@@ -5,7 +5,14 @@ import { getAuthenticatedUser } from '@/lib/auth-server';
 import { paymentProofExists } from '@/lib/payment-proofs';
 import { ambassadorGuardError, findOwnAmbassador, resolveReferralCode, type Registrant } from '@/lib/ambassadors';
 import { registrationsClosedResponse, registrationsOpen } from '@/lib/registration-gate';
-import { isDuplicatePhoneError, PHONE_IN_USE_ERROR_MESSAGE } from '@/lib/validation';
+import {
+  isDuplicatePhoneError,
+  isIterSoaCollege,
+  isIterSoaEmail,
+  isIterSoaRefusal,
+  ITER_SOA_ERROR_MESSAGE,
+  PHONE_IN_USE_ERROR_MESSAGE,
+} from '@/lib/validation';
 import { ATTEMPTS_USED_UP_ERROR, attemptsLeft, isAttemptsUsedUpError } from '@/lib/rejections';
 import {
   classifyStudentType,
@@ -193,6 +200,12 @@ export async function POST(req: NextRequest) {
     const input = parsed.data;
     const college = input.college;
 
+    // ITER - SOA students may not register: by the college they type or by an ITER / SOA email. The database refuses
+    // them too (trg_refuse_iter_soa_registration, supabase/schema.sql section 18).
+    if (isIterSoaCollege(college) || isIterSoaEmail(verifiedEmail)) {
+      return NextResponse.json({ error: ITER_SOA_ERROR_MESSAGE, field: 'college' }, { status: 403 });
+    }
+
     const adminClient = getSupabaseAdmin(token);
 
     // 3. Prevent duplicate registrations for the same authenticated user. A rejected one doesn't count: the user may
@@ -305,6 +318,9 @@ export async function POST(req: NextRequest) {
       if (isAttemptsUsedUpError(regError)) {
         return NextResponse.json({ error: ATTEMPTS_USED_UP_ERROR }, { status: 403 });
       }
+      if (isIterSoaRefusal(regError)) {
+        return NextResponse.json({ error: ITER_SOA_ERROR_MESSAGE, field: 'college' }, { status: 403 });
+      }
       if (regError.code !== '23505') break;
       // Unique violation on utr: another registration claimed this UTR between the pre-check and the insert (possibly
       // this user's own concurrent submit, when the UTR index is checked before the user_id index).
 
@@ -9,6 +9,7 @@ import { Logo } from './icons';
 import EntryPassCard from './EntryPassCard';
 import SeatCounter from './SeatCounter';
 import styles from './AuthOverlay.module.css';
+import { isIterSoaCollege, isIterSoaEmail, ITER_SOA_ERROR_MESSAGE } from '@/lib/validation';
 
 /* ── Payment QR lightbox state lives here, outside JSX ── */
 
@@ -17,6 +18,7 @@ export default function AuthOverlay({ v }: { v: V }) {
   useDialogFocus(v.authHidden === 'false', dialog, v.closeAuthH);
   const [userCollege, setUserCollege] = useState<string | null>(null);
   const collegeValue = userCollege !== null ? userCollege : (v.regVals?.college || '');
+  const isIterSoa = isIterSoaCollege(collegeValue) || isIterSoaEmail(v.regVals?.email);
   const [payQrOpen, setPayQrOpen] = useState(false);
   return (
     <>
@@ -91,6 +93,10 @@ export default function AuthOverlay({ v }: { v: V }) {
 
