Harden production route validation and persistence

[charlesrhoward]

Summary

• Reject malformed or injected route payloads and surface failed ownership or persistence checks instead of reporting success.
• Make team invite acceptance a single transactional claim so concurrent callers cannot create ambiguous membership state.
• Enforce request-wide attachment limits in Control chat.

Privacy and compatibility

No account-specific data or hosted-service diagnostics are included. Successful response shapes stay compatible; malformed input and backend failures now return explicit 4xx or 5xx responses. The invite transaction is added to both supported migration ledgers.

Verification

• Full fast, unit, and database suites
• Lint with zero errors
• Production build
• Focused unit, database migration, and type checks after rebasing onto current main

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[mogplex]

Mogplex PR Review

Status: Attention needed

The route and persistence hardening is generally well-structured, and the atomic invite claim is backed by useful concurrency/rollback coverage. One correctness gap remains in Control chat attachment validation: malformed base64 payloads can still pass the new validator, so this needs changes before approval.

1 finding was added inline.

View check run

[mogplex]

Mogplex PR Review

Status: No material issues found

Summary: The PR is approve-ready. Route payloads are allowlisted or structurally validated, persistence failures are surfaced instead of silently succeeding, and attachment limits are enforced across the full Control chat request.

Critical issues: None found.

Warnings: None found. The atomic invite migration is present in both migration ledgers and includes a row lock, transactional membership creation, single-use claiming, and restricted function execution. The added unit and database tests cover malformed input, backend failures, migration parity, and competing invite claimants.

Verdict: ✅ APPROVE — No material security, correctness, architecture, performance, or testing issues found in the submitted changes.

View check run