[arrzdev]

What and why

The invite API (invite.routes.ts, invite.service.ts) was only tested as a side section of game.routes.test.ts, with nothing on who may see, decline or delete an invite. A change to those rules could reach a deploy without a failing test.

• invite.routes.test.ts (Workers pool, real local D1): every route's success path, 401 without a session, 400 on a bad body or id, and the permission cases. A stranger does not see the invite in their list and gets not_found on decline and delete. The sender gets not_found when declining their own invite, and the recipient gets not_found when deleting one sent to them. Each refusal also checks the invite is unchanged. Also covers inviting yourself (invite_self), a handle nobody holds (player_not_found), a second invite while one is pending (invite_exists, 409), asking again after a decline (same row, back to pending) and inviting back in the other direction (allowed).
• The existing invite tests move out of game.routes.test.ts into the new file. The game file keeps its invite helper for opening games.
• invite.service.test.ts covers what HTTP cannot reach: findAddressedTo and discard (called only by the acceptance facade), and D1 failing at each step of a send, using a local D1 proxy that fails from the nth query.

No permission bug found, and no production code changes.

Line coverage from test:coverage:

File	Before	After
invite.service.ts	87.5% (49/56), branches 71.87%	100% (56/56), branches 96.87%
invite.routes.ts	100% (22/22)	100% (22/22)
All files	95.15% lines	96.02% lines

How to verify

cd apps/backend
pnpm exec vitest run src/http/routes/invite.routes.test.ts src/services/invite.service.test.ts
pnpm test:coverage

Ran the two new files 10 times in a row: 45/45 passed every time.

[arrzdev]

Approve. Checked against the task's list: each route has success, 401 and 400 cases, plus every permission case (stranger, sender declining their own invite, recipient deleting). Each refusal also checks the invite is unchanged. Service tests reach only what HTTP can't. Ran both files 10 times in a row: 45/45 passed every run.