## ADDED Requirements

### Requirement: A guest inherits its event's owner (P0)
Because a guest record belongs to exactly one event, who may see and change that guest SHALL
follow from who owns that event. A Host SHALL be able to add, list, view, edit, import and delete
guests under the events they own, and SHALL reach no guest under any other event. A Super Admin
SHALL reach every guest. A guest SHALL have no owner of its own — there is one answer, derived
from the event, so the two can never disagree.

#### Scenario: Host works within their event
- **WHEN** a Host opens an event they own and adds, edits or deletes a guest
- **THEN** the operation succeeds exactly as it would for a Super Admin

#### Scenario: Host reaches for a foreign guest
- **WHEN** a Host requests a guest by id who belongs to an event owned by someone else
- **THEN** the request is refused and the response is indistinguishable from a guest that does not exist

#### Scenario: Ownership moves with the event
- **WHEN** a Super Admin transfers an event to another Host
- **THEN** every guest under it becomes reachable by the new owner and unreachable by the old one, with no per-guest change

### Requirement: The cross-event guest list is scoped (P0)
The guest surface that spans events SHALL list only guests belonging to the caller's visible
events, and its filters SHALL offer only those events. Naming another event in a filter SHALL NOT
widen the result. Its total SHALL continue to be labelled as a count of guest records rather than
of people, and for a Host that total SHALL span their own events only.

#### Scenario: Host lists across events
- **WHEN** a Host opens the cross-event guest list
- **THEN** only guests of the events they own are returned, and the event filter offers only those events

#### Scenario: Filtering by a foreign event
- **WHEN** a Host filters the cross-event guest list by the id of an event they do not own
- **THEN** no guests are returned and no indication is given that the event exists

#### Scenario: Host's totals
- **WHEN** a Host sees a total on the cross-event guest list
- **THEN** it counts guest records across their own events only, and is labelled as records rather than people

### Requirement: Import and duplicate detection stay inside the event (P0)
Import SHALL be refused for an event outside the caller's visible set, at preview as well as at
commit, so a spreadsheet cannot be used to write into another owner's list or to probe it.
Duplicate detection SHALL continue to operate within the destination event only, which means a
Host SHALL never be told that a contact matches a guest of an event they cannot see.

#### Scenario: Import into a foreign event
- **WHEN** a Host uploads a CSV addressed at an event they do not own
- **THEN** neither the preview nor the commit is answered, and no rows are written

#### Scenario: Duplicate report does not leak
- **WHEN** a Host imports a contact who also exists under another owner's event
- **THEN** the row is accepted as new and the report makes no mention of the other event