                     <div style={{ display: v.d.s0, flexDirection: "column", gap: "20px" }}>
                       <h3 data-s-in="" style={{ margin: "0 0 4px", fontFamily: "var(--font-display)", fontWeight: "400", fontSize: "clamp(24px,2.2vw,32px)", lineHeight: "1.1" }}>Your details</h3>
+                      <p data-s-in="" role="note" style={{ display: "flex", alignItems: "flex-start", gap: "10px", margin: "-4px 0 0", padding: "12px 14px", border: "1px solid rgba(239,68,68,.55)", background: "rgba(239,68,68,.1)", fontSize: "14px", lineHeight: "1.45", color: "#fca5a5", overflowWrap: "anywhere" }}>
+                        <svg viewBox="0 0 16 16" aria-hidden="true" style={{ flex: "none", width: "16px", height: "16px", marginTop: "1px" }}><circle cx="8" cy="8" r="6.5" fill="none" stroke="currentColor" strokeWidth="1.5"></circle><path d="M3.5 12.5l9-9" stroke="currentColor" strokeWidth="1.5"></path></svg>
+                        <span>Students of ITER / SOA (Siksha &lsquo;O&rsquo; Anusandhan) are not allowed to register.</span>
+                      </p>
                       {v.gNote ? (
                         <p data-s-in="" role="status" style={{ display: "flex", alignItems: "flex-start", gap: "10px", margin: "-4px 0 0", padding: "12px 14px", border: "1px solid rgba(236,232,223,.18)", background: "rgba(236,232,223,.04)", fontSize: "14px", lineHeight: "1.45", color: "rgba(236,232,223,.86)", overflowWrap: "anywhere" }}>
                           <svg viewBox="0 0 16 16" aria-hidden="true" style={{ flex: "none", width: "16px", height: "16px", marginTop: "1px", color: "oklch(0.78 0.075 85)" }}><path d="M3 8.5 6.5 12 13 4.5" fill="none" stroke="currentColor" strokeWidth="2"></path></svg>
@@ -143,7 +149,7 @@ export default function AuthOverlay({ v }: { v: V }) {
                           }}
                           style-focus="border-color:oklch(0.78 0.075 85);background:rgba(236,232,223,.08)"
                         />
-                        {v.err.college ? (<span role="alert" style={{ fontSize: "14px", lineHeight: "1.4", color: "oklch(0.76 0.14 35)" }}>{v.err.college}</span>) : null}
+                        {v.err.college || isIterSoa ? (<span role="alert" style={{ fontSize: "14px", lineHeight: "1.4", color: "oklch(0.76 0.14 35)" }}>{isIterSoa ? ITER_SOA_ERROR_MESSAGE : v.err.college}</span>) : null}
                       </label>
                       <label data-s-in="" style={{ display: "flex", flexDirection: "column", gap: "8px" }}>
                         <span style={{ fontSize: "12px", fontWeight: "700", letterSpacing: ".16em", color: "rgba(236,232,223,.86)" }}>EMAIL</span>
 
@@ -59,7 +59,7 @@ import { fetchSeatCount, SEATS_FULL_MESSAGE } from '@/lib/seats';
 import { AMBASSADOR_FORM_URL, AMBASSADOR_SECTION } from '@/config/ambassador';
 import { REGISTRATION_FEE, UPI_ID, UPI_PAY_LINK, UPI_QR_SRC } from '@/config/payment';
 import { SKIP_INTRO_KEY } from '@/components/coming-soon/SkipIntroOnReturn';
-import { isValidGoogleDriveUrl, GENDER_OPTIONS as GENDERS, normalizeReferralCode, isReferralCode, formatReferralCode, REFERRAL_CODE_FORMAT_ERROR } from '@/lib/validation';
+import { isValidGoogleDriveUrl, GENDER_OPTIONS as GENDERS, normalizeReferralCode, isReferralCode, formatReferralCode, REFERRAL_CODE_FORMAT_ERROR, isIterSoaCollege, isIterSoaEmail, ITER_SOA_ERROR_MESSAGE } from '@/lib/validation';
 import { httpErrorMessage, isTransientFailure } from '@/lib/api-errors';
 
 gsap.registerPlugin(ScrollTrigger, ScrambleTextPlugin);
@@ -2590,6 +2590,8 @@ export class Innovision extends Component<Props, State> {
         err.college = 'Which college are you from?';
       } else if (college.length > 200) {
         err.college = 'Keep the college name under 200 characters.';
+      } else if (isIterSoaCollege(college) || isIterSoaEmail(email)) {
+        err.college = ITER_SOA_ERROR_MESSAGE;
       }
       if (!/^[6-9]\d{9}$/.test(phone)) err.phone = 'Use a 10-digit Indian mobile number.';
       if (!enrollment_no) err.enrollment_no = 'Enter your college roll / enrollment number.';
 
@@ -2,6 +2,46 @@
  * Client & Server safe validation utilities for Innovision 2026.
  */
 
