doc: update bpn xml api reference

deploy.php

@@ -77,33 +77,31 @@ $rsyncOptions = [
     'timeout' => 300,
 ];
 
-// Shared by all hosts. The deploy path only differs by the host alias.
-set('deploy_path', '/usr/home/myepsf/public_html/{{alias}}');
+// Shared by all hosts.
 set('bin/php', '/usr/bin/php');
 set('http_user', 'myepsf');
 // Must stay here: contrib/rsync.php sets the same key, but its __DIR__ is the vendor dir.
 set('rsync_src', __DIR__);
 set('rsync', $rsyncOptions);
-// The web adapter fetches its probe file back through the live docroot, so --web-path must
-// be the current symlink, never {{release_or_current_path}}: that one resolves (and memoizes)
-// to the new release dir, which the FPM worker's realpath cache does not see yet.
-set('cachetool_args', '--web=SymfonyHttpClient --web-path={{current_path}}/public/ --web-url={{web_url}}');
 
 host('prod')
     ->setHostname('dedi10193.your-server.de')
+    ->setDeployPath('/usr/www/users/myepsf/prod')
     ->setRemoteUser('myepsf')
     ->setForwardAgent(true)
     ->setSshMultiplexing(true)
-    ->set('web_url', 'https://my.ep-reisen.de')
+    ->set('cachetool_args', '--web=SymfonyHttpClient --web-path={{current_path}}/public/ --web-url=https://my.ep-reisen.de')
 ;
 
 host('staging')
     ->setHostname('dedi10193.your-server.de')
+    ->setDeployPath('/usr/www/users/myepsf/staging')
     ->setRemoteUser('myepsf')
     ->setForwardAgent(true)
     ->setSshMultiplexing(true)
-    ->set('web_url', 'https://my.ep-reisen.net')
+    ->set('cachetool_args', '--web=SymfonyHttpClient --web-path={{current_path}}/public/ --web-url=https://my.ep-reisen.net --web-basic-auth=myep:staging')
     ->add('shared_files', [
+        'public/.htaccess',
         'public/.htpasswd',
     ])
 ;

docs/bpn-xml-api-reference.md

@@ -166,6 +166,18 @@ genuinely missing, which is a useful way to audit an address: the placeholder ac
 fails on `Telefon-Mobil` and `Nationalität` because its `Vorgang_Details` record has only
 `telefonprivat` and no `nationalitaet`.
 
+**Participants are held to less than the Anmelder** (measured 2026-09-16 on 2036, travel 12500, from a
+real step-3 `Anfrage`). Once a room is present, every `teilnehmer` needs a `Mail-Adresse`, children
+included: without `kommunikation` the answer is `650 … 1.Teilnehmer-Mail-Adresse, 2.Teilnehmer-Mail-Adresse`.
+`telefonmobil` and an empty `anschrift` pass for participants. An email identical to the Anmelder's is
+accepted. The field list above (Strasse, Plz, Ort, Telefon-Mobil for every participant) was measured on
+the placeholder records and is stricter than what BusPro applies to ordinary participants.
+
+**The Anmelder does not have to travel.** An `<anmelder>` that matches no `teilnehmer` (a parent booking
+for their children) returns `möglich` with the same price as the control where the Anmelder is
+`teilnehmer 1`. Whether the committed booking binds to the Anmelder's existing customer record has not
+been measured yet.
+
 Note `650` again: both of those are hard rejections delivered under the code
 `Notification::isError()` treats as success.
 
@@ -196,7 +208,7 @@ the same way. Ask `MOEGLICHEAENDERUNGEN` first (`<idreise>`), which answers:
 | `buchungsart` | yes | yes | Edit **hardcodes `Buchung`** (`ApiClient.php:233`) |
 | `status` | yes | yes | Edit replays the value read back from BusPro — see the caveat below |
 | `idreise`, `idpartner`, `idagentur` | yes | yes | `idpartner` sent unconditionally, even with no room |
-| `anmelder` | yes | yes | Create builds it from participant[0]; edit uses `PersonalData::toPayload()` |
+| `anmelder` | yes | yes | Create builds it from participant[0]; edit uses `PersonalData::toPayload()`. BusPro accepts an Anmelder who is not a participant |
 | `anmelder/bemerkung` | — | yes | Via `PersonalData::toPayload()` |
 | `teilnehmerliste` | yes | yes | |
 | `wünsche` (`unterbringungswunsch`, `beförderungswunsch`) | yes | yes | |