Pre-alpha3 audit: refuse operator markup and scripted artwork on the place map, take the summary off its per-line reads, and put back the vocabulary, translations and docs the last 92 commits moved

The pre-release audit of 1.x since 1.0.0-alpha2, ahead of tagging 1.0.0-alpha3. 92 commits, 751 files, +81,811/-11,155, 29 shipped modules, 210 test classes and 1,152 test methods, no skipped test and no @todo left anywhere. Every job of the 1.x pipeline is green, including the five that are allowed to fail, so everything below is something tooling cannot see.

Security. Two operator-entered values reach the markup of the place map, a page every booker opens.

• The venue's sprite ids are an unconstrained 128-character string, shipped into the map document and written into an attribute in the browser, so a venue editor can close that attribute and add markup of their own. The two colour fields beside them already carry a pattern constraint whose comment reasons about exactly this door.
• The background illustration is an SVG in the public files directory and nothing inspects it, on either write path (the venue form, and the package importer, which replaces the file in place). A visitor opening that file's own URL runs whatever it carries in the site's origin.

Performance. The order summary is an N+1 in its slots, resources and tariffs: every line resolves its slot through the reference, every event asks that slot for its resource, and every ticket asks its own tariff. Measured with Database::startLog() around TransactionSummary::build(): 7 queries for one line, 22 for four, 62 for twelve. It renders on the cart, the order pages, the cancel screen, the payment step and both mail parts.

Accessibility. The pooled-area steppers on the place map set disabled when they reach a bound, so a keyboard user loses focus at the exact moment they reach the maximum. The map's own refresh control and the calendar's offer stepper both use aria-disabled for that stated reason.

Vocabulary. The selling words came back after they were swept out: 14 translatable strings and the resource field labelled Sells by tariff, introduced by the tariff work of 2026-08-05 and 2026-08-06. Half of what this engine books is free, so it does not sell anything.

Translations. 33 strings had no fr.po entry and 27 entries were orphaned, with not one empty msgstr, so a completeness check reads clean while the allotment and pinning screens, the retention settings, the venue-positions command and eight validation labels are all untranslated.

Documentation. docs/metrics.md was 92 commits stale (683 files and 72,118 lines against 1,015 and 109,705); twelve passages across eight pages described what the code used to do rather than what it does; the no-code page was in no navigation; and two shipped submodules were in no module map.

Also. A private method with no caller and a docblock still pointing at it; a branch in the map JavaScript injecting a payload key no PHP has emitted since the artwork became its own resource; five unused assignments in a test; 15 test classes without #[RunTestsInSeparateProcesses] where 195 carry it; and a suggest block naming three PHP libraries and none of the four Drupal projects the shipped submodules depend on.

Fixed in one merge request, as one release-preparation change.