+export const ITER_SOA_ERROR_MESSAGE =
+  "Students of ITER / SOA (Siksha 'O' Anusandhan) are not allowed to register for Innovision 2026.";
+
+/** Whole words: ITER, SOA, SOAU, and the same spelt out with dots or spaces (I.T.E.R., S O A). */
+const ITER_SOA_WORD = /(^| )(iter|soa|soau|i t e r|s o a|s o a u)( |$)/;
+
+/**
+ * With spaces and punctuation gone: ITER-SOA / SOA ITER, Institute of Technical Education (and/&) Research, and
+ * Siksha 'O' Anusandhan however it is spelt (Shiksha, Sikha, O or no O, Anushandhan, Anusandhaan).
+ */
+const ITER_SOA_COMPACT = /itersoa|soaiter|technicaleducationa?n?d?research|sh?ik?s?h?a+o?a*nush?andh?a+n/;
+
+/**
+ * True when a college name is ITER (Institute of Technical Education and Research) or SOA (Siksha 'O' Anusandhan),
+ * whatever the case, spelling, punctuation, accents or full-width letters. Must match public.is_iter_soa_college in
+ * supabase/schema.sql (section 18).
+ */
+export function isIterSoaCollege(college: string | null | undefined): boolean {
+  if (typeof college !== 'string') return false;
+  // "I.T.E.R., S.O.A" -> "i t e r s o a"
+  const spaced = college
+    .normalize('NFKD')
+    .replace(/[\u0300-\u036f]/g, '')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, ' ')
+    .trim();
+  return ITER_SOA_WORD.test(spaced) || ITER_SOA_COMPACT.test(spaced.replace(/ /g, ''));
+}
+
+/** True for an ITER / SOA email address (@soa.ac.in, @iter.ac.in and their subdomains). */
+export function isIterSoaEmail(email: string | null | undefined): boolean {
+  if (typeof email !== 'string') return false;
+  return /@([a-z0-9-]+\.)*(soa|iter)\./.test(email.trim().toLowerCase());
+}
+
+/** The database refused a registration as ITER / SOA (trg_refuse_iter_soa_registration in supabase/schema.sql). */
+export function isIterSoaRefusal(err: { message?: string } | null | undefined): boolean {
+  return /ITER \/ SOA registrations are not allowed/i.test(err?.message ?? '');
+}
+
 export const PHONE_IN_USE_ERROR_MESSAGE =
   'This phone number is already linked to another account. Please use a different number.';
 
 
@@ -0,0 +1,55 @@
+-- ==============================================================================
+-- MIGRATION (run once in the Supabase SQL editor): ITER - SOA students may not register.
+--
+-- Why: ITER (Institute of Technical Education and Research) and SOA (Siksha 'O' Anusandhan) students are not allowed
+-- at Innovision 2026. /api/register and the form refuse them by the college they type (any case or spelling: ITER,
+-- I.T.E.R., iter-soa, SOA University, Shiksha O Anushandhan...) or by an @soa. / @iter. email; this makes the
+-- database refuse them too, whoever inserts (the service role included).
+-- This adds section 18 of supabase/schema.sql: public.is_iter_soa_college and trg_refuse_iter_soa_registration.
+-- No existing row changes: registrations made before the ban stay, and staff can still confirm or reject them.
+--
+-- Run it before or after deploying the code: either refuses ITER - SOA on its own.
+-- Kept out of supabase/migrations/ on purpose so the Supabase CLI never applies it automatically. Safe to re-run.
+-- ==============================================================================
+
+-- Students of ITER (Institute of Technical Education and Research) and SOA (Siksha 'O' Anusandhan) may not register.
+-- True for any spelling of either name, whatever the case or punctuation: ITER, I.T.E.R., iter-soa, SOA University,
+-- Institute of Technical Education & Research, Shiksha O Anushandhan... Must match isIterSoaCollege in
+-- src/lib/validation.ts.
+CREATE OR REPLACE FUNCTION public.is_iter_soa_college(p_college TEXT) RETURNS BOOLEAN AS $$
+DECLARE
+  v_spaced TEXT;
+BEGIN
+  IF p_college IS NULL THEN
+    RETURN FALSE;
+  END IF;
+  -- "I.T.E.R., S.O.A" -> "i t e r s o a": accents and full-width letters folded, everything but a-z and 0-9 a space.
+  v_spaced := btrim(regexp_replace(
+    lower(regexp_replace(normalize(p_college, NFKD), '[\u0300-\u036f]', '', 'g')) COLLATE "C",
+    '[^a-z0-9]+', ' ', 'g'
+  ));
+  RETURN v_spaced ~ '(^| )(iter|soa|soau|i t e r|s o a|s o a u)( |$)'
+      OR replace(v_spaced, ' ', '') ~ '(itersoa|soaiter|technicaleducationa?n?d?research|sh?ik?s?h?a+o?a*nush?andh?a+n)';
+END;
+$$ LANGUAGE plpgsql IMMUTABLE SET search_path = public;
+
+-- Refuses a registration from ITER - SOA, by its college or by an ITER / SOA email (@soa.ac.in, @iter.ac.in and their
+-- subdomains, as isIterSoaEmail), whoever inserts: /api/register (service role) included. Registrations made before
+-- the ban stay, and staff can still confirm or reject them: only a new row, or a change to its college or email, is
+-- checked. /api/register looks for this message.
+CREATE OR REPLACE FUNCTION public.refuse_iter_soa_registration() RETURNS TRIGGER AS $$
+BEGIN
+  IF public.is_iter_soa_college(NEW.college) OR lower(btrim(COALESCE(NEW.email, ''))) ~ '@([a-z0-9-]+\.)*(soa|iter)\.' THEN
+    RAISE EXCEPTION 'ITER / SOA registrations are not allowed' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SET search_path = public;
+
+DROP TRIGGER IF EXISTS trg_refuse_iter_soa_registration ON public.registrations;
+CREATE TRIGGER trg_refuse_iter_soa_registration
+  BEFORE INSERT OR UPDATE OF college, email ON public.registrations
+  FOR EACH ROW EXECUTE FUNCTION public.refuse_iter_soa_registration();
+
+-- Internal: only the trigger above uses it.
+REVOKE EXECUTE ON FUNCTION public.refuse_iter_soa_registration() FROM PUBLIC, anon, authenticated, service_role;
@@ -80,7 +80,8 @@ CREATE INDEX IF NOT EXISTS idx_registrations_user_id ON public.registrations(use
 CREATE INDEX IF NOT EXISTS idx_registrations_status ON public.registrations(status);
 CREATE INDEX IF NOT EXISTS idx_registrations_reg_id ON public.registrations(registration_id);
 
