- Config 'Update', 'Commit Mission', lock, and clearupdate now use db.php
helpers with bound params (were injectable via ~20 raw $_GET values incl.
nummercs and playerid). Pod toggles collapsed into a 16-iteration loop.
- Commit Mission runs under the shared queue lock and one transaction so a
registration can't slip into the mission mid-commit.
- dev/migrations/002: pqs_currentmission + pqs_pastmissions -> InnoDB so the
commit's snapshot/archive roll back with the queue delete (uses DELETE not
TRUNCATE to stay in the transaction).
Verified: commit moves players to current/past, empties queue, marks completed
with nummercs; config update writes pods + settings; no errors.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
