining private note text. Repeated deletion returns not found without another deletion event.
+- Restricted the legacy global note deletion route to global User notes so it cannot bypass the private-note audit service.
+- Successful deletion returns to the member summary’s administrative notes section. No schema migration is required.
+
+Validation covers tenant and membership isolation, member restrictions, shared administrators, Super Administrator access, CSRF, wrong note types, stale confirmations, mandatory-audit rollback, duplicate requests, archived clubs, escaped previews, and browser Cancel/Confirm behavior. Regression suites cover existing notes, member actions, club browser flows, and deployment tooling.
+
+Validation result: all 161 targeted HTTP, browser, and deployment checks passed, plus source validation of 68 PHP files, 58 JavaScript files and 39 XSL stylesheets. The deletion suite contains 17 checks; browser coverage includes Cancel and Confirm deletion.
+
+Deployed four PHP files to development after saving previous copies under `.tools/deployment-backups/member-note-deletion-29e446be674741c5a06f6cfca23aa947`. Deployed hashes and a temporary protected server runtime probe passed; the probe was removed. No development database records were changed, and no migration was required. Disposable local databases were cleaned up and the local database server stopped.