--- ITER - SOA students may register: drops the college CHECK that used to refuse them, on databases that still have it.
+-- The old ITER - SOA college CHECK: trg_refuse_iter_soa_registration (section 18) refuses them now, without blocking
+-- staff from reviewing a registration made before the ban.
 ALTER TABLE IF EXISTS public.registrations DROP CONSTRAINT IF EXISTS registrations_no_iter_soa;
 
 
@@ -1751,3 +1752,49 @@ CREATE TRIGGER trg_guard_registration_attempts
 -- Internal: only the triggers above use these.
 REVOKE EXECUTE ON FUNCTION public.move_registration_counter() FROM PUBLIC, anon, authenticated, service_role;
 REVOKE EXECUTE ON FUNCTION public.guard_registration_attempts() FROM PUBLIC, anon, authenticated, service_role;
+
+
+-- ==============================================================================
+-- 18. NO ITER - SOA REGISTRATIONS
+-- ==============================================================================
+-- Students of ITER (Institute of Technical Education and Research) and SOA (Siksha 'O' Anusandhan) may not register.
+-- True for any spelling of either name, whatever the case or punctuation: ITER, I.T.E.R., iter-soa, SOA University,
+-- Institute of Technical Education & Research, Shiksha O Anushandhan... Must match isIterSoaCollege in
+-- src/lib/validation.ts.
+CREATE OR REPLACE FUNCTION public.is_iter_soa_college(p_college TEXT) RETURNS BOOLEAN AS $$
+DECLARE
+  v_spaced TEXT;
+BEGIN
+  IF p_college IS NULL THEN
+    RETURN FALSE;
+  END IF;
+  -- "I.T.E.R., S.O.A" -> "i t e r s o a": accents and full-width letters folded, everything but a-z and 0-9 a space.
+  v_spaced := btrim(regexp_replace(
+    lower(regexp_replace(normalize(p_college, NFKD), '[\u0300-\u036f]', '', 'g')) COLLATE "C",
+    '[^a-z0-9]+', ' ', 'g'
+  ));
+  RETURN v_spaced ~ '(^| )(iter|soa|soau|i t e r|s o a|s o a u)( |$)'
+      OR replace(v_spaced, ' ', '') ~ '(itersoa|soaiter|technicaleducationa?n?d?research|sh?ik?s?h?a+o?a*nush?andh?a+n)';
+END;
+$$ LANGUAGE plpgsql IMMUTABLE SET search_path = public;
+
+-- Refuses a registration from ITER - SOA, by its college or by an ITER / SOA email (@soa.ac.in, @iter.ac.in and their
+-- subdomains, as isIterSoaEmail), whoever inserts: /api/register (service role) included. Registrations made before
+-- the ban stay, and staff can still confirm or reject them: only a new row, or a change to its college or email, is
+-- checked. /api/register looks for this message.
+CREATE OR REPLACE FUNCTION public.refuse_iter_soa_registration() RETURNS TRIGGER AS $$
+BEGIN
+  IF public.is_iter_soa_college(NEW.college) OR lower(btrim(COALESCE(NEW.email, ''))) ~ '@([a-z0-9-]+\.)*(soa|iter)\.' THEN
+    RAISE EXCEPTION 'ITER / SOA registrations are not allowed' USING ERRCODE = '23514';
+  END IF;
+  RETURN NEW;
+END;
+$$ LANGUAGE plpgsql SET search_path = public;
+
+DROP TRIGGER IF EXISTS trg_refuse_iter_soa_registration ON public.registrations;
+CREATE TRIGGER trg_refuse_iter_soa_registration
+  BEFORE INSERT OR UPDATE OF college, email ON public.registrations
+  FOR EACH ROW EXECUTE FUNCTION public.refuse_iter_soa_registration();
+
+-- Internal: only the trigger above uses it.
+REVOKE EXECUTE ON FUNCTION public.refuse_iter_soa_registration() FROM PUBLIC, anon, authenticated, service_role;